--- title: Get suppressions affecting future rule description: Datadog, the leading service for cloud-scale monitoring. breadcrumbs: Docs > API Reference > Security Monitoring --- # Get suppressions affecting future rule{% #get-suppressions-affecting-future-rule %} Copy pageCopied {% tab title="v2" %} | Datadog site | API endpoint | | ----------------- | ---------------------------------------------------------------------------------------------- | | ap1.datadoghq.com | POST https://api.ap1.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/rules | | ap2.datadoghq.com | POST https://api.ap2.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/rules | | app.datadoghq.eu | POST https://api.datadoghq.eu/api/v2/security_monitoring/configuration/suppressions/rules | | app.ddog-gov.com | POST https://api.ddog-gov.com/api/v2/security_monitoring/configuration/suppressions/rules | | us2.ddog-gov.com | POST https://api.us2.ddog-gov.com/api/v2/security_monitoring/configuration/suppressions/rules | | app.datadoghq.com | POST https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/rules | | us3.datadoghq.com | POST https://api.us3.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/rules | | us5.datadoghq.com | POST https://api.us5.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/rules | ### Overview Get the list of suppressions that would affect a rule. OAuth apps require the `security_monitoring_suppressions_read` authorization [scope](https://docs.datadoghq.com/api/latest/scopes.md#security-monitoring) to access this endpoint. ### Request #### Body Data (required) {% tab title="Model" %} | Parent field | Field | Type | Description | | ------------------------ | ----------------------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Option 1 | object | Create a new rule. | | Option 1 | calculatedFields | [object] | Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined. | | calculatedFields | expression [*required*] | string | Expression. | | calculatedFields | name [*required*] | string | Field name. | | Option 1 | cases [*required*] | [object] | Cases for generating signals. | | cases | actions | [object] | Action to perform for each rule case. | | actions | options | object | Options for the rule action | | options | duration | int64 | Duration of the action in seconds. 0 indicates no expiration. | | options | flaggedIPType | enum | Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. Allowed enum values: `SUSPICIOUS,FLAGGED` | | options | userBehaviorName | string | Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule. | | actions | type | enum | The action type. Allowed enum values: `block_ip,block_user,user_behavior,flag_ip` | | cases | condition | string | A case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated based on the event counts in the previously defined queries. | | cases | name | string | Name of the case. | | cases | notifications | [string] | Notification targets. | | cases | status [*required*] | enum | Severity of the Security Signal. Allowed enum values: `info,low,medium,high,critical` | | Option 1 | filters | [object] | Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. | | filters | action | enum | The type of filtering action. Allowed enum values: `require,suppress` | | filters | query | string | Query for selecting logs to apply the filtering action. | | Option 1 | groupSignalsBy | [string] | Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. | | Option 1 | hasExtendedTitle | boolean | Whether the notifications include the triggering group-by values in their title. | | Option 1 | isEnabled [*required*] | boolean | Whether the rule is enabled. | | Option 1 | message [*required*] | string | Message for generated signals. | | Option 1 | name [*required*] | string | The name of the rule. | | Option 1 | options [*required*] | object | Options. | | options | anomalyDetectionOptions | object | Options on anomaly detection method. | | anomalyDetectionOptions | bucketDuration | enum | Duration in seconds of the time buckets used to aggregate events matched by the rule. Must be greater than or equal to 300. Allowed enum values: `300,600,900,1800,3600,10800` | | anomalyDetectionOptions | detectionTolerance | enum | An optional parameter that sets how permissive anomaly detection is. Higher values require higher deviations before triggering a signal. Allowed enum values: `1,2,3,4,5` | | anomalyDetectionOptions | instantaneousBaseline | boolean | When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time. | | anomalyDetectionOptions | learningDuration | enum | Learning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating. Allowed enum values: `1,6,12,24,48,168,336` | | anomalyDetectionOptions | learningPeriodBaseline | int64 | An optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0. | | options | complianceRuleOptions | object | Options for cloud_configuration rules. Fields `resourceType` and `regoRule` are mandatory when managing custom `cloud_configuration` rules. | | complianceRuleOptions | complexRule | boolean | Whether the rule is a complex one. Must be set to true if `regoRule.resourceTypes` contains more than one item. Defaults to false. | | complianceRuleOptions | regoRule | object | Rule details. | | regoRule | policy [*required*] | string | The policy written in `rego`, see: [https://www.openpolicyagent.org/docs/latest/policy-language/](https://www.openpolicyagent.org/docs/latest/policy-language/) | | regoRule | resourceTypes [*required*] | [string] | List of resource types that will be evaluated upon. Must have at least one element. | | complianceRuleOptions | resourceType | string | Main resource type to be checked by the rule. It should be specified again in `regoRule.resourceTypes`. | | options | decreaseCriticalityBasedOnEnv | boolean | If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise. The severity is decreased by one level: `CRITICAL` in production becomes `HIGH` in non-production, `HIGH` becomes `MEDIUM` and so on. `INFO` remains `INFO`. The decrement is applied when the environment tag of the signal starts with `staging`, `test` or `dev`. | | options | detectionMethod | enum | The detection method. Allowed enum values: `threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection` | | options | evaluationWindow | enum | A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used. Allowed enum values: `0,60,300,600,900,1800,3600,7200,10800,21600` | | options | hardcodedEvaluatorType | enum | Hardcoded evaluator type. Allowed enum values: `log4shell` | | options | impossibleTravelOptions | object | Options on impossible travel detection method. | | impossibleTravelOptions | baselineUserLocations | boolean | If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access. | | impossibleTravelOptions | baselineUserLocationsDuration | int32 | The duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations. | | options | keepAlive | enum | Once a signal is generated, the signal will remain "open" if a case is matched at least once within this keep alive window. For third party detection method, this field is not used. Allowed enum values: `0,60,300,600,900,1800,3600,7200,10800,21600` | | options | maxSignalDuration | enum | A signal will "close" regardless of the query being matched once the time exceeds the maximum duration. This time is calculated from the first seen timestamp. Allowed enum values: `0,60,300,600,900,1800,3600,7200,10800,21600` | | options | newValueOptions | object | Options on new value detection method. | | newValueOptions | forgetAfter | int32 | The duration in days after which a learned value is forgotten. | | newValueOptions | instantaneousBaseline | boolean | When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time. | | newValueOptions | learningDuration | int32 | The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. | | newValueOptions | learningMethod | enum | The learning method used to determine when signals should be generated for values that weren't learned. Allowed enum values: `duration,threshold` | | newValueOptions | learningThreshold | enum | A number of occurrences after which signals will be generated for values that weren't learned. Allowed enum values: `0,1` | | options | sequenceDetectionOptions | object | Options on sequence detection method. | | sequenceDetectionOptions | stepTransitions | [object] | Transitions defining the allowed order of steps and their evaluation windows. | | stepTransitions | child | string | Name of the child step. | | stepTransitions | evaluationWindow | enum | A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used. Allowed enum values: `0,60,300,600,900,1800,3600,7200,10800,21600` | | stepTransitions | parent | string | Name of the parent step. | | sequenceDetectionOptions | steps | [object] | Steps that define the conditions to be matched in sequence. | | steps | condition | string | Condition referencing rule queries (e.g., `a > 0`). | | steps | evaluationWindow | enum | A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used. Allowed enum values: `0,60,300,600,900,1800,3600,7200,10800,21600` | | steps | name | string | Unique name identifying the step. | | options | thirdPartyRuleOptions | object | Options on third party detection method. | | thirdPartyRuleOptions | defaultNotifications | [string] | Notification targets for the logs that do not correspond to any of the cases. | | thirdPartyRuleOptions | defaultStatus | enum | Severity of the Security Signal. Allowed enum values: `info,low,medium,high,critical` | | thirdPartyRuleOptions | rootQueries | [object] | Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert. | | rootQueries | groupByFields | [string] | Fields to group by. | | rootQueries | query | string | Query to run on logs. | | thirdPartyRuleOptions | signalTitleTemplate | string | A template for the signal title; if omitted, the title is generated based on the case name. | | Option 1 | queries [*required*] | [object] | Queries for selecting logs which are part of the rule. | | queries | aggregation | enum | The aggregation type. Allowed enum values: `count,cardinality,sum,max,new_value,geo_data,event_count,none` | | queries | customQueryExtension | string | Query extension to append to the logs query. | | queries | dataSource | enum | Source of events, either logs, audit trail, security signals, or Datadog events. `app_sec_spans` is deprecated in favor of `spans`. Allowed enum values: `logs,audit,app_sec_spans,spans,security_runtime,network,events,security_signals` | | queries | distinctFields | [string] | Field for which the cardinality is measured. Sent as an array. | | queries | groupByFields | [string] | Fields to group by. | | queries | hasOptionalGroupByFields | boolean | When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values. | | queries | index | string | **This field is currently unstable and might be removed in a minor version upgrade.