Attributes of a suggested action for a security signal. The available fields depend on the action type.
name
string
The name of the investigation log query.
query_filter
string
The log query filter for the investigation.
template_variables
object
Template variables applied to the investigation log query, mapping attribute paths to values extracted from the signal.
<any-key>
[string]
title
string
The title of the recommended blog post.
url
string
The URL of the suggested action.
id [required]
string
The unique ID of the suggested action.
type [required]
enum
The type of the suggested action resource.
Allowed enum values: investigation_log_queries,recommended_blog_posts
{"data":[{"attributes":{"name":"Cloudtrail events for user ARN","query_filter":"source:cloudtrail @userIdentity.arn:\"foo\"","template_variables":{"<any-key>":[]},"title":"Monitor Okta logs to track system access and unusual activity","url":"/logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22"},"id":"w00-t10-992","type":"investigation_log_queries"}]}
Response with suggested actions for a security signal.
Expand All
Field
Type
Description
data [required]
[object]
List of suggested actions for a security signal.
attributes [required]
object
Attributes of a suggested action for a security signal. The available fields depend on the action type.
name
string
The name of the investigation log query.
query_filter
string
The log query filter for the investigation.
template_variables
object
Template variables applied to the investigation log query, mapping attribute paths to values extracted from the signal.
<any-key>
[string]
title
string
The title of the recommended blog post.
url
string
The URL of the suggested action.
id [required]
string
The unique ID of the suggested action.
type [required]
enum
The type of the suggested action resource.
Allowed enum values: investigation_log_queries,recommended_blog_posts
{"data":[{"attributes":{"name":"Cloudtrail events for user ARN","query_filter":"source:cloudtrail @userIdentity.arn:\"foo\"","template_variables":{"<any-key>":[]},"title":"Monitor Okta logs to track system access and unusual activity","url":"/logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22"},"id":"w00-t10-992","type":"investigation_log_queries"}]}
"""
Get suggested actions for a signal returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApiconfiguration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.get_suggested_actions_matching_signal(signal_id="AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",)print(response)
# Get suggested actions for a signal returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newpapi_instance.get_suggested_actions_matching_signal("AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE")
// Get suggested actions for a signal returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.GetSuggestedActionsMatchingSignal(ctx,"AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE")iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.GetSuggestedActionsMatchingSignal`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.GetSuggestedActionsMatchingSignal`:\n%s\n",responseContent)}
// Get suggested actions for a signal returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalSuggestedActionsResponse;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);try{SecurityMonitoringSignalSuggestedActionsResponseresult=apiInstance.getSuggestedActionsMatchingSignal("AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE");System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#getSuggestedActionsMatchingSignal");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
// Get suggested actions for a signal returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.get_suggested_actions_matching_signal("AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE".to_string(),).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get suggested actions for a signal returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiGetSuggestedActionsMatchingSignalRequest={signalId:"AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",};apiInstance.getSuggestedActionsMatchingSignal(params).then((data: v2.SecurityMonitoringSignalSuggestedActionsResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));