--- title: Get a job's details description: Datadog, the leading service for cloud-scale monitoring. breadcrumbs: Docs > API Reference > Security Monitoring --- # Get a job's details{% #get-a-jobs-details %} Copy pageCopied {% tab title="v2" %} **Note**: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates. | Datadog site | API endpoint | | ----------------- | --------------------------------------------------------------------------------- | | ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/siem-historical-detections/jobs/{job_id} | | ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/siem-historical-detections/jobs/{job_id} | | app.datadoghq.eu | GET https://api.datadoghq.eu/api/v2/siem-historical-detections/jobs/{job_id} | | app.ddog-gov.com | GET https://api.ddog-gov.com/api/v2/siem-historical-detections/jobs/{job_id} | | us2.ddog-gov.com | GET https://api.us2.ddog-gov.com/api/v2/siem-historical-detections/jobs/{job_id} | | app.datadoghq.com | GET https://api.datadoghq.com/api/v2/siem-historical-detections/jobs/{job_id} | | us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/siem-historical-detections/jobs/{job_id} | | us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/siem-historical-detections/jobs/{job_id} | ### Overview Get a job's details. This endpoint requires the `security_monitoring_rules_read` permission. OAuth apps require the `security_monitoring_rules_read` authorization [scope](https://docs.datadoghq.com/api/latest/scopes.md#security-monitoring) to access this endpoint. ### Arguments #### Path Parameters | Name | Type | Description | | ------------------------ | ------ | ------------------ | | job_id [*required*] | string | The ID of the job. | ### Response {% tab title="200" %} OK {% tab title="Model" %} Historical job response. | Parent field | Field | Type | Description | | ------------------------ | ----------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | data | object | Historical job response data. | | data | attributes | object | Historical job attributes. | | attributes | createdAt | string | Time when the job was created. | | attributes | createdByHandle | string | The handle of the user who created the job. | | attributes | createdByName | string | The name of the user who created the job. | | attributes | createdFromRuleId | string | ID of the rule used to create the job (if it is created from a rule). | | attributes | jobDefinition | object | Definition of a historical job. | | jobDefinition | calculatedFields | [object] | Calculated fields. | | calculatedFields | expression [*required*] | string | Expression. | | calculatedFields | name [*required*] | string | Field name. | | jobDefinition | cases [*required*] | [object] | Cases used for generating job results. Up to 10 cases are allowed. | | cases | actions | [object] | Action to perform for each rule case. | | actions | options | object | Options for the rule action | | options | duration | int64 | Duration of the action in seconds. 0 indicates no expiration. | | options | flaggedIPType | enum | Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. Allowed enum values: `SUSPICIOUS,FLAGGED` | | options | userBehaviorName | string | Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule. | | actions | type | enum | The action type. Allowed enum values: `block_ip,block_user,user_behavior,flag_ip` | | cases | condition | string | A case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated based on the event counts in the previously defined queries. | | cases | name | string | Name of the case. | | cases | notifications | [string] | Notification targets. | | cases | status [*required*] | enum | Severity of the Security Signal. Allowed enum values: `info,low,medium,high,critical` | | jobDefinition | from [*required*] | int64 | Starting time of data analyzed by the job. | | jobDefinition | groupSignalsBy | [string] | Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. | | jobDefinition | index [*required*] | string | Index used to load the data. | | jobDefinition | message [*required*] | string | Message for generated results. | | jobDefinition | name [*required*] | string | Job name. | | jobDefinition | options | object | Job options. | | options | anomalyDetectionOptions | object | Options on anomaly detection method. | | anomalyDetectionOptions | bucketDuration | enum | Duration in seconds of the time buckets used to aggregate events matched by the rule. Must be greater than or equal to 300. Allowed enum values: `300,600,900,1800,3600,10800` | | anomalyDetectionOptions | detectionTolerance | enum | An optional parameter that sets how permissive anomaly detection is. Higher values require higher deviations before triggering a signal. Allowed enum values: `1,2,3,4,5` | | anomalyDetectionOptions | instantaneousBaseline | boolean | When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time. | | anomalyDetectionOptions | learningDuration | enum | Learning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating. Allowed enum values: `1,6,12,24,48,168,336` | | anomalyDetectionOptions | learningPeriodBaseline | int64 | An optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0. | | options | detectionMethod | enum | The detection method. Allowed enum values: `threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection` | | options | evaluationWindow | enum | A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used. Allowed enum values: `0,60,300,600,900,1800,3600,7200,10800,21600` | | options | impossibleTravelOptions | object | Options on impossible travel detection method. | | impossibleTravelOptions | baselineUserLocations | boolean | If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access. | | impossibleTravelOptions | baselineUserLocationsDuration | int32 | The duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations. | | options | keepAlive | enum | Once a signal is generated, the signal will remain "open" if a case is matched at least once within this keep alive window. For third party detection method, this field is not used. Allowed enum values: `0,60,300,600,900,1800,3600,7200,10800,21600` | | options | maxSignalDuration | enum | A signal will "close" regardless of the query being matched once the time exceeds the maximum duration. This time is calculated from the first seen timestamp. Allowed enum values: `0,60,300,600,900,1800,3600,7200,10800,21600` | | options | newValueOptions | object | Options on new value detection method. | | newValueOptions | forgetAfter | int32 | The duration in days after which a learned value is forgotten. | | newValueOptions | instantaneousBaseline | boolean | When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time. | | newValueOptions | learningDuration | int32 | The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. | | newValueOptions | learningMethod | enum | The learning method used to determine when signals should be generated for values that weren't learned. Allowed enum values: `duration,threshold` | | newValueOptions | learningThreshold | enum | A number of occurrences after which signals will be generated for values that weren't learned. Allowed enum values: `0,1` | | options | sequenceDetectionOptions | object | Options on sequence detection method. | | sequenceDetectionOptions | stepTransitions | [object] | Transitions defining the allowed order of steps and their evaluation windows. | | stepTransitions | child | string | Name of the child step. | | stepTransitions | evaluationWindow | enum | A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used. Allowed enum values: `0,60,300,600,900,1800,3600,7200,10800,21600` | | stepTransitions | parent | string | Name of the parent step. | | sequenceDetectionOptions | steps | [object] | Steps that define the conditions to be matched in sequence. | | steps | condition | string | Condition referencing rule queries (e.g., `a > 0`). | | steps | evaluationWindow | enum | A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used. Allowed enum values: `0,60,300,600,900,1800,3600,7200,10800,21600` | | steps | name | string | Unique name identifying the step. | | options | thirdPartyRuleOptions | object | Options on third party detection method. | | thirdPartyRuleOptions | defaultNotifications | [string] | Notification targets for the logs that do not correspond to any of the cases. | | thirdPartyRuleOptions | defaultStatus | enum | Severity of the Security Signal. Allowed enum values: `info,low,medium,high,critical` | | thirdPartyRuleOptions | rootQueries | [object] | Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert. | | rootQueries | groupByFields | [string] | Fields to group by. | | rootQueries | query | string | Query to run on logs. | | thirdPartyRuleOptions | signalTitleTemplate | string | A template for the signal title; if omitted, the title is generated based on the case name. | | jobDefinition | queries [*required*] | [object] | Queries for selecting logs analyzed by the job. Up to 10 queries are allowed. | | queries | additionalFilters | string | Additional filters appended to the query at evaluation time. | | queries | aggregation | enum | The aggregation type. Allowed enum values: `count,cardinality,sum,max,new_value,geo_data,event_count,none` | | queries | correlatedByFields | [string] | Fields used to correlate results across queries in sequence detection rules. | | queries | correlatedQueryIndex | int64 | Zero-based index of the query to correlate with in sequence detection rules. Up to 10 queries are supported, so valid values are 0 to 9. | | queries | customQueryExtension | string | Custom query extension used to refine the base query. | | queries | dataSource | enum | Source of events, either logs, audit trail, security signals, or Datadog events. `app_sec_spans` is deprecated in favor of `spans`. Allowed enum values: `logs,audit,app_sec_spans,spans,security_runtime,network,events,security_signals` | | queries | datasetIds | [string] | IDs of reference datasets used by this query. | | queries | distinctFields | [string] | Field for which the cardinality is measured. Sent as an array. | | queries | groupByFields | [string] | Fields to group by. | | queries | hasOptionalGroupByFields | boolean | When false, events without a group-by value are ignored by the query. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values. | | queries | index | string | Index used to load the data for this query. | | queries | indexes | [string] | Indexes used to load the data for this query. Mutually exclusive with `index`. | | queries | metrics | [string] | Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values. | | queries | name | string | Name of the query. | | queries | query | string | Query to run on logs. | | queries | queryLanguage | string | Language used to parse the query string. | | jobDefinition | referenceTables | [object] | Reference tables used in the queries. | | referenceTables | checkPresence | boolean | Whether to include or exclude the matched values. | | referenceTables | columnName | string | The name of the column in the reference table. | | referenceTables | logFieldPath | string | The field in the log to match against the reference table. | | referenceTables | ruleQueryName | string | The name of the query to apply the reference table to. | | referenceTables | tableName | string | The name of the reference table. | | jobDefinition | tags | [string] | Tags for generated signals. | | jobDefinition | thirdPartyCases | [object] | Cases for generating results from third-party detection method. Only available for third-party detection method. Up to 10 cases are allowed. | | thirdPartyCases | name | string | Name of the case. | | thirdPartyCases | notifications | [string] | Notification targets for each case. | | thirdPartyCases | query | string | A query to map a third party event to this case. | | thirdPartyCases | status [*required*] | enum | Severity of the Security Signal. Allowed enum values: `info,low,medium,high,critical` | | jobDefinition | to [*required*] | int64 | Ending time of data analyzed by the job. | | jobDefinition | type | string | Job type. | | attributes | jobName | string | Job name. | | attributes | jobStatus | string | Job status. | | attributes | modifiedAt | string | Last modification time of the job. | | attributes | progressRate | double | Job execution progress as a value between 0 and 1. Available for ongoing jobs. | | attributes | signalOutput | boolean | Whether the job outputs signals. | | data | id | string | ID of the job. | | data | type | enum | Type of payload. Allowed enum values: `historicalDetectionsJob` | {% /tab %} {% tab title="Example" %} ```json { "data": { "attributes": { "createdAt": "string", "createdByHandle": "string", "createdByName": "string", "createdFromRuleId": "string", "jobDefinition": { "calculatedFields": [ { "expression": "@request_end_timestamp - @request_start_timestamp", "name": "response_time" } ], "cases": [ { "actions": [ { "options": { "duration": 0, "flaggedIPType": "FLAGGED", "userBehaviorName": "string" }, "type": "string" } ], "condition": "string", "name": "string", "notifications": [], "status": "critical" } ], "from": 1729843470000, "groupSignalsBy": [ "service" ], "index": "cloud_siem", "message": "A large number of failed login attempts.", "name": "Excessive number of failed attempts.", "options": { "anomalyDetectionOptions": { "bucketDuration": 300, "detectionTolerance": 5, "instantaneousBaseline": false, "learningDuration": "integer", "learningPeriodBaseline": "integer" }, "detectionMethod": "string", "evaluationWindow": "integer", "impossibleTravelOptions": { "baselineUserLocations": true, "baselineUserLocationsDuration": "integer" }, "keepAlive": "integer", "maxSignalDuration": "integer", "newValueOptions": { "forgetAfter": "integer", "instantaneousBaseline": false, "learningDuration": "integer", "learningMethod": "string", "learningThreshold": "integer" }, "sequenceDetectionOptions": { "stepTransitions": [ { "child": "string", "evaluationWindow": "integer", "parent": "string" } ], "steps": [ { "condition": "string", "evaluationWindow": "integer", "name": "string" } ] }, "thirdPartyRuleOptions": { "defaultNotifications": [], "defaultStatus": "critical", "rootQueries": [ { "groupByFields": [], "query": "source:cloudtrail" } ], "signalTitleTemplate": "string" } }, "queries": [ { "additionalFilters": "string", "aggregation": "string", "correlatedByFields": [], "correlatedQueryIndex": "integer", "customQueryExtension": "string", "dataSource": "logs", "datasetIds": [], "distinctFields": [], "groupByFields": [], "hasOptionalGroupByFields": false, "index": "string", "indexes": [], "metrics": [], "name": "string", "query": "a > 3", "queryLanguage": "string" } ], "referenceTables": [ { "checkPresence": false, "columnName": "string", "logFieldPath": "string", "ruleQueryName": "string", "tableName": "string" } ], "tags": [], "thirdPartyCases": [ { "name": "string", "notifications": [], "query": "string", "status": "critical" } ], "to": 1729847070000, "type": "string" }, "jobName": "string", "jobStatus": "string", "modifiedAt": "string", "progressRate": "number", "signalOutput": false }, "id": "string", "type": "string" } } ``` {% /tab %} {% /tab %} {% tab title="400" %} Bad Request {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} {% tab title="403" %} Not Authorized {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} {% tab title="404" %} Not Found {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} {% tab title="429" %} Too many requests {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} ### Code Example ##### \# Path parameters export job_id="CHANGE_ME" \# Curl command curl -X GET "https://api.datadoghq.com/api/v2/siem-historical-detections/jobs/${job_id}" \ -H "Accept: application/json" \ -H "DD-API-KEY: ${DD_API_KEY}" \ -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" ##### ```python """ Get a job's details returns "OK" response """ from os import environ from datadog_api_client import ApiClient, Configuration from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi # there is a valid "historical_job" in the system HISTORICAL_JOB_DATA_ID = environ["HISTORICAL_JOB_DATA_ID"] configuration = Configuration() configuration.unstable_operations["get_historical_job"] = True configuration.unstable_operations["run_historical_job"] = True with ApiClient(configuration) as api_client: api_instance = SecurityMonitoringApi(api_client) response = api_instance.get_historical_job( job_id=HISTORICAL_JOB_DATA_ID, ) print(response) ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=python) and then save the example to `example.py` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" python3 "example.py" ##### ```ruby # Get a job's details returns "OK" response require "datadog_api_client" DatadogAPIClient.configure do |config| config.unstable_operations["v2.get_historical_job".to_sym] = true config.unstable_operations["v2.run_historical_job".to_sym] = true end api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new # there is a valid "historical_job" in the system HISTORICAL_JOB_DATA_ID = ENV["HISTORICAL_JOB_DATA_ID"] p api_instance.get_historical_job(HISTORICAL_JOB_DATA_ID) ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=ruby) and then save the example to `example.rb` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" rb "example.rb" ##### ```go // Get a job's details returns "OK" response package main import ( "context" "encoding/json" "fmt" "os" "github.com/DataDog/datadog-api-client-go/v2/api/datadog" "github.com/DataDog/datadog-api-client-go/v2/api/datadogV2" ) func main() { // there is a valid "historical_job" in the system HistoricalJobDataID := os.Getenv("HISTORICAL_JOB_DATA_ID") ctx := datadog.NewDefaultContext(context.Background()) configuration := datadog.NewConfiguration() configuration.SetUnstableOperationEnabled("v2.GetHistoricalJob", true) configuration.SetUnstableOperationEnabled("v2.RunHistoricalJob", true) apiClient := datadog.NewAPIClient(configuration) api := datadogV2.NewSecurityMonitoringApi(apiClient) resp, r, err := api.GetHistoricalJob(ctx, HistoricalJobDataID) if err != nil { fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.GetHistoricalJob`: %v\n", err) fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) } responseContent, _ := json.MarshalIndent(resp, "", " ") fmt.Fprintf(os.Stdout, "Response from `SecurityMonitoringApi.GetHistoricalJob`:\n%s\n", responseContent) } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=go) and then save the example to `main.go` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" go run "main.go" ##### ```java // Get a job's details returns "OK" response import com.datadog.api.client.ApiClient; import com.datadog.api.client.ApiException; import com.datadog.api.client.v2.api.SecurityMonitoringApi; import com.datadog.api.client.v2.model.HistoricalJobResponse; public class Example { public static void main(String[] args) { ApiClient defaultClient = ApiClient.getDefaultApiClient(); defaultClient.setUnstableOperationEnabled("v2.getHistoricalJob", true); defaultClient.setUnstableOperationEnabled("v2.runHistoricalJob", true); SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient); // there is a valid "historical_job" in the system String HISTORICAL_JOB_DATA_ID = System.getenv("HISTORICAL_JOB_DATA_ID"); try { HistoricalJobResponse result = apiInstance.getHistoricalJob(HISTORICAL_JOB_DATA_ID); System.out.println(result); } catch (ApiException e) { System.err.println("Exception when calling SecurityMonitoringApi#getHistoricalJob"); System.err.println("Status code: " + e.getCode()); System.err.println("Reason: " + e.getResponseBody()); System.err.println("Response headers: " + e.getResponseHeaders()); e.printStackTrace(); } } } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=java) and then save the example to `Example.java` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" java "Example.java" ##### ```rust // Get a job's details returns "OK" response use datadog_api_client::datadog; use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI; #[tokio::main] async fn main() { // there is a valid "historical_job" in the system let historical_job_data_id = std::env::var("HISTORICAL_JOB_DATA_ID").unwrap(); let mut configuration = datadog::Configuration::new(); configuration.set_unstable_operation_enabled("v2.GetHistoricalJob", true); configuration.set_unstable_operation_enabled("v2.RunHistoricalJob", true); let api = SecurityMonitoringAPI::with_config(configuration); let resp = api.get_historical_job(historical_job_data_id.clone()).await; if let Ok(value) = resp { println!("{:#?}", value); } else { println!("{:#?}", resp.unwrap_err()); } } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=rust) and then save the example to `src/main.rs` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" cargo run ##### ```typescript /** * Get a job's details returns "OK" response */ import { client, v2 } from "@datadog/datadog-api-client"; const configuration = client.createConfiguration(); configuration.unstableOperations["v2.getHistoricalJob"] = true; configuration.unstableOperations["v2.runHistoricalJob"] = true; const apiInstance = new v2.SecurityMonitoringApi(configuration); // there is a valid "historical_job" in the system const HISTORICAL_JOB_DATA_ID = process.env.HISTORICAL_JOB_DATA_ID as string; const params: v2.SecurityMonitoringApiGetHistoricalJobRequest = { jobId: HISTORICAL_JOB_DATA_ID, }; apiInstance .getHistoricalJob(params) .then((data: v2.HistoricalJobResponse) => { console.log( "API called successfully. Returned data: " + JSON.stringify(data) ); }) .catch((error: any) => console.error(error)); ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=typescript) and then save the example to `example.ts` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" tsc "example.ts" {% /tab %}