--- title: Update a batch migration resource description: Datadog, the leading service for cloud-scale monitoring. breadcrumbs: Docs > API Reference > Security Monitoring --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Update a batch migration resource{% #update-a-batch-migration-resource %} {% tab title="v2" %} **Note**: This endpoint is in Preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. | Datadog site | API endpoint | | ----------------- | ------------------------------------------------------------------------------------------------------------------ | | ap1.datadoghq.com | PATCH https://api.ap1.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id} | | ap2.datadoghq.com | PATCH https://api.ap2.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id} | | app.datadoghq.eu | PATCH https://api.datadoghq.eu/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id} | | app.ddog-gov.com | PATCH https://api.ddog-gov.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id} | | us2.ddog-gov.com | PATCH https://api.us2.ddog-gov.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id} | | uk1.datadoghq.com | PATCH https://api.uk1.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id} | | app.datadoghq.com | PATCH https://api.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id} | | us3.datadoghq.com | PATCH https://api.us3.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id} | | us5.datadoghq.com | PATCH https://api.us5.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id} | ### Overview Update a resource of a batch migration. At least one of `name`, `description`, `inputType`, or `input` must be provided. `name` and `description` can be updated at any time. `inputType` and `input` can only be updated while the resource is `pending`; otherwise, the request returns `409 Conflict`. The translated `output` cannot be edited. This endpoint requires the `security_monitoring_rules_write` permission. OAuth apps require the `security_monitoring_rules_write` authorization [scope](https://docs.datadoghq.com/api/latest/scopes.md#security-monitoring) to access this endpoint. ### Arguments #### Path Parameters | Name | Type | Description | | ----------------------------- | ------ | ----------------------------------------- | | batch_id [*required*] | string | The UUID of the batch migration. | | resource_id [*required*] | string | The UUID of the batch migration resource. | ### Request #### Body Data (required) {% tab title="Model" %} | Parent field | Field | Type | Description | | ------------ | ---------------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | data [*required*] | object | Data of the batch migration resource to update. | | data | attributes [*required*] | object | Attributes of the batch migration resource to update. At least one attribute is required. | | attributes | description | string | The description of the resource. | | attributes | input | string | The source query or natural language description to translate. Must not be blank. | | attributes | inputType | enum | The type of the source rule: `spl` for a Splunk SPL search or saved search definition, `natural_language` for a plain-English description of the behavior to detect, or `kql` for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded. Allowed enum values: `natural_language,spl,kql` | | attributes | name | string | The name of the resource. | | data | type [*required*] | enum | The type of resource for a batch migration resource. Allowed enum values: `batchMigrationResource` | {% /tab %} {% tab title="Example" %} ```json { "data": { "type": "batchMigrationResource", "attributes": { "input": "index=wineventlog EventCode=4625 | stats count by user" } } } ``` {% /tab %} ### Response {% tab title="200" %} OK {% tab title="Model" %} Response containing a batch migration resource. | Parent field | Field | Type | Description | | ------------ | ------------------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | data [*required*] | object | A batch migration resource. | | data | attributes [*required*] | object | Attributes of a batch migration resource. | | attributes | batchId [*required*] | uuid | The UUID of the batch migration that contains the resource. | | attributes | createdAt [*required*] | date-time | The creation date of the resource, in RFC 3339 format. | | attributes | createdBy | string | The UUID of the user or service account who created the resource. | | attributes | description | string | The description of the resource. | | attributes | input [*required*] | string | The source query or natural language description to translate. | | attributes | inputType [*required*] | enum | The type of the source rule: `spl` for a Splunk SPL search or saved search definition, `natural_language` for a plain-English description of the behavior to detect, or `kql` for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded. Allowed enum values: `natural_language,spl,kql` | | attributes | lastUpdatedAt [*required*] | date-time | The last update date of the resource, in RFC 3339 format. | | attributes | lastUpdatedBy | string | The UUID of the user or service account who last updated the resource, or the name of a system actor. | | attributes | name [*required*] | string | The name of the resource. | | attributes | output [*required*] | object | The translation output. When the resource is `completed`, a Cloud SIEM detection rule definition in the same format as the create detection rule API. When the resource is `failed`, an object with an `error` describing the failure, with `kind` set to `translation_error` or `internal_error`, and optional `type` and `message`. Otherwise, null. | | attributes | outputType [*required*] | string | The type of the translation output. Currently always `siem_rule`. | | attributes | ruleId | string | The ID of the Cloud SIEM detection rule created when the resource was published. | | attributes | status [*required*] | enum | The status of a batch migration resource. `completed` resources have a translation in `output` that is ready to be published. `duplicate` is reserved for future duplicate rule detection. Allowed enum values: `pending,in_progress,completed,canceled,failed,publishing,published,duplicate` | | data | id [*required*] | uuid | The UUID of the batch migration resource. | | data | type [*required*] | enum | The type of resource for a batch migration resource. Allowed enum values: `batchMigrationResource` | {% /tab %} {% tab title="Example" %} ```json { "data": { "attributes": { "batchId": "7cdb3a75-64fb-46ce-9445-41969e78fe8e", "createdAt": "2026-09-21T12:00:00Z", "createdBy": "3653d3c6-0c75-11ea-ad28-fb5701eabc7d", "description": "Detects repeated failed Windows authentication attempts.", "input": "index=wineventlog EventCode=4625", "inputType": "spl", "lastUpdatedAt": "2026-09-21T12:02:00Z", "lastUpdatedBy": "3653d3c6-0c75-11ea-ad28-fb5701eabc7d", "name": "Repeated Windows login failures", "output": { "name": "Repeated Windows login failures", "type": "log_detection" }, "outputType": "siem_rule", "ruleId": "abc-def-ghi", "status": "completed" }, "id": "c968cf83-56c2-4d54-a993-6c86dfb83527", "type": "batchMigrationResource" } } ``` {% /tab %} {% /tab %} {% tab title="400" %} Bad Request {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="401" %} Unauthorized {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="403" %} Forbidden {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="404" %} Not Found {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="409" %} Conflict {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="429" %} Too many requests {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} ### Code Example ##### \## default # \# Path parameters export batch_id="7cdb3a75-64fb-46ce-9445-41969e78fe8e" export resource_id="c968cf83-56c2-4d54-a993-6c86dfb83527" \# Use a Personal Access Token or Service Access Token export DD_BEARER_TOKEN="" \# Curl command curl -X PATCH "https://api.datadoghq.com/api/v2/security_monitoring/batch-migrations/${batch_id}/resources/${resource_id}" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" \ -d @- << EOF { "data": { "attributes": { "input": "index=wineventlog EventCode=4625 | stats count by user" }, "type": "batchMigrationResource" } } EOF {% /tab %}