Filtering on tags: ?filter[tags]=tag_key:tag_value&filter[tags]=tag_key_2:tag_value_2
Here, attribute_key can be any of the filter keys described further below.
Query parameters of type integer support comparison operators (>, >=, <, <=). This is particularly useful when filtering by evaluation_changed_at or resource_discovery_timestamp. For example: ?filter[evaluation_changed_at]=>20123123121.
You can also use the negation operator on strings. For example, use filter[resource_type]=-aws* to filter for any non-AWS resources.
The operator must come after the equal sign. For example, to filter with the >= operator, add the operator after the equal sign: filter[evaluation_changed_at]=>=1678809373257.
Query parameters must be only among the documented ones and with values of correct types. Duplicated query parameters (e.g. filter[status]=low&filter[status]=info) are not allowed.
The expected response schema when listing findings.
Expand All
항목
유형
설명
data [required]
[object]
Array of findings.
attributes
object
The JSON:API attributes of the finding.
evaluation
enum
The evaluation of the finding.
Allowed enum values: pass,fail
evaluation_changed_at
int64
The date on which the evaluation for this finding changed (Unix ms).
mute
object
Information about the mute status of this finding.
description
string
Additional information about the reason why this finding is muted or unmuted.
expiration_date
int64
The expiration date of the mute or unmute action (Unix ms).
muted
boolean
Whether this finding is muted or unmuted.
reason
enum
The reason why this finding is muted or unmuted.
Allowed enum values: PENDING_FIX,FALSE_POSITIVE,ACCEPTED_RISK,NO_PENDING_FIX,HUMAN_ERROR,NO_LONGER_ACCEPTED_RISK,OTHER
start_date
int64
The start of the mute period.
uuid
string
The ID of the user who muted or unmuted this finding.
resource
string
The resource name of this finding.
resource_discovery_date
int64
The date on which the resource was discovered (Unix ms).
resource_type
string
The resource type of this finding.
rule
object
The rule that triggered this finding.
id
string
The ID of the rule that triggered this finding.
name
string
The name of the rule that triggered this finding.
status
enum
The status of the finding.
Allowed enum values: critical,high,medium,low,info
tags
[string]
The tags associated with this finding.
id
string
The unique ID for this finding.
type
enum
The JSON:API type for findings.
Allowed enum values: finding
default: finding
meta [required]
object
Metadata for pagination.
page
object
Pagination and findings count information.
cursor
string
The cursor used to paginate requests.
total_filtered_count
int64
The total count of findings after the filter has been applied.
snapshot_timestamp
int64
The point in time corresponding to the listed findings.
{"data":[{"attributes":{"evaluation":"pass","evaluation_changed_at":1678721573794,"mute":{"description":"To be resolved later","expiration_date":1778721573794,"muted":true,"reason":"ACCEPTED_RISK","start_date":1678721573794,"uuid":"e51c9744-d158-11ec-ad23-da7ad0900002"},"resource":"my_resource_name","resource_discovery_date":1678721573794,"resource_type":"azure_storage_account","rule":{"id":"dv2-jzf-41i","name":"Soft delete is enabled for Azure Storage"},"status":"critical","tags":["cloud_provider:aws","myTag:myValue"]},"id":"ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==","type":"finding"}],"meta":{"page":{"cursor":"eyJhZnRlciI6IkFRQUFBWWJiaEJXQS1OY1dqUUFBQUFCQldXSmlhRUpYUVVGQlJFSktkbTlDTUdaWFRVbDNRVUUiLCJ2YWx1ZXMiOlsiY3JpdGljYWwiXX0=","total_filtered_count":213},"snapshot_timestamp":1678721573794}}
Bad Request: The server cannot process the request due to invalid syntax in the request.
/**
* List findings returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();configuration.unstableOperations["v2.listFindings"]=true;constapiInstance=newv2.SecurityMonitoringApi(configuration);apiInstance.listFindings().then((data: v2.ListFindingsResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
The expected response schema when getting a finding.
Expand All
항목
유형
설명
data [required]
object
A single finding with with message and resource configuration.
attributes
object
The JSON:API attributes of the detailed finding.
evaluation
enum
The evaluation of the finding.
Allowed enum values: pass,fail
evaluation_changed_at
int64
The date on which the evaluation for this finding changed (Unix ms).
message
string
The remediation message for this finding.
mute
object
Information about the mute status of this finding.
description
string
Additional information about the reason why this finding is muted or unmuted.
expiration_date
int64
The expiration date of the mute or unmute action (Unix ms).
muted
boolean
Whether this finding is muted or unmuted.
reason
enum
The reason why this finding is muted or unmuted.
Allowed enum values: PENDING_FIX,FALSE_POSITIVE,ACCEPTED_RISK,NO_PENDING_FIX,HUMAN_ERROR,NO_LONGER_ACCEPTED_RISK,OTHER
start_date
int64
The start of the mute period.
uuid
string
The ID of the user who muted or unmuted this finding.
resource
string
The resource name of this finding.
resource_configuration
object
The resource configuration for this finding.
resource_discovery_date
int64
The date on which the resource was discovered (Unix ms).
resource_type
string
The resource type of this finding.
rule
object
The rule that triggered this finding.
id
string
The ID of the rule that triggered this finding.
name
string
The name of the rule that triggered this finding.
status
enum
The status of the finding.
Allowed enum values: critical,high,medium,low,info
tags
[string]
The tags associated with this finding.
id
string
The unique ID for this finding.
type
enum
The JSON:API type for findings that have the message and resource configuration.
Allowed enum values: detailed_finding
default: detailed_finding
{"data":{"attributes":{"evaluation":"pass","evaluation_changed_at":1678721573794,"message":"## Remediation\n\n### From the console\n\n1. Go to Storage Account\n2. For each Storage Account, navigate to Data Protection\n3. Select Set soft delete enabled and enter the number of days to retain soft deleted data.","mute":{"description":"To be resolved later","expiration_date":1778721573794,"muted":true,"reason":"ACCEPTED_RISK","start_date":1678721573794,"uuid":"e51c9744-d158-11ec-ad23-da7ad0900002"},"resource":"my_resource_name","resource_configuration":{},"resource_discovery_date":1678721573794,"resource_type":"azure_storage_account","rule":{"id":"dv2-jzf-41i","name":"Soft delete is enabled for Azure Storage"},"status":"critical","tags":["cloud_provider:aws","myTag:myValue"]},"id":"ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==","type":"detailed_finding"}}
Bad Request: The server cannot process the request due to invalid syntax in the request.
"""
Get a finding returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApiconfiguration=Configuration()configuration.unstable_operations["get_finding"]=TruewithApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.get_finding(finding_id="AgAAAYd59gjghzF52gAAAAAAAAAYAAAAAEFZZDU5Z2pnQUFCRTRvV1lFeEo4SlFBQQAAACQAAAAAMDE4NzdhMDEtMDRiYS00NTZlLWFmMzMtNTIxNmNkNjVlNDMz",)print(response)
# Get a finding returns "OK" responserequire"datadog_api_client"DatadogAPIClient.configuredo|config|config.unstable_operations["v2.get_finding".to_sym]=trueendapi_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newpapi_instance.get_finding("AgAAAYd59gjghzF52gAAAAAAAAAYAAAAAEFZZDU5Z2pnQUFCRTRvV1lFeEo4SlFBQQAAACQAAAAAMDE4NzdhMDEtMDRiYS00NTZlLWFmMzMtNTIxNmNkNjVlNDMz")
// Get a finding returns "OK" response
packagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()configuration.SetUnstableOperationEnabled("v2.GetFinding",true)apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.GetFinding(ctx,"AgAAAYd59gjghzF52gAAAAAAAAAYAAAAAEFZZDU5Z2pnQUFCRTRvV1lFeEo4SlFBQQAAACQAAAAAMDE4NzdhMDEtMDRiYS00NTZlLWFmMzMtNTIxNmNkNjVlNDMz",*datadogV2.NewGetFindingOptionalParameters())iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.GetFinding`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.GetFinding`:\n%s\n",responseContent)}
/**
* Get a finding returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();configuration.unstableOperations["v2.getFinding"]=true;constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiGetFindingRequest={findingId:"AgAAAYd59gjghzF52gAAAAAAAAAYAAAAAEFZZDU5Z2pnQUFCRTRvV1lFeEo4SlFBQQAAACQAAAAAMDE4NzdhMDEtMDRiYS00NTZlLWFmMzMtNTIxNmNkNjVlNDMz",};apiInstance.getFinding(params).then((data: v2.GetFindingResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
All findings are updated with the same attributes. The request body must include at least two attributes: muted and reason.
