> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aegister.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Cloud Defender detections

> Retrieve the requests Cloud Defender matched against its attack signatures for one protected domain.
A detection records what a request looked like, not necessarily what happened to it: the signature rules currently run in preview, so a detection reports what would have been blocked. The outcome field states what actually happened.



## OpenAPI

````yaml get /api/v1/cloud-defender/{id}/security-events
openapi: 3.1.0
info:
  title: Aegister API
  version: 1.1.0
servers: []
security: []
paths:
  /api/v1/cloud-defender/{id}/security-events:
    get:
      tags:
        - cloud-defender
      summary: List Cloud Defender security events
      description: >-
        Detected attacks for a Cloud Defender domain you can view, newest first.


        Captured request detail (`matched_field`, `matched_value`), the `ja3`
        correlation handle and

        the event `fingerprint` are returned to **super_admin only** — they are
        forensic detail, not

        customer-facing. Events whose attacker IP could not be resolved are
        likewise super_admin

        only, because the address in the log is the CDN edge rather than the
        attacker.
      operationId: cloud_defender_security_events_retrieve
      parameters:
        - in: query
          name: days
          schema:
            type: number
            default: 7
          description: Window in days (1-365).
        - in: path
          name: id
          schema:
            type: integer
          required: true
        - in: query
          name: limit
          schema:
            type: number
            default: 50
          description: Max items (1-200).
        - in: query
          name: offset
          schema:
            type: number
            default: 0
          description: Offset items.
        - in: query
          name: search
          schema:
            type: string
          description: Match domain or source IP.
        - in: query
          name: severity
          schema:
            type: string
          description: 'Filter by severity: danger, warning or info.'
      responses:
        '200':
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: integer
                    description: |-
                      Any value different from 0 indicates an error.  
                      More details can be found in `messages`.
                    minimum: 0
                    maximum: 0
                    examples:
                      - 0
                  messages:
                    type: array
                    description: >-
                      If `error` is `1`, contains zero or more details on the
                      error.
                    examples:
                      - []
                  total:
                    type: number
                    description: >-
                      Total number of items that meet the list filter.  

                      This doesn't represent the number of items inside the
                      `data` array.
                    minimum: 0
                    examples:
                      - 20
                      - 30
                      - 40
                  data:
                    type: array
                    items:
                      type: object
          description: ''
        '401':
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: integer
                    description: |-
                      Any value different from 0 indicates an error.  
                      More details can be found in `messages`.
                    minimum: 0
                    maximum: 0
                    examples:
                      - 1
                  messages:
                    type: array
                    description: >-
                      If `error` is `1`, contains zero or more details on the
                      error.
                    examples:
                      - - 9153
          description: ''
        '404':
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: integer
                    description: |-
                      Any value different from 0 indicates an error.  
                      More details can be found in `messages`.
                    minimum: 0
                    maximum: 0
                    examples:
                      - 1
                  messages:
                    type: array
                    description: >-
                      If `error` is `1`, contains zero or more details on the
                      error.
                    examples:
                      - []
          description: ''
      security:
        - ApiKeyAuth: []
        - ApiKeyQueryParam: []
components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-Aegister-Token
    ApiKeyQueryParam:
      type: apiKey
      in: query
      name: X-Aegister-Token

````