For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/jen.gilbert/astro-base/ja/api/latest/security-monitoring/create-or-update-an-indicator-triage-state.md. A documentation index is available at /llms.txt.
Language
Datadog site

Create or update an indicator triage state

警告Note: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates.
POSThttps://api.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.us3.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.us5.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.datadoghq.eu/api/v2/security/siem/ioc-explorer/triagehttps://api.ap1.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.ap2.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.uk1.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.ddog-gov.com/api/v2/security/siem/ioc-explorer/triagehttps://api.us2.ddog-gov.com/api/v2/security/siem/ioc-explorer/triage

概要

Set the triage state of an indicator of compromise (IoC). This creates or updates the triage state for the indicator in your organization.

OAuth apps require the security_monitoring_signals_write authorization scope to access this endpoint.

リクエスト

Body Data (required)

The triage state to set for the indicator.

フィールド
タイプ
説明
data [required]
object

Data object for the triage write request.

応答

Created

Response for the create indicator triage state endpoint.

フィールド
タイプ
説明
data
object

Data object of the triage write response.

コード例

Create or update an indicator triage state returns "Created" response
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF