Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.
expression [required]
string
Expression.
name [required]
string
Field name.
cases [required]
[object]
Cases for generating signals.
actions
[object]
Action to perform for each rule case.
options
object
Options for the rule action
duration
int64
Duration of the action in seconds. 0 indicates no expiration.
flaggedIPType
enum
Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses.
Allowed enum values: SUSPICIOUS,FLAGGED
userBehaviorName
string
Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
type
enum
The action type.
Allowed enum values: block_ip,block_user,user_behavior,flag_ip
condition
string
A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated
based on the event counts in the previously defined queries.
name
string
Name of the case.
notifications
[string]
Notification targets.
status [required]
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
customMessage
string
Custom/Overridden message for generated signals (used in case of Default rule update).
customName
string
Custom/Overridden name of the rule (used in case of Default rule update).
filters
[object]
Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
action
enum
The type of filtering action.
Allowed enum values: require,suppress
query
string
Query for selecting logs to apply the filtering action.
groupSignalsBy
[string]
Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
hasExtendedTitle
boolean
Whether the notifications include the triggering group-by values in their title.
isEnabled [required]
boolean
Whether the rule is enabled.
message [required]
string
Message for generated signals.
name [required]
string
The name of the rule.
options [required]
object
Options.
anomalyDetectionOptions
object
Options on anomaly detection method.
bucketDuration
enum
Duration in seconds of the time buckets used to aggregate events matched by the rule.
Must be greater than or equal to 300.
Allowed enum values: 300,600,900,1800,3600,10800
detectionTolerance
enum
An optional parameter that sets how permissive anomaly detection is.
Higher values require higher deviations before triggering a signal.
Allowed enum values: 1,2,3,4,5
instantaneousBaseline
boolean
When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDuration
enum
Learning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating.
Allowed enum values: 1,6,12,24,48,168,336
learningPeriodBaseline
int64
An optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0.
complianceRuleOptions
object
Options for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRule
boolean
Whether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
List of resource types that will be evaluated upon. Must have at least one element.
resourceType
string
Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnv
boolean
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.
The severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.
The decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethod
enum
The detection method.
Allowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time. For third party detection method, this field is not used.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular
access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
baselineUserLocationsDuration
int32
The duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations.
keepAlive
enum
Once a signal is generated, the signal will remain "open" if a case is matched at least once within
this keep alive window. For third party detection method, this field is not used.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
maxSignalDuration
enum
A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.
This time is calculated from the first seen timestamp.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
newValueOptions
object
Options on new value detection method.
forgetAfter
int32
The duration in days after which a learned value is forgotten.
instantaneousBaseline
boolean
When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDuration
int32
The duration in days during which values are learned, and after which signals will be generated for values that
weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
learningMethod
enum
The learning method used to determine when signals should be generated for values that weren't learned.
Allowed enum values: duration,threshold
default: duration
learningThreshold
enum
A number of occurrences after which signals will be generated for values that weren't learned.
Allowed enum values: 0,1
sequenceDetectionOptions
object
Options on sequence detection method.
stepTransitions
[object]
Transitions defining the allowed order of steps and their evaluation windows.
child
string
Name of the child step.
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time. For third party detection method, this field is not used.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
parent
string
Name of the parent step.
steps
[object]
Steps that define the conditions to be matched in sequence.
condition
string
Condition referencing rule queries (e.g., a > 0).
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time. For third party detection method, this field is not used.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
name
string
Unique name identifying the step.
thirdPartyRuleOptions
object
Options on third party detection method.
defaultNotifications
[string]
Notification targets for the logs that do not correspond to any of the cases.
defaultStatus
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
rootQueries
[object]
Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
groupByFields
[string]
Fields to group by.
query
string
Query to run on logs.
signalTitleTemplate
string
A template for the signal title; if omitted, the title is generated based on the case name.
queries [required]
[object]
Queries for selecting logs which are part of the rule.
aggregation
enum
The aggregation type.
Allowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none
customQueryExtension
string
Query extension to append to the logs query.
dataSource
enum
Source of events, either logs, audit trail, security signals, or Datadog events. app_sec_spans is deprecated in favor of spans.
Allowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events,security_signals
default: logs
distinctFields
[string]
Field for which the cardinality is measured. Sent as an array.
groupByFields
[string]
Fields to group by.
hasOptionalGroupByFields
boolean
When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.
index
string
This field is currently unstable and might be removed in a minor version upgrade.
The index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.
indexes
[string]
List of indexes to query when the dataSource is logs. Only used for scheduled rules, such as when the schedulingOptions field is present in the rule payload.
metric
string
DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max
aggregations. metrics field should be used instead.
metrics
[string]
Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
name
string
Name of the query.
query
string
Query to run on logs.
referenceTables
[object]
Reference tables for the rule.
checkPresence
boolean
Whether to include or exclude the matched values.
columnName
string
The name of the column in the reference table.
logFieldPath
string
The field in the log to match against the reference table.
ruleQueryName
string
The name of the query to apply the reference table to.
tableName
string
The name of the reference table.
schedulingOptions
object
Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
rrule
string
Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.
start
string
Start date for the schedule, in ISO 8601 format without timezone.
timezone
string
Time zone of the start date, in the tz database format.
tags
[string]
Tags for generated signals.
thirdPartyCases
[object]
Cases for generating signals from third-party rules. Only available for third-party rules.
name
string
Name of the case.
notifications
[string]
Notification targets for each case.
query
string
A query to map a third party event to this case.
status [required]
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
type
enum
The rule type.
