Returns security signals that match a search query.
Both this endpoint and the GET endpoint can be used interchangeably for listing
security signals.
This endpoint requires the security_monitoring_signals_read permission.
OAuth apps require the security_monitoring_signals_read authorization scope to access this endpoint.
The response object with all security signals matching the request
and pagination information.
Expand All
Field
Type
Description
data
[object]
An array of security signals matching the request.
attributes
object
The object containing all signal attributes and their
associated values.
custom
object
A JSON object of attributes in the security signal.
message
string
The message in the security signal defined by the rule that generated the signal.
tags
[string]
An array of tags associated with the security signal.
timestamp
date-time
The timestamp of the security signal.
id
string
The unique ID of the security signal.
type
enum
The type of event.
Allowed enum values: signal
default: signal
links
object
Links attributes.
next
string
The link for the next set of results. Note: The request can also be made using the
POST endpoint.
meta
object
Meta attributes.
page
object
Paging attributes.
after
string
The cursor used to get the next results, if any. To make the next request, use the same
parameters with the addition of the page[cursor].
{"data":[{"attributes":{"custom":{"workflow":{"first_seen":"2020-06-23T14:46:01.000Z","last_seen":"2020-06-23T14:46:49.000Z","rule":{"id":"0f5-e0c-805","name":"Brute Force Attack Grouped By User","version":12}}},"message":"Detect Account Take Over (ATO) through brute force attempts","tags":["security:attack","technique:T1110-brute-force"],"timestamp":"2019-01-02T09:42:36.320Z"},"id":"AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA","type":"signal"}],"links":{"next":"https://app.datadoghq.com/api/v2/security_monitoring/signals?filter[query]=foo\u0026page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ=="},"meta":{"page":{"after":"eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ=="}}}
// Get a list of security signals returns "OK" response with paginationpackagemainimport("context""encoding/json""fmt""os""time""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.SecurityMonitoringSignalListRequest{Filter:&datadogV2.SecurityMonitoringSignalListRequestFilter{From:datadog.PtrTime(time.Now().Add(time.Minute*-15)),Query:datadog.PtrString("security:attack status:high"),To:datadog.PtrTime(time.Now()),},Page:&datadogV2.SecurityMonitoringSignalListRequestPage{Limit:datadog.PtrInt32(2),},Sort:datadogV2.SECURITYMONITORINGSIGNALSSORT_TIMESTAMP_ASCENDING.Ptr(),}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,_:=api.SearchSecurityMonitoringSignalsWithPagination(ctx,*datadogV2.NewSearchSecurityMonitoringSignalsOptionalParameters().WithBody(body))forpaginationResult:=rangeresp{ifpaginationResult.Error!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.SearchSecurityMonitoringSignals`: %v\n",paginationResult.Error)}responseContent,_:=json.MarshalIndent(paginationResult.Item,""," ")fmt.Fprintf(os.Stdout,"%s\n",responseContent)}}
// Get a list of security signals returns "OK" response with paginationimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.PaginationIterable;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.api.SecurityMonitoringApi.SearchSecurityMonitoringSignalsOptionalParameters;importcom.datadog.api.client.v2.model.SecurityMonitoringSignal;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalListRequest;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalListRequestFilter;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalListRequestPage;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalsSort;importjava.time.OffsetDateTime;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);SecurityMonitoringSignalListRequestbody=newSecurityMonitoringSignalListRequest().filter(newSecurityMonitoringSignalListRequestFilter().from(OffsetDateTime.now().plusMinutes(-15)).query("security:attack status:high").to(OffsetDateTime.now())).page(newSecurityMonitoringSignalListRequestPage().limit(2)).sort(SecurityMonitoringSignalsSort.TIMESTAMP_ASCENDING);try{PaginationIterable<SecurityMonitoringSignal>iterable=apiInstance.searchSecurityMonitoringSignalsWithPagination(newSearchSecurityMonitoringSignalsOptionalParameters().body(body));for(SecurityMonitoringSignalitem:iterable){System.out.println(item);}}catch(RuntimeExceptione){System.err.println("Exception when calling"+" SecurityMonitoringApi#searchSecurityMonitoringSignalsWithPagination");System.err.println("Reason: "+e.getMessage());e.printStackTrace();}}}
