Optional requestFactory: SecurityMonitoringApiRequestFactoryOptional responseProcessor: SecurityMonitoringApiResponseProcessorPrivate configurationPrivate requestPrivate responseThe request object
Optional options: ConfigurationActivate an entity context sync integration for a source type that does not require manually supplied credentials (for example, Entra ID). If an integration of this type already exists, it is returned (re-enabling it first if it was disabled) instead of creating a duplicate.
The request object
Optional options: ConfigurationAttach security findings to a case. You can attach up to 50 security findings per case. Security findings that are already attached to another case will be detached from their previous case and attached to the specified case.
The request object
Optional options: ConfigurationAttach security findings to a Jira issue by providing the Jira issue URL. You can attach up to 50 security findings per Jira issue. If the Jira issue is not linked to any case, this operation will create a case for the security findings and link the Jira issue to the newly created case. To configure the Jira integration, see Bidirectional ticket syncing with Jira. Security findings that are already attached to another Jira issue will be detached from their previous Jira issue and attached to the specified Jira issue.
The request object
Optional options: ConfigurationAttach security findings to a Linear issue by providing the Linear issue URL. You can attach up to 50 security findings per Linear issue. If the Linear issue is not linked to any case, this operation will create a case for the security findings and link the Linear issue to the newly created case. Security findings that are already attached to another Linear issue will be detached from their previous Linear issue and attached to the specified Linear issue.
The request object
Optional options: ConfigurationAttach security findings to a ServiceNow ticket by providing the ServiceNow ticket URL. You can attach up to 50 security findings per ServiceNow ticket. If the ServiceNow ticket is not linked to any case, this operation will create a case for the security findings and link the ServiceNow ticket to the newly created case. Security findings that are already attached to another ServiceNow ticket will be detached from their previous ServiceNow ticket and attached to the specified ServiceNow ticket.
The request object
Optional options: ConfigurationReturn, for each of the requested datasets, the list of detection rules that depend on it. Useful for understanding the impact of updating or deleting a dataset.
The request object
Optional options: ConfigurationConvert a list of existing security monitoring rules to Terraform for the Datadog provider
resource datadog_security_monitoring_rule. Returns a ZIP archive containing one Terraform
file per rule. You can convert rules for the following types:
The request object
Optional options: ConfigurationSubscribe to sample log generation for multiple Cloud SIEM content packs in a single call. Each requested content pack is processed independently; the response includes a per-item status so partial successes can be inspected.
Availability: this endpoint is restricted to Cloud SIEM trial organizations on an
eligible pricing model. Non-trial orgs receive 403 Forbidden, the feature flag may also reject
requests with 400 Bad Request, and legacy pricing tiers receive per-item responses with status: not_available.
The request object
Optional options: ConfigurationDelete multiple security monitoring rules in a single request. Default rules cannot be deleted.
The request object
Optional options: ConfigurationUpdate the triage state or assignee of multiple security signals at once. The maximum number of signals that can be updated in a single request is 199.
The request object
Optional options: ConfigurationChange the triage assignees of multiple security signals at once. The maximum number of signals that can be updated in a single request is 199.
The request object
Optional options: ConfigurationChange the triage states of multiple security signals at once. The maximum number of signals that can be updated in a single request is 199.
The request object
Optional options: ConfigurationExport a list of security monitoring rules as a ZIP file containing JSON rule definitions. The endpoint accepts a list of rule IDs and returns a ZIP archive where each rule is saved as a separate JSON file named after the rule.
The request object
Optional options: ConfigurationExport multiple security monitoring resources to Terraform, packaged as a zip archive.
The resource_type path parameter specifies the type of resources to export
and must be one of suppressions, critical_assets, security_filters, or rules.
A maximum of 1000 resources can be exported in a single request.
For rules, partner rules cannot be exported and return a 400 error.
The request object
Optional options: ConfigurationCancel a historical job.
The request object
Optional options: ConfigurationCancel an in_progress batch migration. Resources that are pending or in_progress
become canceled. Resources that are already completed or failed keep their status
and output, so completed resources can still be published. Canceling a canceled batch
migration succeeds, so the request can be safely retried. Returns 409 Conflict if the
batch migration is draft or completed.
The request object
Optional options: ConfigurationConvert an existing rule from JSON to Terraform for Datadog provider
resource datadog_security_monitoring_rule. You can do so for the following rule types:
You can convert Cloud Security configuration rules using Terraform's Datadog Cloud Configuration Rule resource.
The request object
Optional options: ConfigurationConvert a job result to a signal.
