For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/es/api/latest/security-monitoring/create-or-update-an-indicator-triage-state.md. A documentation index is available at /llms.txt.
Language
Datadog site

Create or update an indicator triage state

ADVERTENCIANote: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates.
POSThttps://api.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.us3.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.us5.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.datadoghq.eu/api/v2/security/siem/ioc-explorer/triagehttps://api.ap1.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.ap2.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.uk1.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.ddog-gov.com/api/v2/security/siem/ioc-explorer/triagehttps://api.us2.ddog-gov.com/api/v2/security/siem/ioc-explorer/triage

Descripción general

Set the triage state of an indicator of compromise (IoC). This creates or updates the triage state for the indicator in your organization.

OAuth apps require the security_monitoring_signals_write authorization scope to access this endpoint.

Solicitud

Body Data (required)

The triage state to set for the indicator.

Campo
Type
Descripción
data [required]
object

Data object for the triage write request.

Respuesta

Created

Response for the create indicator triage state endpoint.

Campo
Type
Descripción
data
object

Data object of the triage write response.

Ejemplo de código

Create or update an indicator triage state returns "Created" response
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF