What this endpoint does

Retrieves detection rules from a specific threat hunt job — a point-in-time snapshot, not the profile's current live rule set. Part of the async hunting workflow: (1) poll Threat Hunting: Get Pending Jobs, (2) update to "started" via Threat Hunting: Update Job Status, (3) fetch rules here and/or indicators via Threat Hunting: Get Job Indicators, (4) mark "completed" or "failed". At least one rule type must be specified in filter.types: sigma, snort, yara, yaral, kql, fql, s1ql.

Response data

Returns detection rules scoped to the hunt job's time window — ready to deploy into your SIEM, IDS, or endpoint platform. Each rule's content contains the complete deployable rule text (Sigma YAML, Snort signatures, YARA rules, etc.) sourced from Insikt Group research during the job's lookback period. Rules are tagged with MITRE ATT&CK techniques to help prioritize which hunts to run first. Filter by rule type to match your security stack. Returns 404 if the job ID doesn't exist.

200Detection rules for this profile

404Threat hunt job not found