Detection rules

Detection rules and templates catalogued for a CVE.

GET/api/v1/cves/{cveId}/detection-rules

Detection content linked to the CVE — Nuclei templates, Sigma/SIEM rules, YARA signatures — each with its source, evidence type, confidence, and a hash and byte size of the rule body.

Rule bodies are returned inline by default; pass body=false for a lightweight inventory (body is then null) when you only need to know that coverage exists.

Parameters

Name	In	Type	Description
`cveId`	path	string	CVE identifier.
`body`	query	boolean	Include the rule body; false returns the inventory only (body null). Default: `true`.

Example request

curl "https://radicalnotion.ai/api/v1/cves/CVE-2025-55182/detection-rules?body=false" \
  -H "Authorization: Bearer $RN_TOKEN"

Example response(captured with body=false — body is null)

{
  "cve_id": "CVE-2025-55182",
  "count": 1,
  "detection_rules": [
    {
      "source": "nuclei",
      "source_ref_id": "CVE-2025-55182",
      "evidence_type": "detection_template",
      "confidence": "high",
      "evidence_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml",
      "has_body": true,
      "byte_size": 4488,
      "body_hash": "93c2c43cb6fccba0bd1f125195d27fd13b82c1f3c88c6a9f2bd3ea3ddcadb139",
      "first_seen": "2026-07-26T15:28:54Z",
      "last_seen": "2026-07-26T15:28:54Z",
      "body": null
    }
  ]
}

Response schema

Field	Type	Description
`count`	integer	Number of detection rules.
`detection_rules[].source`	string	Rule source (nuclei, sigma, yara, ...).
`detection_rules[].source_ref_id`	string	Identifier of the rule within its source.
`detection_rules[].evidence_type`	string	Kind of detection content (detection_template, ...).
`detection_rules[].confidence`	string \| null	Confidence of the match.
`detection_rules[].evidence_url`	string \| null	Link to the upstream rule.
`detection_rules[].has_body`	boolean	Whether a rule body is stored.
`detection_rules[].byte_size / body_hash`	integer / string	Size and hash of the rule body.
`detection_rules[].first_seen / last_seen`	string	Observation window (ISO 8601).
`detection_rules[].body`	string \| null	The rule body; null when body=false.

Responses

Status	Meaning
`200`	Success.
`400`	A path or query parameter failed validation.
`401`	Missing or invalid access token.
`403`	The CVE is outside your access tier.
`404`	No record exists for the CVE.
`429`	Rate limit exceeded.

A CVE with no catalogued detection rules returns count 0.

Empty result (200)

{
  "cve_id": "CVE-2025-55182",
  "count": 0,
  "detection_rules": []
}

Name

Type

Description

cveId

path

string

CVE identifier.

body

query

boolean

Include the rule body; false returns the inventory only (body null). Default: true.

Example response(captured with body=false — body is null)

{
  "cve_id": "CVE-2025-55182",
  "count": 1,
  "detection_rules": [
    {
      "source": "nuclei",
      "source_ref_id": "CVE-2025-55182",
      "evidence_type": "detection_template",
      "confidence": "high",
      "evidence_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml",
      "has_body": true,
      "byte_size": 4488,
      "body_hash": "93c2c43cb6fccba0bd1f125195d27fd13b82c1f3c88c6a9f2bd3ea3ddcadb139",
      "first_seen": "2026-07-26T15:28:54Z",
      "last_seen": "2026-07-26T15:28:54Z",
      "body": null
    }
  ]
}

Response schema

Field	Type	Description
`count`	integer	Number of detection rules.
`detection_rules[].source`	string	Rule source (nuclei, sigma, yara, ...).
`detection_rules[].source_ref_id`	string	Identifier of the rule within its source.
`detection_rules[].evidence_type`	string	Kind of detection content (detection_template, ...).
`detection_rules[].confidence`	string \| null	Confidence of the match.
`detection_rules[].evidence_url`	string \| null	Link to the upstream rule.
`detection_rules[].has_body`	boolean	Whether a rule body is stored.
`detection_rules[].byte_size / body_hash`	integer / string	Size and hash of the rule body.
`detection_rules[].first_seen / last_seen`	string	Observation window (ISO 8601).
`detection_rules[].body`	string \| null	The rule body; null when body=false.

Responses

Status	Meaning
`200`	Success.
`400`	A path or query parameter failed validation.
`401`	Missing or invalid access token.
`403`	The CVE is outside your access tier.
`404`	No record exists for the CVE.
`429`	Rate limit exceeded.

A CVE with no catalogued detection rules returns count 0.

Empty result (200)

{
  "cve_id": "CVE-2025-55182",
  "count": 0,
  "detection_rules": []
}