For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/security-monitoring/convert-a-job-result-to-a-signal.md. A documentation index is available at /llms.txt.
Language
Datadog site

Convert a job result to a signal

WARNINGNote: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates.
POSThttps://api.datadoghq.com/api/v2/siem-historical-detections/jobs/signal_converthttps://api.us3.datadoghq.com/api/v2/siem-historical-detections/jobs/signal_converthttps://api.us5.datadoghq.com/api/v2/siem-historical-detections/jobs/signal_converthttps://api.datadoghq.eu/api/v2/siem-historical-detections/jobs/signal_converthttps://api.ap1.datadoghq.com/api/v2/siem-historical-detections/jobs/signal_converthttps://api.ap2.datadoghq.com/api/v2/siem-historical-detections/jobs/signal_converthttps://api.uk1.datadoghq.com/api/v2/siem-historical-detections/jobs/signal_converthttps://api.ddog-gov.com/api/v2/siem-historical-detections/jobs/signal_converthttps://api.us2.ddog-gov.com/api/v2/siem-historical-detections/jobs/signal_convert

Overview

Convert a job result to a signal.

This endpoint requires the security_monitoring_signals_write permission.

Request

Body Data (required)

Field
Type
Description
data
object

Data for converting historical job results to signals.

Response

OK

Code Example

Convert a job result to a signal
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/siem-historical-detections/jobs/signal_convert" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "jobResultIds": [
        ""
      ],
      "notifications": [
        ""
      ],
      "signalMessage": "A large number of failed login attempts.",
      "signalSeverity": "critical"
    },
    "type": "historicalDetectionsJobResultSignalConversion"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/siem-historical-detections/jobs/signal_convert" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "jobResultIds": [
        ""
      ],
      "notifications": [
        ""
      ],
      "signalMessage": "A large number of failed login attempts.",
      "signalSeverity": "critical"
    },
    "type": "historicalDetectionsJobResultSignalConversion"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/siem-historical-detections/jobs/signal_convert" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "jobResultIds": [
        ""
      ],
      "notifications": [
        ""
      ],
      "signalMessage": "A large number of failed login attempts.",
      "signalSeverity": "critical"
    },
    "type": "historicalDetectionsJobResultSignalConversion"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/siem-historical-detections/jobs/signal_convert" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "jobResultIds": [
        ""
      ],
      "notifications": [
        ""
      ],
      "signalMessage": "A large number of failed login attempts.",
      "signalSeverity": "critical"
    },
    "type": "historicalDetectionsJobResultSignalConversion"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/siem-historical-detections/jobs/signal_convert" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "jobResultIds": [
        ""
      ],
      "notifications": [
        ""
      ],
      "signalMessage": "A large number of failed login attempts.",
      "signalSeverity": "critical"
    },
    "type": "historicalDetectionsJobResultSignalConversion"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/siem-historical-detections/jobs/signal_convert" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "jobResultIds": [
        ""
      ],
      "notifications": [
        ""
      ],
      "signalMessage": "A large number of failed login attempts.",
      "signalSeverity": "critical"
    },
    "type": "historicalDetectionsJobResultSignalConversion"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/siem-historical-detections/jobs/signal_convert" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "jobResultIds": [
        ""
      ],
      "notifications": [
        ""
      ],
      "signalMessage": "A large number of failed login attempts.",
      "signalSeverity": "critical"
    },
    "type": "historicalDetectionsJobResultSignalConversion"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/siem-historical-detections/jobs/signal_convert" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "jobResultIds": [
        ""
      ],
      "notifications": [
        ""
      ],
      "signalMessage": "A large number of failed login attempts.",
      "signalSeverity": "critical"
    },
    "type": "historicalDetectionsJobResultSignalConversion"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/siem-historical-detections/jobs/signal_convert" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "jobResultIds": [
        ""
      ],
      "notifications": [
        ""
      ],
      "signalMessage": "A large number of failed login attempts.",
      "signalSeverity": "critical"
    },
    "type": "historicalDetectionsJobResultSignalConversion"
  }
}
EOF