Skip to main content
Detection rule packs hold the Sigma and Agent Threat Rules (ATR) rules that Squasher runs on connector logs, web server spans, and AI agent spans. Each match is a security finding. See Detection rules for the formats and the built-in pack. Fields use snake_case. Write operations accept an Idempotency-Key header; the operations that turn a pack off or on, delete a pack, or start a backtest require one. The same key with the same request returns the first response; the same key with another request returns 422. Operations that support dry_run=true return a preview and change nothing.

​
Operations

The built-in pack has the id builtin. It cannot change.

​
Validate rule files

The response has valid, one entry per file (name, valid, error, and the compiled rules with id, title, author, level, and source), and error for a problem of the whole set, such as the same rule id in two files. Create and update return 422 with the same file entries when a file does not compile.

​
Start a backtest

Set pack_id (builtin or a custom pack id) or rules (draft files), and a window of at most 7 days in the past.
The job handle has job_id, status, progress (0 to 1), error, created_at, and updated_at. When status is succeeded, result has events_scanned, events_matched, truncated, and rules (rule_id, title, level, matches, sample_timestamps). A project can have at most 2 queued or running backtests. One more start returns 429; wait for a job to finish, or cancel one. One compute budget covers the whole job, and a job runs for at most 240 seconds. A job that passes either limit has status: "failed", an error that starts with budget_exceeded or time_limit_exceeded, and the partial result with truncated: true. Use a shorter window.