Fetch detection rules from a threat hunt job scoped to its time window.
What this endpoint does
Retrieves detection rules from a specific threat hunt job — a point-in-time snapshot, not the profile's current live rule set. Part of the async hunting workflow: (1) poll Threat Hunting: Get Pending Jobs, (2) update to "started" via Threat Hunting: Update Job Status, (3) fetch rules here and/or indicators via Threat Hunting: Get Job Indicators, (4) mark "completed" or "failed". At least one rule type must be specified in filter.types: sigma, snort, yara, yaral, kql, fql, s1ql.
Response data
Returns detection rules scoped to the hunt job's time window — ready to deploy into your SIEM, IDS, or endpoint platform. Each rule's content contains the complete deployable rule text (Sigma YAML, Snort signatures, YARA rules, etc.) sourced from Insikt Group research during the job's lookback period. Rules are tagged with MITRE ATT&CK techniques to help prioritize which hunts to run first. Filter by rule type to match your security stack. Returns 404 if the job ID doesn't exist.