Get Detection Rule List

Retrieve a list of Detection rules available in a tenant.

Service Endpoint

/rules/v2?page=m&page_size=n

Optional query string parameters
  • page: This is the page number to request.
  • page_size: This is the number of device records to retrieve per page.

Example

Return the first page with 100 devices: https://protectapi.cylance.com/rules/v2?page=1&page_size=100

Method

HTTP/1.1 GET

Request headers
  • Accept: application/json
  • Authorization: Bearer JWT Token returned by Auth API with the opticsrule:list scope encoded

Request

None

Response

Please see the Response status codes for more information.

Response JSON schema

Field Name Description

Category
This is the category of rule grouping that the detection rule belongs to. Possible values include:
  • Custom: These are custom rules that users have uploaded to a tenant.
  • Endpoint Defense rules: These are the rules from Endpoint Defense.
  • Endpoint Defense experimental: These are the rules from Endpoint Defense that are deemed to be experimental.

Description

This is the description of the detection rule.

DeviceCount

This is the number of devices that have the detection rule applied.

Id

This is the unique ID of the detection rule.

LastModified

This is the timestamp (in UTC) of the last time that the detection rule was modified.

ModifiedBy
This is an object detailing the last user to modify the detection rule. It includes the following fields:
  • id: This is the unique ID of the user who modified the detection rule.
  • login: This is the email address of the user who modified the detection rule.

Name

This is the name of the detection rule.

OperatingSystems
This is an object detailing the operating systems that the detection rule can be applied to. It will include the "name" field. This can consist of:
  • "Windows"
  • "MacOS"

page_number

This is the current page number of results.

page_size

This is the number of items on the page.

RulesetCount

This is the number of detection rule sets that have the detection rule enabled.

Severity
This is the severity assigned to the detection rule. Possible values are:
  • High
  • Medium
  • Low
  • Informational

total_number_of_items

This is the total number of detection rules in the tenant.

total_pages

This is the total number of pages of this size.

Version

This is the version of the detection rule.