For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/es/api/latest/security-monitoring/list-indicators-of-compromise.md. A documentation index is available at /llms.txt.
homeIniciodocsDocumentaciónapiAPI
Language
Datadog site

List indicators of compromise

ADVERTENCIANote: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates.
GEThttps://api.datadoghq.com/api/v2/security/siem/ioc-explorerhttps://api.us3.datadoghq.com/api/v2/security/siem/ioc-explorerhttps://api.us5.datadoghq.com/api/v2/security/siem/ioc-explorerhttps://api.datadoghq.eu/api/v2/security/siem/ioc-explorerhttps://api.ap1.datadoghq.com/api/v2/security/siem/ioc-explorerhttps://api.ap2.datadoghq.com/api/v2/security/siem/ioc-explorerhttps://api.uk1.datadoghq.com/api/v2/security/siem/ioc-explorerhttps://api.ddog-gov.com/api/v2/security/siem/ioc-explorerhttps://api.us2.ddog-gov.com/api/v2/security/siem/ioc-explorer

Descripción general

Get a list of indicators of compromise (IoCs) matching the specified filters.

OAuth apps require the security_monitoring_signals_read authorization scope to access this endpoint.

Argumentos

Cadenas de consulta

Nombre
Type
Descripción
limit
integer

Number of results per page.

Default: 50
offset
integer

Pagination offset.

Default: 0
query
string

Search/filter query (supports field:value syntax).

sort[column]
string

Sort column: score, first_seen_ts_epoch, last_seen_ts_epoch, indicator, indicator_type, signal_count, log_count, category, as_type.

Default: score
sort[order]
string

Sort order: asc or desc.

Default: desc
ocsf
boolean

When true, return only OCSF field-based matches. When false, return regex/message-based matches.

Default: true
worked_by
string

Filter indicators whose triage state was updated by a specific user identified by their handle.

triage_state
enum

Filter by triage state.

Allowed enum values: not_reviewed, reviewed

Respuesta

OK

Response for the list indicators of compromise endpoint.

Campo
Type
Descripción
data
object

IoC Explorer list response data object.

Ejemplo de código

List indicators of compromise
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"