---
title: "Search Detection Rules"
method: POST
path: "/search"
tags: ["Detection Rules"]
---

# Search Detection Rules

`POST /search`

## Request

- Base URL: `/detection-rule` (relative, and the document’s source URL is not known)
- URL: `/detection-rule/search`
- Auth: one of:
  - API key in header `X-RFToken`
  - OAuth 2
    - Authorization code: `https://id.recordedfuture.com/authorize`
    - Token URL: `https://id.recordedfuture.com/token`

Search Insikt Group detection rules with deployable YARA, Sigma, and Snort source code.

## Request body

- object
  - `filter` DetectionRuleFilter: Filters Insikt Notes and the associated detection rules.
    - `types` DetectionRuleType[]: Filters on type of detection rules, applied as a logical "OR". The following values are allowed: `yara`, `sigma`, and `snort`.
    - `entities` EntityId[]: An array of entities that may be associated with a given detection rule. All values in the array must be valid Recorded Future entity IDs. Use **Entity Match** to lookup entity IDs. Values in this filter are applied as a logical "AND".
    - `created` DateTimeRange
      - `before` string, date-time
      - `after` string, date-time
    - `updated` DateTimeRange
      - `before` string, date-time
      - `after` string, date-time
    - `doc_id` string: Will look for a specific Insikt Note document ID associated with detection rules
    - `title` string: Filters as a free text search for Insikt Notes associated with detection rules
  - `tagged_entities` boolean: If set to true, the entity ID of tagged entities in the title and body of the Insikt Note associated with the detection rule will be included.
  - `limit` integer: Sets the limit of total number of rules that will be returned in the result set. If the search has more results than the specified limit, the `next_offset` value in the response can be used in the `offset` value of the next request to get the next set of results.
  - `offset` string: This value, if specified with the `next_offset` value of a prior result, will indicate where to start showing results from. To see the first set of results of the search, this parameter should be omitted.

## Response `200`

Success

- DetectionRuleResult: Search results for Insikt Group detection rules containing deployable YARA, Sigma, and Snort rule source code.
  - `count` integer, required: Number of results in this page
  - `total_count` integer, required: Total matching results across all pages
  - `result` DetectionRuleSet[], required: Array of detection rule note objects.
    - `id` string, required: Document ID (doc:XXXXX)
    - `type` 'sigma' | 'yara' | 'snort', required: The type of a Detection Rule Available types: * sigma: Sigma rule * yara: YARA rule * snort: Snort rule
    - `title` string, required: Insikt Group note title describing the threat
    - `description` string, required: Detailed threat analysis narrative
    - `rules` object[], required: Detection rules with deployable source code.
      - `name` string
      - `description` string
      - `file_name` string: Suggested filename for the rule
      - `entities` DetectionRuleEntity[]: Associated entities (MITRE ATT&CK techniques, malware families, hashes).
        - `id` string, required
        - `type` string, required: Additional information about entity types is provided by the /entity/types endpoint. It can be used to find the display name of the entity type.
        - `name` string, required
        - `display_name` string: Human-readable name with context
      - `content` string, required: Full rule source code (YARA rule, Sigma YAML, or Snort signature)
    - `created` string, date-time, required
    - `updated` string, date-time, required
  - `next_offset` string: Cursor-based pagination token for next page

## Other responses

- `400`: Bad Request

---

[API](https://skmtc.dev/recordedfuture/apis/detection-rule-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/detection-rule-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/detection-rule-api/revisions/0708637f5534?raw)