The request object
Optional options: ConfigurationConvert a rule that doesn't (yet) exist from JSON to Terraform for Datadog provider
resource datadog_security_monitoring_rule. You can do so for the following rule types:
You can convert Cloud Security configuration rules using Terraform's Datadog Cloud Configuration Rule resource.
The request object
Optional options: ConfigurationConvert a security monitoring resource that doesn't (yet) exist from JSON to Terraform.
The resource_type path parameter specifies the type of resource to convert
and must be one of suppressions, critical_assets, security_filters, or rules.
The request object
Optional options: ConfigurationCreate cases for security findings. You can create up to 50 cases per request and associate up to 50 security findings per case. Security findings that are already attached to another case will be detached from their previous case and attached to the newly created case.
The request object
Optional options: ConfigurationCreate a custom framework.
The request object
Optional options: ConfigurationSet the triage state of an indicator of compromise (IoC). This creates or updates the triage state for the indicator in your organization.
The request object
Optional options: ConfigurationCreate Jira issues for security findings. This operation creates a case in Datadog and a Jira issue linked to that case for bidirectional sync between Datadog and Jira. To configure the Jira integration, see Bidirectional ticket syncing with Jira. You can create up to 50 Jira issues per request and associate up to 50 security findings per Jira issue. Security findings that are already attached to another Jira issue will be detached from their previous Jira issue and attached to the newly created Jira issue.
The request object
Optional options: ConfigurationCreate Linear issues for security findings. This operation creates a case in Datadog and a Linear issue linked to that case for bidirectional sync between Datadog and Linear. You can create up to 50 Linear issues per request and associate up to 50 security findings per Linear issue. Security findings that are already attached to another Linear issue will be detached from their previous Linear issue and attached to the newly created Linear issue.
The request object
Optional options: ConfigurationSubscribe to sample log generation for a Cloud SIEM content pack. Sample logs for the requested content pack are injected into the Logs platform for the duration of the subscription, so detection rules can be exercised without onboarding the underlying integration first.
Availability: this endpoint is restricted to Cloud SIEM trial organizations on an
eligible pricing model. Non-trial orgs receive 403 Forbidden, the feature flag may also reject
requests with 400 Bad Request, and legacy pricing tiers receive a response with status: not_available.
The request object
Optional options: ConfigurationCreate a security filter.
See the security filter guide for more examples.
The request object
Optional options: ConfigurationCreate a due date rule for the current organization.
The request object
Optional options: ConfigurationCreate an inbox rule for the current organization.
The request object
Optional options: ConfigurationCreate a mute rule for the current organization.
The request object
Optional options: ConfigurationCreate a severity modifier rule for the current organization.
The request object
Optional options: ConfigurationCreate a ticket creation rule for the current organization.
The request object
Optional options: ConfigurationCreate a batch migration in the draft status, together with 1 to 100 initial
resources. Each resource holds one source rule to translate into a Cloud SIEM detection
rule. To load more rules, add them with the add resources endpoint before starting the
batch migration. A batch migration can hold up to 1000 resources. The response does not
include the created resources: list the resources of the batch migration to retrieve them.
Alternatively, use the start-a-rule-proposal endpoint to get a single proposed rule.
The request object
Optional options: ConfigurationAdd 1 to 1000 resources to a draft batch migration. Returns 409 Conflict if the
batch migration is not draft, and 400 Bad Request if the batch migration would
contain more than 1000 resources.
The request object
Optional options: ConfigurationCreate a new critical asset.
The request object
Optional options: ConfigurationCreate a new Cloud SIEM dataset. A dataset bundles a data source, a set of indexes, and a search query that can be referenced from detection rules.
The request object
Optional options: ConfigurationCreate a new entity context sync configuration so Cloud SIEM can ingest entities from an external
source. The credentials provided in secrets are validated against the source before the configuration
is stored and never returned in subsequent responses.
The request object
Optional options: ConfigurationCreate a detection rule.
The request object
Optional options: ConfigurationCreate a new suppression rule.
The request object
Optional options: ConfigurationCreate ServiceNow tickets for security findings. This operation creates a case in Datadog and a ServiceNow ticket linked to that case for bidirectional sync between Datadog and ServiceNow. You can create up to 50 ServiceNow tickets per request and associate up to 50 security findings per ServiceNow ticket. Security findings that are already attached to another ServiceNow ticket will be detached from their previous ServiceNow ticket and attached to the newly created ServiceNow ticket.
The request object
Optional options: ConfigurationCreate a new notification rule for security signals and return the created rule.
The request object
Optional options: ConfigurationParse source code into an abstract syntax tree (AST) for the specified language.
The request object
Optional options: ConfigurationRun static analysis rules against a source code file and return violations found.
