> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/detection-rules-management/detection-rules.md).

# Detection Rules

API for managing detection rules including CRUD operations for security policies, compliance metadata, and rule configurations.

## Create Detection Rule

> Creates a new detection rule with the specified configuration including name, severity, query, and compliance metadata. The rule will be validated and persisted if all required fields are provided correctly.

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"tags":[{"name":"Detection Rules","description":"API for managing detection rules including CRUD operations for security policies, compliance metadata, and rule configurations."}],"servers":[{"url":"https://api-{fqdn}","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"fully qualified domain name for Cortex tenant"}}}],"paths":{"/public_api/v1/rule":{"post":{"operationId":"createDetectionRule","description":"Creates a new detection rule with the specified configuration including name, severity, query, and compliance metadata. The rule will be validated and persisted if all required fields are provided correctly.","parameters":[{"description":"api_key_id authentication identifier","in":"header","name":"x-xdr-auth-id","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Request body for creating a detection rule","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateRuleRequest"}}},"required":true},"responses":{"201":{"description":"Rule successfully created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RuleResponse"}}}},"400":{"description":"Bad Request - Invalid parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationErrorResponse"}}}},"401":{"description":"Unauthorized"},"403":{"description":"Forbidden"},"409":{"description":"Conflict - Rule with same name already exists","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationErrorResponse"}}}},"429":{"description":"Too Many Requests"},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationErrorResponse"}}}},"502":{"description":"Bad Gateway"},"503":{"description":"Service Unavailable"}},"summary":"Create Detection Rule","tags":["Detection Rules"]}}},"components":{"schemas":{"CreateRuleRequest":{"description":"Request body for creating a detection rule","type":"object","required":["name","asset_types","severity","query"],"properties":{"name":{"type":"string","description":"Unique rule name","pattern":"\\S","maxLength":255},"description":{"type":"string","description":"Detailed rule description","maxLength":2000},"class":{"type":"string","description":"Rule class - Must be 'config' (CSPM)","pattern":"\\S"},"type":{"type":"string","description":"Rule type - Must be 'DETECTION' (can be inferred if not provided)"},"asset_types":{"type":"array","items":{"type":"string","pattern":"\\S"},"description":"Array with single asset type identifier (exactly one required)","minItems":1,"maxItems":1},"severity":{"type":"string","description":"Rule severity (low, medium, high, critical, informational)","pattern":"\\S"},"query":{"description":"Query object containing XQL","allOf":[{"$ref":"#/components/schemas/QueryRequest"}]},"metadata":{"description":"Metadata containing issue information","allOf":[{"$ref":"#/components/schemas/MetadataRequest"}]},"compliance_metadata":{"type":"array","items":{"$ref":"#/components/schemas/ComplianceMetadataRequest"},"description":"List of compliance metadata with control IDs","maxItems":100},"labels":{"type":"array","items":{"type":"string","maxLength":100},"description":"Custom labels (max 50, each max 100 chars)","maxItems":50},"enabled":{"type":"boolean","description":"Rule enabled status (default: true)"}}},"QueryRequest":{"type":"object","description":"Query object","required":["xql"],"properties":{"xql":{"type":"string","description":"Valid XQL query string","pattern":"\\S"}}},"MetadataRequest":{"type":"object","description":"Metadata object","properties":{"issue":{"description":"Issue information","allOf":[{"$ref":"#/components/schemas/IssueRequest"}]}}},"IssueRequest":{"type":"object","description":"Issue information","properties":{"recommendation":{"type":"string","description":"Remediation steps","maxLength":5000}}},"ComplianceMetadataRequest":{"type":"object","description":"Compliance metadata object","required":["control_id"],"properties":{"control_id":{"type":"string","description":"Compliance control identifier","pattern":"\\S"}}},"RuleResponse":{"description":"Response for rule operations","type":"object","properties":{"id":{"type":"string","description":"Unique rule identifier"},"name":{"type":"string","description":"Rule name"},"description":{"type":"string","description":"Rule description"},"rule_class":{"type":"string","description":"Rule