Skip to main content

List Rules

Retrieve a paginated list of detection rules with optional filtering.

Endpoint

GET /api/rules

Authentication

Requires JWT token or API key with read permissions.

Query Parameters

ParameterTypeDescriptionDefault
pageintegerPage number1
page_sizeintegerItems per page (max 100)20
statusstringFilter by status-
severitystringFilter by severity-
searchstringSearch in title/content-
sort_bystringSort fieldcreated_at
sort_orderstringasc or descdesc

Status Values

  • deployed - Active rules
  • undeployed - Inactive rules
  • snoozed - Temporarily disabled

Severity Values

  • critical
  • high
  • medium
  • low
  • informational

Example Request

curl -H "Authorization: Bearer chad_ak_xxxxx..." \
  "https://chad.example.com/api/external/rules?status=deployed&page_size=50"

Response

{
  "items": [
    {
      "id": "abc-123",
      "title": "Failed Login Attempt",
      "status": "deployed",
      "severity": "medium",
      "tags": ["attack.credential_access", "attack.t1110"],
      "created_at": "2024-01-10T10:00:00Z",
      "updated_at": "2024-01-15T14:32:17Z",
      "version": 3
    },
    {
      "id": "def-456",
      "title": "Suspicious PowerShell",
      "status": "deployed",
      "severity": "high",
      "tags": ["attack.execution", "attack.t1059.001"],
      "created_at": "2024-01-12T09:00:00Z",
      "updated_at": "2024-01-12T09:00:00Z",
      "version": 1
    }
  ],
  "total": 150,
  "page": 1,
  "page_size": 50,
  "pages": 3
}

Response Fields

FieldTypeDescription
idstringUnique rule identifier
titlestringRule title
statusstringDeployment status
severitystringAlert severity level
tagsarrayMITRE ATT&CK and custom tags
created_atdatetimeCreation timestamp
updated_atdatetimeLast update timestamp
versionintegerCurrent version number

Error Responses

401 Unauthorized

{
  "detail": "Could not validate credentials"
}

400 Bad Request

{
  "detail": "Invalid status value"
}

Code Examples

Python

import requests

API_KEY = "chad_ak_xxxxx..."
BASE_URL = "https://chad.example.com"

response = requests.get(
    f"{BASE_URL}/api/external/rules",
    headers={"Authorization": f"Bearer {API_KEY}"},
    params={"status": "deployed", "page_size": 100}
)

rules = response.json()
for rule in rules["items"]:
    print(f"{rule['title']} - {rule['severity']}")

JavaScript

const response = await fetch(
  'https://chad.example.com/api/external/rules?status=deployed',
  {
    headers: {
      'Authorization': 'Bearer chad_ak_xxxxx...'
    }
  }
);

const { items, total } = await response.json();
console.log(`Found ${total} rules`);