--- title: Get details of a vulnerability notification rule description: Datadog, the leading service for cloud-scale monitoring. breadcrumbs: Docs > API Reference > Security Monitoring --- # Get details of a vulnerability notification rule{% #get-details-of-a-vulnerability-notification-rule %} Copy pageCopied {% tab title="v2" %} | Datadog site | API endpoint | | ----------------- | ----------------------------------------------------------------------------------------- | | ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/security/vulnerabilities/notification_rules/{id} | | ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/security/vulnerabilities/notification_rules/{id} | | app.datadoghq.eu | GET https://api.datadoghq.eu/api/v2/security/vulnerabilities/notification_rules/{id} | | app.ddog-gov.com | GET https://api.ddog-gov.com/api/v2/security/vulnerabilities/notification_rules/{id} | | us2.ddog-gov.com | GET https://api.us2.ddog-gov.com/api/v2/security/vulnerabilities/notification_rules/{id} | | app.datadoghq.com | GET https://api.datadoghq.com/api/v2/security/vulnerabilities/notification_rules/{id} | | us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/security/vulnerabilities/notification_rules/{id} | | us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/security/vulnerabilities/notification_rules/{id} | ### Overview Get the details of a notification rule for security vulnerabilities. This endpoint requires the `security_monitoring_notification_profiles_read` permission. ### Arguments #### Path Parameters | Name | Type | Description | | -------------------- | ------ | ---------------------------- | | id [*required*] | string | ID of the notification rule. | ### Response {% tab title="200" %} Notification rule details. {% tab title="Model" %} Response object which includes a notification rule. | Parent field | Field | Type | Description | | ------------ | -------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | data | object | Notification rules allow full control over notifications generated by the various Datadog security products. They allow users to define the conditions under which a notification should be generated (based on rule severities, rule types, rule tags, and so on), and the targets to notify. A notification rule is composed of a rule ID, a rule type, and the rule attributes. All fields are required. | | data | attributes [*required*] | object | Attributes of the notification rule. | | attributes | created_at [*required*] | int64 | Date as Unix timestamp in milliseconds. | | attributes | created_by [*required*] | object | User creating or modifying a rule. | | created_by | handle | string | The user handle. | | created_by | name | string | The user name. | | attributes | enabled [*required*] | boolean | Field used to enable or disable the rule. | | attributes | modified_at [*required*] | int64 | Date as Unix timestamp in milliseconds. | | attributes | modified_by [*required*] | object | User creating or modifying a rule. | | modified_by | handle | string | The user handle. | | modified_by | name | string | The user name. | | attributes | name [*required*] | string | Name of the notification rule. | | attributes | selectors [*required*] | object | Selectors are used to filter security issues for which notifications should be generated. Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source. Only the trigger_source field is required. | | selectors | query | string | The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes. | | selectors | rule_types | [string] | Security rule types used as filters in security rules. | | selectors | severities | [string] | The security rules severities to consider. | | selectors | trigger_source [*required*] | enum | The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals", while notification rules based on security vulnerabilities need to use the trigger source "security_findings". Allowed enum values: `security_findings,security_signals` | | attributes | targets [*required*] | [string] | List of recipients to notify when a notification rule is triggered. Many different target types are supported, such as email addresses, Slack channels, and PagerDuty services. The appropriate integrations need to be properly configured to send notifications to the specified targets. | | attributes | time_aggregation | int64 | Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation. Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation. Notifications are only sent for new issues discovered during the window. Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation is done. | | attributes | version [*required*] | int64 | Version of the notification rule. It is updated when the rule is modified. | | data | id [*required*] | string | The ID of a notification rule. | | data | type [*required*] | enum | The rule type associated to notification rules. Allowed enum values: `notification_rules` | {% /tab %} {% tab title="Example" %} ```json { "data": { "attributes": { "created_at": 1722439510282, "created_by": { "handle": "john.doe@domain.com", "name": "John Doe" }, "enabled": true, "modified_at": 1722439510282, "modified_by": { "handle": "john.doe@domain.com", "name": "John Doe" }, "name": "Rule 1", "selectors": { "query": "(source:production_service OR env:prod)", "rule_types": [ "misconfiguration", "attack_path" ], "severities": [ "critical" ], "trigger_source": "security_findings" }, "targets": [ "@john.doe@email.com" ], "time_aggregation": 86400, "version": 1 }, "id": "aaa-bbb-ccc", "type": "notification_rules" } } ``` {% /tab %} {% /tab %} {% tab title="400" %} Bad Request {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} {% tab title="403" %} Forbidden {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} {% tab title="404" %} Not Found {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} {% tab title="429" %} Too many requests {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} ### Code Example ##### \# Path parameters export id="CHANGE_ME" \# Curl command curl -X GET "https://api.datadoghq.com/api/v2/security/vulnerabilities/notification_rules/${id}" \ -H "Accept: application/json" \ -H "DD-API-KEY: ${DD_API_KEY}" \ -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" ##### ```python """ Get