Detection Rules - Hilt Documentation

Returns the custom detection rules configured on the Alerts → Rules tab, each with live fire statistics.

List detection rules

GET /v1/detection-rules

curl "https://<your-dashboard-host>/v1/detection-rules" \
  -H "Authorization: Bearer $HILT_API_KEY"

{
  "detection_rules": [
    {
      "id": 12,
      "name": "Curl to unknown destination",
      "description": "Flags curl/wget launched by service accounts",
      "enabled": true,
      "severity": "high",
      "label": "exfil-watch",
      "expression": {
        "type": "group",
        "op": "and",
        "children": [
          { "type": "condition", "field": "comm", "op": "eq", "value": "curl" }
        ]
      },
      "all_hosts": true,
      "host_ids": [],
      "workload_scopes": [],
      "cooldown_seconds": 300,
      "version": 4,
      "created_by": "admin",
      "created_at": "2026-06-12T09:30:00Z",
      "updated_at": "2026-07-01T16:20:00Z",
      "fires": 42,
      "last_fired_ns": 1783426000123456789
    }
  ],
  "total": 1
}

fires and last_fired_ns count matches on hosts within your key’s scope. When a rule fires, the match also appears as a finding in GET /v1/findings (with source: "detection_rule") and triggers the detection_rule.matched webhook event.

Scope behavior

Rules are returned when they apply to hosts your key can see — either all-hosts rules or rules scoped to at least one host in your scope. For rules that span additional hosts outside your scope, host_ids and workload_scopes list only the hosts you have access to. Rule management (create, edit, delete) is available in the dashboard.