Read one detection library entry

Returns the entry with its notebook source and the globally cached logic summary, for review before adding. Requires tool.read.

get/api/detection-library/{slug}

Request

slugstring required

Successful response

slugstring required

Kebab-case library entry identity

namestring required

summarystring required

1–3 sentence plain-prose headline of what the detection is meant to detect

descriptionstring required

Operational GitHub-flavored markdown covering the signal and the fire condition

revisionstring required

SHA-256 of the entry notebook

toolNamesstring[] required

Tool actions the entry notebook calls

requiredLogSourcesstring[] required

Cotool Logs warehouse sources the notebook queries (e.g. okta); eligibility requires the org to have their log ingest enabled

mitreTechniqueIdsstring[] required

defaultMinSeverity'low' | 'medium' | 'high' | 'critical' required

eligibleboolean required

Whether missingLogSources and missingTools are both empty

addedDetectionIdstring uuid nullable required

The org detection created from this entry, when already added

contentstring required

The entry notebook source, for read-only preview

No recorded changes to this operation across all 2 revisions of this API.