The allowed reasons depend on whether the finding is being muted or unmuted:
To mute a finding: PENDING_FIX, FALSE_POSITIVE, ACCEPTED_RISK, OTHER.
To unmute a finding : NO_PENDING_FIX, HUMAN_ERROR, NO_LONGER_ACCEPTED_RISK, OTHER.
Meta
The request body must include a list of the finding IDs to be updated.
Data object containing the new bulk mute properties of the finding.
attributes [required]
object
The mute properties to be updated.
mute [required]
object
Object containing the new mute properties of the findings.
description
string
Additional information about the reason why those findings are muted or unmuted. This field has a maximum limit of 280 characters.
expiration_date
int64
The expiration date of the mute or unmute action (Unix ms). It must be set to a value greater than the current timestamp.
If this field is not provided, the finding will be muted or unmuted indefinitely, which is equivalent to setting the expiration date to 9999999999999.
muted [required]
boolean
Whether those findings should be muted or unmuted.
reason [required]
enum
The reason why this finding is muted or unmuted.
Allowed enum values: PENDING_FIX,FALSE_POSITIVE,ACCEPTED_RISK,NO_PENDING_FIX,HUMAN_ERROR,NO_LONGER_ACCEPTED_RISK,OTHER
id [required]
string
UUID to identify the request
meta [required]
object
Meta object containing the findings to be updated.
findings
[object]
Array of findings.
finding_id
string
The unique ID for this finding.
type [required]
enum
The JSON:API type for findings.
Allowed enum values: finding
// Mute or unmute a batch of findings returns "OK" response
packagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.BulkMuteFindingsRequest{Data:datadogV2.BulkMuteFindingsRequestData{Attributes:datadogV2.BulkMuteFindingsRequestAttributes{Mute:datadogV2.BulkMuteFindingsRequestProperties{ExpirationDate:datadog.PtrInt64(1778721573794),Muted:true,Reason:datadogV2.FINDINGMUTEREASON_ACCEPTED_RISK,},},Id:"dbe5f567-192b-4404-b908-29b70e1c9f76",Meta:datadogV2.BulkMuteFindingsRequestMeta{Findings:[]datadogV2.BulkMuteFindingsRequestMetaFindings{{FindingId:datadog.PtrString("ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw=="),},},},Type:datadogV2.FINDINGTYPE_FINDING,},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()configuration.SetUnstableOperationEnabled("v2.MuteFindings",true)apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.MuteFindings(ctx,body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.MuteFindings`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.MuteFindings`:\n%s\n",responseContent)}
// Mute or unmute a batch of findings returns "OK" response
importcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.BulkMuteFindingsRequest;importcom.datadog.api.client.v2.model.BulkMuteFindingsRequestAttributes;importcom.datadog.api.client.v2.model.BulkMuteFindingsRequestData;importcom.datadog.api.client.v2.model.BulkMuteFindingsRequestMeta;importcom.datadog.api.client.v2.model.BulkMuteFindingsRequestMetaFindings;importcom.datadog.api.client.v2.model.BulkMuteFindingsRequestProperties;importcom.datadog.api.client.v2.model.BulkMuteFindingsResponse;importcom.datadog.api.client.v2.model.FindingMuteReason;importcom.datadog.api.client.v2.model.FindingType;importjava.util.Collections;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();defaultClient.setUnstableOperationEnabled("v2.muteFindings",true);SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);BulkMuteFindingsRequestbody=newBulkMuteFindingsRequest().data(newBulkMuteFindingsRequestData().attributes(newBulkMuteFindingsRequestAttributes().mute(newBulkMuteFindingsRequestProperties().expirationDate(1778721573794L).muted(true).reason(FindingMuteReason.ACCEPTED_RISK))).id("dbe5f567-192b-4404-b908-29b70e1c9f76").meta(newBulkMuteFindingsRequestMeta().findings(Collections.singletonList(newBulkMuteFindingsRequestMetaFindings().findingId("ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==")))).type(FindingType.FINDING));try{BulkMuteFindingsResponseresult=apiInstance.muteFindings(body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#muteFindings");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Mute or unmute a batch of findings returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.bulk_mute_findings_requestimportBulkMuteFindingsRequestfromdatadog_api_client.v2.model.bulk_mute_findings_request_attributesimportBulkMuteFindingsRequestAttributesfromdatadog_api_client.v2.model.bulk_mute_findings_request_dataimportBulkMuteFindingsRequestDatafromdatadog_api_client.v2.model.bulk_mute_findings_request_metaimportBulkMuteFindingsRequestMetafromdatadog_api_client.v2.model.bulk_mute_findings_request_meta_findingsimportBulkMuteFindingsRequestMetaFindingsfromdatadog_api_client.v2.model.bulk_mute_findings_request_propertiesimportBulkMuteFindingsRequestPropertiesfromdatadog_api_client.v2.model.finding_mute_reasonimportFindingMuteReasonfromdatadog_api_client.v2.model.finding_typeimportFindingTypebody=BulkMuteFindingsRequest(data=BulkMuteFindingsRequestData(attributes=BulkMuteFindingsRequestAttributes(mute=BulkMuteFindingsRequestProperties(expiration_date=1778721573794,muted=True,reason=FindingMuteReason.ACCEPTED_RISK,),),id="dbe5f567-192b-4404-b908-29b70e1c9f76",meta=BulkMuteFindingsRequestMeta(findings=[BulkMuteFindingsRequestMetaFindings(finding_id="ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",),],),type=FindingType.FINDING,),)configuration=Configuration()configuration.unstable_operations["mute_findings"]=TruewithApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.mute_findings(body=body)print(response)
# Mute or unmute a batch of findings returns "OK" responserequire"datadog_api_client"DatadogAPIClient.configuredo|config|config.unstable_operations["v2.mute_findings".to_sym]=trueendapi_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newbody=DatadogAPIClient::V2::BulkMuteFindingsRequest.new({data:DatadogAPIClient::V2::BulkMuteFindingsRequestData.new({attributes:DatadogAPIClient::V2::BulkMuteFindingsRequestAttributes.new({mute:DatadogAPIClient::V2::BulkMuteFindingsRequestProperties.new({expiration_date:1778721573794,muted:true,reason:DatadogAPIClient::V2::FindingMuteReason::ACCEPTED_RISK,}),}),id:"dbe5f567-192b-4404-b908-29b70e1c9f76",meta:DatadogAPIClient::V2::BulkMuteFindingsRequestMeta.new({findings:[DatadogAPIClient::V2::BulkMuteFindingsRequestMetaFindings.new({finding_id:"ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",}),],}),type:DatadogAPIClient::V2::FindingType::FINDING,}),})papi_instance.mute_findings(body)
/**
* Mute or unmute a batch of findings returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();configuration.unstableOperations["v2.muteFindings"]=true;constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiMuteFindingsRequest={body:{data:{attributes:{mute:{expirationDate: 1778721573794,muted: true,reason:"ACCEPTED_RISK",},},id:"dbe5f567-192b-4404-b908-29b70e1c9f76",meta:{findings:[{findingId:"ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",},],},type:"finding",},},};apiInstance.muteFindings(params).then((data: v2.BulkMuteFindingsResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
Add a security signal to an incident. This makes it possible to search for signals by incident within the signal explorer and to view the signals on the incident timeline.
