> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-5-api/detection-rules-management/models.md).

# Models

## The AssetScope object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"AssetScope":{"type":"string","enum":["NO_ASSETS","ALL_ASSETS","ASSET_GROUPS"]}}}}
```

## The CloudType object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"CloudType":{"type":"string","enum":["all","aws","azure","gcp","alibaba_cloud","oci","other","ibm"]}}}}
```

## The ColumnDefinition object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"ColumnDefinition":{"type":"object","properties":{"FIELD_NAME":{"type":"string"},"FIELD_PRETTY_NAME":{"type":"string"},"DATA_TYPE":{"type":"string"},"COLUMN_TYPE":{"type":"string"},"IS_HIDDEN":{"type":"boolean"},"SORTABLE":{"type":"boolean"},"FILTERABLE":{"type":"boolean"},"FILTER_PARAMS":{"$ref":"#/components/schemas/FilterParams"},"ORDER_POSITION":{"type":"integer","format":"int32"},"ALLOWED_FILTERS":{"type":"array","items":{"type":"object","additionalProperties":{}}},"EXTRA_FIELDS":{"type":"array","items":{"type":"object","additionalProperties":{}}},"FIELD_TITLE":{"type":"object","additionalProperties":{}},"ENABLES_COLUMNS":{"type":"object","additionalProperties":{}},"TOOLTIP":{"type":"object","additionalProperties":{}},"IS_MULTI_VALUE":{"type":"boolean"},"IS_JSON_VALUE":{"type":"boolean"},"HIGHLIGHT":{"type":"object","additionalProperties":{}},"DISABLE_TRANSLATE_ENUM":{"type":"boolean"},"AUTOCOMPLETE_SUPPORTED":{"type":"boolean"},"STACKING_VIEW_DEF":{"type":"object","additionalProperties":{}},"HISTOGRAM_SUPPORTED":{"type":"boolean"}}},"FilterParams":{"type":"object","properties":{"WILDCARD_FILTERABLE":{"type":"boolean"},"HIGHLIGHT_TYPEAHEAD":{"type":"boolean"},"EXPAND_TREE_ON_SEARCH":{"type":"boolean"},"IS_COUNTABLE":{"type":"boolean"},"ENUM_VALUES":{"type":"array","items":{"$ref":"#/components/schemas/EnumValue"}}}},"EnumValue":{"type":"object","properties":{"NAME":{"type":"string"},"PRETTY_NAME":{"type":"string"}}}}}}
```

## The ComplianceMetadata object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"ComplianceMetadata":{"type":"object","description":"Compliance metadata object","properties":{"standard_name":{"type":"string","description":"Full name of the compliance standard"},"control_id":{"type":"string","description":"Compliance control identifier"},"control_name":{"type":"string","description":"Full name of the compliance control"}}}}}}
```

## The ComplianceMetadata1 object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"ComplianceMetadata1":{"type":"object","description":"Compliance metadata object","properties":{"standard_name":{"type":"string","description":"Full name of the compliance standard"},"control_id":{"type":"string","description":"Compliance control identifier"},"control_name":{"type":"string","description":"Full name of the compliance control"}}}}}}
```

## The ComplianceMetadataRequest object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"ComplianceMetadataRequest":{"type":"object","description":"Compliance metadata object","required":["control_id"],"properties":{"control_id":{"type":"string","description":"Compliance control identifier","pattern":"\\S"}}}}}}
```

## The ComplianceMetadataRequest1 object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"ComplianceMetadataRequest1":{"type":"object","description":"Compliance metadata object","properties":{"control_id":{"type":"string","description":"Compliance control identifier"}}}}}}
```

## The CreateRuleRequest object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"CreateRuleRequest":{"description":"Request body for creating a detection rule","type":"object","required":["name","asset_types","severity","query"],"properties":{"name":{"type":"string","description":"Unique rule name","pattern":"\\S","maxLength":255},"description":{"type":"string","description":"Detailed rule description","maxLength":2000},"class":{"type":"string","description":"Rule class - Must be 'config' (CSPM)","pattern":"\\S"},"type":{"type":"string","description":"Rule type - Must be 'DETECTION' (can be inferred if not provided)"},"asset_types":{"type":"array","items":{"type":"string","pattern":"\\S"},"description":"Array with single asset type identifier (exactly one required)","minItems":1,"maxItems":1},"severity":{"type":"string","description":"Rule severity (low, medium, high, critical, informational)","pattern":"\\S"},"query":{"description":"Query object containing XQL","allOf":[{"$ref":"#/components/schemas/QueryRequest"}]},"metadata":{"description":"Metadata containing issue information","allOf":[{"$ref":"#/components/schemas/MetadataRequest"}]},"compliance_metadata":{"type":"array","items":{"$ref":"#/components/schemas/ComplianceMetadataRequest"},"description":"List of compliance metadata with control IDs","maxItems":100},"labels":{"type":"array","items":{"type":"string","maxLength":100},"description":"Custom labels (max 50, each max 100 chars)","maxItems":50},"enabled":{"type":"boolean","description":"Rule enabled status (default: true)"}}},"QueryRequest":{"type":"object","description":"Query object","required":["xql"],"properties":{"xql":{"type":"string","description":"Valid XQL query string","pattern":"\\S"}}},"MetadataRequest":{"type":"object","description":"Metadata object","properties":{"issue":{"description":"Issue information","allOf":[{"$ref":"#/components/schemas/IssueRequest"}]}}},"IssueRequest":{"type":"object","description":"Issue information","properties":{"recommendation":{"type":"string","description":"Remediation steps","maxLength":5000}}},"ComplianceMetadataRequest":{"type":"object","description":"Compliance metadata object","required":["control_id"],"properties":{"control_id":{"type":"string","description":"Compliance control identifier","pattern":"\\S"}}}}}}
```

