---
title: "Get result of a job"
method: GET
path: "/v1/auto-sigma/jobs/{jobId}"
tags: ["Auto Sigma"]
---

# Get result of a job

`GET /v1/auto-sigma/jobs/{jobId}`

## Request

- Base URL: `https://api.recordedfuture.com/malware-intelligence`
- URL: `https://api.recordedfuture.com/malware-intelligence/v1/auto-sigma/jobs/{jobId}`
- Auth: one of:
  - OAuth 2
    - Authorization code: `https://id.recordedfuture.com/authorize`
    - Token URL: `https://id.recordedfuture.com/token`
  - API key in header `X-RFToken`

Retrieve a specific Auto Sigma job's status, configuration, and generated detection rules.

## Path parameters

- `jobId` string, required

## Response `200`

Successful Response

- GetSigmaJobResponse: Detailed result of a Sigma rule generation job including status, generated rules, and patterns.
  - `jobId` string, required: A unique identifier for the Sigma job.
  - `name` string, required: The name of the Sigma job.
  - `created` string, date-time, required: The timestamp when the Sigma job was created.
  - `modified` string, date-time, required: The timestamp when the Sigma job was last updated.
  - `status` string, required: The current status of the Sigma job (e.g., "CREATED", "RUNNING", "FINISHED", "FAILED").
  - `query` string, required: The query that was used to find the initial hashes.
  - `startDate` string, date, required: Earliest date to include in the query (cannot be before 2023-11-01)
  - `endDate` string, date, required: Latest date to include in the query, defaults to today in UTC
  - `nMatchedHashes` number, required: Number of hashes matching the query during specified time range
  - `familyCounts` FamilyCounts, required: Statistics over number of matched hashes per malware family
  - `sigma_rules` SigmaRuleItem[], required: The Sigma Rules and associated stats.
    - `rule` string, required: Sigma rule in YAML format
    - `rule_id` string, required: Id of the generated rule
    - `stats` SigmaPatternStats: Statistics about patterns identified during Sigma rule generation.
      - `n_hashes` number, required: Number of hashes matching the pattern
      - `overlap` number, required: Number of hashes matching both pattern and job query
      - `family_counts` FamilyCounts, required: Statistics over number of matched hashes per malware family
    - `status` 'True Positive' | 'False Positive' | 'Benign Behavior' | 'No Root Cause' | 'Needs Tuning' | 'New', required: Selected status of the rule
    - `modified` string, date-time: The timestamp when the rule was last updated. Not present if rule was never updated.
  - `patterns` PatternItem[], required: The generated patterns and associated stats
    - `image` string: Parent image, optionally with wildcard replacement
    - `cmd_pattern` string: Command line, optionally with wildcard replacement
    - `matched_cmds` string[]: List of command lines matching this pattern
    - `stats` SigmaPatternStats: Statistics about patterns identified during Sigma rule generation.
      - `n_hashes` number, required: Number of hashes matching the pattern
      - `overlap` number, required: Number of hashes matching both pattern and job query
      - `family_counts` FamilyCounts, required: Statistics over number of matched hashes per malware family

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Page not found

---

[API](https://skmtc.dev/recordedfuture/apis/recorded-future-malware-intelligence.md) - [All operations](https://skmtc.dev/recordedfuture/apis/recorded-future-malware-intelligence/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/recorded-future-malware-intelligence/revisions/190a3d1d0680?raw)