Skip Navigation
  1. BlackBerry Docs
  2. Cylance Endpoint Security
  3. Cylance User API guide
  4. Detection rule API
  5. Get Detection Rule List

Get Detection Rule List

Retrieve a list of Detection rules available in a tenant.
Service Endpoint
/rules/v2?page=m&page_size=n
Optional query string parameters
  • page: This is the page number to request.
  • page_size: This is the number of device records to retrieve per page.
Example
Return the first page with 100 devices: https://protectapi.cylance.com/rules/v2?page=1&page_size=100
Method
HTTP/1.1 GET
Request headers
  • Accept: application/json
  • Authorization: Bearer
    JWT Token returned by Auth API
     with the opticsrule:list scope encoded

Request

None

Response

Please see the Response status codes for more information.

Response JSON schema

Field Name
Description
Category
This is the category of rule grouping that the detection rule belongs to. Possible values include:
  • Custom: These are custom rules that users have uploaded to a tenant.
  • Cylance
     rules: These are the rules from
    Cylance
    .
  • Cylance
     experimental: These are the rules from
    Cylance
     that are deemed to be experimental.
Description
This is the description of the detection rule.
DeviceCount
This is the number of devices that have the detection rule applied.
Id
This is the unique ID of the detection rule.
LastModified
This is the timestamp (in UTC) of the last time that the detection rule was modified.
ModifiedBy
This is an object detailing the last user to modify the detection rule. It includes the following fields:
  • id: This is the unique ID of the user who modified the detection rule.
  • login: This is the email address of the user who modified the detection rule.
Name
This is the name of the detection rule.
OperatingSystems
This is an object detailing the operating systems that the detection rule can be applied to. It will include the "name" field. This can consist of:
  • "Windows"
  • "MacOS"
page_number
This is the current page number of results.
page_size
This is the number of items on the page.
RulesetCount
This is the number of detection rule sets that have the detection rule enabled.
Severity
This is the severity assigned to the detection rule. Possible values are:
  • High
  • Medium
  • Low
  • Informational
total_number_of_items
This is the total number of detection rules in the tenant.
total_pages
This is the total number of pages of this size.
Version
This is the version of the detection rule.