Optional comment to explain why a signal is being archived.
archiveReason
enum
Reason why a signal has been archived.
Allowed enum values: none,false_positive,testing_or_maintenance,investigated_case_opened,true_positive_benign,true_positive_malicious,other
state [required]
enum
The new triage state of the signal.
Allowed enum values: open,archived,under_review
version
int64
Version of the updated signal. If server side version is higher, update will be rejected.
// Change the triage state of a security signal returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV1")funcmain(){body:=datadogV1.SignalStateUpdateRequest{ArchiveReason:datadogV1.SIGNALARCHIVEREASON_NONE.Ptr(),State:datadogV1.SIGNALTRIAGESTATE_OPEN,}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV1.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.EditSecurityMonitoringSignalState(ctx,"AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.EditSecurityMonitoringSignalState`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.EditSecurityMonitoringSignalState`:\n%s\n",responseContent)}
// Change the triage state of a security signal returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v1.api.SecurityMonitoringApi;importcom.datadog.api.client.v1.model.SignalArchiveReason;importcom.datadog.api.client.v1.model.SignalStateUpdateRequest;importcom.datadog.api.client.v1.model.SignalTriageState;importcom.datadog.api.client.v1.model.SuccessfulSignalUpdateResponse;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);SignalStateUpdateRequestbody=newSignalStateUpdateRequest().archiveReason(SignalArchiveReason.NONE).state(SignalTriageState.OPEN);try{SuccessfulSignalUpdateResponseresult=apiInstance.editSecurityMonitoringSignalState("AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#editSecurityMonitoringSignalState");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Change the triage state of a security signal returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v1.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v1.model.signal_archive_reasonimportSignalArchiveReasonfromdatadog_api_client.v1.model.signal_state_update_requestimportSignalStateUpdateRequestfromdatadog_api_client.v1.model.signal_triage_stateimportSignalTriageStatebody=SignalStateUpdateRequest(archive_reason=SignalArchiveReason.NONE,state=SignalTriageState.OPEN,)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.edit_security_monitoring_signal_state(signal_id="AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body=body)print(response)
# Change the triage state of a security signal returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V1::SecurityMonitoringAPI.newbody=DatadogAPIClient::V1::SignalStateUpdateRequest.new({archive_reason:DatadogAPIClient::V1::SignalArchiveReason::NONE,state:DatadogAPIClient::V1::SignalTriageState::OPEN,})papi_instance.edit_security_monitoring_signal_state("AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body)
// Change the triage state of a security signal returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV1::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV1::model::SignalArchiveReason;usedatadog_api_client::datadogV1::model::SignalStateUpdateRequest;usedatadog_api_client::datadogV1::model::SignalTriageState;#[tokio::main]asyncfnmain(){letbody=SignalStateUpdateRequest::new(SignalTriageState::OPEN).archive_reason(SignalArchiveReason::NONE);letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.edit_security_monitoring_signal_state("AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE".to_string(),body,).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<API-KEY>"DD_APP_KEY="<APP-KEY>"cargo run
/**
* Change the triage state of a security signal returns "OK" response
*/import{client,v1}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv1.SecurityMonitoringApi(configuration);constparams: v1.SecurityMonitoringApiEditSecurityMonitoringSignalStateRequest={body:{archiveReason:"none",state:"open",},signalId:"AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",};apiInstance.editSecurityMonitoringSignalState(params).then((data: v1.SuccessfulSignalUpdateResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Data containing the patch for changing the state of a signal.
attributes [required]
object
Attributes describing the change of state of a security signal.
archive_comment
string
Optional comment to display on archived signals.
archive_reason
enum
Reason a signal is archived.
Allowed enum values: none,false_positive,testing_or_maintenance,remediated,investigated_case_opened,true_positive_benign,true_positive_malicious,other
state [required]
enum
The new triage state of the signal.
Allowed enum values: open,archived,under_review
version
int64
Version of the updated signal. If server side version is higher, update will be rejected.
id
The unique ID of the security signal.
type
enum
The type of event.
Allowed enum values: signal_metadata
The response returned after all triage operations, containing the updated signal triage data.
Expand All
フィールド
種類
説明
data [required]
object
Data containing the updated triage attributes of the signal.
attributes
object
Attributes describing a triage state update operation over a security signal.
archive_comment
string
Optional comment to display on archived signals.
archive_comment_timestamp
int64
Timestamp of the last edit to the comment.
archive_comment_user
object
Object representing a given user entity.
handle
string
The handle for this user account.
icon
string
Gravatar icon associated to the user.
id
int64
Numerical ID assigned by Datadog to this user account.
name
string
The name for this user account.
uuid [required]
string
UUID assigned by Datadog to this user account.
archive_reason
enum
Reason a signal is archived.
Allowed enum values: none,false_positive,testing_or_maintenance,remediated,investigated_case_opened,true_positive_benign,true_positive_malicious,other
assignee [required]
object
Object representing a given user entity.
handle
string
The handle for this user account.
icon
string
Gravatar icon associated to the user.
id
int64
Numerical ID assigned by Datadog to this user account.
name
string
The name for this user account.
uuid [required]
string
UUID assigned by Datadog to this user account.
incident_ids [required]
[integer]
Array of incidents that are associated with this signal.
state [required]
enum
The new triage state of the signal.
Allowed enum values: open,archived,under_review
state_update_timestamp
int64
Timestamp of the last update to the signal state.
state_update_user
object
Object representing a given user entity.
handle
string
The handle for this user account.
icon
string
Gravatar icon associated to the user.
id
int64
Numerical ID assigned by Datadog to this user account.
name
string
The name for this user account.
uuid [required]
string
UUID assigned by Datadog to this user account.
id
string
The unique ID of the security signal.
type
enum
The type of event.
Allowed enum values: signal_metadata
// Change the triage state of a security signal returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.SecurityMonitoringSignalStateUpdateRequest{Data:datadogV2.SecurityMonitoringSignalStateUpdateData{Attributes:datadogV2.SecurityMonitoringSignalStateUpdateAttributes{ArchiveReason:datadogV2.SECURITYMONITORINGSIGNALARCHIVEREASON_NONE.Ptr(),State:datadogV2.SECURITYMONITORINGSIGNALSTATE_OPEN,},},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.EditSecurityMonitoringSignalState(ctx,"AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.EditSecurityMonitoringSignalState`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.EditSecurityMonitoringSignalState`:\n%s\n",responseContent)}
// Change the triage state of a security signal returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalArchiveReason;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalState;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalStateUpdateAttributes;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalStateUpdateData;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalStateUpdateRequest;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalTriageUpdateResponse;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);SecurityMonitoringSignalStateUpdateRequestbody=newSecurityMonitoringSignalStateUpdateRequest().data(newSecurityMonitoringSignalStateUpdateData().attributes(newSecurityMonitoringSignalStateUpdateAttributes().archiveReason(SecurityMonitoringSignalArchiveReason.NONE).state(SecurityMonitoringSignalState.OPEN)));try{SecurityMonitoringSignalTriageUpdateResponseresult=apiInstance.editSecurityMonitoringSignalState("AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#editSecurityMonitoringSignalState");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Change the triage state of a security signal returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.security_monitoring_signal_archive_reasonimportSecurityMonitoringSignalArchiveReasonfromdatadog_api_client.v2.model.security_monitoring_signal_stateimportSecurityMonitoringSignalStatefromdatadog_api_client.v2.model.security_monitoring_signal_state_update_attributesimport(SecurityMonitoringSignalStateUpdateAttributes,)fromdatadog_api_client.v2.model.security_monitoring_signal_state_update_dataimport(SecurityMonitoringSignalStateUpdateData,)fromdatadog_api_client.v2.model.security_monitoring_signal_state_update_requestimport(SecurityMonitoringSignalStateUpdateRequest,)body=SecurityMonitoringSignalStateUpdateRequest(data=SecurityMonitoringSignalStateUpdateData(attributes=SecurityMonitoringSignalStateUpdateAttributes(archive_reason=SecurityMonitoringSignalArchiveReason.NONE,state=SecurityMonitoringSignalState.OPEN,),),)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.edit_security_monitoring_signal_state(signal_id="AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",body=body)print(response)
# Change the triage state of a security signal returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newbody=DatadogAPIClient::V2::SecurityMonitoringSignalStateUpdateRequest.new({data:DatadogAPIClient::V2::SecurityMonitoringSignalStateUpdateData.new({attributes:DatadogAPIClient::V2::SecurityMonitoringSignalStateUpdateAttributes.new({archive_reason:DatadogAPIClient::V2::SecurityMonitoringSignalArchiveReason::NONE,state:DatadogAPIClient::V2::SecurityMonitoringSignalState::OPEN,}),}),})papi_instance.edit_security_monitoring_signal_state("AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",body)
// Change the triage state of a security signal returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV2::model::SecurityMonitoringSignalArchiveReason;usedatadog_api_client::datadogV2::model::SecurityMonitoringSignalState;usedatadog_api_client::datadogV2::model::SecurityMonitoringSignalStateUpdateAttributes;usedatadog_api_client::datadogV2::model::SecurityMonitoringSignalStateUpdateData;usedatadog_api_client::datadogV2::model::SecurityMonitoringSignalStateUpdateRequest;#[tokio::main]asyncfnmain(){letbody=SecurityMonitoringSignalStateUpdateRequest::new(SecurityMonitoringSignalStateUpdateData::new(SecurityMonitoringSignalStateUpdateAttributes::new(SecurityMonitoringSignalState::OPEN).archive_reason(SecurityMonitoringSignalArchiveReason::NONE),),);letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.edit_security_monitoring_signal_state("AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE".to_string(),body,).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Change the triage state of a security signal returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiEditSecurityMonitoringSignalStateRequest={body:{data:{attributes:{archiveReason:"none",state:"open",},},},signalId:"AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",};apiInstance.editSecurityMonitoringSignalState(params).then((data: v2.SecurityMonitoringSignalTriageUpdateResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Filtering on tags: ?filter[tags]=tag_key:tag_value&filter[tags]=tag_key_2:tag_value_2
Here, attribute_key can be any of the filter keys described further below.
Query parameters of type integer support comparison operators (>, >=, <, <=). This is particularly useful when filtering by evaluation_changed_at or resource_discovery_timestamp. For example: ?filter[evaluation_changed_at]=>20123123121.
You can also use the negation operator on strings. For example, use filter[resource_type]=-aws* to filter for any non-AWS resources.
The operator must come after the equal sign. For example, to filter with the >= operator, add the operator after the equal sign: filter[evaluation_changed_at]=>=1678809373257.
Query parameters must be only among the documented ones and with values of correct types. Duplicated query parameters (e.g. filter[status]=low&filter[status]=info) are not allowed.
The expected response schema when listing findings.
Expand All
フィールド
種類
説明
data [required]
[object]
Array of findings.
attributes
object
The JSON:API attributes of the finding.
datadog_link
string
The Datadog relative link for this finding.
description
string
The description and remediation steps for this finding.
evaluation
enum
The evaluation of the finding.
Allowed enum values: pass,fail
evaluation_changed_at
int64
The date on which the evaluation for this finding changed (Unix ms).
external_id
string
The cloud-based ID for the resource related to the finding.
mute
object
Information about the mute status of this finding.
description
string
Additional information about the reason why this finding is muted or unmuted.
expiration_date
int64
The expiration date of the mute or unmute action (Unix ms).
muted
boolean
Whether this finding is muted or unmuted.
reason
enum
The reason why this finding is muted or unmuted.
Allowed enum values: PENDING_FIX,FALSE_POSITIVE,ACCEPTED_RISK,NO_PENDING_FIX,HUMAN_ERROR,NO_LONGER_ACCEPTED_RISK,OTHER
start_date
int64
The start of the mute period.
uuid
string
The ID of the user who muted or unmuted this finding.
resource
string
The resource name of this finding.
resource_discovery_date
int64
The date on which the resource was discovered (Unix ms).
resource_type
string
The resource type of this finding.
rule
object
The rule that triggered this finding.
id
string
The ID of the rule that triggered this finding.
name
string
The name of the rule that triggered this finding.
status
enum
The status of the finding.
Allowed enum values: critical,high,medium,low,info
tags
[string]
The tags associated with this finding.
vulnerability_type
enum
The vulnerability type of the finding.
Allowed enum values: misconfiguration,attack_path,identity_risk,api_security
id
string
The unique ID for this finding.
type
enum
The JSON:API type for findings.
Allowed enum values: finding
default: finding
meta [required]
object
Metadata for pagination.
page
object
Pagination and findings count information.
cursor
string
The cursor used to paginate requests.
total_filtered_count
int64
The total count of findings after the filter has been applied.
snapshot_timestamp
int64
The point in time corresponding to the listed findings.
{"data":[{"attributes":{"datadog_link":"/security/compliance?panels=cpfinding%7Cevent%7CruleId%3Adef-000-u5t%7CresourceId%3Ae8c9ab7c52ebd7bf2fdb4db641082d7d%7CtabId%3Aoverview","description":"## Remediation\n\n1. In the console, go to **Storage Account**.\n2. For each Storage Account, navigate to **Data Protection**.\n3. Select **Set soft delete enabled** and enter the number of days to retain soft deleted data.","evaluation":"pass","evaluation_changed_at":1678721573794,"external_id":"arn:aws:s3:::my-example-bucket","mute":{"description":"To be resolved later","expiration_date":1778721573794,"muted":true,"reason":"ACCEPTED_RISK","start_date":1678721573794,"uuid":"e51c9744-d158-11ec-ad23-da7ad0900002"},"resource":"my_resource_name","resource_discovery_date":1678721573794,"resource_type":"azure_storage_account","rule":{"id":"dv2-jzf-41i","name":"Soft delete is enabled for Azure Storage"},"status":"critical","tags":["cloud_provider:aws","myTag:myValue"],"vulnerability_type":"misconfiguration"},"id":"ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==","type":"finding"}],"meta":{"page":{"cursor":"eyJhZnRlciI6IkFRQUFBWWJiaEJXQS1OY1dqUUFBQUFCQldXSmlhRUpYUVVGQlJFSktkbTlDTUdaWFRVbDNRVUUiLCJ2YWx1ZXMiOlsiY3JpdGljYWwiXX0=","total_filtered_count":213},"snapshot_timestamp":1678721573794}}
Bad Request: The server cannot process the request due to invalid syntax in the request.
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* List findings returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();configuration.unstableOperations["v2.listFindings"]=true;constapiInstance=newv2.SecurityMonitoringApi(configuration);apiInstance.listFindings().then((data: v2.ListFindingsResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
インシデントにセキュリティシグナルを追加します。これにより、シグナルエクスプローラー内でインシデント別にシグナルを検索したり、インシデントタイムライン上でシグナルを表示したりすることが可能になります。
This endpoint requires the security_monitoring_signals_write permission.
// Add a security signal to an incident returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV1")funcmain(){body:=datadogV1.AddSignalToIncidentRequest{IncidentId:2609,}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV1.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.AddSecurityMonitoringSignalToIncident(ctx,"AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.AddSecurityMonitoringSignalToIncident`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.AddSecurityMonitoringSignalToIncident`:\n%s\n",responseContent)}
// Add a security signal to an incident returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v1.api.SecurityMonitoringApi;importcom.datadog.api.client.v1.model.AddSignalToIncidentRequest;importcom.datadog.api.client.v1.model.SuccessfulSignalUpdateResponse;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);AddSignalToIncidentRequestbody=newAddSignalToIncidentRequest().incidentId(2609L);try{SuccessfulSignalUpdateResponseresult=apiInstance.addSecurityMonitoringSignalToIncident("AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#addSecurityMonitoringSignalToIncident");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Add a security signal to an incident returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v1.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v1.model.add_signal_to_incident_requestimportAddSignalToIncidentRequestbody=AddSignalToIncidentRequest(incident_id=2609,)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.add_security_monitoring_signal_to_incident(signal_id="AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body=body)print(response)
# Add a security signal to an incident returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V1::SecurityMonitoringAPI.newbody=DatadogAPIClient::V1::AddSignalToIncidentRequest.new({incident_id:2609,})papi_instance.add_security_monitoring_signal_to_incident("AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body)
// Add a security signal to an incident returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV1::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV1::model::AddSignalToIncidentRequest;#[tokio::main]asyncfnmain(){letbody=AddSignalToIncidentRequest::new(2609);letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.add_security_monitoring_signal_to_incident("AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE".to_string(),body,).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<API-KEY>"DD_APP_KEY="<APP-KEY>"cargo run
/**
* Add a security signal to an incident returns "OK" response
*/import{client,v1}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv1.SecurityMonitoringApi(configuration);constparams: v1.SecurityMonitoringApiAddSecurityMonitoringSignalToIncidentRequest={body:{incidentId: 2609,},signalId:"AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",};apiInstance.addSecurityMonitoringSignalToIncident(params).then((data: v1.SuccessfulSignalUpdateResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Mute or unmute findings.
This endpoint requires
any
of the following permissions:
security_monitoring_findings_write
appsec_vm_write
リクエスト
Body Data (required)
Attributes
All findings are updated with the same attributes. The request body must include at least two attributes: muted and reason.
The allowed reasons depend on whether the finding is being muted or unmuted:
To mute a finding: PENDING_FIX, FALSE_POSITIVE, ACCEPTED_RISK, OTHER.
To unmute a finding : NO_PENDING_FIX, HUMAN_ERROR, NO_LONGER_ACCEPTED_RISK, OTHER.
Meta
The request body must include a list of the finding IDs to be updated.
Data object containing the new bulk mute properties of the finding.
attributes [required]
object
The mute properties to be updated.
mute [required]
object
Object containing the new mute properties of the findings.
description
string
Additional information about the reason why those findings are muted or unmuted. This field has a maximum limit of 280 characters.
expiration_date
int64
The expiration date of the mute or unmute action (Unix ms). It must be set to a value greater than the current timestamp.
If this field is not provided, the finding will be muted or unmuted indefinitely, which is equivalent to setting the expiration date to 9999999999999.
muted [required]
boolean
Whether those findings should be muted or unmuted.
reason [required]
enum
The reason why this finding is muted or unmuted.
Allowed enum values: PENDING_FIX,FALSE_POSITIVE,ACCEPTED_RISK,NO_PENDING_FIX,HUMAN_ERROR,NO_LONGER_ACCEPTED_RISK,OTHER
id [required]
string
UUID to identify the request
meta [required]
object
Meta object containing the findings to be updated.
findings
[object]
Array of findings.
finding_id
string
The unique ID for this finding.
type [required]
enum
The JSON:API type for findings.
Allowed enum values: finding
// Mute or unmute a batch of findings returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.BulkMuteFindingsRequest{Data:datadogV2.BulkMuteFindingsRequestData{Attributes:datadogV2.BulkMuteFindingsRequestAttributes{Mute:datadogV2.BulkMuteFindingsRequestProperties{ExpirationDate:datadog.PtrInt64(1778721573794),Muted:true,Reason:datadogV2.FINDINGMUTEREASON_ACCEPTED_RISK,},},Id:"dbe5f567-192b-4404-b908-29b70e1c9f76",Meta:datadogV2.BulkMuteFindingsRequestMeta{Findings:[]datadogV2.BulkMuteFindingsRequestMetaFindings{{FindingId:datadog.PtrString("ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw=="),},},},Type:datadogV2.FINDINGTYPE_FINDING,},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()configuration.SetUnstableOperationEnabled("v2.MuteFindings",true)apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.MuteFindings(ctx,body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.MuteFindings`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.MuteFindings`:\n%s\n",responseContent)}
// Mute or unmute a batch of findings returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.BulkMuteFindingsRequest;importcom.datadog.api.client.v2.model.BulkMuteFindingsRequestAttributes;importcom.datadog.api.client.v2.model.BulkMuteFindingsRequestData;importcom.datadog.api.client.v2.model.BulkMuteFindingsRequestMeta;importcom.datadog.api.client.v2.model.BulkMuteFindingsRequestMetaFindings;importcom.datadog.api.client.v2.model.BulkMuteFindingsRequestProperties;importcom.datadog.api.client.v2.model.BulkMuteFindingsResponse;importcom.datadog.api.client.v2.model.FindingMuteReason;importcom.datadog.api.client.v2.model.FindingType;importjava.util.Collections;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();defaultClient.setUnstableOperationEnabled("v2.muteFindings",true);SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);BulkMuteFindingsRequestbody=newBulkMuteFindingsRequest().data(newBulkMuteFindingsRequestData().attributes(newBulkMuteFindingsRequestAttributes().mute(newBulkMuteFindingsRequestProperties().expirationDate(1778721573794L).muted(true).reason(FindingMuteReason.ACCEPTED_RISK))).id("dbe5f567-192b-4404-b908-29b70e1c9f76").meta(newBulkMuteFindingsRequestMeta().findings(Collections.singletonList(newBulkMuteFindingsRequestMetaFindings().findingId("ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==")))).type(FindingType.FINDING));try{BulkMuteFindingsResponseresult=apiInstance.muteFindings(body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#muteFindings");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Mute or unmute a batch of findings returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.bulk_mute_findings_requestimportBulkMuteFindingsRequestfromdatadog_api_client.v2.model.bulk_mute_findings_request_attributesimportBulkMuteFindingsRequestAttributesfromdatadog_api_client.v2.model.bulk_mute_findings_request_dataimportBulkMuteFindingsRequestDatafromdatadog_api_client.v2.model.bulk_mute_findings_request_metaimportBulkMuteFindingsRequestMetafromdatadog_api_client.v2.model.bulk_mute_findings_request_meta_findingsimportBulkMuteFindingsRequestMetaFindingsfromdatadog_api_client.v2.model.bulk_mute_findings_request_propertiesimportBulkMuteFindingsRequestPropertiesfromdatadog_api_client.v2.model.finding_mute_reasonimportFindingMuteReasonfromdatadog_api_client.v2.model.finding_typeimportFindingTypebody=BulkMuteFindingsRequest(data=BulkMuteFindingsRequestData(attributes=BulkMuteFindingsRequestAttributes(mute=BulkMuteFindingsRequestProperties(expiration_date=1778721573794,muted=True,reason=FindingMuteReason.ACCEPTED_RISK,),),id="dbe5f567-192b-4404-b908-29b70e1c9f76",meta=BulkMuteFindingsRequestMeta(findings=[BulkMuteFindingsRequestMetaFindings(finding_id="ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",),],),type=FindingType.FINDING,),)configuration=Configuration()configuration.unstable_operations["mute_findings"]=TruewithApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.mute_findings(body=body)print(response)
# Mute or unmute a batch of findings returns "OK" responserequire"datadog_api_client"DatadogAPIClient.configuredo|config|config.unstable_operations["v2.mute_findings".to_sym]=trueendapi_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newbody=DatadogAPIClient::V2::BulkMuteFindingsRequest.new({data:DatadogAPIClient::V2::BulkMuteFindingsRequestData.new({attributes:DatadogAPIClient::V2::BulkMuteFindingsRequestAttributes.new({mute:DatadogAPIClient::V2::BulkMuteFindingsRequestProperties.new({expiration_date:1778721573794,muted:true,reason:DatadogAPIClient::V2::FindingMuteReason::ACCEPTED_RISK,}),}),id:"dbe5f567-192b-4404-b908-29b70e1c9f76",meta:DatadogAPIClient::V2::BulkMuteFindingsRequestMeta.new({findings:[DatadogAPIClient::V2::BulkMuteFindingsRequestMetaFindings.new({finding_id:"ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",}),],}),type:DatadogAPIClient::V2::FindingType::FINDING,}),})papi_instance.mute_findings(body)
// Mute or unmute a batch of findings returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV2::model::BulkMuteFindingsRequest;usedatadog_api_client::datadogV2::model::BulkMuteFindingsRequestAttributes;usedatadog_api_client::datadogV2::model::BulkMuteFindingsRequestData;usedatadog_api_client::datadogV2::model::BulkMuteFindingsRequestMeta;usedatadog_api_client::datadogV2::model::BulkMuteFindingsRequestMetaFindings;usedatadog_api_client::datadogV2::model::BulkMuteFindingsRequestProperties;usedatadog_api_client::datadogV2::model::FindingMuteReason;usedatadog_api_client::datadogV2::model::FindingType;#[tokio::main]asyncfnmain(){letbody=BulkMuteFindingsRequest::new(BulkMuteFindingsRequestData::new(BulkMuteFindingsRequestAttributes::new(BulkMuteFindingsRequestProperties::new(true,FindingMuteReason::ACCEPTED_RISK).expiration_date(1778721573794),),"dbe5f567-192b-4404-b908-29b70e1c9f76".to_string(),BulkMuteFindingsRequestMeta::new().findings(vec![BulkMuteFindingsRequestMetaFindings::new().finding_id("ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==".to_string(),)]),FindingType::FINDING,));letmutconfiguration=datadog::Configuration::new();configuration.set_unstable_operation_enabled("v2.MuteFindings",true);letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.mute_findings(body).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Mute or unmute a batch of findings returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();configuration.unstableOperations["v2.muteFindings"]=true;constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiMuteFindingsRequest={body:{data:{attributes:{mute:{expirationDate: 1778721573794,muted: true,reason:"ACCEPTED_RISK",},},id:"dbe5f567-192b-4404-b908-29b70e1c9f76",meta:{findings:[{findingId:"ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",},],},type:"finding",},},};apiInstance.muteFindings(params).then((data: v2.BulkMuteFindingsResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
The expected response schema when getting a finding.
Expand All
フィールド
種類
説明
data [required]
object
A single finding with with message and resource configuration.
attributes
object
The JSON:API attributes of the detailed finding.
evaluation
enum
The evaluation of the finding.
Allowed enum values: pass,fail
evaluation_changed_at
int64
The date on which the evaluation for this finding changed (Unix ms).
message
string
The remediation message for this finding.
mute
object
Information about the mute status of this finding.
description
string
Additional information about the reason why this finding is muted or unmuted.
expiration_date
int64
The expiration date of the mute or unmute action (Unix ms).
muted
boolean
Whether this finding is muted or unmuted.
reason
enum
The reason why this finding is muted or unmuted.
