# Action Details

Includes detailed action result with attack start & end time, log & alert time and attack module based details (payloads, terminal log, file name, sha256, md5, sha1). Protocol based results are also available. Includes detection rules mapped to each action under detection_contents, grouped by content source. Only sources the account is licensed for appear, and only rule ids the account may fetch. To retrieve a rule, call GET /v1/mitigation/detection-content/{source}/rules/{rule_id} with the entry's source_name as {source} — that endpoint resolves sources by name, so source_id is not accepted there. Omitted when the account has no detection-content license or no rules map to the action.