What this endpoint does

Retrieves detection rules associated with a threat prevention profile, filtered by rule format. While prevention profiles primarily curate indicator-based block lists (available via the Get Profile Indicators endpoint), some profiles also include detection rules in formats like Sigma, Snort, YARA, and others for complementary threat detection alongside blocking. You must specify at least one rule type in filter.types — supported formats include sigma, snort, yara, yaral, kql, fql, and s1ql. An empty result does not indicate an error — many prevention profiles operate solely through indicators without associated detection rules. Use the Query Profiles endpoint with your enterprise ID to discover available prevention profile IDs.

Response data

Returns an array of detection rule objects, each containing the rule's identifier, display name, rule format type, associated MITRE ATT&CK techniques, and the complete deployable rule content in the content field. Each rule includes a noteId linking it to the source Recorded Future analyst note. The response may be empty if the prevention profile focuses exclusively on indicator-based blocking without supplementary detection rules.