The request object
Optional options: ConfigurationCreate a new notification rule for security vulnerabilities and return the created rule.
The request object
Optional options: ConfigurationDeactivate a Cloud SIEM content pack. This operation removes the content pack's configuration from log filters or security filters and updates the content pack activation state.
The request object
Optional options: ConfigurationDeactivate all active entity context sync integrations of the given source type (for example, Entra ID).
The request object
Optional options: ConfigurationDelete a custom framework.
The request object
Optional options: ConfigurationDelete an existing job.
The request object
Optional options: ConfigurationUnsubscribe from sample log generation for a Cloud SIEM content pack. After unsubscribing, no more sample logs are generated for the requested content pack.
Availability: this endpoint is restricted to Cloud SIEM trial organizations on an
eligible pricing model. Non-trial orgs receive 403 Forbidden, the feature flag may also reject
requests with 400 Bad Request, and legacy pricing tiers receive a response with status: not_available.
The request object
Optional options: ConfigurationDelete a specific security filter.
The request object
Optional options: ConfigurationDelete a due date rule by ID.
The request object
Optional options: ConfigurationDelete an inbox rule by ID.
The request object
Optional options: ConfigurationDelete a mute rule by ID.
The request object
Optional options: ConfigurationDelete a severity modifier rule by ID.
The request object
Optional options: ConfigurationDelete a ticket creation rule by ID.
The request object
Optional options: ConfigurationDelete a batch migration and its resources. Detection rules that were already
published are not deleted. Returns 409 Conflict while any resource is in_progress
or publishing: cancel the batch migration, or wait for publishing to finish, and
then try again.
The request object
Optional options: ConfigurationDelete resources from a batch migration. The request is all-or-nothing: it returns
404 Not Found if any resource does not exist, and 409 Conflict if any resource is
in_progress or publishing. In both cases nothing is deleted. Duplicate resource IDs
are ignored. Detection rules already published from the deleted resources are not deleted.
The request object
Optional options: ConfigurationDelete a specific critical asset.
The request object
Optional options: ConfigurationDelete a Cloud SIEM dataset. Out-of-the-box datasets cannot be deleted and deleting a dataset that is referenced by a detection rule is rejected.
The request object
Optional options: ConfigurationDelete an entity context sync configuration. Cloud SIEM stops ingesting entities from this source, and the credentials stored for the configuration are removed from the secrets store.
The request object
Optional options: ConfigurationDelete an existing rule. Default rules cannot be deleted.
The request object
Optional options: ConfigurationDelete a specific suppression rule.
The request object
Optional options: ConfigurationDelete a notification rule for security signals.
The request object
Optional options: ConfigurationDelete a notification rule for security vulnerabilities.
The request object
Optional options: ConfigurationDetach security findings from their case. This operation dissociates security findings from their associated cases without deleting the cases themselves. You can detach security findings from multiple different cases in a single request, with a limit of 50 security findings per request. Security findings that are not currently attached to any case will be ignored.
The request object
Optional options: ConfigurationDisable a default inbox rule for the current organization.
The request object
Optional options: ConfigurationUpdate the triage state or assignee of a security signal.
The request object
Optional options: ConfigurationModify the triage assignee of a security signal.
The request object
Optional options: ConfigurationChange the related incidents for a security signal.
The request object
Optional options: ConfigurationChange the triage state of a security signal.
The request object
Optional options: ConfigurationEnable a default inbox rule for the current organization.
The request object
Optional options: ConfigurationExport a security monitoring resource to a Terraform configuration.
The resource_type path parameter specifies the type of resource to export
and must be one of suppressions, critical_assets, security_filters, or rules.
For rules, partner rules cannot be exported and return a 400 error.
The request object
Optional options: ConfigurationGet the activation state, integration status, and log collection status for all Cloud SIEM content packs.
Optional options: ConfigurationGet the list of critical assets that affect a specific existing rule by the rule's ID.
The request object
Optional options: ConfigurationGet a custom framework.
The request object
Optional options: ConfigurationSearch the Cloud SIEM entity context store for entities that match a query, and return the historical
revisions of each entity in the requested time range. The endpoint can either return revisions across an
interval (from / to) or the snapshot of each entity at a single point in time (as_of); the two modes
are mutually exclusive.
The request object
Optional options: ConfigurationGet the entities with the most recent updates in the Cloud SIEM entity context store. Entities are ranked
by the time of their most recent revision in the requested time range, and the top limit entities are
returned in that order. This endpoint is not paginated.
The request object
Optional options: ConfigurationGet the Azure App Registrations discovered for the organization and whether at least one of them has resource collection enabled, which is a prerequisite for activating the Entra ID entity context sync integration.