// Add a security signal to an incident returns "OK" response
packagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV1")funcmain(){body:=datadogV1.AddSignalToIncidentRequest{IncidentId:2609,}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV1.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.AddSecurityMonitoringSignalToIncident(ctx,"AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.AddSecurityMonitoringSignalToIncident`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.AddSecurityMonitoringSignalToIncident`:\n%s\n",responseContent)}
// Add a security signal to an incident returns "OK" response
importcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v1.api.SecurityMonitoringApi;importcom.datadog.api.client.v1.model.AddSignalToIncidentRequest;importcom.datadog.api.client.v1.model.SuccessfulSignalUpdateResponse;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);AddSignalToIncidentRequestbody=newAddSignalToIncidentRequest().incidentId(2609L);try{SuccessfulSignalUpdateResponseresult=apiInstance.addSecurityMonitoringSignalToIncident("AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#addSecurityMonitoringSignalToIncident");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Add a security signal to an incident returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v1.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v1.model.add_signal_to_incident_requestimportAddSignalToIncidentRequestbody=AddSignalToIncidentRequest(incident_id=2609,)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.add_security_monitoring_signal_to_incident(signal_id="AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body=body)print(response)
# Add a security signal to an incident returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V1::SecurityMonitoringAPI.newbody=DatadogAPIClient::V1::AddSignalToIncidentRequest.new({incident_id:2609,})papi_instance.add_security_monitoring_signal_to_incident("AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body)
/**
* Add a security signal to an incident returns "OK" response
*/import{client,v1}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv1.SecurityMonitoringApi(configuration);constparams: v1.SecurityMonitoringApiAddSecurityMonitoringSignalToIncidentRequest={body:{incidentId: 2609,},signalId:"AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",};apiInstance.addSecurityMonitoringSignalToIncident(params).then((data: v1.SuccessfulSignalUpdateResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
// Change the triage state of a security signal returns "OK" response
packagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV1")funcmain(){body:=datadogV1.SignalStateUpdateRequest{ArchiveReason:datadogV1.SIGNALARCHIVEREASON_NONE.Ptr(),State:datadogV1.SIGNALTRIAGESTATE_OPEN,}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV1.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.EditSecurityMonitoringSignalState(ctx,"AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.EditSecurityMonitoringSignalState`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.EditSecurityMonitoringSignalState`:\n%s\n",responseContent)}
// Change the triage state of a security signal returns "OK" response
importcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v1.api.SecurityMonitoringApi;importcom.datadog.api.client.v1.model.SignalArchiveReason;importcom.datadog.api.client.v1.model.SignalStateUpdateRequest;importcom.datadog.api.client.v1.model.SignalTriageState;importcom.datadog.api.client.v1.model.SuccessfulSignalUpdateResponse;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);SignalStateUpdateRequestbody=newSignalStateUpdateRequest().archiveReason(SignalArchiveReason.NONE).state(SignalTriageState.OPEN);try{SuccessfulSignalUpdateResponseresult=apiInstance.editSecurityMonitoringSignalState("AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#editSecurityMonitoringSignalState");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Change the triage state of a security signal returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v1.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v1.model.signal_archive_reasonimportSignalArchiveReasonfromdatadog_api_client.v1.model.signal_state_update_requestimportSignalStateUpdateRequestfromdatadog_api_client.v1.model.signal_triage_stateimportSignalTriageStatebody=SignalStateUpdateRequest(archive_reason=SignalArchiveReason.NONE,state=SignalTriageState.OPEN,)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.edit_security_monitoring_signal_state(signal_id="AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body=body)print(response)
# Change the triage state of a security signal returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V1::SecurityMonitoringAPI.newbody=DatadogAPIClient::V1::SignalStateUpdateRequest.new({archive_reason:DatadogAPIClient::V1::SignalArchiveReason::NONE,state:DatadogAPIClient::V1::SignalTriageState::OPEN,})papi_instance.edit_security_monitoring_signal_state("AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",body)
/**
* Change the triage state of a security signal returns "OK" response
*/import{client,v1}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv1.SecurityMonitoringApi(configuration);constparams: v1.SecurityMonitoringApiEditSecurityMonitoringSignalStateRequest={body:{archiveReason:"none",state:"open",},signalId:"AQAAAYDiB_Ol8PbzFAAAAABBWURpQl9PbEFBQU0yeXhGTG9ZV2JnQUE",};apiInstance.editSecurityMonitoringSignalState(params).then((data: v1.SuccessfulSignalUpdateResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
// Change the triage state of a security signal returns "OK" response
packagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.SecurityMonitoringSignalStateUpdateRequest{Data:datadogV2.SecurityMonitoringSignalStateUpdateData{Attributes:datadogV2.SecurityMonitoringSignalStateUpdateAttributes{ArchiveReason:datadogV2.SECURITYMONITORINGSIGNALARCHIVEREASON_NONE.Ptr(),State:datadogV2.SECURITYMONITORINGSIGNALSTATE_OPEN,},},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.EditSecurityMonitoringSignalState(ctx,"AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.EditSecurityMonitoringSignalState`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.EditSecurityMonitoringSignalState`:\n%s\n",responseContent)}
// Change the triage state of a security signal returns "OK" response
importcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalArchiveReason;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalState;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalStateUpdateAttributes;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalStateUpdateData;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalStateUpdateRequest;importcom.datadog.api.client.v2.model.SecurityMonitoringSignalTriageUpdateResponse;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);SecurityMonitoringSignalStateUpdateRequestbody=newSecurityMonitoringSignalStateUpdateRequest().data(newSecurityMonitoringSignalStateUpdateData().attributes(newSecurityMonitoringSignalStateUpdateAttributes().archiveReason(SecurityMonitoringSignalArchiveReason.NONE).state(SecurityMonitoringSignalState.OPEN)));try{SecurityMonitoringSignalTriageUpdateResponseresult=apiInstance.editSecurityMonitoringSignalState("AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#editSecurityMonitoringSignalState");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Change the triage state of a security signal returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.security_monitoring_signal_archive_reasonimportSecurityMonitoringSignalArchiveReasonfromdatadog_api_client.v2.model.security_monitoring_signal_stateimportSecurityMonitoringSignalStatefromdatadog_api_client.v2.model.security_monitoring_signal_state_update_attributesimport(SecurityMonitoringSignalStateUpdateAttributes,)fromdatadog_api_client.v2.model.security_monitoring_signal_state_update_dataimport(SecurityMonitoringSignalStateUpdateData,)fromdatadog_api_client.v2.model.security_monitoring_signal_state_update_requestimport(SecurityMonitoringSignalStateUpdateRequest,)body=SecurityMonitoringSignalStateUpdateRequest(data=SecurityMonitoringSignalStateUpdateData(attributes=SecurityMonitoringSignalStateUpdateAttributes(archive_reason=SecurityMonitoringSignalArchiveReason.NONE,state=SecurityMonitoringSignalState.OPEN,),),)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.edit_security_monitoring_signal_state(signal_id="AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",body=body)print(response)
# Change the triage state of a security signal returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newbody=DatadogAPIClient::V2::SecurityMonitoringSignalStateUpdateRequest.new({data:DatadogAPIClient::V2::SecurityMonitoringSignalStateUpdateData.new({attributes:DatadogAPIClient::V2::SecurityMonitoringSignalStateUpdateAttributes.new({archive_reason:DatadogAPIClient::V2::SecurityMonitoringSignalArchiveReason::NONE,state:DatadogAPIClient::V2::SecurityMonitoringSignalState::OPEN,}),}),})papi_instance.edit_security_monitoring_signal_state("AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",body)
/**
* Change the triage state of a security signal returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiEditSecurityMonitoringSignalStateRequest={body:{data:{attributes:{archiveReason:"none",state:"open",},},},signalId:"AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",};apiInstance.editSecurityMonitoringSignalState(params).then((data: v2.SecurityMonitoringSignalTriageUpdateResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));
A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated
based on the event counts in the previously defined queries.
name
string
Name of the case.
notifications
[string]
Notification targets for each rule case.
status [required]
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
filters
[object]
Additional queries to filter matched events before they are processed.
action
enum
The type of filtering action.