## The DetectionRuleBffWrapper object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"DetectionRuleBffWrapper":{"type":"object","properties":{"DATA":{"type":"array","items":{"$ref":"#/components/schemas/DetectionRuleDomain"},"description":"List of detection rules","readOnly":true},"FILTER_COUNT":{"type":"integer","format":"int64","description":"Count of detection rules matching the filter criteria","readOnly":true},"TOTAL_COUNT":{"type":"integer","format":"int64","description":"Total number of rules present in the service","readOnly":true}}},"DetectionRuleDomain":{"type":"object","description":"Detection rule domain object containing all rule properties","properties":{"id":{"description":"Unique detection rule identifier","readOnly":true,"allOf":[{"$ref":"#/components/schemas/UUID"}]},"sourceId":{"type":"string","description":"This is the unique identifier if provided and module needs to maintain it but an optional parameter, preferred format is module_name_<UUID> If source_id is not provided it will be kept empty","readOnly":true},"name":{"type":"string","description":"Conditional. Unique rule name, only required when creating a new detection rule"},"findingTypeId":{"type":"integer","format":"int32","description":"Unique finding type id platform attribute related to xdm finding type","readOnly":true},"module":{"description":"Conditional. Only required when creating a new detection rule","allOf":[{"$ref":"#/components/schemas/SupportedModule"}]},"description":{"type":"string","description":"Conditional. Only required when creating a new detection rule"},"type":{"description":"Conditional. Only required when creating a new detection rule","allOf":[{"$ref":"#/components/schemas/RuleType"}]},"subTypes":{"type":"array","items":{"$ref":"#/components/schemas/SubType"},"description":"Conditional. Only required when creating a new detection rule"},"query":{"type":"object","additionalProperties":{},"description":"Conditional.This is the rule definition query described as an json object. The module can choose the parameters according to the use case. Only required when creating a new detection rule"},"assetTypes":{"type":"array","items":{"type":"string"},"description":"This is platform asset type id associated with detection rule","readOnly":true},"assetType":{"type":"string","description":"This is platform asset type id associated with detection rule","readOnly":true,"deprecated":true},"severity":{"description":"Conditional. It represents rules criticality and only required when creating a new detection rule","allOf":[{"$ref":"#/components/schemas/Severity"}]},"enhancedRemediation":{"type":"boolean","description":"Indicates if enhanced remediation is available for a specific detection rule","readOnly":true},"remediation":{"type":"object","additionalProperties":{},"description":"Actionable remediation steps to resolve the issue. Modules can decide the schema of the json object based on use case"},"recommendation":{"type":"string","description":"Steps/description for resolving the issue, usually it is detailed blob of text writeup","deprecated":true},"criticalPaths":{"type":"object","additionalProperties":{},"description":"Critical Paths"},"cloudType":{"description":"Cloud Type associated with a detection rule","allOf":[{"$ref":"#/components/schemas/CloudType"}]},"validateQuery":{"type":"boolean","description":"Indicates if a detection rule should only be validated for structure and semantics. Note: If true, rule will not be persisted.","default":false},"ruleExists":{"type":"boolean","description":"Indicates if a detection rule with same name already exists. Note: If true, rule will not be persisted.","default":false},"systemDefault":{"type":"boolean","description":"This specifies if the rule is out of box rule","default":false},"enabled":{"type":"boolean","description":"This field specified if rule is active or disabled","default":true},"excluded":{"type":"boolean","description":"This field specified if rule is excluded from default policy","default":false},"additionalFields":{"type":"object","additionalProperties":{},"description":"Extra module specific metadata for the rule if required. Module can decide the format of json object but number of keys must be less than 50."},"labels":{"type":["array","null"],"items":{"type":"string","maxLength":100},"description":"Conditional. Only required when creating a new detection rule","maxItems":50},"startTs":{"type":"integer","format":"int64","description":"Attribute indicating if detection rule should be be enabled at a certain timestamp","readOnly":true},"endTs":{"type":"integer","format":"int64","description":"Attribute indicating if detection rule should be be disabled after a certain timestamp"},"lastModifiedBy":{"type":"string","description":"This is unique identifier of the user who created/last updated the detection rule","readOnly":true,"minLength":1},"lastModifiedOn":{"type":"integer","format":"int64","description":"Attribute indicating when the detection rule last created/modified","readOnly":true},"createdBy":{"type":"string","description":"User name or identifier who initially created the detection rule"},"createdOn":{"type":"integer","format":"int64","description":"Attribute indicating when the detection rule is created","readOnly":true},"complianceStandards":{"type":["array","null"],"items":{"type":"string"},"description":"The Compliance Standards for the rule"},"controlIds":{"type":["array","null"],"items":{"type":"string"},"description":"The Compliance Control Ids for the rule"},"findingCategories":{"type":"array","items":{"type":"string"},"description":"Finding Categories"},"findingTypes":{"type":"array","items":{"type":"string"},"description":"Finding Types"},"cloneable":{"type":"boolean","description":"Indicates if this rule can be cloned in query builder","readOnly":true}},"required":["name","module","description","type","query","severity","cloudType","lastModifiedBy"]},"UUID":{"type":"string","format":"uuid","pattern":"[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}"},"SupportedModule":{"type":"string","enum":["PLATFORM","CWP","CNAPP","CIEM","DSPM","API_SECURITY","CAS","CSPM","ASM","ITDR","CNS","ORPHAN","AISPM"]},"RuleType":{"type":"string","enum":["config","attack_path","network_reachability","identity","data","AI"]},"SubType":{"type":"string","enum":["build","run","permissions"]},"Severity":{"type":"string","enum":["informational","low","medium","high","critical"]},"CloudType":{"type":"string","enum":["all","aws","azure","gcp","alibaba_cloud","oci","other","ibm"]}}}}
```