details of a vulnerability notification rule returns "Notification rule details." response """ from os import environ from datadog_api_client import ApiClient, Configuration from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi # there is a valid "valid_vulnerability_notification_rule" in the system VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID = environ["VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID"] configuration = Configuration() with ApiClient(configuration) as api_client: api_instance = SecurityMonitoringApi(api_client) response = api_instance.get_vulnerability_notification_rule( id=VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID, ) print(response) ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=python) and then save the example to `example.py` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" python3 "example.py" ##### ```ruby # Get details of a vulnerability notification rule returns "Notification rule details." response require "datadog_api_client" api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new # there is a valid "valid_vulnerability_notification_rule" in the system VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID = ENV["VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID"] p api_instance.get_vulnerability_notification_rule(VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID) ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=ruby) and then save the example to `example.rb` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" rb "example.rb" ##### ```go // Get details of a vulnerability notification rule returns "Notification rule details." response package main import ( "context" "encoding/json" "fmt" "os" "github.com/DataDog/datadog-api-client-go/v2/api/datadog" "github.com/DataDog/datadog-api-client-go/v2/api/datadogV2" ) func main() { // there is a valid "valid_vulnerability_notification_rule" in the system ValidVulnerabilityNotificationRuleDataID := os.Getenv("VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID") ctx := datadog.NewDefaultContext(context.Background()) configuration := datadog.NewConfiguration() apiClient := datadog.NewAPIClient(configuration) api := datadogV2.NewSecurityMonitoringApi(apiClient) resp, r, err := api.GetVulnerabilityNotificationRule(ctx, ValidVulnerabilityNotificationRuleDataID) if err != nil { fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.GetVulnerabilityNotificationRule`: %v\n", err) fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) } responseContent, _ := json.MarshalIndent(resp, "", " ") fmt.Fprintf(os.Stdout, "Response from `SecurityMonitoringApi.GetVulnerabilityNotificationRule`:\n%s\n", responseContent) } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=go) and then save the example to `main.go` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" go run "main.go" ##### ```java // Get details of a vulnerability notification rule returns "Notification rule details." response import com.datadog.api.client.ApiClient; import com.datadog.api.client.ApiException; import com.datadog.api.client.v2.api.SecurityMonitoringApi; import com.datadog.api.client.v2.model.NotificationRuleResponse; public class Example { public static void main(String[] args) { ApiClient defaultClient = ApiClient.getDefaultApiClient(); SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient); // there is a valid "valid_vulnerability_notification_rule" in the system String VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID = System.getenv("VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID"); try { NotificationRuleResponse result = apiInstance.getVulnerabilityNotificationRule( VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID); System.out.println(result); } catch (ApiException e) { System.err.println( "Exception when calling SecurityMonitoringApi#getVulnerabilityNotificationRule"); System.err.println("Status code: " + e.getCode()); System.err.println("Reason: " + e.getResponseBody()); System.err.println("Response headers: " + e.getResponseHeaders()); e.printStackTrace(); } } } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=java) and then save the example to `Example.java` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" java "Example.java" ##### ```rust // Get details of a vulnerability notification rule returns "Notification rule // details." response use datadog_api_client::datadog; use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI; #[tokio::main] async fn main() { // there is a valid "valid_vulnerability_notification_rule" in the system let valid_vulnerability_notification_rule_data_id = std::env::var("VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID").unwrap(); let configuration = datadog::Configuration::new(); let api = SecurityMonitoringAPI::with_config(configuration); let resp = api .get_vulnerability_notification_rule(valid_vulnerability_notification_rule_data_id.clone()) .await; if let Ok(value) = resp { println!("{:#?}", value); } else { println!("{:#?}", resp.unwrap_err()); } } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=rust) and then save the example to `src/main.rs` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" cargo run ##### ```typescript /** * Get details of a vulnerability notification rule returns "Notification rule details." response */ import { client, v2 } from "@datadog/datadog-api-client"; const configuration = client.createConfiguration(); const apiInstance = new v2.SecurityMonitoringApi(configuration); // there is a valid "valid_vulnerability_notification_rule" in the system const VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID = process.env .VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID as string; const params: v2.SecurityMonitoringApiGetVulnerabilityNotificationRuleRequest = { id: VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID, }; apiInstance .getVulnerabilityNotificationRule(params) .then((data: v2.NotificationRuleResponse) => { console.log( "API called successfully. Returned data: " + JSON.stringify(data) ); }) .catch((error: any) => console.error(error)); ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=typescript) and then save the example to `example.ts` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" tsc "example.ts" {% /tab %}