Convert a rule from JSON to Terraform
https://api.datadoghq.com/api/v2/security_monitoring/rules/converthttps://api.us3.datadoghq.com/api/v2/security_monitoring/rules/converthttps://api.us5.datadoghq.com/api/v2/security_monitoring/rules/converthttps://api.datadoghq.eu/api/v2/security_monitoring/rules/converthttps://api.ap1.datadoghq.com/api/v2/security_monitoring/rules/converthttps://api.ap2.datadoghq.com/api/v2/security_monitoring/rules/converthttps://api.uk1.datadoghq.com/api/v2/security_monitoring/rules/converthttps://api.ddog-gov.com/api/v2/security_monitoring/rules/converthttps://api.us2.ddog-gov.com/api/v2/security_monitoring/rules/convertOverview
Convert a rule that doesn't (yet) exist from JSON to Terraform for Datadog provider
resource datadog_security_monitoring_rule. You can do so for the following rule types:
- App and API Protection
- Cloud SIEM (log detection and signal correlation)
- Workload Protection
You can convert Cloud Security configuration rules using Terraform's Datadog Cloud Configuration Rule resource.
OAuth apps require the security_monitoring_rules_write authorization scope to access this endpoint.
Request
Body Data (required)
Option 1The payload of a rule.
calculatedFieldsCalculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.
expression [required]Expression.
name [required]Field name.
cases [required]Cases for generating signals.
actionsAction to perform for each rule case.
optionsOptions for the rule action
durationDuration of the action in seconds. 0 indicates no expiration.
flaggedIPTypeUsed with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses.
SUSPICIOUS, FLAGGEDuserBehaviorNameUsed with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
typeThe action type.
block_ip, block_user, user_behavior, flag_ipconditionA case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated
based on the event counts in the previously defined queries.
nameName of the case.
notificationsNotification targets.
status [required]Severity of the Security Signal.
info, low, medium, high, criticalcustomMessageCustom/Overridden message for generated signals (used in case of Default rule update).
customNameCustom/Overridden name of the rule (used in case of Default rule update).
filtersAdditional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
actionThe type of filtering action.
require, suppressqueryQuery for selecting logs to apply the filtering action.
groupSignalsByAdditional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
hasExtendedTitleWhether the notifications include the triggering group-by values in their title.
isEnabled [required]Whether the rule is enabled.
message [required]Message for generated signals.
name [required]The name of the rule.
options [required]Options.
anomalyDetectionOptionsOptions on anomaly detection method.
bucketDurationDuration in seconds of the time buckets used to aggregate events matched by the rule. Must be greater than or equal to 300.
300, 600, 900, 1800, 3600, 10800detectionToleranceAn optional parameter that sets how permissive anomaly detection is. Higher values require higher deviations before triggering a signal.
1, 2, 3, 4, 5instantaneousBaselineWhen set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDurationLearning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating.
1, 6, 12, 24, 48, 168, 336learningPeriodBaselineAn optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0.
complianceRuleOptionsOptions for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRuleWhether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
regoRuleRule details.
policy [required]The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/
resourceTypes [required]List of resource types that will be evaluated upon. Must have at least one element.
resourceTypeMain resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnvIf true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.
The severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.
The decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethodThe detection method.
threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party, anomaly_threshold, sequence_detectionevaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400hardcodedEvaluatorTypeHardcoded evaluator type.
log4shellimpossibleTravelOptionsOptions on impossible travel detection method.
baselineUserLocationsIf true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
baselineUserLocationsDurationThe duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations.
keepAliveOnce a signal is generated, the signal will remain "open" if a case is matched at least once within this keep alive window. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400maxSignalDurationA signal will "close" regardless of the query being matched once the time exceeds the maximum duration. This time is calculated from the first seen timestamp.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400newValueOptionsOptions on new value detection method.
forgetAfterThe duration in days after which a learned value is forgotten.
instantaneousBaselineWhen set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDurationThe duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
0learningMethodThe learning method used to determine when signals should be generated for values that weren't learned.
durationduration, thresholdlearningThresholdA number of occurrences after which signals will be generated for values that weren't learned.
00, 1sequenceDetectionOptionsOptions on sequence detection method.
stepTransitionsTransitions defining the allowed order of steps and their evaluation windows.
childName of the child step.
evaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400parentName of the parent step.
stepsSteps that define the conditions to be matched in sequence.
conditionCondition referencing rule queries (e.g., a > 0).
evaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400nameUnique name identifying the step.
thirdPartyRuleOptionsOptions on third party detection method.
defaultNotificationsNotification targets for the logs that do not correspond to any of the cases.
defaultStatusSeverity of the Security Signal.
info, low, medium, high, criticalrootQueriesQueries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
groupByFieldsFields to group by.
queryQuery to run on logs.
signalTitleTemplateA template for the signal title; if omitted, the title is generated based on the case name.
queries [required]Queries for selecting logs which are part of the rule.
aggregationThe aggregation type.
count, cardinality, sum, max, new_value, geo_data, event_count, nonecustomQueryExtensionQuery extension to append to the logs query.
dataSourceSource of events, either logs, audit trail, security signals, or Datadog events. app_sec_spans is deprecated in favor of spans.
logslogs, audit, app_sec_spans, spans, security_runtime, network, events, security_signalsdatasetIdsIDs of the datasets queried by the rule. Only used when queryLanguage is sql.
datasetVersionsVersion of each dataset used by the rule, keyed by dataset ID. Only used when queryLanguage is sql.
