This dataset provides access to Datadog Security Findings, which represent the results of evaluating cloud resources, code repositories, container images, and host configurations against compliance and vulnerability rules. Each finding produces a Pass or Fail status and includes the resource configuration, applied compliance rules mapped to industry frameworks, severity scores, and remediation guidance. Resources are scanned at regular intervals and findings are retained for up to 15 months.

dd.security_findings

Cloud Security Misconfigurations Findings Public Documentation

Security Findings API Public Documentation

Query Parameters

This dataset uses a polymorphic table function. You must specify parameters when querying.

Example Queries

-- Fetch open high-severity findings
SELECT * FROM dd.security_findings(
  columns => ARRAY[
    'timestamp',
    '@status',
    '@severity',
    '@rule.name',
    '@rule.type',
    '@resource_id',
    '@resource_name',
    '@cloud_resource.cloud_provider',
    '@compliance.evaluation'
  ],
  filter => '@status:open AND @severity:high'
) AS (
  ts               TIMESTAMP,
  status           VARCHAR,
  severity         VARCHAR,
  rule_name        VARCHAR,
  rule_type        VARCHAR,
  resource_id      VARCHAR,
  resource_name    VARCHAR,
  cloud_provider   VARCHAR,
  evaluation       VARCHAR
);

Fields