Class SecurityMonitoringApi

Activate a Cloud SIEM content pack. This operation configures the necessary log filters or security filters depending on the pricing model and updates the content pack activation state.

Attach security findings to a case. You can attach up to 50 security findings per case. Security findings that are already attached to another case will be detached from their previous case and attached to the specified case.

Attach security findings to a Jira issue by providing the Jira issue URL. You can attach up to 50 security findings per Jira issue. If the Jira issue is not linked to any case, this operation will create a case for the security findings and link the Jira issue to the newly created case. To configure the Jira integration, see Bidirectional ticket syncing with Jira. Security findings that are already attached to another Jira issue will be detached from their previous Jira issue and attached to the specified Jira issue.

Return, for each of the requested datasets, the list of detection rules that depend on it. Useful for understanding the impact of updating or deleting a dataset.

Convert a list of existing security monitoring rules to Terraform for the Datadog provider resource datadog_security_monitoring_rule. Returns a ZIP archive containing one Terraform file per rule. You can convert rules for the following types:

• App and API Protection
• Cloud SIEM (log detection and signal correlation)
• Workload Protection

Subscribe to sample log generation for multiple Cloud SIEM content packs in a single call. Each requested content pack is processed independently; the response includes a per-item status so partial successes can be inspected.

Availability: this endpoint is restricted to Cloud SIEM trial organizations on an eligible pricing model. Non-trial orgs receive 403 Forbidden, the feature flag may also reject requests with 400 Bad Request, and legacy pricing tiers receive per-item responses with status: not_available.

Delete multiple security monitoring rules in a single request. Default rules cannot be deleted.

Update the triage state or assignee of multiple security signals at once. The maximum number of signals that can be updated in a single request is 199.

Change the triage assignees of multiple security signals at once. The maximum number of signals that can be updated in a single request is 199.

Change the triage states of multiple security signals at once. The maximum number of signals that can be updated in a single request is 199.

Export a list of security monitoring rules as a ZIP file containing JSON rule definitions. The endpoint accepts a list of rule IDs and returns a ZIP archive where each rule is saved as a separate JSON file named after the rule.

Export multiple security monitoring resources to Terraform, packaged as a zip archive. The resource_type path parameter specifies the type of resources to export and must be one of suppressions or critical_assets. A maximum of 1000 resources can be exported in a single request.

Cancel a historical job.

Convert an existing rule from JSON to Terraform for Datadog provider resource datadog_security_monitoring_rule. You can do so for the following rule types:

• App and API Protection
• Cloud SIEM (log detection and signal correlation)
• Workload Protection

You can convert Cloud Security configuration rules using Terraform's Datadog Cloud Configuration Rule resource.

Convert a job result to a signal.

Convert a rule that doesn't (yet) exist from JSON to Terraform for Datadog provider resource datadog_security_monitoring_rule. You can do so for the following rule types:

• App and API Protection
• Cloud SIEM (log detection and signal correlation)
• Workload Protection

You can convert Cloud Security configuration rules using Terraform's Datadog Cloud Configuration Rule resource.

Convert a security monitoring resource that doesn't (yet) exist from JSON to Terraform. The resource_type path parameter specifies the type of resource to convert and must be one of suppressions or critical_assets.

Create cases for security findings. You can create up to 50 cases per request and associate up to 50 security findings per case. Security findings that are already attached to another case will be detached from their previous case and attached to the newly created case.

Create a custom framework.

Create Jira issues for security findings. This operation creates a case in Datadog and a Jira issue linked to that case for bidirectional sync between Datadog and Jira. To configure the Jira integration, see Bidirectional ticket syncing with Jira. You can create up to 50 Jira issues per request and associate up to 50 security findings per Jira issue. Security findings that are already attached to another Jira issue will be detached from their previous Jira issue and attached to the newly created Jira issue.

Subscribe to sample log generation for a Cloud SIEM content pack. Sample logs for the requested content pack are injected into the Logs platform for the duration of the subscription, so detection rules can be exercised without onboarding the underlying integration first.

Availability: this endpoint is restricted to Cloud SIEM trial organizations on an eligible pricing model. Non-trial orgs receive 403 Forbidden, the feature flag may also reject requests with 400 Bad Request, and legacy pricing tiers receive a response with status: not_available.

Create a security filter.

See the security filter guide for more examples.

Create a new critical asset.