<any-key>Dataset version.
distinctFieldsField for which the cardinality is measured. Sent as an array.
groupByFieldsFields to group by.
hasOptionalGroupByFieldsWhen false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.
falseindexThis field is currently unstable and might be removed in a minor version upgrade.
The index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.
indexesList of indexes to query when the dataSource is logs. Only used for scheduled rules, such as when the schedulingOptions field is present in the rule payload.
metricDEPRECATED (Deprecated) The target field to aggregate over when using the sum or max
aggregations. metrics field should be used instead.
metricsGroup of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
nameName of the query.
queryQuery to run on logs.
queryLanguageLanguage of the query. Use sql for SQL-based rules over datasets. Defaults to event_query.
referenceTablesReference tables for the rule.
checkPresenceWhether to include or exclude the matched values.
columnNameThe name of the column in the reference table.
logFieldPathThe field in the log to match against the reference table.
ruleQueryNameThe name of the query to apply the reference table to.
tableNameThe name of the reference table.
schedulingOptionsOptions for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
startStart date for the schedule, in ISO 8601 format without timezone.
tagsTags for generated signals.
thirdPartyCasesCases for generating signals from third-party rules. Only available for third-party rules.
nameName of the case.
notificationsNotification targets for each case.
queryA query to map a third party event to this case.
status [required]Severity of the Security Signal.
info, low, medium, high, criticaltypeThe rule type.
api_security, application_security, log_detection, workload_activity, workload_securityOption 2The payload of a signal correlation rule.
cases [required]Cases for generating signals.
actionsAction to perform for each rule case.
optionsOptions for the rule action
durationDuration of the action in seconds. 0 indicates no expiration.
flaggedIPTypeUsed with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses.
SUSPICIOUS, FLAGGEDuserBehaviorNameUsed with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
typeThe action type.
block_ip, block_user, user_behavior, flag_ipconditionA case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated
based on the event counts in the previously defined queries.
nameName of the case.
notificationsNotification targets.
status [required]Severity of the Security Signal.
info, low, medium, high, criticalcustomMessageCustom/Overridden message for generated signals (used in case of Default rule update).
customNameCustom/Overridden name of the rule (used in case of Default rule update).
filtersAdditional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
actionThe type of filtering action.
require, suppressqueryQuery for selecting logs to apply the filtering action.
hasExtendedTitleWhether the notifications include the triggering group-by values in their title.
isEnabled [required]Whether the rule is enabled.
message [required]Message for generated signals.
name [required]The name of the rule.
options [required]Options.
anomalyDetectionOptionsOptions on anomaly detection method.
bucketDurationDuration in seconds of the time buckets used to aggregate events matched by the rule. Must be greater than or equal to 300.
300, 600, 900, 1800, 3600, 10800detectionToleranceAn optional parameter that sets how permissive anomaly detection is. Higher values require higher deviations before triggering a signal.
1, 2, 3, 4, 5instantaneousBaselineWhen set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDurationLearning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating.
1, 6, 12, 24, 48, 168, 336learningPeriodBaselineAn optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0.
complianceRuleOptionsOptions for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRuleWhether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
regoRuleRule details.
policy [required]The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/
resourceTypes [required]List of resource types that will be evaluated upon. Must have at least one element.
resourceTypeMain resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnvIf true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.
The severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.
The decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethodThe detection method.
threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party, anomaly_threshold, sequence_detectionevaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400hardcodedEvaluatorTypeHardcoded evaluator type.
log4shellimpossibleTravelOptionsOptions on impossible travel detection method.
baselineUserLocationsIf true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
baselineUserLocationsDurationThe duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations.
keepAliveOnce a signal is generated, the signal will remain "open" if a case is matched at least once within this keep alive window. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400maxSignalDurationA signal will "close" regardless of the query being matched once the time exceeds the maximum duration. This time is calculated from the first seen timestamp.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400newValueOptionsOptions on new value detection method.
forgetAfterThe duration in days after which a learned value is forgotten.
instantaneousBaselineWhen set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDurationThe duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
0learningMethodThe learning method used to determine when signals should be generated for values that weren't learned.
durationduration, thresholdlearningThresholdA number of occurrences after which signals will be generated for values that weren't learned.
