Change the triage assignees of multiple security signals at once.
The maximum number of signals that can be updated in a single request is 199.
This endpoint requires the security_monitoring_signals_write permission.
Request
Body Data (required)
Attributes describing the signal assignee updates.
Response for a bulk triage update of security signals.
Expand All
Field
Type
Description
result [required]
object
The result payload of a bulk signal triage update.
count [required]
int64
The number of signals updated.
events [required]
[object]
The list of updated signals.
event [required]
object
Triage attributes of a security signal returned in a bulk update response.
archive_comment
string
Optional comment to display on archived signals.
archive_comment_timestamp
int64
Timestamp of the last edit to the archive comment.
archive_comment_user
object
Object representing a given user entity.
handle
string
The handle for this user account.
icon
string
Gravatar icon associated to the user.
id
int64
Numerical ID assigned by Datadog to this user account.
name
string
The name for this user account.
uuid [required]
string
UUID assigned by Datadog to this user account.
archive_reason
enum
Reason a signal is archived.
Allowed enum values: none,false_positive,testing_or_maintenance,remediated,investigated_case_opened,true_positive_benign,true_positive_malicious,other
assignee [required]
object
Object representing a given user entity.
handle
string
The handle for this user account.
icon
string
Gravatar icon associated to the user.
id
int64
Numerical ID assigned by Datadog to this user account.
name
string
The name for this user account.
uuid [required]
string
UUID assigned by Datadog to this user account.
id [required]
string
The unique ID of the security signal.
incident_ids [required]
[integer]
Array of incidents that are associated with this signal.
state [required]
enum
The new triage state of the signal.
Allowed enum values: open,archived,under_review
state_update_timestamp
int64
Timestamp of the last state update.
state_update_user
object
Object representing a given user entity.
handle
string
The handle for this user account.
icon
string
Gravatar icon associated to the user.
id
int64
Numerical ID assigned by Datadog to this user account.
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"python3"example.py"
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"rb"example.rb"
// Bulk update triage assignee of security signals returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.SecurityMonitoringSignalsBulkAssigneeUpdateRequest{Data:[]datadogV2.SecurityMonitoringSignalsBulkAssigneeUpdateData{{Attributes:datadogV2.SecurityMonitoringSignalsBulkAssigneeUpdateAttributes{Assignee:"773b045d-ccf8-4808-bd3b-955ef6a8c940",},Id:"AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA",Type:datadogV2.SECURITYMONITORINGSIGNALTYPE_SIGNAL.Ptr(),},},}ctx:=datadog.NewDefaultContext(context.Background())ctx=context.WithValue(ctx,datadog.ContextAccessToken,os.Getenv("DD_BEARER_TOKEN"))configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.BulkEditSecurityMonitoringSignalsAssignee(ctx,body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.BulkEditSecurityMonitoringSignalsAssignee`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.BulkEditSecurityMonitoringSignalsAssignee`:\n%s\n",responseContent)}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"go run"main.go"
// Bulk update triage assignee of security signals returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalType;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalsBulkAssigneeUpdateAttributes;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalsBulkAssigneeUpdateData;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalsBulkAssigneeUpdateRequest;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalsBulkTriageUpdateResponse;importjava.util.Collections;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN"));SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);SecurityMonitoringSignalsBulkAssigneeUpdateRequestbody=newSecurityMonitoringSignalsBulkAssigneeUpdateRequest().data(Collections.singletonList(newSecurityMonitoringSignalsBulkAssigneeUpdateData().attributes(newSecurityMonitoringSignalsBulkAssigneeUpdateAttributes().assignee("773b045d-ccf8-4808-bd3b-955ef6a8c940")).id("AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA").type(SecurityMonitoringSignalType.SIGNAL)));try{SecurityMonitoringSignalsBulkTriageUpdateResponseresult=apiInstance.bulkEditSecurityMonitoringSignalsAssignee(body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#bulkEditSecurityMonitoringSignalsAssignee");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"java"Example.java"
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<API-KEY>"DD_APP_KEY="<APP-KEY>"cargo run
/**
* Bulk update triage assignee of security signals returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration({authMethods:{AuthZ:{accessToken: process.env.DD_BEARER_TOKENasstring,},},});constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiBulkEditSecurityMonitoringSignalsAssigneeRequest={body:{data:[{attributes:{assignee:"773b045d-ccf8-4808-bd3b-955ef6a8c940",},id:"AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA",type:"signal",},],},};apiInstance.bulkEditSecurityMonitoringSignalsAssignee(params).then((data: v2.SecurityMonitoringSignalsBulkTriageUpdateResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"tsc"example.ts"
Request a personalized demo
Get Started with Datadog
Ask AI
AI-generated responses may be inaccurate. Verify important info.