Note: This endpoint is in preview and is subject to change. If you have any feedback, contact Datadog support.

POST https://api.ap1.datadoghq.com/api/v2/security_monitoring/datasetshttps://api.ap2.datadoghq.com/api/v2/security_monitoring/datasetshttps://api.datadoghq.eu/api/v2/security_monitoring/datasetshttps://api.ddog-gov.com/api/v2/security_monitoring/datasetshttps://api.us2.ddog-gov.com/api/v2/security_monitoring/datasetshttps://api.uk1.datadoghq.com/api/v2/security_monitoring/datasetshttps://api.datadoghq.com/api/v2/security_monitoring/datasetshttps://api.us3.datadoghq.com/api/v2/security_monitoring/datasetshttps://api.us5.datadoghq.com/api/v2/security_monitoring/datasets

개요

새 Cloud SIEM 데이터 세트를 생성합니다. 데이터 세트는 데이터 소스, 일련의 인덱스, 그리고 탐지 규칙에서 참조할 수 있는 검색 쿼리를 번들로 묶습니다. This endpoint requires any of the following permissions:

  • security_monitoring_rules_write
  • security_monitoring_dataset_write

  • OAuth apps require the security_monitoring_rules_write authorization scope to access this endpoint.

    요청

    Body Data (required)

    Expand All

    항목

    유형

    설명

    data [required]

    object

    The data wrapper of a dataset create request.

    attributes [required]

    object

    The attributes of a dataset create or update request.

    definition [required]

    object

    The definition of the dataset. The shape depends on the value of data_source. Use reference_table or managed_resource for a referential dataset, or one of the event platform sources (for example logs, audit, events, spans, rum) for an event platform dataset.

    columns

    [object]

    For event platform datasets, the list of columns exposed by the dataset.

    column [required]

    string

    The name of the column.

    type [required]

    string

    The type of the column value.

    data_source [required]

    string

    The data source backing this dataset definition.

    indexes

    [string]

    For event platform datasets, the list of indexes to query.

    name [required]

    string

    The unique name of the dataset. Must start with a lowercase letter and contain only lowercase letters, digits, and underscores (max 255 characters).

    query_filter

    string

    For referential datasets, an optional filter expression applied to the table.

    search

    object

    The search clause applied to an event platform dataset.

    query [required]

    string

    The search query expression.

    storage

    string

    Storage tier the dataset reads from. Applies to event platform datasets.

    table_name

    string

    For referential datasets, the name of the underlying table.

    time_window

    object

    An optional time window that overrides the default query time range.

    from

    int64

    Inclusive start of the time window, in milliseconds since the Unix epoch.

    to

    int64

    Exclusive end of the time window, in milliseconds since the Unix epoch.

    description

    string

    The description of the dataset. Maximum 255 characters.

    version

    int64

    The expected current version of the dataset for optimistic concurrency control on updates. If the dataset's current version does not match, the request is rejected with a 409 Conflict.

    type [required]

    enum

    The type of resource for a dataset create request. Allowed enum values: datasetCreate

    {
      "data": {
        "attributes": {
          "definition": {
            "columns": [
              {
                "column": "message",
                "type": "string"
              }
            ],
            "data_source": "logs",
            "indexes": [],
            "name": "sample_dataset",
            "query_filter": "status = 'active'",
            "search": {
              "query": "*"
            },
            "storage": "hot",
            "table_name": "my_reference_table",
            "time_window": {
              "from": 1700000000000,
              "to": 1700003600000
            }
          },
          "description": "A sample dataset used for detection rules.",
          "version": 1
        },
        "type": "datasetCreate"
      }
    }

    응답

    Created

    Response returned after creating a dataset.

    Expand All

    항목

    유형

    설명

    data [required]

    object

    The data wrapper of a dataset create response.

    id [required]

    string

    The UUID of the newly created dataset.

    type [required]

    enum

    The type of resource for a dataset response. Allowed enum values: dataset

    {
      "data": {
        "id": "123e4567-e89b-12d3-a456-426614174000",
        "type": "dataset"
      }
    }

    Bad Request

    API error response.