## The DetectionRuleDomain object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"DetectionRuleDomain":{"type":"object","description":"Detection rule domain object containing all rule properties","properties":{"id":{"description":"Unique detection rule identifier","readOnly":true,"allOf":[{"$ref":"#/components/schemas/UUID"}]},"sourceId":{"type":"string","description":"This is the unique identifier if provided and module needs to maintain it but an optional parameter, preferred format is module_name_<UUID> If source_id is not provided it will be kept empty","readOnly":true},"name":{"type":"string","description":"Conditional. Unique rule name, only required when creating a new detection rule"},"findingTypeId":{"type":"integer","format":"int32","description":"Unique finding type id platform attribute related to xdm finding type","readOnly":true},"module":{"description":"Conditional. Only required when creating a new detection rule","allOf":[{"$ref":"#/components/schemas/SupportedModule"}]},"description":{"type":"string","description":"Conditional. Only required when creating a new detection rule"},"type":{"description":"Conditional. Only required when creating a new detection rule","allOf":[{"$ref":"#/components/schemas/RuleType"}]},"subTypes":{"type":"array","items":{"$ref":"#/components/schemas/SubType"},"description":"Conditional. Only required when creating a new detection rule"},"query":{"type":"object","additionalProperties":{},"description":"Conditional.This is the rule definition query described as an json object. The module can choose the parameters according to the use case. Only required when creating a new detection rule"},"assetTypes":{"type":"array","items":{"type":"string"},"description":"This is platform asset type id associated with detection rule","readOnly":true},"assetType":{"type":"string","description":"This is platform asset type id associated with detection rule","readOnly":true,"deprecated":true},"severity":{"description":"Conditional. It represents rules criticality and only required when creating a new detection rule","allOf":[{"$ref":"#/components/schemas/Severity"}]},"enhancedRemediation":{"type":"boolean","description":"Indicates if enhanced remediation is available for a specific detection rule","readOnly":true},"remediation":{"type":"object","additionalProperties":{},"description":"Actionable remediation steps to resolve the issue. Modules can decide the schema of the json object based on use case"},"recommendation":{"type":"string","description":"Steps/description for resolving the issue, usually it is detailed blob of text writeup","deprecated":true},"criticalPaths":{"type":"object","additionalProperties":{},"description":"Critical Paths"},"cloudType":{"description":"Cloud Type associated with a detection rule","allOf":[{"$ref":"#/components/schemas/CloudType"}]},"validateQuery":{"type":"boolean","description":"Indicates if a detection rule should only be validated for structure and semantics. Note: If true, rule will not be persisted.","default":false},"ruleExists":{"type":"boolean","description":"Indicates if a detection rule with same name already exists. Note: If true, rule will not be persisted.","default":false},"systemDefault":{"type":"boolean","description":"This specifies if the rule is out of box rule","default":false},"enabled":{"type":"boolean","description":"This field specified if rule is active or disabled","default":true},"excluded":{"type":"boolean","description":"This field specified if rule is excluded from default policy","default":false},"additionalFields":{"type":"object","additionalProperties":{},"description":"Extra module specific metadata for the rule if required. Module can decide the format of json object but number of keys must be less than 50."},"labels":{"type":["array","null"],"items":{"type":"string","maxLength":100},"description":"Conditional. Only required when creating a new detection rule","maxItems":50},"startTs":{"type":"integer","format":"int64","description":"Attribute indicating if detection rule should be be enabled at a certain timestamp","readOnly":true},"endTs":{"type":"integer","format":"int64","description":"Attribute indicating if detection rule should be be disabled after a certain timestamp"},"lastModifiedBy":{"type":"string","description":"This is unique identifier of the user who created/last updated the detection rule","readOnly":true,"minLength":1},"lastModifiedOn":{"type":"integer","format":"int64","description":"Attribute indicating when the detection rule last created/modified","readOnly":true},"createdBy":{"type":"string","description":"User name or identifier who initially created the detection rule"},"createdOn":{"type":"integer","format":"int64","description":"Attribute indicating when the detection rule is created","readOnly":true},"complianceStandards":{"type":["array","null"],"items":{"type":"string"},"description":"The Compliance Standards for the rule"},"controlIds":{"type":["array","null"],"items":{"type":"string"},"description":"The Compliance Control Ids for the rule"},"findingCategories":{"type":"array","items":{"type":"string"},"description":"Finding Categories"},"findingTypes":{"type":"array","items":{"type":"string"},"description":"Finding Types"},"cloneable":{"type":"boolean","description":"Indicates if this rule can be cloned in query builder","readOnly":true}},"required":["name","module","description","type","query","severity","cloudType","lastModifiedBy"]},"UUID":{"type":"string","format":"uuid","pattern":"[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}"},"SupportedModule":{"type":"string","enum":["PLATFORM","CWP","CNAPP","CIEM","DSPM","API_SECURITY","CAS","CSPM","ASM","ITDR","CNS","ORPHAN","AISPM"]},"RuleType":{"type":"string","enum":["config","attack_path","network_reachability","identity","data","AI"]},"SubType":{"type":"string","enum":["build","run","permissions"]},"Severity":{"type":"string","enum":["informational","low","medium","high","critical"]},"CloudType":{"type":"string","enum":["all","aws","azure","gcp","alibaba_cloud","oci","other","ibm"]}}}}
```