00, 1sequenceDetectionOptionsOptions on sequence detection method.
stepTransitionsTransitions defining the allowed order of steps and their evaluation windows.
childName of the child step.
evaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400parentName of the parent step.
stepsSteps that define the conditions to be matched in sequence.
conditionCondition referencing rule queries (e.g., a > 0).
evaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400nameUnique name identifying the step.
thirdPartyRuleOptionsOptions on third party detection method.
defaultNotificationsNotification targets for the logs that do not correspond to any of the cases.
defaultStatusSeverity of the Security Signal.
info, low, medium, high, criticalrootQueriesQueries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
groupByFieldsFields to group by.
queryQuery to run on logs.
signalTitleTemplateA template for the signal title; if omitted, the title is generated based on the case name.
queries [required]Queries for selecting signals which are part of the rule.
aggregationThe aggregation type.
count, cardinality, sum, max, new_value, geo_data, event_count, nonecorrelatedByFieldsFields to group by.
correlatedQueryIndexIndex of the rule query used to retrieve the correlated field.
metricsGroup of target fields to aggregate over.
nameName of the query.
ruleId [required]Rule ID to match on signals.
tagsTags for generated signals.
typeThe rule type.
signal_correlation{
"calculatedFields": [
{
"expression": "@request_end_timestamp - @request_start_timestamp",
"name": "response_time"
}
],
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"filters": [],
"groupSignalsBy": [
"service"
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule.",
"name": "My security monitoring rule.",
"options": {
"anomalyDetectionOptions": {
"bucketDuration": 300,
"detectionTolerance": 5,
"instantaneousBaseline": false
},
"complianceRuleOptions": {
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}",
"resourceTypes": [
"gcp_iam_service_account",
"gcp_iam_policy"
]
},
"resourceType": "aws_acm"
},
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 900,
"hardcodedEvaluatorType": "log4shell",
"impossibleTravelOptions": {
"baselineUserLocations": true,
"baselineUserLocationsDuration": 7
},
"keepAlive": 3600,
"maxSignalDuration": 86400,
"newValueOptions": {
"instantaneousBaseline": false,
"learningMethod": "duration"
},
"thirdPartyRuleOptions": {
"defaultStatus": "critical",
"rootQueries": [
{
"query": "source:cloudtrail"
}
]
}
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [],
"query": "source:cloudtrail"
}
],
"schedulingOptions": {
"rrule": "FREQ=HOURLY;INTERVAL=1;",
"start": "2025-07-14T12:00:00",
"timezone": "America/New_York"
},
"tags": [
"env:prod",
"team:security"
],
"thirdPartyCases": [],
"type": "log_detection"
}Response
OK
Result of the convert rule request containing Terraform content.
ruleIdthe ID of the rule.
terraformContentTerraform string as a result of converting the rule from JSON.
{
"ruleId": "string",
"terraformContent": "string"
}Bad Request
API error response.
errors [required]A list of errors.
{
"errors": [
"Bad Request"
]
}Concurrent Modification
API error response.
errors [required]A list of errors.
{
"errors": [
"Bad Request"
]
}Not Authorized
API error response.
errors [required]A list of errors.
{
"errors": [
"Bad Request"
]
}Not Found
API error response.
errors [required]A list of errors.
{
"errors": [
"Bad Request"
]
}Too many requests
API error response.
errors [required]A list of errors.
{
"errors": [
"Bad Request"
]
}Code Example
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/convert" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"calculatedFields": [
{
"expression": "@request_end_timestamp - @request_start_timestamp",
"name": "response_time"
}
],
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"filters": [],
"groupSignalsBy": [
"service"
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule.",
"name": "My security monitoring rule.",
"options": {
"anomalyDetectionOptions": {
"bucketDuration": 300,
"detectionTolerance": 5,
"instantaneousBaseline": false
},
"complianceRuleOptions": {
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}",
"resourceTypes": [
"gcp_iam_service_account",
"gcp_iam_policy"
]
},
"resourceType": "aws_acm"
},
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 900,
"hardcodedEvaluatorType": "log4shell",
"impossibleTravelOptions": {
"baselineUserLocations": true,
"baselineUserLocationsDuration": 7
},
"keepAlive": 3600,
"maxSignalDuration": 86400,
"newValueOptions": {
"instantaneousBaseline": false,
"learningMethod": "duration"
},
"thirdPartyRuleOptions": {
"defaultStatus": "critical",
"rootQueries": [
{
"query": "source:cloudtrail"
}
]
}
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [],
"query": "source:cloudtrail"
}
],
"schedulingOptions": {
"rrule": "FREQ=HOURLY;INTERVAL=1;",
"start": "2025-07-14T12:00:00",
"timezone": "America/New_York"
