Create a severity modifier rule
WARNINGNote: This endpoint is in Preview and is subject to change.
If you have any feedback, contact Datadog support.
POST
https://api.datadoghq.com/api/v2/security/findings/automation/severity_modifier_ruleshttps://api.us3.datadoghq.com/api/v2/security/findings/automation/severity_modifier_ruleshttps://api.us5.datadoghq.com/api/v2/security/findings/automation/severity_modifier_ruleshttps://api.datadoghq.eu/api/v2/security/findings/automation/severity_modifier_ruleshttps://api.ap1.datadoghq.com/api/v2/security/findings/automation/severity_modifier_ruleshttps://api.ap2.datadoghq.com/api/v2/security/findings/automation/severity_modifier_ruleshttps://api.uk1.datadoghq.com/api/v2/security/findings/automation/severity_modifier_ruleshttps://api.ddog-gov.com/api/v2/security/findings/automation/severity_modifier_ruleshttps://api.us2.ddog-gov.com/api/v2/security/findings/automation/severity_modifier_rulesOverview
Create a severity modifier rule for the current organization.
Request
Body Data (required)
Field
Type
Description
data [required]object
The data object for a severity modifier rule create request.
attributes [required]object
Attributes for creating or updating a severity modifier rule.
action [required]<oneOf>
The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one rank.
A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace.
Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
<type=set>object
Sets matched findings to a fixed severity.
descriptionstring
An optional free-form explanation for the severity change.
severity [required]enum
The severity to assign to matched findings. info_none is not supported for the iac_misconfiguration, runtime_code_vulnerability, secret, or static_code_vulnerability finding types.
Allowed enum values:
info_none, low, medium, high, criticaltype [required]enum
The type of a severity modifier rule action that sets a fixed severity.
Allowed enum values:
set<type=shift>object
Shifts matched findings up or down by one severity rank.
descriptionstring
An optional free-form explanation for the severity change.
severity_delta [required]enum
The direction in which to shift the severity of matched findings by one rank.
Allowed enum values:
up_one, down_onetype [required]enum
The type of a severity modifier rule action that shifts the severity by one rank.
Allowed enum values:
shiftenabledboolean
Whether the severity modifier rule is enabled.
name [required]string
The name of the severity modifier rule.
rule [required]object
Defines the scope of findings to which the automation rule applies.
finding_types [required][string]
The list of security finding types that the automation rule applies to.
querystring
A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
type [required]enum
The JSON:API type for severity modifier rules.
Allowed enum values:
severity_modifier_rules{
"data": {
"attributes": {
"action": {
"description": "Lower severity for dev environment noise",
"severity": "low",
"type": "set"
},
"enabled": true,
"name": "Downgrade misconfigurations in dev",
"rule": {
"finding_types": [
"misconfiguration"
],
"query": "env:dev"
}
},
"type": "severity_modifier_rules"
}
}Response
Successfully created the severity modifier rule
A single severity modifier rule response.
Field
Type
Description
data [required]object
The data object for a severity modifier rule as returned by the API.
attributes [required]object
Attributes of a severity modifier rule as returned by the API.
action [required]<oneOf>
The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one rank.
A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace.
Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
<type=set>object
Sets matched findings to a fixed severity.
descriptionstring
An optional free-form explanation for the severity change.
severity [required]enum
The severity to assign to matched findings. info_none is not supported for the iac_misconfiguration, runtime_code_vulnerability, secret, or static_code_vulnerability finding types.
Allowed enum values:
info_none, low, medium, high, criticaltype [required]enum
The type of a severity modifier rule action that sets a fixed severity.
Allowed enum values:
set<type=shift>object
Shifts matched findings up or down by one severity rank.
descriptionstring
An optional free-form explanation for the severity change.
severity_delta [required]enum
The direction in which to shift the severity of matched findings by one rank.
