Retrieve a custom detection

Request

Returns one custom detection in full: its detection logic exactly as stored, and every rule and its settings. Rules are returned in the order they're evaluated, with the highest-priority rule first.

Security

x-api-key

Path

detectionEventTypestring^CUSTOM_[A-Z0-9_]+$required

The custom detection's unique identifier. Always an uppercase identifier beginning with CUSTOM_.

Example:CUSTOM_TORRENT_WEBSITE_VISIT

GET

/v1/controls/customDetections/{detectionEventType}

curl -i -X GET \
  https://api.pushsecurity.com/v1/controls/customDetections/CUSTOM_TORRENT_WEBSITE_VISIT \
  -H 'x-api-key: YOUR_API_KEY_HERE'

Responses

Bodyapplication/json

detectionEventTypestringrequired

The custom detection's unique identifier. Always an uppercase identifier beginning with CUSTOM_.

Example:"CUSTOM_TORRENT_WEBSITE_VISIT"

detectionEventNamestringrequired

The custom detection's name, set when the detection was created. It cannot be updated.

Example:"Torrent website visit"

detectionLogicstringrequired

The detection logic: one or more detection rules, each a YAML document describing what the browser extension matches on, separated by the standard YAML document separator. It is returned exactly as stored. See the custom detection specification for the format of the YAML.

Example:"input: web_request\nmetadata:\n indicator: TORRENT_MAGNET_LINK_DETECTED\nconditions:\n request_url:\n scheme: magnet\n"

rulesArray of objects(Custom Detection Control Rule)required

The custom detection's control rules, in priority order. The first rule that matches wins.

Response

{
  "detectionEventType": "CUSTOM_TORRENT_WEBSITE_VISIT",
  "detectionEventName": "Torrent website visit",
  "detectionLogic": "input: web_request\nmetadata:\n  indicator: TORRENT_MAGNET_LINK_DETECTED\nconditions:\n  request_url:\n    scheme: magnet\n",
  "rules": [
    {
      "id": "c478966c-f927-411c-b919-179832d3d50c",
      "name": "Warn Finance about torrent sites",
      "enabled": true,
      "mode": "WARN",
      "severity": "MEDIUM",
      "title": "Torrent sites are not allowed",
      "subtext": "Downloading torrents on company devices is not permitted.",
      "buttonText": "I understand",
      "detectOnInternalHosts": false,
      "criteria": {
        "employeeIds": {
          "matches": [ … ]
        },
        "employeeGroups": {
          "matches": [ … ]
        }
      }
    }
  ]
}