},
"tags": [
"env:prod",
"team:security"
],
"thirdPartyCases": [],
"type": "log_detection"
}
EOF# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/convert" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"calculatedFields": [
{
"expression": "@request_end_timestamp - @request_start_timestamp",
"name": "response_time"
}
],
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"filters": [],
"groupSignalsBy": [
"service"
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule.",
"name": "My security monitoring rule.",
"options": {
"anomalyDetectionOptions": {
"bucketDuration": 300,
"detectionTolerance": 5,
"instantaneousBaseline": false
},
"complianceRuleOptions": {
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}",
"resourceTypes": [
"gcp_iam_service_account",
"gcp_iam_policy"
]
},
"resourceType": "aws_acm"
},
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 900,
"hardcodedEvaluatorType": "log4shell",
"impossibleTravelOptions": {
"baselineUserLocations": true,
"baselineUserLocationsDuration": 7
},
"keepAlive": 3600,
"maxSignalDuration": 86400,
"newValueOptions": {
"instantaneousBaseline": false,
"learningMethod": "duration"
},
"thirdPartyRuleOptions": {
"defaultStatus": "critical",
"rootQueries": [
{
"query": "source:cloudtrail"
}
]
}
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [],
"query": "source:cloudtrail"
}
],
"schedulingOptions": {
"rrule": "FREQ=HOURLY;INTERVAL=1;",
"start": "2025-07-14T12:00:00",
"timezone": "America/New_York"
},
"tags": [
"env:prod",
"team:security"
],
"thirdPartyCases": [],
"type": "log_detection"
}
EOF# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/convert" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"calculatedFields": [
{
"expression": "@request_end_timestamp - @request_start_timestamp",
"name": "response_time"
}
],
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"filters": [],
"groupSignalsBy": [
"service"
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule.",
"name": "My security monitoring rule.",
"options": {
"anomalyDetectionOptions": {
"bucketDuration": 300,
"detectionTolerance": 5,
"instantaneousBaseline": false
},
"complianceRuleOptions": {
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}",
"resourceTypes": [
"gcp_iam_service_account",
"gcp_iam_policy"
]
},
"resourceType": "aws_acm"
},
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 900,
"hardcodedEvaluatorType": "log4shell",
"impossibleTravelOptions": {
"baselineUserLocations": true,
"baselineUserLocationsDuration": 7
},
"keepAlive": 3600,
"maxSignalDuration": 86400,
"newValueOptions": {
"instantaneousBaseline": false,
"learningMethod": "duration"
},
"thirdPartyRuleOptions": {
"defaultStatus": "critical",
"rootQueries": [
{
"query": "source:cloudtrail"
}
]
}
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [],
"query": "source:cloudtrail"
}
],
"schedulingOptions": {
"rrule": "FREQ=HOURLY;INTERVAL=1;",
"start": "2025-07-14T12:00:00",
"timezone": "America/New_York"
},
"tags": [
"env:prod",
"team:security"
],
"thirdPartyCases": [],
"type": "log_detection"
}
EOF# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/convert" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"calculatedFields": [
{
"expression": "@request_end_timestamp - @request_start_timestamp",
"name": "response_time"
}
],
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"filters": [],
"groupSignalsBy": [
"service"
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule.",
"name": "My security monitoring rule.",
"options": {
"anomalyDetectionOptions": {
"bucketDuration": 300,
"detectionTolerance": 5,
"instantaneousBaseline": false
},
"complianceRuleOptions": {
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}",
"resourceTypes": [
"gcp_iam_service_account",
"gcp_iam_policy"
]
},
"resourceType": "aws_acm"
},
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 900,
"hardcodedEvaluatorType": "log4shell",
"impossibleTravelOptions": {
"baselineUserLocations": true,
"baselineUserLocationsDuration": 7
},
"keepAlive": 3600,
"maxSignalDuration": 86400,
"newValueOptions": {
"instantaneousBaseline": false,
"learningMethod": "duration"
},
"thirdPartyRuleOptions": {
"defaultStatus": "critical",
"rootQueries": [
{
"query": "source:cloudtrail"
}
]
}
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [],
"query": "source:cloudtrail"
}
],
"schedulingOptions": {
"rrule": "FREQ=HOURLY;INTERVAL=1;",
"start": "2025-07-14T12:00:00",
"timezone": "America/New_York"
},
"tags": [
"env:prod",
"team:security"
],
"thirdPartyCases": [],
"type": "log_detection"
}
EOF# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/convert" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"calculatedFields": [
{
"expression": "@request_end_timestamp - @request_start_timestamp",
"name": "response_time"
}
],
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"filters": [],
"groupSignalsBy": [
"service"
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule.",
"name": "My security monitoring rule.",
