---
title: "Generate a SIEM query using AI"
method: POST
path: "/api/detection-queries/generate"
tags: ["Detections"]
deprecated: true
---

# Generate a SIEM query using AI

`POST /api/detection-queries/generate`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/detection-queries/generate`
- Auth: HTTP bearer

> **Deprecated.**

> ⚠️ **Deprecated**
> Standalone query generation is superseded by detection authoring with agents. Run an agent that has your SIEM tool attached (POST /api/agents/{agentId}/run-sync) or author detections in the Cotool app. No sunset is scheduled; the endpoint will be removed once its remaining integration retires.
> **Use instead:** `/api/agents/:agentId/run-sync`

Generates a SIEM query based on a natural language prompt using AI.

## Request body

- object: Request body for generating a detection query using AI
  - `prompt` string, required: Natural language description of what the query should accomplish
  - `siemType` 'splunk' | 'sumologic' | 'elastic' | 'databricks' | 'datadog' | 'scanner' | 'runreveal' | 'microsoftsentinel' | 'panther' | 'cotool' | 'sentinelone' | 'gadmin', required: The detection tool platform to generate the query for (SIEM or endpoint tools like SentinelOne)
  - `category` 'baseline_anomaly' | 'first_occurrence' | 'sequence_pattern' | 'privilege_escalation' | 'custom': The detection category to optimize the query for

## Response `200`

Successful response

- object
  - `query` string, required: The generated SIEM query
  - `systemPrompt` string, required: The customized system prompt for the detection agent
  - `explanation` string: Optional explanation of what the query does

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Forbidden — the authenticated user lacks the required permissions
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)