Update a batch migration resource
https://api.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id}https://api.us3.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id}https://api.us5.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id}https://api.datadoghq.eu/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id}https://api.ap1.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id}https://api.ap2.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id}https://api.uk1.datadoghq.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id}https://api.ddog-gov.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id}https://api.us2.ddog-gov.com/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id}Overview
Update a resource of a batch migration. At least one of name, description,
inputType, or input must be provided. name and description can be updated at
any time. inputType and input can only be updated while the resource is pending;
otherwise, the request returns 409 Conflict. The translated output cannot be edited.
OAuth apps require the security_monitoring_rules_write authorization scope to access this endpoint.
Arguments
Path Parameters
batch_id [required]The UUID of the batch migration.
resource_id [required]The UUID of the batch migration resource.
Request
Body Data (required)
data [required]Data of the batch migration resource to update.
attributes [required]Attributes of the batch migration resource to update. At least one attribute is required.
descriptionThe description of the resource.
inputThe source query or natural language description to translate. Must not be blank.
inputTypeThe type of the source rule: spl for a Splunk SPL search or saved search definition,
natural_language for a plain-English description of the behavior to detect, or kql
for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded.
natural_language, spl, kqlnameThe name of the resource.
type [required]The type of resource for a batch migration resource.
batchMigrationResource{
"data": {
"attributes": {
"input": "index=wineventlog EventCode=4625 | stats count by user"
},
"type": "batchMigrationResource"
}
}Response
OK
Response containing a batch migration resource.
data [required]A batch migration resource.
attributes [required]Attributes of a batch migration resource.
batchId [required]The UUID of the batch migration that contains the resource.
createdAt [required]The creation date of the resource, in RFC 3339 format.
createdByThe UUID of the user or service account who created the resource.
descriptionThe description of the resource.
input [required]The source query or natural language description to translate.
inputType [required]The type of the source rule: spl for a Splunk SPL search or saved search definition,
natural_language for a plain-English description of the behavior to detect, or kql
for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded.
natural_language, spl, kqllastUpdatedAt [required]The last update date of the resource, in RFC 3339 format.
lastUpdatedByThe UUID of the user or service account who last updated the resource, or the name of a system actor.
name [required]The name of the resource.
output [required]The translation output. When the resource is completed, a Cloud SIEM detection rule
definition in the same format as the create detection rule API. When the resource is
failed, an object with an error describing the failure, with kind set to
translation_error or internal_error, and optional type and message. Otherwise, null.
outputType [required]The type of the translation output. Currently always siem_rule.
ruleIdThe ID of the Cloud SIEM detection rule created when the resource was published.
status [required]The status of a batch migration resource. completed resources have a translation in
output that is ready to be published. duplicate is reserved for future duplicate rule
detection.
pending, in_progress, completed, canceled, failed, publishing, published, duplicateid [required]The UUID of the batch migration resource.
type [required]The type of resource for a batch migration resource.
batchMigrationResource{
"data": {
"attributes": {
"batchId": "7cdb3a75-64fb-46ce-9445-41969e78fe8e",
"createdAt": "2026-09-21T12:00:00Z",
"createdBy": "3653d3c6-0c75-11ea-ad28-fb5701eabc7d",
"description": "Detects repeated failed Windows authentication attempts.",
"input": "index=wineventlog EventCode=4625",
"inputType": "spl",
"lastUpdatedAt": "2026-09-21T12:02:00Z",
"lastUpdatedBy": "3653d3c6-0c75-11ea-ad28-fb5701eabc7d",
"name": "Repeated Windows login failures",
"output": {
"name": "Repeated Windows login failures",
"type": "log_detection"
},
"outputType": "siem_rule",
"ruleId": "abc-def-ghi",
"status": "completed"
},
"id": "c968cf83-56c2-4d54-a993-6c86dfb83527",
"type": "batchMigrationResource"
}
}Bad Request
API error response.
errors [required]A list of errors.
detailA human-readable explanation specific to this occurrence of the error.
metaNon-standard meta-information about the error
sourceReferences to the source of the error.
headerA string indicating the name of a single request header which caused the error.
parameterA string indicating which URI query parameter caused the error.
pointerA JSON pointer to the value in the request document that caused the error.
statusStatus code of the response.
titleShort human-readable summary of the error.
{
"errors": [
{
"detail": "Missing required attribute in body",
"meta": {},
"source": {
"header": "Authorization",
"parameter": "limit",
"pointer": "/data/attributes/title"
},
"status": "400",
"title": "Bad Request"
}
]
}Unauthorized
API error response.
errors [required]A list of errors.
detailA human-readable explanation specific to this occurrence of the error.
metaNon-standard meta-information about the error
sourceReferences to the source of the error.
headerA string indicating the name of a single request header which caused the error.
parameterA string indicating which URI query parameter caused the error.
pointerA JSON pointer to the value in the request document that caused the error.
statusStatus code of the response.
titleShort human-readable summary of the error.
{
"errors": [
{
"detail": "Missing required attribute in body",
"meta": {},
"source": {
"header": "Authorization",
"parameter": "limit",
"pointer": "/data/attributes/title"
},
"status": "400",
"title": "Bad Request"
}
]
}Forbidden
API error response.
errors [required]A list of errors.
detailA human-readable explanation specific to this occurrence of the error.
metaNon-standard meta-information about the error
sourceReferences to the source of the error.
headerA string indicating the name of a single request header which caused the error.
parameterA string indicating which URI query parameter caused the error.
pointerA JSON pointer to the value in the request document that caused the error.
statusStatus code of the response.
titleShort human-readable summary of the error.