Optional options: ConfigurationReturns a single finding with message and resource configuration.
The request object
Optional options: ConfigurationGet a job's details.
The request object
Optional options: ConfigurationGet detailed information about a specific indicator of compromise (IoC).
The request object
Optional options: ConfigurationGet the list of investigation log queries available for a given security signal.
The request object
Optional options: ConfigurationReturns the list of security signals that match a given event on the given track.
The request object
Optional options: ConfigurationList resource filters.
The request object
Optional options: ConfigurationGet a rule's version history.
The request object
Optional options: ConfigurationGet a single SBOM related to an asset by its type and name.
The request object
Optional options: ConfigurationReturns a list of Secrets rules with ID, Pattern, Description, Priority, and SDS ID.
Optional options: ConfigurationGet the details of a specific security filter.
See the security filter guide for more examples.
The request object
Optional options: ConfigurationGet the details of a default inbox rule by ID. Datadog manages default inbox rules. Their name, rule, and action are read-only, and each organization can change only whether they are enabled.
The request object
Optional options: ConfigurationGet the details of a due date rule by ID.
The request object
Optional options: ConfigurationGet the details of an inbox rule by ID.
The request object
Optional options: ConfigurationGet the details of a mute rule by ID.
The request object
Optional options: ConfigurationGet the details of a severity modifier rule by ID.
The request object
Optional options: ConfigurationGet the details of a ticket creation rule by ID.
The request object
Optional options: ConfigurationGet the details of a specific critical asset.
The request object
Optional options: ConfigurationGet the current version of a Cloud SIEM dataset by ID.
The request object
Optional options: ConfigurationRetrieve a specific historical version of a Cloud SIEM dataset.
The request object
Optional options: ConfigurationRetrieve the version history of a Cloud SIEM dataset, including the changes made at each version.
The request object
Optional options: ConfigurationGet a hist signal's details.
The request object
Optional options: ConfigurationGet a job's hist signals.
The request object
Optional options: ConfigurationGet the details of a specific entity context sync configuration.
The request object
Optional options: ConfigurationGet a rule's details.
The request object
Optional options: ConfigurationGet the status of a rule proposal started with the start-a-rule-proposal endpoint.
While the status is pending or in_progress, the proposed rule is still being
generated. Poll this endpoint again later. If the status is completed, the response's rule field contains
the proposed Cloud SIEM detection rule. If the status is failed, the response's error field contains
the reason a rule could not be generated.
This endpoint does not create or modify any detection rules in Cloud SIEM. To create the proposed rule, use the create-a-detection-rule endpoint.
The request object
Optional options: ConfigurationGet a signal's details.
The request object
Optional options: ConfigurationGet the details of a specific suppression rule.
The request object
Optional options: ConfigurationGet the list of entities related to a security signal, captured at the signal's timestamp.
The request object
Optional options: ConfigurationGet the details of a notification rule for security signals.
The request object
Optional options: ConfigurationReturns the list of notification rules for security signals.
Optional options: ConfigurationGet a single entity from the Cloud SIEM entity context store by its identifier, returning the historical
revisions of the entity in the requested time range. The endpoint can either return revisions across an
interval (from / to) or the snapshot of the entity at a single point in time (as_of); the two modes
are mutually exclusive.
The request object
Optional options: ConfigurationGet the default SAST ruleset names for a given programming language.
The request object
Optional options: ConfigurationRetrieve tree-sitter node type definitions for a given programming language.
The request object
Optional options: ConfigurationGet a SAST ruleset by name, including all its rules.
The request object
Optional options: ConfigurationDownload the WebAssembly binary for a tree-sitter grammar by file name.
The request object
Optional options: ConfigurationGet the list of suggested actions for a given security signal.
The request object
Optional options: ConfigurationGet a suppression's version history.
The request object
Optional options: ConfigurationGet the list of suppressions that would affect a rule.
The request object
Optional options: ConfigurationGet the list of suppressions that affect a specific existing rule by its ID.
The request object
Optional options: ConfigurationGet the details of a notification rule for security vulnerabilities.
The request object
Optional options: ConfigurationReturns the list of notification rules for security vulnerabilities.
Optional options: ConfigurationImport security vulnerabilities from an external scanner in CycloneDX 1.5 format.