Create a new Cloud SIEM dataset. A dataset bundles a data source, a set of indexes, and a search query that can be referenced from detection rules.

Create a new entity context sync configuration so Cloud SIEM can ingest entities from an external source. The credentials provided in secrets are validated against the source before the configuration is stored and never returned in subsequent responses.

Create a detection rule.

Create a new suppression rule.

Create a new notification rule for security signals and return the created rule.

Parse source code into an abstract syntax tree (AST) for the specified language.

Run static analysis rules against a source code file and return violations found.

Create a new notification rule for security vulnerabilities and return the created rule.

Deactivate a Cloud SIEM content pack. This operation removes the content pack's configuration from log filters or security filters and updates the content pack activation state.

Delete a custom framework.

Delete an existing job.

Unsubscribe from sample log generation for a Cloud SIEM content pack. After unsubscribing, no more sample logs are generated for the requested content pack.

Availability: this endpoint is restricted to Cloud SIEM trial organizations on an eligible pricing model. Non-trial orgs receive 403 Forbidden, the feature flag may also reject requests with 400 Bad Request, and legacy pricing tiers receive a response with status: not_available.

Delete a specific security filter.

Delete a specific critical asset.

Delete a Cloud SIEM dataset. Out-of-the-box datasets cannot be deleted and deleting a dataset that is referenced by a detection rule is rejected.

Delete an entity context sync configuration. Cloud SIEM stops ingesting entities from this source, and the credentials stored for the configuration are removed from the secrets store.

Delete an existing rule. Default rules cannot be deleted.

Delete a specific suppression rule.

Delete a notification rule for security signals.

Delete a notification rule for security vulnerabilities.

Detach security findings from their case. This operation dissociates security findings from their associated cases without deleting the cases themselves. You can detach security findings from multiple different cases in a single request, with a limit of 50 security findings per request. Security findings that are not currently attached to any case will be ignored.

Update the triage state or assignee of a security signal.

Modify the triage assignee of a security signal.

Change the related incidents for a security signal.

Change the triage state of a security signal.

Export a security monitoring resource to a Terraform configuration. The resource_type path parameter specifies the type of resource to export and must be one of suppressions or critical_assets.

Get the activation state, integration status, and log collection status for all Cloud SIEM content packs.

Get the list of critical assets that affect a specific existing rule by the rule's ID.

Get a custom framework.

Search the Cloud SIEM entity context store for entities that match a query, and return the historical revisions of each entity in the requested time range. The endpoint can either return revisions across an interval (from / to) or the snapshot of each entity at a single point in time (as_of); the two modes are mutually exclusive.

Returns a single finding with message and resource configuration.

Get a job's details.

Get detailed information about a specific indicator of compromise (IoC).

Get the list of investigation log queries available for a given security signal.

List resource filters.

Get a rule's version history.

Get a single SBOM related to an asset by its type and name.

Returns a list of Secrets rules with ID, Pattern, Description, Priority, and SDS ID.

Get the details of a specific security filter.

See the security filter guide for more examples.

Get the details of a specific critical asset.

Get the current version of a Cloud SIEM dataset by ID.

Retrieve a specific historical version of a Cloud SIEM dataset.

Retrieve the version history of a Cloud SIEM dataset, including the changes made at each version.

Get a hist signal's details.

Get a job's hist signals.

Get the details of a specific entity context sync configuration.

Get a rule's details.

Get a signal's details.

Get the details of a specific suppression rule.

Get the list of entities related to a security signal, captured at the signal's timestamp.

Get the details of a notification rule for security signals.

Returns the list of notification rules for security signals.

Get the default SAST ruleset names for a given programming language.

Retrieve tree-sitter node type definitions for a given programming language.

Get a SAST ruleset by name, including all its rules.

Download the WebAssembly binary for a tree-sitter grammar by file name.

Get the list of suggested actions for a given security signal.

Get a suppression's version history.

Get the list of suppressions that would affect a rule.

Get the list of suppressions that affect a specific existing rule by its ID.

Get the details of a notification rule for security vulnerabilities.

Returns the list of notification rules for security vulnerabilities.

Get a list of assets SBOMs for an organization.

Please review the Pagination section for the "List Vulnerabilities" endpoint.

Please review the Filtering section for the "List Vulnerabilities" endpoint.

Please review the Metadata section for the "List Vulnerabilities" endpoint.

