Search Tactics Detections

post

https://api.greynoise.io/v3/workspaces/{workspace_id}/tactics

Search the Tactics detections recorded for a workspace.

A detection is an aggregated view of a single attacker session observed
on one of your deployed sensors: the commands that ran, the MITRE ATT&CK
techniques and tactics they map to, the files the session touched, and
the hosts it contacted. Only sessions carrying at least one ATT&CK
technique are retained as detections, so activity that never matched a
technique is not returned by this endpoint.

Filters supplied in the request body are combined with AND, with one
exception: techniques and tactics combine with each other using OR
(a detection matches if it carries any listed technique or any
listed tactic), and that bundle is then ANDed with the remaining
filters. A body is required; send {} to apply no filters.

Results are ordered newest first and paged with an opaque cursor: pass
the next_cursor from a response back as the cursor query parameter
to fetch the following page. total_count, stats, and tactic_stats
are computed over the whole filtered result set and are returned only
on the first page (when no cursor is supplied).

Each detection in sessions carries a bounded commands preview —
at most 40 of the session's distinct commands, in no particular order.
Fetch the detection by ID for the complete, ordered command timeline.

Path Params

workspace_id

uuid

required

Workspace UUID.

Query Params

page_size

integer

1 to 10000

Defaults to 100

Number of detections to return per page.

cursor

string

Opaque pagination cursor taken from a previous response's next_cursor. Omit to request the first page.

exclude_non_interactive

boolean

Defaults to false

When true, return only interactive sessions (those with a shell ancestor). Non-interactive sessions are included by default.

Body Params

Detection search filters. Every field is optional; send {} to match all detections in the workspace. Fields combine with AND, except techniques and tactics, which combine with each other using OR.

start_time

date-time

Only return detections active at or after this time. When omitted no lower bound is applied and the search spans all retained history; supplying a bound is strongly recommended.

end_time

date-time

Only return detections active at or before this time. Defaults to the current time.

sensor_id

uuid

Only return detections observed on this sensor.

profile_id

uuid

Only return detections observed on this profile.

profile_instance_id

uuid

Only return detections observed on this profile instance.

rules

array of strings

Only return detections that triggered at least one of these sensor rules.

rules

techniques

array of strings

Only return detections carrying at least one of these MITRE ATT&CK technique IDs. Combines with tactics using OR.

techniques

tactics

array of strings

Only return detections carrying at least one of these MITRE ATT&CK tactic IDs. Combines with techniques using OR.

tactics

process_name

string

Only return detections containing an event whose process has this name.

process_parent

string

Only return detections containing an event whose parent process has this name.

process_grandparent

string

Only return detections containing an event whose grandparent process has this name.

process_great_grandparent

string

Only return detections containing an event whose great-grandparent process has this name.

any_process

string

Only return detections containing an event where this name appears at any level of the process ancestry - the process itself, its parent, grandparent, or great-grandparent.

string

Only return detections whose session contacted this destination address. IPv4 only.

Responses

200OK - matching detections returned.

400Bad request - a path parameter, query parameter, or request body was invalid. Validation errors raised by the Tactics backend are returned as a plain-text message; errors raised by the API gateway use the JSON {"message": ...} shape.

401Unauthorized. Please check your API key.

403Forbidden - the workspace is not entitled to Tactics (or, for the host artifact content endpoint, not entitled to file contents), or the authenticated user does not have access to the requested workspace. Contact [email protected] to enable Tactics for your workspace.

500Unexpected error while serving the request. Errors raised by the Tactics backend are returned as a plain-text message; errors raised by the API gateway use the JSON {"message": ...} shape.