The payload is validated against the CycloneDX 1.5 JSON schema and the following additional constraints:
metadata, metadata.component, and metadata.component.name are required.metadata.tools.components must contain exactly one element with a name field.components cannot be empty. Each component requires bom-ref, type, name, and version.type is library, purl is required and must be a valid PURL.type is operating-system, name must be one of the supported OS values:
alma, alpine, amazon, azurelinux, bottlerocket, cbl-mariner, chainguard,
centos, debian, fedora, opensuse, opensuse-leap, opensuse-tumbleweed,
oracle, photon, redhat, rocky, slem, sles, ubuntu, wolfi, windows, macos.vulnerabilities cannot be empty. Each vulnerability requires id, exactly one ratings entry,
and at least one affects entry.affects[].ref must match a bom-ref value in components.The request object
Optional options: ConfigurationGet a list of assets SBOMs for an organization.
The filter[asset_type] parameter is required for initial requests (when no page[token] is provided).
Subsequent pages encode the asset type in the pagination token, so filter[asset_type] is not required
for paginated requests. Mixing infrastructure asset types (Host, HostImage, Image, ServerlessFunction)
with code asset types (Repository, Service) in the same request is not supported and returns a 400 error.
Please review the Pagination section for the "List Vulnerabilities" endpoint.
Please review the Filtering section for the "List Vulnerabilities" endpoint.
Please review the Metadata section for the "List Vulnerabilities" endpoint.
The request object
Optional options: ConfigurationGet a list of findings. These include both misconfigurations and identity risks.
Note: To filter and return only identity risks, add the following query parameter: ?filter[tags]=dd_rule_type:ciem
Filters can be applied by appending query parameters to the URL.
?filter[attribute_key]=attribute_value?filter[attribute_key]=attribute_value&filter[attribute_key]=attribute_value...?filter[tags]=tag_key:tag_value&filter[tags]=tag_key_2:tag_value_2Here, attribute_key can be any of the filter keys described further below.
Query parameters of type integer support comparison operators (>, >=, <, <=). This is particularly useful when filtering by evaluation_changed_at or resource_discovery_timestamp. For example: ?filter[evaluation_changed_at]=>20123123121.
You can also use the negation operator on strings. For example, use filter[resource_type]=-aws* to filter for any non-AWS resources.
The operator must come after the equal sign. For example, to filter with the >= operator, add the operator after the equal sign: filter[evaluation_changed_at]=>=1678809373257.
Query parameters must be only among the documented ones and with values of correct types. Duplicated query parameters (e.g. filter[status]=low&filter[status]=info) are not allowed.
Additional extension fields are available for some findings.
The data is available when you include the query parameter ?detailed_findings=true in the request.
The following fields are available for findings:
external_id: The resource external ID related to the finding.description: The description and remediation steps for the finding.datadog_link: The Datadog relative link for the finding.ip_addresses: The list of private IP addresses for the resource related to the finding.The response includes an array of finding objects, pagination metadata, and a count of items that match the query.
Each finding object contains the following:
GetFinding request to retrieve the full finding details.evaluation_changed_at and resource_discovery_date time stamps.The request object
Optional options: ConfigurationProvide a paginated version of listFindings returning a generator with all the items.
Optional options: ConfigurationList historical jobs.
The request object
Optional options: ConfigurationGet a list of indicators of compromise (IoCs) matching the specified filters.
The request object
Optional options: ConfigurationGet rules for multiple rulesets in batch.
The request object
Optional options: ConfigurationGet the sample log generation subscriptions for the organization. Sample log generation injects representative example logs for a given Cloud SIEM content pack into the Logs platform, which can be used to test detection rules without onboarding the underlying integration first.
Availability: this endpoint is restricted to Cloud SIEM trial organizations on an eligible
pricing model. Other organizations receive a 403 Forbidden (non-trial orgs) or a 400 Bad Request
(feature disabled), and legacy pricing tiers receive a response with status: not_available.
The request object
Optional options: ConfigurationGet a list of security scanned assets metadata for an organization.
For the "List Vulnerabilities" endpoint, see the Pagination section.
For the "List Vulnerabilities" endpoint, see the Filtering section.
For the "List Vulnerabilities" endpoint, see the Metadata section.
This endpoint returns additional metadata for cloud resources that is not available from the standard resource endpoints. To access a richer dataset, call this endpoint together with the relevant resource endpoint(s) and merge (join) their results using the resource identifier.