    Expand All

    항목

    유형

    설명

    errors [required]

    [object]

    A list of errors.

    detail

    string

    A human-readable explanation specific to this occurrence of the error.

    meta

    object

    Non-standard meta-information about the error

    source

    object

    References to the source of the error.

    header

    string

    A string indicating the name of a single request header which caused the error.

    parameter

    string

    A string indicating which URI query parameter caused the error.

    pointer

    string

    A JSON pointer to the value in the request document that caused the error.

    status

    string

    Status code of the response.

    title

    string

    Short human-readable summary of the error.

    {
      "errors": [
        {
          "detail": "Missing required attribute in body",
          "meta": {},
          "source": {
            "header": "Authorization",
            "parameter": "limit",
            "pointer": "/data/attributes/title"
          },
          "status": "400",
          "title": "Bad Request"
        }
      ]
    }

    Forbidden

    API error response.

    Expand All

    항목

    유형

    설명

    errors [required]

    [object]

    A list of errors.

    detail

    string

    A human-readable explanation specific to this occurrence of the error.

    meta

    object

    Non-standard meta-information about the error

    source

    object

    References to the source of the error.

    header

    string

    A string indicating the name of a single request header which caused the error.

    parameter

    string

    A string indicating which URI query parameter caused the error.

    pointer

    string

    A JSON pointer to the value in the request document that caused the error.

    status

    string

    Status code of the response.

    title

    string

    Short human-readable summary of the error.

    {
      "errors": [
        {
          "detail": "Missing required attribute in body",
          "meta": {},
          "source": {
            "header": "Authorization",
            "parameter": "limit",
            "pointer": "/data/attributes/title"
          },
          "status": "400",
          "title": "Bad Request"
        }
      ]
    }

    Conflict

    API error response.

    Expand All

    항목

    유형

    설명

    errors [required]

    [object]

    A list of errors.

    detail

    string

    A human-readable explanation specific to this occurrence of the error.

    meta

    object

    Non-standard meta-information about the error

    source

    object

    References to the source of the error.

    header

    string

    A string indicating the name of a single request header which caused the error.

    parameter

    string

    A string indicating which URI query parameter caused the error.

    pointer

    string

    A JSON pointer to the value in the request document that caused the error.

    status

    string

    Status code of the response.

    title

    string

    Short human-readable summary of the error.

    {
      "errors": [
        {
          "detail": "Missing required attribute in body",
          "meta": {},
          "source": {
            "header": "Authorization",
            "parameter": "limit",
            "pointer": "/data/attributes/title"
          },
          "status": "400",
          "title": "Bad Request"
        }
      ]
    }

    Too many requests

    API error response.

    Expand All

    항목

    유형

    설명

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    코드 예시

                      ## default
    # 
    
    # Use a Personal Access Token or Service Access Token
    export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

    # Curl command
    curl -X POST "https://api.ap1.datadoghq.com"https://api.ap2.datadoghq.com"https://api.datadoghq.eu"https://api.ddog-gov.com"https://api.us2.ddog-gov.com"https://api.uk1.datadoghq.com"https://api.datadoghq.com"https://api.us3.datadoghq.com"https://api.us5.datadoghq.com/api/v2/security_monitoring/datasets" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" \ -d @- << EOF { "data": { "attributes": { "definition": { "columns": [ { "column": "message", "type": "string" } ], "data_source": "logs", "indexes": [ "main" ], "name": "sample_dataset", "search": { "query": "*" } }, "description": "A sample dataset used for detection rules." }, "type": "datasetCreate" } } EOF
    """
    Create a dataset returns "Created" response
    """
    
    from os import environ
    from datadog_api_client import ApiClient, Configuration
    from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
    from datadog_api_client.v2.model.security_monitoring_dataset_attributes_request import (
        SecurityMonitoringDatasetAttributesRequest,
    )
    from datadog_api_client.v2.model.security_monitoring_dataset_column import SecurityMonitoringDatasetColumn
    from datadog_api_client.v2.model.security_monitoring_dataset_create_data import SecurityMonitoringDatasetCreateData
    from datadog_api_client.v2.model.security_monitoring_dataset_create_request import (
        SecurityMonitoringDatasetCreateRequest,
    )
    from datadog_api_client.v2.model.security_monitoring_dataset_create_type import SecurityMonitoringDatasetCreateType
    from datadog_api_client.v2.model.security_monitoring_dataset_definition import SecurityMonitoringDatasetDefinition
    from datadog_api_client.v2.model.security_monitoring_dataset_search import SecurityMonitoringDatasetSearch
    from datadog_api_client.v2.model.security_monitoring_dataset_time_window import SecurityMonitoringDatasetTimeWindow
    