Allowed enum values: PENDING_FIX,FALSE_POSITIVE,ACCEPTED_RISK,NO_PENDING_FIX,HUMAN_ERROR,NO_LONGER_ACCEPTED_RISK,OTHER
start_date
int64
The start of the mute period.
uuid
string
The ID of the user who muted or unmuted this finding.
resource
string
The resource name of this finding.
resource_configuration
object
The resource configuration for this finding.
resource_discovery_date
int64
The date on which the resource was discovered (Unix ms).
resource_type
string
The resource type of this finding.
rule
object
The rule that triggered this finding.
id
string
The ID of the rule that triggered this finding.
name
string
The name of the rule that triggered this finding.
status
enum
The status of the finding.
Allowed enum values: critical,high,medium,low,info
tags
[string]
The tags associated with this finding.
id
string
The unique ID for this finding.
type
enum
The JSON:API type for findings that have the message and resource configuration.
Allowed enum values: detailed_finding
default: detailed_finding
{"data":{"attributes":{"evaluation":"pass","evaluation_changed_at":1678721573794,"message":"## Remediation\n\n### From the console\n\n1. Go to Storage Account\n2. For each Storage Account, navigate to Data Protection\n3. Select Set soft delete enabled and enter the number of days to retain soft deleted data.","mute":{"description":"To be resolved later","expiration_date":1778721573794,"muted":true,"reason":"ACCEPTED_RISK","start_date":1678721573794,"uuid":"e51c9744-d158-11ec-ad23-da7ad0900002"},"resource":"my_resource_name","resource_configuration":{},"resource_discovery_date":1678721573794,"resource_type":"azure_storage_account","rule":{"id":"dv2-jzf-41i","name":"Soft delete is enabled for Azure Storage"},"status":"critical","tags":["cloud_provider:aws","myTag:myValue"]},"id":"ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==","type":"detailed_finding"}}
Bad Request: The server cannot process the request due to invalid syntax in the request.
"""
Get a finding returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApiconfiguration=Configuration()configuration.unstable_operations["get_finding"]=TruewithApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.get_finding(finding_id="AgAAAYd59gjghzF52gAAAAAAAAAYAAAAAEFZZDU5Z2pnQUFCRTRvV1lFeEo4SlFBQQAAACQAAAAAMDE4NzdhMDEtMDRiYS00NTZlLWFmMzMtNTIxNmNkNjVlNDMz",)print(response)
# Get a finding returns "OK" responserequire"datadog_api_client"DatadogAPIClient.configuredo|config|config.unstable_operations["v2.get_finding".to_sym]=trueendapi_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newpapi_instance.get_finding("AgAAAYd59gjghzF52gAAAAAAAAAYAAAAAEFZZDU5Z2pnQUFCRTRvV1lFeEo4SlFBQQAAACQAAAAAMDE4NzdhMDEtMDRiYS00NTZlLWFmMzMtNTIxNmNkNjVlNDMz")
// Get a finding returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()configuration.SetUnstableOperationEnabled("v2.GetFinding",true)apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.GetFinding(ctx,"AgAAAYd59gjghzF52gAAAAAAAAAYAAAAAEFZZDU5Z2pnQUFCRTRvV1lFeEo4SlFBQQAAACQAAAAAMDE4NzdhMDEtMDRiYS00NTZlLWFmMzMtNTIxNmNkNjVlNDMz",*datadogV2.NewGetFindingOptionalParameters())iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.GetFinding`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.GetFinding`:\n%s\n",responseContent)}
// Get a finding returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.GetFindingResponse;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();defaultClient.setUnstableOperationEnabled("v2.getFinding",true);SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);try{GetFindingResponseresult=apiInstance.getFinding("AgAAAYd59gjghzF52gAAAAAAAAAYAAAAAEFZZDU5Z2pnQUFCRTRvV1lFeEo4SlFBQQAAACQAAAAAMDE4NzdhMDEtMDRiYS00NTZlLWFmMzMtNTIxNmNkNjVlNDMz");System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#getFinding");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
// Get a finding returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::GetFindingOptionalParams;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){letmutconfiguration=datadog::Configuration::new();configuration.set_unstable_operation_enabled("v2.GetFinding",true);letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.get_finding("AgAAAYd59gjghzF52gAAAAAAAAAYAAAAAEFZZDU5Z2pnQUFCRTRvV1lFeEo4SlFBQQAAACQAAAAAMDE4NzdhMDEtMDRiYS00NTZlLWFmMzMtNTIxNmNkNjVlNDMz".to_string(),GetFindingOptionalParams::default(),).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get a finding returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();configuration.unstableOperations["v2.getFinding"]=true;constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiGetFindingRequest={findingId:"AgAAAYd59gjghzF52gAAAAAAAAAYAAAAAEFZZDU5Z2pnQUFCRTRvV1lFeEo4SlFBQQAAACQAAAAAMDE4NzdhMDEtMDRiYS00NTZlLWFmMzMtNTIxNmNkNjVlNDMz",};apiInstance.getFinding(params).then((data: v2.GetFindingResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
// Modify the triage assignee of a security signal returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV1")funcmain(){body:=datadogV1.SignalAssigneeUpdateRequest{Assignee:"773b045d-ccf8-4808-bd3b-955ef6a8c940",}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV1.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.EditSecurityMonitoringSignalAssignee(ctx,"AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.EditSecurityMonitoringSignalAssignee`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.EditSecurityMonitoringSignalAssignee`:\n%s\n",responseContent)}
// Modify the triage assignee of a security signal returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v1.api.SecurityMonitoringApi;importcom.datadog.api.client.v1.model.SignalAssigneeUpdateRequest;importcom.datadog.api.client.v1.model.SuccessfulSignalUpdateResponse;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);SignalAssigneeUpdateRequestbody=newSignalAssigneeUpdateRequest().assignee("773b045d-ccf8-4808-bd3b-955ef6a8c940");try{SuccessfulSignalUpdateResponseresult=apiInstance.editSecurityMonitoringSignalAssignee("AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#editSecurityMonitoringSignalAssignee");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Modify the triage assignee of a security signal returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v1.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v1.model.signal_assignee_update_requestimportSignalAssigneeUpdateRequestbody=SignalAssigneeUpdateRequest(assignee="773b045d-ccf8-4808-bd3b-955ef6a8c940",)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.edit_security_monitoring_signal_assignee(signal_id="AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body=body)print(response)
# Modify the triage assignee of a security signal returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V1::SecurityMonitoringAPI.newbody=DatadogAPIClient::V1::SignalAssigneeUpdateRequest.new({assignee:"773b045d-ccf8-4808-bd3b-955ef6a8c940",})papi_instance.edit_security_monitoring_signal_assignee("AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body)
// Modify the triage assignee of a security signal returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV1::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV1::model::SignalAssigneeUpdateRequest;#[tokio::main]asyncfnmain(){letbody=SignalAssigneeUpdateRequest::new("773b045d-ccf8-4808-bd3b-955ef6a8c940".to_string());letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.edit_security_monitoring_signal_assignee("AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE".to_string(),body,).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<API-KEY>"DD_APP_KEY="<APP-KEY>"cargo run
/**
* Modify the triage assignee of a security signal returns "OK" response
*/import{client,v1}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv1.SecurityMonitoringApi(configuration);constparams: v1.SecurityMonitoringApiEditSecurityMonitoringSignalAssigneeRequest={body:{assignee:"773b045d-ccf8-4808-bd3b-955ef6a8c940",},signalId:"AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",};apiInstance.editSecurityMonitoringSignalAssignee(params).then((data: v1.SuccessfulSignalUpdateResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
The response returned after all triage operations, containing the updated signal triage data.
Expand All
フィールド
種類
説明
data [required]
object
Data containing the updated triage attributes of the signal.
attributes
object
Attributes describing a triage state update operation over a security signal.
archive_comment
string
Optional comment to display on archived signals.
archive_comment_timestamp
int64
Timestamp of the last edit to the comment.
archive_comment_user
object
Object representing a given user entity.
handle
string
The handle for this user account.
icon
string
Gravatar icon associated to the user.
id
int64
Numerical ID assigned by Datadog to this user account.
name
string
The name for this user account.
uuid [required]
string
UUID assigned by Datadog to this user account.
archive_reason
enum
Reason a signal is archived.
Allowed enum values: none,false_positive,testing_or_maintenance,remediated,investigated_case_opened,true_positive_benign,true_positive_malicious,other
assignee [required]
object
Object representing a given user entity.
handle
string
The handle for this user account.
icon
string
Gravatar icon associated to the user.
id
int64
Numerical ID assigned by Datadog to this user account.
name
string
The name for this user account.
uuid [required]
string
UUID assigned by Datadog to this user account.
incident_ids [required]
[integer]
Array of incidents that are associated with this signal.
state [required]
enum
The new triage state of the signal.
Allowed enum values: open,archived,under_review
state_update_timestamp
int64
Timestamp of the last update to the signal state.
state_update_user
object
Object representing a given user entity.
handle
string
The handle for this user account.
icon
string
Gravatar icon associated to the user.
id
int64
Numerical ID assigned by Datadog to this user account.
name
string
The name for this user account.
uuid [required]
string
UUID assigned by Datadog to this user account.
id
string
The unique ID of the security signal.
type
enum
The type of event.
Allowed enum values: signal_metadata
// Modify the triage assignee of a security signal returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.SecurityMonitoringSignalAssigneeUpdateRequest{Data:datadogV2.SecurityMonitoringSignalAssigneeUpdateData{Attributes:datadogV2.SecurityMonitoringSignalAssigneeUpdateAttributes{Assignee:datadogV2.SecurityMonitoringTriageUser{Uuid:"",},},},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.EditSecurityMonitoringSignalAssignee(ctx,"AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.EditSecurityMonitoringSignalAssignee`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.EditSecurityMonitoringSignalAssignee`:\n%s\n",responseContent)}
// Modify the triage assignee of a security signal returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalAssigneeUpdateAttributes;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalAssigneeUpdateData;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalAssigneeUpdateRequest;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalTriageUpdateResponse;importcom.datadog.api.client.v2.model.SecurityMonitoringTriageUser;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);SecurityMonitoringSignalAssigneeUpdateRequestbody=newSecurityMonitoringSignalAssigneeUpdateRequest().data(newSecurityMonitoringSignalAssigneeUpdateData().attributes(newSecurityMonitoringSignalAssigneeUpdateAttributes().assignee(newSecurityMonitoringTriageUser().uuid(""))));try{SecurityMonitoringSignalTriageUpdateResponseresult=apiInstance.editSecurityMonitoringSignalAssignee("AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#editSecurityMonitoringSignalAssignee");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Modify the triage assignee of a security signal returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.security_monitoring_signal_assignee_update_attributesimport(SecurityMonitoringSignalAssigneeUpdateAttributes,)fromdatadog_api_client.v2.model.security_monitoring_signal_assignee_update_dataimport(SecurityMonitoringSignalAssigneeUpdateData,)fromdatadog_api_client.v2.model.security_monitoring_signal_assignee_update_requestimport(SecurityMonitoringSignalAssigneeUpdateRequest,)fromdatadog_api_client.v2.model.security_monitoring_triage_userimportSecurityMonitoringTriageUserbody=SecurityMonitoringSignalAssigneeUpdateRequest(data=SecurityMonitoringSignalAssigneeUpdateData(attributes=SecurityMonitoringSignalAssigneeUpdateAttributes(assignee=SecurityMonitoringTriageUser(uuid="",),),),)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.edit_security_monitoring_signal_assignee(signal_id="AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",body=body)print(response)
# Modify the triage assignee of a security signal returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newbody=DatadogAPIClient::V2::SecurityMonitoringSignalAssigneeUpdateRequest.new({data:DatadogAPIClient::V2::SecurityMonitoringSignalAssigneeUpdateData.new({attributes:DatadogAPIClient::V2::SecurityMonitoringSignalAssigneeUpdateAttributes.new({assignee:DatadogAPIClient::V2::SecurityMonitoringTriageUser.new({uuid:"",}),}),}),})papi_instance.edit_security_monitoring_signal_assignee("AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",body)
// Modify the triage assignee of a security signal returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV2::model::SecurityMonitoringSignalAssigneeUpdateAttributes;usedatadog_api_client::datadogV2::model::SecurityMonitoringSignalAssigneeUpdateData;usedatadog_api_client::datadogV2::model::SecurityMonitoringSignalAssigneeUpdateRequest;usedatadog_api_client::datadogV2::model::SecurityMonitoringTriageUser;#[tokio::main]asyncfnmain(){letbody=SecurityMonitoringSignalAssigneeUpdateRequest::new(SecurityMonitoringSignalAssigneeUpdateData::new(SecurityMonitoringSignalAssigneeUpdateAttributes::new(SecurityMonitoringTriageUser::new("".to_string()),),),);letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.edit_security_monitoring_signal_assignee("AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE".to_string(),body,).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Modify the triage assignee of a security signal returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiEditSecurityMonitoringSignalAssigneeRequest={body:{data:{attributes:{assignee:{uuid:"",},},},},signalId:"AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",};apiInstance.editSecurityMonitoringSignalAssignee(params).then((data: v2.SecurityMonitoringSignalTriageUpdateResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Returns the list of notification rules for security vulnerabilities.
This endpoint requires the security_monitoring_notification_profiles_read permission.
Selectors are used to filter security issues for which notifications should be generated.
Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source.
Only the trigger_source field is required.
query
string
The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
rule_types
[string]
Security rule types used as filters in security rules.
severities
[string]
The security rules severities to consider.
trigger_source [required]
enum
The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals",
while notification rules based on security vulnerabilities need to use the trigger source "security_findings".
Allowed enum values: security_findings,security_signals
targets [required]
[string]
List of recipients to notify when a notification rule is triggered. Many different target types are supported,
such as email addresses, Slack channels, and PagerDuty services.
The appropriate integrations need to be properly configured to send notifications to the specified targets.
time_aggregation
int64
Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation.
Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation.
Notifications are only sent for new issues discovered during the window.
Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation
is done.
version [required]
int64
Version of the notification rule. It is updated when the rule is modified.
id [required]
string
The ID of a notification rule.
type [required]
enum
The rule type associated to notification rules.
Allowed enum values: notification_rules
{"data":[{"attributes":{"created_at":1722439510282,"created_by":{"handle":"john.doe@domain.com","name":"John Doe"},"enabled":true,"modified_at":1722439510282,"modified_by":{"handle":"john.doe@domain.com","name":"John Doe"},"name":"Rule 1","selectors":{"query":"(source:production_service OR env:prod)","rule_types":["misconfiguration","attack_path"],"severities":["critical"],"trigger_source":"security_findings"},"targets":["@john.doe@email.com"],"time_aggregation":86400,"version":1},"id":"aaa-bbb-ccc","type":"notification_rules"}]}
"""
Get the list of vulnerability notification rules returns "The list of notification rules." response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApiconfiguration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.get_vulnerability_notification_rules()print(response)
# Get the list of vulnerability notification rules returns "The list of notification rules." responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newpapi_instance.get_vulnerability_notification_rules()
// Get the list of vulnerability notification rules returns "The list of notification rules." responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.GetVulnerabilityNotificationRules(ctx)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.GetVulnerabilityNotificationRules`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.GetVulnerabilityNotificationRules`:\n%s\n",responseContent)}
// Get the list of vulnerability notification rules returns "The list of notification rules."// responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);try{apiInstance.getVulnerabilityNotificationRules();}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#getVulnerabilityNotificationRules");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
// Get the list of vulnerability notification rules returns "The list of
// notification rules." response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.get_vulnerability_notification_rules().await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get the list of vulnerability notification rules returns "The list of notification rules." response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);apiInstance.getVulnerabilityNotificationRules().then((data: any)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Create a new notification rule for security vulnerabilities and return the created rule.
This endpoint requires the security_monitoring_notification_profiles_write permission.
リクエスト
Body Data (required)
The body of the create notification rule request is composed of the rule type and the rule attributes:
the rule name, the selectors, the notification targets, and the rule enabled status.
Data of the notification rule create request: the rule type, and the rule attributes. All fields are required.
attributes [required]
object
Attributes of the notification rule create request.
enabled
boolean
Field used to enable or disable the rule.
name [required]
string
Name of the notification rule.
selectors [required]
object
Selectors are used to filter security issues for which notifications should be generated.
Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source.
Only the trigger_source field is required.
query
string
The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
rule_types
[string]
Security rule types used as filters in security rules.
severities
[string]
The security rules severities to consider.
trigger_source [required]
enum
The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals",
while notification rules based on security vulnerabilities need to use the trigger source "security_findings".
Allowed enum values: security_findings,security_signals
targets [required]
[string]
List of recipients to notify when a notification rule is triggered. Many different target types are supported,
such as email addresses, Slack channels, and PagerDuty services.
The appropriate integrations need to be properly configured to send notifications to the specified targets.
time_aggregation
int64
Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation.
Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation.
Notifications are only sent for new issues discovered during the window.
Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation
is done.
type [required]
enum
The rule type associated to notification rules.
Allowed enum values: notification_rules
{"data":{"attributes":{"enabled":true,"name":"Rule 1","selectors":{"query":"(source:production_service OR env:prod)","rule_types":["misconfiguration","attack_path"],"severities":["critical"],"trigger_source":"security_findings"},"targets":["@john.doe@email.com"],"time_aggregation":86400},"type":"notification_rules"}}
{"data":{"attributes":{"enabled":true,"name":"Example-Security-Monitoring","selectors":{"query":"(source:production_service OR env:prod)","rule_types":["sast_vulnerability","secret_vulnerability"],"severities":["critical"],"trigger_source":"security_findings"},"targets":["@john.doe@email.com"],"time_aggregation":86400},"type":"notification_rules"}}
Response object which includes a notification rule.
Expand All
フィールド
種類
説明
data
object
Notification rules allow full control over notifications generated by the various Datadog security products.
They allow users to define the conditions under which a notification should be generated (based on rule severities,
rule types, rule tags, and so on), and the targets to notify.
A notification rule is composed of a rule ID, a rule type, and the rule attributes. All fields are required.
attributes [required]
object
Attributes of the notification rule.
created_at [required]
int64
Date as Unix timestamp in milliseconds.
created_by [required]
object
User creating or modifying a rule.
handle
string
The user handle.
name
string
The user name.
enabled [required]
boolean
Field used to enable or disable the rule.
modified_at [required]
int64
Date as Unix timestamp in milliseconds.
modified_by [required]
object
User creating or modifying a rule.
handle
string
The user handle.
name
string
The user name.
name [required]
string
Name of the notification rule.
selectors [required]
object
Selectors are used to filter security issues for which notifications should be generated.
Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source.
Only the trigger_source field is required.
query
string
The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
rule_types
[string]
Security rule types used as filters in security rules.
severities
[string]
The security rules severities to consider.
trigger_source [required]
enum
The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals",
while notification rules based on security vulnerabilities need to use the trigger source "security_findings".
Allowed enum values: security_findings,security_signals
targets [required]
[string]
List of recipients to notify when a notification rule is triggered. Many different target types are supported,
such as email addresses, Slack channels, and PagerDuty services.
The appropriate integrations need to be properly configured to send notifications to the specified targets.
time_aggregation
int64
Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation.
Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation.
Notifications are only sent for new issues discovered during the window.
Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation
is done.
version [required]
int64
Version of the notification rule. It is updated when the rule is modified.
id [required]
string
The ID of a notification rule.
type [required]
enum
The rule type associated to notification rules.
Allowed enum values: notification_rules
{"data":{"attributes":{"created_at":1722439510282,"created_by":{"handle":"john.doe@domain.com","name":"John Doe"},"enabled":true,"modified_at":1722439510282,"modified_by":{"handle":"john.doe@domain.com","name":"John Doe"},"name":"Rule 1","selectors":{"query":"(source:production_service OR env:prod)","rule_types":["misconfiguration","attack_path"],"severities":["critical"],"trigger_source":"security_findings"},"targets":["@john.doe@email.com"],"time_aggregation":86400,"version":1},"id":"aaa-bbb-ccc","type":"notification_rules"}}
// Create a new vulnerability-based notification rule returns "Successfully created the notification rule." responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.CreateNotificationRuleParameters{Data:&datadogV2.CreateNotificationRuleParametersData{Attributes:datadogV2.CreateNotificationRuleParametersDataAttributes{Enabled:datadog.PtrBool(true),Name:"Rule 1",Selectors:datadogV2.Selectors{Query:datadog.PtrString("(source:production_service OR env:prod)"),RuleTypes:[]datadogV2.RuleTypesItems{datadogV2.RULETYPESITEMS_MISCONFIGURATION,datadogV2.RULETYPESITEMS_ATTACK_PATH,},Severities:[]datadogV2.RuleSeverity{datadogV2.RULESEVERITY_CRITICAL,},TriggerSource:datadogV2.TRIGGERSOURCE_SECURITY_FINDINGS,},Targets:[]string{"@john.doe@email.com",},TimeAggregation:datadog.PtrInt64(86400),},Type:datadogV2.NOTIFICATIONRULESTYPE_NOTIFICATION_RULES,},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.CreateVulnerabilityNotificationRule(ctx,body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.CreateVulnerabilityNotificationRule`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.CreateVulnerabilityNotificationRule`:\n%s\n",responseContent)}
// Create a new vulnerability-based notification rule returns "Successfully created the notification// rule." responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.CreateNotificationRuleParameters;importcom.datadog.api.client.v2.model.CreateNotificationRuleParametersData;importcom.datadog.api.client.v2.model.CreateNotificationRuleParametersDataAttributes;importcom.datadog.api.client.v2.model.NotificationRuleResponse;importcom.datadog.api.client.v2.model.NotificationRulesType;importcom.datadog.api.client.v2.model.RuleSeverity;importcom.datadog.api.client.v2.model.RuleTypesItems;importcom.datadog.api.client.v2.model.Selectors;importcom.datadog.api.client.v2.model.TriggerSource;importjava.util.Arrays;importjava.util.Collections;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);CreateNotificationRuleParametersbody=newCreateNotificationRuleParameters().data(newCreateNotificationRuleParametersData().attributes(newCreateNotificationRuleParametersDataAttributes().enabled(true).name("Rule 1").selectors(newSelectors().query("(source:production_service OR env:prod)").ruleTypes(Arrays.asList(RuleTypesItems.MISCONFIGURATION,RuleTypesItems.ATTACK_PATH)).severities(Collections.singletonList(RuleSeverity.CRITICAL)).triggerSource(TriggerSource.SECURITY_FINDINGS)).targets(Collections.singletonList("@john.doe@email.com")).timeAggregation(86400L)).type(NotificationRulesType.NOTIFICATION_RULES));try{NotificationRuleResponseresult=apiInstance.createVulnerabilityNotificationRule(body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#createVulnerabilityNotificationRule");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Create a new vulnerability-based notification rule returns "Successfully created the notification rule." response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.create_notification_rule_parametersimportCreateNotificationRuleParametersfromdatadog_api_client.v2.model.create_notification_rule_parameters_dataimportCreateNotificationRuleParametersDatafromdatadog_api_client.v2.model.create_notification_rule_parameters_data_attributesimport(CreateNotificationRuleParametersDataAttributes,)fromdatadog_api_client.v2.model.notification_rules_typeimportNotificationRulesTypefromdatadog_api_client.v2.model.rule_severityimportRuleSeverityfromdatadog_api_client.v2.model.rule_types_itemsimportRuleTypesItemsfromdatadog_api_client.v2.model.selectorsimportSelectorsfromdatadog_api_client.v2.model.trigger_sourceimportTriggerSourcebody=CreateNotificationRuleParameters(data=CreateNotificationRuleParametersData(attributes=CreateNotificationRuleParametersDataAttributes(enabled=True,name="Rule 1",selectors=Selectors(query="(source:production_service OR env:prod)",rule_types=[RuleTypesItems.MISCONFIGURATION,RuleTypesItems.ATTACK_PATH,],severities=[RuleSeverity.CRITICAL,],trigger_source=TriggerSource.SECURITY_FINDINGS,),targets=["@john.doe@email.com",],time_aggregation=86400,),type=NotificationRulesType.NOTIFICATION_RULES,),)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.create_vulnerability_notification_rule(body=body)print(response)
# Create a new vulnerability-based notification rule returns "Successfully created the notification rule." responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newbody=DatadogAPIClient::V2::CreateNotificationRuleParameters.new({data:DatadogAPIClient::V2::CreateNotificationRuleParametersData.new({attributes:DatadogAPIClient::V2::CreateNotificationRuleParametersDataAttributes.new({enabled:true,name:"Rule 1",selectors:DatadogAPIClient::V2::Selectors.new({query:"(source:production_service OR env:prod)",rule_types:[DatadogAPIClient::V2::RuleTypesItems::MISCONFIGURATION,DatadogAPIClient::V2::RuleTypesItems::ATTACK_PATH,],severities:[DatadogAPIClient::V2::RuleSeverity::CRITICAL,],trigger_source:DatadogAPIClient::V2::TriggerSource::SECURITY_FINDINGS,}),targets:["@john.doe@email.com",],time_aggregation:86400,}),type:DatadogAPIClient::V2::NotificationRulesType::NOTIFICATION_RULES,}),})papi_instance.create_vulnerability_notification_rule(body)
// Create a new vulnerability-based notification rule returns "Successfully
// created the notification rule." response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV2::model::CreateNotificationRuleParameters;usedatadog_api_client::datadogV2::model::CreateNotificationRuleParametersData;usedatadog_api_client::datadogV2::model::CreateNotificationRuleParametersDataAttributes;usedatadog_api_client::datadogV2::model::NotificationRulesType;usedatadog_api_client::datadogV2::model::RuleSeverity;usedatadog_api_client::datadogV2::model::RuleTypesItems;usedatadog_api_client::datadogV2::model::Selectors;usedatadog_api_client::datadogV2::model::TriggerSource;#[tokio::main]asyncfnmain(){letbody=CreateNotificationRuleParameters::new().data(CreateNotificationRuleParametersData::new(CreateNotificationRuleParametersDataAttributes::new("Rule 1".to_string(),Selectors::new(TriggerSource::SECURITY_FINDINGS).query("(source:production_service OR env:prod)".to_string()).rule_types(vec![RuleTypesItems::MISCONFIGURATION,RuleTypesItems::ATTACK_PATH,]).severities(vec![RuleSeverity::CRITICAL]),vec!["@john.doe@email.com".to_string()],).enabled(true).time_aggregation(86400),NotificationRulesType::NOTIFICATION_RULES,));letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.create_vulnerability_notification_rule(body).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Create a new vulnerability-based notification rule returns "Successfully created the notification rule." response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiCreateVulnerabilityNotificationRuleRequest={body:{data:{attributes:{enabled: true,name:"Rule 1",selectors:{query:"(source:production_service OR env:prod)",ruleTypes:["misconfiguration","attack_path"],severities:["critical"],triggerSource:"security_findings",},targets:["@john.doe@email.com"],timeAggregation: 86400,},type:"notification_rules",},},};apiInstance.createVulnerabilityNotificationRule(params).then((data: v2.NotificationRuleResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Get the details of a notification rule for security vulnerabilities.
