For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/jen.gilbert/astro-base/es/api/latest/security-monitoring/list-vulnerabilities.md. A documentation index is available at /llms.txt.
homeIniciodocsDocumentaciónapiAPI
Language
Datadog site

Lista de vulnerabilidades

ADVERTENCIANote: This endpoint is deprecated. See the List Security Findings endpoint.
GEThttps://api.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.us3.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.us5.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.datadoghq.eu/api/v2/security/vulnerabilitieshttps://api.ap1.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.ap2.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.uk1.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.ddog-gov.com/api/v2/security/vulnerabilitieshttps://api.us2.ddog-gov.com/api/v2/security/vulnerabilities

Descripción general

Obtén una lista de vulnerabilidades.

Paginación

La paginación está activada por defecto en ambos vulnerabilities y assets. El tamaño de la página varía según el endpoint y no puede modificarse. Para automatizar la solicitud de la próxima página, puedes usar la sección de enlaces en la respuesta.

Este endpoint devolverá las respuestas paginadas. Las páginas están almacenadas en la sección de enlaces de la respuesta:

{
  "data": [...],
  "meta": {...},
  "links": {
    "self": "https://.../api/v2/security/vulnerabilities",
    "first": "https://.../api/v2/security/vulnerabilities?page[number]=1&page[token]=abc",
    "last": "https://.../api/v2/security/vulnerabilities?page[number]=43&page[token]=abc",
    "next": "https://.../api/v2/security/vulnerabilities?page[number]=2&page[token]=abc"
  }
}
  • links.previous está vacío si se solicita la primera página.
  • links.next está vacío si se solicita la última página.

Token

Las vulnerabilidades se pueden crear, actualizar o eliminar en cualquier momento.

En la primera solicitud, se crea un token para asegurar la coherencia entre las solicitudes paginadas posteriores.

Un token es válido solo por 24 horas.

Primera solicitud

Consideramos una solicitud como la primera solicitud cuando no hay un parámetro page[token].

La respuesta de esta primera solicitud contiene el token recién creado en la sección links.

Este token luego puede utilizarse en las posteriores solicitudes paginadas.

Nota: La primera solicitud puede tardar más en completarse que las solicitudes posteriores.

Solicitudes posteriores

Cualquier solicitud que contenga parámetros page[token] y page[number] válidos se considerarán una solicitud posterior.

Si el token no es válido, se devolverá una respuesta 404.

Si la página number no es válida, se devolverá una respuesta 400.

El token devuelto es válido para todas las solicitudes en la secuencia de paginación. Para enviar solicitudes paginadas en paralelo, reutiliza el mismo token y cambia solo el parámetro page[number].

Filtrado

La solicitud puede incluir algunos parámetros de filtro para filtrar los datos a recuperar. El formato de los parámetros de filtro sigue el formato JSON:API: filter[$prop_name], donde prop_name es el nombre de propiedad en la entidad filtrada.

Todos los filtros pueden incluir múltiples valores, en los que los datos se filtrarán con una cláusula OR: filter[title]=Title1,Title2 filtrará todas las vulnerabilidades en las que el título es igual a Title1 OR Title2.

Los filtros de cadena distinguen mayúscula y minúscula.

Los filtros booleanos aceptan true o false como valores.

Los filtros de número deben incluir un operador como una segunda entrada de filtro: filter[$prop_name][$operator]. Por ejemplo, para el endpoint de vulnerabilidades: filter[cvss.base.score][lte]=8.

Los operadores disponibles son: eq (==), lt (<), lte (<=), gt (>) and gte (>=).

Metadatos

Sigue el formato JSON:API, objeto que incluye la metainformación no estándar.

Este endpoint incluye el miembro meta en la respuesta. Para obtener más detalles sobre cada una de las propiedades incluidas en esta sección, comprueba las tablas de respuesta de endpoints.

{
  "data": [...],
  "meta": {
    "total": 1500,
    "count": 18732,
    "token": "some_token"
  },
  "links": {...}
}

Extensiones

Las solicitudes pueden incluir extensiones para modificar el comportamiento del endpoint solicitado. Los parámetros de filtro siguen el formato JSON:API format: ext:$extension_name, donde extension_name es el nombre del modificador que se está aplicando.

Las extensiones solo pueden incluir un valor: ext:modifier=value.

This endpoint requires the appsec_vm_read permission.

Argumentos

Cadenas de consulta

Nombre
Type
Descripción
page[token]
string

Its value must come from the links section of the response of the first request. Do not manually edit it.

page[number]
integer

The page number to be retrieved. It should be equal or greater than 1

filter[type]
enum

Filter by vulnerability type.

