Overview

To make it easier to search for security findings throughout Datadog, the syntax for search queries is changing:

• Standardized naming conventions for security finding data fields
• A new schema to consistently organize those fields across security products

This change comes with a set of new features that use the new schema, and may also impact your existing workflows. This page details what is changing, the workflows that Datadog automatically updates, and the changes you need to make to avoid interruptions in your existing workflows.

Required action

• If you use certain API endpoints or Terraform resources, changes will be required:
  • For List findings and Get a finding API endpoints, update your API calls to use the new unified Findings API. The documentation for this API will be published in early January 2026.
  • For datadog_security_notification_rule Terraform resources with trigger_source: "security_findings", update query values to use the new search syntax, starting January 28, 2026.
• If you do not use public APIs or the security findings notification rules terraform resource, no changes are required. The following queries are updated automatically in the UI:
  • Explorers
  • Dashboards
  • Notification rules
  • Automation pipelines
  • Workflows

If you need assistance with your migration, contact Datadog support.

What is changing

New querying syntax

Following this change, you can use the same query syntax for all security findings, using attributes organized around namespaces. Here are some practical examples:

View the full specification at Security Findings Schema Reference.

New features

Starting January 28, 2026, the following features will be made available and use the new data model:

• Unified search queries for Cloud Security Misconfigurations, Identity Risks, Attack Paths, IaC, and API findings
• A new unified public findings API
• Dashboard support for Code Security
• Graphing security findings in Datadog Sheets
• Datadog Workflow Automation support for all finding types
• Using SQL to query security findings and join them with other Datadog telemetry using DDSQL Editor

The following additional features will be released later:

• Support for Cloud Security Vulnerabilities and Code Security findings (SCA, SAST, IAST, Secrets) in the unified search experience
• Data Access Controls
• Security findings & tools in the Datadog MCP Server
• API & Terraform support for automation pipelines

Security findings

Security findings encompass misconfigurations, vulnerabilities, and security risks identified across your infrastructure and applications. This table shows the scope of security findings across Datadog and which findings are supported in the new data model.

Further reading

Más enlaces, artículos y documentación útiles:

Cloud SecurityDOCUMENTATION Code SecurityDOCUMENTATION Application SecurityDOCUMENTATION