This endpoint requires the security_monitoring_notification_profiles_read permission.
Response object which includes a notification rule.
Expand All
フィールド
種類
説明
data
object
Notification rules allow full control over notifications generated by the various Datadog security products.
They allow users to define the conditions under which a notification should be generated (based on rule severities,
rule types, rule tags, and so on), and the targets to notify.
A notification rule is composed of a rule ID, a rule type, and the rule attributes. All fields are required.
attributes [required]
object
Attributes of the notification rule.
created_at [required]
int64
Date as Unix timestamp in milliseconds.
created_by [required]
object
User creating or modifying a rule.
handle
string
The user handle.
name
string
The user name.
enabled [required]
boolean
Field used to enable or disable the rule.
modified_at [required]
int64
Date as Unix timestamp in milliseconds.
modified_by [required]
object
User creating or modifying a rule.
handle
string
The user handle.
name
string
The user name.
name [required]
string
Name of the notification rule.
selectors [required]
object
Selectors are used to filter security issues for which notifications should be generated.
Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source.
Only the trigger_source field is required.
query
string
The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
rule_types
[string]
Security rule types used as filters in security rules.
severities
[string]
The security rules severities to consider.
trigger_source [required]
enum
The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals",
while notification rules based on security vulnerabilities need to use the trigger source "security_findings".
Allowed enum values: security_findings,security_signals
targets [required]
[string]
List of recipients to notify when a notification rule is triggered. Many different target types are supported,
such as email addresses, Slack channels, and PagerDuty services.
The appropriate integrations need to be properly configured to send notifications to the specified targets.
time_aggregation
int64
Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation.
Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation.
Notifications are only sent for new issues discovered during the window.
Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation
is done.
version [required]
int64
Version of the notification rule. It is updated when the rule is modified.
id [required]
string
The ID of a notification rule.
type [required]
enum
The rule type associated to notification rules.
Allowed enum values: notification_rules
{"data":{"attributes":{"created_at":1722439510282,"created_by":{"handle":"john.doe@domain.com","name":"John Doe"},"enabled":true,"modified_at":1722439510282,"modified_by":{"handle":"john.doe@domain.com","name":"John Doe"},"name":"Rule 1","selectors":{"query":"(source:production_service OR env:prod)","rule_types":["misconfiguration","attack_path"],"severities":["critical"],"trigger_source":"security_findings"},"targets":["@john.doe@email.com"],"time_aggregation":86400,"version":1},"id":"aaa-bbb-ccc","type":"notification_rules"}}
"""
Get details of a vulnerability notification rule returns "Notification rule details." response
"""fromosimportenvironfromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApi# there is a valid "valid_vulnerability_notification_rule" in the systemVALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID=environ["VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID"]configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.get_vulnerability_notification_rule(id=VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID,)print(response)
# Get details of a vulnerability notification rule returns "Notification rule details." responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.new# there is a valid "valid_vulnerability_notification_rule" in the systemVALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID=ENV["VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID"]papi_instance.get_vulnerability_notification_rule(VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID)
// Get details of a vulnerability notification rule returns "Notification rule details." responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){// there is a valid "valid_vulnerability_notification_rule" in the systemValidVulnerabilityNotificationRuleDataID:=os.Getenv("VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID")ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.GetVulnerabilityNotificationRule(ctx,ValidVulnerabilityNotificationRuleDataID)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.GetVulnerabilityNotificationRule`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.GetVulnerabilityNotificationRule`:\n%s\n",responseContent)}
// Get details of a vulnerability notification rule returns "Notification rule details." responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.NotificationRuleResponse;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);// there is a valid "valid_vulnerability_notification_rule" in the systemStringVALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID=System.getenv("VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID");try{NotificationRuleResponseresult=apiInstance.getVulnerabilityNotificationRule(VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#getVulnerabilityNotificationRule");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
// Get details of a vulnerability notification rule returns "Notification rule
// details." response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){// there is a valid "valid_vulnerability_notification_rule" in the system
letvalid_vulnerability_notification_rule_data_id=std::env::var("VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID").unwrap();letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.get_vulnerability_notification_rule(valid_vulnerability_notification_rule_data_id.clone()).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get details of a vulnerability notification rule returns "Notification rule details." response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);// there is a valid "valid_vulnerability_notification_rule" in the system
constVALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID=process.env.VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_IDasstring;constparams: v2.SecurityMonitoringApiGetVulnerabilityNotificationRuleRequest={id: VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID,};apiInstance.getVulnerabilityNotificationRule(params).then((data: v2.NotificationRuleResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
"""
Delete a vulnerability-based notification rule returns "Rule successfully deleted." response
"""fromosimportenvironfromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApi# there is a valid "valid_vulnerability_notification_rule" in the systemVALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID=environ["VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID"]configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)api_instance.delete_vulnerability_notification_rule(id=VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID,)
# Delete a vulnerability-based notification rule returns "Rule successfully deleted." responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.new# there is a valid "valid_vulnerability_notification_rule" in the systemVALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID=ENV["VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID"]api_instance.delete_vulnerability_notification_rule(VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID)
// Delete a vulnerability-based notification rule returns "Rule successfully deleted." responsepackagemainimport("context""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){// there is a valid "valid_vulnerability_notification_rule" in the systemValidVulnerabilityNotificationRuleDataID:=os.Getenv("VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID")ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)r,err:=api.DeleteVulnerabilityNotificationRule(ctx,ValidVulnerabilityNotificationRuleDataID)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.DeleteVulnerabilityNotificationRule`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}}
// Delete a vulnerability-based notification rule returns "Rule successfully deleted." responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);// there is a valid "valid_vulnerability_notification_rule" in the systemStringVALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID=System.getenv("VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID");try{apiInstance.deleteVulnerabilityNotificationRule(VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#deleteVulnerabilityNotificationRule");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
// Delete a vulnerability-based notification rule returns "Rule successfully
// deleted." response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){// there is a valid "valid_vulnerability_notification_rule" in the system
letvalid_vulnerability_notification_rule_data_id=std::env::var("VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID").unwrap();letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.delete_vulnerability_notification_rule(valid_vulnerability_notification_rule_data_id.clone(),).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Delete a vulnerability-based notification rule returns "Rule successfully deleted." response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);// there is a valid "valid_vulnerability_notification_rule" in the system
constVALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID=process.env.VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_IDasstring;constparams: v2.SecurityMonitoringApiDeleteVulnerabilityNotificationRuleRequest={id: VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID,};apiInstance.deleteVulnerabilityNotificationRule(params).then((data: any)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Partially update the notification rule. All fields are optional; if a field is not provided, it is not updated.
This endpoint requires the security_monitoring_notification_profiles_write permission.
Data of the notification rule patch request: the rule ID, the rule type, and the rule attributes. All fields are required.
attributes [required]
object
Attributes of the notification rule patch request. It is required to update the version of the rule when patching it.
enabled
boolean
Field used to enable or disable the rule.
name
string
Name of the notification rule.
selectors
object
Selectors are used to filter security issues for which notifications should be generated.
Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source.
Only the trigger_source field is required.
query
string
The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
rule_types
[string]
Security rule types used as filters in security rules.
severities
[string]
The security rules severities to consider.
trigger_source [required]
enum
The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals",
while notification rules based on security vulnerabilities need to use the trigger source "security_findings".
Allowed enum values: security_findings,security_signals
targets
[string]
List of recipients to notify when a notification rule is triggered. Many different target types are supported,
such as email addresses, Slack channels, and PagerDuty services.
The appropriate integrations need to be properly configured to send notifications to the specified targets.
time_aggregation
int64
Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation.
Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation.
Notifications are only sent for new issues discovered during the window.
Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation
is done.
version
int64
Version of the notification rule. It is updated when the rule is modified.
id [required]
string
The ID of a notification rule.
type [required]
enum
The rule type associated to notification rules.
Allowed enum values: notification_rules
{"data":{"attributes":{"enabled":true,"name":"Rule 1","selectors":{"query":"(source:production_service OR env:prod)","rule_types":["misconfiguration","attack_path"],"severities":["critical"],"trigger_source":"security_findings"},"targets":["@john.doe@email.com"],"time_aggregation":86400,"version":1},"id":"aaa-bbb-ccc","type":"notification_rules"}}
Response object which includes a notification rule.
Expand All
フィールド
種類
説明
data
object
Notification rules allow full control over notifications generated by the various Datadog security products.
They allow users to define the conditions under which a notification should be generated (based on rule severities,
rule types, rule tags, and so on), and the targets to notify.
A notification rule is composed of a rule ID, a rule type, and the rule attributes. All fields are required.
attributes [required]
object
Attributes of the notification rule.
created_at [required]
int64
Date as Unix timestamp in milliseconds.
created_by [required]
object
User creating or modifying a rule.
handle
string
The user handle.
name
string
The user name.
enabled [required]
boolean
Field used to enable or disable the rule.
modified_at [required]
int64
Date as Unix timestamp in milliseconds.
modified_by [required]
object
User creating or modifying a rule.
handle
string
The user handle.
name
string
The user name.
name [required]
string
Name of the notification rule.
selectors [required]
object
Selectors are used to filter security issues for which notifications should be generated.
Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source.
Only the trigger_source field is required.
query
string
The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
rule_types
[string]
Security rule types used as filters in security rules.
severities
[string]
The security rules severities to consider.
trigger_source [required]
enum
The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals",
while notification rules based on security vulnerabilities need to use the trigger source "security_findings".
Allowed enum values: security_findings,security_signals
targets [required]
[string]
List of recipients to notify when a notification rule is triggered. Many different target types are supported,
such as email addresses, Slack channels, and PagerDuty services.
The appropriate integrations need to be properly configured to send notifications to the specified targets.
time_aggregation
int64
Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation.
Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation.
Notifications are only sent for new issues discovered during the window.
Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation
is done.
version [required]
int64
Version of the notification rule. It is updated when the rule is modified.
id [required]
string
The ID of a notification rule.
type [required]
enum
The rule type associated to notification rules.
Allowed enum values: notification_rules
{"data":{"attributes":{"created_at":1722439510282,"created_by":{"handle":"john.doe@domain.com","name":"John Doe"},"enabled":true,"modified_at":1722439510282,"modified_by":{"handle":"john.doe@domain.com","name":"John Doe"},"name":"Rule 1","selectors":{"query":"(source:production_service OR env:prod)","rule_types":["misconfiguration","attack_path"],"severities":["critical"],"trigger_source":"security_findings"},"targets":["@john.doe@email.com"],"time_aggregation":86400,"version":1},"id":"aaa-bbb-ccc","type":"notification_rules"}}
// Patch a vulnerability-based notification rule returns "Notification rule successfully patched." responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){// there is a valid "valid_vulnerability_notification_rule" in the systemValidVulnerabilityNotificationRuleDataID:=os.Getenv("VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID")body:=datadogV2.PatchNotificationRuleParameters{Data:&datadogV2.PatchNotificationRuleParametersData{Attributes:datadogV2.PatchNotificationRuleParametersDataAttributes{Enabled:datadog.PtrBool(true),Name:datadog.PtrString("Rule 1"),Selectors:&datadogV2.Selectors{Query:datadog.PtrString("(source:production_service OR env:prod)"),RuleTypes:[]datadogV2.RuleTypesItems{datadogV2.RULETYPESITEMS_MISCONFIGURATION,datadogV2.RULETYPESITEMS_ATTACK_PATH,},Severities:[]datadogV2.RuleSeverity{datadogV2.RULESEVERITY_CRITICAL,},TriggerSource:datadogV2.TRIGGERSOURCE_SECURITY_FINDINGS,},Targets:[]string{"@john.doe@email.com",},TimeAggregation:datadog.PtrInt64(86400),Version:datadog.PtrInt64(1),},Id:ValidVulnerabilityNotificationRuleDataID,Type:datadogV2.NOTIFICATIONRULESTYPE_NOTIFICATION_RULES,},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.PatchVulnerabilityNotificationRule(ctx,ValidVulnerabilityNotificationRuleDataID,body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.PatchVulnerabilityNotificationRule`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.PatchVulnerabilityNotificationRule`:\n%s\n",responseContent)}
// Patch a vulnerability-based notification rule returns "Notification rule successfully patched."// responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.NotificationRuleResponse;importcom.datadog.api.client.v2.model.NotificationRulesType;importcom.datadog.api.client.v2.model.PatchNotificationRuleParameters;importcom.datadog.api.client.v2.model.PatchNotificationRuleParametersData;importcom.datadog.api.client.v2.model.PatchNotificationRuleParametersDataAttributes;importcom.datadog.api.client.v2.model.RuleSeverity;importcom.datadog.api.client.v2.model.RuleTypesItems;importcom.datadog.api.client.v2.model.Selectors;importcom.datadog.api.client.v2.model.TriggerSource;importjava.util.Arrays;importjava.util.Collections;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);// there is a valid "valid_vulnerability_notification_rule" in the systemStringVALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID=System.getenv("VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID");PatchNotificationRuleParametersbody=newPatchNotificationRuleParameters().data(newPatchNotificationRuleParametersData().attributes(newPatchNotificationRuleParametersDataAttributes().enabled(true).name("Rule 1").selectors(newSelectors().query("(source:production_service OR env:prod)").ruleTypes(Arrays.asList(RuleTypesItems.MISCONFIGURATION,RuleTypesItems.ATTACK_PATH)).severities(Collections.singletonList(RuleSeverity.CRITICAL)).triggerSource(TriggerSource.SECURITY_FINDINGS)).targets(Collections.singletonList("@john.doe@email.com")).timeAggregation(86400L).version(1L)).id(VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID).type(NotificationRulesType.NOTIFICATION_RULES));try{NotificationRuleResponseresult=apiInstance.patchVulnerabilityNotificationRule(VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID,body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#patchVulnerabilityNotificationRule");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Patch a vulnerability-based notification rule returns "Notification rule successfully patched." response
"""fromosimportenvironfromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.notification_rules_typeimportNotificationRulesTypefromdatadog_api_client.v2.model.patch_notification_rule_parametersimportPatchNotificationRuleParametersfromdatadog_api_client.v2.model.patch_notification_rule_parameters_dataimportPatchNotificationRuleParametersDatafromdatadog_api_client.v2.model.patch_notification_rule_parameters_data_attributesimport(PatchNotificationRuleParametersDataAttributes,)fromdatadog_api_client.v2.model.rule_severityimportRuleSeverityfromdatadog_api_client.v2.model.rule_types_itemsimportRuleTypesItemsfromdatadog_api_client.v2.model.selectorsimportSelectorsfromdatadog_api_client.v2.model.trigger_sourceimportTriggerSource# there is a valid "valid_vulnerability_notification_rule" in the systemVALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID=environ["VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID"]body=PatchNotificationRuleParameters(data=PatchNotificationRuleParametersData(attributes=PatchNotificationRuleParametersDataAttributes(enabled=True,name="Rule 1",selectors=Selectors(query="(source:production_service OR env:prod)",rule_types=[RuleTypesItems.MISCONFIGURATION,RuleTypesItems.ATTACK_PATH,],severities=[RuleSeverity.CRITICAL,],trigger_source=TriggerSource.SECURITY_FINDINGS,),targets=["@john.doe@email.com",],time_aggregation=86400,version=1,),id=VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID,type=NotificationRulesType.NOTIFICATION_RULES,),)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.patch_vulnerability_notification_rule(id=VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID,body=body)print(response)
# Patch a vulnerability-based notification rule returns "Notification rule successfully patched." responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.new# there is a valid "valid_vulnerability_notification_rule" in the systemVALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID=ENV["VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID"]body=DatadogAPIClient::V2::PatchNotificationRuleParameters.new({data:DatadogAPIClient::V2::PatchNotificationRuleParametersData.new({attributes:DatadogAPIClient::V2::PatchNotificationRuleParametersDataAttributes.new({enabled:true,name:"Rule 1",selectors:DatadogAPIClient::V2::Selectors.new({query:"(source:production_service OR env:prod)",rule_types:[DatadogAPIClient::V2::RuleTypesItems::MISCONFIGURATION,DatadogAPIClient::V2::RuleTypesItems::ATTACK_PATH,],severities:[DatadogAPIClient::V2::RuleSeverity::CRITICAL,],trigger_source:DatadogAPIClient::V2::TriggerSource::SECURITY_FINDINGS,}),targets:["@john.doe@email.com",],time_aggregation:86400,version:1,}),id:VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID,type:DatadogAPIClient::V2::NotificationRulesType::NOTIFICATION_RULES,}),})papi_instance.patch_vulnerability_notification_rule(VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID,body)
// Patch a vulnerability-based notification rule returns "Notification rule
// successfully patched." response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV2::model::NotificationRulesType;usedatadog_api_client::datadogV2::model::PatchNotificationRuleParameters;usedatadog_api_client::datadogV2::model::PatchNotificationRuleParametersData;usedatadog_api_client::datadogV2::model::PatchNotificationRuleParametersDataAttributes;usedatadog_api_client::datadogV2::model::RuleSeverity;usedatadog_api_client::datadogV2::model::RuleTypesItems;usedatadog_api_client::datadogV2::model::Selectors;usedatadog_api_client::datadogV2::model::TriggerSource;#[tokio::main]asyncfnmain(){// there is a valid "valid_vulnerability_notification_rule" in the system
letvalid_vulnerability_notification_rule_data_id=std::env::var("VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID").unwrap();letbody=PatchNotificationRuleParameters::new().data(PatchNotificationRuleParametersData::new(PatchNotificationRuleParametersDataAttributes::new().enabled(true).name("Rule 1".to_string()).selectors(Selectors::new(TriggerSource::SECURITY_FINDINGS).query("(source:production_service OR env:prod)".to_string()).rule_types(vec![RuleTypesItems::MISCONFIGURATION,RuleTypesItems::ATTACK_PATH,]).severities(vec![RuleSeverity::CRITICAL]),).targets(vec!["@john.doe@email.com".to_string()]).time_aggregation(86400).version(1),valid_vulnerability_notification_rule_data_id.clone(),NotificationRulesType::NOTIFICATION_RULES,));letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.patch_vulnerability_notification_rule(valid_vulnerability_notification_rule_data_id.clone(),body,).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Patch a vulnerability-based notification rule returns "Notification rule successfully patched." response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);// there is a valid "valid_vulnerability_notification_rule" in the system
constVALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID=process.env.VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_IDasstring;constparams: v2.SecurityMonitoringApiPatchVulnerabilityNotificationRuleRequest={body:{data:{attributes:{enabled: true,name:"Rule 1",selectors:{query:"(source:production_service OR env:prod)",ruleTypes:["misconfiguration","attack_path"],severities:["critical"],triggerSource:"security_findings",},targets:["@john.doe@email.com"],timeAggregation: 86400,version: 1,},id: VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID,type:"notification_rules",},},id: VALID_VULNERABILITY_NOTIFICATION_RULE_DATA_ID,};apiInstance.patchVulnerabilityNotificationRule(params).then((data: v2.NotificationRuleResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Selectors are used to filter security issues for which notifications should be generated.
Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source.
Only the trigger_source field is required.
query
string
The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
rule_types
[string]
Security rule types used as filters in security rules.
severities
[string]
The security rules severities to consider.
trigger_source [required]
enum
The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals",
while notification rules based on security vulnerabilities need to use the trigger source "security_findings".
Allowed enum values: security_findings,security_signals
targets [required]
[string]
List of recipients to notify when a notification rule is triggered. Many different target types are supported,
such as email addresses, Slack channels, and PagerDuty services.
The appropriate integrations need to be properly configured to send notifications to the specified targets.
time_aggregation
int64
Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation.
Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation.
Notifications are only sent for new issues discovered during the window.
Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation
is done.
version [required]
int64
Version of the notification rule. It is updated when the rule is modified.
id [required]
string
The ID of a notification rule.
type [required]
enum
The rule type associated to notification rules.
Allowed enum values: notification_rules
{"data":[{"attributes":{"created_at":1722439510282,"created_by":{"handle":"john.doe@domain.com","name":"John Doe"},"enabled":true,"modified_at":1722439510282,"modified_by":{"handle":"john.doe@domain.com","name":"John Doe"},"name":"Rule 1","selectors":{"query":"(source:production_service OR env:prod)","rule_types":["misconfiguration","attack_path"],"severities":["critical"],"trigger_source":"security_findings"},"targets":["@john.doe@email.com"],"time_aggregation":86400,"version":1},"id":"aaa-bbb-ccc","type":"notification_rules"}]}
"""
Get the list of signal-based notification rules returns "The list of notification rules." response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApiconfiguration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.get_signal_notification_rules()print(response)
# Get the list of signal-based notification rules returns "The list of notification rules." responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newpapi_instance.get_signal_notification_rules()
// Get the list of signal-based notification rules returns "The list of notification rules." responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.GetSignalNotificationRules(ctx)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.GetSignalNotificationRules`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.GetSignalNotificationRules`:\n%s\n",responseContent)}
// Get the list of signal-based notification rules returns "The list of notification rules."// responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);try{apiInstance.getSignalNotificationRules();}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#getSignalNotificationRules");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
// Get the list of signal-based notification rules returns "The list of
// notification rules." response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.get_signal_notification_rules().await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get the list of signal-based notification rules returns "The list of notification rules." response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);apiInstance.getSignalNotificationRules().then((data: any)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Create a new notification rule for security signals and return the created rule.
This endpoint requires the security_monitoring_notification_profiles_write permission.
リクエスト
Body Data (required)
The body of the create notification rule request is composed of the rule type and the rule attributes:
the rule name, the selectors, the notification targets, and the rule enabled status.
Data of the notification rule create request: the rule type, and the rule attributes. All fields are required.
attributes [required]
object
Attributes of the notification rule create request.
enabled
boolean
Field used to enable or disable the rule.
name [required]
string
Name of the notification rule.
selectors [required]
object
Selectors are used to filter security issues for which notifications should be generated.
Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source.
Only the trigger_source field is required.
query
string
The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
rule_types
[string]
Security rule types used as filters in security rules.
severities
[string]
The security rules severities to consider.
trigger_source [required]
enum
The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals",
while notification rules based on security vulnerabilities need to use the trigger source "security_findings".
Allowed enum values: security_findings,security_signals
targets [required]
[string]
List of recipients to notify when a notification rule is triggered. Many different target types are supported,
such as email addresses, Slack channels, and PagerDuty services.
The appropriate integrations need to be properly configured to send notifications to the specified targets.
time_aggregation
int64
Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation.
Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation.
Notifications are only sent for new issues discovered during the window.
Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation
is done.
type [required]
enum
The rule type associated to notification rules.
Allowed enum values: notification_rules
{"data":{"attributes":{"enabled":true,"name":"Rule 1","selectors":{"query":"(source:production_service OR env:prod)","rule_types":["misconfiguration","attack_path"],"severities":["critical"],"trigger_source":"security_findings"},"targets":["@john.doe@email.com"],"time_aggregation":86400},"type":"notification_rules"}}
Response object which includes a notification rule.
Expand All
フィールド
種類
説明
data
object
Notification rules allow full control over notifications generated by the various Datadog security products.
They allow users to define the conditions under which a notification should be generated (based on rule severities,
rule types, rule tags, and so on), and the targets to notify.
A notification rule is composed of a rule ID, a rule type, and the rule attributes. All fields are required.
attributes [required]
object
Attributes of the notification rule.
created_at [required]
int64
Date as Unix timestamp in milliseconds.
created_by [required]
object
User creating or modifying a rule.
handle
string
The user handle.
name
string
The user name.
enabled [required]
boolean
Field used to enable or disable the rule.
modified_at [required]
int64
Date as Unix timestamp in milliseconds.
modified_by [required]
object
User creating or modifying a rule.
handle
string
The user handle.
name
string
The user name.
name [required]
string
Name of the notification rule.
selectors [required]
object
Selectors are used to filter security issues for which notifications should be generated.
Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source.
Only the trigger_source field is required.
query
string
The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
rule_types
[string]
Security rule types used as filters in security rules.
severities
[string]
The security rules severities to consider.
trigger_source [required]
enum
The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals",
while notification rules based on security vulnerabilities need to use the trigger source "security_findings".
Allowed enum values: security_findings,security_signals
targets [required]
[string]
List of recipients to notify when a notification rule is triggered. Many different target types are supported,
such as email addresses, Slack channels, and PagerDuty services.
The appropriate integrations need to be properly configured to send notifications to the specified targets.
time_aggregation
int64
Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation.
Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation.
Notifications are only sent for new issues discovered during the window.
Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation
is done.
version [required]
int64
Version of the notification rule. It is updated when the rule is modified.
id [required]
string
The ID of a notification rule.
type [required]
enum
The rule type associated to notification rules.
Allowed enum values: notification_rules
{"data":{"attributes":{"created_at":1722439510282,"created_by":{"handle":"john.doe@domain.com","name":"John Doe"},"enabled":true,"modified_at":1722439510282,"modified_by":{"handle":"john.doe@domain.com","name":"John Doe"},"name":"Rule 1","selectors":{"query":"(source:production_service OR env:prod)","rule_types":["misconfiguration","attack_path"],"severities":["critical"],"trigger_source":"security_findings"},"targets":["@john.doe@email.com"],"time_aggregation":86400,"version":1},"id":"aaa-bbb-ccc","type":"notification_rules"}}
// Create a new signal-based notification rule returns "Successfully created the notification rule." responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.CreateNotificationRuleParameters{Data:&datadogV2.CreateNotificationRuleParametersData{Attributes:datadogV2.CreateNotificationRuleParametersDataAttributes{Enabled:datadog.PtrBool(true),Name:"Rule 1",Selectors:datadogV2.Selectors{Query:datadog.PtrString("(source:production_service OR env:prod)"),RuleTypes:[]datadogV2.RuleTypesItems{datadogV2.RULETYPESITEMS_MISCONFIGURATION,datadogV2.RULETYPESITEMS_ATTACK_PATH,},Severities:[]datadogV2.RuleSeverity{datadogV2.RULESEVERITY_CRITICAL,},TriggerSource:datadogV2.TRIGGERSOURCE_SECURITY_FINDINGS,},Targets:[]string{"@john.doe@email.com",},TimeAggregation:datadog.PtrInt64(86400),},Type:datadogV2.NOTIFICATIONRULESTYPE_NOTIFICATION_RULES,},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.CreateSignalNotificationRule(ctx,body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.CreateSignalNotificationRule`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.CreateSignalNotificationRule`:\n%s\n",responseContent)}
// Create a new signal-based notification rule returns "Successfully created the notification rule."// responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.CreateNotificationRuleParameters;importcom.datadog.api.client.v2.model.CreateNotificationRuleParametersData;importcom.datadog.api.client.v2.model.CreateNotificationRuleParametersDataAttributes;importcom.datadog.api.client.v2.model.NotificationRuleResponse;importcom.datadog.api.client.v2.model.NotificationRulesType;importcom.datadog.api.client.v2.model.RuleSeverity;importcom.datadog.api.client.v2.model.RuleTypesItems;importcom.datadog.api.client.v2.model.Selectors;importcom.datadog.api.client.v2.model.TriggerSource;importjava.util.Arrays;importjava.util.Collections;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);CreateNotificationRuleParametersbody=newCreateNotificationRuleParameters().data(newCreateNotificationRuleParametersData().attributes(newCreateNotificationRuleParametersDataAttributes().enabled(true).name("Rule 1").selectors(newSelectors().query("(source:production_service OR env:prod)").ruleTypes(Arrays.asList(RuleTypesItems.MISCONFIGURATION,RuleTypesItems.ATTACK_PATH)).severities(Collections.singletonList(RuleSeverity.CRITICAL)).triggerSource(TriggerSource.SECURITY_FINDINGS)).targets(Collections.singletonList("@john.doe@email.com")).timeAggregation(86400L)).type(NotificationRulesType.NOTIFICATION_RULES));try{NotificationRuleResponseresult=apiInstance.createSignalNotificationRule(body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#createSignalNotificationRule");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Create a new signal-based notification rule returns "Successfully created the notification rule." response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.create_notification_rule_parametersimportCreateNotificationRuleParametersfromdatadog_api_client.v2.model.create_notification_rule_parameters_dataimportCreateNotificationRuleParametersDatafromdatadog_api_client.v2.model.create_notification_rule_parameters_data_attributesimport(CreateNotificationRuleParametersDataAttributes,)fromdatadog_api_client.v2.model.notification_rules_typeimportNotificationRulesTypefromdatadog_api_client.v2.model.rule_severityimportRuleSeverityfromdatadog_api_client.v2.model.rule_types_itemsimportRuleTypesItemsfromdatadog_api_client.v2.model.selectorsimportSelectorsfromdatadog_api_client.v2.model.trigger_sourceimportTriggerSourcebody=CreateNotificationRuleParameters(data=CreateNotificationRuleParametersData(attributes=CreateNotificationRuleParametersDataAttributes(enabled=True,name="Rule 1",selectors=Selectors(query="(source:production_service OR env:prod)",rule_types=[RuleTypesItems.MISCONFIGURATION,RuleTypesItems.ATTACK_PATH,],severities=[RuleSeverity.CRITICAL,],trigger_source=TriggerSource.SECURITY_FINDINGS,),targets=["@john.doe@email.com",],time_aggregation=86400,),type=NotificationRulesType.NOTIFICATION_RULES,),)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.create_signal_notification_rule(body=body)print(response)
# Create a new signal-based notification rule returns "Successfully created the notification rule." responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newbody=DatadogAPIClient::V2::CreateNotificationRuleParameters.new({data:DatadogAPIClient::V2::CreateNotificationRuleParametersData.new({attributes:DatadogAPIClient::V2::CreateNotificationRuleParametersDataAttributes.new({enabled:true,name:"Rule 1",selectors:DatadogAPIClient::V2::Selectors.new({query:"(source:production_service OR env:prod)",rule_types:[DatadogAPIClient::V2::RuleTypesItems::MISCONFIGURATION,DatadogAPIClient::V2::RuleTypesItems::ATTACK_PATH,],severities:[DatadogAPIClient::V2::RuleSeverity::CRITICAL,],trigger_source:DatadogAPIClient::V2::TriggerSource::SECURITY_FINDINGS,}),targets:["@john.doe@email.com",],time_aggregation:86400,}),type:DatadogAPIClient::V2::NotificationRulesType::NOTIFICATION_RULES,}),})papi_instance.create_signal_notification_rule(body)
// Create a new signal-based notification rule returns "Successfully created the
// notification rule." response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV2::model::CreateNotificationRuleParameters;usedatadog_api_client::datadogV2::model::CreateNotificationRuleParametersData;usedatadog_api_client::datadogV2::model::CreateNotificationRuleParametersDataAttributes;usedatadog_api_client::datadogV2::model::NotificationRulesType;usedatadog_api_client::datadogV2::model::RuleSeverity;usedatadog_api_client::datadogV2::model::RuleTypesItems;usedatadog_api_client::datadogV2::model::Selectors;usedatadog_api_client::datadogV2::model::TriggerSource;#[tokio::main]asyncfnmain(){letbody=CreateNotificationRuleParameters::new().data(CreateNotificationRuleParametersData::new(CreateNotificationRuleParametersDataAttributes::new("Rule 1".to_string(),Selectors::new(TriggerSource::SECURITY_FINDINGS).query("(source:production_service OR env:prod)".to_string()).rule_types(vec![RuleTypesItems::MISCONFIGURATION,RuleTypesItems::ATTACK_PATH,]).severities(vec![RuleSeverity::CRITICAL]),vec!["@john.doe@email.com".to_string()],).enabled(true).time_aggregation(86400),NotificationRulesType::NOTIFICATION_RULES,));letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.create_signal_notification_rule(body).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Create a new signal-based notification rule returns "Successfully created the notification rule." response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiCreateSignalNotificationRuleRequest={body:{data:{attributes:{enabled: true,name:"Rule 1",selectors:{query:"(source:production_service OR env:prod)",ruleTypes:["misconfiguration","attack_path"],severities:["critical"],triggerSource:"security_findings",},targets:["@john.doe@email.com"],timeAggregation: 86400,},type:"notification_rules",},},};apiInstance.createSignalNotificationRule(params).then((data: v2.NotificationRuleResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Response object which includes a notification rule.
Expand All
フィールド
種類
説明
data
object
Notification rules allow full control over notifications generated by the various Datadog security products.
They allow users to define the conditions under which a notification should be generated (based on rule severities,
rule types, rule tags, and so on), and the targets to notify.
A notification rule is composed of a rule ID, a rule type, and the rule attributes. All fields are required.
attributes [required]
object
Attributes of the notification rule.
created_at [required]
int64
Date as Unix timestamp in milliseconds.
created_by [required]
object
User creating or modifying a rule.
handle
string
The user handle.
name
string
The user name.
enabled [required]
boolean
Field used to enable or disable the rule.
modified_at [required]
int64
Date as Unix timestamp in milliseconds.
modified_by [required]
object
User creating or modifying a rule.
handle
string
The user handle.
name
string
The user name.
name [required]
string
Name of the notification rule.
selectors [required]
object
Selectors are used to filter security issues for which notifications should be generated.
Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source.
Only the trigger_source field is required.
query
string
The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
rule_types
[string]
Security rule types used as filters in security rules.
severities
[string]
The security rules severities to consider.
trigger_source [required]
enum
The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals",
while notification rules based on security vulnerabilities need to use the trigger source "security_findings".
Allowed enum values: security_findings,security_signals
targets [required]
[string]
List of recipients to notify when a notification rule is triggered. Many different target types are supported,
such as email addresses, Slack channels, and PagerDuty services.
The appropriate integrations need to be properly configured to send notifications to the specified targets.
time_aggregation
int64
Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation.
Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation.
Notifications are only sent for new issues discovered during the window.
Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation
is done.
version [required]
int64
Version of the notification rule. It is updated when the rule is modified.
id [required]
string
The ID of a notification rule.
type [required]
enum
The rule type associated to notification rules.
Allowed enum values: notification_rules
{"data":{"attributes":{"created_at":1722439510282,"created_by":{"handle":"john.doe@domain.com","name":"John Doe"},"enabled":true,"modified_at":1722439510282,"modified_by":{"handle":"john.doe@domain.com","name":"John Doe"},"name":"Rule 1","selectors":{"query":"(source:production_service OR env:prod)","rule_types":["misconfiguration","attack_path"],"severities":["critical"],"trigger_source":"security_findings"},"targets":["@john.doe@email.com"],"time_aggregation":86400,"version":1},"id":"aaa-bbb-ccc","type":"notification_rules"}}
"""
Get details of a signal-based notification rule returns "Notification rule details." response
"""fromosimportenvironfromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApi# there is a valid "valid_signal_notification_rule" in the systemVALID_SIGNAL_NOTIFICATION_RULE_DATA_ID=environ["VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID"]configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.get_signal_notification_rule(id=VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID,)print(response)
# Get details of a signal-based notification rule returns "Notification rule details." responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.new# there is a valid "valid_signal_notification_rule" in the systemVALID_SIGNAL_NOTIFICATION_RULE_DATA_ID=ENV["VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID"]papi_instance.get_signal_notification_rule(VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID)
// Get details of a signal-based notification rule returns "Notification rule details." responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){// there is a valid "valid_signal_notification_rule" in the systemValidSignalNotificationRuleDataID:=os.Getenv("VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID")ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.GetSignalNotificationRule(ctx,ValidSignalNotificationRuleDataID)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.GetSignalNotificationRule`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.GetSignalNotificationRule`:\n%s\n",responseContent)}
// Get details of a signal-based notification rule returns "Notification rule details." responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.NotificationRuleResponse;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);// there is a valid "valid_signal_notification_rule" in the systemStringVALID_SIGNAL_NOTIFICATION_RULE_DATA_ID=System.getenv("VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID");try{NotificationRuleResponseresult=apiInstance.getSignalNotificationRule(VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#getSignalNotificationRule");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
// Get details of a signal-based notification rule returns "Notification rule
// details." response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){// there is a valid "valid_signal_notification_rule" in the system
letvalid_signal_notification_rule_data_id=std::env::var("VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID").unwrap();letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.get_signal_notification_rule(valid_signal_notification_rule_data_id.clone()).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get details of a signal-based notification rule returns "Notification rule details." response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);// there is a valid "valid_signal_notification_rule" in the system
constVALID_SIGNAL_NOTIFICATION_RULE_DATA_ID=process.env.VALID_SIGNAL_NOTIFICATION_RULE_DATA_IDasstring;constparams: v2.SecurityMonitoringApiGetSignalNotificationRuleRequest={id: VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID,};apiInstance.getSignalNotificationRule(params).then((data: v2.NotificationRuleResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
"""
Delete a signal-based notification rule returns "Rule successfully deleted." response
"""fromosimportenvironfromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApi# there is a valid "valid_signal_notification_rule" in the systemVALID_SIGNAL_NOTIFICATION_RULE_DATA_ID=environ["VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID"]configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)api_instance.delete_signal_notification_rule(id=VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID,)
# Delete a signal-based notification rule returns "Rule successfully deleted." responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.new# there is a valid "valid_signal_notification_rule" in the systemVALID_SIGNAL_NOTIFICATION_RULE_DATA_ID=ENV["VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID"]api_instance.delete_signal_notification_rule(VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID)
// Delete a signal-based notification rule returns "Rule successfully deleted." responsepackagemainimport("context""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){// there is a valid "valid_signal_notification_rule" in the systemValidSignalNotificationRuleDataID:=os.Getenv("VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID")ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)r,err:=api.DeleteSignalNotificationRule(ctx,ValidSignalNotificationRuleDataID)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.DeleteSignalNotificationRule`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}}
// Delete a signal-based notification rule returns "Rule successfully deleted." responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);// there is a valid "valid_signal_notification_rule" in the systemStringVALID_SIGNAL_NOTIFICATION_RULE_DATA_ID=System.getenv("VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID");try{apiInstance.deleteSignalNotificationRule(VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#deleteSignalNotificationRule");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
// Delete a signal-based notification rule returns "Rule successfully deleted."
// response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){// there is a valid "valid_signal_notification_rule" in the system
letvalid_signal_notification_rule_data_id=std::env::var("VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID").unwrap();letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.delete_signal_notification_rule(valid_signal_notification_rule_data_id.clone()).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Delete a signal-based notification rule returns "Rule successfully deleted." response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);// there is a valid "valid_signal_notification_rule" in the system
constVALID_SIGNAL_NOTIFICATION_RULE_DATA_ID=process.env.VALID_SIGNAL_NOTIFICATION_RULE_DATA_IDasstring;constparams: v2.SecurityMonitoringApiDeleteSignalNotificationRuleRequest={id: VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID,};apiInstance.deleteSignalNotificationRule(params).then((data: any)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Partially update the notification rule. All fields are optional; if a field is not provided, it is not updated.
This endpoint requires the security_monitoring_notification_profiles_write permission.
Data of the notification rule patch request: the rule ID, the rule type, and the rule attributes. All fields are required.
attributes [required]
object
Attributes of the notification rule patch request. It is required to update the version of the rule when patching it.
enabled
boolean
Field used to enable or disable the rule.
name
string
Name of the notification rule.
selectors
object
Selectors are used to filter security issues for which notifications should be generated.
Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source.
Only the trigger_source field is required.
query
string
The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
rule_types
[string]
Security rule types used as filters in security rules.
severities
[string]
The security rules severities to consider.
trigger_source [required]
enum
The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals",
while notification rules based on security vulnerabilities need to use the trigger source "security_findings".
Allowed enum values: security_findings,security_signals
targets
[string]
List of recipients to notify when a notification rule is triggered. Many different target types are supported,
such as email addresses, Slack channels, and PagerDuty services.
The appropriate integrations need to be properly configured to send notifications to the specified targets.
time_aggregation
int64
Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation.
Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation.
Notifications are only sent for new issues discovered during the window.
Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation
is done.
version
int64
Version of the notification rule. It is updated when the rule is modified.
id [required]
string
The ID of a notification rule.
type [required]
enum
The rule type associated to notification rules.
Allowed enum values: notification_rules
{"data":{"attributes":{"enabled":true,"name":"Rule 1","selectors":{"query":"(source:production_service OR env:prod)","rule_types":["misconfiguration","attack_path"],"severities":["critical"],"trigger_source":"security_findings"},"targets":["@john.doe@email.com"],"time_aggregation":86400,"version":1},"id":"aaa-bbb-ccc","type":"notification_rules"}}
Response object which includes a notification rule.
Expand All
フィールド
種類
説明
data
object
Notification rules allow full control over notifications generated by the various Datadog security products.
They allow users to define the conditions under which a notification should be generated (based on rule severities,
rule types, rule tags, and so on), and the targets to notify.
A notification rule is composed of a rule ID, a rule type, and the rule attributes. All fields are required.
attributes [required]
object
Attributes of the notification rule.
created_at [required]
int64
Date as Unix timestamp in milliseconds.
created_by [required]
object
User creating or modifying a rule.
handle
string
The user handle.
name
string
The user name.
enabled [required]
boolean
Field used to enable or disable the rule.
modified_at [required]
int64
Date as Unix timestamp in milliseconds.
modified_by [required]
object
User creating or modifying a rule.
handle
string
The user handle.
name
string
The user name.
name [required]
string
Name of the notification rule.
selectors [required]
object
Selectors are used to filter security issues for which notifications should be generated.
Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source.
Only the trigger_source field is required.
query
string
The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
rule_types
[string]
Security rule types used as filters in security rules.
severities
[string]
The security rules severities to consider.
trigger_source [required]
enum
The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals",
while notification rules based on security vulnerabilities need to use the trigger source "security_findings".
Allowed enum values: security_findings,security_signals
targets [required]
[string]
List of recipients to notify when a notification rule is triggered. Many different target types are supported,
such as email addresses, Slack channels, and PagerDuty services.
The appropriate integrations need to be properly configured to send notifications to the specified targets.
time_aggregation
int64
Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation.
Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation.
Notifications are only sent for new issues discovered during the window.
Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation
is done.
version [required]
int64
Version of the notification rule. It is updated when the rule is modified.
id [required]
string
The ID of a notification rule.
type [required]
enum
The rule type associated to notification rules.
Allowed enum values: notification_rules
{"data":{"attributes":{"created_at":1722439510282,"created_by":{"handle":"john.doe@domain.com","name":"John Doe"},"enabled":true,"modified_at":1722439510282,"modified_by":{"handle":"john.doe@domain.com","name":"John Doe"},"name":"Rule 1","selectors":{"query":"(source:production_service OR env:prod)","rule_types":["misconfiguration","attack_path"],"severities":["critical"],"trigger_source":"security_findings"},"targets":["@john.doe@email.com"],"time_aggregation":86400,"version":1},"id":"aaa-bbb-ccc","type":"notification_rules"}}
// Patch a signal-based notification rule returns "Notification rule successfully patched." responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){// there is a valid "valid_signal_notification_rule" in the systemValidSignalNotificationRuleDataID:=os.Getenv("VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID")body:=datadogV2.PatchNotificationRuleParameters{Data:&datadogV2.PatchNotificationRuleParametersData{Attributes:datadogV2.PatchNotificationRuleParametersDataAttributes{Enabled:datadog.PtrBool(true),Name:datadog.PtrString("Rule 1"),Selectors:&datadogV2.Selectors{Query:datadog.PtrString("(source:production_service OR env:prod)"),RuleTypes:[]datadogV2.RuleTypesItems{datadogV2.RULETYPESITEMS_MISCONFIGURATION,datadogV2.RULETYPESITEMS_ATTACK_PATH,},Severities:[]datadogV2.RuleSeverity{datadogV2.RULESEVERITY_CRITICAL,},TriggerSource:datadogV2.TRIGGERSOURCE_SECURITY_FINDINGS,},Targets:[]string{"@john.doe@email.com",},TimeAggregation:datadog.PtrInt64(86400),Version:datadog.PtrInt64(1),},Id:ValidSignalNotificationRuleDataID,Type:datadogV2.NOTIFICATIONRULESTYPE_NOTIFICATION_RULES,},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.PatchSignalNotificationRule(ctx,ValidSignalNotificationRuleDataID,body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.PatchSignalNotificationRule`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.PatchSignalNotificationRule`:\n%s\n",responseContent)}
// Patch a signal-based notification rule returns "Notification rule successfully patched." responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.NotificationRuleResponse;importcom.datadog.api.client.v2.model.NotificationRulesType;importcom.datadog.api.client.v2.model.PatchNotificationRuleParameters;importcom.datadog.api.client.v2.model.PatchNotificationRuleParametersData;importcom.datadog.api.client.v2.model.PatchNotificationRuleParametersDataAttributes;importcom.datadog.api.client.v2.model.RuleSeverity;importcom.datadog.api.client.v2.model.RuleTypesItems;importcom.datadog.api.client.v2.model.Selectors;importcom.datadog.api.client.v2.model.TriggerSource;importjava.util.Arrays;importjava.util.Collections;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);// there is a valid "valid_signal_notification_rule" in the systemStringVALID_SIGNAL_NOTIFICATION_RULE_DATA_ID=System.getenv("VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID");PatchNotificationRuleParametersbody=newPatchNotificationRuleParameters().data(newPatchNotificationRuleParametersData().attributes(newPatchNotificationRuleParametersDataAttributes().enabled(true).name("Rule 1").selectors(newSelectors().query("(source:production_service OR env:prod)").ruleTypes(Arrays.asList(RuleTypesItems.MISCONFIGURATION,RuleTypesItems.ATTACK_PATH)).severities(Collections.singletonList(RuleSeverity.CRITICAL)).triggerSource(TriggerSource.SECURITY_FINDINGS)).targets(Collections.singletonList("@john.doe@email.com")).timeAggregation(86400L).version(1L)).id(VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID).type(NotificationRulesType.NOTIFICATION_RULES));try{NotificationRuleResponseresult=apiInstance.patchSignalNotificationRule(VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID,body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#patchSignalNotificationRule");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Patch a signal-based notification rule returns "Notification rule successfully patched." response
"""fromosimportenvironfromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.notification_rules_typeimportNotificationRulesTypefromdatadog_api_client.v2.model.patch_notification_rule_parametersimportPatchNotificationRuleParametersfromdatadog_api_client.v2.model.patch_notification_rule_parameters_dataimportPatchNotificationRuleParametersDatafromdatadog_api_client.v2.model.patch_notification_rule_parameters_data_attributesimport(PatchNotificationRuleParametersDataAttributes,)fromdatadog_api_client.v2.model.rule_severityimportRuleSeverityfromdatadog_api_client.v2.model.rule_types_itemsimportRuleTypesItemsfromdatadog_api_client.v2.model.selectorsimportSelectorsfromdatadog_api_client.v2.model.trigger_sourceimportTriggerSource# there is a valid "valid_signal_notification_rule" in the systemVALID_SIGNAL_NOTIFICATION_RULE_DATA_ID=environ["VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID"]body=PatchNotificationRuleParameters(data=PatchNotificationRuleParametersData(attributes=PatchNotificationRuleParametersDataAttributes(enabled=True,name="Rule 1",selectors=Selectors(query="(source:production_service OR env:prod)",rule_types=[RuleTypesItems.MISCONFIGURATION,RuleTypesItems.ATTACK_PATH,],severities=[RuleSeverity.CRITICAL,],trigger_source=TriggerSource.SECURITY_FINDINGS,),targets=["@john.doe@email.com",],time_aggregation=86400,version=1,),id=VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID,type=NotificationRulesType.NOTIFICATION_RULES,),)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.patch_signal_notification_rule(id=VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID,body=body)print(response)
# Patch a signal-based notification rule returns "Notification rule successfully patched." responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.new# there is a valid "valid_signal_notification_rule" in the systemVALID_SIGNAL_NOTIFICATION_RULE_DATA_ID=ENV["VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID"]body=DatadogAPIClient::V2::PatchNotificationRuleParameters.new({data:DatadogAPIClient::V2::PatchNotificationRuleParametersData.new({attributes:DatadogAPIClient::V2::PatchNotificationRuleParametersDataAttributes.new({enabled:true,name:"Rule 1",selectors:DatadogAPIClient::V2::Selectors.new({query:"(source:production_service OR env:prod)",rule_types:[DatadogAPIClient::V2::RuleTypesItems::MISCONFIGURATION,DatadogAPIClient::V2::RuleTypesItems::ATTACK_PATH,],severities:[DatadogAPIClient::V2::RuleSeverity::CRITICAL,],trigger_source:DatadogAPIClient::V2::TriggerSource::SECURITY_FINDINGS,}),targets:["@john.doe@email.com",],time_aggregation:86400,version:1,}),id:VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID,type:DatadogAPIClient::V2::NotificationRulesType::NOTIFICATION_RULES,}),})papi_instance.patch_signal_notification_rule(VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID,body)
// Patch a signal-based notification rule returns "Notification rule successfully
// patched." response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV2::model::NotificationRulesType;usedatadog_api_client::datadogV2::model::PatchNotificationRuleParameters;usedatadog_api_client::datadogV2::model::PatchNotificationRuleParametersData;usedatadog_api_client::datadogV2::model::PatchNotificationRuleParametersDataAttributes;usedatadog_api_client::datadogV2::model::RuleSeverity;usedatadog_api_client::datadogV2::model::RuleTypesItems;usedatadog_api_client::datadogV2::model::Selectors;usedatadog_api_client::datadogV2::model::TriggerSource;#[tokio::main]asyncfnmain(){// there is a valid "valid_signal_notification_rule" in the system
letvalid_signal_notification_rule_data_id=std::env::var("VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID").unwrap();letbody=PatchNotificationRuleParameters::new().data(PatchNotificationRuleParametersData::new(PatchNotificationRuleParametersDataAttributes::new().enabled(true).name("Rule 1".to_string()).selectors(Selectors::new(TriggerSource::SECURITY_FINDINGS).query("(source:production_service OR env:prod)".to_string()).rule_types(vec![RuleTypesItems::MISCONFIGURATION,RuleTypesItems::ATTACK_PATH,]).severities(vec![RuleSeverity::CRITICAL]),).targets(vec!["@john.doe@email.com".to_string()]).time_aggregation(86400).version(1),valid_signal_notification_rule_data_id.clone(),NotificationRulesType::NOTIFICATION_RULES,));letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.patch_signal_notification_rule(valid_signal_notification_rule_data_id.clone(),body).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Patch a signal-based notification rule returns "Notification rule successfully patched." response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);// there is a valid "valid_signal_notification_rule" in the system
constVALID_SIGNAL_NOTIFICATION_RULE_DATA_ID=process.env.VALID_SIGNAL_NOTIFICATION_RULE_DATA_IDasstring;constparams: v2.SecurityMonitoringApiPatchSignalNotificationRuleRequest={body:{data:{attributes:{enabled: true,name:"Rule 1",selectors:{query:"(source:production_service OR env:prod)",ruleTypes:["misconfiguration","attack_path"],severities:["critical"],triggerSource:"security_findings",},targets:["@john.doe@email.com"],timeAggregation: 86400,version: 1,},id: VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID,type:"notification_rules",},},id: VALID_SIGNAL_NOTIFICATION_RULE_DATA_ID,};apiInstance.patchSignalNotificationRule(params).then((data: v2.NotificationRuleResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
This endpoint uses the logs query syntax. Findings attributes (living in the attributes.attributes. namespace) are prefixed by @ when queried. Tags are queried without a prefix.