## The EnumElement object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"EnumElement":{"type":"object","properties":{"NAME":{"type":"string"},"PRETTY_NAME":{"type":"string"}}}}}}
```

## The EnumValue object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"EnumValue":{"type":"object","properties":{"NAME":{"type":"string"},"PRETTY_NAME":{"type":"string"}}}}}}
```

## The ErrorDetail object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"ErrorDetail":{"type":"object","properties":{"field":{"type":"string"},"message":{"type":"string"}}}}}}
```

## The FilterCriteria object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"FilterCriteria":{"type":"object","description":"Filter criteria supporting AND/OR logical operations and direct field searches","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterCriteria"},"description":"Array of filter criteria to be combined with AND logic"},"OR":{"type":"array","items":{"$ref":"#/components/schemas/FilterCriteria"},"description":"Array of filter criteria to be combined with OR logic"},"SEARCH_FIELD":{"type":"string","description":"Field name to search on"},"SEARCH_TYPE":{"type":"string","description":"Search operation type (EQ, NEQ, CONTAINS, NCONTAINS)"},"SEARCH_VALUE":{"type":"string","description":"Value to search for"}}}}}}
```

## The FilterData object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"FilterData":{"type":"object","properties":{"filter":{"type":"object","additionalProperties":{"type":"array","items":{"type":"object"}}},"locked":{"type":"object","additionalProperties":{"type":"array","items":{"type":"object"}}},"paging":{"type":"object","additionalProperties":{"type":"integer","format":"int32"}},"sort":{"type":"array","items":{"type":"object","additionalProperties":{"type":"string"}}},"userContext":{"$ref":"#/components/schemas/UserContext"}}},"UserContext":{"type":"object","properties":{"isAdmin":{"type":"boolean"},"sbacEnabled":{"type":"boolean"},"assetScope":{"$ref":"#/components/schemas/AssetScope"},"incidentScope":{"$ref":"#/components/schemas/IncidentScope"},"incidentDomains":{"type":"array","items":{"type":"string"}},"assetGroupIds":{"type":"array","items":{"type":"integer","format":"int32"}}}},"AssetScope":{"type":"string","enum":["NO_ASSETS","ALL_ASSETS","ASSET_GROUPS"]},"IncidentScope":{"type":"string","enum":["NO_INCIDENT","ALL_INCIDENT","INCIDENT_GROUPS"]}}}}
```

## The FilterParams object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"FilterParams":{"type":"object","properties":{"WILDCARD_FILTERABLE":{"type":"boolean"},"HIGHLIGHT_TYPEAHEAD":{"type":"boolean"},"EXPAND_TREE_ON_SEARCH":{"type":"boolean"},"IS_COUNTABLE":{"type":"boolean"},"ENUM_VALUES":{"type":"array","items":{"$ref":"#/components/schemas/EnumValue"}}}},"EnumValue":{"type":"object","properties":{"NAME":{"type":"string"},"PRETTY_NAME":{"type":"string"}}}}}}
```

## The FindingDefinition object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"FindingDefinition":{"type":"object","required":["type_id","owner","category","name"],"properties":{"type_id":{"type":"integer","format":"int32"},"owner":{"type":"string","minLength":1},"category":{"type":"string","minLength":1},"name":{"type":"string","minLength":1},"docs":{"type":"string"}}}}}}
```

## The HistogramFilterData object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"HistogramFilterData":{"type":"object","properties":{"filter":{"type":"object","additionalProperties":{"type":"array","items":{"type":"object"}}},"userContext":{"$ref":"#/components/schemas/UserContext"}}},"UserContext":{"type":"object","properties":{"isAdmin":{"type":"boolean"},"sbacEnabled":{"type":"boolean"},"assetScope":{"$ref":"#/components/schemas/AssetScope"},"incidentScope":{"$ref":"#/components/schemas/IncidentScope"},"incidentDomains":{"type":"array","items":{"type":"string"}},"assetGroupIds":{"type":"array","items":{"type":"integer","format":"int32"}}}},"AssetScope":{"type":"string","enum":["NO_ASSETS","ALL_ASSETS","ASSET_GROUPS"]},"IncidentScope":{"type":"string","enum":["NO_INCIDENT","ALL_INCIDENT","INCIDENT_GROUPS"]}}}}
```

## The IncidentScope object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"IncidentScope":{"type":"string","enum":["NO_INCIDENT","ALL_INCIDENT","INCIDENT_GROUPS"]}}}}
```

## The IssueRequest object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"IssueRequest":{"type":"object","description":"Issue information","properties":{"recommendation":{"type":"string","description":"Remediation steps","maxLength":5000}}}}}}
```

## The IssueRequest1 object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"IssueRequest1":{"type":"object","description":"Issue information","properties":{"recommendation":{"type":"string","description":"Remediation steps","maxLength":5000}}}}}}
```

## The IssueResponse object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"IssueResponse":{"type":"object","description":"Issue information","properties":{"recommendation":{"type":"string","description":"Remediation steps"}}}}}}
```

## The Metadata object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"Metadata":{"type":"object","description":"Metadata containing count information","required":["filter_count","total_count"],"properties":{"filter_count":{"type":"integer","format":"int64","description":"Number of rules matching the filter criteria"},"total_count":{"type":"integer","format":"int64","description":"Total number of rules available"}}}}}}
```

## The Metadata1 object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"Metadata1":{"type":"object","properties":{"err_extra":{"type":"array","items":{"$ref":"#/components/schemas/ErrorDetail"}}}},"ErrorDetail":{"type":"object","properties":{"field":{"type":"string"},"message":{"type":"string"}}}}}}
```

## The MetadataRequest object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"MetadataRequest":{"type":"object","description":"Metadata object","properties":{"issue":{"description":"Issue information","allOf":[{"$ref":"#/components/schemas/IssueRequest"}]}}},"IssueRequest":{"type":"object","description":"Issue information","properties":{"recommendation":{"type":"string","description":"Remediation steps","maxLength":5000}}}}}}
```

## The MetadataRequest1 object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"MetadataRequest1":{"type":"object","description":"Metadata object","properties":{"issue":{"description":"Issue information","allOf":[{"$ref":"#/components/schemas/IssueRequest1"}]}}},"IssueRequest1":{"type":"object","description":"Issue information","properties":{"recommendation":{"type":"string","description":"Remediation steps","maxLength":5000}}}}}}
```

## The MetadataResponse object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"MetadataResponse":{"type":"object","description":"Metadata object","properties":{"issue":{"description":"Issue information","allOf":[{"$ref":"#/components/schemas/IssueResponse"}]}}},"IssueResponse":{"type":"object","description":"Issue information","properties":{"recommendation":{"type":"string","description":"Remediation steps"}}}}}}
```

## The PredefinedFilter object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"PredefinedFilter":{"type":"object","properties":{"filter":{"type":"object","additionalProperties":{}},"sort":{"type":"array","items":{"$ref":"#/components/schemas/Sort"}}}},"Sort":{"type":"object","properties":{"FIELD":{"type":"string"},"ORDER":{"type":"string"}}}}}}
```

## The PublicRulesResponse object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"PublicRulesResponse":{"description":"Response containing a list of detection rules with metadata","type":"object","required":["data","metadata"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/RuleData"},"description":"List of detection rules matching the filter criteria"},"metadata":{"description":"Metadata about the response including counts","allOf":[{"$ref":"#/components/schemas/Metadata"}]}}},"RuleData":{"type":"object","description":"Detection rule data","properties":{"asset_types":{"type":"array","items":{"type":"string"},"description":"Array of asset type identifiers"},"class":{"type":"string","description":"Rule class"},"compliance_metadata":{"type":"array","items":{"$ref":"#/components/schemas/ComplianceMetadata"},"description":"Array of compliance metadata objects with full standard and control information"},"compliance_standards":{"type":"array","items":{"type":"string"},"description":"List of compliance standards associated with the rule"},"created_by":{"type":"string","description":"User who created the rule"},"created_on":{"type":"integer","format":"int64","description":"Timestamp when the rule was created (milliseconds since epoch)"},"description":{"type":"string","description":"Detailed description of the rule"},"enabled":{"type":"boolean","description":"Whether the rule is enabled"},"id":{"type":"string","description":"Unique identifier of the rule"},"labels":{"type":"array","items":{"type":"string"},"description":"Custom labels associated with the rule"},"last_modified_by":{"type":"string","description":"User who last modified the rule"},"last_modified_on":{"type":"integer","format":"int64","description":"Timestamp when the rule was last modified (milliseconds since epoch)"},"module":{"type":"string","description":"Module the rule belongs to"},"name":{"type":"string","description":"Name of the rule"},"provider":{"type":"string","description":"Cloud provider"},"severity":{"type":"string","description":"Severity level of the rule","enum":["low","medium","high","critical","informational"]},"system_default":{"type":"boolean","description":"Whether this is a system default rule"},"type":{"type":"string","description":"Type of the rule","enum":["config","network","audit_event","anomaly","data"]}},"required":["class","created_by","created_on","description","enabled","id","last_modified_by","last_modified_on","module","name","provider","severity","system_default","type"]},"ComplianceMetadata":{"type":"object","description":"Compliance metadata object","properties":{"standard_name":{"type":"string","description":"Full name of the compliance standard"},"control_id":{"type":"string","description":"Compliance control identifier"},"control_name":{"type":"string","description":"Full name of the compliance control"}}},"Metadata":{"type":"object","description":"Metadata containing count information","required":["filter_count","total_count"],"properties":{"filter_count":{"type":"integer","format":"int64","description":"Number of rules matching the filter criteria"},"total_count":{"type":"integer","format":"int64","description":"Total number of rules available"}}}}}}
```

## The QueryRequest object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"QueryRequest":{"type":"object","description":"Query object","required":["xql"],"properties":{"xql":{"type":"string","description":"Valid XQL query string","pattern":"\\S"}}}}}}
```

## The QueryRequest1 object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"QueryRequest1":{"type":"object","description":"Query object","properties":{"xql":{"type":"string","description":"XQL query string (only editable for custom config rules with XQL)"}}}}}}
```

## The QueryResponse object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"QueryResponse":{"type":"object","description":"Query object","properties":{"xql":{"type":"string","description":"XQL query string"}}}}}}
```

