COcotool
Detections

Add a detection library entry

Creates an org-owned detection from the entry, publishes its notebook as version 1, and enables the entry's default schedule.

post/api/detection-library/{slug}/add

Request

  • Base URL
    https://app.cotool.ai
  • Auth
    HTTP bearer

Path parameters

slugstring required

Response

Successful response

idstring uuid required
chatIdstring uuid nullable required

Caller-owned editor chat on detail responses; always null in catalog rows

revisionstring required
namestring nullable required
summarystring nullable required

1–3 sentence plain-prose headline of what the detection is meant to detect. No bullet lists.

howItWorksstring nullable required

How the detection works, as operational GitHub-flavored markdown: typically two or three bullets covering the signal it watches and the condition that fires

toolNamesstring[] required
mitreTechniqueIdsstring[] required
metadataStatus'pending' | 'ready' | 'failed' required
librarySlugstring nullable required

Library entry this detection was installed from, when any: a detection library slug for alert detections, a streaming detection library slug for streaming detections

outputKind'alerts' | 'signals' required
executionMode'batch' | 'streaming' required
managedboolean required

Cotool owns the logic and keeps it current with its library entry; the org can enable or disable it but not edit it

createdAtstring date-time required
updatedAtstring date-time required
publishedVersionIdstring uuid nullable required

Changes

No recorded changes to this operation across all 2 revisions of this API.