Hosts
To enrich host data, join the response from the Hosts endpoint with the response from the scanned-assets-metadata endpoint on the following key fields:
| ENDPOINT | JOIN KEY | TYPE |
|---|---|---|
| /api/v1/hosts | host_list.host_name | string |
| /api/v2/security/scanned-assets-metadata | data.attributes.asset.name | string |
Host Images
To enrich host image data, join the response from the Hosts endpoint with the response from the scanned-assets-metadata endpoint on the following key fields:
| ENDPOINT | JOIN KEY | TYPE |
|---|---|---|
| /api/v1/hosts | host_list.tags_by_source["Amazon Web Services"]["image"] | string |
| /api/v2/security/scanned-assets-metadata | data.attributes.asset.name | string |
Container Images
To enrich container image data, join the response from the Container Images endpoint with the response from the scanned-assets-metadata endpoint on the following key fields:
| ENDPOINT | JOIN KEY | TYPE |
|---|---|---|
| /api/v2/container_images | data.attributes.name@data.attributes.repo_digest |
string |
| /api/v2/security/scanned-assets-metadata | data.attributes.asset.name | string |
The request object
Optional options: ConfigurationGet the configured security filters at each historical version of the configuration. Each entry in the response represents the set of all security filters at a given version, ordered from the most recent version to the oldest.
Optional options: ConfigurationGet the list of configured security filters with their definitions.
Optional options: ConfigurationGet a list of security findings that match a search query. See the schema for security findings.
This endpoint uses the logs query syntax. Findings attributes (living in the attributes.attributes. namespace) are prefixed by @ when queried. Tags are queried without a prefix.
Example: @severity:(critical OR high) @status:open team:platform
The request object
Optional options: ConfigurationGet all default inbox rules for the current organization. Datadog manages default inbox rules. Their name, rule, and action are read-only, and each organization can change only whether they are enabled.
Optional options: ConfigurationGet all due date rules for the current organization.
The request object
Optional options: ConfigurationGet all inbox rules for the current organization.
The request object
Optional options: ConfigurationGet all mute rules for the current organization.
The request object
Optional options: ConfigurationGet all severity modifier rules for the current organization.
The request object
Optional options: ConfigurationGet all ticket creation rules for the current organization.
The request object
Optional options: ConfigurationProvide a paginated version of listSecurityFindings returning a generator with all the items.
Optional options: ConfigurationList the resources of a batch migration, including the input of each source rule and,
once translated, the proposed Cloud SIEM detection rule in output.
The request object
Optional options: ConfigurationList the batch migrations of your organization. A batch migration groups detection
rules from another SIEM that the Datadog Detection Agent translates into Cloud SIEM
detection rules. To retrieve a single batch migration, filter by its ID with
filter[query]=id:<batch_id>. Poll this endpoint to follow the progress of a batch
migration through its status and resourceStatusCounts.
The request object
Optional options: ConfigurationGet the list of all critical assets.
Optional options: ConfigurationList all Cloud SIEM datasets available to the organization, including both customer-defined datasets and Datadog out-of-the-box datasets.
The request object
Optional options: ConfigurationList hist signals.
The request object
Optional options: ConfigurationList the entity context sync configurations for Cloud SIEM. Each configuration connects Cloud SIEM to an external source that provides entities (for example, users from an identity provider) for use in signals and the entity explorer.
The request object
Optional options: ConfigurationList rules.
The request object
Optional options: ConfigurationThe list endpoint returns security signals that match a search query. Both this endpoint and the POST endpoint can be used interchangeably when listing security signals.
The request object
Optional options: ConfigurationProvide a paginated version of listSecurityMonitoringSignals returning a generator with all the items.
Optional options: ConfigurationGet the list of all suppression rules.
The request object
Optional options: ConfigurationGet the rulesets relevant for code generation for the authenticated user.
Optional options: ConfigurationGet a list of vulnerabilities.
Pagination is enabled by default in both vulnerabilities and assets. The size of the page varies depending on the endpoint and cannot be modified. To automate the request of the next page, you can use the links section in the response.
This endpoint will return paginated responses. The pages are stored in the links section of the response:
{
"data": [...],
"meta": {...},
"links": {
"self": "https://.../api/v2/security/vulnerabilities",
"first": "https://.../api/v2/security/vulnerabilities?page[number]=1&page[token]=abc",
"last": "https://.../api/v2/security/vulnerabilities?page[number]=43&page[token]=abc",
"next": "https://.../api/v2/security/vulnerabilities?page[number]=2&page[token]=abc"
}
}
links.previous is empty if the first page is requested.links.next is empty if the last page is requested.Vulnerabilities can be created, updated or deleted at any point in time.
Upon the first request, a token is created to ensure consistency across subsequent paginated requests.
A token is valid only for 24 hours.
We consider a request to be the first request when there is no page[token] parameter.
The response of this first request contains the newly created token in the links section.
This token can then be used in the subsequent paginated requests.
Note: The first request may take longer to complete than subsequent requests.
Any request containing valid page[token] and page[number] parameters will be considered a subsequent request.
If the token is invalid, a 404 response will be returned.
If the page number is invalid, a 400 response will be returned.
The returned token is valid for all requests in the pagination sequence. To send paginated requests in parallel, reuse the same token and change only the page[number] parameter.
