> ## Documentation Index > Fetch the complete documentation index at: https://chainpatrol.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # detections command — run and manage detection configs > Run ChainPatrol detection configs on demand, validate that they still return results, catch query drift, list detection results, and update a config. ```bash theme={null} chainpatrol detections ``` Every subcommand is organization-scoped. Pass `--org ` once and it is [saved as your default](/docs/cli/installation#setting-a-default-organization). ## detections healthcheck Run a health check across all of an organization's detection configs. ```bash theme={null} chainpatrol detections healthcheck --org [options] ``` | Option | Description | | ---------------------- | --------------------------------------------------- | | `--org ` | Organization slug. | | `--source ` | Filter by detection source key. | | `--min-results ` | Minimum recent results a config must have produced. | | `--lookback-hours ` | Lookback window, in hours. | | `--run` | Run the detections before validating them. | | `--include-disabled` | Include disabled configs. | ```bash theme={null} chainpatrol detections healthcheck --org acme --run chainpatrol detections healthcheck --org acme --run --min-results 1 --lookback-hours 168 chainpatrol --json detections healthcheck --org acme --run ``` An unhealthy result exits with [code `6`](/docs/cli/output#exit-codes) — the check ran fine, something is wrong. That makes it usable directly as a CI gate. ## detections validate Validate that detection configs still produce the results you expect, without the surrounding health report. Takes the same options as `healthcheck`. ```bash theme={null} chainpatrol detections validate --org acme --source urlscan chainpatrol detections validate --org acme --min-results 5 ``` ## detections drift Surface drift signals — configs returning zero results, configs that have turned noisy, and stale queries. ```bash theme={null} chainpatrol detections drift --org [options] ``` | Option | Description | | ---------------------- | ------------------------------- | | `--org ` | Organization slug. | | `--source ` | Filter by detection source key. | | `--config-id ` | Filter by config ID. | | `--lookback-hours ` | Lookback window, in hours. | | `--include-disabled` | Include disabled configs. | ```bash theme={null} chainpatrol detections drift --org acme --lookback-hours 168 chainpatrol detections drift --org acme --explain --output markdown ``` Add `--explain` to get the recommendation behind each signal rather than the counts alone. ## detections run Run one or more detection configs on demand. ```bash theme={null} chainpatrol detections run --org [options] ``` | Option | Description | | -------------------- | ------------------------------- | | `--org ` | Organization slug. | | `--config-id ` | Run a specific config. | | `--source ` | Filter by detection source key. | | `--include-disabled` | Include disabled configs. | | `--dry-run` | Preview without executing. | ```bash theme={null} chainpatrol detections run --org acme --source google_search chainpatrol detections run --org acme --config-id 42 ``` ## detections list List recent detection results, with the same filters as the app's Detections view. Confidence comes back as a human-readable level rather than a raw score. ```bash theme={null} chainpatrol detections list --org [filters] ``` | Option | Description | | ----------------------------- | ------------------------------------------------------------------------------------------- | | `--org ` | Organization slug. | | `--limit ` | Page size, 1–100. Defaults to 50. | | `--cursor ` | Pagination cursor. | | `--search ` | Search by threat content. | | `--source ` | Comma list of detection source keys. | | `--confidence ` | Comma list: `none`, `low`, `medium`, `high`. | | `--asset-status ` | Comma list: `BLOCKED`, `ALLOWED`, `UNKNOWN`. | | `--asset-type ` | Comma list of asset types. | | `--brand ` | Comma list of brand IDs. | | `--liveness ` | Comma list: `ALIVE`, `DEAD`, `UNKNOWN`. | | `--watchlist ` | Comma list: `ENABLED`, `DISABLED`. | | `--reported ` | Comma list: `reported`, `not_reported`. | | `--country-code ` | Comma list of 2-letter ISO country codes. | | `--only-deleted` | Return only soft-deleted detections. Without it, both deleted and non-deleted are returned. | | `--from ` / `--to ` | Date range (ISO 8601). | ```bash theme={null} chainpatrol detections list --org acme --confidence medium,high chainpatrol detections list --org acme --source twitter --liveness ALIVE chainpatrol detections list --org acme --reported not_reported --watchlist ENABLED chainpatrol detections list --org acme --brand 12,34 --country-code US,GB ``` ## configs list List the detection configs available to your organization. `chainpatrol configs list` is a top-level shorthand for `chainpatrol detections configs list`. ```bash theme={null} chainpatrol configs list --org acme chainpatrol detections configs list --org acme chainpatrol --json configs list --org acme ``` ## detections configs update Update an existing config's status, title, cron schedule, or query. ```bash theme={null} chainpatrol detections configs update --org --config-id [options] ``` | Option | Description | | ------------------------ | -------------------------------------------------------------- | | `--org ` | Organization slug. | | `--config-id ` | Config ID. Required. | | `--enable` / `--disable` | Enable or disable the config. | | `--title ` | New title. | | `--description ` | New description. | | `--cron ` | New CRON expression. | | `--set key=value` | Patch a value inside the config. Repeatable. | | `--merge-config` | Merge `--set` keys into the existing config. Defaults to true. | | `--dry-run` | Preview without applying. | `--set` values are parsed: `true`, `false`, `null`, and numbers become their JSON types, `{...}` and `[...]` are parsed as JSON, and everything else stays a string. ```bash theme={null} chainpatrol detections configs update --org acme --config-id 42 --disable chainpatrol detections configs update --org acme --config-id 42 \ --set query=brand-phishing --set maxResults=100 chainpatrol detections configs update --org acme --config-id 42 \ --set query="phishing site" --dry-run --output json ``` `detections configs run` is also accepted, and behaves the same as `detections run`. ## Related * [`GET /organization/detections`](/docs/external-api/detection-list) * [`GET /organization/detection-configs`](/docs/external-api/detection-configs-list) * [`POST /organization/detection-configs/{id}`](/docs/external-api/detection-configs-update) * [Detections concept](/docs/concepts/detections)