Allowed enum values:
up_one, down_onetype [required]enum
The type of a severity modifier rule action that shifts the severity by one rank.
Allowed enum values:
shiftcreated_at [required]int64
The Unix timestamp in milliseconds when the rule was created.
created_by [required]object
The user or Datadog system who created the rule.
id [required]string
The actor's identifier (a user UUID or a system identifier).
name [required]string
The name of the actor.
type [required]enum
Whether the actor is a user or the Datadog system.
Allowed enum values:
user, systemenabled [required]boolean
Whether the severity modifier rule is enabled.
modified_at [required]int64
The Unix timestamp in milliseconds when the rule was last modified.
modified_by [required]object
The user or Datadog system who last modified the rule.
id [required]string
The actor's identifier (a user UUID or a system identifier).
name [required]string
The name of the actor.
type [required]enum
Whether the actor is a user or the Datadog system.
Allowed enum values:
user, systemname [required]string
The name of the severity modifier rule.
rule [required]object
Defines the scope of findings to which the automation rule applies.
finding_types [required][string]
The list of security finding types that the automation rule applies to.
querystring
A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
id [required]uuid
The ID of the severity modifier rule.
type [required]enum
The JSON:API type for severity modifier rules.
Allowed enum values:
severity_modifier_rules{
"data": {
"attributes": {
"action": {
"description": "Lower severity for dev environment noise",
"severity": "low",
"type": "set"
},
"created_at": 1722439510282,
"created_by": {
"id": "00000000-0000-0000-0000-000000000000",
"name": "Jane Doe",
"type": "user"
},
"enabled": true,
"modified_at": 1722439510282,
"modified_by": {
"id": "00000000-0000-0000-0000-000000000000",
"name": "Jane Doe",
"type": "user"
},
"name": "Downgrade misconfigurations in dev",
"rule": {
"finding_types": [
"misconfiguration"
],
"query": "env:prod team:platform"
}
},
"id": "00000000-0000-0000-0000-000000000000",
"type": "severity_modifier_rules"
}
}Bad Request
API error response.
Field
Type
Description
errors [required][object]
A list of errors.
detailstring
A human-readable explanation specific to this occurrence of the error.
metaobject
Non-standard meta-information about the error
sourceobject
References to the source of the error.
headerstring
A string indicating the name of a single request header which caused the error.
parameterstring
A string indicating which URI query parameter caused the error.
pointerstring
A JSON pointer to the value in the request document that caused the error.
statusstring
Status code of the response.
titlestring
Short human-readable summary of the error.
{
"errors": [
{
"detail": "Missing required attribute in body",
"meta": {},
"source": {
"header": "Authorization",
"parameter": "limit",
"pointer": "/data/attributes/title"
},
"status": "400",
"title": "Bad Request"
}
]
}Forbidden
API error response.
Field
Type
Description
errors [required][string]
A list of errors.
{
"errors": [
"Bad Request"
]
}Unprocessable Entity
API error response.
Field
Type
Description
errors [required][object]
A list of errors.
detailstring
A human-readable explanation specific to this occurrence of the error.
metaobject
Non-standard meta-information about the error
sourceobject
References to the source of the error.
headerstring
A string indicating the name of a single request header which caused the error.
parameterstring
A string indicating which URI query parameter caused the error.
pointerstring
A JSON pointer to the value in the request document that caused the error.
statusstring
Status code of the response.
titlestring
Short human-readable summary of the error.
{
"errors": [
{
"detail": "Missing required attribute in body",
"meta": {},
"source": {
"header": "Authorization",
"parameter": "limit",
"pointer": "/data/attributes/title"
},
"status": "400",
"title": "Bad Request"
}
]
}Too many requests
API error response.
Field
Type
Description
errors [required][string]
A list of errors.
