--- title: Import security vulnerabilities description: Datadog, the leading service for cloud-scale monitoring. breadcrumbs: Docs > API Reference > Security Monitoring --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Import security vulnerabilities{% #import-security-vulnerabilities %} Copy pageCopied {% tab title="v2" %} **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). | Datadog site | API endpoint | | ----------------- | ------------------------------------------------------------------ | | ap1.datadoghq.com | POST https://api.ap1.datadoghq.com/api/v2/security/vulnerabilities | | ap2.datadoghq.com | POST https://api.ap2.datadoghq.com/api/v2/security/vulnerabilities | | app.datadoghq.eu | POST https://api.datadoghq.eu/api/v2/security/vulnerabilities | | app.ddog-gov.com | POST https://api.ddog-gov.com/api/v2/security/vulnerabilities | | us2.ddog-gov.com | POST https://api.us2.ddog-gov.com/api/v2/security/vulnerabilities | | uk1.datadoghq.com | POST https://api.uk1.datadoghq.com/api/v2/security/vulnerabilities | | app.datadoghq.com | POST https://api.datadoghq.com/api/v2/security/vulnerabilities | | us3.datadoghq.com | POST https://api.us3.datadoghq.com/api/v2/security/vulnerabilities | | us5.datadoghq.com | POST https://api.us5.datadoghq.com/api/v2/security/vulnerabilities | ### Overview Import security vulnerabilities from an external scanner in CycloneDX 1.5 format. The payload is validated against the CycloneDX 1.5 JSON schema and the following additional constraints: - `metadata`, `metadata.component`, and `metadata.component.name` are required. - `metadata.tools.components` must contain exactly one element with a `name` field. - `components` cannot be empty. Each component requires `bom-ref`, `type`, `name`, and `version`. - When `type` is `library`, `purl` is required and must be a valid PURL. - When `type` is `operating-system`, `name` must be one of the supported OS values: `alma`, `alpine`, `amazon`, `azurelinux`, `bottlerocket`, `cbl-mariner`, `chainguard`, `centos`, `debian`, `fedora`, `opensuse`, `opensuse-leap`, `opensuse-tumbleweed`, `oracle`, `photon`, `redhat`, `rocky`, `slem`, `sles`, `ubuntu`, `wolfi`, `windows`, `macos`. - `vulnerabilities` cannot be empty. Each vulnerability requires `id`, exactly one `ratings` entry, and at least one `affects` entry. - Each `affects[].ref` must match a `bom-ref` value in `components`. This endpoint requires the `security_monitoring_findings_write` permission. OAuth apps require the `security_monitoring_findings_write` authorization [scope](https://docs.datadoghq.com/api/latest/scopes.md#security-monitoring) to access this endpoint. ### Request #### Body Data (required) {% tab title="Model" %} | Parent field | Field | Type | Description | | --------------- | --------------------------------- | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | bomFormat [*required*] | string | The BOM format identifier. Must be `CycloneDX`. | | | components [*required*] | [object] | The list of scanned software components. Cannot be empty. | | components | bom-ref [*required*] | string | A unique reference identifier used to link vulnerabilities to this component. | | components | name [*required*] | string | The name of the component. | | components | purl | string | The Package URL (PURL) of the component. Required when `type` is `library`. | | components | type [*required*] | enum | The type of the scanned component. Allowed enum values: `library,application,operating-system` | | components | version [*required*] | string | The version of the component. | | | metadata [*required*] | object | Metadata about the BOM, including the scanned asset and the scanner tool. | | metadata | component [*required*] | object | The asset that was scanned (for example, a host or container image). | | component | bom-ref | string | A unique reference identifier for this metadata component. If set, must match a `bom-ref` in `components`. | | component | name [*required*] | string | The name or identifier of the scanned asset (for example, an instance ID or hostname). | | component | type | string | The type of the scanned asset. | | metadata | tools [*required*] | object | Information about the scanner tool that produced this BOM. | | tools | components [*required*] | [object] | The scanner tool components. Must contain exactly one element. | | components | name [*required*] | string | The name of the scanner tool. | | components | type | string | The type of the tool component. | | | specVersion [*required*] | string | The CycloneDX specification version. Must be `1.5`. | | | version | int64 | The version number of the BOM document. | | | vulnerabilities [*required*] | [object] | The list of detected vulnerabilities. Cannot be empty. | | vulnerabilities | advisories | [object] | External advisory references for the vulnerability. | | advisories | url | string | The URL of the advisory. | | vulnerabilities | affects [*required*] | [object] | The components affected by this vulnerability. Must be non-empty. Each `ref` must match a `bom-ref` in `components`. | | affects | ref [*required*] | string | The `bom-ref` of the affected component. | | vulnerabilities | analysis | object | The exploitability analysis for the vulnerability. When `state` is set to `resolved` or `resolved_with_pedigree`, the vulnerability is closed in Datadog. Other state values are accepted but have no effect on the vulnerability status. | | analysis | state | string | The vulnerability analysis state. | | vulnerabilities | cwes | [integer] | CWE identifiers associated with the vulnerability. | | vulnerabilities | description | string | A short description of the vulnerability. | | vulnerabilities | detail | string | Detailed information about the vulnerability. | | vulnerabilities | id [*required*] | string | The vulnerability identifier (for example, a CVE ID). | | vulnerabilities | ratings [*required*] | [object] | The severity ratings for the vulnerability. Must contain exactly one element. | | ratings | score | double | The CVSS score. | | ratings | severity | string | The severity level. | | ratings | vector | string | The CVSS vector string. | | vulnerabilities | references | [object] | External reference identifiers for the vulnerability. | | references | id | string | The identifier of the external reference (for example, a GHSA ID). | | references | source | object | The source of an external vulnerability reference. | | source | url | string | The URL of the reference source. | {% /tab %} {% tab title="Example" %} ```json { "bomFormat": "CycloneDX", "components": [ { "bom-ref": "a3390fca-c315-41ae-ae05-af5e7859cdee", "name": "lodash", "purl": "pkg:npm/lodash@4.17.21", "type": "library", "version": "4.17.21" } ], "metadata": { "component": { "bom-ref": "host-ref-abc123", "name": "i-12345", "type": "operating-system" }, "tools": { "components": [ { "name": "my-scanner", "type": "application" } ] } }, "specVersion": "1.5", "version": 1, "vulnerabilities": [ { "advisories": [ { "url": "https://example.com/advisory/CVE-2021-1234" } ], "affects": [ { "ref": "a3390fca-c315-41ae-ae05-af5e7859cdee" } ], "analysis": { "state": "resolved" }, "cwes": [ 123, 345 ], "description": "Sample vulnerability detected in the application.", "detail": "Details about the vulnerability.", "id": "CVE-2021-1234", "ratings": [ { "score": 9, "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N" } ], "references": [ { "id": "GHSA-35m5-8cvj-8783", "source": { "url": "https://example.com" } } ] } ] } ``` {% /tab %} ### Response {% tab title="200" %} Vulnerabilities accepted successfully. {% /tab %} {% tab title="400" %} Bad Request {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} {% tab title="403" %} Forbidden {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} {% tab title="429" %} Too many requests {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} {% tab title="500" %} Internal Server Error {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} ### Code Example ##### \## default # \# Curl command curl -X POST "https://api.datadoghq.com/api/v2/security/vulnerabilities" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "DD-API-KEY: ${DD_API_KEY}" \ -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \ -d @- << EOF { "bomFormat": "CycloneDX", "components": [ { "bom-ref": "a3390fca-c315-41ae-ae05-af5e7859cdee", "name": "lodash", "purl": "pkg:npm/lodash@4.17.21", "type": "library", "version": "4.17.21" } ], "metadata": { "component": { "name": "i-12345", "type": "operating-system" }, "tools": { "components": [ { "name": "my-scanner", "type": "application" } ] } }, "specVersion": "1.5", "version": 1, "vulnerabilities": [ { "affects": [ { "ref": "a3390fca-c315-41ae-ae05-af5e7859cdee" } ], "description": "Sample vulnerability detected in the application.", "id": "CVE-2021-1234", "ratings": [ { "score": 9, "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N" } ] } ] } EOF ##### ```python """ Import security vulnerabilities returns "Vulnerabilities accepted successfully." response """ from datadog_api_client import ApiClient, Configuration from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi from datadog_api_client.v2.model.cyclone_dx_bom import CycloneDXBom from datadog_api_client.v2.model.cyclone_dx_component import CycloneDXComponent from datadog_api_client.v2.model.cyclone_dx_component_type import CycloneDXComponentType from datadog_api_client.v2.model.cyclone_dx_metadata import CycloneDXMetadata from datadog_api_client.v2.model.cyclone_dx_metadata_component import CycloneDXMetadataComponent from datadog_api_client.v2.model.cyclone_dx_metadata_tools import CycloneDXMetadataTools from datadog_api_client.v2.model.cyclone_dx_tool_component import CycloneDXToolComponent from datadog_api_client.v2.model.cyclone_dx_vulnerability import CycloneDXVulnerability from datadog_api_client.v2.model.cyclone_dx_vulnerability_advisory import CycloneDXVulnerabilityAdvisory from datadog_api_client.v2.model.cyclone_dx_vulnerability_affects import CycloneDXVulnerabilityAffects from datadog_api_client.v2.model.cyclone_dx_vulnerability_analysis import CycloneDXVulnerabilityAnalysis from datadog_api_client.v2.model.cyclone_dx_vulnerability_rating import CycloneDXVulnerabilityRating from datadog_api_client.v2.model.cyclone_dx_vulnerability_reference import CycloneDXVulnerabilityReference from datadog_api_client.v2.model.cyclone_dx_vulnerability_reference_source import CycloneDXVulnerabilityReferenceSource body = CycloneDXBom( bom_format="CycloneDX", components=[ CycloneDXComponent( bom_ref="a3390fca-c315-41ae-ae05-af5e7859cdee", name="lodash", purl="pkg:npm/lodash@4.17.21", type=CycloneDXComponentType.LIBRARY, version="4.17.21", ), ], metadata=CycloneDXMetadata( component=CycloneDXMetadataComponent( bom_ref="host-ref-abc123", name="i-12345", type="operating-system", ), tools=CycloneDXMetadataTools( components=[ CycloneDXToolComponent( name="my-scanner", type="application", ), ], ), ), spec_version="1.5", version=1, vulnerabilities=[ CycloneDXVulnerability( advisories=[ CycloneDXVulnerabilityAdvisory( url="https://example.com/advisory/CVE-2021-1234", ), ], affects=[ CycloneDXVulnerabilityAffects( ref="a3390fca-c315-41ae-ae05-af5e7859cdee", ), ], analysis=CycloneDXVulnerabilityAnalysis( state="resolved", ), cwes=[ 123, 345, ], description="Sample vulnerability detected in the application.", detail="Details about the vulnerability.", id="CVE-2021-1234", ratings=[ CycloneDXVulnerabilityRating( score=9.0, severity="high", vector="CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", ), ], references=[ CycloneDXVulnerabilityReference( id="GHSA-35m5-8cvj-8783", source=CycloneDXVulnerabilityReferenceSource( url="https://example.com", ), ), ], ), ], ) configuration = Configuration() configuration.unstable_operations["import_security_vulnerabilities"] = True with ApiClient(configuration) as api_client: api_instance = SecurityMonitoringApi(api_client) api_instance.import_security_vulnerabilities(body=body) ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=python) and then save the example to `example.py` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" python3 "example.py" ##### ```ruby # Import security vulnerabilities returns "Vulnerabilities accepted successfully." response require "datadog_api_client" DatadogAPIClient.configure do |config| config.unstable_operations["v2.import_security_vulnerabilities".to_sym] = true end api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new body = DatadogAPIClient::V2::CycloneDXBom.new({ bom_format: "CycloneDX", components: [ DatadogAPIClient::V2::CycloneDXComponent.new({ bom_ref: "a3390fca-c315-41ae-ae05-af5e7859cdee", name: "lodash", purl: "pkg:npm/lodash@4.17.21", type: DatadogAPIClient::V2::CycloneDXComponentType::LIBRARY, version: "4.17.21", }), ], metadata: DatadogAPIClient::V2::CycloneDXMetadata.new({ component: DatadogAPIClient::V2::CycloneDXMetadataComponent.new({ bom_ref: "host-ref-abc123", name: "i-12345", type: "operating-system", }), tools: DatadogAPIClient::V2::CycloneDXMetadataTools.new({ components: [ DatadogAPIClient::V2::CycloneDXToolComponent.new({ name: "my-scanner", type: "application", }), ], }), }), spec_version: "1.5", version: 1, vulnerabilities: [ DatadogAPIClient::V2::CycloneDXVulnerability.new({ advisories: [ DatadogAPIClient::V2::CycloneDXVulnerabilityAdvisory.new({ url: "https://example.com/advisory/CVE-2021-1234", }), ], affects: [ DatadogAPIClient::V2::CycloneDXVulnerabilityAffects.new({ ref: "a3390fca-c315-41ae-ae05-af5e7859cdee", }), ], analysis: DatadogAPIClient::V2::CycloneDXVulnerabilityAnalysis.new({ state: "resolved", }), cwes: [ 123, 345, ], description: "Sample vulnerability detected in the application.", detail: "Details about the vulnerability.", id: "CVE-2021-1234", ratings: [ DatadogAPIClient::V2::CycloneDXVulnerabilityRating.new({ score: 9.0, severity: "high", vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", }), ], references: [ DatadogAPIClient::V2::CycloneDXVulnerabilityReference.new({ id: "GHSA-35m5-8cvj-8783", source: DatadogAPIClient::V2::CycloneDXVulnerabilityReferenceSource.new({ url: "https://example.com", }), }), ], }), ], }) p api_instance.import_security_vulnerabilities(body) ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=ruby) and then save the example to `example.rb` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" rb "example.rb" ##### ```go // Import security vulnerabilities returns "Vulnerabilities accepted successfully." response package main import ( "context" "fmt" "os" "github.com/DataDog/datadog-api-client-go/v2/api/datadog" "github.com/DataDog/datadog-api-client-go/v2/api/datadogV2" ) func main() { body := datadogV2.CycloneDXBom{ BomFormat: "CycloneDX", Components: []datadogV2.CycloneDXComponent{ { BomRef: "a3390fca-c315-41ae-ae05-af5e7859cdee", Name: "lodash", Purl: datadog.PtrString("pkg:npm/lodash@4.17.21"), Type: datadogV2.CYCLONEDXCOMPONENTTYPE_LIBRARY, Version: "4.17.21", }, }, Metadata: datadogV2.CycloneDXMetadata{ Component: datadogV2.CycloneDXMetadataComponent{ BomRef: datadog.PtrString("host-ref-abc123"), Name: "i-12345", Type: datadog.PtrString("operating-system"), }, Tools: datadogV2.CycloneDXMetadataTools{ Components: []datadogV2.CycloneDXToolComponent{ { Name: "my-scanner", Type: datadog.PtrString("application"), }, }, }, }, SpecVersion: "1.5", Version: datadog.PtrInt64(1), Vulnerabilities: []datadogV2.CycloneDXVulnerability{ { Advisories: []datadogV2.CycloneDXVulnerabilityAdvisory{ { Url: datadog.PtrString("https://example.com/advisory/CVE-2021-1234"), }, }, Affects: []datadogV2.CycloneDXVulnerabilityAffects{ { Ref: "a3390fca-c315-41ae-ae05-af5e7859cdee", }, }, Analysis: &datadogV2.CycloneDXVulnerabilityAnalysis{ State: datadog.PtrString("resolved"), }, Cwes: []int64{ 123, 345, }, Description: datadog.PtrString("Sample vulnerability detected in the application."), Detail: datadog.PtrString("Details about the vulnerability."), Id: "CVE-2021-1234", Ratings: []datadogV2.CycloneDXVulnerabilityRating{ { Score: datadog.PtrFloat64(9.0), Severity: datadog.PtrString("high"), Vector: datadog.PtrString("CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"), }, }, References: []datadogV2.CycloneDXVulnerabilityReference{ { Id: datadog.PtrString("GHSA-35m5-8cvj-8783"), Source: &datadogV2.CycloneDXVulnerabilityReferenceSource{ Url: datadog.PtrString("https://example.com"), }, }, }, }, }, } ctx := datadog.NewDefaultContext(context.Background()) configuration := datadog.NewConfiguration() configuration.SetUnstableOperationEnabled("v2.ImportSecurityVulnerabilities", true) apiClient := datadog.NewAPIClient(configuration) api := datadogV2.NewSecurityMonitoringApi(apiClient) r, err := api.ImportSecurityVulnerabilities(ctx, body) if err != nil { fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.ImportSecurityVulnerabilities`: %v\n", err) fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) } } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=go) and then save the example to `main.go` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" go run "main.go" ##### ```java // Import security vulnerabilities returns "Vulnerabilities accepted successfully." response import com.datadog.api.client.ApiClient; import com.datadog.api.client.ApiException; import com.datadog.api.client.v2.api.SecurityMonitoringApi; import com.datadog.api.client.v2.model.CycloneDXBom; import com.datadog.api.client.v2.model.CycloneDXComponent; import com.datadog.api.client.v2.model.CycloneDXComponentType; import com.datadog.api.client.v2.model.CycloneDXMetadata; import com.datadog.api.client.v2.model.CycloneDXMetadataComponent; import com.datadog.api.client.v2.model.CycloneDXMetadataTools; import com.datadog.api.client.v2.model.CycloneDXToolComponent; import com.datadog.api.client.v2.model.CycloneDXVulnerability; import com.datadog.api.client.v2.model.CycloneDXVulnerabilityAdvisory; import com.datadog.api.client.v2.model.CycloneDXVulnerabilityAffects; import com.datadog.api.client.v2.model.CycloneDXVulnerabilityAnalysis; import com.datadog.api.client.v2.model.CycloneDXVulnerabilityRating; import com.datadog.api.client.v2.model.CycloneDXVulnerabilityReference; import com.datadog.api.client.v2.model.CycloneDXVulnerabilityReferenceSource; import java.util.Arrays; import java.util.Collections; public class Example { public static void main(String[] args) { ApiClient defaultClient = ApiClient.getDefaultApiClient(); defaultClient.setUnstableOperationEnabled("v2.importSecurityVulnerabilities", true); SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient); CycloneDXBom body = new CycloneDXBom() .bomFormat("CycloneDX") .components( Collections.singletonList( new CycloneDXComponent() .bomRef("a3390fca-c315-41ae-ae05-af5e7859cdee") .name("lodash") .purl("pkg:npm/lodash@4.17.21") .type(CycloneDXComponentType.LIBRARY) .version("4.17.21"))) .metadata( new CycloneDXMetadata() .component( new CycloneDXMetadataComponent() .bomRef("host-ref-abc123") .name("i-12345") .type("operating-system")) .tools( new CycloneDXMetadataTools() .components( Collections.singletonList( new CycloneDXToolComponent() .name("my-scanner") .type("application"))))) .specVersion("1.5") .version(1L) .vulnerabilities( Collections.singletonList( new CycloneDXVulnerability() .advisories( Collections.singletonList( new CycloneDXVulnerabilityAdvisory() .url("https://example.com/advisory/CVE-2021-1234"))) .affects( Collections.singletonList( new CycloneDXVulnerabilityAffects() .ref("a3390fca-c315-41ae-ae05-af5e7859cdee"))) .analysis(new CycloneDXVulnerabilityAnalysis().state("resolved")) .cwes(Arrays.asList(123L, 345L)) .description("Sample vulnerability detected in the application.") .detail("Details about the vulnerability.") .id("CVE-2021-1234") .ratings( Collections.singletonList( new CycloneDXVulnerabilityRating() .score(9.0) .severity("high") .vector("CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"))) .references( Collections.singletonList( new CycloneDXVulnerabilityReference() .id("GHSA-35m5-8cvj-8783") .source( new CycloneDXVulnerabilityReferenceSource() .url("https://example.com")))))); try { apiInstance.importSecurityVulnerabilities(body); } catch (ApiException e) { System.err.println( "Exception when calling SecurityMonitoringApi#importSecurityVulnerabilities"); System.err.println("Status code: " + e.getCode()); System.err.println("Reason: " + e.getResponseBody()); System.err.println("Response headers: " + e.getResponseHeaders()); e.printStackTrace(); } } } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=java) and then save the example to `Example.java` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" java "Example.java" ##### ```rust // Import security vulnerabilities returns "Vulnerabilities accepted // successfully." response use datadog_api_client::datadog; use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI; use datadog_api_client::datadogV2::model::CycloneDXBom; use datadog_api_client::datadogV2::model::CycloneDXComponent; use datadog_api_client::datadogV2::model::CycloneDXComponentType; use datadog_api_client::datadogV2::model::CycloneDXMetadata; use datadog_api_client::datadogV2::model::CycloneDXMetadataComponent; use datadog_api_client::datadogV2::model::CycloneDXMetadataTools; use datadog_api_client::datadogV2::model::CycloneDXToolComponent; use datadog_api_client::datadogV2::model::CycloneDXVulnerability; use