Create a batch migration
https://api.datadoghq.com/api/v2/security_monitoring/batch-migrationshttps://api.us3.datadoghq.com/api/v2/security_monitoring/batch-migrationshttps://api.us5.datadoghq.com/api/v2/security_monitoring/batch-migrationshttps://api.datadoghq.eu/api/v2/security_monitoring/batch-migrationshttps://api.ap1.datadoghq.com/api/v2/security_monitoring/batch-migrationshttps://api.ap2.datadoghq.com/api/v2/security_monitoring/batch-migrationshttps://api.uk1.datadoghq.com/api/v2/security_monitoring/batch-migrationshttps://api.ddog-gov.com/api/v2/security_monitoring/batch-migrationshttps://api.us2.ddog-gov.com/api/v2/security_monitoring/batch-migrationsOverview
Create a batch migration in the draft status, together with 1 to 100 initial
resources. Each resource holds one source rule to translate into a Cloud SIEM detection
rule. To load more rules, add them with the add resources endpoint before starting the
batch migration. A batch migration can hold up to 1000 resources. The response does not
include the created resources: list the resources of the batch migration to retrieve them.
OAuth apps require the security_monitoring_rules_write authorization scope to access this endpoint.
Request
Body Data (required)
data [required]Data of the batch migration to create.
attributes [required]Attributes of the batch migration to create.
descriptionThe description of the batch migration.
nameThe name of the batch migration.
resources [required]The initial resources of the batch migration. From 1 to 100 resources.
descriptionThe description of the resource.
input [required]The source query or natural language description to translate. Must not be blank.
inputType [required]The type of the source rule: spl for a Splunk SPL search or saved search definition,
natural_language for a plain-English description of the behavior to detect, or kql
for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded.
natural_language, spl, kqlnameThe name of the resource.
tagsTags of the batch migration. Up to 50 tags, each up to 256 characters.
type [required]The type of resource for a batch migration.
batchMigration{
"data": {
"type": "batchMigration",
"attributes": {
"name": "Example-Security-Monitoring",
"description": "Rules imported from Splunk",
"tags": [
"source:splunk"
],
"resources": [
{
"name": "Repeated Windows login failures",
"description": "Detects repeated failed Windows authentication attempts.",
"inputType": "spl",
"input": "index=wineventlog EventCode=4625"
}
]
}
}
}Response
Created
Response containing a batch migration.
data [required]A batch migration.
attributes [required]Attributes of a batch migration.
createdAt [required]The creation date of the batch migration, in RFC 3339 format.
createdByThe UUID of the user or service account who created the batch migration.
descriptionThe description of the batch migration.
inputSource [required]The origin of a batch migration. Always batch_migration for batch migrations
created through this API.
batch_migration, threat_hunting, userlastUpdatedAt [required]The last update date of the batch migration, in RFC 3339 format.
lastUpdatedByThe UUID of the user or service account who last updated the batch migration, or the name of a system actor.
name [required]The name of the batch migration.
orgId [required]The ID of the organization that owns the batch migration.
resourceStatusCounts [required]The number of resources of a batch migration in each status.
canceled [required]Number of resources whose translation was canceled.
completed [required]Number of resources translated and ready to be published.
duplicate [required]Number of resources identified as duplicates of an existing rule. Reserved for future use.
failed [required]Number of resources whose translation failed.
inProgress [required]Number of resources being translated.
pending [required]Number of resources waiting to be translated.
published [required]Number of resources published as Cloud SIEM detection rules.
publishing [required]Number of resources being published.
status [required]The status of a batch migration. A batch migration is created as draft and moves to
in_progress when started. It moves to completed once no resource is pending or
in_progress, or to canceled when canceled.
draft, in_progress, canceled, completedtags [required]Tags of the batch migration. Up to 50 tags, each up to 256 characters.
id [required]The UUID of the batch migration.
type [required]The type of resource for a batch migration.
batchMigration{
"data": {
"attributes": {
"createdAt": "2026-09-21T12:00:00Z",
"createdBy": "3653d3c6-0c75-11ea-ad28-fb5701eabc7d",
"description": "Rules imported from Splunk",
"inputSource": "batch_migration",
"lastUpdatedAt": "2026-09-21T12:00:00Z",
"lastUpdatedBy": "3653d3c6-0c75-11ea-ad28-fb5701eabc7d",
"name": "Splunk migration",
"orgId": 123456,
"resourceStatusCounts": {
"canceled": 0,
"completed": 0,
"duplicate": 0,
"failed": 0,
"inProgress": 0,
"pending": 1,
"published": 0,
"publishing": 0
},
"status": "draft",
"tags": [
"source:splunk"
]
},
"id": "7cdb3a75-64fb-46ce-9445-41969e78fe8e",
"type": "batchMigration"
}
}Bad Request
API error response.
errors [required]A list of errors.
detailA human-readable explanation specific to this occurrence of the error.
metaNon-standard meta-information about the error
sourceReferences to the source of the error.
headerA string indicating the name of a single request header which caused the error.
parameterA string indicating which URI query parameter caused the error.
pointerA JSON pointer to the value in the request document that caused the error.
statusStatus code of the response.
titleShort human-readable summary of the error.