    body = SecurityMonitoringDatasetCreateRequest(
        data=SecurityMonitoringDatasetCreateData(
            attributes=SecurityMonitoringDatasetAttributesRequest(
                definition=SecurityMonitoringDatasetDefinition(
                    columns=[
                        SecurityMonitoringDatasetColumn(
                            column="message",
                            type="string",
                        ),
                    ],
                    data_source="logs",
                    indexes=[],
                    name="sample_dataset",
                    query_filter="status = 'active'",
                    search=SecurityMonitoringDatasetSearch(
                        query="*",
                    ),
                    storage="hot",
                    table_name="my_reference_table",
                    time_window=SecurityMonitoringDatasetTimeWindow(
                        _from=1700000000000,
                        to=1700003600000,
                    ),
                ),
                description="A sample dataset used for detection rules.",
                version=1,
            ),
            type=SecurityMonitoringDatasetCreateType.DATASET_CREATE,
        ),
    )
    
    configuration = Configuration()
    configuration.access_token = environ["DD_BEARER_TOKEN"]
    configuration.unstable_operations["create_security_monitoring_dataset"] = True
    with ApiClient(configuration) as api_client:
        api_instance = SecurityMonitoringApi(api_client)
        response = api_instance.create_security_monitoring_dataset(body=body)
    
        print(response)
    

    Instructions

    First install the library and its dependencies and then save the example to example.py and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"
    # Create a dataset returns "Created" response
    
    require "datadog_api_client"
    DatadogAPIClient.configure do |config|
      config.access_token = ENV["DD_BEARER_TOKEN"]
      config.unstable_operations["v2.create_security_monitoring_dataset".to_sym] = true
    end
    api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
    
    body = DatadogAPIClient::V2::SecurityMonitoringDatasetCreateRequest.new({
      data: DatadogAPIClient::V2::SecurityMonitoringDatasetCreateData.new({
        attributes: DatadogAPIClient::V2::SecurityMonitoringDatasetAttributesRequest.new({
          definition: DatadogAPIClient::V2::SecurityMonitoringDatasetDefinition.new({
            columns: [
              DatadogAPIClient::V2::SecurityMonitoringDatasetColumn.new({
                column: "message",
                type: "string",
              }),
            ],
            data_source: "logs",
            indexes: [],
            name: "sample_dataset",
            query_filter: "status = 'active'",
            search: DatadogAPIClient::V2::SecurityMonitoringDatasetSearch.new({
              query: "*",
            }),
            storage: "hot",
            table_name: "my_reference_table",
            time_window: DatadogAPIClient::V2::SecurityMonitoringDatasetTimeWindow.new({
              from: 1700000000000,
              to: 1700003600000,
            }),
          }),
          description: "A sample dataset used for detection rules.",
          version: 1,
        }),
        type: DatadogAPIClient::V2::SecurityMonitoringDatasetCreateType::DATASET_CREATE,
      }),
    })
    p api_instance.create_security_monitoring_dataset(body)
    

    Instructions

    First install the library and its dependencies and then save the example to example.rb and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"
    // Create a dataset returns "Created" response
    
    package main
    
    import (
    	"context"
    	"encoding/json"
    	"fmt"
    	"os"
    
    	"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
    	"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
    )
    
    func main() {
    	body := datadogV2.SecurityMonitoringDatasetCreateRequest{
    		Data: datadogV2.SecurityMonitoringDatasetCreateData{
    			Attributes: datadogV2.SecurityMonitoringDatasetAttributesRequest{
    				Definition: datadogV2.SecurityMonitoringDatasetDefinition{
    					Columns: []datadogV2.SecurityMonitoringDatasetColumn{
    						{
    							Column: "message",
    							Type:   "string",
    						},
    					},
    					DataSource:  "logs",
    					Indexes:     []string{},
    					Name:        "sample_dataset",
    					QueryFilter: datadog.PtrString("status = 'active'"),
    					Search: &datadogV2.SecurityMonitoringDatasetSearch{
    						Query: "*",
    					},
    					Storage:   datadog.PtrString("hot"),
    					TableName: datadog.PtrString("my_reference_table"),
    					TimeWindow: &datadogV2.SecurityMonitoringDatasetTimeWindow{
    						From: datadog.PtrInt64(1700000000000),
    						To:   datadog.PtrInt64(1700003600000),
    					},
    				},
    				Description: datadog.PtrString("A sample dataset used for detection rules."),
    				Version:     datadog.PtrInt64(1),
    			},
    			Type: datadogV2.SECURITYMONITORINGDATASETCREATETYPE_DATASET_CREATE,
    		},
    	}
    	ctx := datadog.NewDefaultContext(context.Background())
    	ctx = context.WithValue(ctx, datadog.ContextAccessToken, os.Getenv("DD_BEARER_TOKEN"))
    	configuration := datadog.NewConfiguration()
    	configuration.SetUnstableOperationEnabled("v2.CreateSecurityMonitoringDataset", true)
    	apiClient := datadog.NewAPIClient(configuration)
    	api := datadogV2.NewSecurityMonitoringApi(apiClient)
    	resp, r, err := api.CreateSecurityMonitoringDataset(ctx, body)
    
    	if err != nil {
    		fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.CreateSecurityMonitoringDataset`: %v\n", err)
    		fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
    	}
    
    	responseContent, _ := json.MarshalIndent(resp, "", "  ")
    	fmt.Fprintf(os.Stdout, "Response from `SecurityMonitoringApi.CreateSecurityMonitoringDataset`:\n%s\n", responseContent)
    }
    

    Instructions

    First install the library and its dependencies and then save the example to main.go and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"
    // Create a dataset returns "Created" response
    
    import com.datadog.api.client.ApiClient;
    import com.datadog.api.client.ApiException;
    import com.datadog.api.client.v2.api.SecurityMonitoringApi;
    import com.datadog.api.client.v2.model.SecurityMonitoringDatasetAttributesRequest;
    import com.datadog.api.client.v2.model.SecurityMonitoringDatasetColumn;
    import com.datadog.api.client.v2.model.SecurityMonitoringDatasetCreateData;
    import com.datadog.api.client.v2.model.SecurityMonitoringDatasetCreateRequest;
    import com.datadog.api.client.v2.model.SecurityMonitoringDatasetCreateResponse;
    import com.datadog.api.client.v2.model.SecurityMonitoringDatasetCreateType;
    import com.datadog.api.client.v2.model.SecurityMonitoringDatasetDefinition;
    import com.datadog.api.client.v2.model.SecurityMonitoringDatasetSearch;
    import com.datadog.api.client.v2.model.SecurityMonitoringDatasetTimeWindow;
    import java.util.Collections;
    
    public class Example {
      public static void main(String[] args) {
        ApiClient defaultClient = ApiClient.getDefaultApiClient();
        defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN"));
        defaultClient.setUnstableOperationEnabled("v2.createSecurityMonitoringDataset", true);
        SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient);
    
        SecurityMonitoringDatasetCreateRequest body =
            new SecurityMonitoringDatasetCreateRequest()
                .data(
                    new SecurityMonitoringDatasetCreateData()
                        .attributes(
                            new SecurityMonitoringDatasetAttributesRequest()
                                .definition(
                                    new SecurityMonitoringDatasetDefinition()
                                        .columns(
                                            Collections.singletonList(
                                                new SecurityMonitoringDatasetColumn()
                                                    .column("message")
                                                    .type("string")))
                                        .dataSource("logs")
                                        .name("sample_dataset")
                                        .queryFilter("status = 'active'")
                                        .search(new SecurityMonitoringDatasetSearch().query("*"))
                                        .storage("hot")
                                        .tableName("my_reference_table")
                                        .timeWindow(
                                            new SecurityMonitoringDatasetTimeWindow()
                                                .from(1700000000000L)
                                                .to(1700003600000L)))
                                .description("A sample dataset used for detection rules.")
                                .version(1L))
                        .type(SecurityMonitoringDatasetCreateType.DATASET_CREATE));
    
        try {
          SecurityMonitoringDatasetCreateResponse result =
              apiInstance.createSecurityMonitoringDataset(body);
          System.out.println(result);
        } catch (ApiException e) {
          System.err.println(
              "Exception when calling SecurityMonitoringApi#createSecurityMonitoringDataset");
          System.err.println("Status code: " + e.getCode());
          System.err.println("Reason: " + e.getResponseBody());
          System.err.println("Response headers: " + e.getResponseHeaders());
          e.printStackTrace();
        }
      }
    }
    

