Class SecurityMonitoringApi

Cancel a historical job.

Convert an existing rule from JSON to Terraform for datadog provider resource datadog_security_monitoring_rule.

Convert a job result to a signal.

Convert a rule that doesn't (yet) exist from JSON to Terraform for datadog provider resource datadog_security_monitoring_rule.

Create a security filter.

See the security filter guide for more examples.

Create a detection rule.

Create a new suppression rule.

Delete an existing job.

Delete a specific security filter.

Delete an existing rule. Default rules cannot be deleted.

Delete a specific suppression rule.

Modify the triage assignee of a security signal.

Change the related incidents for a security signal.

Change the triage state of a security signal.

Returns a single finding with message and resource configuration.

Get a job's details.

Get the details of a specific security filter.

See the security filter guide for more examples.

Get a rule's details.

Get a signal's details.

Get the details of a specific suppression rule.

Get a list of findings. These include both misconfigurations and identity risks.

Note: To filter and return only identity risks, add the following query parameter: ?filter[tags]=dd_rule_type:ciem

Filters can be applied by appending query parameters to the URL.

• Using a single filter: ?filter[attribute_key]=attribute_value
• Chaining filters: ?filter[attribute_key]=attribute_value&filter[attribute_key]=attribute_value...
• Filtering on tags: ?filter[tags]=tag_key:tag_value&filter[tags]=tag_key_2:tag_value_2

Here, attribute_key can be any of the filter keys described further below.

Query parameters of type integer support comparison operators (>, >=, <, <=). This is particularly useful when filtering by evaluation_changed_at or resource_discovery_timestamp. For example: ?filter[evaluation_changed_at]=>20123123121.

You can also use the negation operator on strings. For example, use filter[resource_type]=-aws* to filter for any non-AWS resources.

The operator must come after the equal sign. For example, to filter with the >= operator, add the operator after the equal sign: filter[evaluation_changed_at]=>=1678809373257.

Query parameters must be only among the documented ones and with values of correct types. Duplicated query parameters (e.g. filter[status]=low&filter[status]=info) are not allowed.

The response includes an array of finding objects, pagination metadata, and a count of items that match the query.

Each finding object contains the following:

• The finding ID that can be used in a GetFinding request to retrieve the full finding details.
• Core attributes, including status, evaluation, high-level resource details, muted state, and rule details.
• evaluation_changed_at and resource_discovery_date time stamps.
• An array of associated tags.

Provide a paginated version of listFindings returning a generator with all the items.

List historical jobs.

Get the list of configured security filters with their definitions.

List rules.

The list endpoint returns security signals that match a search query. Both this endpoint and the POST endpoint can be used interchangeably when listing security signals.

Provide a paginated version of listSecurityMonitoringSignals returning a generator with all the items.

Get the list of all suppression rules.

Mute or unmute findings.

Run a historical job.

Returns security signals that match a search query. Both this endpoint and the GET endpoint can be used interchangeably for listing security signals.

Provide a paginated version of searchSecurityMonitoringSignals returning a generator with all the items.

Test an existing rule.

Test a rule.

Update a specific security filter. Returns the security filter object when the request is successful.

Update an existing rule. When updating cases, queries or options, the whole field must be included. For example, when modifying a query all queries must be included. Default rules can only be updated to be enabled, to change notifications, or to update the tags (default tags cannot be removed).

Update a specific suppression rule.

Validate a detection rule.