---
title: "Create a Auto Sigma job"
method: POST
path: "/v1/auto-sigma/jobs"
tags: ["Auto Sigma"]
---

# Create a Auto Sigma job

`POST /v1/auto-sigma/jobs`

## Request

- Base URL: `https://api.recordedfuture.com/malware-intelligence`
- URL: `https://api.recordedfuture.com/malware-intelligence/v1/auto-sigma/jobs`
- Auth: one of:
  - OAuth 2
    - Authorization code: `https://id.recordedfuture.com/authorize`
    - Token URL: `https://id.recordedfuture.com/token`
  - API key in header `X-RFToken`

Generate Sigma detection rules from observed behavioral patterns across malware samples.

## Request body

- CreateSigmaJobRequest: Request to create an Auto Sigma rule generation job from malware sample hashes.
  - `name` string, required: The name of the Auto Sigma job.
  - `query` string, required: The query used to select files to build rules for
  - `start_date` string, date, required: Earliest date to include in the query (cannot be before 2023-11-01)
  - `end_date` string, date: Latest date to include in the query, defaults to today in UTC

## Response `200`

Successful Response

- CreateJobResponse: Response confirming creation of a rule generation job with its assigned ID.
  - `job_id` string, required

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Page not found

---

[API](https://skmtc.dev/recordedfuture/apis/recorded-future-malware-intelligence.md) - [All operations](https://skmtc.dev/recordedfuture/apis/recorded-future-malware-intelligence/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/recorded-future-malware-intelligence/revisions/190a3d1d0680?raw)