{
"errors": [
"Bad Request"
]
}Code Example
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/automation/severity_modifier_rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"action": {
"description": "Lower severity for dev environment noise",
"severity": "low",
"type": "set"
},
"enabled": true,
"name": "Downgrade misconfigurations in dev",
"rule": {
"finding_types": [
"misconfiguration"
],
"query": "env:dev"
}
},
"type": "severity_modifier_rules"
}
}
EOF# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/automation/severity_modifier_rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"action": {
"description": "Lower severity for dev environment noise",
"severity": "low",
"type": "set"
},
"enabled": true,
"name": "Downgrade misconfigurations in dev",
"rule": {
"finding_types": [
"misconfiguration"
],
"query": "env:dev"
}
},
"type": "severity_modifier_rules"
}
}
EOF# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/automation/severity_modifier_rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"action": {
"description": "Lower severity for dev environment noise",
"severity": "low",
"type": "set"
},
"enabled": true,
"name": "Downgrade misconfigurations in dev",
"rule": {
"finding_types": [
"misconfiguration"
],
"query": "env:dev"
}
},
"type": "severity_modifier_rules"
}
}
EOF# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/automation/severity_modifier_rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"action": {
"description": "Lower severity for dev environment noise",
"severity": "low",
"type": "set"
},
"enabled": true,
"name": "Downgrade misconfigurations in dev",
"rule": {
"finding_types": [
"misconfiguration"
],
"query": "env:dev"
}
},
"type": "severity_modifier_rules"
}
}
EOF# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/automation/severity_modifier_rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"action": {
"description": "Lower severity for dev environment noise",
"severity": "low",
"type": "set"
},
"enabled": true,
"name": "Downgrade misconfigurations in dev",
"rule": {
"finding_types": [
"misconfiguration"
],
"query": "env:dev"
}
},
"type": "severity_modifier_rules"
}
}
EOF# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/automation/severity_modifier_rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"action": {
"description": "Lower severity for dev environment noise",
"severity": "low",
"type": "set"
},
"enabled": true,
"name": "Downgrade misconfigurations in dev",
"rule": {
"finding_types": [
"misconfiguration"
],
"query": "env:dev"
}
},
"type": "severity_modifier_rules"
}
}
EOF# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/automation/severity_modifier_rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"action": {
"description": "Lower severity for dev environment noise",
"severity": "low",
"type": "set"
},
"enabled": true,
"name": "Downgrade misconfigurations in dev",
"rule": {
"finding_types": [
"misconfiguration"
],
"query": "env:dev"
}
},
"type": "severity_modifier_rules"
}
}
EOF# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/automation/severity_modifier_rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"action": {
"description": "Lower severity for dev environment noise",
"severity": "low",
"type": "set"
},
"enabled": true,
"name": "Downgrade misconfigurations in dev",
"rule": {
"finding_types": [
"misconfiguration"
],
"query": "env:dev"
}
},
"type": "severity_modifier_rules"
}
}
EOF# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security/findings/automation/severity_modifier_rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"action": {
"description": "Lower severity for dev environment noise",
"severity": "low",
"type": "set"
},
"enabled": true,
"name": "Downgrade misconfigurations in dev",
"rule": {
"finding_types": [
"misconfiguration"
],
"query": "env:dev"
}
},
"type": "severity_modifier_rules"
}
}
EOF// Create a severity modifier rule returns "Successfully created the severity modifier rule" response
package main
import (
"context"
"encoding/json"
"fmt"
"os"