Allowed enum values: require,suppress
query
string
Query for selecting logs to apply the filtering action.
hasExtendedTitle
boolean
Whether the notifications include the triggering group-by values in their title.
isEnabled [required]
boolean
Whether the rule is enabled.
message [required]
string
Message for generated signals.
name [required]
string
The name of the rule.
options [required]
object
Options on rules.
complianceRuleOptions
object
Options for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRule
boolean
Whether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
List of resource types that will be evaluated upon. Must have at least one element.
resourceType
string
Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnv
boolean
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.
The severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.
The decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethod
enum
The detection method.
Allowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time.
Allowed enum values: 0,60,300,600,900,1800,3600,7200
If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular
access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
keepAlive
enum
Once a signal is generated, the signal will remain “open” if a case is matched at least once within
this keep alive window.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600
maxSignalDuration
enum
A signal will “close” regardless of the query being matched once the time exceeds the maximum duration.
This time is calculated from the first seen timestamp.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400
newValueOptions
object
Options on new value rules.
forgetAfter
enum
The duration in days after which a learned value is forgotten.
Allowed enum values: 1,2,7,14,21,28
learningDuration
enum
The duration in days during which values are learned, and after which signals will be generated for values that
weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
Allowed enum values: 0,1,7
learningMethod
enum
The learning method used to determine when signals should be generated for values that weren't learned.
Allowed enum values: duration,threshold
default: duration
learningThreshold
enum
A number of occurrences after which signals will be generated for values that weren't learned.
Allowed enum values: 0,1
queries [required]
[object]
Queries for selecting logs which are part of the rule.
aggregation
enum
The aggregation type.
Allowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none
distinctFields
[string]
Field for which the cardinality is measured. Sent as an array.
groupByFields
[string]
Fields to group by.
hasOptionalGroupByFields
boolean
When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.
metric
string
DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max
aggregations. metrics field should be used instead.
metrics
[string]
Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
name
string
Name of the query.
query
string
Query to run on logs.
tags
[string]
Tags for generated signals.
type
enum
The rule type.
Allowed enum values: log_detection,workload_security
Option 2
object
Create a new signal correlation rule.
cases [required]
[object]
Cases for generating signals.
condition
string
A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated
based on the event counts in the previously defined queries.
name
string
Name of the case.
notifications
[string]
Notification targets for each rule case.
status [required]
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
filters
[object]
Additional queries to filter matched events before they are processed.
action
enum
The type of filtering action.
Allowed enum values: require,suppress
query
string
Query for selecting logs to apply the filtering action.
hasExtendedTitle
boolean
Whether the notifications include the triggering group-by values in their title.
isEnabled [required]
boolean
Whether the rule is enabled.
message [required]
string
Message for generated signals.
name [required]
string
The name of the rule.
options [required]
object
Options on rules.
complianceRuleOptions
object
Options for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRule
boolean
Whether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
List of resource types that will be evaluated upon. Must have at least one element.
resourceType
string
Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnv
boolean
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.
The severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.
The decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethod
enum
The detection method.
Allowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time.
Allowed enum values: 0,60,300,600,900,1800,3600,7200
If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular
access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
keepAlive
enum
Once a signal is generated, the signal will remain “open” if a case is matched at least once within
this keep alive window.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600
maxSignalDuration
enum
A signal will “close” regardless of the query being matched once the time exceeds the maximum duration.
This time is calculated from the first seen timestamp.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400
newValueOptions
object
Options on new value rules.
forgetAfter
enum
The duration in days after which a learned value is forgotten.
Allowed enum values: 1,2,7,14,21,28
learningDuration
enum
The duration in days during which values are learned, and after which signals will be generated for values that
weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
Allowed enum values: 0,1,7
learningMethod
enum
The learning method used to determine when signals should be generated for values that weren't learned.
Allowed enum values: duration,threshold
default: duration
learningThreshold
enum
A number of occurrences after which signals will be generated for values that weren't learned.
Allowed enum values: 0,1
queries [required]
[object]
Queries for selecting signals which are part of the rule.
aggregation
enum
The aggregation type.
Allowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none
correlatedByFields
[string]
Fields to group by.
correlatedQueryIndex
int32
Index of the rule query used to retrieve the correlated field.
metrics
[string]
Group of target fields to aggregate over.
name
string
Name of the query.
ruleId [required]
string
Rule ID to match on signals.
tags
[string]
Tags for generated signals.
type
enum
The rule type.
Allowed enum values: signal_correlation
Option 3
object
Create a new cloud configuration rule.
cases [required]
[object]
Description of generated findings and signals (severity and channels to be notified in case of a signal). Must contain exactly one item.
notifications
[string]
Notification targets for each rule case.
status [required]
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
complianceSignalOptions [required]
object
How to generate compliance signals. Useful for cloud_configuration rules only.
defaultActivationStatus
boolean
The default activation status.
defaultGroupByFields
[string]
The default group by fields.
userActivationStatus
boolean
Whether signals will be sent.
userGroupByFields
[string]
Fields to use to group findings by when sending signals.
filters
[object]
Additional queries to filter matched events before they are processed.
action
enum
The type of filtering action.
Allowed enum values: require,suppress
query
string
Query for selecting logs to apply the filtering action.
isEnabled [required]
boolean
Whether the rule is enabled.
message [required]
string
Message in markdown format for generated findings and signals.
name [required]
string
The name of the rule.
options [required]
object
Options on cloud configuration rules.
complianceRuleOptions [required]
object
Options for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRule
boolean
Whether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated
based on the event counts in the previously defined queries.
name
string
Name of the case.
notifications
[string]
Notification targets for each rule case.
status
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
complianceSignalOptions
object
How to generate compliance signals. Useful for cloud_configuration rules only.
defaultActivationStatus
boolean
The default activation status.
defaultGroupByFields
[string]
The default group by fields.
userActivationStatus
boolean
Whether signals will be sent.
userGroupByFields
[string]
Fields to use to group findings by when sending signals.
createdAt
int64
When the rule was created, timestamp in milliseconds.
creationAuthorId
int64
User ID of the user who created the rule.
deprecationDate
int64
When the rule will be deprecated, timestamp in milliseconds.
filters
[object]
Additional queries to filter matched events before they are processed.
action
enum
The type of filtering action.
Allowed enum values: require,suppress
query
string
Query for selecting logs to apply the filtering action.
hasExtendedTitle
boolean
Whether the notifications include the triggering group-by values in their title.
id
string
The ID of the rule.
isDefault
boolean
Whether the rule is included by default.
isDeleted
boolean
Whether the rule has been deleted.
isEnabled
boolean
Whether the rule is enabled.
message
string
Message for generated signals.
name
string
The name of the rule.
options
object
Options on rules.
complianceRuleOptions
object
Options for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRule
boolean
Whether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
List of resource types that will be evaluated upon. Must have at least one element.
resourceType
string
Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnv
boolean
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.
The severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.
The decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethod
enum
The detection method.
Allowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time.
Allowed enum values: 0,60,300,600,900,1800,3600,7200
If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular
access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
keepAlive
enum
Once a signal is generated, the signal will remain “open” if a case is matched at least once within
this keep alive window.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600
maxSignalDuration
enum
A signal will “close” regardless of the query being matched once the time exceeds the maximum duration.
This time is calculated from the first seen timestamp.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400
newValueOptions
object
Options on new value rules.
forgetAfter
enum
The duration in days after which a learned value is forgotten.
Allowed enum values: 1,2,7,14,21,28
learningDuration
enum
The duration in days during which values are learned, and after which signals will be generated for values that
weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
Allowed enum values: 0,1,7
learningMethod
enum
The learning method used to determine when signals should be generated for values that weren't learned.
Allowed enum values: duration,threshold
default: duration
learningThreshold
enum
A number of occurrences after which signals will be generated for values that weren't learned.
Allowed enum values: 0,1
queries
[object]
Queries for selecting logs which are part of the rule.
aggregation
enum
The aggregation type.
Allowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none
distinctFields
[string]
Field for which the cardinality is measured. Sent as an array.
groupByFields
[string]
Fields to group by.
hasOptionalGroupByFields
boolean
When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.
metric
string
DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max
aggregations. metrics field should be used instead.
metrics
[string]
Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
name
string
Name of the query.
query
string
Query to run on logs.
tags
[string]
Tags for generated signals.
type
enum
The rule type.
Allowed enum values: log_detection,infrastructure_configuration,workload_security,cloud_configuration,application_security
updateAuthorId
int64
User ID of the user who updated the rule.
version
int64
The version of the rule.
Option 2
Rule.
cases
[object]
Cases for generating signals.
condition
string
A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated
based on the event counts in the previously defined queries.
name
string
Name of the case.
notifications
[string]
Notification targets for each rule case.
status
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
createdAt
int64
When the rule was created, timestamp in milliseconds.
creationAuthorId
int64
User ID of the user who created the rule.
deprecationDate
int64
When the rule will be deprecated, timestamp in milliseconds.
filters
[object]
Additional queries to filter matched events before they are processed.
action
enum
The type of filtering action.
Allowed enum values: require,suppress
query
string
Query for selecting logs to apply the filtering action.
hasExtendedTitle
boolean
Whether the notifications include the triggering group-by values in their title.
id
string
The ID of the rule.
isDefault
boolean
Whether the rule is included by default.
isDeleted
boolean
Whether the rule has been deleted.
isEnabled
boolean
Whether the rule is enabled.
message
string
Message for generated signals.
name
string
The name of the rule.
options
object
Options on rules.
complianceRuleOptions
object
Options for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRule
boolean
Whether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
List of resource types that will be evaluated upon. Must have at least one element.
resourceType
string
Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnv
boolean
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.
The severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.
The decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethod
enum
The detection method.
Allowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time.
Allowed enum values: 0,60,300,600,900,1800,3600,7200
If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular
access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
keepAlive
enum
Once a signal is generated, the signal will remain “open” if a case is matched at least once within
this keep alive window.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600
maxSignalDuration
enum
A signal will “close” regardless of the query being matched once the time exceeds the maximum duration.
This time is calculated from the first seen timestamp.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400
newValueOptions
object
Options on new value rules.
forgetAfter
enum
The duration in days after which a learned value is forgotten.
Allowed enum values: 1,2,7,14,21,28
learningDuration
enum
The duration in days during which values are learned, and after which signals will be generated for values that
weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
Allowed enum values: 0,1,7
learningMethod
enum
The learning method used to determine when signals should be generated for values that weren't learned.
Allowed enum values: duration,threshold
default: duration
learningThreshold
enum
A number of occurrences after which signals will be generated for values that weren't learned.
Allowed enum values: 0,1
queries
[object]
Queries for selecting logs which are part of the rule.
aggregation
enum
The aggregation type.
Allowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none
correlatedByFields
[string]
Fields to correlate by.
correlatedQueryIndex
int32
Index of the rule query used to retrieve the correlated field.
defaultRuleId
string
Default Rule ID to match on signals.
distinctFields
[string]
Field for which the cardinality is measured. Sent as an array.
groupByFields
[string]
Fields to group by.
metrics
[string]
Group of target fields to aggregate over.
name
string
Name of the query.
ruleId
string
Rule ID to match on signals.
tags
[string]
Tags for generated signals.
type
enum
The rule type.
Allowed enum values: signal_correlation
updateAuthorId
int64
User ID of the user who updated the rule.
version
int64
The version of the rule.
{"cases":[{"condition":"string","name":"string","notifications":[],"status":"critical"}],"complianceSignalOptions":{"defaultActivationStatus":false,"defaultGroupByFields":[],"userActivationStatus":false,"userGroupByFields":[]},"createdAt":"integer","creationAuthorId":"integer","deprecationDate":"integer","filters":[{"action":"string","query":"string"}],"hasExtendedTitle":false,"id":"string","isDefault":false,"isDeleted":false,"isEnabled":false,"message":"string","name":"string","options":{"complianceRuleOptions":{"complexRule":false,"regoRule":{"policy":"package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}\n","resourceTypes":["gcp_iam_service_account","gcp_iam_policy"]},"resourceType":"aws_acm"},"decreaseCriticalityBasedOnEnv":false,"detectionMethod":"string","evaluationWindow":"integer","hardcodedEvaluatorType":"string","impossibleTravelOptions":{"baselineUserLocations":true},"keepAlive":"integer","maxSignalDuration":"integer","newValueOptions":{"forgetAfter":"integer","learningDuration":"integer","learningMethod":"string","learningThreshold":"integer"}},"queries":[{"aggregation":"string","distinctFields":[],"groupByFields":[],"hasOptionalGroupByFields":false,"metric":"string","metrics":[],"name":"string","query":"a > 3"}],"tags":[],"type":"string","updateAuthorId":"integer","version":"integer"}
// Create a cloud_configuration rule returns "OK" response
packagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.SecurityMonitoringRuleCreatePayload{CloudConfigurationRuleCreatePayload:&datadogV2.CloudConfigurationRuleCreatePayload{Type:datadogV2.CLOUDCONFIGURATIONRULETYPE_CLOUD_CONFIGURATION.Ptr(),Name:"Example-Security-Monitoring_cloud",IsEnabled:false,Cases:[]datadogV2.CloudConfigurationRuleCaseCreate{{Status:datadogV2.SECURITYMONITORINGRULESEVERITY_INFO,Notifications:[]string{"channel",},},},Options:datadogV2.CloudConfigurationRuleOptions{ComplianceRuleOptions:datadogV2.CloudConfigurationComplianceRuleOptions{ResourceType:datadog.PtrString("gcp_compute_disk"),ComplexRule:datadog.PtrBool(false),RegoRule:&datadogV2.CloudConfigurationRegoRule{Policy:`package datadog
import data.datadog.output as dd_output
import future.keywords.contains
import future.keywords.if
import future.keywords.in
milliseconds_in_a_day := ((1000 * 60) * 60) * 24
eval(iam_service_account_key) = "skip" if {
iam_service_account_key.disabled
} else = "pass" if {
(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90
} else = "fail"
# This part remains unchanged for all rules
results contains result if {
some resource in input.resources[input.main_resource_type]
result := dd_output.format(resource, eval(resource))
}
`,ResourceTypes:[]string{"gcp_compute_disk",},},},},Message:"ddd",Tags:[]string{"my:tag",},ComplianceSignalOptions:datadogV2.CloudConfigurationRuleComplianceSignalOptions{UserActivationStatus:*datadog.NewNullableBool(datadog.PtrBool(true)),UserGroupByFields:*datadog.NewNullableList(&[]string{"@account_id",}),},Filters:[]datadogV2.SecurityMonitoringFilter{{Action:datadogV2.SECURITYMONITORINGFILTERACTION_REQUIRE.Ptr(),Query:datadog.PtrString("resource_id:helo*"),},{Action:datadogV2.SECURITYMONITORINGFILTERACTION_SUPPRESS.Ptr(),Query:datadog.PtrString("control:helo*"),},},}}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.CreateSecurityMonitoringRule(ctx,body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.CreateSecurityMonitoringRule`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.CreateSecurityMonitoringRule`:\n%s\n",responseContent)}
// Create a detection rule returns "OK" response
packagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.SecurityMonitoringRuleCreatePayload{SecurityMonitoringStandardRuleCreatePayload:&datadogV2.SecurityMonitoringStandardRuleCreatePayload{Name:"Example-Security-Monitoring",Queries:[]datadogV2.SecurityMonitoringStandardRuleQuery{{Query:datadog.PtrString("@test:true"),Aggregation:datadogV2.SECURITYMONITORINGRULEQUERYAGGREGATION_COUNT.Ptr(),GroupByFields:[]string{},DistinctFields:[]string{},Metric:datadog.PtrString(""),},},Filters:[]datadogV2.SecurityMonitoringFilter{},Cases:[]datadogV2.SecurityMonitoringRuleCaseCreate{{Name:datadog.PtrString(""),Status:datadogV2.SECURITYMONITORINGRULESEVERITY_INFO,Condition:datadog.PtrString("a > 0"),Notifications:[]string{},},},Options:datadogV2.SecurityMonitoringRuleOptions{EvaluationWindow:datadogV2.SECURITYMONITORINGRULEEVALUATIONWINDOW_FIFTEEN_MINUTES.Ptr(),KeepAlive:datadogV2.SECURITYMONITORINGRULEKEEPALIVE_ONE_HOUR.Ptr(),MaxSignalDuration:datadogV2.SECURITYMONITORINGRULEMAXSIGNALDURATION_ONE_DAY.Ptr(),},Message:"Test rule",Tags:[]string{},IsEnabled:true,Type:datadogV2.SECURITYMONITORINGRULETYPECREATE_LOG_DETECTION.Ptr(),}}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.CreateSecurityMonitoringRule(ctx,body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.CreateSecurityMonitoringRule`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.CreateSecurityMonitoringRule`:\n%s\n",responseContent)}
// Create a detection rule with type 'impossible_travel' returns "OK" response
packagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){body:=datadogV2.SecurityMonitoringRuleCreatePayload{SecurityMonitoringStandardRuleCreatePayload:&datadogV2.SecurityMonitoringStandardRuleCreatePayload{Queries:[]datadogV2.SecurityMonitoringStandardRuleQuery{{Aggregation:datadogV2.SECURITYMONITORINGRULEQUERYAGGREGATION_GEO_DATA.Ptr(),GroupByFields:[]string{"@usr.id",},DistinctFields:[]string{},Metric:datadog.PtrString("@network.client.geoip"),Query:datadog.PtrString("*"),},},Cases:[]datadogV2.SecurityMonitoringRuleCaseCreate{{Name:datadog.PtrString(""),Status:datadogV2.SECURITYMONITORINGRULESEVERITY_INFO,Notifications:[]string{},},},HasExtendedTitle:datadog.PtrBool(true),Message:"test",IsEnabled:true,Options:datadogV2.SecurityMonitoringRuleOptions{MaxSignalDuration:datadogV2.SECURITYMONITORINGRULEMAXSIGNALDURATION_ONE_DAY.Ptr(),EvaluationWindow:datadogV2.SECURITYMONITORINGRULEEVALUATIONWINDOW_FIFTEEN_MINUTES.Ptr(),KeepAlive:datadogV2.SECURITYMONITORINGRULEKEEPALIVE_ONE_HOUR.Ptr(),DetectionMethod:datadogV2.SECURITYMONITORINGRULEDETECTIONMETHOD_IMPOSSIBLE_TRAVEL.Ptr(),ImpossibleTravelOptions:&datadogV2.SecurityMonitoringRuleImpossibleTravelOptions{BaselineUserLocations:datadog.PtrBool(false),},},Name:"Example-Security-Monitoring",Type:datadogV2.SECURITYMONITORINGRULETYPECREATE_LOG_DETECTION.Ptr(),Tags:[]string{},Filters:[]datadogV2.SecurityMonitoringFilter{},}}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.CreateSecurityMonitoringRule(ctx,body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.CreateSecurityMonitoringRule`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.CreateSecurityMonitoringRule`:\n%s\n",responseContent)}
// Create a cloud_configuration rule returns "OK" response
importcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.CloudConfigurationComplianceRuleOptions;importcom.datadog.api.client.v2.model.CloudConfigurationRegoRule;importcom.datadog.api.client.v2.model.CloudConfigurationRuleCaseCreate;importcom.datadog.api.client.v2.model.CloudConfigurationRuleComplianceSignalOptions;importcom.datadog.api.client.v2.model.CloudConfigurationRuleCreatePayload;importcom.datadog.api.client.v2.model.CloudConfigurationRuleOptions;importcom.datadog.api.client.v2.model.CloudConfigurationRuleType;importcom.datadog.api.client.v2.model.SecurityMonitoringFilter;importcom.datadog.api.client.v2.model.SecurityMonitoringFilterAction;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleCreatePayload;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleResponse;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleSeverity;importjava.util.Arrays;importjava.util.Collections;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);SecurityMonitoringRuleCreatePayloadbody=newSecurityMonitoringRuleCreatePayload(newCloudConfigurationRuleCreatePayload().type(CloudConfigurationRuleType.CLOUD_CONFIGURATION).name("Example-Security-Monitoring_cloud").isEnabled(false).cases(Collections.singletonList(newCloudConfigurationRuleCaseCreate().status(SecurityMonitoringRuleSeverity.INFO).notifications(Collections.singletonList("channel")))).options(newCloudConfigurationRuleOptions().complianceRuleOptions(newCloudConfigurationComplianceRuleOptions().resourceType("gcp_compute_disk").complexRule(false).regoRule(newCloudConfigurationRegoRule().policy("""
package datadog
import data.datadog.output as dd_output
import future.keywords.contains
import future.keywords.if
import future.keywords.in
milliseconds_in_a_day := ((1000 * 60) * 60) * 24
eval(iam_service_account_key) = "skip" if {
iam_service_account_key.disabled
} else = "pass" if {
(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90
} else = "fail"
# This part remains unchanged for all rules
results contains result if {
some resource in input.resources[input.main_resource_type]
result := dd_output.format(resource, eval(resource))
}
""").resourceTypes(Collections.singletonList("gcp_compute_disk"))))).message("ddd").tags(Collections.singletonList("my:tag")).complianceSignalOptions(newCloudConfigurationRuleComplianceSignalOptions().userActivationStatus(true).userGroupByFields(Collections.singletonList("@account_id"))).filters(Arrays.asList(newSecurityMonitoringFilter().action(SecurityMonitoringFilterAction.REQUIRE).query("resource_id:helo*"),newSecurityMonitoringFilter().action(SecurityMonitoringFilterAction.SUPPRESS).query("control:helo*"))));try{SecurityMonitoringRuleResponseresult=apiInstance.createSecurityMonitoringRule(body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#createSecurityMonitoringRule");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
// Create a detection rule returns "OK" response
importcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleCaseCreate;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleCreatePayload;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleEvaluationWindow;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleKeepAlive;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleMaxSignalDuration;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleOptions;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleQueryAggregation;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleResponse;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleSeverity;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleTypeCreate;importcom.datadog.api.client.v2.model.SecurityMonitoringStandardRuleCreatePayload;importcom.datadog.api.client.v2.model.SecurityMonitoringStandardRuleQuery;importjava.util.Collections;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);SecurityMonitoringRuleCreatePayloadbody=newSecurityMonitoringRuleCreatePayload(newSecurityMonitoringStandardRuleCreatePayload().name("Example-Security-Monitoring").queries(Collections.singletonList(newSecurityMonitoringStandardRuleQuery().query("@test:true").aggregation(SecurityMonitoringRuleQueryAggregation.COUNT).metric(""))).cases(Collections.singletonList(newSecurityMonitoringRuleCaseCreate().name("").status(SecurityMonitoringRuleSeverity.INFO).condition("a > 0"))).options(newSecurityMonitoringRuleOptions().evaluationWindow(SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES).keepAlive(SecurityMonitoringRuleKeepAlive.ONE_HOUR).maxSignalDuration(SecurityMonitoringRuleMaxSignalDuration.ONE_DAY)).message("Test rule").isEnabled(true).type(SecurityMonitoringRuleTypeCreate.LOG_DETECTION));try{SecurityMonitoringRuleResponseresult=apiInstance.createSecurityMonitoringRule(body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#createSecurityMonitoringRule");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
// Create a detection rule with type 'impossible_travel' returns "OK" response
importcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleCaseCreate;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleCreatePayload;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleDetectionMethod;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleEvaluationWindow;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleImpossibleTravelOptions;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleKeepAlive;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleMaxSignalDuration;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleOptions;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleQueryAggregation;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleResponse;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleSeverity;importcom.datadog.api.client.v2.model.SecurityMonitoringRuleTypeCreate;importcom.datadog.api.client.v2.model.SecurityMonitoringStandardRuleCreatePayload;importcom.datadog.api.client.v2.model.SecurityMonitoringStandardRuleQuery;importjava.util.Collections;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);SecurityMonitoringRuleCreatePayloadbody=newSecurityMonitoringRuleCreatePayload(newSecurityMonitoringStandardRuleCreatePayload().queries(Collections.singletonList(newSecurityMonitoringStandardRuleQuery().aggregation(SecurityMonitoringRuleQueryAggregation.GEO_DATA).groupByFields(Collections.singletonList("@usr.id")).metric("@network.client.geoip").query("*"))).cases(Collections.singletonList(newSecurityMonitoringRuleCaseCreate().name("").status(SecurityMonitoringRuleSeverity.INFO))).hasExtendedTitle(true).message("test").isEnabled(true).options(newSecurityMonitoringRuleOptions().maxSignalDuration(SecurityMonitoringRuleMaxSignalDuration.ONE_DAY).evaluationWindow(SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES).keepAlive(SecurityMonitoringRuleKeepAlive.ONE_HOUR).detectionMethod(SecurityMonitoringRuleDetectionMethod.IMPOSSIBLE_TRAVEL).impossibleTravelOptions(newSecurityMonitoringRuleImpossibleTravelOptions().baselineUserLocations(false))).name("Example-Security-Monitoring").type(SecurityMonitoringRuleTypeCreate.LOG_DETECTION));try{SecurityMonitoringRuleResponseresult=apiInstance.createSecurityMonitoringRule(body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling SecurityMonitoringApi#createSecurityMonitoringRule");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Create a detection rule with type 'impossible_travel' returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.security_monitoring_rule_case_createimportSecurityMonitoringRuleCaseCreatefromdatadog_api_client.v2.model.security_monitoring_rule_detection_methodimportSecurityMonitoringRuleDetectionMethodfromdatadog_api_client.v2.model.security_monitoring_rule_evaluation_windowimport(SecurityMonitoringRuleEvaluationWindow,)fromdatadog_api_client.v2.model.security_monitoring_rule_impossible_travel_optionsimport(SecurityMonitoringRuleImpossibleTravelOptions,)fromdatadog_api_client.v2.model.security_monitoring_rule_keep_aliveimportSecurityMonitoringRuleKeepAlivefromdatadog_api_client.v2.model.security_monitoring_rule_max_signal_durationimport(SecurityMonitoringRuleMaxSignalDuration,)fromdatadog_api_client.v2.model.security_monitoring_rule_optionsimportSecurityMonitoringRuleOptionsfromdatadog_api_client.v2.model.security_monitoring_rule_query_aggregationimport(SecurityMonitoringRuleQueryAggregation,)fromdatadog_api_client.v2.model.security_monitoring_rule_severityimportSecurityMonitoringRuleSeverityfromdatadog_api_client.v2.model.security_monitoring_rule_type_createimportSecurityMonitoringRuleTypeCreatefromdatadog_api_client.v2.model.security_monitoring_standard_rule_create_payloadimport(SecurityMonitoringStandardRuleCreatePayload,)fromdatadog_api_client.v2.model.security_monitoring_standard_rule_queryimportSecurityMonitoringStandardRuleQuerybody=SecurityMonitoringStandardRuleCreatePayload(queries=[SecurityMonitoringStandardRuleQuery(aggregation=SecurityMonitoringRuleQueryAggregation.GEO_DATA,group_by_fields=["@usr.id",],distinct_fields=[],metric="@network.client.geoip",query="*",),],cases=[SecurityMonitoringRuleCaseCreate(name="",status=SecurityMonitoringRuleSeverity.INFO,notifications=[],),],has_extended_title=True,message="test",is_enabled=True,options=SecurityMonitoringRuleOptions(max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.ONE_DAY,evaluation_window=SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES,keep_alive=SecurityMonitoringRuleKeepAlive.ONE_HOUR,detection_method=SecurityMonitoringRuleDetectionMethod.IMPOSSIBLE_TRAVEL,impossible_travel_options=SecurityMonitoringRuleImpossibleTravelOptions(baseline_user_locations=False,),),name="Example-Security-Monitoring",type=SecurityMonitoringRuleTypeCreate.LOG_DETECTION,tags=[],filters=[],)configuration=Configuration()withApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.create_security_monitoring_rule(body=body)print(response)
# Create a detection rule with type 'impossible_travel' returns "OK" responserequire"datadog_api_client"api_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newbody=DatadogAPIClient::V2::SecurityMonitoringStandardRuleCreatePayload.new({queries:[DatadogAPIClient::V2::SecurityMonitoringStandardRuleQuery.new({aggregation:DatadogAPIClient::V2::SecurityMonitoringRuleQueryAggregation::GEO_DATA,group_by_fields:["@usr.id",],distinct_fields:[],metric:"@network.client.geoip",query:"*",}),],cases:[DatadogAPIClient::V2::SecurityMonitoringRuleCaseCreate.new({name:"",status:DatadogAPIClient::V2::SecurityMonitoringRuleSeverity::INFO,notifications:[],}),],has_extended_title:true,message:"test",is_enabled:true,options:DatadogAPIClient::V2::SecurityMonitoringRuleOptions.new({max_signal_duration:DatadogAPIClient::V2::SecurityMonitoringRuleMaxSignalDuration::ONE_DAY,evaluation_window:DatadogAPIClient::V2::SecurityMonitoringRuleEvaluationWindow::FIFTEEN_MINUTES,keep_alive:DatadogAPIClient::V2::SecurityMonitoringRuleKeepAlive::ONE_HOUR,detection_method:DatadogAPIClient::V2::SecurityMonitoringRuleDetectionMethod::IMPOSSIBLE_TRAVEL,impossible_travel_options:DatadogAPIClient::V2::SecurityMonitoringRuleImpossibleTravelOptions.new({baseline_user_locations:false,}),}),name:"Example-Security-Monitoring",type:DatadogAPIClient::V2::SecurityMonitoringRuleTypeCreate::LOG_DETECTION,tags:[],filters:[],})papi_instance.create_security_monitoring_rule(body)
A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated
based on the event counts in the previously defined queries.
name
string
Name of the case.
notifications
[string]
Notification targets for each rule case.
status
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
complianceSignalOptions
object
How to generate compliance signals. Useful for cloud_configuration rules only.
defaultActivationStatus
boolean
The default activation status.
defaultGroupByFields
[string]
The default group by fields.
userActivationStatus
boolean
Whether signals will be sent.
userGroupByFields
[string]
Fields to use to group findings by when sending signals.
createdAt
int64
When the rule was created, timestamp in milliseconds.
creationAuthorId
int64
User ID of the user who created the rule.
deprecationDate
int64
When the rule will be deprecated, timestamp in milliseconds.
filters
[object]
Additional queries to filter matched events before they are processed.
action
enum
The type of filtering action.