Get a list of findings. These include both misconfigurations and identity risks.

Note: To filter and return only identity risks, add the following query parameter: ?filter[tags]=dd_rule_type:ciem

Filters can be applied by appending query parameters to the URL.

• Using a single filter: ?filter[attribute_key]=attribute_value
• Chaining filters: ?filter[attribute_key]=attribute_value&filter[attribute_key]=attribute_value...
• Filtering on tags: ?filter[tags]=tag_key:tag_value&filter[tags]=tag_key_2:tag_value_2

Here, attribute_key can be any of the filter keys described further below.

Query parameters of type integer support comparison operators (>, >=, <, <=). This is particularly useful when filtering by evaluation_changed_at or resource_discovery_timestamp. For example: ?filter[evaluation_changed_at]=>20123123121.

You can also use the negation operator on strings. For example, use filter[resource_type]=-aws* to filter for any non-AWS resources.

The operator must come after the equal sign. For example, to filter with the >= operator, add the operator after the equal sign: filter[evaluation_changed_at]=>=1678809373257.

Query parameters must be only among the documented ones and with values of correct types. Duplicated query parameters (e.g. filter[status]=low&filter[status]=info) are not allowed.

Additional extension fields are available for some findings.

The data is available when you include the query parameter ?detailed_findings=true in the request.

The following fields are available for findings:

• external_id: The resource external ID related to the finding.
• description: The description and remediation steps for the finding.
• datadog_link: The Datadog relative link for the finding.
• ip_addresses: The list of private IP addresses for the resource related to the finding.

The response includes an array of finding objects, pagination metadata, and a count of items that match the query.

Each finding object contains the following:

• The finding ID that can be used in a GetFinding request to retrieve the full finding details.
• Core attributes, including status, evaluation, high-level resource details, muted state, and rule details.
• evaluation_changed_at and resource_discovery_date time stamps.
• An array of associated tags.

Provide a paginated version of listFindings returning a generator with all the items.

List historical jobs.

Get a list of indicators of compromise (IoCs) matching the specified filters.

Get rules for multiple rulesets in batch.

Get the sample log generation subscriptions for the organization. Sample log generation injects representative example logs for a given Cloud SIEM content pack into the Logs platform, which can be used to test detection rules without onboarding the underlying integration first.

Availability: this endpoint is restricted to Cloud SIEM trial organizations on an eligible pricing model. Other organizations receive a 403 Forbidden (non-trial orgs) or a 400 Bad Request (feature disabled), and legacy pricing tiers receive a response with status: not_available.

Get a list of security scanned assets metadata for an organization.

For the "List Vulnerabilities" endpoint, see the Pagination section.

For the "List Vulnerabilities" endpoint, see the Filtering section.

For the "List Vulnerabilities" endpoint, see the Metadata section.

This endpoint returns additional metadata for cloud resources that is not available from the standard resource endpoints. To access a richer dataset, call this endpoint together with the relevant resource endpoint(s) and merge (join) their results using the resource identifier.

Hosts

To enrich host data, join the response from the Hosts endpoint with the response from the scanned-assets-metadata endpoint on the following key fields:

Host Images

To enrich host image data, join the response from the Hosts endpoint with the response from the scanned-assets-metadata endpoint on the following key fields:

Container Images

To enrich container image data, join the response from the Container Images endpoint with the response from the scanned-assets-metadata endpoint on the following key fields:

Get the configured security filters at each historical version of the configuration. Each entry in the response represents the set of all security filters at a given version, ordered from the most recent version to the oldest.

Get the list of configured security filters with their definitions.

Get a list of security findings that match a search query. See the schema for security findings.

This endpoint uses the logs query syntax. Findings attributes (living in the attributes.attributes. namespace) are prefixed by @ when queried. Tags are queried without a prefix.

Example: @severity:(critical OR high) @status:open team:platform

Provide a paginated version of listSecurityFindings returning a generator with all the items.

Get the list of all critical assets.

List all Cloud SIEM datasets available to the organization, including both customer-defined datasets and Datadog out-of-the-box datasets.

List hist signals.

List the entity context sync configurations for Cloud SIEM. Each configuration connects Cloud SIEM to an external source that provides entities (for example, users from an identity provider) for use in signals and the entity explorer.

List rules.

The list endpoint returns security signals that match a search query. Both this endpoint and the POST endpoint can be used interchangeably when listing security signals.

