A detection rule is a query that runs continuously on new logs as they arrive in Scanner. You can create create, read, update, and delete detection rules with the Scanner API.
Create a new detection rule
POST/v1/detection_rule
Create a new detection rule with the specified data.
If the detection rule is active, it will be immediately scheduled for backfill and execution.
Body
Name
Type
Description
tenant_idrequired
string
Unique identifier for the tenant
namerequired
string
Name of the detection rule
description required
string
Description of the detection rule
time_range_s required
Lookback period (in seconds)
run_frequency_s required
How frequently to run the detection rule (in seconds)
enabled required
boolean
Whether the detection rule is enabled
severity required
The severity of the detection
query_text required
string
Query for the detection rule
event_sink_ids required
list of strings
Event sinks to send event alerts to
sync_key
string
Sync key, used by automatic detection rule syncers
Returns a list of detection rule summaries. The detection rule summary object is the same as the detection rule object, but it does not include event_sink_ids.
{"detection_rules": [ {"id":"d87284f8-b0f3-4464-9ba9-258c0e585d09","sync_key":null,"prepared_query_id":"b8aa9bb6-de1e-4ef8-82bb-29974a1e4ff2","query_text":"error | count | where @q.count > 100","tenant_id":"00000000-0000-0000-0000-000000000000","time_range_s":300,"run_frequency_s":300,"author_user_id":null,"name":"Errors","description":"Errors in application logs","enabled":true,"severity":"Informational","created_at":"2024-05-09T01:07:24Z","updated_at":"2024-05-09T01:07:24Z","last_alerted_at":null } ]}
time_range_s is the lookback period for the detection rule and run_frequency_s is how often the detection rule is run. Valid values for time_range_s and run_frequency_s are:
60 (1 minute)
300 (5 minutes)
900 (15 minutes)
3600 (1 hour)
21600 (6 hours)
86400 (24 hours)
run_frequency_s is at most two levels below time_range_s. For example, if time_range_s is 300, valid values for run_frequency_s are 60, 300, and 900.