RErecordedfuture
Auto Sigma

Get result of a job

Retrieve a specific Auto Sigma job's status, configuration, and generated detection rules.

get/v1/auto-sigma/jobs/{jobId}

Request

  • Base URL
    https://api.recordedfuture.com/malware-intelligence
  • URL
    https://api.recordedfuture.com/malware-intelligence/v1/auto-sigma/jobs/{jobId}
  • Auth
    • OAuth 2
      Authorization code: https://id.recordedfuture.com/authorize
      Token URL: https://id.recordedfuture.com/token
    • or API key in header X-RFToken

Path parameters

jobIdstring required

Response

Successful Response

jobIdstring required

A unique identifier for the Sigma job.

namestring required

The name of the Sigma job.

createdstring date-time required

The timestamp when the Sigma job was created.

modifiedstring date-time required

The timestamp when the Sigma job was last updated.

statusstring required

The current status of the Sigma job (e.g., "CREATED", "RUNNING", "FINISHED", "FAILED").

querystring required

The query that was used to find the initial hashes.

startDatestring date required

Earliest date to include in the query (cannot be before 2023-11-01)

endDatestring date required

Latest date to include in the query, defaults to today in UTC

nMatchedHashesnumber required

Number of hashes matching the query during specified time range

familyCountsFamilyCounts required

Statistics over number of matched hashes per malware family

Example response

{
  "created": "2025-03-18T08:57:24.855198",
  "modified": "2025-03-18T08:57:24.855198",
  "query": "sample.tags == \"family:redline\"",
  "startDate": "2024-11-01",
  "endDate": "2024-11-30",
  "familyCounts": {
    "family:cobaltstrike": 100,
    "family:xmrig": 5
  },
  "sigma_rules": [
    {
      "stats": {
        "n_hashes": 100,
        "overlap": 100,
        "family_counts": {
          "family:cobaltstrike": 100,
          "family:xmrig": 5
        }
      },
      "modified": "2025-03-18T08:57:24.855198"
    }
  ],
  "patterns": [
    {
      "stats": {
        "n_hashes": 100,
        "overlap": 100,
        "family_counts": {
          "family:cobaltstrike": 100,
          "family:xmrig": 5
        }
      }
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.