Detection coverage

A rollup of detection coverage for a CVE.

GET/api/v1/cves/{cveId}/detection

A compact summary of the detection posture for the CVE: which detection layers have coverage, how many rule bodies are stored, and the evidence broken down by source and by type.

detection_layers and rule_body_count are independent facts — a CVE can report a coverage layer from evidence that carries no stored rule body, and vice versa.

Parameters

Name	In	Type	Description
`cveId`	path	string	CVE identifier.

Example request

curl "https://radicalnotion.ai/api/v1/cves/CVE-2025-55182/detection" \
  -H "Authorization: Bearer $RN_TOKEN"

Example response

{
  "cve_id": "CVE-2025-55182",
  "detection_layers": [
    "file_yara",
    "network_ids",
    "scanner",
    "siem"
  ],
  "rule_body_count": 1,
  "evidence_count": 1,
  "evidence_by_source": {
    "nuclei": 1
  },
  "evidence_by_type": {
    "detection_template": 1
  }
}

Response schema

Field	Type	Description
`detection_layers`	string[]	Layers with coverage: network_ids, file_yara, scanner, siem.
`rule_body_count`	integer	Number of stored detection-rule bodies.
`evidence_count`	integer	Total detection evidence records.
`evidence_by_source`	object	Evidence counts keyed by source (nuclei, sigma, ...).
`evidence_by_type`	object	Evidence counts keyed by evidence type.

Responses

Status	Meaning
`200`	Success.
`400`	A path or query parameter failed validation.
`401`	Missing or invalid access token.
`403`	The CVE is outside your access tier.
`404`	No record exists for the CVE.
`429`	Rate limit exceeded.