## The RuleData object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"RuleData":{"type":"object","description":"Detection rule data","properties":{"asset_types":{"type":"array","items":{"type":"string"},"description":"Array of asset type identifiers"},"class":{"type":"string","description":"Rule class"},"compliance_metadata":{"type":"array","items":{"$ref":"#/components/schemas/ComplianceMetadata"},"description":"Array of compliance metadata objects with full standard and control information"},"compliance_standards":{"type":"array","items":{"type":"string"},"description":"List of compliance standards associated with the rule"},"created_by":{"type":"string","description":"User who created the rule"},"created_on":{"type":"integer","format":"int64","description":"Timestamp when the rule was created (milliseconds since epoch)"},"description":{"type":"string","description":"Detailed description of the rule"},"enabled":{"type":"boolean","description":"Whether the rule is enabled"},"id":{"type":"string","description":"Unique identifier of the rule"},"labels":{"type":"array","items":{"type":"string"},"description":"Custom labels associated with the rule"},"last_modified_by":{"type":"string","description":"User who last modified the rule"},"last_modified_on":{"type":"integer","format":"int64","description":"Timestamp when the rule was last modified (milliseconds since epoch)"},"module":{"type":"string","description":"Module the rule belongs to"},"name":{"type":"string","description":"Name of the rule"},"provider":{"type":"string","description":"Cloud provider"},"severity":{"type":"string","description":"Severity level of the rule","enum":["low","medium","high","critical","informational"]},"system_default":{"type":"boolean","description":"Whether this is a system default rule"},"type":{"type":"string","description":"Type of the rule","enum":["config","network","audit_event","anomaly","data"]}},"required":["class","created_by","created_on","description","enabled","id","last_modified_by","last_modified_on","module","name","provider","severity","system_default","type"]},"ComplianceMetadata":{"type":"object","description":"Compliance metadata object","properties":{"standard_name":{"type":"string","description":"Full name of the compliance standard"},"control_id":{"type":"string","description":"Compliance control identifier"},"control_name":{"type":"string","description":"Full name of the compliance control"}}}}}}
```

## The RuleHistogramRequest object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"RuleHistogramRequest":{"type":"object","properties":{"table_name":{"type":"string"},"columns":{"type":"array","items":{"type":"string"}},"enums":{"type":"object","additionalProperties":{"type":"array","items":{"$ref":"#/components/schemas/EnumElement"}}},"filter_data":{"$ref":"#/components/schemas/HistogramFilterData"},"max_values_per_column":{"type":"integer","format":"int32"}}},"EnumElement":{"type":"object","properties":{"NAME":{"type":"string"},"PRETTY_NAME":{"type":"string"}}},"HistogramFilterData":{"type":"object","properties":{"filter":{"type":"object","additionalProperties":{"type":"array","items":{"type":"object"}}},"userContext":{"$ref":"#/components/schemas/UserContext"}}},"UserContext":{"type":"object","properties":{"isAdmin":{"type":"boolean"},"sbacEnabled":{"type":"boolean"},"assetScope":{"$ref":"#/components/schemas/AssetScope"},"incidentScope":{"$ref":"#/components/schemas/IncidentScope"},"incidentDomains":{"type":"array","items":{"type":"string"}},"assetGroupIds":{"type":"array","items":{"type":"integer","format":"int32"}}}},"AssetScope":{"type":"string","enum":["NO_ASSETS","ALL_ASSETS","ASSET_GROUPS"]},"IncidentScope":{"type":"string","enum":["NO_INCIDENT","ALL_INCIDENT","INCIDENT_GROUPS"]}}}}
```

## The RuleMigrationErrorLogRequest object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"RuleMigrationErrorLogRequest":{"type":"object","properties":{"item_type":{"type":"string"}}}}}}
```

## The RuleMigrationRequest object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"RuleMigrationRequest":{"type":"object","properties":{"item_type":{"$ref":"#/components/schemas/UserSelectedOperation"},"migration_ts":{"type":"integer","format":"int64"},"user_selected_operations":{"type":"array","uniqueItems":true,"items":{"$ref":"#/components/schemas/UserSelectedOperation"},"minItems":1}},"required":["user_selected_operations"]},"UserSelectedOperation":{"type":"string","enum":["cloudsec-rules","cloudsec-compliance-standards","cloudsec-policies","cloudsec-notifications"]}}}}
```

## The RuleMigrationStatusRequest object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"RuleMigrationStatusRequest":{"type":"object","properties":{"item_type":{"type":"string"},"activation_time":{"type":"integer","format":"int64"}}}}}}
```

## The RuleResponse object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"RuleResponse":{"description":"Response for rule operations","type":"object","properties":{"id":{"type":"string","description":"Unique rule identifier"},"name":{"type":"string","description":"Rule name"},"description":{"type":"string","description":"Rule description"},"rule_class":{"type":"string","description":"Rule class"},"type":{"type":"string","description":"Rule type"},"providers":{"type":"array","items":{"type":"string"},"description":"Cloud providers (derived from asset_types)"},"asset_types":{"type":"array","items":{"type":"string"},"description":"Array of asset type identifiers"},"severity":{"type":"string","description":"Rule severity"},"query":{"description":"Query object","allOf":[{"$ref":"#/components/schemas/QueryResponse"}]},"metadata":{"description":"Metadata containing issue information","allOf":[{"$ref":"#/components/schemas/MetadataResponse"}]},"compliance_metadata":{"type":"array","items":{"$ref":"#/components/schemas/ComplianceMetadata1"},"description":"Array of compliance metadata objects with full standard and control information"},"labels":{"type":"array","items":{"type":"string"},"description":"Custom labels"},"enabled":{"type":"boolean","description":"Rule enabled status"},"system_default":{"type":"boolean","description":"System default rule indicator"},"created_by":{"type":"string","description":"Creator identifier"},"created_on":{"type":"integer","format":"int64","description":"Creation timestamp (epoch milliseconds)"},"last_modified_by":{"type":"string","description":"Last modifier"},"last_modified_on":{"type":"integer","format":"int64","description":"Last modification timestamp (epoch milliseconds)"},"deleted":{"type":"boolean","description":"Deletion status"},"deleted_at":{"type":"integer","format":"int64","description":"Deletion timestamp (epoch milliseconds)"},"deleted_by":{"type":"string","description":"User who deleted the rule"}}},"QueryResponse":{"type":"object","description":"Query object","properties":{"xql":{"type":"string","description":"XQL query string"}}},"MetadataResponse":{"type":"object","description":"Metadata object","properties":{"issue":{"description":"Issue information","allOf":[{"$ref":"#/components/schemas/IssueResponse"}]}}},"IssueResponse":{"type":"object","description":"Issue information","properties":{"recommendation":{"type":"string","description":"Remediation steps"}}},"ComplianceMetadata1":{"type":"object","description":"Compliance metadata object","properties":{"standard_name":{"type":"string","description":"Full name of the compliance standard"},"control_id":{"type":"string","description":"Compliance control identifier"},"control_name":{"type":"string","description":"Full name of the compliance control"}}}}}}
```