class"},"type":{"type":"string","description":"Rule type"},"providers":{"type":"array","items":{"type":"string"},"description":"Cloud providers (derived from asset_types)"},"asset_types":{"type":"array","items":{"type":"string"},"description":"Array of asset type identifiers"},"severity":{"type":"string","description":"Rule severity"},"query":{"description":"Query object","allOf":[{"$ref":"#/components/schemas/QueryResponse"}]},"metadata":{"description":"Metadata containing issue information","allOf":[{"$ref":"#/components/schemas/MetadataResponse"}]},"compliance_metadata":{"type":"array","items":{"$ref":"#/components/schemas/ComplianceMetadata1"},"description":"Array of compliance metadata objects with full standard and control information"},"labels":{"type":"array","items":{"type":"string"},"description":"Custom labels"},"enabled":{"type":"boolean","description":"Rule enabled status"},"system_default":{"type":"boolean","description":"System default rule indicator"},"created_by":{"type":"string","description":"Creator identifier"},"created_on":{"type":"integer","format":"int64","description":"Creation timestamp (epoch milliseconds)"},"last_modified_by":{"type":"string","description":"Last modifier"},"last_modified_on":{"type":"integer","format":"int64","description":"Last modification timestamp (epoch milliseconds)"},"deleted":{"type":"boolean","description":"Deletion status"},"deleted_at":{"type":"integer","format":"int64","description":"Deletion timestamp (epoch milliseconds)"},"deleted_by":{"type":"string","description":"User who deleted the rule"}}},"QueryResponse":{"type":"object","description":"Query object","properties":{"xql":{"type":"string","description":"XQL query string"}}},"MetadataResponse":{"type":"object","description":"Metadata object","properties":{"issue":{"description":"Issue information","allOf":[{"$ref":"#/components/schemas/IssueResponse"}]}}},"IssueResponse":{"type":"object","description":"Issue information","properties":{"recommendation":{"type":"string","description":"Remediation steps"}}},"ComplianceMetadata1":{"type":"object","description":"Compliance metadata object","properties":{"standard_name":{"type":"string","description":"Full name of the compliance standard"},"control_id":{"type":"string","description":"Compliance control identifier"},"control_name":{"type":"string","description":"Full name of the compliance control"}}},"ValidationErrorResponse":{"type":"object","properties":{"err_msg":{"type":"string"},"metadata":{"$ref":"#/components/schemas/Metadata1"}}},"Metadata1":{"type":"object","properties":{"err_extra":{"type":"array","items":{"$ref":"#/components/schemas/ErrorDetail"}}}},"ErrorDetail":{"type":"object","properties":{"field":{"type":"string"},"message":{"type":"string"}}}}}}
```

## Get Detection Rules

> Searches for detection rules based on filter criteria with support for pagination and sorting. Returns a list of rules matching the specified filters.

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"tags":[{"name":"Detection Rules","description":"API for managing detection rules including CRUD operations for security policies, compliance metadata, and rule configurations."}],"servers":[{"url":"https://api-{fqdn}","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"fully qualified domain name for Cortex tenant"}}}],"paths":{"/public_api/v1/rule/search":{"post":{"operationId":"searchDetectionRules","description":"Searches for detection rules based on filter criteria with support for pagination and sorting. Returns a list of rules matching the specified filters.","parameters":[{"description":"api_key_id authentication identifier","in":"header","name":"x-xdr-auth-id","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Request body for filtering and sorting detection rules","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RulesPublicDataRequest"}}},"required":true},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicRulesResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationErrorResponse"}}}},"401":{"description":"Unauthorized"},"403":{"description":"Forbidden"},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationErrorResponse"}}}},"429":{"description":"Too many requests"},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationErrorResponse"}}}},"502":{"description":"Bad Gateway"},"503":{"description":"Service Unavailable"}},"summary":"Get Detection Rules","tags":["Detection Rules"]}}},"components":{"schemas":{"RulesPublicDataRequest":{"description":"Request body for querying detection rules","type":"object","properties":{"filter":{"description":"Filter criteria for searching rules","allOf":[{"$ref":"#/components/schemas/FilterCriteria"}]},"search_from":{"type":"integer","format":"int32","description":"Offset index for