Filtering on tags: ?filter[tags]=tag_key:tag_value&filter[tags]=tag_key_2:tag_value_2
Here, attribute_key can be any of the filter keys described further below.
Query parameters of type integer support comparison operators (>, >=, <, <=). This is particularly useful when filtering by evaluation_changed_at or resource_discovery_timestamp. For example: ?filter[evaluation_changed_at]=>20123123121.
You can also use the negation operator on strings. For example, use filter[resource_type]=-aws* to filter for any non-AWS resources.
The operator must come after the equal sign. For example, to filter with the >= operator, add the operator after the equal sign: filter[evaluation_changed_at]=>=1678809373257.
Query parameters must be only among the documented ones and with values of correct types. Duplicated query parameters (e.g. filter[status]=low&filter[status]=info) are not allowed.
The expected response schema when listing findings.
Expand All
Field
Type
Description
data [required]
[object]
Array of findings.
attributes
object
The JSON:API attributes of the finding.
datadog_link
string
The Datadog relative link for this finding.
description
string
The description and remediation steps for this finding.
evaluation
enum
The evaluation of the finding.
Allowed enum values: pass,fail
evaluation_changed_at
int64
The date on which the evaluation for this finding changed (Unix ms).
external_id
string
The cloud-based ID for the resource related to the finding.
mute
object
Information about the mute status of this finding.
description
string
Additional information about the reason why this finding is muted or unmuted.
expiration_date
int64
The expiration date of the mute or unmute action (Unix ms).
muted
boolean
Whether this finding is muted or unmuted.
reason
enum
The reason why this finding is muted or unmuted.
Allowed enum values: PENDING_FIX,FALSE_POSITIVE,ACCEPTED_RISK,NO_PENDING_FIX,HUMAN_ERROR,NO_LONGER_ACCEPTED_RISK,OTHER
start_date
int64
The start of the mute period.
uuid
string
The ID of the user who muted or unmuted this finding.
resource
string
The resource name of this finding.
resource_discovery_date
int64
The date on which the resource was discovered (Unix ms).
resource_type
string
The resource type of this finding.
rule
object
The rule that triggered this finding.
id
string
The ID of the rule that triggered this finding.
name
string
The name of the rule that triggered this finding.
status
enum
The status of the finding.
Allowed enum values: critical,high,medium,low,info
tags
[string]
The tags associated with this finding.
vulnerability_type
enum
The vulnerability type of the finding.
Allowed enum values: misconfiguration,attack_path,identity_risk,api_security
id
string
The unique ID for this finding.
type
enum
The JSON:API type for findings.
Allowed enum values: finding
default: finding
meta [required]
object
Metadata for pagination.
page
object
Pagination and findings count information.
cursor
string
The cursor used to paginate requests.
total_filtered_count
int64
The total count of findings after the filter has been applied.
snapshot_timestamp
int64
The point in time corresponding to the listed findings.
{"data":[{"attributes":{"datadog_link":"/security/compliance?panels=cpfinding%7Cevent%7CruleId%3Adef-000-u5t%7CresourceId%3Ae8c9ab7c52ebd7bf2fdb4db641082d7d%7CtabId%3Aoverview","description":"## Remediation\n\n1. In the console, go to **Storage Account**.\n2. For each Storage Account, navigate to **Data Protection**.\n3. Select **Set soft delete enabled** and enter the number of days to retain soft deleted data.","evaluation":"pass","evaluation_changed_at":1678721573794,"external_id":"arn:aws:s3:::my-example-bucket","mute":{"description":"To be resolved later","expiration_date":1778721573794,"muted":true,"reason":"ACCEPTED_RISK","start_date":1678721573794,"uuid":"e51c9744-d158-11ec-ad23-da7ad0900002"},"resource":"my_resource_name","resource_discovery_date":1678721573794,"resource_type":"azure_storage_account","rule":{"id":"dv2-jzf-41i","name":"Soft delete is enabled for Azure Storage"},"status":"critical","tags":["cloud_provider:aws","myTag:myValue"],"vulnerability_type":"misconfiguration"},"id":"ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==","type":"finding"}],"meta":{"page":{"cursor":"eyJhZnRlciI6IkFRQUFBWWJiaEJXQS1OY1dqUUFBQUFCQldXSmlhRUpYUVVGQlJFSktkbTlDTUdaWFRVbDNRVUUiLCJ2YWx1ZXMiOlsiY3JpdGljYWwiXX0=","total_filtered_count":213},"snapshot_timestamp":1678721573794}}
Bad Request: The server cannot process the request due to invalid syntax in the request.
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* List findings returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();configuration.unstableOperations["v2.listFindings"]=true;constapiInstance=newv2.SecurityMonitoringApi(configuration);apiInstance.listFindings().then((data: v2.ListFindingsResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));