--- title: Add resources to a batch migration description: Datadog, the leading service for cloud-scale monitoring. breadcrumbs: Docs > API Reference > Security Monitoring --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Add resources to a batch migration{% #add-resources-to-a-batch-migration %} {% tab title="v2" %} **Note**: This endpoint is in Preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. | Datadog site | API endpoint | | ----------------- | --------------------------------------------------------------------------------------------------- | | ap1.datadoghq.com | POST https://api.ap1.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | ap2.datadoghq.com | POST https://api.ap2.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | app.datadoghq.eu | POST https://api.datadoghq.eu/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | app.ddog-gov.com | POST https://api.ddog-gov.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | us2.ddog-gov.com | POST https://api.us2.ddog-gov.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | uk1.datadoghq.com | POST https://api.uk1.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | app.datadoghq.com | POST https://api.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | us3.datadoghq.com | POST https://api.us3.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | | us5.datadoghq.com | POST https://api.us5.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources | ### Overview Add 1 to 1000 resources to a `draft` batch migration. Returns `409 Conflict` if the batch migration is not `draft`, and `400 Bad Request` if the batch migration would contain more than 1000 resources. This endpoint requires the `security_monitoring_rules_write` permission. OAuth apps require the `security_monitoring_rules_write` authorization [scope](https://docs.datadoghq.com/api/latest/scopes.md#security-monitoring) to access this endpoint. ### Arguments #### Path Parameters | Name | Type | Description | | -------------------------- | ------ | -------------------------------- | | batch_id [*required*] | string | The UUID of the batch migration. | ### Request #### Body Data (required) {% tab title="Model" %} | Parent field | Field | Type | Description | | ------------ | ---------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | data [*required*] | object | Data of the resources to add to a batch migration. | | data | attributes [*required*] | object | Attributes of the resources to add to a batch migration. | | attributes | resources [*required*] | [object] | The resources to add. From 1 to 1000 resources. | | resources | description | string | The description of the resource. | | resources | input [*required*] | string | The source query or natural language description to translate. Must not be blank. | | resources | inputType [*required*] | enum | The type of the source rule: `spl` for a Splunk SPL search or saved search definition, `natural_language` for a plain-English description of the behavior to detect, or `kql` for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded. Allowed enum values: `natural_language,spl,kql` | | resources | name | string | The name of the resource. | | data | type [*required*] | enum | The type of resource for a request on a set of batch migration resources. Allowed enum values: `batchMigrationResources` | {% /tab %} {% tab title="Example" %} ```json { "data": { "type": "batchMigrationResources", "attributes": { "resources": [ { "name": "Linux sudo abuse", "inputType": "spl", "input": "index=linux process=sudo \"authentication failure\" | stats count by user, host" } ] } } } ``` {% /tab %} ### Response {% tab title="201" %} Created {% tab title="Model" %} Response containing the batch migration resources that were added. | Parent field | Field | Type | Description | | ------------ | ------------------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | data [*required*] | [object] | The added batch migration resources. | | data | attributes [*required*] | object | Attributes of a batch migration resource. | | attributes | batchId [*required*] | uuid | The UUID of the batch migration that contains the resource. | | attributes | createdAt [*required*] | date-time | The creation date of the resource, in RFC 3339 format. | | attributes | createdBy | string | The UUID of the user or service account who created the resource. | | attributes | description | string | The description of the resource. | | attributes | input [*required*] | string | The source query or natural language description to translate. | | attributes | inputType [*required*] | enum | The type of the source rule: `spl` for a Splunk SPL search or saved search definition, `natural_language` for a plain-English description of the behavior to detect, or `kql` for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded. Allowed enum values: `natural_language,spl,kql` | | attributes | lastUpdatedAt [*required*] | date-time | The last update date of the resource, in RFC 3339 format. | | attributes | lastUpdatedBy | string | The UUID of the user or service account who last updated the resource, or the name of a system actor. | | attributes | name [*required*] | string | The name of the resource. | | attributes | output [*required*] | object | The translation output. When the resource is `completed`, a Cloud SIEM detection rule definition in the same format as the create detection rule API. When the resource is `failed`, an object with an `error` describing the failure, with `kind` set to `translation_error` or `internal_error`, and optional `type` and `message`. Otherwise, null. | | attributes | outputType [*required*] | string | The type of the translation output. Currently always `siem_rule`. | | attributes | ruleId | string | The ID of the Cloud SIEM detection rule created when the resource was published. | | attributes | status [*required*] | enum | The status of a batch migration resource. `completed` resources have a translation in `output` that is ready to be published. `duplicate` is reserved for future duplicate rule detection. Allowed enum values: `pending,in_progress,completed,canceled,failed,publishing,published,duplicate` | | data | id [*required*] | uuid | The UUID of the batch migration resource. | | data | type [*required*] | enum | The type of resource for a batch migration resource. Allowed enum values: `batchMigrationResource` | {% /tab %} {% tab title="Example" %} ```json { "data": [ { "attributes": { "batchId": "7cdb3a75-64fb-46ce-9445-41969e78fe8e", "createdAt": "2026-09-21T12:00:00Z", "createdBy": "3653d3c6-0c75-11ea-ad28-fb5701eabc7d", "description": "Detects repeated failed Windows authentication attempts.", "input": "index=wineventlog EventCode=4625", "inputType": "spl", "lastUpdatedAt": "2026-09-21T12:02:00Z", "lastUpdatedBy": "3653d3c6-0c75-11ea-ad28-fb5701eabc7d", "name": "Repeated Windows login failures", "output": { "name": "Repeated Windows login failures", "type": "log_detection" }, "outputType": "siem_rule", "ruleId": "abc-def-ghi", "status": "completed" }, "id": "c968cf83-56c2-4d54-a993-6c86dfb83527", "type": "batchMigrationResource" } ] } ``` {% /tab %} {% /tab %} {% tab title="400" %} Bad Request {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="401" %} Unauthorized {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="403" %} Forbidden {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="404" %} Not Found {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="409" %} Conflict {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="429" %} Too many requests {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} ### Code Example ##### \## default # \# Path parameters export batch_id="7cdb3a75-64fb-46ce-9445-41969e78fe8e" \# Use a Personal Access Token or Service Access Token export DD_BEARER_TOKEN="" \# Curl command curl -X POST "https://api.datadoghq.com/api/v2/security_monitoring/batch-migrations/${batch_id}/resources" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" \ -d @- << EOF { "data": { "attributes": { "resources": [ { "input": "index=linux process=sudo \"authentication failure\" | stats count by user, host", "inputType": "spl", "name": "Linux sudo abuse" } ] }, "type": "batchMigrationResources" } } EOF {% /tab %}