Get detection rule

/rules/v2/{rule_id}

—

https://protectapi.cylance.com/rules/v2/008ece50-49af-472a-b0d8-3c3700883738

HTTP/1.1 GET

This indicates if state events (historical rundowns) should be considered when evaluating for matches.

This is the amount of time a rule is active. If the rule has been active past this duration, then the instance of the rule will be removed.

This indicates if the rule can be activated multiple times, simultaneously.

This is the description for the detection rule.

This is the unique identifier for the detection rule.

This indicates the maximum number of concurrently executing instances of this rule.

This is the name of the detection rule.

This is the date and time (in UTC) after which the detection rule is not valid.

This is the date and time (in UTC) before which the detection rule is not valid.

This is the type of object defined in this rule.

These are the affected operating systems.

This defines the paths by which this deterministic finite automata (DFA) can be iterated.

This is the

CylanceOPTICS

plugin associated with the detection rule.

This is the name of the product associated with the detection rule.

This is the source of the rule (for example, Cylance).

This is the classification or designator for the rule source (for example,

CylanceOPTICS

).

This is the version of the schema.

This is the severity assigned to the detection rule. Possible values are:

This is the list of all available states. If no paths are specified, the states are transitioned in the order they are specified.

This is a list of tags associated with the detection rule.

If the activating process (and, if applicable, all other processes that have been absorbed as activating processes) end, then this will terminate the active DFA.

This is the version of the detection rule.