{
"errors": [
{
"detail": "Missing required attribute in body",
"meta": {},
"source": {
"header": "Authorization",
"parameter": "limit",
"pointer": "/data/attributes/title"
},
"status": "400",
"title": "Bad Request"
}
]
}Not Found
API error response.
errors [required]A list of errors.
detailA human-readable explanation specific to this occurrence of the error.
metaNon-standard meta-information about the error
sourceReferences to the source of the error.
headerA string indicating the name of a single request header which caused the error.
parameterA string indicating which URI query parameter caused the error.
pointerA JSON pointer to the value in the request document that caused the error.
statusStatus code of the response.
titleShort human-readable summary of the error.
{
"errors": [
{
"detail": "Missing required attribute in body",
"meta": {},
"source": {
"header": "Authorization",
"parameter": "limit",
"pointer": "/data/attributes/title"
},
"status": "400",
"title": "Bad Request"
}
]
}Conflict
API error response.
errors [required]A list of errors.
detailA human-readable explanation specific to this occurrence of the error.
metaNon-standard meta-information about the error
sourceReferences to the source of the error.
headerA string indicating the name of a single request header which caused the error.
parameterA string indicating which URI query parameter caused the error.
pointerA JSON pointer to the value in the request document that caused the error.
statusStatus code of the response.
titleShort human-readable summary of the error.
{
"errors": [
{
"detail": "Missing required attribute in body",
"meta": {},
"source": {
"header": "Authorization",
"parameter": "limit",
"pointer": "/data/attributes/title"
},
"status": "400",
"title": "Bad Request"
}
]
}Too many requests
API error response.
errors [required]A list of errors.
{
"errors": [
"Bad Request"
]
}Code Example
# Path parameters
export batch_id="7cdb3a75-64fb-46ce-9445-41969e78fe8e"
export resource_id="c968cf83-56c2-4d54-a993-6c86dfb83527"
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X PATCH "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations/${batch_id}/resources/${resource_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"input": "index=wineventlog EventCode=4625 | stats count by user"
},
"type": "batchMigrationResource"
}
}
EOF# Path parameters
export batch_id="7cdb3a75-64fb-46ce-9445-41969e78fe8e"
export resource_id="c968cf83-56c2-4d54-a993-6c86dfb83527"
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X PATCH "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations/${batch_id}/resources/${resource_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"input": "index=wineventlog EventCode=4625 | stats count by user"
},
"type": "batchMigrationResource"
}
}
EOF# Path parameters
export batch_id="7cdb3a75-64fb-46ce-9445-41969e78fe8e"
export resource_id="c968cf83-56c2-4d54-a993-6c86dfb83527"
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X PATCH "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations/${batch_id}/resources/${resource_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"input": "index=wineventlog EventCode=4625 | stats count by user"
},
"type": "batchMigrationResource"
}
}
EOF# Path parameters
export batch_id="7cdb3a75-64fb-46ce-9445-41969e78fe8e"
export resource_id="c968cf83-56c2-4d54-a993-6c86dfb83527"
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X PATCH "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations/${batch_id}/resources/${resource_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"input": "index=wineventlog EventCode=4625 | stats count by user"
},
"type": "batchMigrationResource"
}
}
EOF# Path parameters
export batch_id="7cdb3a75-64fb-46ce-9445-41969e78fe8e"
export resource_id="c968cf83-56c2-4d54-a993-6c86dfb83527"
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X PATCH "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations/${batch_id}/resources/${resource_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"input": "index=wineventlog EventCode=4625 | stats count by user"
},
"type": "batchMigrationResource"
}
}
EOF# Path parameters
export batch_id="7cdb3a75-64fb-46ce-9445-41969e78fe8e"
export resource_id="c968cf83-56c2-4d54-a993-6c86dfb83527"
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X PATCH "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations/${batch_id}/resources/${resource_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"input": "index=wineventlog EventCode=4625 | stats count by user"
},
"type": "batchMigrationResource"
}
}
EOF# Path parameters
export batch_id="7cdb3a75-64fb-46ce-9445-41969e78fe8e"
export resource_id="c968cf83-56c2-4d54-a993-6c86dfb83527"
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X PATCH "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations/${batch_id}/resources/${resource_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"input": "index=wineventlog EventCode=4625 | stats count by user"
},
"type": "batchMigrationResource"
}
}
EOF# Path parameters
export batch_id="7cdb3a75-64fb-46ce-9445-41969e78fe8e"
export resource_id="c968cf83-56c2-4d54-a993-6c86dfb83527"
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X PATCH "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations/${batch_id}/resources/${resource_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"input": "index=wineventlog EventCode=4625 | stats count by user"
},
"type": "batchMigrationResource"
}
}
EOF# Path parameters
export batch_id="7cdb3a75-64fb-46ce-9445-41969e78fe8e"
export resource_id="c968cf83-56c2-4d54-a993-6c86dfb83527"
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X PATCH "https://api.${DD_SITE}/api/v2/security_monitoring/batch-migrations/${batch_id}/resources/${resource_id}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"data": {
"attributes": {
"input": "index=wineventlog EventCode=4625 | stats count by user"
},
"type": "batchMigrationResource"
}
}
EOF