Skip to main content

Propagate

POST 
/api/v1/sigma/propagate

Generate sigma-bound DFE rules + hunts from the current selection.

For each SELECTED sigma rule, converts its detection to a ClickHouse WHERE over the matching source's {source}_sigma view and stores a DFE rule (with a sigma_rule_id back-reference), then binds it into a per-source hunt. Drifted or hand-edited bindings are reported skipped_drifted unless force. Submitted to the task manager. Blocks up to wait seconds for inline completion, else returns pending - poll via GET /sigma/propagations/{id}.

A production+team run commits each generated rule and hunt to its own review branch rather than the branch the hunt runner syncs. The report carries every branch and PR, and X-DFE-Review-Required says so on a run that completed inline. 422 unknown_org when hunt_customers names no registered org.

Request​

Responses​

Successful Response