"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
)
func main() {
body := datadogV2.SeverityModifierRuleCreateRequest{
Data: datadogV2.SeverityModifierRuleDataCreate{
Attributes: datadogV2.SeverityModifierRuleAttributesCreate{
Action: datadogV2.SeverityModifierRuleAction{
SeverityModifierRuleSetAction: &datadogV2.SeverityModifierRuleSetAction{
Description: datadog.PtrString("Lower severity for dev environment noise"),
Severity: datadogV2.SEVERITYMODIFIERSEVERITY_LOW,
Type: datadogV2.SEVERITYMODIFIERRULESETACTIONTYPE_SET,
}},
Enabled: datadog.PtrBool(true),
Name: "Downgrade misconfigurations in dev",
Rule: datadogV2.AutomationRuleScope{
FindingTypes: []datadogV2.SecurityFindingType{
datadogV2.SECURITYFINDINGTYPE_MISCONFIGURATION,
},
Query: datadog.PtrString("env:prod team:platform"),
},
},
Type: datadogV2.SEVERITYMODIFIERRULETYPE_SEVERITY_MODIFIER_RULES,
},
}
ctx := datadog.NewDefaultContext(context.Background())
ctx = context.WithValue(ctx, datadog.ContextAccessToken, os.Getenv("DD_BEARER_TOKEN"))
configuration := datadog.NewConfiguration()
configuration.SetUnstableOperationEnabled("v2.CreateSecurityFindingsAutomationSeverityModifierRule", true)
apiClient := datadog.NewAPIClient(configuration)
api := datadogV2.NewSecurityMonitoringApi(apiClient)
resp, r, err := api.CreateSecurityFindingsAutomationSeverityModifierRule(ctx, body)
if err != nil {
fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.CreateSecurityFindingsAutomationSeverityModifierRule`: %v\n", err)
fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
}
responseContent, _ := json.MarshalIndent(resp, "", " ")
fmt.Fprintf(os.Stdout, "Response from `SecurityMonitoringApi.CreateSecurityFindingsAutomationSeverityModifierRule`:\n%s\n", responseContent)
}
Instructions
First install the library and its dependencies and then save the example to main.go and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"// Create a severity modifier rule returns "Successfully created the severity modifier rule"
// response
import com.datadog.api.client.ApiClient;
import com.datadog.api.client.ApiException;
import com.datadog.api.client.v2.api.SecurityMonitoringApi;
import com.datadog.api.client.v2.model.AutomationRuleScope;
import com.datadog.api.client.v2.model.SecurityFindingType;
import com.datadog.api.client.v2.model.SeverityModifierRuleAction;
import com.datadog.api.client.v2.model.SeverityModifierRuleAttributesCreate;
import com.datadog.api.client.v2.model.SeverityModifierRuleCreateRequest;
import com.datadog.api.client.v2.model.SeverityModifierRuleDataCreate;
import com.datadog.api.client.v2.model.SeverityModifierRuleResponse;
import com.datadog.api.client.v2.model.SeverityModifierRuleSetAction;
import com.datadog.api.client.v2.model.SeverityModifierRuleSetActionType;
import com.datadog.api.client.v2.model.SeverityModifierRuleType;
import com.datadog.api.client.v2.model.SeverityModifierSeverity;
import java.util.Collections;
public class Example {
public static void main(String[] args) {
ApiClient defaultClient = ApiClient.getDefaultApiClient();
defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN"));
defaultClient.setUnstableOperationEnabled(
"v2.createSecurityFindingsAutomationSeverityModifierRule", true);
SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient);
SeverityModifierRuleCreateRequest body =
new SeverityModifierRuleCreateRequest()
.data(
new SeverityModifierRuleDataCreate()
.attributes(
new SeverityModifierRuleAttributesCreate()
.action(
new SeverityModifierRuleAction(
new SeverityModifierRuleSetAction()
.description("Lower severity for dev environment noise")
.severity(SeverityModifierSeverity.LOW)
.type(SeverityModifierRuleSetActionType.SET)))
.enabled(true)
.name("Downgrade misconfigurations in dev")
.rule(
new AutomationRuleScope()
.findingTypes(
Collections.singletonList(
SecurityFindingType.MISCONFIGURATION))
.query("env:prod team:platform")))
.type(SeverityModifierRuleType.SEVERITY_MODIFIER_RULES));
try {
SeverityModifierRuleResponse result =
apiInstance.createSecurityFindingsAutomationSeverityModifierRule(body);
