RErecordedfuture
Detection Rules

Search Detection Rules

Search Insikt Group detection rules with deployable YARA, Sigma, and Snort source code.

post/search

Request

  • Base URL
    /detection-rule (relative, and the document’s source URL is not known)
  • URL
    /detection-rule/search
  • Auth
    • API key in header X-RFToken
    • or OAuth 2
      Authorization code: https://id.recordedfuture.com/authorize
      Token URL: https://id.recordedfuture.com/token

Request body

tagged_entitiesboolean

If set to true, the entity ID of tagged entities in the title and body of the Insikt Note associated with the detection rule will be included.

limitinteger

Sets the limit of total number of rules that will be returned in the result set. If the search has more results than the specified limit, the next_offset value in the response can be used in the offset value of the next request to get the next set of results.

offsetstring

This value, if specified with the next_offset value of a prior result, will indicate where to start showing results from. To see the first set of results of the search, this parameter should be omitted.

Example request

{
  "filter": {
    "types": [
      "yara"
    ],
    "entities": [
      "mitre:T1486",
      "kK5UbE"
    ],
    "created": {
      "after": "2022-02-10T12:00:00.000Z",
      "before": "2022-03-10T00:00:00.000Z"
    },
    "doc_id": "doc:lmRPGB",
    "title": "Ransomware"
  }
}

Response

Success

countinteger required

Number of results in this page

total_countinteger required

Total matching results across all pages

next_offsetstring

Cursor-based pagination token for next page

Example response

{
  "count": 1,
  "total_count": 10,
  "result": [
    {
      "id": "doc:XYZW",
      "type": "sigma",
      "title": "Snort Rules for CVE-2021-44228 Exploitation Attempts",
      "description": "There are a number of publicly-available Snort rules to detect common methods of  CVE-2021-44228 (Log4Shell remote code execution) exploit attempts. Insikt Group  has created several new, supplementary rules to detect potential exploitation attempts  using less common methods, including those using encoding or obfuscation.\n",
      "rules": [
        {
          "name": "APT_RU_APT29_FatDuke_loader",
          "description": "rule to detect fatduke loader",
          "file_name": "MAL_Kwampirs.yar",
          "entities": [
            {
              "id": "kvXvR5",
              "type": "CyberVulnerability",
              "name": "CVE-2021-44228",
              "display_name": "CVE-2021-44228 (Log4Shell)"
            }
          ]
        }
      ],
      "created": "2017-07-21T17:32:28Z",
      "updated": "2017-07-21T17:32:28Z"
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.