Example: @severity:(critical OR high) @status:open team:platform
This endpoint requires
any
of the following permissions:
security_monitoring_findings_read
appsec_vm_read
OAuth apps require the security_monitoring_findings_read authorization scope to access this endpoint.
引数
クエリ文字列
名前
種類
説明
filter[query]
string
The search query following log search syntax.
page[cursor]
string
Get the next page of results with a cursor provided in the previous query.
page[limit]
integer
The maximum number of findings in the response.
sort
enum
Sorts by @detection_changed_at. Allowed enum values: @detection_changed_at, -@detection_changed_at
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* List security findings returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);apiInstance.listSecurityFindings().then((data: v2.ListSecurityFindingsResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
The API uses the logs query syntax. Findings attributes (living in the attributes.attributes. namespace) are prefixed by @ when queried. Tags are queried without a prefix.
Example: @severity:(critical OR high) @status:open team:platform
This endpoint requires
any
of the following permissions:
security_monitoring_findings_read
appsec_vm_read
OAuth apps require the security_monitoring_findings_read authorization scope to access this endpoint.
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Search security findings returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiSearchSecurityFindingsRequest={body:{data:{attributes:{filter:"@severity:(critical OR high)",},},},};apiInstance.searchSecurityFindings(params).then((data: v2.ListSecurityFindingsResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
/**
* Search security findings returns "OK" response with pagination
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiSearchSecurityFindingsRequest={body:{data:{attributes:{filter:"@severity:(critical OR high)",page:{limit: 1,},},},},};apiInstance.searchSecurityFindings(params).then((data: v2.ListSecurityFindingsResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Create cases for security findings.
You can create up to 50 cases per request and associate up to 50 security findings per case. Security findings that are already attached to another case will be detached from their previous case and attached to the newly created case.
This endpoint requires
any
of the following permissions:
{"data":[{"attributes":{"archived_at":"2025-01-01T00:00:00.000Z","assigned_to":{"data":{"id":"00000000-0000-0000-2345-000000000000","type":"users"}},"attributes":{"<any-key>":[]},"closed_at":"2025-01-01T00:00:00.000Z","created_at":"2025-01-01T00:00:00.000Z","creation_source":"CS_SECURITY_FINDING","description":"A description of the case.","due_date":"2025-01-01","insights":[{"ref":"/security/appsec/vm/library/vulnerability/dfa027f7c037b2f77159adc027fecb56?detection=static","resource_id":"ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==","type":"SECURITY_FINDING"}],"jira_issue":{"error_message":"{\"errorMessages\":[\"An error occured.\"],\"errors\":{}}","result":{"account_id":"463a8631-680e-455c-bfd3-3ed04d326eb7","issue_id":"2871276","issue_key":"PROJ-123","issue_url":"https://domain.atlassian.net/browse/PROJ-123"},"status":"COMPLETED"},"key":"PROJ-123","modified_at":"2025-01-01T00:00:00.000Z","priority":"P4","status":"OPEN","status_group":"SG_OPEN","status_name":"Open","title":"A title for the case.","type":"SECURITY"},"id":"c1234567-89ab-cdef-0123-456789abcdef","relationships":{"created_by":{"data":{"id":"00000000-0000-0000-2345-000000000000","type":"users"}},"modified_by":{"data":{"id":"00000000-0000-0000-2345-000000000000","type":"users"}},"project":{"data":{"id":"aeadc05e-98a8-11ec-ac2c-da7ad0900001","type":"projects"}}},"type":"cases"}]}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Create case for security finding returns "Created" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiCreateCasesRequest={body:{data:[{attributes:{title:"A title",description:"A description",},relationships:{findings:{data:[{id:"YjdhNDM3N2QyNTFjYmUwYTY3NDdhMTg0YTk2Yjg5MDl-ZjNmMzAwOTFkZDNhNGQzYzI0MzgxNTk4MjRjZmE2NzE=",type:"findings",},],},project:{data:{id:"959a6f71-bac8-4027-b1d3-2264f569296f",type:"projects",},},},type:"cases",},],},};apiInstance.createCases(params).then((data: v2.FindingCaseResponseArray)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
/**
* Create case for security findings returns "Created" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiCreateCasesRequest={body:{data:[{attributes:{title:"A title",description:"A description",},relationships:{findings:{data:[{id:"ZTd5LWNuYi1seWV-aS0wMjI2NGZjZjRmZWQ5ODMyMg==",type:"findings",},{id:"c2FuLXhyaS1kZnN-aS0wODM3MjVhMTM2MDExNzNkOQ==",type:"findings",},],},project:{data:{id:"959a6f71-bac8-4027-b1d3-2264f569296f",type:"projects",},},},type:"cases",},],},};apiInstance.createCases(params).then((data: v2.FindingCaseResponseArray)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
/**
* Create cases for security findings returns "Created" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiCreateCasesRequest={body:{data:[{attributes:{title:"A title",description:"A description",},relationships:{findings:{data:[{id:"YjdhNDM3N2QyNTFjYmUwYTY3NDdhMTg0YTk2Yjg5MDl-ZjNmMzAwOTFkZDNhNGQzYzI0MzgxNTk4MjRjZmE2NzE=",type:"findings",},],},project:{data:{id:"959a6f71-bac8-4027-b1d3-2264f569296f",type:"projects",},},},type:"cases",},{attributes:{title:"A title",description:"A description",},relationships:{findings:{data:[{id:"OGRlMDIwYzk4MjFmZTZiNTQwMzk2ZjUxNzg0MDc0NjR-MTk3Yjk4MDI4ZDQ4YzI2ZGZiMWJmMTNhNDEwZGZkYWI=",type:"findings",},],},project:{data:{id:"959a6f71-bac8-4027-b1d3-2264f569296f",type:"projects",},},},type:"cases",},],},};apiInstance.createCases(params).then((data: v2.FindingCaseResponseArray)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Detach security findings from their case.
This operation dissociates security findings from their associated cases without deleting the cases themselves. You can detach security findings from multiple different cases in a single request, with a limit of 50 security findings per request. Security findings that are not currently attached to any case will be ignored.
This endpoint requires
any
of the following permissions:
// Detach security findings from their case returns "No Content" responsepackagemainimport("context""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.DetachCaseRequest{Data:&datadogV2.DetachCaseRequestData{Relationships:&datadogV2.DetachCaseRequestDataRelationships{Findings:datadogV2.Findings{Data:[]datadogV2.FindingData{{Id:"YzM2MTFjYzcyNmY0Zjg4MTAxZmRlNjQ1MWU1ZGQwYzR-YzI5NzE5Y2Y4MzU4ZjliNzhkNjYxNTY0ODIzZDQ2YTM=",Type:datadogV2.FINDINGDATATYPE_FINDINGS,},},},},Type:datadogV2.CASEDATATYPE_CASES,},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)r,err:=api.DetachCase(ctx,body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.DetachCase`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}}
// Detach security findings from their case returns "No Content" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.CaseDataType;importcom.datadog.api.client.v2.model.DetachCaseRequest;importcom.datadog.api.client.v2.model.DetachCaseRequestData;importcom.datadog.api.client.v2.model.DetachCaseRequestDataRelationships;importcom.datadog.api.client.v2.model.FindingData;importcom.datadog.api.client.v2.model.FindingDataType;importcom.datadog.api.client.v2.model.Findings;importjava.util.Collections;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);DetachCaseRequestbody=newDetachCaseRequest().data(newDetachCaseRequestData().relationships(newDetachCaseRequestDataRelationships().findings(newFindings().data(Collections.singletonList(newFindingData().id("YzM2MTFjYzcyNmY0Zjg4MTAxZmRlNjQ1MWU1ZGQwYzR-YzI5NzE5Y2Y4MzU4ZjliNzhkNjYxNTY0ODIzZDQ2YTM=").type(FindingDataType.FINDINGS))))).type(CaseDataType.CASES));try{apiInstance.detachCase(body);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#detachCase");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Detach security findings from their case returns "No Content" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.case_data_typeimportCaseDataTypefromdatadog_api_client.v2.model.detach_case_requestimportDetachCaseRequestfromdatadog_api_client.v2.model.detach_case_request_dataimportDetachCaseRequestDatafromdatadog_api_client.v2.model.detach_case_request_data_relationshipsimportDetachCaseRequestDataRelationshipsfromdatadog_api_client.v2.model.finding_dataimportFindingDatafromdatadog_api_client.v2.model.finding_data_typeimportFindingDataTypefromdatadog_api_client.v2.model.findingsimportFindingsbody=DetachCaseRequest(data=DetachCaseRequestData(relationships=DetachCaseRequestDataRelationships(findings=Findings(data=[FindingData(id="YzM2MTFjYzcyNmY0Zjg4MTAxZmRlNjQ1MWU1ZGQwYzR-YzI5NzE5Y2Y4MzU4ZjliNzhkNjYxNTY0ODIzZDQ2YTM=",type=FindingDataType.FINDINGS,),],),),type=CaseDataType.CASES,),)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)api_instance.detach_case(body=body)
# Detach security findings from their case returns "No Content" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newbody=DatadogAPIClient::V2::DetachCaseRequest.new({data:DatadogAPIClient::V2::DetachCaseRequestData.new({relationships:DatadogAPIClient::V2::DetachCaseRequestDataRelationships.new({findings:DatadogAPIClient::V2::Findings.new({data:[DatadogAPIClient::V2::FindingData.new({id:"YzM2MTFjYzcyNmY0Zjg4MTAxZmRlNjQ1MWU1ZGQwYzR-YzI5NzE5Y2Y4MzU4ZjliNzhkNjYxNTY0ODIzZDQ2YTM=",type:DatadogAPIClient::V2::FindingDataType::FINDINGS,}),],}),}),type:DatadogAPIClient::V2::CaseDataType::CASES,}),})api_instance.detach_case(body)
// Detach security findings from their case returns "No Content" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV2::model::CaseDataType;usedatadog_api_client::datadogV2::model::DetachCaseRequest;usedatadog_api_client::datadogV2::model::DetachCaseRequestData;usedatadog_api_client::datadogV2::model::DetachCaseRequestDataRelationships;usedatadog_api_client::datadogV2::model::FindingData;usedatadog_api_client::datadogV2::model::FindingDataType;usedatadog_api_client::datadogV2::model::Findings;#[tokio::main]asyncfnmain(){letbody=DetachCaseRequest::new().data(DetachCaseRequestData::new(CaseDataType::CASES,).relationships(DetachCaseRequestDataRelationships::new(Findings::new().data(vec![FindingData::new("YzM2MTFjYzcyNmY0Zjg4MTAxZmRlNjQ1MWU1ZGQwYzR-YzI5NzE5Y2Y4MzU4ZjliNzhkNjYxNTY0ODIzZDQ2YTM=".to_string(),FindingDataType::FINDINGS,)],),),),);letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.detach_case(body).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Detach security findings from their case returns "No Content" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiDetachCaseRequest={body:{data:{relationships:{findings:{data:[{id:"YzM2MTFjYzcyNmY0Zjg4MTAxZmRlNjQ1MWU1ZGQwYzR-YzI5NzE5Y2Y4MzU4ZjliNzhkNjYxNTY0ODIzZDQ2YTM=",type:"findings",},],},},type:"cases",},},};apiInstance.detachCase(params).then((data: any)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Attach security findings to a case.
You can attach up to 50 security findings per case. Security findings that are already attached to another case will be detached from their previous case and attached to the specified case.
This endpoint requires
any
of the following permissions:
security_monitoring_findings_write
appsec_vm_write
引数
パスパラメーター
名前
種類
説明
case_id [required]
string
Unique identifier of the case to attach security findings to
{"data":{"attributes":{"archived_at":"2025-01-01T00:00:00.000Z","assigned_to":{"data":{"id":"00000000-0000-0000-2345-000000000000","type":"users"}},"attributes":{"<any-key>":[]},"closed_at":"2025-01-01T00:00:00.000Z","created_at":"2025-01-01T00:00:00.000Z","creation_source":"CS_SECURITY_FINDING","description":"A description of the case.","due_date":"2025-01-01","insights":[{"ref":"/security/appsec/vm/library/vulnerability/dfa027f7c037b2f77159adc027fecb56?detection=static","resource_id":"ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==","type":"SECURITY_FINDING"}],"jira_issue":{"error_message":"{\"errorMessages\":[\"An error occured.\"],\"errors\":{}}","result":{"account_id":"463a8631-680e-455c-bfd3-3ed04d326eb7","issue_id":"2871276","issue_key":"PROJ-123","issue_url":"https://domain.atlassian.net/browse/PROJ-123"},"status":"COMPLETED"},"key":"PROJ-123","modified_at":"2025-01-01T00:00:00.000Z","priority":"P4","status":"OPEN","status_group":"SG_OPEN","status_name":"Open","title":"A title for the case.","type":"SECURITY"},"id":"c1234567-89ab-cdef-0123-456789abcdef","relationships":{"created_by":{"data":{"id":"00000000-0000-0000-2345-000000000000","type":"users"}},"modified_by":{"data":{"id":"00000000-0000-0000-2345-000000000000","type":"users"}},"project":{"data":{"id":"aeadc05e-98a8-11ec-ac2c-da7ad0900001","type":"projects"}}},"type":"cases"}}
// Attach security finding to a case returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.AttachCaseRequest{Data:&datadogV2.AttachCaseRequestData{Id:"7d16945b-baf8-411e-ab2a-20fe43af1ea3",Relationships:&datadogV2.AttachCaseRequestDataRelationships{Findings:datadogV2.Findings{Data:[]datadogV2.FindingData{{Id:"ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",Type:datadogV2.FINDINGDATATYPE_FINDINGS,},},},},Type:datadogV2.CASEDATATYPE_CASES,},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.AttachCase(ctx,"7d16945b-baf8-411e-ab2a-20fe43af1ea3",body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.AttachCase`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.AttachCase`:\n%s\n",responseContent)}
// Attach security findings to a case returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.AttachCaseRequest{Data:&datadogV2.AttachCaseRequestData{Id:"7d16945b-baf8-411e-ab2a-20fe43af1ea3",Relationships:&datadogV2.AttachCaseRequestDataRelationships{Findings:datadogV2.Findings{Data:[]datadogV2.FindingData{{Id:"ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",Type:datadogV2.FINDINGDATATYPE_FINDINGS,},{Id:"MmUzMzZkODQ2YTI3NDU0OTk4NDk3NzhkOTY5YjU2Zjh-YWJjZGI1ODI4OTYzNWM3ZmUwZTBlOWRkYTRiMGUyOGQ=",Type:datadogV2.FINDINGDATATYPE_FINDINGS,},},},},Type:datadogV2.CASEDATATYPE_CASES,},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.AttachCase(ctx,"7d16945b-baf8-411e-ab2a-20fe43af1ea3",body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.AttachCase`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.AttachCase`:\n%s\n",responseContent)}
// Attach security finding to a case returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.AttachCaseRequest;importcom.datadog.api.client.v2.model.AttachCaseRequestData;importcom.datadog.api.client.v2.model.AttachCaseRequestDataRelationships;importcom.datadog.api.client.v2.model.CaseDataType;importcom.datadog.api.client.v2.model.FindingCaseResponse;importcom.datadog.api.client.v2.model.FindingData;importcom.datadog.api.client.v2.model.FindingDataType;importcom.datadog.api.client.v2.model.Findings;importjava.util.Collections;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);AttachCaseRequestbody=newAttachCaseRequest().data(newAttachCaseRequestData().id("7d16945b-baf8-411e-ab2a-20fe43af1ea3").relationships(newAttachCaseRequestDataRelationships().findings(newFindings().data(Collections.singletonList(newFindingData().id("ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=").type(FindingDataType.FINDINGS))))).type(CaseDataType.CASES));try{FindingCaseResponseresult=apiInstance.attachCase("7d16945b-baf8-411e-ab2a-20fe43af1ea3",body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#attachCase");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
// Attach security findings to a case returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.AttachCaseRequest;importcom.datadog.api.client.v2.model.AttachCaseRequestData;importcom.datadog.api.client.v2.model.AttachCaseRequestDataRelationships;importcom.datadog.api.client.v2.model.CaseDataType;importcom.datadog.api.client.v2.model.FindingCaseResponse;importcom.datadog.api.client.v2.model.FindingData;importcom.datadog.api.client.v2.model.FindingDataType;importcom.datadog.api.client.v2.model.Findings;importjava.util.Arrays;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);AttachCaseRequestbody=newAttachCaseRequest().data(newAttachCaseRequestData().id("7d16945b-baf8-411e-ab2a-20fe43af1ea3").relationships(newAttachCaseRequestDataRelationships().findings(newFindings().data(Arrays.asList(newFindingData().id("ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=").type(FindingDataType.FINDINGS),newFindingData().id("MmUzMzZkODQ2YTI3NDU0OTk4NDk3NzhkOTY5YjU2Zjh-YWJjZGI1ODI4OTYzNWM3ZmUwZTBlOWRkYTRiMGUyOGQ=").type(FindingDataType.FINDINGS))))).type(CaseDataType.CASES));try{FindingCaseResponseresult=apiInstance.attachCase("7d16945b-baf8-411e-ab2a-20fe43af1ea3",body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#attachCase");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Attach security finding to a case returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.attach_case_requestimportAttachCaseRequestfromdatadog_api_client.v2.model.attach_case_request_dataimportAttachCaseRequestDatafromdatadog_api_client.v2.model.attach_case_request_data_relationshipsimportAttachCaseRequestDataRelationshipsfromdatadog_api_client.v2.model.case_data_typeimportCaseDataTypefromdatadog_api_client.v2.model.finding_dataimportFindingDatafromdatadog_api_client.v2.model.finding_data_typeimportFindingDataTypefromdatadog_api_client.v2.model.findingsimportFindingsbody=AttachCaseRequest(data=AttachCaseRequestData(id="7d16945b-baf8-411e-ab2a-20fe43af1ea3",relationships=AttachCaseRequestDataRelationships(findings=Findings(data=[FindingData(id="ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",type=FindingDataType.FINDINGS,),],),),type=CaseDataType.CASES,),)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.attach_case(case_id="7d16945b-baf8-411e-ab2a-20fe43af1ea3",body=body)print(response)
"""
Attach security findings to a case returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.attach_case_requestimportAttachCaseRequestfromdatadog_api_client.v2.model.attach_case_request_dataimportAttachCaseRequestDatafromdatadog_api_client.v2.model.attach_case_request_data_relationshipsimportAttachCaseRequestDataRelationshipsfromdatadog_api_client.v2.model.case_data_typeimportCaseDataTypefromdatadog_api_client.v2.model.finding_dataimportFindingDatafromdatadog_api_client.v2.model.finding_data_typeimportFindingDataTypefromdatadog_api_client.v2.model.findingsimportFindingsbody=AttachCaseRequest(data=AttachCaseRequestData(id="7d16945b-baf8-411e-ab2a-20fe43af1ea3",relationships=AttachCaseRequestDataRelationships(findings=Findings(data=[FindingData(id="ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",type=FindingDataType.FINDINGS,),FindingData(id="MmUzMzZkODQ2YTI3NDU0OTk4NDk3NzhkOTY5YjU2Zjh-YWJjZGI1ODI4OTYzNWM3ZmUwZTBlOWRkYTRiMGUyOGQ=",type=FindingDataType.FINDINGS,),],),),type=CaseDataType.CASES,),)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.attach_case(case_id="7d16945b-baf8-411e-ab2a-20fe43af1ea3",body=body)print(response)
# Attach security finding to a case returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newbody=DatadogAPIClient::V2::AttachCaseRequest.new({data:DatadogAPIClient::V2::AttachCaseRequestData.new({id:"7d16945b-baf8-411e-ab2a-20fe43af1ea3",relationships:DatadogAPIClient::V2::AttachCaseRequestDataRelationships.new({findings:DatadogAPIClient::V2::Findings.new({data:[DatadogAPIClient::V2::FindingData.new({id:"ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",type:DatadogAPIClient::V2::FindingDataType::FINDINGS,}),],}),}),type:DatadogAPIClient::V2::CaseDataType::CASES,}),})papi_instance.attach_case("7d16945b-baf8-411e-ab2a-20fe43af1ea3",body)
# Attach security findings to a case returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newbody=DatadogAPIClient::V2::AttachCaseRequest.new({data:DatadogAPIClient::V2::AttachCaseRequestData.new({id:"7d16945b-baf8-411e-ab2a-20fe43af1ea3",relationships:DatadogAPIClient::V2::AttachCaseRequestDataRelationships.new({findings:DatadogAPIClient::V2::Findings.new({data:[DatadogAPIClient::V2::FindingData.new({id:"ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",type:DatadogAPIClient::V2::FindingDataType::FINDINGS,}),DatadogAPIClient::V2::FindingData.new({id:"MmUzMzZkODQ2YTI3NDU0OTk4NDk3NzhkOTY5YjU2Zjh-YWJjZGI1ODI4OTYzNWM3ZmUwZTBlOWRkYTRiMGUyOGQ=",type:DatadogAPIClient::V2::FindingDataType::FINDINGS,}),],}),}),type:DatadogAPIClient::V2::CaseDataType::CASES,}),})papi_instance.attach_case("7d16945b-baf8-411e-ab2a-20fe43af1ea3",body)
// Attach security finding to a case returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV2::model::AttachCaseRequest;usedatadog_api_client::datadogV2::model::AttachCaseRequestData;usedatadog_api_client::datadogV2::model::AttachCaseRequestDataRelationships;usedatadog_api_client::datadogV2::model::CaseDataType;usedatadog_api_client::datadogV2::model::FindingData;usedatadog_api_client::datadogV2::model::FindingDataType;usedatadog_api_client::datadogV2::model::Findings;#[tokio::main]asyncfnmain(){letbody=AttachCaseRequest::new().data(AttachCaseRequestData::new("7d16945b-baf8-411e-ab2a-20fe43af1ea3".to_string(),CaseDataType::CASES,).relationships(AttachCaseRequestDataRelationships::new(Findings::new().data(vec![FindingData::new("ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=".to_string(),FindingDataType::FINDINGS,)],),),),);letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.attach_case("7d16945b-baf8-411e-ab2a-20fe43af1ea3".to_string(),body).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
// Attach security findings to a case returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV2::model::AttachCaseRequest;usedatadog_api_client::datadogV2::model::AttachCaseRequestData;usedatadog_api_client::datadogV2::model::AttachCaseRequestDataRelationships;usedatadog_api_client::datadogV2::model::CaseDataType;usedatadog_api_client::datadogV2::model::FindingData;usedatadog_api_client::datadogV2::model::FindingDataType;usedatadog_api_client::datadogV2::model::Findings;#[tokio::main]asyncfnmain(){letbody=AttachCaseRequest::new().data(AttachCaseRequestData::new("7d16945b-baf8-411e-ab2a-20fe43af1ea3".to_string(),CaseDataType::CASES,).relationships(AttachCaseRequestDataRelationships::new(Findings::new().data(vec![FindingData::new("ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=".to_string(),FindingDataType::FINDINGS,),FindingData::new("MmUzMzZkODQ2YTI3NDU0OTk4NDk3NzhkOTY5YjU2Zjh-YWJjZGI1ODI4OTYzNWM3ZmUwZTBlOWRkYTRiMGUyOGQ=".to_string(),FindingDataType::FINDINGS,)],),),),);letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.attach_case("7d16945b-baf8-411e-ab2a-20fe43af1ea3".to_string(),body).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Attach security finding to a case returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiAttachCaseRequest={body:{data:{id:"7d16945b-baf8-411e-ab2a-20fe43af1ea3",relationships:{findings:{data:[{id:"ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",type:"findings",},],},},type:"cases",},},caseId:"7d16945b-baf8-411e-ab2a-20fe43af1ea3",};apiInstance.attachCase(params).then((data: v2.FindingCaseResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
/**
* Attach security findings to a case returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiAttachCaseRequest={body:{data:{id:"7d16945b-baf8-411e-ab2a-20fe43af1ea3",relationships:{findings:{data:[{id:"ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",type:"findings",},{id:"MmUzMzZkODQ2YTI3NDU0OTk4NDk3NzhkOTY5YjU2Zjh-YWJjZGI1ODI4OTYzNWM3ZmUwZTBlOWRkYTRiMGUyOGQ=",type:"findings",},],},},type:"cases",},},caseId:"7d16945b-baf8-411e-ab2a-20fe43af1ea3",};apiInstance.attachCase(params).then((data: v2.FindingCaseResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Create Jira issues for security findings.
This operation creates a case in Datadog and a Jira issue linked to that case for bidirectional sync between Datadog and Jira. To configure the Jira integration, see Bidirectional ticket syncing with Jira. You can create up to 50 Jira issues per request and associate up to 50 security findings per Jira issue. Security findings that are already attached to another Jira issue will be detached from their previous Jira issue and attached to the newly created Jira issue.