## The RuleType object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"RuleType":{"type":"string","enum":["config","attack_path","network_reachability","identity","data","AI"]}}}}
```

## The RulesDataRequest object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"RulesDataRequest":{"type":"object","properties":{"extraData":{"type":"string"},"filter_data":{"$ref":"#/components/schemas/FilterData"},"jsons":{"type":"array","items":{"type":"string"}}}},"FilterData":{"type":"object","properties":{"filter":{"type":"object","additionalProperties":{"type":"array","items":{"type":"object"}}},"locked":{"type":"object","additionalProperties":{"type":"array","items":{"type":"object"}}},"paging":{"type":"object","additionalProperties":{"type":"integer","format":"int32"}},"sort":{"type":"array","items":{"type":"object","additionalProperties":{"type":"string"}}},"userContext":{"$ref":"#/components/schemas/UserContext"}}},"UserContext":{"type":"object","properties":{"isAdmin":{"type":"boolean"},"sbacEnabled":{"type":"boolean"},"assetScope":{"$ref":"#/components/schemas/AssetScope"},"incidentScope":{"$ref":"#/components/schemas/IncidentScope"},"incidentDomains":{"type":"array","items":{"type":"string"}},"assetGroupIds":{"type":"array","items":{"type":"integer","format":"int32"}}}},"AssetScope":{"type":"string","enum":["NO_ASSETS","ALL_ASSETS","ASSET_GROUPS"]},"IncidentScope":{"type":"string","enum":["NO_INCIDENT","ALL_INCIDENT","INCIDENT_GROUPS"]}}}}
```

## The RulesPublicDataRequest object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"RulesPublicDataRequest":{"description":"Request body for querying detection rules","type":"object","properties":{"filter":{"description":"Filter criteria for searching rules","allOf":[{"$ref":"#/components/schemas/FilterCriteria"}]},"search_from":{"type":"integer","format":"int32","description":"Offset index for pagination"},"search_to":{"type":"integer","format":"int32","description":"Ending index for pagination. The default is 100, and it can be up to 1000.For example, when `search_from` is `10` and `search_to` is `100`, the API retrieves results from index `10` through `100`"},"sort":{"type":"array","items":{"$ref":"#/components/schemas/SortCriteria"},"description":"Sort criteria"}}},"FilterCriteria":{"type":"object","description":"Filter criteria supporting AND/OR logical operations and direct field searches","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterCriteria"},"description":"Array of filter criteria to be combined with AND logic"},"OR":{"type":"array","items":{"$ref":"#/components/schemas/FilterCriteria"},"description":"Array of filter criteria to be combined with OR logic"},"SEARCH_FIELD":{"type":"string","description":"Field name to search on"},"SEARCH_TYPE":{"type":"string","description":"Search operation type (EQ, NEQ, CONTAINS, NCONTAINS)"},"SEARCH_VALUE":{"type":"string","description":"Value to search for"}}},"SortCriteria":{"type":"object","required":["FIELD"],"properties":{"FIELD":{"type":"string","description":"Field name to sort by","pattern":"\\S"},"ORDER":{"type":"string","description":"Sort order (ASC or DESC)"}}}}}}
```

## The Severity object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"Severity":{"type":"string","enum":["informational","low","medium","high","critical"]}}}}
```

## The Sort object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"Sort":{"type":"object","properties":{"FIELD":{"type":"string"},"ORDER":{"type":"string"}}}}}}
```

## The SortCriteria object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"SortCriteria":{"type":"object","required":["FIELD"],"properties":{"FIELD":{"type":"string","description":"Field name to sort by","pattern":"\\S"},"ORDER":{"type":"string","description":"Sort order (ASC or DESC)"}}}}}}
```

## The SubType object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"SubType":{"type":"string","enum":["build","run","permissions"]}}}}
```

## The SupportedModule object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"SupportedModule":{"type":"string","enum":["PLATFORM","CWP","CNAPP","CIEM","DSPM","API_SECURITY","CAS","CSPM","ASM","ITDR","CNS","ORPHAN","AISPM"]}}}}
```

## The TableViewDefinition object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"TableViewDefinition":{"type":"object","properties":{"PREDEFINED_FILTER":{"$ref":"#/components/schemas/PredefinedFilter"},"TABLE_NAME":{"type":"string"},"TABLE_DESCRIPTION":{"type":"string"},"COLUMN_DEFINITIONS":{"type":"array","items":{"$ref":"#/components/schemas/ColumnDefinition"}},"EXPORT_METHODS":{"type":"array","items":{"type":"object","additionalProperties":{}}},"DATA_ID":{"type":"string"},"DATASET_ID":{"type":"string"},"DATA_TYPE":{"type":"string"},"KEY_COLUMN":{"type":"string"},"ENTITY_TYPE":{"type":"string"},"DEFAULT_COLUMN_USED":{"type":"boolean"},"TIME_FIELD":{"type":"string"},"TABLE_CONFIGURATION":{"type":"object","additionalProperties":{}},"AGGREGATED_COLUMN_DATA":{"type":"object","additionalProperties":{}},"TOTAL_WIDGETS":{"type":"integer","format":"int32"},"VIEW_DATA":{"type":"object","additionalProperties":{}}}},"PredefinedFilter":{"type":"object","properties":{"filter":{"type":"object","additionalProperties":{}},"sort":{"type":"array","items":{"$ref":"#/components/schemas/Sort"}}}},"Sort":{"type":"object","properties":{"FIELD":{"type":"string"},"ORDER":{"type":"string"}}},"ColumnDefinition":{"type":"object","properties":{"FIELD_NAME":{"type":"string"},"FIELD_PRETTY_NAME":{"type":"string"},"DATA_TYPE":{"type":"string"},"COLUMN_TYPE":{"type":"string"},"IS_HIDDEN":{"type":"boolean"},"SORTABLE":{"type":"boolean"},"FILTERABLE":{"type":"boolean"},"FILTER_PARAMS":{"$ref":"#/components/schemas/FilterParams"},"ORDER_POSITION":{"type":"integer","format":"int32"},"ALLOWED_FILTERS":{"type":"array","items":{"type":"object","additionalProperties":{}}},"EXTRA_FIELDS":{"type":"array","items":{"type":"object","additionalProperties":{}}},"FIELD_TITLE":{"type":"object","additionalProperties":{}},"ENABLES_COLUMNS":{"type":"object","additionalProperties":{}},"TOOLTIP":{"type":"object","additionalProperties":{}},"IS_MULTI_VALUE":{"type":"boolean"},"IS_JSON_VALUE":{"type":"boolean"},"HIGHLIGHT":{"type":"object","additionalProperties":{}},"DISABLE_TRANSLATE_ENUM":{"type":"boolean"},"AUTOCOMPLETE_SUPPORTED":{"type":"boolean"},"STACKING_VIEW_DEF":{"type":"object","additionalProperties":{}},"HISTOGRAM_SUPPORTED":{"type":"boolean"}}},"FilterParams":{"type":"object","properties":{"WILDCARD_FILTERABLE":{"type":"boolean"},"HIGHLIGHT_TYPEAHEAD":{"type":"boolean"},"EXPAND_TREE_ON_SEARCH":{"type":"boolean"},"IS_COUNTABLE":{"type":"boolean"},"ENUM_VALUES":{"type":"array","items":{"$ref":"#/components/schemas/EnumValue"}}}},"EnumValue":{"type":"object","properties":{"NAME":{"type":"string"},"PRETTY_NAME":{"type":"string"}}}}}}
```

## The UUID object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"UUID":{"type":"string","format":"uuid","pattern":"[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}"}}}}
```

