Oracle · Schema

DetectorRecipe

A detector recipe is a collection of rules that can be configured to trigger problems that appear on the Cloud Guard Problems page. A DetectorRecipe resource contains settings for a specific detector recipe, plus a list of the detector rules (DetectorRecipeDetectorRule resources) belonging to the DetectorRecipe resource.

OracleCloudDatabaseEnterpriseInfrastructureSoftware-as-a-ServiceFortune 100

Properties

Name	Type	Description
compartmentId	string	Compartment OCID of detector recipe
definedTags	object	Defined tags for this resource. Each key is predefined and scoped to a namespace. Example: `{"foo-namespace": {"bar-key": "value"}}`
description	string	Detector recipe description
detector	string	Type of detector
detectorRecipeType	string	Recipe type ( STANDARD, ENTERPRISE )
detectorRules	array	List of detector rules for the detector type for recipe - user input
displayName	string	Display name of detector recipe
effectiveDetectorRules	array	List of effective detector rules for the detector type for recipe after applying defaults
freeformTags	object	Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only. Example: `{"bar-key": "value"}` Avoid entering confidential information.
id	string	OCID for detector recipe
lifecycleState	string	The current lifecycle state of the resource
owner	string	Owner of detector recipe
sourceDataRetention	integer	The number of days for which source data is retained
sourceDetectorRecipeId	string	Recipe OCID of the source recipe to be cloned
systemTags	object	System tags for this resource. Each key is predefined and scoped to a namespace. For more information, see [Resource Tags](/Content/General/Concepts/resourcetags.htm). System tags can be viewed by use
targetIds	array	List of target IDs to which the recipe is attached
timeCreated	string	The date and time the detector recipe was created Format defined by RFC3339.
timeUpdated	string	The date and time the detector recipe was last updated Format defined by RFC3339.