This endpoint requires
any
of the following permissions:
Array of Jira issue creation request data objects.
attributes
object
Attributes of the Jira issue to create.
assignee_id
string
Unique identifier of the Datadog user assigned to the Jira issue.
description
string
Description of the Jira issue. If not provided, the description will be automatically generated.
fields
object
Custom fields of the Jira issue to create. For the list of available fields, see Jira documentation.
priority
enum
Datadog case priority mapped to the Jira issue priority. If not provided, the priority will be automatically set to "NOT_DEFINED". To configure the mapping, see Bidirectional ticket syncing with Jira.
Allowed enum values: NOT_DEFINED,P1,P2,P3,P4,P5
default: NOT_DEFINED
title
string
Title of the Jira issue. If not provided, the title will be automatically generated.
Case management project configured with the Jira integration. It is used to create the Jira issue. To configure the Jira integration, see Bidirectional ticket syncing with Jira.
data [required]
object
Data object representing a case management project.
{"data":[{"attributes":{"archived_at":"2025-01-01T00:00:00.000Z","assigned_to":{"data":{"id":"00000000-0000-0000-2345-000000000000","type":"users"}},"attributes":{"<any-key>":[]},"closed_at":"2025-01-01T00:00:00.000Z","created_at":"2025-01-01T00:00:00.000Z","creation_source":"CS_SECURITY_FINDING","description":"A description of the case.","due_date":"2025-01-01","insights":[{"ref":"/security/appsec/vm/library/vulnerability/dfa027f7c037b2f77159adc027fecb56?detection=static","resource_id":"ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==","type":"SECURITY_FINDING"}],"jira_issue":{"error_message":"{\"errorMessages\":[\"An error occured.\"],\"errors\":{}}","result":{"account_id":"463a8631-680e-455c-bfd3-3ed04d326eb7","issue_id":"2871276","issue_key":"PROJ-123","issue_url":"https://domain.atlassian.net/browse/PROJ-123"},"status":"COMPLETED"},"key":"PROJ-123","modified_at":"2025-01-01T00:00:00.000Z","priority":"P4","status":"OPEN","status_group":"SG_OPEN","status_name":"Open","title":"A title for the case.","type":"SECURITY"},"id":"c1234567-89ab-cdef-0123-456789abcdef","relationships":{"created_by":{"data":{"id":"00000000-0000-0000-2345-000000000000","type":"users"}},"modified_by":{"data":{"id":"00000000-0000-0000-2345-000000000000","type":"users"}},"project":{"data":{"id":"aeadc05e-98a8-11ec-ac2c-da7ad0900001","type":"projects"}}},"type":"cases"}]}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Create Jira issue for security finding returns "Created" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiCreateJiraIssuesRequest={body:{data:[{attributes:{title:"A title",description:"A description",},relationships:{findings:{data:[{id:"YmNlZmJhYTcyMDU5ZDk0ZDhiNjRmNGI0NDk4MDdiNzN-MDJlMjg0NzNmYzJiODY2MzJkNjU0OTI4NmVhZTUyY2U=",type:"findings",},],},project:{data:{id:"959a6f71-bac8-4027-b1d3-2264f569296f",type:"projects",},},},type:"jira_issues",},],},};apiInstance.createJiraIssues(params).then((data: v2.FindingCaseResponseArray)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
/**
* Create Jira issue for security findings returns "Created" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiCreateJiraIssuesRequest={body:{data:[{attributes:{title:"A title",description:"A description",},relationships:{findings:{data:[{id:"a3ZoLXNjbS14eXV-aS0wNWY5MGYwMGE4NDg2ODdlOA==",type:"findings",},{id:"eWswLWJsdC1hZm5-aS0wMjRlYTgwMzVkZTU1MGIwYQ==",type:"findings",},],},project:{data:{id:"959a6f71-bac8-4027-b1d3-2264f569296f",type:"projects",},},},type:"jira_issues",},],},};apiInstance.createJiraIssues(params).then((data: v2.FindingCaseResponseArray)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
/**
* Create Jira issues for security findings returns "Created" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiCreateJiraIssuesRequest={body:{data:[{attributes:{title:"A title",description:"A description",},relationships:{findings:{data:[{id:"eWswLWJsdC1hZm5-aS0wMjRlYTgwMzVkZTU1MGIwYQ==",type:"findings",},],},project:{data:{id:"959a6f71-bac8-4027-b1d3-2264f569296f",type:"projects",},},},type:"jira_issues",},{attributes:{title:"A title",description:"A description",},relationships:{findings:{data:[{id:"a3ZoLXNjbS14eXV-aS0wNWY5MGYwMGE4NDg2ODdlOA==",type:"findings",},],},project:{data:{id:"959a6f71-bac8-4027-b1d3-2264f569296f",type:"projects",},},},type:"jira_issues",},],},};apiInstance.createJiraIssues(params).then((data: v2.FindingCaseResponseArray)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Attach security findings to a Jira issue by providing the Jira issue URL.
You can attach up to 50 security findings per Jira issue. If the Jira issue is not linked to any case, this operation will create a case for the security findings and link the Jira issue to the newly created case. To configure the Jira integration, see Bidirectional ticket syncing with Jira. Security findings that are already attached to another Jira issue will be detached from their previous Jira issue and attached to the specified Jira issue.
This endpoint requires
any
of the following permissions:
Case management project with Jira integration configured. It is used to attach security findings to the Jira issue. To configure the integration, see Bidirectional ticket syncing with Jira.
data [required]
object
Data object representing a case management project.
{"data":{"attributes":{"archived_at":"2025-01-01T00:00:00.000Z","assigned_to":{"data":{"id":"00000000-0000-0000-2345-000000000000","type":"users"}},"attributes":{"<any-key>":[]},"closed_at":"2025-01-01T00:00:00.000Z","created_at":"2025-01-01T00:00:00.000Z","creation_source":"CS_SECURITY_FINDING","description":"A description of the case.","due_date":"2025-01-01","insights":[{"ref":"/security/appsec/vm/library/vulnerability/dfa027f7c037b2f77159adc027fecb56?detection=static","resource_id":"ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==","type":"SECURITY_FINDING"}],"jira_issue":{"error_message":"{\"errorMessages\":[\"An error occured.\"],\"errors\":{}}","result":{"account_id":"463a8631-680e-455c-bfd3-3ed04d326eb7","issue_id":"2871276","issue_key":"PROJ-123","issue_url":"https://domain.atlassian.net/browse/PROJ-123"},"status":"COMPLETED"},"key":"PROJ-123","modified_at":"2025-01-01T00:00:00.000Z","priority":"P4","status":"OPEN","status_group":"SG_OPEN","status_name":"Open","title":"A title for the case.","type":"SECURITY"},"id":"c1234567-89ab-cdef-0123-456789abcdef","relationships":{"created_by":{"data":{"id":"00000000-0000-0000-2345-000000000000","type":"users"}},"modified_by":{"data":{"id":"00000000-0000-0000-2345-000000000000","type":"users"}},"project":{"data":{"id":"aeadc05e-98a8-11ec-ac2c-da7ad0900001","type":"projects"}}},"type":"cases"}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Attach security finding to a Jira issue returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiAttachJiraIssueRequest={body:{data:{attributes:{jiraIssueUrl:"https://datadoghq-sandbox-538.atlassian.net/browse/CSMSEC-105476",},relationships:{findings:{data:[{id:"OTQ3NjJkMmYwMTIzMzMxNTc1Y2Q4MTA5NWU0NTBmMDl-ZjE3NjMxZWVkYzBjZGI1NDY2NWY2OGQxZDk4MDY4MmI=",type:"findings",},],},project:{data:{id:"959a6f71-bac8-4027-b1d3-2264f569296f",type:"projects",},},},type:"jira_issues",},},};apiInstance.attachJiraIssue(params).then((data: v2.FindingCaseResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
/**
* Attach security findings to a Jira issue returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiAttachJiraIssueRequest={body:{data:{attributes:{jiraIssueUrl:"https://datadoghq-sandbox-538.atlassian.net/browse/CSMSEC-105476",},relationships:{findings:{data:[{id:"OTQ3NjJkMmYwMTIzMzMxNTc1Y2Q4MTA5NWU0NTBmMDl-ZjE3NjMxZWVkYzBjZGI1NDY2NWY2OGQxZDk4MDY4MmI=",type:"findings",},{id:"MTNjN2ZmYWMzMDIxYmU1ZDFiZDRjNWUwN2I1NzVmY2F-YTA3MzllMTUzNWM3NmEyZjdiNzEzOWM5YmViZTMzOGM=",type:"findings",},],},project:{data:{id:"959a6f71-bac8-4027-b1d3-2264f569296f",type:"projects",},},},type:"jira_issues",},},};apiInstance.attachJiraIssue(params).then((data: v2.FindingCaseResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Mute or unmute security findings.
You can mute or unmute up to 100 security findings per request. The request body must include is_muted and reason attributes. The allowed reasons depend on whether the finding is being muted or unmuted:
To mute a finding: PENDING_FIX, FALSE_POSITIVE, OTHER, NO_FIX, DUPLICATE, RISK_ACCEPTED.
To unmute a finding: NO_PENDING_FIX, HUMAN_ERROR, NO_LONGER_ACCEPTED_RISK, OTHER.
This endpoint requires
any
of the following permissions:
Additional information about the reason why the findings are muted or unmuted. This field has a limit of 280 characters.
expire_at
int64
The expiration date of the mute action (Unix ms). It must be set to a value greater than the current timestamp. If this field is not provided, the findings remain muted indefinitely.
is_muted [required]
boolean
Whether the findings should be muted or unmuted.
reason [required]
enum
The reason why the findings are muted or unmuted.
Allowed enum values: PENDING_FIX,FALSE_POSITIVE,OTHER,NO_FIX,DUPLICATE,RISK_ACCEPTED,NO_PENDING_FIX,HUMAN_ERROR,NO_LONGER_ACCEPTED_RISK
{"data":{"attributes":{"mute":{"description":"To be resolved later.","expire_at":1778721573794,"is_muted":true,"reason":"RISK_ACCEPTED"}},"relationships":{"findings":{"data":[{"id":"ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=","type":"findings"}]}},"type":"mute"}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Update a custom framework returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiUpdateCustomFrameworkRequest={body:{data:{type:"custom_framework",attributes:{name:"name",handle:"create-framework-new",version:"10",iconUrl:"test-url",requirements:[{name:"requirement",controls:[{name:"control",rulesId:["def-000-be9"],},],},],},},},handle:"create-framework-new",version:"10",};apiInstance.updateCustomFramework(params).then((data: v2.UpdateCustomFrameworkResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
The type of the resource. The value must be custom_framework.
Allowed enum values: custom_framework
default: custom_framework
{"data":{"attributes":{"description":"this is a security description","handle":"sec2","icon_url":"https://example.com/icon.png","name":"security-framework","version":"2"},"id":"handle-version","type":"custom_framework"}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Delete a custom framework returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiDeleteCustomFrameworkRequest={handle:"create-framework-new",version:"10",};apiInstance.deleteCustomFramework(params).then((data: v2.DeleteCustomFrameworkResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
"""
Get a custom framework returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApiconfiguration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.get_custom_framework(handle="create-framework-new",version="10",)print(response)
# Get a custom framework returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newpapi_instance.get_custom_framework("create-framework-new","10")
// Get a custom framework returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.GetCustomFramework(ctx,"create-framework-new","10")iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.GetCustomFramework`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.GetCustomFramework`:\n%s\n",responseContent)}
// Get a custom framework returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.get_custom_framework("create-framework-new".to_string(),"10".to_string()).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get a custom framework returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiGetCustomFrameworkRequest={handle:"create-framework-new",version:"10",};apiInstance.getCustomFramework(params).then((data: v2.GetCustomFrameworkResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* List resource filters returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiGetResourceEvaluationFiltersRequest={cloudProvider:"aws",accountId:"123456789",};apiInstance.getResourceEvaluationFilters(params).then((data: v2.GetResourceEvaluationFiltersResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Update resource filters returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiUpdateResourceEvaluationFiltersRequest={body:{data:{attributes:{cloudProvider:{aws:{aws_account_id:["tag1:v1"],},},},id:"csm_resource_filter",type:"csm_resource_filter",},},};apiInstance.updateResourceEvaluationFilters(params).then((data: v2.UpdateResourceEvaluationFiltersResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Create a custom framework returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiCreateCustomFrameworkRequest={body:{data:{type:"custom_framework",attributes:{name:"name",handle:"create-framework-new",version:"10",iconUrl:"test-url",requirements:[{name:"requirement",controls:[{name:"control",rulesId:["def-000-be9"],},],},],},},},};apiInstance.createCustomFramework(params).then((data: v2.CreateCustomFrameworkResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
The list of exclusion filters applied in this security filter.
name
string
The exclusion filter name.
query
string
The exclusion filter query.
filtered_data_type
enum
The filtered data type.
Allowed enum values: logs
is_builtin
boolean
Whether the security filter is the built-in filter.
is_enabled
boolean
Whether the security filter is enabled.
name
string
The security filter name.
query
string
The security filter query. Logs accepted by this query will be accepted by this filter.
version
int32
The version of the security filter.
id
string
The ID of the security filter.
type
enum
The type of the resource. The value should always be security_filters.
Allowed enum values: security_filters
default: security_filters
meta
object
Optional metadata associated to the response.
warning
string
A warning message.
{"data":[{"attributes":{"exclusion_filters":[{"name":"Exclude staging","query":"source:staging"}],"filtered_data_type":"logs","is_builtin":false,"is_enabled":false,"name":"Custom security filter","query":"service:api","version":1},"id":"3dd-0uc-h1s","type":"security_filters"}],"meta":{"warning":"All the security filters are disabled. As a result, no logs are being analyzed."}}
"""
Get all security filters returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApiconfiguration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.list_security_filters()print(response)
# Get all security filters returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newpapi_instance.list_security_filters()
// Get all security filters returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.ListSecurityFilters(ctx)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.ListSecurityFilters`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.ListSecurityFilters`:\n%s\n",responseContent)}
// Get all security filters returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.list_security_filters().await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get all security filters returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);apiInstance.listSecurityFilters().then((data: v2.SecurityFiltersResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Response object which includes a single security filter.
Expand All
フィールド
種類
説明
data
object
The security filter's properties.
attributes
object
The object describing a security filter.
exclusion_filters
[object]
The list of exclusion filters applied in this security filter.
name
string
The exclusion filter name.
query
string
The exclusion filter query.
filtered_data_type
enum
The filtered data type.
Allowed enum values: logs
is_builtin
boolean
Whether the security filter is the built-in filter.
is_enabled
boolean
Whether the security filter is enabled.
name
string
The security filter name.
query
string
The security filter query. Logs accepted by this query will be accepted by this filter.
version
int32
The version of the security filter.
id
string
The ID of the security filter.
type
enum
The type of the resource. The value should always be security_filters.
Allowed enum values: security_filters
default: security_filters
meta
object
Optional metadata associated to the response.
warning
string
A warning message.
{"data":{"attributes":{"exclusion_filters":[{"name":"Exclude staging","query":"source:staging"}],"filtered_data_type":"logs","is_builtin":false,"is_enabled":false,"name":"Custom security filter","query":"service:api","version":1},"id":"3dd-0uc-h1s","type":"security_filters"},"meta":{"warning":"All the security filters are disabled. As a result, no logs are being analyzed."}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Create a security filter returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiCreateSecurityFilterRequest={body:{data:{attributes:{exclusionFilters:[{name:"Exclude staging",query:"source:staging",},],filteredDataType:"logs",isEnabled: true,name:"Example-Security-Monitoring",query:"service:ExampleSecurityMonitoring",},type:"security_filters",},},};apiInstance.createSecurityFilter(params).then((data: v2.SecurityFilterResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Response object which includes a single security filter.
Expand All
フィールド
種類
説明
data
object
The security filter's properties.
attributes
object
The object describing a security filter.
exclusion_filters
[object]
The list of exclusion filters applied in this security filter.
name
string
The exclusion filter name.
query
string
The exclusion filter query.
filtered_data_type
enum
The filtered data type.
Allowed enum values: logs
is_builtin
boolean
Whether the security filter is the built-in filter.
is_enabled
boolean
Whether the security filter is enabled.
name
string
The security filter name.
query
string
The security filter query. Logs accepted by this query will be accepted by this filter.
version
int32
The version of the security filter.
id
string
The ID of the security filter.
type
enum
The type of the resource. The value should always be security_filters.
Allowed enum values: security_filters
default: security_filters
meta
object
Optional metadata associated to the response.
warning
string
A warning message.
{"data":{"attributes":{"exclusion_filters":[{"name":"Exclude staging","query":"source:staging"}],"filtered_data_type":"logs","is_builtin":false,"is_enabled":false,"name":"Custom security filter","query":"service:api","version":1},"id":"3dd-0uc-h1s","type":"security_filters"},"meta":{"warning":"All the security filters are disabled. As a result, no logs are being analyzed."}}
"""
Get a security filter returns "OK" response
"""fromosimportenvironfromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApi# there is a valid "security_filter" in the systemSECURITY_FILTER_DATA_ID=environ["SECURITY_FILTER_DATA_ID"]configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.get_security_filter(security_filter_id=SECURITY_FILTER_DATA_ID,)print(response)
# Get a security filter returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.new# there is a valid "security_filter" in the systemSECURITY_FILTER_DATA_ID=ENV["SECURITY_FILTER_DATA_ID"]papi_instance.get_security_filter(SECURITY_FILTER_DATA_ID)
// Get a security filter returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){// there is a valid "security_filter" in the systemSecurityFilterDataID:=os.Getenv("SECURITY_FILTER_DATA_ID")ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.GetSecurityFilter(ctx,SecurityFilterDataID)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.GetSecurityFilter`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.GetSecurityFilter`:\n%s\n",responseContent)}
// Get a security filter returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.SecurityFilterResponse;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);// there is a valid "security_filter" in the systemStringSECURITY_FILTER_DATA_ID=System.getenv("SECURITY_FILTER_DATA_ID");try{SecurityFilterResponseresult=apiInstance.getSecurityFilter(SECURITY_FILTER_DATA_ID);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#getSecurityFilter");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
// Get a security filter returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){// there is a valid "security_filter" in the system
letsecurity_filter_data_id=std::env::var("SECURITY_FILTER_DATA_ID").unwrap();letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.get_security_filter(security_filter_data_id.clone()).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get a security filter returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);// there is a valid "security_filter" in the system
constSECURITY_FILTER_DATA_ID=process.env.SECURITY_FILTER_DATA_IDasstring;constparams: v2.SecurityMonitoringApiGetSecurityFilterRequest={securityFilterId: SECURITY_FILTER_DATA_ID,};apiInstance.getSecurityFilter(params).then((data: v2.SecurityFilterResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Update a specific security filter.
Returns the security filter object when the request is successful.
This endpoint requires the security_monitoring_filters_write permission.
OAuth apps require the security_monitoring_filters_write authorization scope to access this endpoint.
Response object which includes a single security filter.
Expand All
フィールド
種類
説明
data
object
The security filter's properties.
attributes
object
The object describing a security filter.
exclusion_filters
[object]
The list of exclusion filters applied in this security filter.
name
string
The exclusion filter name.
query
string
The exclusion filter query.
filtered_data_type
enum
The filtered data type.
Allowed enum values: logs
is_builtin
boolean
Whether the security filter is the built-in filter.
is_enabled
boolean
Whether the security filter is enabled.
name
string
The security filter name.
query
string
The security filter query. Logs accepted by this query will be accepted by this filter.
version
int32
The version of the security filter.
id
string
The ID of the security filter.
type
enum
The type of the resource. The value should always be security_filters.
Allowed enum values: security_filters
default: security_filters
meta
object
Optional metadata associated to the response.
warning
string
A warning message.
{"data":{"attributes":{"exclusion_filters":[{"name":"Exclude staging","query":"source:staging"}],"filtered_data_type":"logs","is_builtin":false,"is_enabled":false,"name":"Custom security filter","query":"service:api","version":1},"id":"3dd-0uc-h1s","type":"security_filters"},"meta":{"warning":"All the security filters are disabled. As a result, no logs are being analyzed."}}
// Update a security filter returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){// there is a valid "security_filter" in the systemSecurityFilterDataID:=os.Getenv("SECURITY_FILTER_DATA_ID")body:=datadogV2.SecurityFilterUpdateRequest{Data:datadogV2.SecurityFilterUpdateData{Attributes:datadogV2.SecurityFilterUpdateAttributes{ExclusionFilters:[]datadogV2.SecurityFilterExclusionFilter{},FilteredDataType:datadogV2.SECURITYFILTERFILTEREDDATATYPE_LOGS.Ptr(),IsEnabled:datadog.PtrBool(true),Name:datadog.PtrString("Example-Security-Monitoring"),Query:datadog.PtrString("service:ExampleSecurityMonitoring"),Version:datadog.PtrInt32(1),},Type:datadogV2.SECURITYFILTERTYPE_SECURITY_FILTERS,},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.UpdateSecurityFilter(ctx,SecurityFilterDataID,body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.UpdateSecurityFilter`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.UpdateSecurityFilter`:\n%s\n",responseContent)}
// Update a security filter returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.SecurityFilterFilteredDataType;importcom.datadog.api.client.v2.model.SecurityFilterResponse;importcom.datadog.api.client.v2.model.SecurityFilterType;importcom.datadog.api.client.v2.model.SecurityFilterUpdateAttributes;importcom.datadog.api.client.v2.model.SecurityFilterUpdateData;importcom.datadog.api.client.v2.model.SecurityFilterUpdateRequest;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);// there is a valid "security_filter" in the systemStringSECURITY_FILTER_DATA_ID=System.getenv("SECURITY_FILTER_DATA_ID");SecurityFilterUpdateRequestbody=newSecurityFilterUpdateRequest().data(newSecurityFilterUpdateData().attributes(newSecurityFilterUpdateAttributes().filteredDataType(SecurityFilterFilteredDataType.LOGS).isEnabled(true).name("Example-Security-Monitoring").query("service:ExampleSecurityMonitoring").version(1)).type(SecurityFilterType.SECURITY_FILTERS));try{SecurityFilterResponseresult=apiInstance.updateSecurityFilter(SECURITY_FILTER_DATA_ID,body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#updateSecurityFilter");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Update a security filter returns "OK" response
"""fromosimportenvironfromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.security_filter_filtered_data_typeimportSecurityFilterFilteredDataTypefromdatadog_api_client.v2.model.security_filter_typeimportSecurityFilterTypefromdatadog_api_client.v2.model.security_filter_update_attributesimportSecurityFilterUpdateAttributesfromdatadog_api_client.v2.model.security_filter_update_dataimportSecurityFilterUpdateDatafromdatadog_api_client.v2.model.security_filter_update_requestimportSecurityFilterUpdateRequest# there is a valid "security_filter" in the systemSECURITY_FILTER_DATA_ID=environ["SECURITY_FILTER_DATA_ID"]body=SecurityFilterUpdateRequest(data=SecurityFilterUpdateData(attributes=SecurityFilterUpdateAttributes(exclusion_filters=[],filtered_data_type=SecurityFilterFilteredDataType.LOGS,is_enabled=True,name="Example-Security-Monitoring",query="service:ExampleSecurityMonitoring",version=1,),type=SecurityFilterType.SECURITY_FILTERS,),)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.update_security_filter(security_filter_id=SECURITY_FILTER_DATA_ID,body=body)print(response)
# Update a security filter returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.new# there is a valid "security_filter" in the systemSECURITY_FILTER_DATA_ID=ENV["SECURITY_FILTER_DATA_ID"]body=DatadogAPIClient::V2::SecurityFilterUpdateRequest.new({data:DatadogAPIClient::V2::SecurityFilterUpdateData.new({attributes:DatadogAPIClient::V2::SecurityFilterUpdateAttributes.new({exclusion_filters:[],filtered_data_type:DatadogAPIClient::V2::SecurityFilterFilteredDataType::LOGS,is_enabled:true,name:"Example-Security-Monitoring",query:"service:ExampleSecurityMonitoring",version:1,}),type:DatadogAPIClient::V2::SecurityFilterType::SECURITY_FILTERS,}),})papi_instance.update_security_filter(SECURITY_FILTER_DATA_ID,body)
// Update a security filter returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV2::model::SecurityFilterFilteredDataType;usedatadog_api_client::datadogV2::model::SecurityFilterType;usedatadog_api_client::datadogV2::model::SecurityFilterUpdateAttributes;usedatadog_api_client::datadogV2::model::SecurityFilterUpdateData;usedatadog_api_client::datadogV2::model::SecurityFilterUpdateRequest;#[tokio::main]asyncfnmain(){// there is a valid "security_filter" in the system
letsecurity_filter_data_id=std::env::var("SECURITY_FILTER_DATA_ID").unwrap();letbody=SecurityFilterUpdateRequest::new(SecurityFilterUpdateData::new(SecurityFilterUpdateAttributes::new().exclusion_filters(vec![]).filtered_data_type(SecurityFilterFilteredDataType::LOGS).is_enabled(true).name("Example-Security-Monitoring".to_string()).query("service:ExampleSecurityMonitoring".to_string()).version(1),SecurityFilterType::SECURITY_FILTERS,));letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.update_security_filter(security_filter_data_id.clone(),body).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Update a security filter returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);// there is a valid "security_filter" in the system
constSECURITY_FILTER_DATA_ID=process.env.SECURITY_FILTER_DATA_IDasstring;constparams: v2.SecurityMonitoringApiUpdateSecurityFilterRequest={body:{data:{attributes:{exclusionFilters:[],filteredDataType:"logs",isEnabled: true,name:"Example-Security-Monitoring",query:"service:ExampleSecurityMonitoring",version: 1,},type:"security_filters",},},securityFilterId: SECURITY_FILTER_DATA_ID,};apiInstance.updateSecurityFilter(params).then((data: v2.SecurityFilterResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Delete a security filter returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiDeleteSecurityFilterRequest={securityFilterId:"security_filter_id",};apiInstance.deleteSecurityFilter(params).then((data: any)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
OAuth apps require the security_monitoring_suppressions_read authorization scope to access this endpoint.