Allowed enum values: api_security,application_security,log_detection,workload_activity,workload_security
Option 2
object
The payload of a signal correlation rule.
cases [required]
[object]
Cases for generating signals.
actions
[object]
Action to perform for each rule case.
options
object
Options for the rule action
duration
int64
Duration of the action in seconds. 0 indicates no expiration.
flaggedIPType
enum
Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses.
Allowed enum values: SUSPICIOUS,FLAGGED
userBehaviorName
string
Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
type
enum
The action type.
Allowed enum values: block_ip,block_user,user_behavior,flag_ip
condition
string
A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated
based on the event counts in the previously defined queries.
name
string
Name of the case.
notifications
[string]
Notification targets.
status [required]
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
customMessage
string
Custom/Overridden message for generated signals (used in case of Default rule update).
customName
string
Custom/Overridden name of the rule (used in case of Default rule update).
filters
[object]
Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
action
enum
The type of filtering action.
Allowed enum values: require,suppress
query
string
Query for selecting logs to apply the filtering action.
hasExtendedTitle
boolean
Whether the notifications include the triggering group-by values in their title.
isEnabled [required]
boolean
Whether the rule is enabled.
message [required]
string
Message for generated signals.
name [required]
string
The name of the rule.
options [required]
object
Options.
anomalyDetectionOptions
object
Options on anomaly detection method.
bucketDuration
enum
Duration in seconds of the time buckets used to aggregate events matched by the rule.
Must be greater than or equal to 300.
Allowed enum values: 300,600,900,1800,3600,10800
detectionTolerance
enum
An optional parameter that sets how permissive anomaly detection is.
Higher values require higher deviations before triggering a signal.
Allowed enum values: 1,2,3,4,5
instantaneousBaseline
boolean
When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDuration
enum
Learning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating.
Allowed enum values: 1,6,12,24,48,168,336
learningPeriodBaseline
int64
An optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0.
complianceRuleOptions
object
Options for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRule
boolean
Whether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
List of resource types that will be evaluated upon. Must have at least one element.
resourceType
string
Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnv
boolean
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.
The severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.
The decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethod
enum
The detection method.
Allowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time. For third party detection method, this field is not used.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular
access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
baselineUserLocationsDuration
int32
The duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations.
keepAlive
enum
Once a signal is generated, the signal will remain "open" if a case is matched at least once within
this keep alive window. For third party detection method, this field is not used.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
maxSignalDuration
enum
A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.
This time is calculated from the first seen timestamp.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
newValueOptions
object
Options on new value detection method.
forgetAfter
int32
The duration in days after which a learned value is forgotten.
instantaneousBaseline
boolean
When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDuration
int32
The duration in days during which values are learned, and after which signals will be generated for values that
weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
learningMethod
enum
The learning method used to determine when signals should be generated for values that weren't learned.
Allowed enum values: duration,threshold
default: duration
learningThreshold
enum
A number of occurrences after which signals will be generated for values that weren't learned.
Allowed enum values: 0,1
sequenceDetectionOptions
object
Options on sequence detection method.
stepTransitions
[object]
Transitions defining the allowed order of steps and their evaluation windows.
child
string
Name of the child step.
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time. For third party detection method, this field is not used.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
parent
string
Name of the parent step.
steps
[object]
Steps that define the conditions to be matched in sequence.
condition
string
Condition referencing rule queries (e.g., a > 0).
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time. For third party detection method, this field is not used.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
name
string
Unique name identifying the step.
thirdPartyRuleOptions
object
Options on third party detection method.
defaultNotifications
[string]
Notification targets for the logs that do not correspond to any of the cases.
defaultStatus
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
rootQueries
[object]
Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
groupByFields
[string]
Fields to group by.
query
string
Query to run on logs.
signalTitleTemplate
string
A template for the signal title; if omitted, the title is generated based on the case name.
queries [required]
[object]
Queries for selecting signals which are part of the rule.
aggregation
enum
The aggregation type.
Allowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none
correlatedByFields
[string]
Fields to group by.
correlatedQueryIndex
int32
Index of the rule query used to retrieve the correlated field.
metrics
[string]
Group of target fields to aggregate over.
name
string
Name of the query.
ruleId [required]
string
Rule ID to match on signals.
tags
[string]
Tags for generated signals.
type
enum
The rule type.
Allowed enum values: signal_correlation
Option 3
object
The payload of a cloud configuration rule.
cases [required]
[object]
Description of generated findings and signals (severity and channels to be notified in case of a signal). Must contain exactly one item.
notifications
[string]
Notification targets for each rule case.
status [required]
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
complianceSignalOptions [required]
object
How to generate compliance signals. Useful for cloud_configuration rules only.
defaultActivationStatus
boolean
The default activation status.
defaultGroupByFields
[string]
The default group by fields.
userActivationStatus
boolean
Whether signals will be sent.
userGroupByFields
[string]
Fields to use to group findings by when sending signals.
customMessage
string
Custom/Overridden message for generated signals (used in case of Default rule update).
customName
string
Custom/Overridden name of the rule (used in case of Default rule update).
filters
[object]
Additional queries to filter matched events before they are processed.
action
enum
The type of filtering action.
Allowed enum values: require,suppress
query
string
Query for selecting logs to apply the filtering action.
isEnabled [required]
boolean
Whether the rule is enabled.
message [required]
string
Message in markdown format for generated findings and signals.
name [required]
string
The name of the rule.
options [required]
object
Options on cloud configuration rules.
complianceRuleOptions [required]
object
Options for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRule
boolean
Whether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