{
"errors": [
{
"detail": "Missing required attribute in body",
"meta": {},
"source": {
"header": "Authorization",
"parameter": "limit",
"pointer": "/data/attributes/title"
},
"status": "400",
"title": "Bad Request"
}
]
}Unauthorized
API error response.
errors [required]A list of errors.
detailA human-readable explanation specific to this occurrence of the error.
metaNon-standard meta-information about the error
sourceReferences to the source of the error.
headerA string indicating the name of a single request header which caused the error.
parameterA string indicating which URI query parameter caused the error.
pointerA JSON pointer to the value in the request document that caused the error.
statusStatus code of the response.
titleShort human-readable summary of the error.
{
"errors": [
{
"detail": "Missing required attribute in body",
"meta": {},
"source": {
"header": "Authorization",
"parameter": "limit",
"pointer": "/data/attributes/title"
},
"status": "400",
"title": "Bad Request"
}
]
}Forbidden
API error response.
errors [required]A list of errors.
detailA human-readable explanation specific to this occurrence of the error.
metaNon-standard meta-information about the error
sourceReferences to the source of the error.
headerA string indicating the name of a single request header which caused the error.
parameterA string indicating which URI query parameter caused the error.
pointerA JSON pointer to the value in the request document that caused the error.
statusStatus code of the response.
titleShort human-readable summary of the error.
{
"errors": [
{
"detail": "Missing required attribute in body",
"meta": {},
"source": {
"header": "Authorization",
"parameter": "limit",
"pointer": "/data/attributes/title"
},
"status": "400",
"title": "Bad Request"
}
]
}Too many requests
API error response.
errors [required]A list of errors.
{
"errors": [
"Bad Request"
]
}Code Example
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"type": "batchMigration",
"attributes": {
"name": "Example-Security-Monitoring",
"description": "Rules imported from Splunk",
"tags": [
"source:splunk"
],
"resources": [
{
"name": "Repeated Windows login failures",
"description": "Detects repeated failed Windows authentication attempts.",
"inputType": "spl",
"input": "index=wineventlog EventCode=4625"
}
]
}
}
}
EOF# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"type": "batchMigration",
"attributes": {
"name": "Example-Security-Monitoring",
"description": "Rules imported from Splunk",
"tags": [
"source:splunk"
],
"resources": [
{
"name": "Repeated Windows login failures",
"description": "Detects repeated failed Windows authentication attempts.",
"inputType": "spl",
"input": "index=wineventlog EventCode=4625"
}
]
}
}
}
EOF# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"type": "batchMigration",
"attributes": {
"name": "Example-Security-Monitoring",
"description": "Rules imported from Splunk",
"tags": [
"source:splunk"
],
"resources": [
{
"name": "Repeated Windows login failures",
"description": "Detects repeated failed Windows authentication attempts.",
"inputType": "spl",
"input": "index=wineventlog EventCode=4625"
}
]
}
}
}
EOF# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"type": "batchMigration",
"attributes": {
"name": "Example-Security-Monitoring",
"description": "Rules imported from Splunk",
"tags": [
"source:splunk"
],
"resources": [
{
"name": "Repeated Windows login failures",
"description": "Detects repeated failed Windows authentication attempts.",
"inputType": "spl",
"input": "index=wineventlog EventCode=4625"
}
]
}
}
}
EOF# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"type": "batchMigration",
"attributes": {
"name": "Example-Security-Monitoring",
"description": "Rules imported from Splunk",
"tags": [
"source:splunk"
],
"resources": [
{
"name": "Repeated Windows login failures",
"description": "Detects repeated failed Windows authentication attempts.",
"inputType": "spl",
"input": "index=wineventlog EventCode=4625"
}
]
}
}
}
EOF# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"type": "batchMigration",
"attributes": {
"name": "Example-Security-Monitoring",
"description": "Rules imported from Splunk",
"tags": [
"source:splunk"
],
"resources": [
{
"name": "Repeated Windows login failures",
"description": "Detects repeated failed Windows authentication attempts.",
"inputType": "spl",
"input": "index=wineventlog EventCode=4625"
}
]
}
}
}
EOF# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"type": "batchMigration",
"attributes": {
"name": "Example-Security-Monitoring",
"description": "Rules imported from Splunk",
"tags": [
"source:splunk"
],
"resources": [
{
"name": "Repeated Windows login failures",
"description": "Detects repeated failed Windows authentication attempts.",
"inputType": "spl",
"input": "index=wineventlog EventCode=4625"
}
]
}
}
}
EOF# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"type": "batchMigration",
"attributes": {
"name": "Example-Security-Monitoring",
"description": "Rules imported from Splunk",
"tags": [
"source:splunk"
],
"resources": [
{
"name": "Repeated Windows login failures",
"description": "Detects repeated failed Windows authentication attempts.",
"inputType": "spl",
"input": "index=wineventlog EventCode=4625"
}
]
}
}
}
EOF# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"type": "batchMigration",
"attributes": {
"name": "Example-Security-Monitoring",
"description": "Rules imported from Splunk",
"tags": [
"source:splunk"
],
"resources": [
{
"name": "Repeated Windows login failures",
"description": "Detects repeated failed Windows authentication attempts.",
"inputType": "spl",
"input": "index=wineventlog EventCode=4625"
}
]
}
}
}
EOF