View JSON Schema on GitHub

JSON Schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/oracle/json-schema/oracle-detector-recipe-schema.json",
  "title": "DetectorRecipe",
  "description": "A detector recipe is a collection of rules that can be configured to trigger problems that appear on the Cloud Guard Problems page. A DetectorRecipe resource contains settings for a specific detector recipe, plus a list of the detector rules (DetectorRecipeDetectorRule resources) belonging to the DetectorRecipe resource.",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/oracle-cloudguard-api-openapi.yml#/components/schemas/DetectorRecipe",
  "properties": {
    "compartmentId": {
      "description": "Compartment OCID of detector recipe",
      "type": "string"
    },
    "definedTags": {
      "additionalProperties": {
        "additionalProperties": {
          "description": "The value of the tag. Only string, integer and boolean types are supported.\n\nAvoid entering confidential information.\n",
          "type": "object"
        },
        "description": "Key-value pair representing predefined tags' keys and values scoped to a namespace.\nExample: `{\"bar-key\": \"value\"}`\n",
        "type": "object"
      },
      "description": "Defined tags for this resource. Each key is predefined and scoped to a namespace.\nExample: `{\"foo-namespace\": {\"bar-key\": \"value\"}}`\n",
      "type": "object"
    },
    "description": {
      "description": "Detector recipe description",
      "type": "string"
    },
    "detector": {
      "description": "Type of detector",
      "enum": [
        "IAAS_ACTIVITY_DETECTOR",
        "IAAS_CONFIGURATION_DETECTOR",
        "IAAS_THREAT_DETECTOR",
        "IAAS_LOGGING_DETECTOR",
        "IAAS_LOG_INSIGHT_DETECTOR",
        "SAAS_FA_ACTIVITY_DETECTOR",
        "IAAS_CONTAINER_SECURITY_DETECTOR"
      ],
      "type": "string",
      "x-obmcs-top-level-enum": "#/definitions/DetectorEnum"
    },
    "detectorRecipeType": {
      "description": "Recipe type ( STANDARD, ENTERPRISE )",
      "enum": [
        "LIMITED",
        "BASIC",
        "STANDARD",
        "ENTERPRISE"
      ],
      "type": "string",
      "x-obmcs-top-level-enum": "#/definitions/DetectorRecipeEnum"
    },
    "detectorRules": {
      "description": "List of detector rules for the detector type for recipe - user input",
      "items": {
        "$ref": "#/$defs/DetectorRecipeDetectorRule"
      },
      "type": "array"
    },
    "displayName": {
      "description": "Display name of detector recipe",
      "type": "string"
    },
    "effectiveDetectorRules": {
      "description": "List of effective detector rules for the detector type for recipe after applying defaults",
      "items": {
        "$ref": "#/$defs/DetectorRecipeDetectorRule"
      },
      "type": "array"
    },
    "freeformTags": {
      "additionalProperties": {
        "type": "string"
      },
      "description": "Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only.\nExample: `{\"bar-key\": \"value\"}`\n\nAvoid entering confidential information.\n",
      "type": "object"
    },
    "id": {
      "description": "OCID for detector recipe",
      "maxLength": 255,
      "minLength": 1,
      "type": "string"
    },
    "lifecycleState": {
      "description": "The current lifecycle state of the resource",
      "enum": [
        "CREATING",
        "UPDATING",
        "ACTIVE",
        "INACTIVE",
        "DELETING",
        "DELETED",
        "FAILED"
      ],
      "type": "string",
      "x-obmcs-top-level-enum": "#/definitions/LifecycleState"
    },
    "owner": {
      "description": "Owner of detector recipe",
      "enum": [
        "CUSTOMER",
        "ORACLE"
      ],
      "type": "string",
      "x-obmcs-top-level-enum": "#/definitions/OwnerType"
    },
    "sourceDataRetention": {
      "description": "The number of days for which source data is retained",
      "type": "integer"
    },
    "sourceDetectorRecipeId": {
      "description": "Recipe OCID of the source recipe to be cloned",
      "type": "string"
    },
    "systemTags": {
      "additionalProperties": {
        "additionalProperties": {
          "description": "The value of the tag. Only the String type is supported.\n\nAvoid entering confidential information.\n",
          "type": "object"
        },
        "description": "Key-value pair representing a defined tag key and value, scoped to a namespace.\nExample: `{\"free-tier-retained\": \"true\"}`\n",
        "type": "object"
      },
      "description": "System tags for this resource. Each key is predefined and scoped to a namespace.\nFor more information, see [Resource Tags](/Content/General/Concepts/resourcetags.htm).\nSystem tags can be viewed by users, but can only be created by the system.\n\nExample: `{\"orcl-cloud\": {\"free-tier-retained\": \"true\"}}`\n",
      "type": "object"
    },
    "targetIds": {
      "description": "List of target IDs to which the recipe is attached",
      "items": {
        "type": "string"
      },
      "type": "array"
    },
    "timeCreated": {
      "description": "The date and time the detector recipe was created Format defined by RFC3339.",
      "format": "date-time",
      "type": "string"
    },
    "timeUpdated": {
      "description": "The date and time the detector recipe was last updated Format defined by RFC3339.",
      "format": "date-time",
      "type": "string"
    }
  },
  "required": [
    "id",
    "displayName",
    "compartmentId",
    "owner",
    "detector",
    "sourceDetectorRecipeId"
  ],
  "type": "object",
  "$defs": {
    "AdditionalConfigPropertyDefinition": {
      "description": "Detector rule additional property field",
      "properties": {
        "key": {
          "description": "Name for Additional Property, for example, \"interpreter\", \"router\"",
          "type": "string"
