COcotool
Detections

Generate a SIEM query using AI

⚠️ Deprecated Standalone query generation is superseded by detection authoring with agents. Run an agent that has your SIEM tool attached (POST /api/agents/{agentId}/run-sync) or author detections in the Cotool app. No sunset is scheduled; the endpoint will be removed once its remaining integration retires. Use instead: /api/agents/:agentId/run-sync

Generates a SIEM query based on a natural language prompt using AI.

post/api/detection-queries/generate

Request

  • Base URL
    https://app.cotool.ai
  • Auth
    HTTP bearer

Request body

promptstring required

Natural language description of what the query should accomplish

siemType'splunk' | 'sumologic' | 'elastic' | 'databricks' | 'datadog' | 'scanner' | 'runreveal' | 'microsoftsentinel' | 'panther' | 'cotool' | 'sentinelone' | 'gadmin' required

The detection tool platform to generate the query for (SIEM or endpoint tools like SentinelOne)

category'baseline_anomaly' | 'first_occurrence' | 'sequence_pattern' | 'privilege_escalation' | 'custom'

The detection category to optimize the query for

Response

Successful response

querystring required

The generated SIEM query

systemPromptstring required

The customized system prompt for the detection agent

explanationstring

Optional explanation of what the query does

Changes

No recorded changes to this operation across all 2 revisions of this API.