## The UnifiedQueryDefinition object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"UnifiedQueryDefinition":{"type":"object","properties":{"xql":{"type":"string"},"json":{"type":"object","additionalProperties":{}}}}}}}
```

## The UnifiedRuleSeverity object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"UnifiedRuleSeverity":{"type":"string","enum":["INFORMATIONAL","LOW","MEDIUM","HIGH","CRITICAL"]}}}}
```

## The UnifiedRuleType object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"UnifiedRuleType":{"type":"string","enum":["SILENT","DETECTION","FINDING"]}}}}
```

## The UpdateRuleRequest object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"UpdateRuleRequest":{"description":"Request body for updating a detection rule","type":"object","required":["rule_class"],"properties":{"name":{"type":"string","description":"Rule name (must be unique if changed)","maxLength":255},"description":{"type":"string","description":"Rule description","maxLength":2000},"rule_class":{"type":"string","description":"Rule class - Must be 'config' (CSPM)"},"type":{"type":"string","description":"Rule type - Must be 'DETECTION'"},"asset_types":{"type":"array","items":{"type":"string"},"description":"Array with single asset type identifier (exactly one if provided)","minItems":1,"maxItems":1},"severity":{"type":"string","description":"Rule severity (low, medium, high, critical, informational)"},"query":{"description":"Query object containing XQL (only editable for custom config rules with XQL)","allOf":[{"$ref":"#/components/schemas/QueryRequest1"}]},"metadata":{"description":"Metadata containing issue information","allOf":[{"$ref":"#/components/schemas/MetadataRequest1"}]},"compliance_metadata":{"type":"array","items":{"$ref":"#/components/schemas/ComplianceMetadataRequest1"},"description":"List of compliance metadata with control IDs","maxItems":100},"labels":{"type":"array","items":{"type":"string","maxLength":100},"description":"Custom labels (max 50, each max 100 chars)","maxItems":50},"enabled":{"type":"boolean","description":"Rule enabled status"}}},"QueryRequest1":{"type":"object","description":"Query object","properties":{"xql":{"type":"string","description":"XQL query string (only editable for custom config rules with XQL)"}}},"MetadataRequest1":{"type":"object","description":"Metadata object","properties":{"issue":{"description":"Issue information","allOf":[{"$ref":"#/components/schemas/IssueRequest1"}]}}},"IssueRequest1":{"type":"object","description":"Issue information","properties":{"recommendation":{"type":"string","description":"Remediation steps","maxLength":5000}}},"ComplianceMetadataRequest1":{"type":"object","description":"Compliance metadata object","properties":{"control_id":{"type":"string","description":"Compliance control identifier"}}}}}}
```

## The UserContext object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"UserContext":{"type":"object","properties":{"isAdmin":{"type":"boolean"},"sbacEnabled":{"type":"boolean"},"assetScope":{"$ref":"#/components/schemas/AssetScope"},"incidentScope":{"$ref":"#/components/schemas/IncidentScope"},"incidentDomains":{"type":"array","items":{"type":"string"}},"assetGroupIds":{"type":"array","items":{"type":"integer","format":"int32"}}}},"AssetScope":{"type":"string","enum":["NO_ASSETS","ALL_ASSETS","ASSET_GROUPS"]},"IncidentScope":{"type":"string","enum":["NO_INCIDENT","ALL_INCIDENT","INCIDENT_GROUPS"]}}}}
```

## The UserSelectedOperation object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"UserSelectedOperation":{"type":"string","enum":["cloudsec-rules","cloudsec-compliance-standards","cloudsec-policies","cloudsec-notifications"]}}}}
```

## The ValidationErrorResponse object

```json
{"openapi":"3.1.0","info":{"title":"Detection Rules Management API","version":"1.0.0"},"components":{"schemas":{"ValidationErrorResponse":{"type":"object","properties":{"err_msg":{"type":"string"},"metadata":{"$ref":"#/components/schemas/Metadata1"}}},"Metadata1":{"type":"object","properties":{"err_extra":{"type":"array","items":{"$ref":"#/components/schemas/ErrorDetail"}}}},"ErrorDetail":{"type":"object","properties":{"field":{"type":"string"},"message":{"type":"string"}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xdr-5-api/detection-rules-management/models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.