> ## Documentation Index > Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt > Use this file to discover all available pages before exploring further. # Get all verdict rules ## OpenAPI ````yaml https://api.wirespeed.co/v1/openapi.json get /verdict/rules openapi: 3.0.0 info: title: Wirespeed API description: The public Wirespeed API. v1 is the first stable contract. version: '1.0' contact: {} servers: - url: https://api.wirespeed.co security: [] tags: [] paths: /verdict/rules: get: tags: - Verdict summary: Get all verdict rules operationId: VerdictController_getAllRules parameters: [] responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/VerdictRules' '400': description: '' content: application/json: schema: $ref: '#/components/schemas/HttpError' security: - bearer: [] components: schemas: VerdictRules: type: object properties: rules: type: array items: $ref: '#/components/schemas/VerdictRule' required: - rules HttpError: type: object properties: message: type: string statusCode: type: number required: - message - statusCode VerdictRule: type: object properties: id: type: string stage: type: string enum: - TRIAGE - HUNT - MONITOR default: type: boolean managedByWspd: type: boolean category: type: string enum: - OTHER__DIAGNOSTIC - OTHER__INFORMATIONAL_EVENT - OTHER__WARNING - OTHER__UNKNOWN - OTHER__DECEPTION - OTHER__DECEPTION__SIMULATION - OTHER__CUSTOM_DETECTION - CLOUD__INVOCATION - CLOUD__DISCOVERY - CLOUD__DATA_TRANSFER - CLOUD__PERSISTENCE - CLOUD__PUBLIC_BUCKET - ENDPOINT__DISCOVERY - ENDPOINT__EXECUTION - ENDPOINT__LIVE_OFF_THE_LAND - ENDPOINT__NUISANCE - ENDPOINT__MALWARE_DISCOVERY - ENDPOINT__MALWARE_EXECUTION - ENDPOINT__LATE_STAGE - ENDPOINT__PERSISTENCE - ENDPOINT__REMOTE_MANAGEMENT - ENDPOINT__LATERAL_MOVEMENT - ENDPOINT__IMPACT - ENDPOINT__EVASION - ENDPOINT__EXPLOITATION - ENDPOINT__SIMULATION - ENDPOINT__PLANNED_CHANGE - IDENTITY__LOGIN - IDENTITY__REJECTED_MFA - IDENTITY__DISCOVERY - IDENTITY__BRUTE_FORCE - IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE - IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE - IDENTITY__PERSISTENCE - IDENTITY__ACCOUNT_COMPROMISE - IDENTITY__OAUTH_GRANT - IDENTITY__SIMULATION - NETWORK__INBOUND_CONNECTION - NETWORK__OUTBOUND_CONNECTION - NETWORK__PHISHING - NETWORK__NOISY - NETWORK__DISCOVERY - EMAIL__PHISHING - EMAIL__PHISHING_REPORTED - EMAIL__EVASION - EMAIL__MALWARE - EMAIL__MALICIOUS_LINK - EMAIL__GRAYMAIL - EMAIL__SPAM - EMAIL__BUSINESS_EMAIL_COMPROMISE - EMAIL__MAILBOX_RULE - DATA__DATA_TRANSFER - DATA__DATA_SHARE - POSTURE__POSTURE - POSTURE__HEALTH wspdRule: type: string enum: - CLOUD__INVOCATION - CLOUD__INVOCATION__LOW_SEVERITY - CLOUD__INVOCATION__MANAGED_DEVICE - CLOUD__INVOCATION__KNOWN_SAFE_IP - CLOUD__DISCOVERY - CLOUD__DISCOVERY__LOW_SEVERITY - CLOUD__DISCOVERY__MANAGED_DEVICE - CLOUD__DISCOVERY__KNOWN_SAFE_IP - CLOUD__DATA_TRANSFER - CLOUD__DATA_TRANSFER__LOW_SEVERITY - CLOUD__DATA_TRANSFER__MANAGED_DEVICE - CLOUD__DATA_TRANSFER__KNOWN_SAFE_IP - CLOUD__PERSISTENCE - CLOUD__PERSISTENCE__LOW_SEVERITY - CLOUD__PERSISTENCE__MANAGED_DEVICE - CLOUD__PERSISTENCE__KNOWN_SAFE_IP - CLOUD__PUBLIC_BUCKET - CLOUD__PUBLIC_BUCKET__LOW_CONFIDENCE - CLOUD__PUBLIC_BUCKET__LISTABLE - ENDPOINT__DISCOVERY - ENDPOINT__DISCOVERY__LOW_SEVERITY - ENDPOINT__DISCOVERY__USER_TECHNICAL - ENDPOINT__LIVE_OFF_THE_LAND__LOW_SEVERITY - ENDPOINT__LIVE_OFF_THE_LAND__BLOCKED_HVA - ENDPOINT__LIVE_OFF_THE_LAND__BLOCKED - ENDPOINT__LIVE_OFF_THE_LAND__MASQUERADED - ENDPOINT__LIVE_OFF_THE_LAND__AI_VERDICT - ENDPOINT__LIVE_OFF_THE_LAND__USER_NON_TECHNICAL - ENDPOINT__LIVE_OFF_THE_LAND__USER_TECHNICAL - ENDPOINT__LIVE_OFF_THE_LAND - ENDPOINT__NUISANCE - ENDPOINT__EXECUTION__LOW_SEVERITY - ENDPOINT__EXECUTION__BLOCKED_HVA - ENDPOINT__EXECUTION__MASQUERADED - ENDPOINT__EXECUTION__BENIGN - ENDPOINT__EXECUTION__BLOCKED - ENDPOINT__EXECUTION - ENDPOINT__EXECUTION__TECHNICAL_USER - ENDPOINT__MALWARE_DISCOVERY - ENDPOINT__MALWARE_DISCOVERY__HVA - ENDPOINT__MALWARE_DISCOVERY__BLOCKED - ENDPOINT__MALWARE_DISCOVERY__BLOCKED_HVA - ENDPOINT__MALWARE_DISCOVERY__BENIGN - ENDPOINT__MALWARE_DISCOVERY__SERVER - ENDPOINT__MALWARE_DISCOVERY__NO_FILES - ENDPOINT__MALWARE_DISCOVERY__LATE_STAGE_BLOCKED - ENDPOINT__MALWARE_DISCOVERY__LATE_STAGE - ENDPOINT__MALWARE_EXECUTION - ENDPOINT__MALWARE_EXECUTION__BLOCKED - ENDPOINT__MALWARE_EXECUTION__BLOCKED_HVA - ENDPOINT__LATE_STAGE - ENDPOINT__LATE_STAGE__BLOCKED - ENDPOINT__LATE_STAGE__BLOCKED_HVA - ENDPOINT__LATE_STAGE__BLOCKED_ADMINISTRATOR - ENDPOINT__LATE_STAGE__ADMINISTRATOR - ENDPOINT__REMOTE_MANAGEMENT - ENDPOINT__REMOTE_MANAGEMENT__BLOCKED - ENDPOINT__REMOTE_MANAGEMENT__BLOCKED_HVA - ENDPOINT__REMOTE_MANAGEMENT__ADMIN_INSTALL - ENDPOINT__REMOTE_MANAGEMENT__USER_TECHNICAL - ENDPOINT__LATERAL_MOVEMENT - ENDPOINT__LATERAL_MOVEMENT__BURST - ENDPOINT__LATERAL_MOVEMENT__RELATED_BURST - ENDPOINT__LATERAL_MOVEMENT__LOW_SEVERITY - ENDPOINT__LATERAL_MOVEMENT__HVA - ENDPOINT__LATERAL_MOVEMENT__SERVER - ENDPOINT__LATERAL_MOVEMENT__BLOCKED - ENDPOINT__LATERAL_MOVEMENT__TECHNICAL_USER - ENDPOINT__LATERAL_MOVEMENT__HUNT__SUDDENLY_ACTIVE - ENDPOINT__LATERAL_MOVEMENT__HUNT__WEEKEND_QUIET_HOURS - ENDPOINT__IMPACT__LOW_SEVERITY - ENDPOINT__IMPACT - ENDPOINT__EVASION__LOW_SEVERITY - ENDPOINT__EVASION - ENDPOINT__EXPLOITATION__LOW_SEVERITY - ENDPOINT__EXPLOITATION - ENDPOINT__SIMULATION - ENDPOINT__PLANNED_CHANGE - IDENTITY__DISCOVERY - IDENTITY__DISCOVERY__LOW_SEVERITY - IDENTITY__REJECTED_MFA - IDENTITY__REJECTED_MFA__HUNT__COMMON_TENANT_IP - IDENTITY__LOGIN - IDENTITY__LOGIN__LEARNING_ENVIRONMENT - IDENTITY__LOGIN__LOW_SEVERITY - IDENTITY__LOGIN__NO_USER - IDENTITY__LOGIN__BLOCKED - IDENTITY__LOGIN__BLOCKED_VIP - IDENTITY__LOGIN__BLOCKED_PRIVACY_POLICY - IDENTITY__LOGIN__MANAGED_DEVICE - IDENTITY__LOGIN__HUNT__MANAGED_DEVICE - IDENTITY__LOGIN__ADVERSARIAL_COUNTRY - IDENTITY__LOGIN__HOSTING_PROVIDER - IDENTITY__LOGIN__KNOWN_SAFE_IP_ADDRESS - IDENTITY__LOGIN__KNOWN_UNSAFE_IP_ADDRESS - IDENTITY__LOGIN__TOR - IDENTITY__LOGIN__RESIDENTIAL_PROXY - IDENTITY__LOGIN__AITM_PROXY - IDENTITY__LOGIN__PRIVACY_VPN__MOBILE - IDENTITY__LOGIN__PRIVACY_VPN__EXTERNAL - IDENTITY__LOGIN__PRIVACY_VPN - IDENTITY__LOGIN__TRUSTED_RELAY - IDENTITY__LOGIN__HUNT__HIGH_USAGE_IP_ADDRESS - IDENTITY__LOGIN__HUNT__ISP_HIGH_USAGE_REGION - IDENTITY__LOGIN__HUNT__TRUSTED_RELAY - IDENTITY__LOGIN__HUNT__BLOCKED_BY_POLICY - IDENTITY__LOGIN__HUNT__AUTHORIZED_DEVICE - IDENTITY__LOGIN__HUNT__AITM - IDENTITY__LOGIN__HUNT__FAILED_LOGIN - IDENTITY__LOGIN__HUNT__ADVERSARIAL_COUNTRY - IDENTITY__LOGIN__MONITOR__MAILBOX_RULES - IDENTITY__LOGIN__MONITOR__MAILBOX_SEND - IDENTITY__LOGIN__MONITOR__MASS_EMAIL_ACCESS - IDENTITY__LOGIN__MONITOR__MASS_EMAIL_SEND - IDENTITY__LOGIN__MONITOR__PERSISTENCE - IDENTITY__LOGIN__MONITOR__OAUTH_GRANT - IDENTITY__LOGIN__MONITOR__SESSION_CHANGE - IDENTITY__LOGIN__MONITOR__AITM - IDENTITY__PERSISTENCE - IDENTITY__PERSISTENCE__LOW_SEVERITY - IDENTITY__PERSISTENCE__TECHNICAL_USER - IDENTITY__PERSISTENCE__ADMIN_USER - IDENTITY__BRUTE_FORCE - IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE - IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE__PASSWORD_RESET - IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE__OLD_BREACH - IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE__IMPORTANT_USER - IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE__DC_SYNC - IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE__LOW_SEVERITY - IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE - IDENTITY__ACCOUNT_COMPROMISE__TEAM_AUTH_BASELINE_IP - IDENTITY__ACCOUNT_COMPROMISE__MEETING_ROOM_DEVICE - IDENTITY__ACCOUNT_COMPROMISE - IDENTITY__OAUTH_GRANT__SUSPICIOUS_NAME - IDENTITY__OAUTH_GRANT - IDENTITY__SIMULATION - ENDPOINT__PERSISTENCE__LOW_SEVERITY - ENDPOINT__PERSISTENCE__BLOCKED - ENDPOINT__PERSISTENCE__BLOCKED_HVA - ENDPOINT__PERSISTENCE__HVA - ENDPOINT__PERSISTENCE__USER_TECHNICAL - ENDPOINT__PERSISTENCE - NETWORK__INBOUND_CONNECTION - NETWORK__INBOUND_CONNECTION__KNOWN_SAFE_IP - NETWORK__INBOUND_CONNECTION__KNOWN_UNSAFE_IP - NETWORK__INBOUND_CONNECTION__BLOCKED - NETWORK__INBOUND_CONNECTION__TOR - NETWORK__INBOUND_CONNECTION__VPN - NETWORK__INBOUND_CONNECTION__PROXY - NETWORK__INBOUND_CONNECTION__RELAY - NETWORK__INBOUND_CONNECTION__LOW_SEVERITY - NETWORK__OUTBOUND_CONNECTION - NETWORK__OUTBOUND_CONNECTION__KNOWN_SAFE_IP - NETWORK__OUTBOUND_CONNECTION__KNOWN_UNSAFE_IP - NETWORK__OUTBOUND_CONNECTION__SERVER - NETWORK__OUTBOUND_CONNECTION__TOR - NETWORK__OUTBOUND_CONNECTION__TECHNICAL_USER - NETWORK__OUTBOUND_CONNECTION__VPN - NETWORK__OUTBOUND_CONNECTION__PROXY - NETWORK__OUTBOUND_CONNECTION__RELAY - NETWORK__OUTBOUND_CONNECTION__BLOCKED - NETWORK__OUTBOUND_CONNECTION__BLOCKED_HVA - NETWORK__OUTBOUND_CONNECTION__LOW_SEVERITY - NETWORK__OUTBOUND_CONNECTION__NO_ASSET - NETWORK__PHISHING - NETWORK__PHISHING__LOW_SEVERITY - NETWORK__PHISHING__MOBILE - NETWORK__PHISHING__HUNT__BLOCKED - NETWORK__NOISY - NETWORK__DISCOVERY - NETWORK__DISCOVERY__LOW_SEVERITY - EMAIL__PHISHING - EMAIL__PHISHING__VIP - EMAIL__PHISHING__BLOCKED - EMAIL__PHISHING__LOW_SEVERITY - EMAIL__PHISHING_REPORTED - EMAIL__PHISHING_REPORTED__EXTERNAL_SENDER - EMAIL__PHISHING_REPORTED__INTERNAL_SENDER - EMAIL__EVASION__LOW_SEVERITY - EMAIL__EVASION - EMAIL__MALWARE - EMAIL__MALWARE__BLOCKED - EMAIL__MALWARE__BENIGN - EMAIL__MALICIOUS_LINK - EMAIL__MALICIOUS_LINK__BLOCKED - EMAIL__GRAYMAIL - EMAIL__SPAM - EMAIL__BUSINESS_EMAIL_COMPROMISE - EMAIL__MAILBOX_RULE - EMAIL__MAILBOX_RULE__NO_ARTIFACT - EMAIL__MAILBOX_RULE__DELETE_ALL - EMAIL__MAILBOX_RULE__COMMON_TENANT_IP - EMAIL__MAILBOX_RULE__SUSPICIOUS_NAME - EMAIL__MAILBOX_RULE__HIDDEN_MOVE - DATA__DATA_TRANSFER__BLOCKED - DATA__DATA_TRANSFER - DATA__DATA_SHARE_BLOCKED - DATA__DATA_SHARE - POSTURE__POSTURE - POSTURE__HEALTH - OTHER__DECEPTION - OTHER__DECEPTION__LOW_SEVERITY - OTHER__DECEPTION__SIMULATION - OTHER__UNKNOWN - OTHER__DIAGNOSTIC - OTHER__INFORMATIONAL_EVENT - OTHER__WARNING - OTHER__WARNING__LOW_SEVERITY - OTHER__CUSTOM_DETECTION - OTHER__CUSTOM_DETECTION__LOW_SEVERITY retired: type: boolean escalate: type: boolean chatOps: type: boolean close: type: boolean disabled: type: boolean containUserActions: type: array items: type: string enum: - disable - reset_password - revoke_sessions containEndpointActions: type: array items: type: string enum: - isolate - lock containFileActions: type: array items: type: string enum: - delete - quarantine uncontainUserActions: type: array items: type: string enum: - enable uncontainEndpointActions: type: array items: type: string enum: - unisolate - unlock uncontainFileActions: type: array items: type: string enum: - unquarantine chatOpsMFA: type: boolean monitor: type: boolean monitorFallbackPreset: type: string enum: - ESCALATE - ESCALATE_CONTAIN - CLOSE managerChatOps: type: boolean vipChatOps: type: boolean createdAt: type: string updatedAt: type: string teamId: type: string chatOpsTimeoutVerdict: type: string enum: - MALICIOUS - SUSPICIOUS - BENIGN chatOpsTimeoutMonitor: type: boolean chatOpsTimeoutClose: type: boolean chatOpsUnsureVerdict: type: string enum: - MALICIOUS - SUSPICIOUS - BENIGN verdict: type: string enum: - MALICIOUS - SUSPICIOUS - BENIGN description: type: string managedByParent: type: boolean severity: type: string enum: - INFORMATIONAL - LOW - MEDIUM - HIGH - CRITICAL useSourceSeverity: type: boolean ignoresRemediation: type: boolean defaults: $ref: '#/components/schemas/VerdictRule' required: - stage - default - managedByWspd - category - wspdRule - retired - escalate - chatOps - close - disabled - containUserActions - containEndpointActions - containFileActions - uncontainUserActions - uncontainEndpointActions - uncontainFileActions - chatOpsMFA - monitor - managerChatOps - vipChatOps - chatOpsUnsureVerdict - description - severity securitySchemes: bearer: scheme: bearer bearerFormat: API key type: http description: >- Team API key sent as a Bearer token. Create a key in Wirespeed under Settings → Team. See https://docs.wirespeed.co/api-reference/authentication. ````