"options": {
"anomalyDetectionOptions": {
"bucketDuration": 300,
"detectionTolerance": 5,
"instantaneousBaseline": false
},
"complianceRuleOptions": {
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}",
"resourceTypes": [
"gcp_iam_service_account",
"gcp_iam_policy"
]
},
"resourceType": "aws_acm"
},
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 900,
"hardcodedEvaluatorType": "log4shell",
"impossibleTravelOptions": {
"baselineUserLocations": true,
"baselineUserLocationsDuration": 7
},
"keepAlive": 3600,
"maxSignalDuration": 86400,
"newValueOptions": {
"instantaneousBaseline": false,
"learningMethod": "duration"
},
"thirdPartyRuleOptions": {
"defaultStatus": "critical",
"rootQueries": [
{
"query": "source:cloudtrail"
}
]
}
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [],
"query": "source:cloudtrail"
}
],
"schedulingOptions": {
"rrule": "FREQ=HOURLY;INTERVAL=1;",
"start": "2025-07-14T12:00:00",
"timezone": "America/New_York"
},
"tags": [
"env:prod",
"team:security"
],
"thirdPartyCases": [],
"type": "log_detection"
}
EOF# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/convert" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"calculatedFields": [
{
"expression": "@request_end_timestamp - @request_start_timestamp",
"name": "response_time"
}
],
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"filters": [],
"groupSignalsBy": [
"service"
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule.",
"name": "My security monitoring rule.",
"options": {
"anomalyDetectionOptions": {
"bucketDuration": 300,
"detectionTolerance": 5,
"instantaneousBaseline": false
},
"complianceRuleOptions": {
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}",
"resourceTypes": [
"gcp_iam_service_account",
"gcp_iam_policy"
]
},
"resourceType": "aws_acm"
},
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 900,
"hardcodedEvaluatorType": "log4shell",
"impossibleTravelOptions": {
"baselineUserLocations": true,
"baselineUserLocationsDuration": 7
},
"keepAlive": 3600,
"maxSignalDuration": 86400,
"newValueOptions": {
"instantaneousBaseline": false,
"learningMethod": "duration"
},
"thirdPartyRuleOptions": {
"defaultStatus": "critical",
"rootQueries": [
{
"query": "source:cloudtrail"
}
]
}
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [],
"query": "source:cloudtrail"
}
],
"schedulingOptions": {
"rrule": "FREQ=HOURLY;INTERVAL=1;",
"start": "2025-07-14T12:00:00",
"timezone": "America/New_York"
},
"tags": [
"env:prod",
"team:security"
],
"thirdPartyCases": [],
"type": "log_detection"
}
EOF# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/convert" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"calculatedFields": [
{
"expression": "@request_end_timestamp - @request_start_timestamp",
"name": "response_time"
}
],
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"filters": [],
"groupSignalsBy": [
"service"
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule.",
"name": "My security monitoring rule.",
"options": {
"anomalyDetectionOptions": {
"bucketDuration": 300,
"detectionTolerance": 5,
"instantaneousBaseline": false
},
"complianceRuleOptions": {
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}",
"resourceTypes": [
"gcp_iam_service_account",
"gcp_iam_policy"
]
},
"resourceType": "aws_acm"
},
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 900,
"hardcodedEvaluatorType": "log4shell",
"impossibleTravelOptions": {
"baselineUserLocations": true,
"baselineUserLocationsDuration": 7
},
"keepAlive": 3600,
"maxSignalDuration": 86400,
"newValueOptions": {
"instantaneousBaseline": false,
"learningMethod": "duration"
},
"thirdPartyRuleOptions": {
"defaultStatus": "critical",
"rootQueries": [
{
"query": "source:cloudtrail"
}
]
}
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [],
"query": "source:cloudtrail"
}
],
"schedulingOptions": {
"rrule": "FREQ=HOURLY;INTERVAL=1;",
"start": "2025-07-14T12:00:00",
"timezone": "America/New_York"
},
"tags": [
"env:prod",
"team:security"
],
"thirdPartyCases": [],
"type": "log_detection"
}
EOF# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/convert" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"calculatedFields": [
{
"expression": "@request_end_timestamp - @request_start_timestamp",
"name": "response_time"
}
],
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"filters": [],
"groupSignalsBy": [
"service"
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule.",
"name": "My security monitoring rule.",
"options": {
"anomalyDetectionOptions": {
"bucketDuration": 300,
"detectionTolerance": 5,
"instantaneousBaseline": false
},
"complianceRuleOptions": {
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}",
"resourceTypes": [
"gcp_iam_service_account",
"gcp_iam_policy"
]
},
"resourceType": "aws_acm"
},
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 900,
"hardcodedEvaluatorType": "log4shell",
"impossibleTravelOptions": {
"baselineUserLocations": true,
"baselineUserLocationsDuration": 7
},