pagination"},"search_to":{"type":"integer","format":"int32","description":"Ending index for pagination. The default is 100, and it can be up to 1000. For example, when `search_from` is `10` and `search_to` is `100`, the API retrieves results from index `10` through `100`.","maximum":1000,"default":100},"sort":{"type":"array","items":{"$ref":"#/components/schemas/SortCriteria"},"description":"Sort criteria"}}},"FilterCriteria":{"type":"object","description":"Filter criteria supporting AND/OR logical operations and direct field searches","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterCriteria"},"description":"Array of filter criteria to be combined with AND logic"},"OR":{"type":"array","items":{"$ref":"#/components/schemas/FilterCriteria"},"description":"Array of filter criteria to be combined with OR logic"},"SEARCH_FIELD":{"type":"string","description":"Field name to search on"},"SEARCH_TYPE":{"type":"string","description":"Search operation type (EQ, NEQ, CONTAINS, NCONTAINS)"},"SEARCH_VALUE":{"type":"string","description":"Value to search for"}}},"SortCriteria":{"type":"object","required":["FIELD"],"properties":{"FIELD":{"type":"string","description":"Field name to sort by","pattern":"\\S"},"ORDER":{"type":"string","description":"Sort order (ASC or DESC)"}}},"PublicRulesResponse":{"description":"Response containing a list of detection rules with metadata","type":"object","required":["data","metadata"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/RuleData"},"description":"List of detection rules matching the filter criteria"},"metadata":{"description":"Metadata about the response including counts","allOf":[{"$ref":"#/components/schemas/Metadata"}]}}},"RuleData":{"type":"object","description":"Detection rule data","properties":{"asset_types":{"type":"array","items":{"type":"string"},"description":"Array of asset type identifiers"},"class":{"type":"string","description":"Rule class"},"compliance_metadata":{"type":"array","items":{"$ref":"#/components/schemas/ComplianceMetadata"},"description":"Array of compliance metadata objects with full standard and control information"},"compliance_standards":{"type":"array","items":{"type":"string"},"description":"List of compliance standards associated with the rule"},"created_by":{"type":"string","description":"User who created the rule"},"created_on":{"type":"integer","format":"int64","description":"Timestamp when the rule was created (milliseconds since epoch)"},"description":{"type":"string","description":"Detailed description of the rule"},"enabled":{"type":"boolean","description":"Whether the rule is enabled"},"id":{"type":"string","description":"Unique identifier of the rule"},"labels":{"type":"array","items":{"type":"string"},"description":"Custom labels associated with the rule"},"last_modified_by":{"type":"string","description":"User who last modified the rule"},"last_modified_on":{"type":"integer","format":"int64","description":"Timestamp when the rule was last modified (milliseconds since epoch)"},"module":{"type":"string","description":"Module the rule belongs to"},"name":{"type":"string","description":"Name of the rule"},"provider":{"type":"string","description":"Cloud provider"},"severity":{"type":"string","description":"Severity level of the rule","enum":["low","medium","high","critical","informational"]},"system_default":{"type":"boolean","description":"Whether this is a system default rule"},"type":{"type":"string","description":"Type of the rule","enum":["config","network","audit_event","anomaly","data"]}},"required":["class","created_by","created_on","description","enabled","id","last_modified_by","last_modified_on","module","name","provider","severity","system_default","type"]},"ComplianceMetadata":{"type":"object","description":"Compliance metadata object","properties":{"standard_name":{"type":"string","description":"Full name of the compliance standard"},"control_id":{"type":"string","description":"Compliance control identifier"},"control_name":{"type":"string","description":"Full name of the compliance control"}}},"Metadata":{"type":"object","description":"Metadata containing count information","required":["filter_count","total_count"],"properties":{"filter_count":{"type":"integer","format":"int64","description":"Number of rules matching the filter criteria"},"total_count":{"type":"integer","format":"int64","description":"Total number of rules available"}}},"ValidationErrorResponse":{"type":"object","properties":{"err_msg":{"type":"string"},"metadata":{"$ref":"#/components/schemas/Metadata1"}}},"Metadata1":{"type":"object","properties":{"err_extra":{"type":"array","items":{"$ref":"#/components/schemas/ErrorDetail"}}}},"ErrorDetail":{"type":"object","properties":{"field":{"type":"string"},"message":{"type":"string"}}}}}}
```

