RErecordedfuture
Auto Sigma

Create a Auto Sigma job

Generate Sigma detection rules from observed behavioral patterns across malware samples.

post/v1/auto-sigma/jobs

Request

  • Base URL
    https://api.recordedfuture.com/malware-intelligence
  • URL
    https://api.recordedfuture.com/malware-intelligence/v1/auto-sigma/jobs
  • Auth
    • OAuth 2
      Authorization code: https://id.recordedfuture.com/authorize
      Token URL: https://id.recordedfuture.com/token
    • or API key in header X-RFToken

Request body

namestring required

The name of the Auto Sigma job.

querystring required

The query used to select files to build rules for

start_datestring date required

Earliest date to include in the query (cannot be before 2023-11-01)

end_datestring date

Latest date to include in the query, defaults to today in UTC

Example request

{
  "name": "Example Job",
  "query": "sample.tags == \"family:redline\"",
  "start_date": "2024-11-01",
  "end_date": "2024-11-30"
}

Response

Successful Response

job_idstring required

Changes

No recorded changes to this operation across all 1 revision of this API.