--- title: "Get Security Detection" method: POST path: "/security-detection/{id}/get-item" tags: ["Security Detection"] --- # Get Security Detection `POST /security-detection/{id}/get-item` ## Request - Base URL: `https://oneuptime.com/api` - URL: `https://oneuptime.com/api/security-detection/{id}/get-item` - Auth: API key in header `APIKey` - TypeScript: (a function with typed inputs; its response is checked against the schema) Endpoint to retrieve a single Security Detection by ID ## Path parameters - `id` string, uuid, required ## Request body - object - `select` SecurityDetectionSelectSchema: Select schema for SecurityDetection. Set fields to true to include them in the response. - `_id` boolean - `createdAt` boolean - `updatedAt` boolean - `deletedAt` boolean - `projectId` boolean - `securityCaseId` boolean - `title` boolean - `description` boolean - `severity` boolean - `source` boolean - `fingerprint` boolean - `ruleName` boolean - `detectionRuleId` boolean - `threatIntelFeedId` boolean - `securityEventConnectionId` boolean - `groupValue` boolean - `entities` boolean - `mitreTactics` boolean - `mitreTechniques` boolean - `eventCount` boolean - `fireCount` boolean - `firstSeenAt` boolean - `lastSeenAt` boolean - `sampleMessage` boolean - `eventUid` boolean - `deletedByUserId` boolean ## Response `200` Successful response - object - `data` SecurityDetection - `_id` string, uuid: ID of this object. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `createdAt` object: Date and Time when the object was created. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `updatedAt` object: Date and Time when the object was updated. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `deletedAt` object: Date and Time when the object was deleted. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `version` number: Object version - `projectId` string, uuid, required: ID of the project this detection belongs to. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `securityCaseId` string, uuid, required: ID of the case this detection belongs to. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `title` string, required: What fired, about what: the rule's name and the value it grouped on. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `description` string: What the detection saw, in Markdown. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `severity` 'Unknown' | 'Informational' | 'Low' | 'Medium' | 'High' | 'Critical' | 'Fatal' | 'Other', required: OCSF severity of the detection: Informational, Low, Medium, High, Critical or Fatal. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `source` 'Detection Rule' | 'Threat Intel' | 'Connected Product' | 'Manual' | 'Entity Risk' | 'Data Security', required: What raised it: a Detection Rule, Threat Intel, a Connected Product, Entity Risk, or a person (Manual). Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `fingerprint` string, required: Identifies the same signal across repeats: the source and what it fired for. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `ruleName` string: The name of what fired: the detection rule, the threat intel feed, or the connected product's own rule. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `detectionRuleId` string, uuid: ID of the detection rule that fired. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `threatIntelFeedId` string, uuid: ID of the feed whose indicator matched. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `securityEventConnectionId` string, uuid: ID of the connection the alert was imported through. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `groupValue` string: The value the rule grouped its matches by, such as the host or IP address they share. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `entities` object: The users, hosts, IP addresses, domains and files the detection names, each as { type, value }. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `mitreTactics` object: ATT&CK tactic ids the detection is tagged with. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `mitreTechniques` object: ATT&CK technique ids the detection is tagged with. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `eventCount` number: How many security events are behind the detection, over every time it fired. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `fireCount` number: How many times the detection fired while its case was open. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `firstSeenAt` object: When the detection first fired. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `lastSeenAt` object: When the detection last fired. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `sampleMessage` string: The message of one of the events behind the detection. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `eventUid` string: eventUid of the security event that records the detection: the Detection Finding a rule or feed wrote, or the imported alert. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `deletedByUserId` string, uuid: ID of the person who deleted the detection. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] ## Other responses - `400`: Bad request. This response indicates that the request was malformed or contained invalid data. - `401`: Unauthorized. This response indicates that the request requires user authentication. - `402`: Payment Required. This response indicates that the request requires payment or a valid subscription. - `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it. - `404`: Not found. The record does not exist, belongs to another project, or is one you may not read - the same answer for each. - `405`: Project not found. This response indicates that the requested project does not exist or is not accessible. - `408`: Request Timeout. This response indicates that the server timed out waiting for the request. - `415`: Unable to reach server. This response indicates that the server is currently unreachable or down. - `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource. - `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request. --- [API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)