## Get Rule By Id

> Retrieves a specific detection rule by its unique identifier. Returns the complete rule configuration including query, compliance metadata, and labels.

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"tags":[{"name":"Detection Rules","description":"API for managing detection rules including CRUD operations for security policies, compliance metadata, and rule configurations."}],"servers":[{"url":"https://api-{fqdn}","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"fully qualified domain name for Cortex tenant"}}}],"paths":{"/public_api/v1/rule/{id}":{"get":{"operationId":"getDetectionRuleById","description":"Retrieves a specific detection rule by its unique identifier. Returns the complete rule configuration including query, compliance metadata, and labels.","parameters":[{"description":"api_key_id authentication identifier","in":"header","name":"x-xdr-auth-id","required":true,"schema":{"type":"string"}},{"description":"Unique identifier of the detection rule to retrieve","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Rule successfully retrieved","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RuleResponse"}}}},"400":{"description":"Bad Request - Invalid ID format","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationErrorResponse"}}}},"401":{"description":"Unauthorized"},"403":{"description":"Forbidden"},"404":{"description":"Not Found - Rule does not exist","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationErrorResponse"}}}},"429":{"description":"Too Many Requests"},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationErrorResponse"}}}},"502":{"description":"Bad Gateway"},"503":{"description":"Service Unavailable"}},"summary":"Get Rule By Id","tags":["Detection Rules"]}}},"components":{"schemas":{"RuleResponse":{"description":"Response for rule operations","type":"object","properties":{"id":{"type":"string","description":"Unique rule identifier"},"name":{"type":"string","description":"Rule name"},"description":{"type":"string","description":"Rule description"},"rule_class":{"type":"string","description":"Rule class"},"type":{"type":"string","description":"Rule type"},"providers":{"type":"array","items":{"type":"string"},"description":"Cloud providers (derived from asset_types)"},"asset_types":{"type":"array","items":{"type":"string"},"description":"Array of asset type identifiers"},"severity":{"type":"string","description":"Rule severity"},"query":{"description":"Query object","allOf":[{"$ref":"#/components/schemas/QueryResponse"}]},"metadata":{"description":"Metadata containing issue information","allOf":[{"$ref":"#/components/schemas/MetadataResponse"}]},"compliance_metadata":{"type":"array","items":{"$ref":"#/components/schemas/ComplianceMetadata1"},"description":"Array of compliance metadata objects with full standard and control information"},"labels":{"type":"array","items":{"type":"string"},"description":"Custom labels"},"enabled":{"type":"boolean","description":"Rule enabled status"},"system_default":{"type":"boolean","description":"System default rule indicator"},"created_by":{"type":"string","description":"Creator identifier"},"created_on":{"type":"integer","format":"int64","description":"Creation timestamp (epoch milliseconds)"},"last_modified_by":{"type":"string","description":"Last modifier"},"last_modified_on":{"type":"integer","format":"int64","description":"Last modification timestamp (epoch milliseconds)"},"deleted":{"type":"boolean","description":"Deletion status"},"deleted_at":{"type":"integer","format":"int64","description":"Deletion timestamp (epoch milliseconds)"},"deleted_by":{"type":"string","description":"User who deleted the rule"}}},"QueryResponse":{"type":"object","description":"Query object","properties":{"xql":{"type":"string","description":"XQL query string"}}},"MetadataResponse":{"type":"object","description":"Metadata object","properties":{"issue":{"description":"Issue information","allOf":[{"$ref":"#/components/schemas/IssueResponse"}]}}},"IssueResponse":{"type":"object","description":"Issue information","properties":{"recommendation":{"type":"string","description":"Remediation steps"}}},"ComplianceMetadata1":{"type":"object","description":"Compliance metadata object","properties":{"standard_name":{"type":"string","description":"Full name of the compliance standard"},"control_id":{"type":"string","description":"Compliance control identifier"},"control_name":{"type":"string","description":"Full name of the compliance control"}}},"ValidationErrorResponse":{"type":"object","properties":{"err_msg":{"type":"string"},"metadata":{"$ref":"#/components/schemas/Metadata1"}}},"Metadata1":{"type":"object","properties":{"err_extra":{"type":"array","items":{"$ref":"#/components/schemas/ErrorDetail"}}}},"ErrorDetail":{"type":"object","properties":{"field":{"type":"string"},"message":{"type":"string"}}}}}}
```

## Delete Detection Rule

> Permanently deletes a detection rule by its unique identifier. This action cannot be undone. Only custom rules can be deleted; system default rules cannot be removed.

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"tags":[{"name":"Detection Rules","description":"API for managing detection rules including CRUD operations for security policies, compliance metadata, and rule configurations."}],"servers":[{"url":"https://api-{fqdn}","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"fully qualified domain name for Cortex tenant"}}}],"paths":{"/public_api/v1/rule/{id}":{"delete":{"operationId":"deleteDetectionRule","description":"Permanently deletes a detection rule by its unique identifier. This action cannot be undone. Only custom rules can be deleted; system default rules cannot be removed.","parameters":[{"description":"api_key_id authentication identifier","in":"header","name":"x-xdr-auth-id","required":true,"schema":{"type":"string"}},{"description":"Unique identifier of the detection rule to delete","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Rule successfully deleted (no content)"},"400":{"description":"Bad Request - Invalid ID format","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationErrorResponse"}}}},"401":{"description":"Unauthorized"},"403":{"description":"Forbidden"},"404":{"description":"Not Found - Rule does not exist","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationErrorResponse"}}}},"429":{"description":"Too Many Requests"},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationErrorResponse"}}}},"502":{"description":"Bad Gateway"},"503":{"description":"Service Unavailable"}},"summary":"Delete Detection Rule","tags":["Detection Rules"]}}},"components":{"schemas":{"ValidationErrorResponse":{"type":"object","properties":{"err_msg":{"type":"string"},"metadata":{"$ref":"#/components/schemas/Metadata1"}}},"Metadata1":{"type":"object","properties":{"err_extra":{"type":"array","items":{"$ref":"#/components/schemas/ErrorDetail"}}}},"ErrorDetail":{"type":"object","properties":{"field":{"type":"string"},"message":{"type":"string"}}}}}}
```