Allowed enum values: AdminConsoleActive, CodeInjection, CommandInjection, ComponentWithKnownVulnerability, DangerousWorkflows, DefaultAppDeployed, DefaultHtmlEscapeInvalid, DirectoryListingLeak, EmailHtmlInjection, EndOfLife
Show 34 moreHardcodedPassword, HardcodedSecret, HeaderInjection, HstsHeaderMissing, InsecureAuthProtocol, InsecureCookie, InsecureJspLayout, LdapInjection, MaliciousPackage, MandatoryRemediation, NoHttpOnlyCookie, NoSameSiteCookie, NoSqlMongoDbInjection, PathTraversal, ReflectionInjection, RiskyLicense, SessionRewriting, SessionRewritting, SessionTimeout, SqlInjection, Ssrf, StackTraceLeak, TemplateInjection, TrustBoundaryViolation, Unmaintained, UntrustedDeserialization, UnvalidatedRedirect, VerbTampering, WeakCipher, WeakHash, WeakRandomness, XContentTypeHeaderMissing, XPathInjection, Xss
filter[cvss.base.score][`$op`]
number

Filter by vulnerability base (i.e. from the original advisory) severity score.

filter[cvss.base.severity]
enum

Filter by vulnerability base severity.

Allowed enum values: Unknown, None, Low, Medium, High, Critical
filter[cvss.base.vector]
string

Filter by vulnerability base CVSS vector.

filter[cvss.datadog.score][`$op`]
number

Filter by vulnerability Datadog severity score.

filter[cvss.datadog.severity]
enum

Filter by vulnerability Datadog severity.

Allowed enum values: Unknown, None, Low, Medium, High, Critical
filter[cvss.datadog.vector]
string

Filter by vulnerability Datadog CVSS vector.

filter[status]
enum

Filter by the status of the vulnerability.

Allowed enum values: Open, Muted, Remediated, InProgress, AutoClosed
filter[tool]
enum

Filter by the tool of the vulnerability.

Allowed enum values: IAST, SCA, Infra, SAST
filter[library.name]
string

Filter by library name.

filter[library.version]
string

Filter by library version.

filter[advisory.id]
string

Filter by advisory ID.

filter[risks.exploitation_probability]
boolean

Filter by exploitation probability.

filter[risks.poc_exploit_available]
boolean

Filter by POC exploit availability.

filter[risks.exploit_available]
boolean

Filter by public exploit availability.

filter[risks.epss.score][`$op`]
number

Filter by vulnerability EPSS severity score.

filter[risks.epss.severity]
enum

Filter by vulnerability EPSS severity.

Allowed enum values: Unknown, None, Low, Medium, High, Critical
filter[language]
string

Filter by language.

filter[ecosystem]
enum

Filter by ecosystem.

Allowed enum values: PyPI, Maven, NuGet, Npm, RubyGems, Go, Packagist, Deb, Rpm, Apk
Show 6 moreWindows, Generic, MacOs, Oci, BottleRocket, None
filter[code_location.location]
string

Filter by vulnerability location.

filter[code_location.file_path]
string

Filter by vulnerability file path.

filter[code_location.method]
string

Filter by method.

filter[fix_available]
boolean

Filter by fix availability.

filter[repo_digests]
string

Filter by vulnerability repo_digest (when the vulnerability is related to Image asset).

filter[origin]
string

Filter by origin.

filter[running_kernel]
boolean

Filter for whether the vulnerability affects a running kernel (for vulnerabilities related to a Host asset).

filter[asset.name]
string

Filter by asset name. This field supports the usage of wildcards (*).

filter[asset.type]
enum

Filter by asset type.

Allowed enum values: Repository, Service, Host, HostImage, Image, ServerlessFunction
filter[asset.version.first]
string

Filter by the first version of the asset this vulnerability has been detected on.

filter[asset.version.last]
string

Filter by the last version of the asset this vulnerability has been detected on.

filter[asset.repository_url]
string

Filter by the repository url associated to the asset.

filter[asset.risks.in_production]
boolean

Filter whether the asset is in production or not.

filter[asset.risks.under_attack]
boolean

Filter whether the asset is under attack or not.

filter[asset.risks.is_publicly_accessible]
boolean

Filter whether the asset is publicly accessible or not.

filter[asset.risks.has_privileged_access]
boolean

Filter whether the asset is publicly accessible or not.

filter[asset.risks.has_access_to_sensitive_data]
boolean

Filter whether the asset has access to sensitive data or not.

filter[asset.environments]
string

Filter by asset environments.

filter[asset.teams]
string

Filter by asset teams.

filter[asset.arch]
string

Filter by asset architecture.

filter[asset.operating_system.name]
string

Filter by asset operating system name.

filter[asset.operating_system.version]
string

Filter by asset operating system version.

Respuesta

OK

The expected response schema when listing vulnerabilities.

Campo
Type
Descripción
data [required]
[object]

List of vulnerabilities.

links
object

The JSON:API links related to pagination.

meta
object

The metadata related to this request.

Ejemplo de código

Lista de vulnerabilidades
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"