Create Detection Config
Create a config that makes a detection source run for an organization. Sources that are disabled by default have no config, so they cannot be enabled through /detection/configs/update until one is created. A source can have several configs, each with its own query, schedule or brand.
Overview
Create a new threat detection config so a source starts scanning for your organization. Sources that are disabled by default have no config row, so they cannot be enabled through Update Detection Config until you create one here. A single source can have several configs, each with its own query, schedule, or brand. Usetitle and description to tell them apart.
When to use
- Turn on a source that is disabled by default for your organization.
- Add another config to a source you already run (for example, a second query or a brand-scoped variant).
- Provision a source-specific
configpayload programmatically.
How it works
sourcemust be a key returned by List Detection Sources. Global-only sources and sources with no implementation are rejected.cronis only accepted for scheduled (pull-based) sources. Omit it to use the source’s default schedule.configis validated against the source’sconfigSchemafrom List Detection Sources. An empty object{}is allowed; schema defaults are applied at scan time.brandId, when passed, must belong to your organization. Omit for an organization-wide config.- The config and an initial history row are written in one transaction so default-sync jobs don’t disable it.
Authorizations
Your API key. This is required by most endpoints to access our API programatically. Reach out to us at support@chainpatrol.io to get an API key for your use.
Body
Create a threat detection config
Creates the config row that makes a detection source run for your organization. Sources that are disabled by default have no config row, so they cannot be enabled through /detection/configs/update until one exists.
A source can have several configs, each scanning with its own query, schedule or brand. Use title to tell them apart.
Detection source key, from GET /detection/sources. The source must support the organization scope; global-only sources cannot be configured per organization.
meta_ads_search, telegram_channels_search, telegram_user_search, telegram_channels_search_vetric, telegram_user_search_vetric, facebook_page_search_vetric, instagram_account_search_vetric, twitter_search_vetric, linkedin_people_search_vetric, linkedin_company_search_vetric, meta_ads_search_vetric, tik_tok_video_search, tik_tok_user_search, tik_tok_user_search_vetric, tik_tok_video_search_vetric, blocklist, apple_app_store, google_ads_search, mozilla_addon_search, reddit_subreddit_search, asset_check, twitter_post_search, medium_tag_rss, twitter_search, yahoo_search, duck_duck_go_search, bing_search, guestbook, certstream, external, google_search, dns_twist, twitter, twitter_username_monitor, urlscan, urlscan_hostname_search, youtube_search, google_play_search, dexscreener_search, blocked_ip_scan, blocked_bilibili_suggested, grok_post_search, grok_user_search, google_lens_image_search, yandex_search, linkedin_employee_detection, linkedin_post_search, linkedin_company_search, bing_ads_search, tik_tok_ads_search, dnsdb, daily_motion_search, watchlist Organization slug. Defaults to the organization your API key is scoped to, so you only need this when authenticating with a key that spans organizations.
1Status to create the config with. Defaults to ENABLED.
ENABLED, DEPRECATED_EVALUATE, DISABLED Optional label for this config
Optional human-readable description of what the config does
Optional custom CRON schedule. Only accepted for sources that run on a schedule; the source's default schedule is used when omitted.
Source-specific configuration, validated against that source's configSchema from GET /detection/sources. When omitted the source's schema defaults are applied.
Optional brand to scope this config to. The brand must belong to the same organization. Omit for an organization-wide config.
x > 0Response
Successful response
Created detection config