> ## Documentation Index
> Fetch the complete documentation index at: https://hilt.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Detection Rules

> List your custom detection rules and how often each has fired.

Returns the custom detection rules configured on the [Alerts → Rules](https://hilt.ai/docs/dashboard/alerts.md) tab, each with live fire statistics.

***

## List detection rules

```text theme={null}
GET /v1/detection-rules
```

```bash theme={null}
curl "https://<your-dashboard-host>/v1/detection-rules" \
  -H "Authorization: Bearer $HILT_API_KEY"
```

```json theme={null}
{
  "detection_rules": [
    {
      "id": 12,
      "name": "Curl to unknown destination",
      "description": "Flags curl/wget launched by service accounts",
      "enabled": true,
      "severity": "high",
      "label": "exfil-watch",
      "expression": {
        "type": "group",
        "op": "and",
        "children": [
          { "type": "condition", "field": "comm", "op": "eq", "value": "curl" }
        ]
      },
      "all_hosts": true,
      "host_ids": [],
      "workload_scopes": [],
      "cooldown_seconds": 300,
      "version": 4,
      "created_by": "admin",
      "created_at": "2026-06-12T09:30:00Z",
      "updated_at": "2026-07-01T16:20:00Z",
      "fires": 42,
      "last_fired_ns": 1783426000123456789
    }
  ],
  "total": 1
}
```

`fires` and `last_fired_ns` count matches on hosts within your key's scope. When a rule fires, the match also appears as a finding in [`GET /v1/findings`](https://hilt.ai/docs/api/findings) (with `source: "detection_rule"`) and triggers the `detection_rule.matched` [webhook event](https://hilt.ai/docs/api/webhooks.md).

## Scope behavior

Rules are returned when they apply to hosts your key can see — either all-hosts rules or rules scoped to at least one host in your scope. For rules that span additional hosts outside your scope, `host_ids` and `workload_scopes` list only the hosts you have access to.

Rule management (create, edit, delete) is available in the dashboard.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.