** The index to run the query on, if the `dataSource` is `logs`. Only used for scheduled rules - in other words, when the `schedulingOptions` field is present in the rule payload. | | queries | indexes | [string] | List of indexes to query when the `dataSource` is `logs`. Only used for scheduled rules, such as when the `schedulingOptions` field is present in the rule payload. | | queries | metric | string | **DEPRECATED**: (Deprecated) The target field to aggregate over when using the sum or max aggregations. `metrics` field should be used instead. | | queries | metrics | [string] | Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values. | | queries | name | string | Name of the query. | | queries | query | string | Query to run on logs. | | Option 1 | referenceTables | [object] | Reference tables for the rule. | | referenceTables | checkPresence | boolean | Whether to include or exclude the matched values. | | referenceTables | columnName | string | The name of the column in the reference table. | | referenceTables | logFieldPath | string | The field in the log to match against the reference table. | | referenceTables | ruleQueryName | string | The name of the query to apply the reference table to. | | referenceTables | tableName | string | The name of the reference table. | | Option 1 | schedulingOptions | object | Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs. | | schedulingOptions | rrule | string | Schedule for the rule queries, written in RRULE syntax. See [RFC](https://icalendar.org/iCalendar-RFC-5545/3-8-5-3-recurrence-rule.html) for syntax reference. | | schedulingOptions | start | string | Start date for the schedule, in ISO 8601 format without timezone. | | schedulingOptions | timezone | string | Time zone of the start date, in the [tz database](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) format. | | Option 1 | tags | [string] | Tags for generated signals. | | Option 1 | thirdPartyCases | [object] | Cases for generating signals from third-party rules. Only available for third-party rules. | | thirdPartyCases | name | string | Name of the case. | | thirdPartyCases | notifications | [string] | Notification targets for each case. | | thirdPartyCases | query | string | A query to map a third party event to this case. | | thirdPartyCases | status [*required*] | enum | Severity of the Security Signal. Allowed enum values: `info,low,medium,high,critical` | | Option 1 | type | enum | The rule type. Allowed enum values: `api_security,application_security,log_detection,workload_activity,workload_security` | | | Option 2 | object | Create a new signal correlation rule. | | Option 2 | cases [*required*] | [object] | Cases for generating signals. | | cases | actions | [object] | Action to perform for each rule case. | | actions | options | object | Options for the rule action | | options | duration | int64 | Duration of the action in seconds. 0 indicates no expiration. | | options | flaggedIPType | enum | Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. Allowed enum values: `SUSPICIOUS,FLAGGED` | | options | userBehaviorName | string | Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule. | | actions | type | enum | The action type. Allowed enum values: `block_ip,block_user,user_behavior,flag_ip` | | cases | condition | string | A case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated based on the event counts in the previously defined queries. | | cases | name | string | Name of the case. | | cases | notifications | [string] | Notification targets. | | cases | status [*required*] | enum | Severity of the Security Signal. Allowed enum values: `info,low,medium,high,critical` | | Option 2 | filters | [object] | Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. | | filters | action | enum | The type of filtering action. Allowed enum values: `require,suppress` | | filters | query | string | Query for selecting logs to apply the filtering action. | | Option 2 | hasExtendedTitle | boolean | Whether the notifications include the triggering group-by values in their title. | | Option 2 | isEnabled [*required*] | boolean | Whether the rule is enabled. | | Option 2 | message [*required*] | string | Message for generated signals. | | Option 2 | name [*required*] | string | The name of the rule. | | Option 2 | options [*required*] | object | Options. | | options | anomalyDetectionOptions | object | Options on anomaly detection method. | | anomalyDetectionOptions | bucketDuration | enum | Duration in seconds of the time buckets used to aggregate events matched by the rule. Must be greater than or equal to 300. Allowed enum values: `300,600,900,1800,3600,10800` | | anomalyDetectionOptions | detectionTolerance | enum | An optional parameter that sets how permissive anomaly detection is. Higher values require higher deviations before triggering a signal. Allowed enum values: `1,2,3,4,5` | | anomalyDetectionOptions | instantaneousBaseline | boolean | When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time. | | anomalyDetectionOptions | learningDuration | enum | Learning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating. Allowed enum values: `1,6,12,24,48,168,336` | | anomalyDetectionOptions | learningPeriodBaseline | int64 | An optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0. | | options | complianceRuleOptions | object | Options for cloud_configuration rules. Fields `resourceType` and `regoRule` are mandatory when managing custom `cloud_configuration` rules. | | complianceRuleOptions | complexRule | boolean | Whether the rule is a complex one. Must be set to true if `regoRule.resourceTypes` contains more than one item. Defaults to false. | | complianceRuleOptions | regoRule | object | Rule details. | | regoRule | policy [*required*] | string | The policy written in `rego`, see: [https://www.openpolicyagent.org/docs/latest/policy-language/](https://www.openpolicyagent.org/docs/latest/policy-language/) | | regoRule | resourceTypes [*required*] | [string] | List of resource types that will be evaluated upon. Must have at least one element. | | complianceRuleOptions | resourceType | string | Main resource type to be checked by the rule. It should be specified again in `regoRule.resourceTypes`. | | options | decreaseCriticalityBasedOnEnv | boolean | If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise. The severity is decreased by one level: `CRITICAL` in production becomes `HIGH` in non-production, `HIGH` becomes `MEDIUM` and so on. `INFO` remains `INFO`. The decrement is applied when the environment tag of the signal starts with `staging`, `test` or `dev`. | | options | detectionMethod | enum | The detection method. Allowed enum values: `threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection` | | options | evaluationWindow | enum | A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used. Allowed enum values: `0,60,300,600,900,1800,3600,7200,10800,21600` | | options | hardcodedEvaluatorType | enum | Hardcoded evaluator type. Allowed enum values: `log4shell` | | options | impossibleTravelOptions | object | Options on impossible travel detection method. | | impossibleTravelOptions | baselineUserLocations | boolean | If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access. | | impossibleTravelOptions | baselineUserLocationsDuration | int32 | The duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations. | | options | keepAlive | enum | Once a signal is generated, the signal will remain "open" if a case is matched at least once within this keep alive window. For third party detection method, this field is not used. Allowed enum values: `0,60,300,600,900,1800,3600,7200,10800,21600` | | options | maxSignalDuration | enum | A signal will "close" regardless of the query being matched once the time exceeds the maximum duration. This time is calculated from the first seen timestamp. Allowed enum values: `0,60,300,600,900,1800,3600,7200,10800,21600` | | options | newValueOptions | object | Options on new value detection method. | | newValueOptions | forgetAfter | int32 | The duration in days after which a learned value is forgotten. | | newValueOptions | instantaneousBaseline | boolean | When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time. | | newValueOptions | learningDuration | int32 | The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. | | newValueOptions | learningMethod | enum | The learning method used to determine when signals should be generated for values that weren't learned. Allowed enum values: `duration,threshold` | | newValueOptions | learningThreshold | enum | A number of occurrences after which signals will be generated for values that weren't learned. Allowed enum values: `0,1` | | options | sequenceDetectionOptions | object | Options on sequence detection method. | | sequenceDetectionOptions | stepTransitions | [object] | Transitions defining the allowed order of steps and their evaluation windows. | | stepTransitions | child | string | Name of the child step. | | stepTransitions | evaluationWindow | enum | A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used. Allowed enum values: `0,60,300,600,900,1800,3600,7200,10800,21600` | | stepTransitions | parent | string | Name of the parent step. | | sequenceDetectionOptions | steps | [object] | Steps that define the conditions to be matched in sequence. | | steps | condition | string | Condition referencing rule queries (e.g., `a > 0`). | | steps | evaluationWindow | enum | A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used. Allowed enum values: `0,60,300,600,900,1800,3600,7200,10800,21600` | | steps | name | string | Unique name identifying the step. | | options | thirdPartyRuleOptions | object | Options on third party detection method. | | thirdPartyRuleOptions | defaultNotifications | [string] | Notification targets for the logs that do not correspond to any of the cases. | | thirdPartyRuleOptions | defaultStatus | enum | Severity of the Security Signal. Allowed enum values: `info,low,medium,high,critical` | | thirdPartyRuleOptions | rootQueries | [object] | Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert. | | rootQueries | groupByFields | [string] | Fields to group by. | | rootQueries | query | string | Query to run on logs. | | thirdPartyRuleOptions | signalTitleTemplate | string | A template for the signal title; if omitted, the title is generated based on the case name. | | Option 2 | queries [*required*] | [object] | Queries for selecting signals which are part of the rule. | | queries | aggregation | enum | The aggregation type. Allowed enum values: `count,cardinality,sum,max,new_value,geo_data,event_count,none` | | queries | correlatedByFields | [string] | Fields to group by. | | queries | correlatedQueryIndex | int32 | Index of the rule query used to retrieve the correlated field. | | queries | metrics | [string] | Group of target fields to aggregate over. | | queries | name | string | Name of the query. | | queries | ruleId [*required*] | string | Rule ID to match on signals. | | Option 2 | tags | [string] | Tags for generated signals. | | Option 2 | type | enum | The rule type. Allowed enum values: `signal_correlation` | | | Option 3 | object | Create a new cloud configuration rule. | | Option 3 | cases [*required*] | [object] | Description of generated findings and signals (severity and channels to be notified in case of a signal). Must contain exactly one item. | | cases | notifications | [string] | Notification targets for each rule case. | | cases | status [*required*] | enum | Severity of the Security Signal. Allowed enum values: `info,low,medium,high,critical` | | Option 3 | complianceSignalOptions [*required*] | object | How to generate compliance signals. Useful for cloud_configuration rules only. | | complianceSignalOptions | defaultActivationStatus | boolean | The default activation status. | | complianceSignalOptions | defaultGroupByFields | [string] | The default group by fields. | | complianceSignalOptions | userActivationStatus | boolean | Whether signals will be sent. | | complianceSignalOptions | userGroupByFields | [string] | Fields to use to group findings by when sending signals. | | Option 3 | filters | [object] | Additional queries to filter matched events before they are processed. | | filters | action | enum | The type of filtering action. Allowed enum values: `require,suppress` | | filters | query | string | Query for selecting logs to apply the filtering action. | | Option 3 | isEnabled [*required*] | boolean | Whether the rule is enabled. | | Option 3 | message [*required*] | string | Message in markdown format for generated findings and signals. | | Option 3 | name [*required*] | string | The name of the rule. | | Option 3 | options [*required*] | object | Options on cloud configuration rules. | | options | complianceRuleOptions [*required*] | object | Options for cloud_configuration rules. Fields `resourceType` and `regoRule` are mandatory when managing custom `cloud_configuration` rules. | | complianceRuleOptions | complexRule | boolean | Whether the rule is a complex one. Must be set to true if `regoRule.resourceTypes` contains more than one item. Defaults to false. | | complianceRuleOptions | regoRule | object | Rule details. | | regoRule | policy [*required*] | string | The policy written in `rego`, see: [https://www.openpolicyagent.org/docs/latest/policy-language/](https://www.openpolicyagent.org/docs/latest/policy-language/) | | regoRule | resourceTypes [*required*] | [string] | List of resource types that will be evaluated upon. Must have at least one element. | | complianceRuleOptions | resourceType | string | Main resource type to be checked by the rule. It should be specified again in `regoRule.resourceTypes`. | | Option 3 | tags | [string] | Tags for generated findings and signals. | | Option 3 | type | enum | The rule type. Allowed enum values: `cloud_configuration` | {% /tab %} {% tab title="Example" %} ```json { "name": "Example-Security-Monitoring", "queries": [ { "query": "@test:true", "aggregation": "count", "groupByFields": [], "distinctFields": [], "metrics": [] } ], "filters": [], "cases": [ { "name": "", "status": "info", "condition": "a > 0", "notifications": [] } ], "options": { "evaluationWindow": 900, "keepAlive": 3600, "maxSignalDuration": 86400 }, "message": "Test rule", "tags": [], "isEnabled": true, "type": "log_detection" } ``` {% /tab %} ### Response {% tab title="200" %} OK {% tab title="Model" %} Response object containing the available suppression rules. | Parent field | Field | Type | Description | | ------------ | -------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | data | [object] | A list of suppressions objects. | | data | attributes | object | The attributes of the suppression rule. | | attributes | creation_date | int64 | A Unix millisecond timestamp given the creation date of the suppression rule. | | attributes | creator | object | A user. | | creator | handle | string | The handle of the user. | | creator | name | string | The name of the user. | | attributes | data_exclusion_query | string | An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule. | | attributes | description | string | A description for the suppression rule. | | attributes | editable | boolean | Whether the suppression rule is editable. | | attributes | enabled | boolean | Whether the suppression rule is enabled. | | attributes | expiration_date | int64 | A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore. | | attributes | name | string | The name of the suppression rule. | | attributes | rule_query | string | The rule query of the suppression rule, with the same syntax as the search bar for detection rules. | | attributes | start_date | int64 | A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals. | | attributes | suppression_query | string | The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer. | | attributes | tags | [string] | List of tags associated with the suppression rule. | | attributes | update_date | int64 | A Unix millisecond timestamp given the update date of the suppression rule. | | attributes | updater | object | A user. | | updater | handle | string | The handle of the user. | | updater | name | string | The name of the user. | | attributes | version | int32 | The version of the suppression rule; it starts at 1, and is incremented at each update. | | data | id | string | The ID of the suppression rule. | | data | type | enum | The type of the resource. The value should always be `suppressions`. Allowed enum values: `suppressions` | {% /tab %} {% tab title="Example" %} ```json { "data": [ { "attributes": { "creation_date": "integer", "creator": { "handle": "john.doe@datadoghq.com", "name": "John Doe" }, "data_exclusion_query": "source:cloudtrail account_id:12345", "description": "This rule suppresses low-severity signals in staging environments.", "editable": true, "enabled": true, "expiration_date": 1703187336000, "name": "Custom suppression", "rule_query": "type:log_detection source:cloudtrail", "start_date": 1703187336000, "suppression_query": "env:staging status:low", "tags": [ "technique:T1110-brute-force", "source:cloudtrail" ], "update_date": "integer", "updater": { "handle": "john.doe@datadoghq.com", "name": "John Doe" }, "version": 42 }, "id": "3dd-0uc-h1s", "type": "suppressions" } ] } ``` {% /tab %} {% /tab %} {% tab title="400" %} Bad Request {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} {% tab title="403" %} Not Authorized {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} {% tab title="429" %} Too many requests {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} ### Code Example ##### \## default # \# Curl command curl -X POST "https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/rules" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "DD-API-KEY: ${DD_API_KEY}" \ -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \ -d @- << EOF { "calculatedFields": [ { "expression": "@request_end_timestamp - @request_start_timestamp", "name": "response_time" } ], "cases": [], "filters": [ { "action": "require" } ], "groupSignalsBy": [ "service" ], "hasExtendedTitle": true, "isEnabled": true, "message": "", "name": "My security monitoring rule.", "options": { "anomalyDetectionOptions": { "bucketDuration": 300, "detectionTolerance": 5, "instantaneousBaseline": false }, "complianceRuleOptions": { "regoRule": { "policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}", "resourceTypes": [ "gcp_iam_service_account", "gcp_iam_policy" ] }, "resourceType": "aws_acm" }, "decreaseCriticalityBasedOnEnv": false, "detectionMethod": "threshold", "hardcodedEvaluatorType": "log4shell", "impossibleTravelOptions": { "baselineUserLocations": true, "baselineUserLocationsDuration": 7 }, "newValueOptions": { "instantaneousBaseline": false, "learningMethod": "duration" }, "thirdPartyRuleOptions": { "defaultStatus": "critical", "rootQueries": [ { "query": "source:cloudtrail" } ] } }, "queries": [], "schedulingOptions": { "rrule": "FREQ=HOURLY;INTERVAL=1;", "start": "2025-07-14T12:00:00", "timezone": "America/New_York" }, "tags": [ "env:prod", "team:security" ], "thirdPartyCases": [], "type": "api_security" } EOF ##### ```go // Get suppressions affecting future rule returns "OK" response package main import ( "context" "encoding/json" "fmt" "os" "github.com/DataDog/datadog-api-client-go/v2/api/datadog" "github.com/DataDog/datadog-api-client-go/v2/api/datadogV2" ) func main() { body := datadogV2.SecurityMonitoringRuleCreatePayload{ SecurityMonitoringStandardRuleCreatePayload: &datadogV2.SecurityMonitoringStandardRuleCreatePayload{ Name: "Example-Security-Monitoring", Queries: []datadogV2.SecurityMonitoringStandardRuleQuery{ { Query: datadog.PtrString("@test:true"), Aggregation: datadogV2.SECURITYMONITORINGRULEQUERYAGGREGATION_COUNT.Ptr(), GroupByFields: []string{}, DistinctFields: []string{}, Metrics: []string{}, }, }, Filters: []datadogV2.SecurityMonitoringFilter{}, Cases: []datadogV2.SecurityMonitoringRuleCaseCreate{ { Name: datadog.PtrString(""), Status: datadogV2.SECURITYMONITORINGRULESEVERITY_INFO, Condition: datadog.PtrString("a > 0"), Notifications: []string{}, }, }, Options: datadogV2.SecurityMonitoringRuleOptions{ EvaluationWindow: datadogV2.SECURITYMONITORINGRULEEVALUATIONWINDOW_FIFTEEN_MINUTES.Ptr(), KeepAlive: datadogV2.SECURITYMONITORINGRULEKEEPALIVE_ONE_HOUR.Ptr(), MaxSignalDuration: datadogV2.SECURITYMONITORINGRULEMAXSIGNALDURATION_ONE_DAY.Ptr(), }, Message: "Test rule", Tags: []string{}, IsEnabled: true, Type: datadogV2.SECURITYMONITORINGRULETYPECREATE_LOG_DETECTION.Ptr(), }} ctx := datadog.NewDefaultContext(context.Background()) configuration := datadog.NewConfiguration() apiClient := datadog.NewAPIClient(configuration) api := datadogV2.NewSecurityMonitoringApi(apiClient) resp, r, err := api.GetSuppressionsAffectingFutureRule(ctx, body) if err != nil { fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.GetSuppressionsAffectingFutureRule`: %v\n", err) fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) } responseContent, _ := json.MarshalIndent(resp, "", " ") fmt.Fprintf(os.Stdout, "Response from `SecurityMonitoringApi.GetSuppressionsAffectingFutureRule`:\n%s\n", responseContent) } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=go) and then save the example to `main.go` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" go run "main.go" ##### ```java // Get suppressions affecting future rule returns "OK" response import com.datadog.api.client.ApiClient; import com.datadog.api.client.ApiException; import com.datadog.api.client.v2.api.SecurityMonitoringApi; import com.datadog.api.client.v2.model.SecurityMonitoringRuleCaseCreate; import com.datadog.api.client.v2.model.SecurityMonitoringRuleCreatePayload; import com.datadog.api.client.v2.model.SecurityMonitoringRuleEvaluationWindow; import com.datadog.api.client.v2.model.SecurityMonitoringRuleKeepAlive; import com.datadog.api.client.v2.model.SecurityMonitoringRuleMaxSignalDuration; import com.datadog.api.client.v2.model.SecurityMonitoringRuleOptions; import com.datadog.api.client.v2.model.SecurityMonitoringRuleQueryAggregation; import com.datadog.api.client.v2.model.SecurityMonitoringRuleSeverity; import com.datadog.api.client.v2.model.SecurityMonitoringRuleTypeCreate; import com.datadog.api.client.v2.model.SecurityMonitoringStandardRuleCreatePayload; import com.datadog.api.client.v2.model.SecurityMonitoringStandardRuleQuery; import com.datadog.api.client.v2.model.SecurityMonitoringSuppressionsResponse; import java.util.Collections; public class Example { public static void main(String[] args) { ApiClient defaultClient = ApiClient.getDefaultApiClient(); SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient); SecurityMonitoringRuleCreatePayload body = new SecurityMonitoringRuleCreatePayload( new SecurityMonitoringStandardRuleCreatePayload() .name("Example-Security-Monitoring") .queries( Collections.singletonList( new SecurityMonitoringStandardRuleQuery() .query("@test:true") .aggregation(SecurityMonitoringRuleQueryAggregation.COUNT))) .cases( Collections.singletonList( new SecurityMonitoringRuleCaseCreate() .name("") .status(SecurityMonitoringRuleSeverity.INFO) .condition("a > 0"))) .options( new SecurityMonitoringRuleOptions() .evaluationWindow(SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES) .keepAlive(SecurityMonitoringRuleKeepAlive.ONE_HOUR) .maxSignalDuration(SecurityMonitoringRuleMaxSignalDuration.ONE_DAY)) .message("Test rule") .isEnabled(true) .type(SecurityMonitoringRuleTypeCreate.LOG_DETECTION)); try { SecurityMonitoringSuppressionsResponse result = apiInstance.getSuppressionsAffectingFutureRule(body); System.out.println(result); } catch (ApiException e) { System.err.println( "Exception when calling SecurityMonitoringApi#getSuppressionsAffectingFutureRule"); System.err.println("Status code: " + e.getCode()); System.err.println("Reason: " + e.getResponseBody()); System.err.println("Response headers: " + e.getResponseHeaders()); e.printStackTrace(); } } } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=java) and then save the example to `Example.java` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" java "Example.java" ##### ```python """ Get suppressions affecting future rule returns "OK" response """ from datadog_api_client import ApiClient, Configuration from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi from datadog_api_client.v2.model.security_monitoring_rule_case_create import SecurityMonitoringRuleCaseCreate from datadog_api_client.v2.model.security_monitoring_rule_evaluation_window import ( SecurityMonitoringRuleEvaluationWindow, ) from datadog_api_client.v2.model.security_monitoring_rule_keep_alive import SecurityMonitoringRuleKeepAlive from datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration import ( SecurityMonitoringRuleMaxSignalDuration, ) from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions from datadog_api_client.v2.model.security_monitoring_rule_query_aggregation import ( SecurityMonitoringRuleQueryAggregation, ) from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity from datadog_api_client.v2.model.security_monitoring_rule_type_create import SecurityMonitoringRuleTypeCreate from datadog_api_client.v2.model.security_monitoring_standard_rule_create_payload import ( SecurityMonitoringStandardRuleCreatePayload, ) from datadog_api_client.v2.model.security_monitoring_standard_rule_query import SecurityMonitoringStandardRuleQuery body = SecurityMonitoringStandardRuleCreatePayload( name="Example-Security-Monitoring", queries=[ SecurityMonitoringStandardRuleQuery( query="@test:true", aggregation=SecurityMonitoringRuleQueryAggregation.COUNT, group_by_fields=[], distinct_fields=[], metrics=[], ), ], filters=[], cases=[ SecurityMonitoringRuleCaseCreate( name="", status=SecurityMonitoringRuleSeverity.INFO, condition="a > 0", notifications=[], ), ], options=SecurityMonitoringRuleOptions( evaluation_window=SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES, keep_alive=SecurityMonitoringRuleKeepAlive.ONE_HOUR, max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.ONE_DAY, ), message="Test rule", tags=[], is_enabled=True, type=SecurityMonitoringRuleTypeCreate.LOG_DETECTION, ) configuration = Configuration() with ApiClient(configuration) as api_client: api_instance = SecurityMonitoringApi(api_client) response = api_instance.get_suppressions_affecting_future_rule(body=body) print(response) ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=python) and then save the example to `example.py` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" python3 "example.py" ##### ```ruby # Get suppressions affecting future rule returns "OK" response require "datadog_api_client" api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new body = DatadogAPIClient::V2::SecurityMonitoringStandardRuleCreatePayload.new({ name: "Example-Security-Monitoring", queries: [ DatadogAPIClient::V2::SecurityMonitoringStandardRuleQuery.new({ query: "@test:true", aggregation: DatadogAPIClient::V2::SecurityMonitoringRuleQueryAggregation::COUNT, group_by_fields: [], distinct_fields: [], metrics: [], }), ], filters: [], cases: [ DatadogAPIClient::V2::SecurityMonitoringRuleCaseCreate.new({ name: "", status: DatadogAPIClient::V2::SecurityMonitoringRuleSeverity::INFO, condition: "a > 0", notifications: [], }), ], options: DatadogAPIClient::V2::SecurityMonitoringRuleOptions.new({ evaluation_window: DatadogAPIClient::V2::SecurityMonitoringRuleEvaluationWindow::FIFTEEN_MINUTES, keep_alive: DatadogAPIClient::V2::SecurityMonitoringRuleKeepAlive::ONE_HOUR, max_signal_duration: DatadogAPIClient::V2::SecurityMonitoringRuleMaxSignalDuration::ONE_DAY, }), message: "Test rule", tags: [], is_enabled: true, type: DatadogAPIClient::V2::SecurityMonitoringRuleTypeCreate::LOG_DETECTION, }) p api_instance.get_suppressions_affecting_future_rule(body) ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=ruby) and then save the example to `example.rb` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" rb "example.rb" ##### ```rust // Get suppressions affecting future rule returns "OK" response use datadog_api_client::datadog; use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI; use datadog_api_client::datadogV2::model::SecurityMonitoringRuleCaseCreate; use datadog_api_client::datadogV2::model::SecurityMonitoringRuleCreatePayload; use datadog_api_client::datadogV2::model::SecurityMonitoringRuleEvaluationWindow; use datadog_api_client::datadogV2::model::SecurityMonitoringRuleKeepAlive; use datadog_api_client::datadogV2::model::SecurityMonitoringRuleMaxSignalDuration; use datadog_api_client::datadogV2::model::SecurityMonitoringRuleOptions; use datadog_api_client::datadogV2::model::SecurityMonitoringRuleQueryAggregation; use datadog_api_client::datadogV2::model::SecurityMonitoringRuleSeverity; use datadog_api_client::datadogV2::model::SecurityMonitoringRuleTypeCreate; use datadog_api_client::datadogV2::model::SecurityMonitoringStandardRuleCreatePayload; use datadog_api_client::datadogV2::model::SecurityMonitoringStandardRuleQuery; #[tokio::main] async fn main() { let body = SecurityMonitoringRuleCreatePayload::SecurityMonitoringStandardRuleCreatePayload(Box::new( SecurityMonitoringStandardRuleCreatePayload::new( vec![ SecurityMonitoringRuleCaseCreate::new(SecurityMonitoringRuleSeverity::INFO) .condition("a > 0".to_string()) .name("".to_string()) .notifications(vec![]), ], true, "Test rule".to_string(), "Example-Security-Monitoring".to_string(), SecurityMonitoringRuleOptions::new() .evaluation_window(SecurityMonitoringRuleEvaluationWindow::FIFTEEN_MINUTES) .keep_alive(SecurityMonitoringRuleKeepAlive::ONE_HOUR) .max_signal_duration(SecurityMonitoringRuleMaxSignalDuration::ONE_DAY), vec![SecurityMonitoringStandardRuleQuery::new() .aggregation(SecurityMonitoringRuleQueryAggregation::COUNT) .distinct_fields(vec![]) .group_by_fields(vec![]) .metrics(vec![]) .query("@test:true".to_string())], ) .filters(vec![]) .tags(vec![]) .type_(SecurityMonitoringRuleTypeCreate::LOG_DETECTION), )); let configuration = datadog::Configuration::new(); let api = SecurityMonitoringAPI::with_config(configuration); let resp = api.get_suppressions_affecting_future_rule(body).await; if let Ok(value) = resp { println!("{:#?}", value); } else { println!("{:#?}", resp.unwrap_err()); } } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=rust) and then save the example to `src/main.rs` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" cargo run ##### ```typescript /** * Get suppressions affecting future rule returns "OK" response */ import { client, v2 } from "@datadog/datadog-api-client"; const configuration = client.createConfiguration(); const apiInstance = new v2.SecurityMonitoringApi(configuration); const params: v2.SecurityMonitoringApiGetSuppressionsAffectingFutureRuleRequest = { body: { name: "Example-Security-Monitoring", queries: [ { query: "@test:true", aggregation: "count", groupByFields: [], distinctFields: [], metrics: [], }, ], filters: [], cases: [ { name: "", status: "info", condition: "a > 0", notifications: [], }, ], options: { evaluationWindow: 900, keepAlive: 3600, maxSignalDuration: 86400, }, message: "Test rule", tags: [], isEnabled: true, type: "log_detection", }, }; apiInstance .getSuppressionsAffectingFutureRule(params) .then((data: v2.SecurityMonitoringSuppressionsResponse) => { console.log( "API called successfully. Returned data: " + JSON.stringify(data) ); }) .catch((error: any) => console.error(error)); ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=typescript) and then save the example to `example.ts` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" tsc "example.ts" {% /tab %}