System.out.println(result);
} catch (ApiException e) {
System.err.println(
"Exception when calling"
+ " SecurityMonitoringApi#createSecurityFindingsAutomationSeverityModifierRule");
System.err.println("Status code: " + e.getCode());
System.err.println("Reason: " + e.getResponseBody());
System.err.println("Response headers: " + e.getResponseHeaders());
e.printStackTrace();
}
}
}
Instructions
First install the library and its dependencies and then save the example to Example.java and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java""""
Create a severity modifier rule returns "Successfully created the severity modifier rule" response
"""
from os import environ
from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
from datadog_api_client.v2.model.automation_rule_scope import AutomationRuleScope
from datadog_api_client.v2.model.security_finding_type import SecurityFindingType
from datadog_api_client.v2.model.severity_modifier_rule_attributes_create import SeverityModifierRuleAttributesCreate
from datadog_api_client.v2.model.severity_modifier_rule_create_request import SeverityModifierRuleCreateRequest
from datadog_api_client.v2.model.severity_modifier_rule_data_create import SeverityModifierRuleDataCreate
from datadog_api_client.v2.model.severity_modifier_rule_set_action import SeverityModifierRuleSetAction
from datadog_api_client.v2.model.severity_modifier_rule_set_action_type import SeverityModifierRuleSetActionType
from datadog_api_client.v2.model.severity_modifier_rule_type import SeverityModifierRuleType
from datadog_api_client.v2.model.severity_modifier_severity import SeverityModifierSeverity
body = SeverityModifierRuleCreateRequest(
data=SeverityModifierRuleDataCreate(
attributes=SeverityModifierRuleAttributesCreate(
action=SeverityModifierRuleSetAction(
description="Lower severity for dev environment noise",
severity=SeverityModifierSeverity.LOW,
type=SeverityModifierRuleSetActionType.SET,
),
enabled=True,
name="Downgrade misconfigurations in dev",
rule=AutomationRuleScope(
finding_types=[
SecurityFindingType.MISCONFIGURATION,
],
query="env:prod team:platform",
),
),
type=SeverityModifierRuleType.SEVERITY_MODIFIER_RULES,
),
)
configuration = Configuration()
configuration.access_token = environ["DD_BEARER_TOKEN"]
configuration.unstable_operations["create_security_findings_automation_severity_modifier_rule"] = True
with ApiClient(configuration) as api_client:
api_instance = SecurityMonitoringApi(api_client)
response = api_instance.create_security_findings_automation_severity_modifier_rule(body=body)
print(response)
Instructions
First install the library and its dependencies and then save the example to example.py and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"# Create a severity modifier rule returns "Successfully created the severity modifier rule" response
require "datadog_api_client"
DatadogAPIClient.configure do |config|
config.access_token = ENV["DD_BEARER_TOKEN"]
config.unstable_operations["v2.create_security_findings_automation_severity_modifier_rule".to_sym] = true
end
api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
body = DatadogAPIClient::V2::SeverityModifierRuleCreateRequest.new({
data: DatadogAPIClient::V2::SeverityModifierRuleDataCreate.new({
attributes: DatadogAPIClient::V2::SeverityModifierRuleAttributesCreate.new({
action: DatadogAPIClient::V2::SeverityModifierRuleSetAction.new({
description: "Lower severity for dev environment noise",
severity: DatadogAPIClient::V2::SeverityModifierSeverity::LOW,
type: DatadogAPIClient::V2::SeverityModifierRuleSetActionType::SET,
}),
enabled: true,
name: "Downgrade misconfigurations in dev",
rule: DatadogAPIClient::V2::AutomationRuleScope.new({
finding_types: [
DatadogAPIClient::V2::SecurityFindingType::MISCONFIGURATION,
],
query: "env:prod team:platform",
}),
}),
type: DatadogAPIClient::V2::SeverityModifierRuleType::SEVERITY_MODIFIER_RULES,
}),
})
p api_instance.create_security_findings_automation_severity_modifier_rule(body)
Instructions