        },
        "propertyType": {
          "description": "Property Type",
          "enum": [
            "HINT",
            "RANGE"
          ],
          "type": "string"
        },
        "value": {
          "description": "Value for Property Name, for example, \"generic\", \"cloudguard\"",
          "type": "string"
        }
      },
      "type": "object"
    },
    "CandidateResponderRule": {
      "description": "Information for a responder rule that can be used to remediate a problem triggered by specific detector rule.",
      "properties": {
        "displayName": {
          "description": "The display name of the responder rule",
          "maxLength": 255,
          "minLength": 1,
          "type": "string"
        },
        "id": {
          "description": "The unique identifier of the responder rule",
          "type": "string"
        },
        "isPreferred": {
          "description": "Is this the preferred state?",
          "type": "boolean"
        }
      },
      "type": "object"
    },
    "Condition": {
      "description": "The base condition resource.",
      "properties": {
        "kind": {
          "description": "Type of condition resource",
          "enum": [
            "COMPOSITE",
            "SIMPLE"
          ],
          "type": "string"
        }
      },
      "required": [
        "kind"
      ]
    },
    "ConfigValue": {
      "description": "Details for a configuration value for a managed list.",
      "properties": {
        "listType": {
          "description": "Configuration list item type (CUSTOM or MANAGED)",
          "enum": [
            "MANAGED",
            "CUSTOM"
          ],
          "type": "string",
          "x-obmcs-top-level-enum": "#/definitions/ConfigurationListItemType"
        },
        "managedListType": {
          "description": "Type of content in the managed list",
          "type": "string"
        },
        "value": {
          "description": "Configuration value",
          "type": "string"
        }
      },
      "required": [
        "listType",
        "managedListType",
        "value"
      ],
      "type": "object"
    },
    "DetectorConfiguration": {
      "description": "Configuration details for a detector.",
      "properties": {
        "additionalProperties": {
          "description": "Map of additional property values for configuration",
          "items": {
            "$ref": "#/$defs/AdditionalConfigPropertyDefinition"
          },
          "type": "array"
        },
        "allowedValues": {
          "description": "Map of possible values for configuration",
          "items": {
            "$ref": "#/$defs/PropertyTuple"
          },
          "type": "array"
        },
        "allowedValuesDataType": {
          "description": "Map property Value data type",
          "type": "string"
        },
        "configKey": {
          "description": "Unique identifier of the configuration",
          "maxLength": 255,
          "minLength": 1,
          "type": "string"
        },
        "dataType": {
          "description": "Configuration data type",
          "type": "string"
        },
        "name": {
          "description": "Configuration name",
          "maxLength": 255,
          "minLength": 1,
          "type": "string"
        },
        "value": {
          "description": "Configuration value",
          "maxLength": 255,
          "minLength": 1,
          "type": "string"
        },
        "values": {
          "description": "List of configuration values",
          "items": {
            "$ref": "#/$defs/ConfigValue"
          },
          "type": "array"
        }
      },
      "required": [
        "configKey",
        "name"
      ],
      "type": "object"
    },
    "DetectorDetails": {
      "description": "Detailed information for a detector.",
      "properties": {
        "condition": {
          "$ref": "#/$defs/Condition"
        },
        "configurations": {
          "description": "List of detector rule configurations",
          "items": {
            "$ref": "#/$defs/DetectorConfiguration"
          },
          "type": "array"
        },
        "dataSourceId": {
          "description": "The ID of the attached data source",
          "type": "string"
        },
        "description": {
          "description": "Description for detector recipe detector rule",
          "type": "string"
        },
        "entitiesMappings": {
          "description": "Data source entities mapping for a detector rule",
          "items": {
            "$ref": "#/$defs/EntitiesMapping"
          },
          "type": "array"
        },
        "isConfigurationAllowed": {
          "description": "Can the rule be configured?",
          "type": "boolean"
        },
        "isEnabled": {
          "description": "Enablement status for the rule",
          "type": "boolean"
        },
        "labels": {
          "description": "User-defined labels for a detector rule",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "problemThreshold": {
          "description": "The point at which an elevated resource risk score creates a problem",
          "type": "integer"
        },
        "recommendation": {
          "description": "Recommendation for detector recipe detector rule",
          "type": "string"
        },
        "riskLevel": {
          "description": "The risk level for the rule",
          "enum": [
            "CRITICAL",
            "HIGH",
            "MEDIUM",
            "LOW",
            "MINOR"
          ],
          "type": "string",
          "x-obmcs-top-level-enum": "#/definitions/RiskLevel"
        },
        "sightingTypes": {
          "description": "List of sighting types",
          "items": {
            "$ref": "#/$defs/SightingType"
          },
          "type": "array"
        },
        "targetTypes": {
