For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/jen.gilbert/astro-base/fr/api/latest/security-monitoring/create-or-update-an-indicator-triage-state.md. A documentation index is available at /llms.txt.
Language
Datadog site

Create or update an indicator triage state

WARNINGNote: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates.
POSThttps://api.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.us3.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.us5.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.datadoghq.eu/api/v2/security/siem/ioc-explorer/triagehttps://api.ap1.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.ap2.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.uk1.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.ddog-gov.com/api/v2/security/siem/ioc-explorer/triagehttps://api.us2.ddog-gov.com/api/v2/security/siem/ioc-explorer/triage

Présentation

Set the triage state of an indicator of compromise (IoC). This creates or updates the triage state for the indicator in your organization.

OAuth apps require the security_monitoring_signals_write authorization scope to access this endpoint.

Requête

Body Data (required)

The triage state to set for the indicator.

Champ
Type
Description
data [required]
object

Data object for the triage write request.

Réponse

Created

Response for the create indicator triage state endpoint.

Champ
Type
Description
data
object

Data object of the triage write response.

Exemple de code

Create or update an indicator triage state returns "Created" response
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF