What this endpoint does

Retrieves supplementary detection rules from a threat prevention profile. Prevention profiles primarily provide block list indicators — most have no associated rules, so an empty response is normal. For the block list (the primary output), use Threat Prevention: Get Profile Indicators. First discover profile UUIDs via Threat Prevention: Query Profiles. At least one rule type required in filter.types: sigma, snort, yara, yaral, kql, fql, s1ql.

Response data

Returns detection rules ready for deployment into your security tooling — each rule's content field contains the complete rule text (Sigma YAML, Snort signature, YARA rule, etc.) that can be directly ingested by the corresponding platform. Rules are sourced from Insikt Group research and tagged with MITRE ATT&CK techniques for prioritization. An empty response is expected for most prevention profiles since they primarily operate through indicator block lists rather than detection rules. Filter by rule type to match your security stack — request only sigma for SIEM deployments or snort for network IDS.