For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/jen.gilbert/astro-base/api/latest/security-monitoring/attach-security-findings-to-a-case.md. A documentation index is available at /llms.txt.
Language
Datadog site

Attach security findings to a case

PATCHhttps://api.datadoghq.com/api/v2/security/findings/cases/{case_id}https://api.us3.datadoghq.com/api/v2/security/findings/cases/{case_id}https://api.us5.datadoghq.com/api/v2/security/findings/cases/{case_id}https://api.datadoghq.eu/api/v2/security/findings/cases/{case_id}https://api.ap1.datadoghq.com/api/v2/security/findings/cases/{case_id}https://api.ap2.datadoghq.com/api/v2/security/findings/cases/{case_id}https://api.uk1.datadoghq.com/api/v2/security/findings/cases/{case_id}https://api.ddog-gov.com/api/v2/security/findings/cases/{case_id}https://api.us2.ddog-gov.com/api/v2/security/findings/cases/{case_id}

Overview

Attach security findings to a case. You can attach up to 50 security findings per case. Security findings that are already attached to another case will be detached from their previous case and attached to the specified case.

This endpoint requires any of the following permissions:

  • security_monitoring_findings_write
  • appsec_vm_write

Arguments

Path Parameters

Name
Type
Description
case_id [required]
string

Unique identifier of the case to attach security findings to

Request

Body Data (required)

Field
Type
Description
data
object

Data of the case to attach security findings to.

Response

OK

Case response.

Field
Type
Description
data
object

Data of the case.

Code Example

Attach security finding to a case returns "OK" response
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF
Attach security findings to a case returns "OK" response
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          },
          {
            "id": "MmUzMzZkODQ2YTI3NDU0OTk4NDk3NzhkOTY5YjU2Zjh-YWJjZGI1ODI4OTYzNWM3ZmUwZTBlOWRkYTRiMGUyOGQ=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          },
          {
            "id": "MmUzMzZkODQ2YTI3NDU0OTk4NDk3NzhkOTY5YjU2Zjh-YWJjZGI1ODI4OTYzNWM3ZmUwZTBlOWRkYTRiMGUyOGQ=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          },
          {
            "id": "MmUzMzZkODQ2YTI3NDU0OTk4NDk3NzhkOTY5YjU2Zjh-YWJjZGI1ODI4OTYzNWM3ZmUwZTBlOWRkYTRiMGUyOGQ=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          },
          {
            "id": "MmUzMzZkODQ2YTI3NDU0OTk4NDk3NzhkOTY5YjU2Zjh-YWJjZGI1ODI4OTYzNWM3ZmUwZTBlOWRkYTRiMGUyOGQ=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          },
          {
            "id": "MmUzMzZkODQ2YTI3NDU0OTk4NDk3NzhkOTY5YjU2Zjh-YWJjZGI1ODI4OTYzNWM3ZmUwZTBlOWRkYTRiMGUyOGQ=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          },
          {
            "id": "MmUzMzZkODQ2YTI3NDU0OTk4NDk3NzhkOTY5YjU2Zjh-YWJjZGI1ODI4OTYzNWM3ZmUwZTBlOWRkYTRiMGUyOGQ=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          },
          {
            "id": "MmUzMzZkODQ2YTI3NDU0OTk4NDk3NzhkOTY5YjU2Zjh-YWJjZGI1ODI4OTYzNWM3ZmUwZTBlOWRkYTRiMGUyOGQ=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          },
          {
            "id": "MmUzMzZkODQ2YTI3NDU0OTk4NDk3NzhkOTY5YjU2Zjh-YWJjZGI1ODI4OTYzNWM3ZmUwZTBlOWRkYTRiMGUyOGQ=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF
# Path parameters
export case_id="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/cases/${case_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "id": "7d16945b-baf8-411e-ab2a-20fe43af1ea3",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGZhMDI3ZjdjMDM3YjJmNzcxNTlhZGMwMjdmZWNiNTZ-MTVlYTNmYWU3NjNlOTNlYTE2YjM4N2JmZmI4Yjk5N2Y=",
            "type": "findings"
          },
          {
            "id": "MmUzMzZkODQ2YTI3NDU0OTk4NDk3NzhkOTY5YjU2Zjh-YWJjZGI1ODI4OTYzNWM3ZmUwZTBlOWRkYTRiMGUyOGQ=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "cases"
  }
}
EOF