          "description": "List of target types for which the detector rule is applicable",
          "items": {
            "type": "string"
          },
          "type": "array"
        }
      },
      "required": [
        "isEnabled"
      ],
      "type": "object"
    },
    "DetectorRecipeDetectorRule": {
      "description": "A DetectorRecipeDetectorRule resource defines a single recipe rule in the collection for a DetectorRecipe resource.",
      "properties": {
        "candidateResponderRules": {
          "description": "List of responder rules that can be used to remediate this detector rule",
          "items": {
            "$ref": "#/$defs/CandidateResponderRule"
          },
          "type": "array"
        },
        "dataSourceId": {
          "description": "The unique identifier of the attached data source",
          "type": "string"
        },
        "description": {
          "description": "Description for DetectorRecipeDetectorRule resource",
          "type": "string"
        },
        "details": {
          "$ref": "#/$defs/DetectorDetails"
        },
        "detector": {
          "description": "Detector recipe for the rule",
          "enum": [
            "IAAS_ACTIVITY_DETECTOR",
            "IAAS_CONFIGURATION_DETECTOR",
            "IAAS_THREAT_DETECTOR",
            "IAAS_LOGGING_DETECTOR",
            "IAAS_LOG_INSIGHT_DETECTOR",
            "SAAS_FA_ACTIVITY_DETECTOR",
            "IAAS_CONTAINER_SECURITY_DETECTOR"
          ],
          "type": "string",
          "x-obmcs-top-level-enum": "#/definitions/DetectorEnum"
        },
        "detectorRuleId": {
          "description": "The unique identifier of the detector rule.",
          "maxLength": 255,
          "minLength": 1,
          "type": "string"
        },
        "displayName": {
          "description": "Display name for DetectorRecipeDetectorRule resource",
          "type": "string"
        },
        "entitiesMappings": {
          "description": "Data source entities mapping for the detector rule",
          "items": {
            "$ref": "#/$defs/EntitiesMapping"
          },
          "type": "array"
        },
        "isCloneable": {
          "description": "Is the rule cloneable?",
          "type": "boolean"
        },
        "lifecycleDetails": {
          "description": "A message describing the current state in more detail. For example, can be used to provide actionable information for a resource in Failed state.",
          "type": "string"
        },
        "lifecycleState": {
          "description": "The current lifecycle state of the detector rule.",
          "enum": [
            "CREATING",
            "UPDATING",
            "ACTIVE",
            "INACTIVE",
            "DELETING",
            "DELETED",
            "FAILED"
          ],
          "type": "string",
          "x-obmcs-top-level-enum": "#/definitions/LifecycleState"
        },
        "locks": {
          "description": "Locks associated with this resource.",
          "items": {
            "$ref": "#/$defs/ResourceLock"
          },
          "maxItems": 1,
          "type": "array"
        },
        "managedListTypes": {
          "description": "List of managed list types related to this rule",
          "items": {
            "enum": [
              "CIDR_BLOCK",
              "USERS",
              "GROUPS",
              "IPV4ADDRESS",
              "IPV6ADDRESS",
              "RESOURCE_OCID",
              "REGION",
              "COUNTRY",
              "STATE",
              "CITY",
              "TAGS",
              "GENERIC",
              "FUSION_APPS_ROLE",
              "FUSION_APPS_PERMISSION",
              "NAMESPACE_SELECTOR",
              "POD_RESOURCE_SELECTOR"
            ],
            "type": "string"
          },
          "type": "array"
        },
        "recommendation": {
          "description": "Recommendation for DetectorRecipeDetectorRule resource",
          "type": "string"
        },
        "resourceType": {
          "description": "Resource type of the configuration to which the rule is applied",
          "type": "string"
        },
        "ruleType": {
          "description": "Detector rule type",
          "items": {
            "$ref": "#/$defs/RuleType"
          },
          "type": "array"
        },
        "serviceType": {
          "description": "Service type of the configuration to which the rule is applied",
          "type": "string"
        },
        "sourceDetectorRuleId": {
          "description": "The ID of the source detector rule",
          "type": "string"
        },
        "timeCreated": {
          "description": "The date and time the detector recipe rule was created. Format defined by RFC3339.",
          "format": "date-time",
          "type": "string"
        },
        "timeUpdated": {
          "description": "The date and time the detector recipe rule was last updated. Format defined by RFC3339.",
          "format": "date-time",
          "type": "string"
        }
      },
      "required": [
        "detectorRuleId",
        "serviceType",
        "resourceType",
        "detector"
      ],
      "type": "object"
    },
    "EntitiesMapping": {
      "description": "Parameters for entities mapping to data source.",
      "properties": {
        "displayName": {
          "description": "Display name of the entity",
          "type": "string"
        },
        "entityType": {
          "description": "Type of entity",
          "enum": [
            "EXTERNAL_IP",
            "INTERNAL_IP",
            "TEXT",
            "JSON_LIST"
          ],
          "type": "string",
          "x-obmcs-top-level-enum": "#/definitions/EntityType"
        },
        "queryField": {
          "description": "The entity value mapped to a data source query",
          "type": "string"
        }
