---
title: "Get Profile Detection Rules"
method: POST
path: "/v1/prevention/profiles/{id}/rules"
tags: ["Threat Prevention"]
---

# Get Profile Detection Rules

`POST /v1/prevention/profiles/{id}/rules`

Fetch supplementary detection rules from a prevention profile tagged with MITRE ATT&CK techniques.

## Path parameters

- `id` string, uuid, required — Identity of an automation profile

## Request body

- object
  - `filter` object, required
    - `types` DetectionRuleType[] — Decides what detection rule types are included in the results

## Response `200`

Detection rules for this profile

- object
  - `items` DetectionRule[], required — A batch of detection rules matching the filter
    - `id` string, required — The entity id of this detection rule
    - `noteId` string — The Insikt note document id of this detection rule
    - `type` 'sigma' | 'yara' | 'snort', required — The type of a Detection Rule Available types: * sigma: Sigma rule * yara: YARA rule * snort: Snort rule
    - `name` string, required — The name of the detection rule
    - `content` string, required — The content of the detection rule
    - `ttp` object[] — The TTPs associated with this detection rule
      - `code` string
      - `name` string

## Other responses

- `404` — Profile not found

---

[API](https://skmtc.dev/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.dev/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)