Allowed enum values: require,suppress
query
string
Query for selecting logs to apply the filtering action.
hasExtendedTitle
boolean
Whether the notifications include the triggering group-by values in their title.
id
string
The ID of the rule.
isDefault
boolean
Whether the rule is included by default.
isDeleted
boolean
Whether the rule has been deleted.
isEnabled
boolean
Whether the rule is enabled.
message
string
Message for generated signals.
name
string
The name of the rule.
options
object
Options on rules.
complianceRuleOptions
object
Options for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRule
boolean
Whether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
List of resource types that will be evaluated upon. Must have at least one element.
resourceType
string
Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnv
boolean
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.
The severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.
The decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethod
enum
The detection method.
Allowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time.
Allowed enum values: 0,60,300,600,900,1800,3600,7200
If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular
access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
keepAlive
enum
Once a signal is generated, the signal will remain “open” if a case is matched at least once within
this keep alive window.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600
maxSignalDuration
enum
A signal will “close” regardless of the query being matched once the time exceeds the maximum duration.
This time is calculated from the first seen timestamp.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400
newValueOptions
object
Options on new value rules.
forgetAfter
enum
The duration in days after which a learned value is forgotten.
Allowed enum values: 1,2,7,14,21,28
learningDuration
enum
The duration in days during which values are learned, and after which signals will be generated for values that
weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
Allowed enum values: 0,1,7
learningMethod
enum
The learning method used to determine when signals should be generated for values that weren't learned.
Allowed enum values: duration,threshold
default: duration
learningThreshold
enum
A number of occurrences after which signals will be generated for values that weren't learned.
Allowed enum values: 0,1
queries
[object]
Queries for selecting logs which are part of the rule.
aggregation
enum
The aggregation type.
Allowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none
distinctFields
[string]
Field for which the cardinality is measured. Sent as an array.
groupByFields
[string]
Fields to group by.
hasOptionalGroupByFields
boolean
When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.
metric
string
DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max
aggregations. metrics field should be used instead.
metrics
[string]
Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
name
string
Name of the query.
query
string
Query to run on logs.
tags
[string]
Tags for generated signals.
type
enum
The rule type.
Allowed enum values: log_detection,infrastructure_configuration,workload_security,cloud_configuration,application_security
updateAuthorId
int64
User ID of the user who updated the rule.
version
int64
The version of the rule.
Option 2
Rule.
cases
[object]
Cases for generating signals.
condition
string
A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated
based on the event counts in the previously defined queries.
name
string
Name of the case.
notifications
[string]
Notification targets for each rule case.
status
enum
Severity of the Security Signal.
Allowed enum values: info,low,medium,high,critical
createdAt
int64
When the rule was created, timestamp in milliseconds.
creationAuthorId
int64
User ID of the user who created the rule.
deprecationDate
int64
When the rule will be deprecated, timestamp in milliseconds.
filters
[object]
Additional queries to filter matched events before they are processed.
action
enum
The type of filtering action.
Allowed enum values: require,suppress
query
string
Query for selecting logs to apply the filtering action.
hasExtendedTitle
boolean
Whether the notifications include the triggering group-by values in their title.
id
string
The ID of the rule.
isDefault
boolean
Whether the rule is included by default.
isDeleted
boolean
Whether the rule has been deleted.
isEnabled
boolean
Whether the rule is enabled.
message
string
Message for generated signals.
name
string
The name of the rule.
options
object
Options on rules.
complianceRuleOptions
object
Options for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRule
boolean
Whether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
List of resource types that will be evaluated upon. Must have at least one element.
resourceType
string
Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnv
boolean
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.
The severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.
The decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethod
enum
The detection method.
Allowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party
evaluationWindow
enum
A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time.
Allowed enum values: 0,60,300,600,900,1800,3600,7200
If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular
access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
keepAlive
enum
Once a signal is generated, the signal will remain “open” if a case is matched at least once within
this keep alive window.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600
maxSignalDuration
enum
A signal will “close” regardless of the query being matched once the time exceeds the maximum duration.
This time is calculated from the first seen timestamp.
Allowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400
newValueOptions
object
Options on new value rules.
forgetAfter
enum
The duration in days after which a learned value is forgotten.
Allowed enum values: 1,2,7,14,21,28
learningDuration
enum
The duration in days during which values are learned, and after which signals will be generated for values that
weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
Allowed enum values: 0,1,7
learningMethod
enum
The learning method used to determine when signals should be generated for values that weren't learned.
Allowed enum values: duration,threshold
default: duration
learningThreshold
enum
A number of occurrences after which signals will be generated for values that weren't learned.
Allowed enum values: 0,1
queries
[object]
Queries for selecting logs which are part of the rule.
aggregation
enum
The aggregation type.
Allowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none
correlatedByFields
[string]
Fields to correlate by.
correlatedQueryIndex
int32
Index of the rule query used to retrieve the correlated field.
defaultRuleId
string
Default Rule ID to match on signals.
distinctFields
[string]
Field for which the cardinality is measured. Sent as an array.
groupByFields
[string]
Fields to group by.
metrics
[string]
Group of target fields to aggregate over.
name
string
Name of the query.
ruleId
string
Rule ID to match on signals.
tags
[string]
Tags for generated signals.
type
enum
The rule type.
Allowed enum values: signal_correlation
updateAuthorId
int64
User ID of the user who updated the rule.
version
int64
The version of the rule.
meta
object
Object describing meta attributes of response.
page
object
Pagination object.
total_count
int64
Total count.
total_filtered_count
int64
Total count of elements matched by the filter.
{"data":[{"cases":[{"condition":"string","name":"string","notifications":[],"status":"critical"}],"complianceSignalOptions":{"defaultActivationStatus":false,"defaultGroupByFields":[],"userActivationStatus":false,"userGroupByFields":[]},"createdAt":"integer","creationAuthorId":"integer","deprecationDate":"integer","filters":[{"action":"string","query":"string"}],"hasExtendedTitle":false,"id":"string","isDefault":false,"isDeleted":false,"isEnabled":false,"message":"string","name":"string","options":{"complianceRuleOptions":{"complexRule":false,"regoRule":{"policy":"package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}\n","resourceTypes":["gcp_iam_service_account","gcp_iam_policy"]},"resourceType":"aws_acm"},"decreaseCriticalityBasedOnEnv":false,"detectionMethod":"string","evaluationWindow":"integer","hardcodedEvaluatorType":"string","impossibleTravelOptions":{"baselineUserLocations":true},"keepAlive":"integer","maxSignalDuration":"integer","newValueOptions":{"forgetAfter":"integer","learningDuration":"integer","learningMethod":"string","learningThreshold":"integer"}},"queries":[{"aggregation":"string","distinctFields":[],"groupByFields":[],"hasOptionalGroupByFields":false,"metric":"string","metrics":[],"name":"string","query":"a > 3"}],"tags":[],"type":"string","updateAuthorId":"integer","version":"integer"}],"meta":{"page":{"total_count":"integer","total_filtered_count":"integer"}}}