    Instructions

    First install the library and its dependencies and then save the example to Example.java and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"
    // Create a dataset returns "Created" response
    use datadog_api_client::datadog;
    use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;
    use datadog_api_client::datadogV2::model::SecurityMonitoringDatasetAttributesRequest;
    use datadog_api_client::datadogV2::model::SecurityMonitoringDatasetColumn;
    use datadog_api_client::datadogV2::model::SecurityMonitoringDatasetCreateData;
    use datadog_api_client::datadogV2::model::SecurityMonitoringDatasetCreateRequest;
    use datadog_api_client::datadogV2::model::SecurityMonitoringDatasetCreateType;
    use datadog_api_client::datadogV2::model::SecurityMonitoringDatasetDefinition;
    use datadog_api_client::datadogV2::model::SecurityMonitoringDatasetSearch;
    use datadog_api_client::datadogV2::model::SecurityMonitoringDatasetTimeWindow;
    
    #[tokio::main]
    async fn main() {
        let body =
            SecurityMonitoringDatasetCreateRequest::new(SecurityMonitoringDatasetCreateData::new(
                SecurityMonitoringDatasetAttributesRequest::new(
                    SecurityMonitoringDatasetDefinition::new(
                        "logs".to_string(),
                        "sample_dataset".to_string(),
                    )
                    .columns(vec![SecurityMonitoringDatasetColumn::new(
                        "message".to_string(),
                        "string".to_string(),
                    )])
                    .indexes(vec![])
                    .query_filter("status = 'active'".to_string())
                    .search(SecurityMonitoringDatasetSearch::new("*".to_string()))
                    .storage("hot".to_string())
                    .table_name("my_reference_table".to_string())
                    .time_window(
                        SecurityMonitoringDatasetTimeWindow::new()
                            .from(1700000000000)
                            .to(1700003600000),
                    ),
                )
                .description("A sample dataset used for detection rules.".to_string())
                .version(1),
                SecurityMonitoringDatasetCreateType::DATASET_CREATE,
            ));
        let mut configuration = datadog::Configuration::new();
        configuration.set_unstable_operation_enabled("v2.create_security_monitoring_dataset", true);
        let api = SecurityMonitoringAPI::with_config(configuration);
        let resp = api.create_security_monitoring_dataset(body).await;
        if let Ok(value) = resp {
            println!("{:#?}", value);
        } else {
            println!("{:#?}", resp.unwrap_err());
        }
    }
    

    Instructions

    First install the library and its dependencies and then save the example to src/main.rs and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo run
    /**
     * Create a dataset returns "Created" response
     */
    
    import { client, v2 } from "@datadog/datadog-api-client";
    
    const configuration = client.createConfiguration({
      authMethods: {
        AuthZ: {
          accessToken: process.env.DD_BEARER_TOKEN as string,
        },
      },
    });
    configuration.unstableOperations["v2.createSecurityMonitoringDataset"] = true;
    const apiInstance = new v2.SecurityMonitoringApi(configuration);
    
    const params: v2.SecurityMonitoringApiCreateSecurityMonitoringDatasetRequest = {
      body: {
        data: {
          attributes: {
            definition: {
              columns: [
                {
                  column: "message",
                  type: "string",
                },
              ],
              dataSource: "logs",
              indexes: [],
              name: "sample_dataset",
              queryFilter: "status = 'active'",
              search: {
                query: "*",
              },
              storage: "hot",
              tableName: "my_reference_table",
              timeWindow: {
                from: 1700000000000,
                to: 1700003600000,
              },
            },
            description: "A sample dataset used for detection rules.",
            version: 1,
          },
          type: "datasetCreate",
        },
      },
    };
    
    apiInstance
      .createSecurityMonitoringDataset(params)
      .then((data: v2.SecurityMonitoringDatasetCreateResponse) => {
        console.log(
          "API called successfully. Returned data: " + JSON.stringify(data)
        );
      })
      .catch((error: any) => console.error(error));
    

    Instructions

    First install the library and its dependencies and then save the example to example.ts and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"