"keepAlive": 3600,
"maxSignalDuration": 86400,
"newValueOptions": {
"instantaneousBaseline": false,
"learningMethod": "duration"
},
"thirdPartyRuleOptions": {
"defaultStatus": "critical",
"rootQueries": [
{
"query": "source:cloudtrail"
}
]
}
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [],
"query": "source:cloudtrail"
}
],
"schedulingOptions": {
"rrule": "FREQ=HOURLY;INTERVAL=1;",
"start": "2025-07-14T12:00:00",
"timezone": "America/New_York"
},
"tags": [
"env:prod",
"team:security"
],
"thirdPartyCases": [],
"type": "log_detection"
}
EOF# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/convert" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"calculatedFields": [
{
"expression": "@request_end_timestamp - @request_start_timestamp",
"name": "response_time"
}
],
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"filters": [],
"groupSignalsBy": [
"service"
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule.",
"name": "My security monitoring rule.",
"options": {
"anomalyDetectionOptions": {
"bucketDuration": 300,
"detectionTolerance": 5,
"instantaneousBaseline": false
},
"complianceRuleOptions": {
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}",
"resourceTypes": [
"gcp_iam_service_account",
"gcp_iam_policy"
]
},
"resourceType": "aws_acm"
},
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 900,
"hardcodedEvaluatorType": "log4shell",
"impossibleTravelOptions": {
"baselineUserLocations": true,
"baselineUserLocationsDuration": 7
},
"keepAlive": 3600,
"maxSignalDuration": 86400,
"newValueOptions": {
"instantaneousBaseline": false,
"learningMethod": "duration"
},
"thirdPartyRuleOptions": {
"defaultStatus": "critical",
"rootQueries": [
{
"query": "source:cloudtrail"
}
]
}
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [],
"query": "source:cloudtrail"
}
],
"schedulingOptions": {
"rrule": "FREQ=HOURLY;INTERVAL=1;",
"start": "2025-07-14T12:00:00",
"timezone": "America/New_York"
},
"tags": [
"env:prod",
"team:security"
],
"thirdPartyCases": [],
"type": "log_detection"
}
EOF// Convert a rule from JSON to Terraform returns "OK" response
package main
import (
"context"
"encoding/json"
"fmt"
"os"
"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
)
func main() {
body := datadogV2.SecurityMonitoringRuleConvertPayload{
SecurityMonitoringStandardRulePayload: &datadogV2.SecurityMonitoringStandardRulePayload{
Name: "_49768568946de993",
Queries: []datadogV2.SecurityMonitoringStandardRuleQuery{
{
Query: datadog.PtrString("@test:true"),
Aggregation: datadogV2.SECURITYMONITORINGRULEQUERYAGGREGATION_COUNT.Ptr(),
GroupByFields: []string{},
DistinctFields: []string{},
Metric: datadog.PtrString(""),
},
},
Filters: []datadogV2.SecurityMonitoringFilter{},
Cases: []datadogV2.SecurityMonitoringRuleCaseCreate{
{
Name: datadog.PtrString(""),
Status: datadogV2.SECURITYMONITORINGRULESEVERITY_INFO,
Condition: datadog.PtrString("a > 0"),
Notifications: []string{},
},
},
Options: datadogV2.SecurityMonitoringRuleOptions{
EvaluationWindow: datadogV2.SECURITYMONITORINGRULEEVALUATIONWINDOW_FIFTEEN_MINUTES.Ptr(),
KeepAlive: datadogV2.SECURITYMONITORINGRULEKEEPALIVE_ONE_HOUR.Ptr(),
MaxSignalDuration: datadogV2.SECURITYMONITORINGRULEMAXSIGNALDURATION_ONE_DAY.Ptr(),
},
Message: "Test rule",
Tags: []string{},
IsEnabled: true,
Type: datadogV2.SECURITYMONITORINGRULETYPECREATE_LOG_DETECTION.Ptr(),
}}
ctx := datadog.NewDefaultContext(context.Background())
ctx = context.WithValue(ctx, datadog.ContextAccessToken, os.Getenv("DD_BEARER_TOKEN"))
configuration := datadog.NewConfiguration()
apiClient := datadog.NewAPIClient(configuration)
api := datadogV2.NewSecurityMonitoringApi(apiClient)
resp, r, err := api.ConvertSecurityMonitoringRuleFromJSONToTerraform(ctx, body)
if err != nil {
fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.ConvertSecurityMonitoringRuleFromJSONToTerraform`: %v\n", err)
fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
}
responseContent, _ := json.MarshalIndent(resp, "", " ")
fmt.Fprintf(os.Stdout, "Response from `SecurityMonitoringApi.ConvertSecurityMonitoringRuleFromJSONToTerraform`:\n%s\n", responseContent)
}
Instructions
First install the library and its dependencies and then save the example to main.go and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"// Convert a rule from JSON to Terraform returns "OK" response
import com.datadog.api.client.ApiClient;
import com.datadog.api.client.ApiException;
import com.datadog.api.client.v2.api.SecurityMonitoringApi;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleCaseCreate;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleConvertPayload;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleConvertResponse;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleEvaluationWindow;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleKeepAlive;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleMaxSignalDuration;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleOptions;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleQueryAggregation;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleSeverity;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleTypeCreate;