## Update Detection Rule

> Updates an existing detection rule with the provided fields. Only the fields included in the request body will be updated. The rule\_class field is required for validation.

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"tags":[{"name":"Detection Rules","description":"API for managing detection rules including CRUD operations for security policies, compliance metadata, and rule configurations."}],"servers":[{"url":"https://api-{fqdn}","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"fully qualified domain name for Cortex tenant"}}}],"paths":{"/public_api/v1/rule/{id}":{"patch":{"operationId":"updateDetectionRule","description":"Updates an existing detection rule with the provided fields. Only the fields included in the request body will be updated. The rule_class field is required for validation.","parameters":[{"description":"api_key_id authentication identifier","in":"header","name":"x-xdr-auth-id","required":true,"schema":{"type":"string"}},{"description":"Unique identifier of the detection rule to update","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Request body for updating a detection rule","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateRuleRequest"}}},"required":true},"responses":{"200":{"description":"Rule successfully updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RuleResponse"}}}},"400":{"description":"Bad Request - Invalid parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationErrorResponse"}}}},"401":{"description":"Unauthorized"},"403":{"description":"Forbidden"},"404":{"description":"Not Found - Rule does not exist","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationErrorResponse"}}}},"409":{"description":"Conflict - Name already exists","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationErrorResponse"}}}},"429":{"description":"Too Many Requests"},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationErrorResponse"}}}},"502":{"description":"Bad Gateway"},"503":{"description":"Service Unavailable"}},"summary":"Update Detection Rule","tags":["Detection Rules"]}}},"components":{"schemas":{"UpdateRuleRequest":{"description":"Request body for updating a detection rule","type":"object","required":["rule_class"],"properties":{"name":{"type":"string","description":"Rule name (must be unique if changed)","maxLength":255},"description":{"type":"string","description":"Rule description","maxLength":2000},"rule_class":{"type":"string","description":"Rule class - Must be 'config' (CSPM)"},"type":{"type":"string","description":"Rule type - Must be 'DETECTION'"},"asset_types":{"type":"array","items":{"type":"string"},"description":"Array with single asset type identifier (exactly one if provided)","minItems":1,"maxItems":1},"severity":{"type":"string","description":"Rule severity (low, medium, high, critical, informational)"},"query":{"description":"Query object containing XQL (only editable for custom config rules with XQL)","allOf":[{"$ref":"#/components/schemas/QueryRequest1"}]},"metadata":{"description":"Metadata containing issue information","allOf":[{"$ref":"#/components/schemas/MetadataRequest1"}]},"compliance_metadata":{"type":"array","items":{"$ref":"#/components/schemas/ComplianceMetadataRequest1"},"description":"List of compliance metadata with control IDs","maxItems":100},"labels":{"type":"array","items":{"type":"string","maxLength":100},"description":"Custom labels (max 50, each max 100 chars)","maxItems":50},"enabled":{"type":"boolean","description":"Rule enabled status"}}},"QueryRequest1":{"type":"object","description":"Query object","properties":{"xql":{"type":"string","description":"XQL query string (only editable for custom config rules with