The request can include some filter parameters to filter the data to be retrieved. The format of the filter parameters follows the JSON:API format: filter[$prop_name], where prop_name is the property name in the entity being filtered by.
All filters can include multiple values, where data will be filtered with an OR clause: filter[title]=Title1,Title2 will filter all vulnerabilities where title is equal to Title1 OR Title2.
String filters are case sensitive.
Boolean filters accept true or false as values.
Number filters must include an operator as a second filter input: filter[$prop_name][$operator]. For example, for the vulnerabilities endpoint: filter[cvss.base.score][lte]=8.
Available operators are: eq (==), lt (<), lte (<=), gt (>) and gte (>=).
Following JSON:API format, object including non-standard meta-information.
This endpoint includes the meta member in the response. For more details on each of the properties included in this section, check the endpoints response tables.
{
"data": [...],
"meta": {
"total": 1500,
"count": 18732,
"token": "some_token"
},
"links": {...}
}
Requests may include extensions to modify the behavior of the requested endpoint. The filter parameters follow the JSON:API format format: ext:$extension_name, where extension_name is the name of the modifier that is being applied.
Extensions can only include one value: ext:modifier=value.
The request object
Optional options: ConfigurationGet a list of vulnerable assets.
Please review the Pagination section for the "List Vulnerabilities" endpoint.
Please review the Filtering section for the "List Vulnerabilities" endpoint.
Please review the Metadata section for the "List Vulnerabilities" endpoint.
The request object
Optional options: ConfigurationMute or unmute security findings.
You can mute or unmute up to 100 security findings per request. The request body must include is_muted and reason attributes. The allowed reasons depend on whether the finding is being muted or unmuted:
PENDING_FIX, FALSE_POSITIVE, OTHER, NO_FIX, DUPLICATE, RISK_ACCEPTED.NO_PENDING_FIX, HUMAN_ERROR, NO_LONGER_ACCEPTED_RISK, OTHER.The request object
Optional options: ConfigurationPartially update the notification rule. All fields are optional; if a field is not provided, it is not updated.
The request object
Optional options: ConfigurationPartially update the notification rule. All fields are optional; if a field is not provided, it is not updated.
The request object
Optional options: ConfigurationCreate a Cloud SIEM detection rule from the output of each selected completed
resource of a batch migration. Completed resources can be published while the rest of
the batch migration is still being translated. When resourceIds is omitted or empty,
every completed resource is published. Published rules are created disabled.
Every requested resource must be publishable: completed, or left in publishing for
more than one minute after an uncertain result. Otherwise, the request returns
409 Conflict and nothing is published. Already published resources are not publishable.
The response reports the outcome of each resource, and some resources can be published
while others fail. A failed result that contains a ruleId means the rule was created:
do not retry that resource. Publishing a rule with a block_ip or block_user action
requires the appsec_protect_write permission.
The request object
Optional options: ConfigurationReorder the list of due date rules for the current organization.
The request object
Optional options: ConfigurationReorder the list of inbox rules for the current organization.
The request object
Optional options: ConfigurationReorder the list of mute rules for the current organization.
The request object
Optional options: ConfigurationReorder the list of severity modifier rules for the current organization.
The request object
Optional options: ConfigurationReorder the list of ticket creation rules for the current organization.
The request object
Optional options: ConfigurationRestores a custom detection rule to a previously saved historical version. Only custom rules can be restored. Default and partner rules return 400. The restore creates a new version entry; it does not overwrite history.
The request object
Optional options: ConfigurationRun a historical job.
The request object
Optional options: ConfigurationGet a list of security findings that match a search query. See the schema for security findings.
The API uses the logs query syntax. Findings attributes (living in the attributes.attributes. namespace) are prefixed by @ when queried. Tags are queried without a prefix.
Example: @severity:(critical OR high) @status:open team:platform
The request object
Optional options: ConfigurationProvide a paginated version of searchSecurityFindings returning a generator with all the items.
Optional options: ConfigurationSearch hist signals.
The request object
Optional options: ConfigurationReturns security signals that match a search query. Both this endpoint and the GET endpoint can be used interchangeably for listing security signals.
The request object
Optional options: ConfigurationProvide a paginated version of searchSecurityMonitoringSignals returning a generator with all the items.
Optional options: ConfigurationSend a notification preview to test that a notification rule's targets are properly configured.
The request object
Optional options: ConfigurationStart translating the pending resources of a draft batch migration into Cloud SIEM
detection rules. The batch migration moves to in_progress, and its resources are
translated asynchronously. Once no resource is pending or in_progress, the batch
migration moves to completed. Starting an in_progress batch migration again does not
queue duplicate work, so the request can be safely retried, including after a timeout or
a 5xx error. Returns 409 Conflict if the batch migration is completed or canceled.