import com.datadog.api.client.v2.model.SecurityMonitoringStandardRulePayload;
import com.datadog.api.client.v2.model.SecurityMonitoringStandardRuleQuery;
import java.util.Collections;
public class Example {
public static void main(String[] args) {
ApiClient defaultClient = ApiClient.getDefaultApiClient();
defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN"));
SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient);
SecurityMonitoringRuleConvertPayload body =
new SecurityMonitoringRuleConvertPayload(
new SecurityMonitoringStandardRulePayload()
.name("_49768568946de993")
.queries(
Collections.singletonList(
new SecurityMonitoringStandardRuleQuery()
.query("@test:true")
.aggregation(SecurityMonitoringRuleQueryAggregation.COUNT)
.metric("")))
.cases(
Collections.singletonList(
new SecurityMonitoringRuleCaseCreate()
.name("")
.status(SecurityMonitoringRuleSeverity.INFO)
.condition("a > 0")))
.options(
new SecurityMonitoringRuleOptions()
.evaluationWindow(SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES)
.keepAlive(SecurityMonitoringRuleKeepAlive.ONE_HOUR)
.maxSignalDuration(SecurityMonitoringRuleMaxSignalDuration.ONE_DAY))
.message("Test rule")
.isEnabled(true)
.type(SecurityMonitoringRuleTypeCreate.LOG_DETECTION));
try {
SecurityMonitoringRuleConvertResponse result =
apiInstance.convertSecurityMonitoringRuleFromJSONToTerraform(body);
System.out.println(result);
} catch (ApiException e) {
System.err.println(
"Exception when calling"
+ " SecurityMonitoringApi#convertSecurityMonitoringRuleFromJSONToTerraform");
System.err.println("Status code: " + e.getCode());
System.err.println("Reason: " + e.getResponseBody());
System.err.println("Response headers: " + e.getResponseHeaders());
e.printStackTrace();
}
}
}
Instructions
First install the library and its dependencies and then save the example to Example.java and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java""""
Convert a rule from JSON to Terraform returns "OK" response
"""
from os import environ
from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
from datadog_api_client.v2.model.security_monitoring_rule_case_create import SecurityMonitoringRuleCaseCreate
from datadog_api_client.v2.model.security_monitoring_rule_evaluation_window import (
SecurityMonitoringRuleEvaluationWindow,
)
from datadog_api_client.v2.model.security_monitoring_rule_keep_alive import SecurityMonitoringRuleKeepAlive
from datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration import (
SecurityMonitoringRuleMaxSignalDuration,
)
from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions
from datadog_api_client.v2.model.security_monitoring_rule_query_aggregation import (
SecurityMonitoringRuleQueryAggregation,
)
from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity
from datadog_api_client.v2.model.security_monitoring_rule_type_create import SecurityMonitoringRuleTypeCreate
from datadog_api_client.v2.model.security_monitoring_standard_rule_payload import SecurityMonitoringStandardRulePayload
from datadog_api_client.v2.model.security_monitoring_standard_rule_query import SecurityMonitoringStandardRuleQuery
body = SecurityMonitoringStandardRulePayload(
name="_49768568946de993",
queries=[
SecurityMonitoringStandardRuleQuery(
query="@test:true",
aggregation=SecurityMonitoringRuleQueryAggregation.COUNT,
group_by_fields=[],
distinct_fields=[],
metric="",
),
],
filters=[],
cases=[
SecurityMonitoringRuleCaseCreate(
name="",
status=SecurityMonitoringRuleSeverity.INFO,
condition="a > 0",
notifications=[],
),
],
options=SecurityMonitoringRuleOptions(
evaluation_window=SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES,
keep_alive=SecurityMonitoringRuleKeepAlive.ONE_HOUR,
max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.ONE_DAY,
),
message="Test rule",
tags=[],
is_enabled=True,
type=SecurityMonitoringRuleTypeCreate.LOG_DETECTION,
)
configuration = Configuration()
configuration.access_token = environ["DD_BEARER_TOKEN"]
with ApiClient(configuration) as api_client:
api_instance = SecurityMonitoringApi(api_client)
response = api_instance.convert_security_monitoring_rule_from_json_to_terraform(body=body)
print(response)
Instructions
First install the library and its dependencies and then save the example to example.py and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"# Convert a rule from JSON to Terraform returns "OK" response
require "datadog_api_client"
DatadogAPIClient.configure do |config|
config.access_token = ENV["DD_BEARER_TOKEN"]
end
api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
body = DatadogAPIClient::V2::SecurityMonitoringStandardRulePayload.new({
name: "_49768568946de993",
queries: [
DatadogAPIClient::V2::SecurityMonitoringStandardRuleQuery.new({
query: "@test:true",
aggregation: DatadogAPIClient::V2::SecurityMonitoringRuleQueryAggregation::COUNT,
