Detection Rules
YARA and Sigma detection rules extracted from intelligence reports, linked to the entities they document.
GET/rules/:entityType/:entityId
Returns detection rules associated with a given entity — extracted from the reports that document it.
| Parameter | Type | Description |
|---|---|---|
entityType | string | Entity type (e.g. actor / cluster / tool) |
entityId | string | Entity UUID |
No authentication required. Returns an array of rule objects:
| Field | Type | Description |
|---|---|---|
id | uuid | Unique identifier |
type | string | Rule format: yara or sigma |
name | string | Rule name (from the YARA rule block name or Sigma title: field) |
content | string | Full rule text |
source_report_id | uuid | UUID of the report the rule was extracted from |
report_title | string | Title of the source report |
created_at | string | ISO 8601 timestamp |
Rules are extracted from ingested reports automatically using regex detection — no LLM call is involved. A rule is linked to every entity documented in the report it was found in.