For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/jen.gilbert/astro-base/ko/api/latest/security-monitoring/create-a-dataset.md. A documentation index is available at /llms.txt.
Language
Datadog site

데이터셋 생성하기

경고Note: This endpoint is in preview and is subject to change. If you have any feedback, contact Datadog support.
POSThttps://api.datadoghq.com/api/v2/security_monitoring/datasetshttps://api.us3.datadoghq.com/api/v2/security_monitoring/datasetshttps://api.us5.datadoghq.com/api/v2/security_monitoring/datasetshttps://api.datadoghq.eu/api/v2/security_monitoring/datasetshttps://api.ap1.datadoghq.com/api/v2/security_monitoring/datasetshttps://api.ap2.datadoghq.com/api/v2/security_monitoring/datasetshttps://api.uk1.datadoghq.com/api/v2/security_monitoring/datasetshttps://api.ddog-gov.com/api/v2/security_monitoring/datasetshttps://api.us2.ddog-gov.com/api/v2/security_monitoring/datasets

개요

새 Cloud SIEM 데이터 세트를 생성합니다. 데이터 세트는 데이터 소스, 일련의 인덱스, 그리고 탐지 규칙에서 참조할 수 있는 검색 쿼리를 번들로 묶습니다.

This endpoint requires any of the following permissions:

  • security_monitoring_rules_write
  • security_monitoring_dataset_write

OAuth apps require the security_monitoring_rules_write authorization scope to access this endpoint.

요청

Body Data (required)

항목
유형
설명
data [required]
object

Cloud SIEM 데이터 세트 생성을 위한 요청 본문입니다.

응답

Created

Response returned after creating a dataset.

항목
유형
설명
data [required]
object

The data wrapper of a dataset create response.

코드 예시

데이터셋 생성하기
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/datasets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "definition": {
        "columns": [
          {
            "column": "message",
            "type": "string"
          }
        ],
        "data_source": "logs",
        "indexes": [
          "main"
        ],
        "name": "sample_dataset",
        "search": {
          "query": "*"
        }
      },
      "description": "A sample dataset used for detection rules."
    },
    "type": "datasetCreate"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/datasets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "definition": {
        "columns": [
          {
            "column": "message",
            "type": "string"
          }
        ],
        "data_source": "logs",
        "indexes": [
          "main"
        ],
        "name": "sample_dataset",
        "search": {
          "query": "*"
        }
      },
      "description": "A sample dataset used for detection rules."
    },
    "type": "datasetCreate"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/datasets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "definition": {
        "columns": [
          {
            "column": "message",
            "type": "string"
          }
        ],
        "data_source": "logs",
        "indexes": [
          "main"
        ],
        "name": "sample_dataset",
        "search": {
          "query": "*"
        }
      },
      "description": "A sample dataset used for detection rules."
    },
    "type": "datasetCreate"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/datasets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "definition": {
        "columns": [
          {
            "column": "message",
            "type": "string"
          }
        ],
        "data_source": "logs",
        "indexes": [
          "main"
        ],
        "name": "sample_dataset",
        "search": {
          "query": "*"
        }
      },
      "description": "A sample dataset used for detection rules."
    },
    "type": "datasetCreate"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/datasets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "definition": {
        "columns": [
          {
            "column": "message",
            "type": "string"
          }
        ],
        "data_source": "logs",
        "indexes": [
          "main"
        ],
        "name": "sample_dataset",
        "search": {
          "query": "*"
        }
      },
      "description": "A sample dataset used for detection rules."
    },
    "type": "datasetCreate"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/datasets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "definition": {
        "columns": [
          {
            "column": "message",
            "type": "string"
          }
        ],
        "data_source": "logs",
        "indexes": [
          "main"
        ],
        "name": "sample_dataset",
        "search": {
          "query": "*"
        }
      },
      "description": "A sample dataset used for detection rules."
    },
    "type": "datasetCreate"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/datasets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "definition": {
        "columns": [
          {
            "column": "message",
            "type": "string"
          }
        ],
        "data_source": "logs",
        "indexes": [
          "main"
        ],
        "name": "sample_dataset",
        "search": {
          "query": "*"
        }
      },
      "description": "A sample dataset used for detection rules."
    },
    "type": "datasetCreate"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/datasets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "definition": {
        "columns": [
          {
            "column": "message",
            "type": "string"
          }
        ],
        "data_source": "logs",
        "indexes": [
          "main"
        ],
        "name": "sample_dataset",
        "search": {
          "query": "*"
        }
      },
      "description": "A sample dataset used for detection rules."
    },
    "type": "datasetCreate"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/datasets" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "definition": {
        "columns": [
          {
            "column": "message",
            "type": "string"
          }
        ],
        "data_source": "logs",
        "indexes": [
          "main"
        ],
        "name": "sample_dataset",
        "search": {
          "query": "*"
        }
      },
      "description": "A sample dataset used for detection rules."
    },
    "type": "datasetCreate"
  }
}
EOF