Provide a paginated version of listSecurityMonitoringSignals returning a generator with all the items.

Get the list of all suppression rules.

Get the rulesets relevant for code generation for the authenticated user.

Get a list of vulnerabilities.

Pagination is enabled by default in both vulnerabilities and assets. The size of the page varies depending on the endpoint and cannot be modified. To automate the request of the next page, you can use the links section in the response.

This endpoint will return paginated responses. The pages are stored in the links section of the response:

{
  "data": [...],
  "meta": {...},
  "links": {
    "self": "https://.../api/v2/security/vulnerabilities",
    "first": "https://.../api/v2/security/vulnerabilities?page[number]=1&page[token]=abc",
    "last": "https://.../api/v2/security/vulnerabilities?page[number]=43&page[token]=abc",
    "next": "https://.../api/v2/security/vulnerabilities?page[number]=2&page[token]=abc"
  }
}

• links.previous is empty if the first page is requested.
• links.next is empty if the last page is requested.

Vulnerabilities can be created, updated or deleted at any point in time.

Upon the first request, a token is created to ensure consistency across subsequent paginated requests.

A token is valid only for 24 hours.

We consider a request to be the first request when there is no page[token] parameter.

The response of this first request contains the newly created token in the links section.

This token can then be used in the subsequent paginated requests.

Note: The first request may take longer to complete than subsequent requests.

Any request containing valid page[token] and page[number] parameters will be considered a subsequent request.

If the token is invalid, a 404 response will be returned.

If the page number is invalid, a 400 response will be returned.

The returned token is valid for all requests in the pagination sequence. To send paginated requests in parallel, reuse the same token and change only the page[number] parameter.

The request can include some filter parameters to filter the data to be retrieved. The format of the filter parameters follows the JSON:API format: filter[$prop_name], where prop_name is the property name in the entity being filtered by.

All filters can include multiple values, where data will be filtered with an OR clause: filter[title]=Title1,Title2 will filter all vulnerabilities where title is equal to Title1 OR Title2.

String filters are case sensitive.

Boolean filters accept true or false as values.

Number filters must include an operator as a second filter input: filter[$prop_name][$operator]. For example, for the vulnerabilities endpoint: filter[cvss.base.score][lte]=8.

Available operators are: eq (==), lt (<), lte (<=), gt (>) and gte (>=).

Following JSON:API format, object including non-standard meta-information.

This endpoint includes the meta member in the response. For more details on each of the properties included in this section, check the endpoints response tables.

{
  "data": [...],
  "meta": {
    "total": 1500,
    "count": 18732,
    "token": "some_token"
  },
  "links": {...}
}

Requests may include extensions to modify the behavior of the requested endpoint. The filter parameters follow the JSON:API format format: ext:$extension_name, where extension_name is the name of the modifier that is being applied.

Extensions can only include one value: ext:modifier=value.

Get a list of vulnerable assets.

Please review the Pagination section for the "List Vulnerabilities" endpoint.

Please review the Filtering section for the "List Vulnerabilities" endpoint.

Please review the Metadata section for the "List Vulnerabilities" endpoint.

Mute or unmute findings.

Mute or unmute security findings. You can mute or unmute up to 100 security findings per request. The request body must include is_muted and reason attributes. The allowed reasons depend on whether the finding is being muted or unmuted:

• To mute a finding: PENDING_FIX, FALSE_POSITIVE, OTHER, NO_FIX, DUPLICATE, RISK_ACCEPTED.
• To unmute a finding: NO_PENDING_FIX, HUMAN_ERROR, NO_LONGER_ACCEPTED_RISK, OTHER.

Partially update the notification rule. All fields are optional; if a field is not provided, it is not updated.

Partially update the notification rule. All fields are optional; if a field is not provided, it is not updated.

Run a historical job.

Get a list of security findings that match a search query. See the schema for security findings.

The API uses the logs query syntax. Findings attributes (living in the attributes.attributes. namespace) are prefixed by @ when queried. Tags are queried without a prefix.

Example: @severity:(critical OR high) @status:open team:platform

Provide a paginated version of searchSecurityFindings returning a generator with all the items.

Search hist signals.

Returns security signals that match a search query. Both this endpoint and the GET endpoint can be used interchangeably for listing security signals.

Provide a paginated version of searchSecurityMonitoringSignals returning a generator with all the items.

Test an existing rule.