      },
      "required": [
        "queryField"
      ],
      "type": "object"
    },
    "MitreDetails": {
      "description": "MITRE ATT@CK framework details for the sighting type.",
      "properties": {
        "tacticDetails": {
          "$ref": "#/$defs/MitreTactic"
        },
        "techniqueDetails": {
          "$ref": "#/$defs/MitreTechnique"
        }
      },
      "type": "object"
    },
    "MitreTactic": {
      "description": "MITRE ATT@CK framework tactic",
      "properties": {
        "displayName": {
          "description": "The display name of MITRE ATT@CK framework tactic",
          "type": "string"
        },
        "id": {
          "description": "The unique identifier of MITRE ATT@CK framework tactic",
          "type": "string"
        }
      },
      "type": "object"
    },
    "MitreTechnique": {
      "description": "MITRE ATT@CK framework technique",
      "properties": {
        "displayName": {
          "description": "Display name of the MITRE ATT@CK framework technique",
          "type": "string"
        },
        "id": {
          "description": "Unique identifier of the MITRE ATT@CK framework technique",
          "type": "string"
        }
      },
      "type": "object"
    },
    "PropertyTuple": {
      "description": "key and value pair for configuration values",
      "properties": {
        "key": {
          "description": "key",
          "type": "string"
        },
        "value": {
          "description": "value",
          "type": "string"
        }
      },
      "required": [
        "key",
        "value"
      ],
      "type": "object"
    },
    "ResourceLock": {
      "description": "Resource locks are used to prevent certain APIs from being called for the resource.\nA full lock prevents both updating the resource and deleting the resource. A delete\nlock prevents deleting the resource.\n",
      "properties": {
        "message": {
          "description": "A message added by the creator of the lock. This is typically used to give an\nindication of why the resource is locked.\n",
          "type": "string"
        },
        "relatedResourceId": {
          "description": "The ID of the resource that is locking this resource. Indicates that deleting this resource will remove the lock.\n",
          "type": "string"
        },
        "timeCreated": {
          "description": "When the lock was created, in the format defined by RFC 3339.",
          "format": "date-time",
          "type": "string"
        },
        "type": {
          "description": "Type of the lock.",
          "enum": [
            "FULL",
            "DELETE"
          ],
          "type": "string"
        }
      },
      "required": [
        "type"
      ],
      "type": "object"
    },
    "RuleType": {
      "description": "The detector rule types.",
      "properties": {
        "key": {
          "description": "The unique identifier of the detector rule type",
          "enum": [
            "CATEGORY"
          ],
          "type": "string"
        },
        "value": {
          "description": "Detector rule type value",
          "items": {
            "type": "string"
          },
          "type": "array"
        }
      },
      "required": [
        "key",
        "value"
      ],
      "type": "object"
    },
    "SightingType": {
      "description": "Information for a sighting type",
      "properties": {
        "additionalEntitiesMapping": {
          "description": "Data source additional entities mapping for a detector rule",
          "items": {
            "$ref": "#/$defs/EntitiesMapping"
          },
          "maxItems": 15,
          "minItems": 0,
          "type": "array"
        },
        "dataSourceId": {
          "description": "Unique identifier of the associated data source",
          "type": "string"
        },
        "description": {
          "description": "Description of the sighting type",
          "type": "string"
        },
        "displayName": {
          "description": "Display name of the sighting type",
          "type": "string"
        },
        "id": {
          "description": "The unique identifier of the sighting type",
          "type": "string"
        },
        "mitreDetails": {
          "$ref": "#/$defs/MitreDetails"
        },
        "mitreLink": {
          "description": "MITRE ATT@CK framework link for the sighting type",
          "type": "string"
        },
        "owner": {
          "description": "Owner type for the sighting type",
          "enum": [
            "CUSTOMER",
            "ORACLE"
          ],
          "type": "string",
          "x-obmcs-top-level-enum": "#/definitions/OwnerType"
        },
        "tactic": {
          "description": "MITRE ATT@CK framework tactic for the sighting type",
          "type": "string"
        },
        "techniques": {
          "description": "List of MITRE ATT@CK framework techniques for the sighting type",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "timeCreated": {
          "description": "The date and time the sighting type was created. Format defined by RFC3339.",
          "format": "date-time",
          "type": "string"
        },
        "timeUpdated": {
          "description": "The date and time the sighting type was updated. Format defined by RFC3339.",
          "format": "date-time",
          "type": "string"
        }
      },
      "type": "object"
    }
  }
}

Work with this as data

Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for schemas

4 MCP tools reach this

find_json_schemasBrowse and filter every JSON Schema in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This JSON Schema

curl "https://apis.io/api/v1/json-schemas/oracle-detector-recipe"

All schemas

curl "https://apis.io/api/v1/json-schemas?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.