An organization can translate up to 2000 resources in total across all of its batch
migrations. Resources that were already processed count toward this limit even after
they are deleted, and pending resources of in_progress batch migrations reserve
capacity. Returns 409 Conflict if starting the batch migration would exceed this limit.
To request a higher limit for your organization, contact
Datadog support.
The request object
Optional options: ConfigurationStart generating a proposed Cloud SIEM detection rule from a natural-language description, or from an SPL or KQL rule. The proposal is based on your organization's log sources, log fields, and existing detection rules. When logs from the matching source are available, the proposed query is tested against your recent logs.
The proposed rule is generated asynchronously. This endpoint returns a proposal id
with the status pending. To get the proposed rule, pass this id to the get-a-rule-proposal
endpoint and poll the endpoint until the status is completed or failed. A proposal
usually takes a few minutes, and up to 10 minutes.
This endpoint does not create or modify any detection rules in Cloud SIEM. To translate many rules at once, use batch migrations instead.
The request object
Optional options: ConfigurationTest an existing rule.
The request object
Optional options: ConfigurationTest a rule.
The request object
Optional options: ConfigurationUpdate a custom framework.
The request object
Optional options: ConfigurationAssign or unassign security findings.
You can assign up to 100 security findings per request. Set assignee_id to the unique identifier of the Datadog user you want to assign the findings to. Omit assignee_id (or set it to null) to unassign the findings. Per-finding warnings and failures are returned in the response meta object.
The request object
Optional options: ConfigurationSet or clear the manual severity override of security findings.
You can update up to 100 security findings per request.
Use the set action with a value to apply a manual severity override.
value is required for set and must be omitted for clear.
The info value sets the lowest severity the finding type allows.
Use the clear action to remove a manual severity override.
clear does not remove a severity set by an automation rule.
The optional description is accepted with both actions and has a limit of 280 characters.
Auto-closed findings are excluded.
Findings whose severity was set by an automation rule are skipped and listed in the response meta.warnings.
If every finding is skipped this way, the request fails with a 400 error.
Findings that cannot be found are skipped without a warning.
The request fails with a 404 error only if none of the findings can be found.
The request object
Optional options: ConfigurationUpdate resource filters.
The request object
Optional options: ConfigurationUpdate a specific security filter. Returns the security filter object when the request is successful.
The request object
Optional options: ConfigurationUpdate a due date rule by ID.
The request object
Optional options: ConfigurationUpdate an inbox rule by ID.
The request object
Optional options: ConfigurationUpdate a mute rule by ID.
The request object
Optional options: ConfigurationUpdate a severity modifier rule by ID.
The request object
Optional options: ConfigurationUpdate a ticket creation rule by ID.
The request object
Optional options: ConfigurationUpdate the name, description, or tags of a batch migration, in any status. At least
one of these attributes must be provided. Omitted attributes are left unchanged, and
tags replaces the full list of tags.
The request object
Optional options: ConfigurationUpdate a resource of a batch migration. At least one of name, description,
inputType, or input must be provided. name and description can be updated at
any time. inputType and input can only be updated while the resource is pending;
otherwise, the request returns 409 Conflict. The translated output cannot be edited.
The request object
Optional options: ConfigurationUpdate a specific critical asset.
The request object
Optional options: ConfigurationUpdate an existing Cloud SIEM dataset. The current version of the dataset can be provided to detect concurrent modifications.
The request object
Optional options: ConfigurationUpdate an existing entity context sync configuration. Supports partial updates; only the fields provided in the request body are modified.
The request object
Optional options: ConfigurationUpdate an existing rule. When updating cases, queries or options, the whole field
must be included. For example, when modifying a query all queries must be included.
Default rules can only be updated to be enabled, to change notifications, or to update
the tags (default tags cannot be removed).
The request object
Optional options: ConfigurationUpdate a specific suppression rule.
The request object
Optional options: ConfigurationValidate the credentials currently stored on an existing entity context sync configuration. Returns a 200 status code if the credentials are still valid against the external entity source.
The request object
Optional options: ConfigurationValidate a set of credentials against the external entity source before creating a sync configuration. Returns a 200 status code if the credentials are valid.
The request object
Optional options: ConfigurationValidate a detection rule.
The request object
Optional options: ConfigurationValidate a suppression rule.
The request object
Optional options: ConfigurationGenerated using TypeDoc
Activate a Cloud SIEM content pack. This operation configures the necessary log filters or security filters depending on the pricing model and updates the content pack activation state.