XQL)"}}},"MetadataRequest1":{"type":"object","description":"Metadata object","properties":{"issue":{"description":"Issue information","allOf":[{"$ref":"#/components/schemas/IssueRequest1"}]}}},"IssueRequest1":{"type":"object","description":"Issue information","properties":{"recommendation":{"type":"string","description":"Remediation steps","maxLength":5000}}},"ComplianceMetadataRequest1":{"type":"object","description":"Compliance metadata object","properties":{"control_id":{"type":"string","description":"Compliance control identifier"}}},"RuleResponse":{"description":"Response for rule operations","type":"object","properties":{"id":{"type":"string","description":"Unique rule identifier"},"name":{"type":"string","description":"Rule name"},"description":{"type":"string","description":"Rule description"},"rule_class":{"type":"string","description":"Rule class"},"type":{"type":"string","description":"Rule type"},"providers":{"type":"array","items":{"type":"string"},"description":"Cloud providers (derived from asset_types)"},"asset_types":{"type":"array","items":{"type":"string"},"description":"Array of asset type identifiers"},"severity":{"type":"string","description":"Rule severity"},"query":{"description":"Query object","allOf":[{"$ref":"#/components/schemas/QueryResponse"}]},"metadata":{"description":"Metadata containing issue information","allOf":[{"$ref":"#/components/schemas/MetadataResponse"}]},"compliance_metadata":{"type":"array","items":{"$ref":"#/components/schemas/ComplianceMetadata1"},"description":"Array of compliance metadata objects with full standard and control information"},"labels":{"type":"array","items":{"type":"string"},"description":"Custom labels"},"enabled":{"type":"boolean","description":"Rule enabled status"},"system_default":{"type":"boolean","description":"System default rule indicator"},"created_by":{"type":"string","description":"Creator identifier"},"created_on":{"type":"integer","format":"int64","description":"Creation timestamp (epoch milliseconds)"},"last_modified_by":{"type":"string","description":"Last modifier"},"last_modified_on":{"type":"integer","format":"int64","description":"Last modification timestamp (epoch milliseconds)"},"deleted":{"type":"boolean","description":"Deletion status"},"deleted_at":{"type":"integer","format":"int64","description":"Deletion timestamp (epoch milliseconds)"},"deleted_by":{"type":"string","description":"User who deleted the rule"}}},"QueryResponse":{"type":"object","description":"Query object","properties":{"xql":{"type":"string","description":"XQL query string"}}},"MetadataResponse":{"type":"object","description":"Metadata object","properties":{"issue":{"description":"Issue information","allOf":[{"$ref":"#/components/schemas/IssueResponse"}]}}},"IssueResponse":{"type":"object","description":"Issue information","properties":{"recommendation":{"type":"string","description":"Remediation steps"}}},"ComplianceMetadata1":{"type":"object","description":"Compliance metadata object","properties":{"standard_name":{"type":"string","description":"Full name of the compliance standard"},"control_id":{"type":"string","description":"Compliance control identifier"},"control_name":{"type":"string","description":"Full name of the compliance control"}}},"ValidationErrorResponse":{"type":"object","properties":{"err_msg":{"type":"string"},"metadata":{"$ref":"#/components/schemas/Metadata1"}}},"Metadata1":{"type":"object","properties":{"err_extra":{"type":"array","items":{"$ref":"#/components/schemas/ErrorDetail"}}}},"ErrorDetail":{"type":"object","properties":{"field":{"type":"string"},"message":{"type":"string"}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/detection-rules-management/detection-rules.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.