For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/cloud-network-monitoring/get-all-aggregated-dns-traffic.md. A documentation index is available at /llms.txt.
Language
Datadog site

Get all aggregated DNS traffic

GEThttps://api.datadoghq.com/api/v2/network/dns/aggregatehttps://api.us3.datadoghq.com/api/v2/network/dns/aggregatehttps://api.us5.datadoghq.com/api/v2/network/dns/aggregatehttps://api.datadoghq.eu/api/v2/network/dns/aggregatehttps://api.ap1.datadoghq.com/api/v2/network/dns/aggregatehttps://api.ap2.datadoghq.com/api/v2/network/dns/aggregatehttps://api.uk1.datadoghq.com/api/v2/network/dns/aggregatehttps://api.ddog-gov.com/api/v2/network/dns/aggregatehttps://api.us2.ddog-gov.com/api/v2/network/dns/aggregate

Overview

Get all aggregated DNS traffic.

This endpoint requires the network_connections_read permission.

OAuth apps require the network_connections_read authorization scope to access this endpoint.

Arguments

Query Strings

Name
Type
Description
from
integer

Unix timestamp (number of seconds since epoch) of the start of the query window. If not provided, the start of the query window is 15 minutes before the to timestamp. If neither from nor to are provided, the query window is [now - 15m, now].

to
integer

Unix timestamp (number of seconds since epoch) of the end of the query window. If not provided, the end of the query window is the current time. If neither from nor to are provided, the query window is [now - 15m, now].

group_by
string

Comma-separated list of fields to group DNS traffic by. The server side defaults to network.dns_query if unspecified. server_ungrouped may be used if groups are not desired. The maximum number of group_by(s) is 10.

tags
string

Comma-separated list of tags to filter DNS traffic by.

query
string

Free-form search query using AND/OR/NOT operators, wildcards, and parentheses. When provided, takes precedence over the tags parameter.

limit
integer

The number of aggregated DNS entries to be returned. The maximum value is 7500. The default is 100.

Default: 100

Response

OK

List of aggregated DNS flows.

Field
Type
Description
data
[object]

Array of aggregated DNS objects.

Code Example

Get all aggregated DNS traffic
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/network/dns/aggregate" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/network/dns/aggregate" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/network/dns/aggregate" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/network/dns/aggregate" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/network/dns/aggregate" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/network/dns/aggregate" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/network/dns/aggregate" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/network/dns/aggregate" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/network/dns/aggregate" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"