First install the library and its dependencies and then save the example to example.rb and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"// Create a severity modifier rule returns "Successfully created the severity
// modifier rule" response
use datadog_api_client::datadog;
use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;
use datadog_api_client::datadogV2::model::AutomationRuleScope;
use datadog_api_client::datadogV2::model::SecurityFindingType;
use datadog_api_client::datadogV2::model::SeverityModifierRuleAction;
use datadog_api_client::datadogV2::model::SeverityModifierRuleAttributesCreate;
use datadog_api_client::datadogV2::model::SeverityModifierRuleCreateRequest;
use datadog_api_client::datadogV2::model::SeverityModifierRuleDataCreate;
use datadog_api_client::datadogV2::model::SeverityModifierRuleSetAction;
use datadog_api_client::datadogV2::model::SeverityModifierRuleSetActionType;
use datadog_api_client::datadogV2::model::SeverityModifierRuleType;
use datadog_api_client::datadogV2::model::SeverityModifierSeverity;
#[tokio::main]
async fn main() {
let body = SeverityModifierRuleCreateRequest::new(SeverityModifierRuleDataCreate::new(
SeverityModifierRuleAttributesCreate::new(
SeverityModifierRuleAction::SeverityModifierRuleSetAction(Box::new(
SeverityModifierRuleSetAction::new(
SeverityModifierSeverity::LOW,
SeverityModifierRuleSetActionType::SET,
)
.description("Lower severity for dev environment noise".to_string()),
)),
"Downgrade misconfigurations in dev".to_string(),
AutomationRuleScope::new(vec![SecurityFindingType::MISCONFIGURATION])
.query("env:prod team:platform".to_string()),
)
.enabled(true),
SeverityModifierRuleType::SEVERITY_MODIFIER_RULES,
));
let mut configuration = datadog::Configuration::new();
configuration.set_unstable_operation_enabled(
"v2.create_security_findings_automation_severity_modifier_rule",
true,
);
let api = SecurityMonitoringAPI::with_config(configuration);
let resp = api
.create_security_findings_automation_severity_modifier_rule(body)
.await;
if let Ok(value) = resp {
println!("{:#?}", value);
} else {
println!("{:#?}", resp.unwrap_err());
}
}
Instructions
First install the library and its dependencies and then save the example to src/main.rs and run following commands:
DD_SITE="datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="us3.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="us5.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="datadoghq.eu" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="ap1.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="ap2.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="uk1.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="us2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo run/**
* Create a severity modifier rule returns "Successfully created the severity modifier rule" response
*/
import { client, v2 } from "@datadog/datadog-api-client";
const configuration = client.createConfiguration({
authMethods: {
AuthZ: {
accessToken: process.env.DD_BEARER_TOKEN as string,
},
},
});
configuration.unstableOperations[
"v2.createSecurityFindingsAutomationSeverityModifierRule"
] = true;
const apiInstance = new v2.SecurityMonitoringApi(configuration);
const params: v2.SecurityMonitoringApiCreateSecurityFindingsAutomationSeverityModifierRuleRequest =
{
body: {
data: {
attributes: {
action: {
description: "Lower severity for dev environment noise",
severity: "low",
type: "set",
},
enabled: true,
name: "Downgrade misconfigurations in dev",
rule: {
findingTypes: ["misconfiguration"],
query: "env:prod team:platform",
},
},
type: "severity_modifier_rules",
},
},
};
apiInstance
.createSecurityFindingsAutomationSeverityModifierRule(params)
.then((data: v2.SeverityModifierRuleResponse) => {
console.log(
"API called successfully. Returned data: " + JSON.stringify(data)
);
})
.catch((error: any) => console.error(error));
Instructions
First install the library and its dependencies and then save the example to example.ts and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"