引数
クエリ文字列
名前
種類
説明
query
string
Query string.
sort
enum
Attribute used to sort the list of suppression rules. Prefix with - to sort in descending order. Allowed enum values: name, start_date, expiration_date, update_date, enabled, -name, -start_date, -expiration_date, -update_date, -creation_dateShow 1 more, -enabled
page[size]
integer
Size for a given page. Use -1 to return all items.
Response object containing the available suppression rules with pagination metadata.
Expand All
フィールド
種類
説明
data
[object]
A list of suppressions objects.
attributes
object
The attributes of the suppression rule.
creation_date
int64
A Unix millisecond timestamp given the creation date of the suppression rule.
creator
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
data_exclusion_query
string
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description
string
A description for the suppression rule.
editable
boolean
Whether the suppression rule is editable.
enabled
boolean
Whether the suppression rule is enabled.
expiration_date
int64
A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
name
string
The name of the suppression rule.
rule_query
string
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
start_date
int64
A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals.
suppression_query
string
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer.
tags
[string]
List of tags associated with the suppression rule.
update_date
int64
A Unix millisecond timestamp given the update date of the suppression rule.
updater
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
version
int32
The version of the suppression rule; it starts at 1, and is incremented at each update.
id
string
The ID of the suppression rule.
type
enum
The type of the resource. The value should always be suppressions.
Allowed enum values: suppressions
"""
Get all suppression rules returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApiconfiguration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.list_security_monitoring_suppressions()print(response)
# Get all suppression rules returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newpapi_instance.list_security_monitoring_suppressions()
// Get all suppression rules returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.ListSecurityMonitoringSuppressions(ctx,*datadogV2.NewListSecurityMonitoringSuppressionsOptionalParameters())iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.ListSecurityMonitoringSuppressions`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.ListSecurityMonitoringSuppressions`:\n%s\n",responseContent)}
// Get all suppression rules returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::ListSecurityMonitoringSuppressionsOptionalParams;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.list_security_monitoring_suppressions(ListSecurityMonitoringSuppressionsOptionalParams::default(),).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get all suppression rules returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);apiInstance.listSecurityMonitoringSuppressions().then((data: v2.SecurityMonitoringPaginatedSuppressionsResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Object containing the attributes of the suppression rule to be created.
data_exclusion_query
string
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description
string
A description for the suppression rule.
enabled [required]
boolean
Whether the suppression rule is enabled.
expiration_date
int64
A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
name [required]
string
The name of the suppression rule.
rule_query [required]
string
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
start_date
int64
A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals.
suppression_query
string
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
tags
[string]
List of tags associated with the suppression rule.
type [required]
enum
The type of the resource. The value should always be suppressions.
Allowed enum values: suppressions
default: suppressions
{"data":{"attributes":{"description":"This rule suppresses low-severity signals in staging environments.","enabled":true,"start_date":1637493071000,"expiration_date":1638443471000,"name":"Example-Security-Monitoring","rule_query":"type:log_detection source:cloudtrail","suppression_query":"env:staging status:low","tags":["technique:T1110-brute-force","source:cloudtrail"]},"type":"suppressions"}}
{"data":{"attributes":{"description":"This rule suppresses low-severity signals in staging environments.","enabled":true,"start_date":1637493071000,"expiration_date":1638443471000,"name":"Example-Security-Monitoring","rule_query":"type:log_detection source:cloudtrail","data_exclusion_query":"account_id:12345"},"type":"suppressions"}}
Response object containing a single suppression rule.
Expand All
フィールド
種類
説明
data
object
The suppression rule's properties.
attributes
object
The attributes of the suppression rule.
creation_date
int64
A Unix millisecond timestamp given the creation date of the suppression rule.
creator
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
data_exclusion_query
string
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description
string
A description for the suppression rule.
editable
boolean
Whether the suppression rule is editable.
enabled
boolean
Whether the suppression rule is enabled.
expiration_date
int64
A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
name
string
The name of the suppression rule.
rule_query
string
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
start_date
int64
A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals.
suppression_query
string
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer.
tags
[string]
List of tags associated with the suppression rule.
update_date
int64
A Unix millisecond timestamp given the update date of the suppression rule.
updater
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
version
int32
The version of the suppression rule; it starts at 1, and is incremented at each update.
id
string
The ID of the suppression rule.
type
enum
The type of the resource. The value should always be suppressions.
Allowed enum values: suppressions
// Create a suppression rule returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.SecurityMonitoringSuppressionCreateRequest{Data:datadogV2.SecurityMonitoringSuppressionCreateData{Attributes:datadogV2.SecurityMonitoringSuppressionCreateAttributes{Description:datadog.PtrString("This rule suppresses low-severity signals in staging environments."),Enabled:true,StartDate:datadog.PtrInt64(1637493071000),ExpirationDate:datadog.PtrInt64(1638443471000),Name:"Example-Security-Monitoring",RuleQuery:"type:log_detection source:cloudtrail",SuppressionQuery:datadog.PtrString("env:staging status:low"),Tags:[]string{"technique:T1110-brute-force","source:cloudtrail",},},Type:datadogV2.SECURITYMONITORINGSUPPRESSIONTYPE_SUPPRESSIONS,},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.CreateSecurityMonitoringSuppression(ctx,body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.CreateSecurityMonitoringSuppression`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.CreateSecurityMonitoringSuppression`:\n%s\n",responseContent)}
// Create a suppression rule with an exclusion query returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.SecurityMonitoringSuppressionCreateRequest{Data:datadogV2.SecurityMonitoringSuppressionCreateData{Attributes:datadogV2.SecurityMonitoringSuppressionCreateAttributes{Description:datadog.PtrString("This rule suppresses low-severity signals in staging environments."),Enabled:true,StartDate:datadog.PtrInt64(1637493071000),ExpirationDate:datadog.PtrInt64(1638443471000),Name:"Example-Security-Monitoring",RuleQuery:"type:log_detection source:cloudtrail",DataExclusionQuery:datadog.PtrString("account_id:12345"),},Type:datadogV2.SECURITYMONITORINGSUPPRESSIONTYPE_SUPPRESSIONS,},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.CreateSecurityMonitoringSuppression(ctx,body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.CreateSecurityMonitoringSuppression`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.CreateSecurityMonitoringSuppression`:\n%s\n",responseContent)}
# Create a suppression rule returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newbody=DatadogAPIClient::V2::SecurityMonitoringSuppressionCreateRequest.new({data:DatadogAPIClient::V2::SecurityMonitoringSuppressionCreateData.new({attributes:DatadogAPIClient::V2::SecurityMonitoringSuppressionCreateAttributes.new({description:"This rule suppresses low-severity signals in staging environments.",enabled:true,start_date:1637493071000,expiration_date:1638443471000,name:"Example-Security-Monitoring",rule_query:"type:log_detection source:cloudtrail",suppression_query:"env:staging status:low",tags:["technique:T1110-brute-force","source:cloudtrail",],}),type:DatadogAPIClient::V2::SecurityMonitoringSuppressionType::SUPPRESSIONS,}),})papi_instance.create_security_monitoring_suppression(body)
# Create a suppression rule with an exclusion query returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newbody=DatadogAPIClient::V2::SecurityMonitoringSuppressionCreateRequest.new({data:DatadogAPIClient::V2::SecurityMonitoringSuppressionCreateData.new({attributes:DatadogAPIClient::V2::SecurityMonitoringSuppressionCreateAttributes.new({description:"This rule suppresses low-severity signals in staging environments.",enabled:true,start_date:1637493071000,expiration_date:1638443471000,name:"Example-Security-Monitoring",rule_query:"type:log_detection source:cloudtrail",data_exclusion_query:"account_id:12345",}),type:DatadogAPIClient::V2::SecurityMonitoringSuppressionType::SUPPRESSIONS,}),})papi_instance.create_security_monitoring_suppression(body)
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Create a suppression rule returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiCreateSecurityMonitoringSuppressionRequest={body:{data:{attributes:{description:"This rule suppresses low-severity signals in staging environments.",enabled: true,startDate: 1637493071000,expirationDate: 1638443471000,name:"Example-Security-Monitoring",ruleQuery:"type:log_detection source:cloudtrail",suppressionQuery:"env:staging status:low",tags:["technique:T1110-brute-force","source:cloudtrail"],},type:"suppressions",},},};apiInstance.createSecurityMonitoringSuppression(params).then((data: v2.SecurityMonitoringSuppressionResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
/**
* Create a suppression rule with an exclusion query returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiCreateSecurityMonitoringSuppressionRequest={body:{data:{attributes:{description:"This rule suppresses low-severity signals in staging environments.",enabled: true,startDate: 1637493071000,expirationDate: 1638443471000,name:"Example-Security-Monitoring",ruleQuery:"type:log_detection source:cloudtrail",dataExclusionQuery:"account_id:12345",},type:"suppressions",},},};apiInstance.createSecurityMonitoringSuppression(params).then((data: v2.SecurityMonitoringSuppressionResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Response object containing a single suppression rule.
Expand All
フィールド
種類
説明
data
object
The suppression rule's properties.
attributes
object
The attributes of the suppression rule.
creation_date
int64
A Unix millisecond timestamp given the creation date of the suppression rule.
creator
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
data_exclusion_query
string
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description
string
A description for the suppression rule.
editable
boolean
Whether the suppression rule is editable.
enabled
boolean
Whether the suppression rule is enabled.
expiration_date
int64
A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
name
string
The name of the suppression rule.
rule_query
string
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
start_date
int64
A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals.
suppression_query
string
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer.
tags
[string]
List of tags associated with the suppression rule.
update_date
int64
A Unix millisecond timestamp given the update date of the suppression rule.
updater
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
version
int32
The version of the suppression rule; it starts at 1, and is incremented at each update.
id
string
The ID of the suppression rule.
type
enum
The type of the resource. The value should always be suppressions.
Allowed enum values: suppressions
"""
Get a suppression rule returns "OK" response
"""fromosimportenvironfromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApi# there is a valid "suppression" in the systemSUPPRESSION_DATA_ID=environ["SUPPRESSION_DATA_ID"]configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.get_security_monitoring_suppression(suppression_id=SUPPRESSION_DATA_ID,)print(response)
# Get a suppression rule returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.new# there is a valid "suppression" in the systemSUPPRESSION_DATA_ID=ENV["SUPPRESSION_DATA_ID"]papi_instance.get_security_monitoring_suppression(SUPPRESSION_DATA_ID)
// Get a suppression rule returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){// there is a valid "suppression" in the systemSuppressionDataID:=os.Getenv("SUPPRESSION_DATA_ID")ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.GetSecurityMonitoringSuppression(ctx,SuppressionDataID)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.GetSecurityMonitoringSuppression`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.GetSecurityMonitoringSuppression`:\n%s\n",responseContent)}
// Get a suppression rule returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.SecurityMonitoringSuppressionResponse;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);// there is a valid "suppression" in the systemStringSUPPRESSION_DATA_ID=System.getenv("SUPPRESSION_DATA_ID");try{SecurityMonitoringSuppressionResponseresult=apiInstance.getSecurityMonitoringSuppression(SUPPRESSION_DATA_ID);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#getSecurityMonitoringSuppression");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
// Get a suppression rule returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){// there is a valid "suppression" in the system
letsuppression_data_id=std::env::var("SUPPRESSION_DATA_ID").unwrap();letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.get_security_monitoring_suppression(suppression_data_id.clone()).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get a suppression rule returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);// there is a valid "suppression" in the system
constSUPPRESSION_DATA_ID=process.env.SUPPRESSION_DATA_IDasstring;constparams: v2.SecurityMonitoringApiGetSecurityMonitoringSuppressionRequest={suppressionId: SUPPRESSION_DATA_ID,};apiInstance.getSecurityMonitoringSuppression(params).then((data: v2.SecurityMonitoringSuppressionResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
The new suppression properties; partial updates are supported.
attributes [required]
object
The suppression rule properties to be updated.
data_exclusion_query
string
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description
string
A description for the suppression rule.
enabled
boolean
Whether the suppression rule is enabled.
expiration_date
int64
A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore. If unset, the expiration date of the suppression rule is left untouched. If set to null, the expiration date is removed.
name
string
The name of the suppression rule.
rule_query
string
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
start_date
int64
A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals. If unset, the start date of the suppression rule is left untouched. If set to null, the start date is removed.
suppression_query
string
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer.
tags
[string]
List of tags associated with the suppression rule.
version
int32
The current version of the suppression. This is optional, but it can help prevent concurrent modifications.
type [required]
enum
The type of the resource. The value should always be suppressions.
Allowed enum values: suppressions
Response object containing a single suppression rule.
Expand All
フィールド
種類
説明
data
object
The suppression rule's properties.
attributes
object
The attributes of the suppression rule.
creation_date
int64
A Unix millisecond timestamp given the creation date of the suppression rule.
creator
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
data_exclusion_query
string
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description
string
A description for the suppression rule.
editable
boolean
Whether the suppression rule is editable.
enabled
boolean
Whether the suppression rule is enabled.
expiration_date
int64
A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
name
string
The name of the suppression rule.
rule_query
string
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
start_date
int64
A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals.
suppression_query
string
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer.
tags
[string]
List of tags associated with the suppression rule.
update_date
int64
A Unix millisecond timestamp given the update date of the suppression rule.
updater
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
version
int32
The version of the suppression rule; it starts at 1, and is incremented at each update.
id
string
The ID of the suppression rule.
type
enum
The type of the resource. The value should always be suppressions.
Allowed enum values: suppressions
// Update a suppression rule returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){// there is a valid "suppression" in the systemSuppressionDataID:=os.Getenv("SUPPRESSION_DATA_ID")body:=datadogV2.SecurityMonitoringSuppressionUpdateRequest{Data:datadogV2.SecurityMonitoringSuppressionUpdateData{Attributes:datadogV2.SecurityMonitoringSuppressionUpdateAttributes{SuppressionQuery:datadog.PtrString("env:staging status:low"),},Type:datadogV2.SECURITYMONITORINGSUPPRESSIONTYPE_SUPPRESSIONS,},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.UpdateSecurityMonitoringSuppression(ctx,SuppressionDataID,body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.UpdateSecurityMonitoringSuppression`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.UpdateSecurityMonitoringSuppression`:\n%s\n",responseContent)}
// Update a suppression rule returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.SecurityMonitoringSuppressionResponse;importcom.datadog.api.client.v2.model.SecurityMonitoringSuppressionType;importcom.datadog.api.client.v2.model.SecurityMonitoringSuppressionUpdateAttributes;importcom.datadog.api.client.v2.model.SecurityMonitoringSuppressionUpdateData;importcom.datadog.api.client.v2.model.SecurityMonitoringSuppressionUpdateRequest;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);// there is a valid "suppression" in the systemStringSUPPRESSION_DATA_ID=System.getenv("SUPPRESSION_DATA_ID");SecurityMonitoringSuppressionUpdateRequestbody=newSecurityMonitoringSuppressionUpdateRequest().data(newSecurityMonitoringSuppressionUpdateData().attributes(newSecurityMonitoringSuppressionUpdateAttributes().suppressionQuery("env:staging status:low")).type(SecurityMonitoringSuppressionType.SUPPRESSIONS));try{SecurityMonitoringSuppressionResponseresult=apiInstance.updateSecurityMonitoringSuppression(SUPPRESSION_DATA_ID,body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#updateSecurityMonitoringSuppression");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Update a suppression rule returns "OK" response
"""fromosimportenvironfromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.security_monitoring_suppression_typeimportSecurityMonitoringSuppressionTypefromdatadog_api_client.v2.model.security_monitoring_suppression_update_attributesimport(SecurityMonitoringSuppressionUpdateAttributes,)fromdatadog_api_client.v2.model.security_monitoring_suppression_update_dataimport(SecurityMonitoringSuppressionUpdateData,)fromdatadog_api_client.v2.model.security_monitoring_suppression_update_requestimport(SecurityMonitoringSuppressionUpdateRequest,)# there is a valid "suppression" in the systemSUPPRESSION_DATA_ID=environ["SUPPRESSION_DATA_ID"]body=SecurityMonitoringSuppressionUpdateRequest(data=SecurityMonitoringSuppressionUpdateData(attributes=SecurityMonitoringSuppressionUpdateAttributes(suppression_query="env:staging status:low",),type=SecurityMonitoringSuppressionType.SUPPRESSIONS,),)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.update_security_monitoring_suppression(suppression_id=SUPPRESSION_DATA_ID,body=body)print(response)
# Update a suppression rule returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.new# there is a valid "suppression" in the systemSUPPRESSION_DATA_ID=ENV["SUPPRESSION_DATA_ID"]body=DatadogAPIClient::V2::SecurityMonitoringSuppressionUpdateRequest.new({data:DatadogAPIClient::V2::SecurityMonitoringSuppressionUpdateData.new({attributes:DatadogAPIClient::V2::SecurityMonitoringSuppressionUpdateAttributes.new({suppression_query:"env:staging status:low",}),type:DatadogAPIClient::V2::SecurityMonitoringSuppressionType::SUPPRESSIONS,}),})papi_instance.update_security_monitoring_suppression(SUPPRESSION_DATA_ID,body)
// Update a suppression rule returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV2::model::SecurityMonitoringSuppressionType;usedatadog_api_client::datadogV2::model::SecurityMonitoringSuppressionUpdateAttributes;usedatadog_api_client::datadogV2::model::SecurityMonitoringSuppressionUpdateData;usedatadog_api_client::datadogV2::model::SecurityMonitoringSuppressionUpdateRequest;#[tokio::main]asyncfnmain(){// there is a valid "suppression" in the system
letsuppression_data_id=std::env::var("SUPPRESSION_DATA_ID").unwrap();letbody=SecurityMonitoringSuppressionUpdateRequest::new(SecurityMonitoringSuppressionUpdateData::new(SecurityMonitoringSuppressionUpdateAttributes::new().suppression_query("env:staging status:low".to_string()),SecurityMonitoringSuppressionType::SUPPRESSIONS,),);letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.update_security_monitoring_suppression(suppression_data_id.clone(),body).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Update a suppression rule returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);// there is a valid "suppression" in the system
constSUPPRESSION_DATA_ID=process.env.SUPPRESSION_DATA_IDasstring;constparams: v2.SecurityMonitoringApiUpdateSecurityMonitoringSuppressionRequest={body:{data:{attributes:{suppressionQuery:"env:staging status:low",},type:"suppressions",},},suppressionId: SUPPRESSION_DATA_ID,};apiInstance.updateSecurityMonitoringSuppression(params).then((data: v2.SecurityMonitoringSuppressionResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
"""
Delete a suppression rule returns "OK" response
"""fromosimportenvironfromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApi# there is a valid "suppression" in the systemSUPPRESSION_DATA_ID=environ["SUPPRESSION_DATA_ID"]configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)api_instance.delete_security_monitoring_suppression(suppression_id=SUPPRESSION_DATA_ID,)
# Delete a suppression rule returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.new# there is a valid "suppression" in the systemSUPPRESSION_DATA_ID=ENV["SUPPRESSION_DATA_ID"]api_instance.delete_security_monitoring_suppression(SUPPRESSION_DATA_ID)
// Delete a suppression rule returns "OK" responsepackagemainimport("context""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){// there is a valid "suppression" in the systemSuppressionDataID:=os.Getenv("SUPPRESSION_DATA_ID")ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)r,err:=api.DeleteSecurityMonitoringSuppression(ctx,SuppressionDataID)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.DeleteSecurityMonitoringSuppression`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}}
// Delete a suppression rule returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);// there is a valid "suppression" in the systemStringSUPPRESSION_DATA_ID=System.getenv("SUPPRESSION_DATA_ID");try{apiInstance.deleteSecurityMonitoringSuppression(SUPPRESSION_DATA_ID);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#deleteSecurityMonitoringSuppression");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
// Delete a suppression rule returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){// there is a valid "suppression" in the system
letsuppression_data_id=std::env::var("SUPPRESSION_DATA_ID").unwrap();letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.delete_security_monitoring_suppression(suppression_data_id.clone()).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Delete a suppression rule returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);// there is a valid "suppression" in the system
constSUPPRESSION_DATA_ID=process.env.SUPPRESSION_DATA_IDasstring;constparams: v2.SecurityMonitoringApiDeleteSecurityMonitoringSuppressionRequest={suppressionId: SUPPRESSION_DATA_ID,};apiInstance.deleteSecurityMonitoringSuppression(params).then((data: any)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Object containing the attributes of the suppression rule to be created.
data_exclusion_query
string
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description
string
A description for the suppression rule.
enabled [required]
boolean
Whether the suppression rule is enabled.
expiration_date
int64
A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
name [required]
string
The name of the suppression rule.
rule_query [required]
string
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
start_date
int64
A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals.
suppression_query
string
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
tags
[string]
List of tags associated with the suppression rule.
type [required]
enum
The type of the resource. The value should always be suppressions.
Allowed enum values: suppressions
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Validate a suppression rule returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiValidateSecurityMonitoringSuppressionRequest={body:{data:{attributes:{dataExclusionQuery:"source:cloudtrail account_id:12345",description:"This rule suppresses low-severity signals in staging environments.",enabled: true,name:"Custom suppression",ruleQuery:"type:log_detection source:cloudtrail",},type:"suppressions",},},};apiInstance.validateSecurityMonitoringSuppression(params).then((data: any)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.
expression [required]
string
Expression.
name [required]
string
Field name.
cases [required]
[object]
Cases for generating signals.
actions
[object]
Action to perform for each rule case.
options
object
Options for the rule action
duration
int64
Duration of the action in seconds. 0 indicates no expiration.
flaggedIPType
enum
Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses.
Allowed enum values: SUSPICIOUS,FLAGGED
userBehaviorName
string
Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
type
enum
The action type.
Allowed enum values: block_ip,block_user,user_behavior,flag_ip
condition
string
A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated
based on the event counts in the previously defined queries.
name
string
Name of the case.
notifications
[string]
Notification targets.
status [required]
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
filters
[object]
Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
action
enum
The type of filtering action.
Allowed enum values: require,suppress
query
string
Query for selecting logs to apply the filtering action.
groupSignalsBy
[string]
Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
hasExtendedTitle
boolean
Whether the notifications include the triggering group-by values in their title.
isEnabled [required]
boolean
Whether the rule is enabled.
message [required]
string
Message for generated signals.
name [required]
string
The name of the rule.
options [required]
object
Options.
anomalyDetectionOptions
object
Options on anomaly detection method.
bucketDuration
enum
Duration in seconds of the time buckets used to aggregate events matched by the rule.
Must be greater than or equal to 300.
Allowed enum values: 300,600,900,1800,3600,10800
detectionTolerance
enum
An optional parameter that sets how permissive anomaly detection is.
Higher values require higher deviations before triggering a signal.
Allowed enum values: 1,2,3,4,5
instantaneousBaseline
boolean
When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDuration
enum
Learning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating.
Allowed enum values: 1,6,12,24,48,168,336
learningPeriodBaseline
int64
An optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0.
complianceRuleOptions
object
Options for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRule
boolean
Whether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
List of resource types that will be evaluated upon. Must have at least one element.
resourceType
string
Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnv
boolean
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.
The severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.
The decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethod
enum
The detection method.
Allowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time. For third party detection method, this field is not used.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular
access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
keepAlive
enum
Once a signal is generated, the signal will remain "open" if a case is matched at least once within
this keep alive window. For third party detection method, this field is not used.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
maxSignalDuration
enum
A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.
This time is calculated from the first seen timestamp.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
newValueOptions
object
Options on new value detection method.
forgetAfter
int32
The duration in days after which a learned value is forgotten.
instantaneousBaseline
boolean
When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDuration
int32
The duration in days during which values are learned, and after which signals will be generated for values that
weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
learningMethod
enum
The learning method used to determine when signals should be generated for values that weren't learned.
Allowed enum values: duration,threshold
default: duration
learningThreshold
enum
A number of occurrences after which signals will be generated for values that weren't learned.
Allowed enum values: 0,1
sequenceDetectionOptions
object
Options on sequence detection method.
stepTransitions
[object]
Transitions defining the allowed order of steps and their evaluation windows.
child
string
Name of the child step.
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time. For third party detection method, this field is not used.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
parent
string
Name of the parent step.
steps
[object]
Steps that define the conditions to be matched in sequence.
condition
string
Condition referencing rule queries (e.g., a > 0).
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time. For third party detection method, this field is not used.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
name
string
Unique name identifying the step.
thirdPartyRuleOptions
object
Options on third party detection method.
defaultNotifications
[string]
Notification targets for the logs that do not correspond to any of the cases.
defaultStatus
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
rootQueries
[object]
Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
groupByFields
[string]
Fields to group by.
query
string
Query to run on logs.
signalTitleTemplate
string
A template for the signal title; if omitted, the title is generated based on the case name.
queries [required]
[object]
Queries for selecting logs which are part of the rule.
aggregation
enum
The aggregation type.
Allowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none
customQueryExtension
string
Query extension to append to the logs query.
dataSource
enum
Source of events, either logs, audit trail, security signals, or Datadog events. app_sec_spans is deprecated in favor of spans.
Allowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events,security_signals
default: logs
distinctFields
[string]
Field for which the cardinality is measured. Sent as an array.
groupByFields
[string]
Fields to group by.
hasOptionalGroupByFields
boolean
When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.
index
string
This field is currently unstable and might be removed in a minor version upgrade.