"""
Get a list of security signals returns "OK" response with pagination
"""fromdatetimeimportdatetimefromdateutil.relativedeltaimportrelativedeltafromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.security_monitoring_signal_list_requestimportSecurityMonitoringSignalListRequestfromdatadog_api_client.v2.model.security_monitoring_signal_list_request_filterimport(SecurityMonitoringSignalListRequestFilter,)fromdatadog_api_client.v2.model.security_monitoring_signal_list_request_pageimport(SecurityMonitoringSignalListRequestPage,)fromdatadog_api_client.v2.model.security_monitoring_signals_sortimportSecurityMonitoringSignalsSortbody=SecurityMonitoringSignalListRequest(filter=SecurityMonitoringSignalListRequestFilter(_from=(datetime.now()+relativedelta(minutes=-15)),query="security:attack status:high",to=datetime.now(),),page=SecurityMonitoringSignalListRequestPage(limit=2,),sort=SecurityMonitoringSignalsSort.TIMESTAMP_ASCENDING,)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)items=api_instance.search_security_monitoring_signals_with_pagination(body=body)foriteminitems:print(item)
# Get a list of security signals returns "OK" response with paginationrequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newbody=DatadogAPIClient::V2::SecurityMonitoringSignalListRequest.new({filter:DatadogAPIClient::V2::SecurityMonitoringSignalListRequestFilter.new({from:(Time.now+-15*60),query:"security:attack status:high",to:Time.now,}),page:DatadogAPIClient::V2::SecurityMonitoringSignalListRequestPage.new({limit:2,}),sort:DatadogAPIClient::V2::SecurityMonitoringSignalsSort::TIMESTAMP_ASCENDING,})opts={body:body,}api_instance.search_security_monitoring_signals_with_pagination(opts){|item|putsitem}
// Get a list of security signals returns "OK" response with pagination
usechrono::{DateTime,Utc};usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SearchSecurityMonitoringSignalsOptionalParams;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV2::model::SecurityMonitoringSignalListRequest;usedatadog_api_client::datadogV2::model::SecurityMonitoringSignalListRequestFilter;usedatadog_api_client::datadogV2::model::SecurityMonitoringSignalListRequestPage;usedatadog_api_client::datadogV2::model::SecurityMonitoringSignalsSort;usefutures_util::pin_mut;usefutures_util::stream::StreamExt;#[tokio::main]asyncfnmain(){letbody=SecurityMonitoringSignalListRequest::new().filter(SecurityMonitoringSignalListRequestFilter::new().from(DateTime::parse_from_rfc3339("2021-11-11T10:56:11+00:00").expect("Failed to parse datetime").with_timezone(&Utc),).query("security:attack status:high".to_string()).to(DateTime::parse_from_rfc3339("2021-11-11T11:11:11+00:00").expect("Failed to parse datetime").with_timezone(&Utc)),).page(SecurityMonitoringSignalListRequestPage::new().limit(2)).sort(SecurityMonitoringSignalsSort::TIMESTAMP_ASCENDING);letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresponse=api.search_security_monitoring_signals_with_pagination(SearchSecurityMonitoringSignalsOptionalParams::default().body(body),);pin_mut!(response);whileletSome(resp)=response.next().await{ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get a list of security signals returns "OK" response with pagination
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiSearchSecurityMonitoringSignalsRequest={body:{filter:{from:newDate(newDate().getTime()+-15*60*1000),query:"security:attack status:high",to: newDate(),},page:{limit: 2,},sort:"timestamp",},};(async()=>{try{forawait(constitemofapiInstance.searchSecurityMonitoringSignalsWithPagination(params)){console.log(item);}}catch(error){console.error(error);}})();