---
title: "Get Job Detection Rules"
method: POST
path: "/v1/hunting/jobs/{id}/rules"
tags: ["Threat Hunting"]
---

# Get Job Detection Rules

`POST /v1/hunting/jobs/{id}/rules`

## Request

- Base URL: `https://api.recordedfuture.com/autonomous-threat-operations`
- URL: `https://api.recordedfuture.com/autonomous-threat-operations/v1/hunting/jobs/{id}/rules`
- Auth: one of:
  - API key in header `X-RFToken`
  - OAuth 2
    - Authorization code: `https://id.recordedfuture.com/authorize`
    - Token URL: `https://id.recordedfuture.com/token`

Fetch detection rules from a threat hunt job scoped to its time window.

## Path parameters

- `id` string, uuid, required: Threat Hunt Job ID

## Request body

- object
  - `filter` object, required
    - `types` DetectionRuleType[]: Decides what detection rule types are included in the results

## Response `200`

Detection rules for this profile

- object
  - `items` DetectionRule[], required: A batch of detection rules matching the filter
    - `id` string, required: The entity id of this detection rule
    - `noteId` string: The Insikt note document id of this detection rule
    - `type` 'fql' | 'kql' | 's1ql' | 'sigma' | 'snort' | 'yara' | 'yaral', required: The type of detection rule
    - `name` string, required: The name of the detection rule
    - `content` string, required: The content of the detection rule
    - `ttp` object[]: The TTPs associated with this detection rule
      - `code` string
      - `name` string

## Other responses

- `404`: Threat hunt job not found

---

[API](https://skmtc.dev/recordedfuture/apis/autonomous-threat-operations-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/autonomous-threat-operations-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/autonomous-threat-operations-api/revisions/a984b61a0cf8?raw)