datadog_api_client::datadogV2::model::CycloneDXVulnerabilityAdvisory; use datadog_api_client::datadogV2::model::CycloneDXVulnerabilityAffects; use datadog_api_client::datadogV2::model::CycloneDXVulnerabilityAnalysis; use datadog_api_client::datadogV2::model::CycloneDXVulnerabilityRating; use datadog_api_client::datadogV2::model::CycloneDXVulnerabilityReference; use datadog_api_client::datadogV2::model::CycloneDXVulnerabilityReferenceSource; #[tokio::main] async fn main() { let body = CycloneDXBom::new( "CycloneDX".to_string(), vec![CycloneDXComponent::new( "a3390fca-c315-41ae-ae05-af5e7859cdee".to_string(), "lodash".to_string(), CycloneDXComponentType::LIBRARY, "4.17.21".to_string(), ) .purl("pkg:npm/lodash@4.17.21".to_string())], CycloneDXMetadata::new( CycloneDXMetadataComponent::new("i-12345".to_string()) .bom_ref("host-ref-abc123".to_string()) .type_("operating-system".to_string()), CycloneDXMetadataTools::new(vec![CycloneDXToolComponent::new( "my-scanner".to_string(), ) .type_("application".to_string())]), ), "1.5".to_string(), vec![CycloneDXVulnerability::new( vec![CycloneDXVulnerabilityAffects::new( "a3390fca-c315-41ae-ae05-af5e7859cdee".to_string(), )], "CVE-2021-1234".to_string(), vec![CycloneDXVulnerabilityRating::new() .score(9.0 as f64) .severity("high".to_string()) .vector("CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N".to_string())], ) .advisories(vec![CycloneDXVulnerabilityAdvisory::new() .url("https://example.com/advisory/CVE-2021-1234".to_string())]) .analysis(CycloneDXVulnerabilityAnalysis::new().state("resolved".to_string())) .cwes(vec![123, 345]) .description("Sample vulnerability detected in the application.".to_string()) .detail("Details about the vulnerability.".to_string()) .references(vec![CycloneDXVulnerabilityReference::new() .id("GHSA-35m5-8cvj-8783".to_string()) .source( CycloneDXVulnerabilityReferenceSource::new().url("https://example.com".to_string()), )])], ) .version(1); let mut configuration = datadog::Configuration::new(); configuration.set_unstable_operation_enabled("v2.ImportSecurityVulnerabilities", true); let api = SecurityMonitoringAPI::with_config(configuration); let resp = api.import_security_vulnerabilities(body).await; if let Ok(value) = resp { println!("{:#?}", value); } else { println!("{:#?}", resp.unwrap_err()); } } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=rust) and then save the example to `src/main.rs` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" cargo run ##### ```typescript /** * Import security vulnerabilities returns "Vulnerabilities accepted successfully." response */ import { client, v2 } from "@datadog/datadog-api-client"; const configuration = client.createConfiguration(); configuration.unstableOperations["v2.importSecurityVulnerabilities"] = true; const apiInstance = new v2.SecurityMonitoringApi(configuration); const params: v2.SecurityMonitoringApiImportSecurityVulnerabilitiesRequest = { body: { bomFormat: "CycloneDX", components: [ { bomRef: "a3390fca-c315-41ae-ae05-af5e7859cdee", name: "lodash", purl: "pkg:npm/lodash@4.17.21", type: "library", version: "4.17.21", }, ], metadata: { component: { bomRef: "host-ref-abc123", name: "i-12345", type: "operating-system", }, tools: { components: [ { name: "my-scanner", type: "application", }, ], }, }, specVersion: "1.5", version: 1, vulnerabilities: [ { advisories: [ { url: "https://example.com/advisory/CVE-2021-1234", }, ], affects: [ { ref: "a3390fca-c315-41ae-ae05-af5e7859cdee", }, ], analysis: { state: "resolved", }, cwes: [123, 345], description: "Sample vulnerability detected in the application.", detail: "Details about the vulnerability.", id: "CVE-2021-1234", ratings: [ { score: 9.0, severity: "high", vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", }, ], references: [ { id: "GHSA-35m5-8cvj-8783", source: { url: "https://example.com", }, }, ], }, ], }, }; apiInstance .importSecurityVulnerabilities(params) .then((data: any) => { console.log( "API called successfully. Returned data: " + JSON.stringify(data) ); }) .catch((error: any) => console.error(error)); ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=typescript) and then save the example to `example.ts` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" tsc "example.ts" {% /tab %}