The index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.
indexes
[string]
List of indexes to query when the dataSource is logs. Only used for scheduled rules, such as when the schedulingOptions field is present in the rule payload.
metric
string
DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max
aggregations. metrics field should be used instead.
metrics
[string]
Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
name
string
Name of the query.
query
string
Query to run on logs.
referenceTables
[object]
Reference tables for the rule.
checkPresence
boolean
Whether to include or exclude the matched values.
columnName
string
The name of the column in the reference table.
logFieldPath
string
The field in the log to match against the reference table.
ruleQueryName
string
The name of the query to apply the reference table to.
tableName
string
The name of the reference table.
schedulingOptions
object
Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
rrule
string
Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.
start
string
Start date for the schedule, in ISO 8601 format without timezone.
timezone
string
Time zone of the start date, in the tz database format.
tags
[string]
Tags for generated signals.
thirdPartyCases
[object]
Cases for generating signals from third-party rules. Only available for third-party rules.
name
string
Name of the case.
notifications
[string]
Notification targets for each case.
query
string
A query to map a third party event to this case.
status [required]
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
type
enum
The rule type.
Allowed enum values: api_security,application_security,log_detection,workload_activity,workload_security
Option 2
object
Create a new signal correlation rule.
cases [required]
[object]
Cases for generating signals.
actions
[object]
Action to perform for each rule case.
options
object
Options for the rule action
duration
int64
Duration of the action in seconds. 0 indicates no expiration.
flaggedIPType
enum
Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses.
Allowed enum values: SUSPICIOUS,FLAGGED
userBehaviorName
string
Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
type
enum
The action type.
Allowed enum values: block_ip,block_user,user_behavior,flag_ip
condition
string
A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated
based on the event counts in the previously defined queries.
name
string
Name of the case.
notifications
[string]
Notification targets.
status [required]
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
filters
[object]
Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
action
enum
The type of filtering action.
Allowed enum values: require,suppress
query
string
Query for selecting logs to apply the filtering action.
hasExtendedTitle
boolean
Whether the notifications include the triggering group-by values in their title.
isEnabled [required]
boolean
Whether the rule is enabled.
message [required]
string
Message for generated signals.
name [required]
string
The name of the rule.
options [required]
object
Options.
anomalyDetectionOptions
object
Options on anomaly detection method.
bucketDuration
enum
Duration in seconds of the time buckets used to aggregate events matched by the rule.
Must be greater than or equal to 300.
Allowed enum values: 300,600,900,1800,3600,10800
detectionTolerance
enum
An optional parameter that sets how permissive anomaly detection is.
Higher values require higher deviations before triggering a signal.
Allowed enum values: 1,2,3,4,5
instantaneousBaseline
boolean
When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDuration
enum
Learning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating.
Allowed enum values: 1,6,12,24,48,168,336
learningPeriodBaseline
int64
An optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0.
complianceRuleOptions
object
Options for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRule
boolean
Whether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
List of resource types that will be evaluated upon. Must have at least one element.
resourceType
string
Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnv
boolean
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.
The severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.
The decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethod
enum
The detection method.
Allowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time. For third party detection method, this field is not used.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular
access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
keepAlive
enum
Once a signal is generated, the signal will remain "open" if a case is matched at least once within
this keep alive window. For third party detection method, this field is not used.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
maxSignalDuration
enum
A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.
This time is calculated from the first seen timestamp.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
newValueOptions
object
Options on new value detection method.
forgetAfter
int32
The duration in days after which a learned value is forgotten.
instantaneousBaseline
boolean
When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDuration
int32
The duration in days during which values are learned, and after which signals will be generated for values that
weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
learningMethod
enum
The learning method used to determine when signals should be generated for values that weren't learned.
Allowed enum values: duration,threshold
default: duration
learningThreshold
enum
A number of occurrences after which signals will be generated for values that weren't learned.
Allowed enum values: 0,1
sequenceDetectionOptions
object
Options on sequence detection method.
stepTransitions
[object]
Transitions defining the allowed order of steps and their evaluation windows.
child
string
Name of the child step.
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time. For third party detection method, this field is not used.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
parent
string
Name of the parent step.
steps
[object]
Steps that define the conditions to be matched in sequence.
condition
string
Condition referencing rule queries (e.g., a > 0).
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time. For third party detection method, this field is not used.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more,43200,86400
name
string
Unique name identifying the step.
thirdPartyRuleOptions
object
Options on third party detection method.
defaultNotifications
[string]
Notification targets for the logs that do not correspond to any of the cases.
defaultStatus
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
rootQueries
[object]
Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
groupByFields
[string]
Fields to group by.
query
string
Query to run on logs.
signalTitleTemplate
string
A template for the signal title; if omitted, the title is generated based on the case name.
queries [required]
[object]
Queries for selecting signals which are part of the rule.
aggregation
enum
The aggregation type.
Allowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none
correlatedByFields
[string]
Fields to group by.
correlatedQueryIndex
int32
Index of the rule query used to retrieve the correlated field.
metrics
[string]
Group of target fields to aggregate over.
name
string
Name of the query.
ruleId [required]
string
Rule ID to match on signals.
tags
[string]
Tags for generated signals.
type
enum
The rule type.
Allowed enum values: signal_correlation
Option 3
object
Create a new cloud configuration rule.
cases [required]
[object]
Description of generated findings and signals (severity and channels to be notified in case of a signal). Must contain exactly one item.
notifications
[string]
Notification targets for each rule case.
status [required]
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
complianceSignalOptions [required]
object
How to generate compliance signals. Useful for cloud_configuration rules only.
defaultActivationStatus
boolean
The default activation status.
defaultGroupByFields
[string]
The default group by fields.
userActivationStatus
boolean
Whether signals will be sent.
userGroupByFields
[string]
Fields to use to group findings by when sending signals.
filters
[object]
Additional queries to filter matched events before they are processed.
action
enum
The type of filtering action.
Allowed enum values: require,suppress
query
string
Query for selecting logs to apply the filtering action.
isEnabled [required]
boolean
Whether the rule is enabled.
message [required]
string
Message in markdown format for generated findings and signals.
name [required]
string
The name of the rule.
options [required]
object
Options on cloud configuration rules.
complianceRuleOptions [required]
object
Options for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRule
boolean
Whether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
Response object containing the available suppression rules.
Expand All
フィールド
種類
説明
data
[object]
A list of suppressions objects.
attributes
object
The attributes of the suppression rule.
creation_date
int64
A Unix millisecond timestamp given the creation date of the suppression rule.
creator
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
data_exclusion_query
string
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description
string
A description for the suppression rule.
editable
boolean
Whether the suppression rule is editable.
enabled
boolean
Whether the suppression rule is enabled.
expiration_date
int64
A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
name
string
The name of the suppression rule.
rule_query
string
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
start_date
int64
A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals.
suppression_query
string
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer.
tags
[string]
List of tags associated with the suppression rule.
update_date
int64
A Unix millisecond timestamp given the update date of the suppression rule.
updater
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
version
int32
The version of the suppression rule; it starts at 1, and is incremented at each update.
id
string
The ID of the suppression rule.
type
enum
The type of the resource. The value should always be suppressions.
Allowed enum values: suppressions
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get suppressions affecting future rule returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiGetSuppressionsAffectingFutureRuleRequest={body:{name:"Example-Security-Monitoring",queries:[{query:"@test:true",aggregation:"count",groupByFields:[],distinctFields:[],metrics:[],},],filters:[],cases:[{name:"",status:"info",condition:"a > 0",notifications:[],},],options:{evaluationWindow: 900,keepAlive: 3600,maxSignalDuration: 86400,},message:"Test rule",tags:[],isEnabled: true,type:"log_detection",},};apiInstance.getSuppressionsAffectingFutureRule(params).then((data: v2.SecurityMonitoringSuppressionsResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Response object containing the available suppression rules.
Expand All
フィールド
種類
説明
data
[object]
A list of suppressions objects.
attributes
object
The attributes of the suppression rule.
creation_date
int64
A Unix millisecond timestamp given the creation date of the suppression rule.
creator
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
data_exclusion_query
string
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description
string
A description for the suppression rule.
editable
boolean
Whether the suppression rule is editable.
enabled
boolean
Whether the suppression rule is enabled.
expiration_date
int64
A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
name
string
The name of the suppression rule.
rule_query
string
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
start_date
int64
A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals.
suppression_query
string
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer.
tags
[string]
List of tags associated with the suppression rule.
update_date
int64
A Unix millisecond timestamp given the update date of the suppression rule.
updater
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
version
int32
The version of the suppression rule; it starts at 1, and is incremented at each update.
id
string
The ID of the suppression rule.
type
enum
The type of the resource. The value should always be suppressions.
Allowed enum values: suppressions
"""
Get suppressions affecting a specific rule returns "OK" response
"""fromosimportenvironfromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApi# there is a valid "security_rule" in the systemSECURITY_RULE_ID=environ["SECURITY_RULE_ID"]configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.get_suppressions_affecting_rule(rule_id=SECURITY_RULE_ID,)print(response)
# Get suppressions affecting a specific rule returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.new# there is a valid "security_rule" in the systemSECURITY_RULE_ID=ENV["SECURITY_RULE_ID"]papi_instance.get_suppressions_affecting_rule(SECURITY_RULE_ID)
// Get suppressions affecting a specific rule returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){// there is a valid "security_rule" in the systemSecurityRuleID:=os.Getenv("SECURITY_RULE_ID")ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.GetSuppressionsAffectingRule(ctx,SecurityRuleID)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.GetSuppressionsAffectingRule`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.GetSuppressionsAffectingRule`:\n%s\n",responseContent)}
// Get suppressions affecting a specific rule returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.SecurityMonitoringSuppressionsResponse;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);// there is a valid "security_rule" in the systemStringSECURITY_RULE_ID=System.getenv("SECURITY_RULE_ID");try{SecurityMonitoringSuppressionsResponseresult=apiInstance.getSuppressionsAffectingRule(SECURITY_RULE_ID);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#getSuppressionsAffectingRule");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
// Get suppressions affecting a specific rule returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){// there is a valid "security_rule" in the system
letsecurity_rule_id=std::env::var("SECURITY_RULE_ID").unwrap();letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.get_suppressions_affecting_rule(security_rule_id.clone()).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get suppressions affecting a specific rule returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);// there is a valid "security_rule" in the system
constSECURITY_RULE_ID=process.env.SECURITY_RULE_IDasstring;constparams: v2.SecurityMonitoringApiGetSuppressionsAffectingRuleRequest={ruleId: SECURITY_RULE_ID,};apiInstance.getSuppressionsAffectingRule(params).then((data: v2.SecurityMonitoringSuppressionsResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Response for getting the suppression version history.
Expand All
フィールド
種類
説明
data
object
Data for the suppression version history.
attributes
object
Response object containing the version history of a suppression.
count
int32
The number of suppression versions.
data
object
The version history of a suppression.
<any-key>
object
A suppression version with a list of updates.
changes
[object]
A list of changes.
change
string
The new value of the field.
field
string
The field that was changed.
type
enum
The type of change.
Allowed enum values: create,update,delete
suppression
object
The attributes of the suppression rule.
creation_date
int64
A Unix millisecond timestamp given the creation date of the suppression rule.
creator
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
data_exclusion_query
string
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description
string
A description for the suppression rule.
editable
boolean
Whether the suppression rule is editable.
enabled
boolean
Whether the suppression rule is enabled.
expiration_date
int64
A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
name
string
The name of the suppression rule.
rule_query
string
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
start_date
int64
A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals.
suppression_query
string
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer.
tags
[string]
List of tags associated with the suppression rule.
update_date
int64
A Unix millisecond timestamp given the update date of the suppression rule.
updater
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
version
int32
The version of the suppression rule; it starts at 1, and is incremented at each update.
id
string
ID of the suppression.
type
enum
Type of data.
Allowed enum values: suppression_version_history
"""
Get a suppression's version history returns "OK" response
"""fromosimportenvironfromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApi# there is a valid "suppression" in the systemSUPPRESSION_DATA_ID=environ["SUPPRESSION_DATA_ID"]configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.get_suppression_version_history(suppression_id=SUPPRESSION_DATA_ID,)print(response)
# Get a suppression's version history returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.new# there is a valid "suppression" in the systemSUPPRESSION_DATA_ID=ENV["SUPPRESSION_DATA_ID"]papi_instance.get_suppression_version_history(SUPPRESSION_DATA_ID)
// Get a suppression's version history returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){// there is a valid "suppression" in the systemSuppressionDataID:=os.Getenv("SUPPRESSION_DATA_ID")ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.GetSuppressionVersionHistory(ctx,SuppressionDataID,*datadogV2.NewGetSuppressionVersionHistoryOptionalParameters())iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.GetSuppressionVersionHistory`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.GetSuppressionVersionHistory`:\n%s\n",responseContent)}
// Get a suppression's version history returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.GetSuppressionVersionHistoryResponse;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);// there is a valid "suppression" in the systemStringSUPPRESSION_DATA_ID=System.getenv("SUPPRESSION_DATA_ID");try{GetSuppressionVersionHistoryResponseresult=apiInstance.getSuppressionVersionHistory(SUPPRESSION_DATA_ID);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#getSuppressionVersionHistory");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
// Get a suppression's version history returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::GetSuppressionVersionHistoryOptionalParams;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){// there is a valid "suppression" in the system
letsuppression_data_id=std::env::var("SUPPRESSION_DATA_ID").unwrap();letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.get_suppression_version_history(suppression_data_id.clone(),GetSuppressionVersionHistoryOptionalParams::default(),).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get a suppression's version history returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);// there is a valid "suppression" in the system
constSUPPRESSION_DATA_ID=process.env.SUPPRESSION_DATA_IDasstring;constparams: v2.SecurityMonitoringApiGetSuppressionVersionHistoryRequest={suppressionId: SUPPRESSION_DATA_ID,};apiInstance.getSuppressionVersionHistory(params).then((data: v2.GetSuppressionVersionHistoryResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Response object containing the available critical assets.
Expand All
フィールド
種類
説明
data
[object]
A list of critical assets objects.
attributes
object
The attributes of the critical asset.
creation_author_id
int64
ID of user who created the critical asset.
creation_date
int64
A Unix millisecond timestamp given the creation date of the critical asset.
creator
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
enabled
boolean
Whether the critical asset is enabled.
query
string
The query for the critical asset. It uses the same syntax as the queries to search signals in the Signals Explorer.
rule_query
string
The rule query of the critical asset, with the same syntax as the search bar for detection rules. This determines which rules this critical asset will apply to.
severity
enum
Severity associated with this critical asset. Either an explicit severity can be set, or the severity can be increased or decreased, or the severity can be left unchanged (no-op).
Allowed enum values: info,low,medium,high,critical,increase,decrease,no-op
tags
[string]
List of tags associated with the critical asset.
update_author_id
int64
ID of user who updated the critical asset.
update_date
int64
A Unix millisecond timestamp given the update date of the critical asset.
updater
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
version
int32
The version of the critical asset; it starts at 1, and is incremented at each update.
id
string
The ID of the critical asset.
type
enum
The type of the resource. The value should always be critical_assets.
Allowed enum values: critical_assets
"""
Get all critical assets returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApiconfiguration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.list_security_monitoring_critical_assets()print(response)
# Get all critical assets returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newpapi_instance.list_security_monitoring_critical_assets()
// Get all critical assets returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.ListSecurityMonitoringCriticalAssets(ctx,*datadogV2.NewListSecurityMonitoringCriticalAssetsOptionalParameters())iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.ListSecurityMonitoringCriticalAssets`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.ListSecurityMonitoringCriticalAssets`:\n%s\n",responseContent)}
// Get all critical assets returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::ListSecurityMonitoringCriticalAssetsOptionalParams;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.list_security_monitoring_critical_assets(ListSecurityMonitoringCriticalAssetsOptionalParams::default(),).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get all critical assets returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);apiInstance.listSecurityMonitoringCriticalAssets().then((data: v2.SecurityMonitoringCriticalAssetsResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Object containing the attributes of the critical asset to be created.
enabled
boolean
Whether the critical asset is enabled. Defaults to true if not specified.
default: true
query [required]
string
The query for the critical asset. It uses the same syntax as the queries to search signals in the Signals Explorer.
rule_query [required]
string
The rule query of the critical asset, with the same syntax as the search bar for detection rules. This determines which rules this critical asset will apply to.
severity [required]
enum
Severity associated with this critical asset. Either an explicit severity can be set, or the severity can be increased or decreased, or the severity can be left unchanged (no-op).
Allowed enum values: info,low,medium,high,critical,increase,decrease,no-op
tags
[string]
List of tags associated with the critical asset.
type [required]
enum
The type of the resource. The value should always be critical_assets.
Allowed enum values: critical_assets
default: critical_assets
{"data":{"type":"critical_assets","attributes":{"query":"host:examplesecuritymonitoring","rule_query":"type:(log_detection OR signal_correlation OR workload_security OR application_security) source:cloudtrail","severity":"decrease","tags":["team:security","env:test"]}}}
Response object containing a single critical asset.
Expand All
フィールド
種類
説明
data
object
The critical asset's properties.
attributes
object
The attributes of the critical asset.
creation_author_id
int64
ID of user who created the critical asset.
creation_date
int64
A Unix millisecond timestamp given the creation date of the critical asset.
creator
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
enabled
boolean
Whether the critical asset is enabled.
query
string
The query for the critical asset. It uses the same syntax as the queries to search signals in the Signals Explorer.
rule_query
string
The rule query of the critical asset, with the same syntax as the search bar for detection rules. This determines which rules this critical asset will apply to.
severity
enum
Severity associated with this critical asset. Either an explicit severity can be set, or the severity can be increased or decreased, or the severity can be left unchanged (no-op).
Allowed enum values: info,low,medium,high,critical,increase,decrease,no-op
tags
[string]
List of tags associated with the critical asset.
update_author_id
int64
ID of user who updated the critical asset.
update_date
int64
A Unix millisecond timestamp given the update date of the critical asset.
updater
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
version
int32
The version of the critical asset; it starts at 1, and is incremented at each update.
id
string
The ID of the critical asset.
type
enum
The type of the resource. The value should always be critical_assets.
Allowed enum values: critical_assets
// Create a critical asset returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.SecurityMonitoringCriticalAssetCreateRequest{Data:datadogV2.SecurityMonitoringCriticalAssetCreateData{Type:datadogV2.SECURITYMONITORINGCRITICALASSETTYPE_CRITICAL_ASSETS,Attributes:datadogV2.SecurityMonitoringCriticalAssetCreateAttributes{Query:"host:examplesecuritymonitoring",RuleQuery:"type:(log_detection OR signal_correlation OR workload_security OR application_security) source:cloudtrail",Severity:datadogV2.SECURITYMONITORINGCRITICALASSETSEVERITY_DECREASE,Tags:[]string{"team:security","env:test",},},},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.CreateSecurityMonitoringCriticalAsset(ctx,body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.CreateSecurityMonitoringCriticalAsset`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.CreateSecurityMonitoringCriticalAsset`:\n%s\n",responseContent)}
"""
Create a critical asset returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.security_monitoring_critical_asset_create_attributesimport(SecurityMonitoringCriticalAssetCreateAttributes,)fromdatadog_api_client.v2.model.security_monitoring_critical_asset_create_dataimport(SecurityMonitoringCriticalAssetCreateData,)fromdatadog_api_client.v2.model.security_monitoring_critical_asset_create_requestimport(SecurityMonitoringCriticalAssetCreateRequest,)fromdatadog_api_client.v2.model.security_monitoring_critical_asset_severityimport(SecurityMonitoringCriticalAssetSeverity,)fromdatadog_api_client.v2.model.security_monitoring_critical_asset_typeimportSecurityMonitoringCriticalAssetTypebody=SecurityMonitoringCriticalAssetCreateRequest(data=SecurityMonitoringCriticalAssetCreateData(type=SecurityMonitoringCriticalAssetType.CRITICAL_ASSETS,attributes=SecurityMonitoringCriticalAssetCreateAttributes(query="host:examplesecuritymonitoring",rule_query="type:(log_detection OR signal_correlation OR workload_security OR application_security) source:cloudtrail",severity=SecurityMonitoringCriticalAssetSeverity.DECREASE,tags=["team:security","env:test",],),),)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.create_security_monitoring_critical_asset(body=body)print(response)
# Create a critical asset returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newbody=DatadogAPIClient::V2::SecurityMonitoringCriticalAssetCreateRequest.new({data:DatadogAPIClient::V2::SecurityMonitoringCriticalAssetCreateData.new({type:DatadogAPIClient::V2::SecurityMonitoringCriticalAssetType::CRITICAL_ASSETS,attributes:DatadogAPIClient::V2::SecurityMonitoringCriticalAssetCreateAttributes.new({query:"host:examplesecuritymonitoring",rule_query:"type:(log_detection OR signal_correlation OR workload_security OR application_security) source:cloudtrail",severity:DatadogAPIClient::V2::SecurityMonitoringCriticalAssetSeverity::DECREASE,tags:["team:security","env:test",],}),}),})papi_instance.create_security_monitoring_critical_asset(body)
// Create a critical asset returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV2::model::SecurityMonitoringCriticalAssetCreateAttributes;usedatadog_api_client::datadogV2::model::SecurityMonitoringCriticalAssetCreateData;usedatadog_api_client::datadogV2::model::SecurityMonitoringCriticalAssetCreateRequest;usedatadog_api_client::datadogV2::model::SecurityMonitoringCriticalAssetSeverity;usedatadog_api_client::datadogV2::model::SecurityMonitoringCriticalAssetType;#[tokio::main]asyncfnmain(){letbody=SecurityMonitoringCriticalAssetCreateRequest::new(SecurityMonitoringCriticalAssetCreateData::new(SecurityMonitoringCriticalAssetCreateAttributes::new("host:examplesecuritymonitoring".to_string(),"type:(log_detection OR signal_correlation OR workload_security OR application_security) source:cloudtrail".to_string(),SecurityMonitoringCriticalAssetSeverity::DECREASE,).tags(vec!["team:security".to_string(),"env:test".to_string()]),SecurityMonitoringCriticalAssetType::CRITICAL_ASSETS,),);letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.create_security_monitoring_critical_asset(body).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Create a critical asset returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiCreateSecurityMonitoringCriticalAssetRequest={body:{data:{type:"critical_assets",attributes:{query:"host:examplesecuritymonitoring",ruleQuery:"type:(log_detection OR signal_correlation OR workload_security OR application_security) source:cloudtrail",severity:"decrease",tags:["team:security","env:test"],},},},};apiInstance.createSecurityMonitoringCriticalAsset(params).then((data: v2.SecurityMonitoringCriticalAssetResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Response object containing a single critical asset.
Expand All
フィールド
種類
説明
data
object
The critical asset's properties.
attributes
object
The attributes of the critical asset.
creation_author_id
int64
ID of user who created the critical asset.
creation_date
int64
A Unix millisecond timestamp given the creation date of the critical asset.
creator
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
enabled
boolean
Whether the critical asset is enabled.
query
string
The query for the critical asset. It uses the same syntax as the queries to search signals in the Signals Explorer.
rule_query
string
The rule query of the critical asset, with the same syntax as the search bar for detection rules. This determines which rules this critical asset will apply to.
severity
enum
Severity associated with this critical asset. Either an explicit severity can be set, or the severity can be increased or decreased, or the severity can be left unchanged (no-op).
Allowed enum values: info,low,medium,high,critical,increase,decrease,no-op
tags
[string]
List of tags associated with the critical asset.
update_author_id
int64
ID of user who updated the critical asset.
update_date
int64
A Unix millisecond timestamp given the update date of the critical asset.
updater
object
A user.
handle
string
The handle of the user.
name
string
The name of the user.
version
int32
The version of the critical asset; it starts at 1, and is incremented at each update.
id
string
The ID of the critical asset.
type
enum
The type of the resource. The value should always be critical_assets.
Allowed enum values: critical_assets
"""
Get a critical asset returns "OK" response
"""fromosimportenvironfromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApi# there is a valid "critical_asset" in the systemCRITICAL_ASSET_DATA_ID=environ["CRITICAL_ASSET_DATA_ID"]configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.get_security_monitoring_critical_asset(critical_asset_id=CRITICAL_ASSET_DATA_ID,)print(response)
# Get a critical asset returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.new# there is a valid "critical_asset" in the systemCRITICAL_ASSET_DATA_ID=ENV["CRITICAL_ASSET_DATA_ID"]papi_instance.get_security_monitoring_critical_asset(CRITICAL_ASSET_DATA_ID)
// Get a critical asset returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){// there is a valid "critical_asset" in the systemCriticalAssetDataID:=os.Getenv("CRITICAL_ASSET_DATA_ID")ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.GetSecurityMonitoringCriticalAsset(ctx,CriticalAssetDataID)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.GetSecurityMonitoringCriticalAsset`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.GetSecurityMonitoringCriticalAsset`:\n%s\n",responseContent)}
// Get a critical asset returns "OK" responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.SecurityMonitoringCriticalAssetResponse;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);// there is a valid "critical_asset" in the systemStringCRITICAL_ASSET_DATA_ID=System.getenv("CRITICAL_ASSET_DATA_ID");try{SecurityMonitoringCriticalAssetResponseresult=apiInstance.getSecurityMonitoringCriticalAsset(CRITICAL_ASSET_DATA_ID);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#getSecurityMonitoringCriticalAsset");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
// Get a critical asset returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){// there is a valid "critical_asset" in the system
letcritical_asset_data_id=std::env::var("CRITICAL_ASSET_DATA_ID").unwrap();letconfiguration=datadog::Configuration::new();letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.get_security_monitoring_critical_asset(critical_asset_data_id.clone()).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get a critical asset returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);// there is a valid "critical_asset" in the system
constCRITICAL_ASSET_DATA_ID=process.env.CRITICAL_ASSET_DATA_IDasstring;constparams: v2.SecurityMonitoringApiGetSecurityMonitoringCriticalAssetRequest={criticalAssetId: CRITICAL_ASSET_DATA_ID,};apiInstance.getSecurityMonitoringCriticalAsset(params).then((data: v2.SecurityMonitoringCriticalAssetResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));