group_by_fields: [],
distinct_fields: [],
metric: "",
}),
],
filters: [],
cases: [
DatadogAPIClient::V2::SecurityMonitoringRuleCaseCreate.new({
name: "",
status: DatadogAPIClient::V2::SecurityMonitoringRuleSeverity::INFO,
condition: "a > 0",
notifications: [],
}),
],
options: DatadogAPIClient::V2::SecurityMonitoringRuleOptions.new({
evaluation_window: DatadogAPIClient::V2::SecurityMonitoringRuleEvaluationWindow::FIFTEEN_MINUTES,
keep_alive: DatadogAPIClient::V2::SecurityMonitoringRuleKeepAlive::ONE_HOUR,
max_signal_duration: DatadogAPIClient::V2::SecurityMonitoringRuleMaxSignalDuration::ONE_DAY,
}),
message: "Test rule",
tags: [],
is_enabled: true,
type: DatadogAPIClient::V2::SecurityMonitoringRuleTypeCreate::LOG_DETECTION,
})
p api_instance.convert_security_monitoring_rule_from_json_to_terraform(body)
Instructions
First install the library and its dependencies and then save the example to example.rb and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"// Convert a rule from JSON to Terraform returns "OK" response
use datadog_api_client::datadog;
use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleCaseCreate;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleConvertPayload;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleEvaluationWindow;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleKeepAlive;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleMaxSignalDuration;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleOptions;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleQueryAggregation;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleSeverity;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleTypeCreate;
use datadog_api_client::datadogV2::model::SecurityMonitoringStandardRulePayload;
use datadog_api_client::datadogV2::model::SecurityMonitoringStandardRuleQuery;
#[tokio::main]
async fn main() {
let body =
SecurityMonitoringRuleConvertPayload::SecurityMonitoringStandardRulePayload(Box::new(
SecurityMonitoringStandardRulePayload::new(
vec![
SecurityMonitoringRuleCaseCreate::new(SecurityMonitoringRuleSeverity::INFO)
.condition("a > 0".to_string())
.name("".to_string())
.notifications(vec![]),
],
true,
"Test rule".to_string(),
"_49768568946de993".to_string(),
SecurityMonitoringRuleOptions::new()
.evaluation_window(SecurityMonitoringRuleEvaluationWindow::FIFTEEN_MINUTES)
.keep_alive(SecurityMonitoringRuleKeepAlive::ONE_HOUR)
.max_signal_duration(SecurityMonitoringRuleMaxSignalDuration::ONE_DAY),
vec![SecurityMonitoringStandardRuleQuery::new()
.aggregation(SecurityMonitoringRuleQueryAggregation::COUNT)
.distinct_fields(vec![])
.group_by_fields(vec![])
.metric("".to_string())
.query("@test:true".to_string())],
)
.filters(vec![])
.tags(vec![])
.type_(SecurityMonitoringRuleTypeCreate::LOG_DETECTION),
));
let configuration = datadog::Configuration::new();
let api = SecurityMonitoringAPI::with_config(configuration);
let resp = api
.convert_security_monitoring_rule_from_json_to_terraform(body)
.await;
if let Ok(value) = resp {
println!("{:#?}", value);
} else {
println!("{:#?}", resp.unwrap_err());
}
}
Instructions
First install the library and its dependencies and then save the example to src/main.rs and run following commands:
DD_SITE="datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="us3.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="us5.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="datadoghq.eu" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="ap1.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="ap2.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="uk1.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="us2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo run/**
* Convert a rule from JSON to Terraform returns "OK" response
*/
import { client, v2 } from "@datadog/datadog-api-client";
const configuration = client.createConfiguration({
authMethods: {
AuthZ: {
accessToken: process.env.DD_BEARER_TOKEN as string,
},
},
});
const apiInstance = new v2.SecurityMonitoringApi(configuration);
const params: v2.SecurityMonitoringApiConvertSecurityMonitoringRuleFromJSONToTerraformRequest =
{
body: {
name: "_49768568946de993",
queries: [
{
query: "@test:true",
aggregation: "count",
groupByFields: [],
distinctFields: [],
metric: "",
},
],
filters: [],
cases: [
{
name: "",
status: "info",
condition: "a > 0",
notifications: [],
},
],
options: {
evaluationWindow: 900,
keepAlive: 3600,
maxSignalDuration: 86400,
},
message: "Test rule",
tags: [],
isEnabled: true,
type: "log_detection",
},
};
apiInstance
.convertSecurityMonitoringRuleFromJSONToTerraform(params)
.then((data: v2.SecurityMonitoringRuleConvertResponse) => {
console.log(
"API called successfully. Returned data: " + JSON.stringify(data)
);
})
.catch((error: any) => console.error(error));
Instructions
First install the library and its dependencies and then save the example to example.ts and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"