--- title: "List Security Detection" method: POST path: "/security-detection/get-list" tags: ["Security Detection"] --- # List Security Detection `POST /security-detection/get-list` ## Request - Base URL: `https://oneuptime.com/api` - URL: `https://oneuptime.com/api/security-detection/get-list` - Auth: API key in header `APIKey` - TypeScript: (a function with typed inputs; its response is checked against the schema) Endpoint to list all Security Detection items ## Request body - object - `query` SecurityDetectionQuerySchema: Query schema for SecurityDetection. A field takes a value, which it matches exactly, or an operator its type allows. A relation is filtered by the fields of the record it names, {"": {"": }}, and a resource with owners by who owns it, {"owners": {"_type": "OwnedBy", "userIds": [...], "teamIds": [...]}}. - `_id` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `createdAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `updatedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `deletedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `projectId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `securityCaseId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `title` union: A filter on a Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `description` union: A filter on a Markdown field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `severity` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `source` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `fingerprint` union: A filter on a Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `ruleName` union: A filter on a Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `detectionRuleId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `threatIntelFeedId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `securityEventConnectionId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `groupValue` union: A filter on a Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `entities` union: A filter on a JSON field, by key: {"": {"": }}. A key takes a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. IsNull and NotNull on the field itself ask whether it holds anything. - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `mitreTactics` union: A filter on a JSON field, by key: {"": {"": }}. A key takes a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. IsNull and NotNull on the field itself ask whether it holds anything. - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `mitreTechniques` union: A filter on a JSON field, by key: {"": {"": }}. A key takes a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. IsNull and NotNull on the field itself ask whether it holds anything. - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `eventCount` union: A filter on a Number field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. - number - object - `_type` 'EqualTo', required - `value` number, required - object - `_type` 'NotEqual', required - `value` number, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` number, required - object - `_type` 'GreaterThan', required - `value` number, required - object - `_type` 'LessThan', required - `value` number, required - object - `_type` 'GreaterThanOrEqual', required - `value` number, required - object - `_type` 'LessThanOrEqual', required - `value` number, required - object - `_type` 'InBetween', required - `startValue` number, required - `endValue` number, required - `fireCount` union: A filter on a Number field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. - number - object - `_type` 'EqualTo', required - `value` number, required - object - `_type` 'NotEqual', required - `value` number, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` number, required - object - `_type` 'GreaterThan', required - `value` number, required - object - `_type` 'LessThan', required - `value` number, required - object - `_type` 'GreaterThanOrEqual', required - `value` number, required - object - `_type` 'LessThanOrEqual', required - `value` number, required - object - `_type` 'InBetween', required - `startValue` number, required - `endValue` number, required - `firstSeenAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `lastSeenAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `sampleMessage` union: A filter on a Very Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `eventUid` union: A filter on a Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `deletedByUserId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `select` SecurityDetectionSelectSchema: Select schema for SecurityDetection. Set fields to true to include them in the response. - `_id` boolean - `createdAt` boolean - `updatedAt` boolean - `deletedAt` boolean - `projectId` boolean - `securityCaseId` boolean - `title` boolean - `description` boolean - `severity` boolean - `source` boolean - `fingerprint` boolean - `ruleName` boolean - `detectionRuleId` boolean - `threatIntelFeedId` boolean - `securityEventConnectionId` boolean - `groupValue` boolean - `entities` boolean - `mitreTactics` boolean - `mitreTechniques` boolean - `eventCount` boolean - `fireCount` boolean - `firstSeenAt` boolean - `lastSeenAt` boolean - `sampleMessage` boolean - `eventUid` boolean - `deletedByUserId` boolean - `sort` SecurityDetectionSortSchema: Sort schema for SecurityDetection. Only sortable fields are included. - `_id` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `createdAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `updatedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `deletedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `projectId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `securityCaseId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `title` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `severity` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `source` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `fingerprint` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `ruleName` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `detectionRuleId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `threatIntelFeedId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `securityEventConnectionId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `groupValue` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `eventCount` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `fireCount` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `firstSeenAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `lastSeenAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `sampleMessage` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `eventUid` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `deletedByUserId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `limit` number: Maximum number of items to return. Defaults to 10. - `skip` number: Number of items to skip for pagination. Defaults to 0. ## Response `200` Successful response - object - `data` SecurityDetection[] - `_id` string, uuid: ID of this object. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `createdAt` object: Date and Time when the object was created. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `updatedAt` object: Date and Time when the object was updated. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `deletedAt` object: Date and Time when the object was deleted. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `version` number: Object version - `projectId` string, uuid, required: ID of the project this detection belongs to. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `securityCaseId` string, uuid, required: ID of the case this detection belongs to. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `title` string, required: What fired, about what: the rule's name and the value it grouped on. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `description` string: What the detection saw, in Markdown. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `severity` 'Unknown' | 'Informational' | 'Low' | 'Medium' | 'High' | 'Critical' | 'Fatal' | 'Other', required: OCSF severity of the detection: Informational, Low, Medium, High, Critical or Fatal. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `source` 'Detection Rule' | 'Threat Intel' | 'Connected Product' | 'Manual' | 'Entity Risk' | 'Data Security', required: What raised it: a Detection Rule, Threat Intel, a Connected Product, Entity Risk, or a person (Manual). Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `fingerprint` string, required: Identifies the same signal across repeats: the source and what it fired for. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `ruleName` string: The name of what fired: the detection rule, the threat intel feed, or the connected product's own rule. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `detectionRuleId` string, uuid: ID of the detection rule that fired. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `threatIntelFeedId` string, uuid: ID of the feed whose indicator matched. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `securityEventConnectionId` string, uuid: ID of the connection the alert was imported through. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `groupValue` string: The value the rule grouped its matches by, such as the host or IP address they share. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `entities` object: The users, hosts, IP addresses, domains and files the detection names, each as { type, value }. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `mitreTactics` object: ATT&CK tactic ids the detection is tagged with. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `mitreTechniques` object: ATT&CK technique ids the detection is tagged with. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `eventCount` number: How many security events are behind the detection, over every time it fired. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `fireCount` number: How many times the detection fired while its case was open. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `firstSeenAt` object: When the detection first fired. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `lastSeenAt` object: When the detection last fired. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `sampleMessage` string: The message of one of the events behind the detection. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `eventUid` string: eventUid of the security event that records the detection: the Detection Finding a rule or feed wrote, or the imported alert. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `deletedByUserId` string, uuid: ID of the person who deleted the detection. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `count` number ## Other responses - `400`: Bad request. This response indicates that the request was malformed or contained invalid data. - `401`: Unauthorized. This response indicates that the request requires user authentication. - `402`: Payment Required. This response indicates that the request requires payment or a valid subscription. - `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it. - `405`: Project not found. This response indicates that the requested project does not exist or is not accessible. - `408`: Request Timeout. This response indicates that the server timed out waiting for the request. - `415`: Unable to reach server. This response indicates that the server is currently unreachable or down. - `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource. - `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request. --- [API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)