For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/es/api/latest/security-monitoring/test-a-notification-rule.md. A documentation index is available at /llms.txt.
Language
Datadog site

Test a notification rule

POSThttps://api.datadoghq.com/api/v2/security_monitoring/configuration/notification_rules/send_notification_previewhttps://api.us3.datadoghq.com/api/v2/security_monitoring/configuration/notification_rules/send_notification_previewhttps://api.us5.datadoghq.com/api/v2/security_monitoring/configuration/notification_rules/send_notification_previewhttps://api.datadoghq.eu/api/v2/security_monitoring/configuration/notification_rules/send_notification_previewhttps://api.ap1.datadoghq.com/api/v2/security_monitoring/configuration/notification_rules/send_notification_previewhttps://api.ap2.datadoghq.com/api/v2/security_monitoring/configuration/notification_rules/send_notification_previewhttps://api.uk1.datadoghq.com/api/v2/security_monitoring/configuration/notification_rules/send_notification_previewhttps://api.ddog-gov.com/api/v2/security_monitoring/configuration/notification_rules/send_notification_previewhttps://api.us2.ddog-gov.com/api/v2/security_monitoring/configuration/notification_rules/send_notification_preview

Descripción general

Send a notification preview to test that a notification rule's targets are properly configured.

This endpoint requires the security_monitoring_notification_profiles_write permission.

OAuth apps require the security_monitoring_notification_profiles_write authorization scope to access this endpoint.

Solicitud

Body Data (required)

Campo
Type
Descripción
data
object

Data of the notification rule create request: the rule type, and the rule attributes. All fields are required.

Respuesta

OK

Response from the notification preview request.

Campo
Type
Descripción
data [required]
object

The notification preview response data.

Ejemplo de código

Test a notification rule returns "OK" response
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/configuration/notification_rules/send_notification_preview" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "enabled": true,
      "name": "Rule 1",
      "selectors": {
        "query": "env:prod",
        "rule_types": [
          "log_detection"
        ],
        "severities": [
          "critical"
        ],
        "trigger_source": "security_signals"
      },
      "targets": [
        "@john.doe@email.com"
      ]
    },
    "type": "notification_rules"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/configuration/notification_rules/send_notification_preview" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "enabled": true,
      "name": "Rule 1",
      "selectors": {
        "query": "env:prod",
        "rule_types": [
          "log_detection"
        ],
        "severities": [
          "critical"
        ],
        "trigger_source": "security_signals"
      },
      "targets": [
        "@john.doe@email.com"
      ]
    },
    "type": "notification_rules"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/configuration/notification_rules/send_notification_preview" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "enabled": true,
      "name": "Rule 1",
      "selectors": {
        "query": "env:prod",
        "rule_types": [
          "log_detection"
        ],
        "severities": [
          "critical"
        ],
        "trigger_source": "security_signals"
      },
      "targets": [
        "@john.doe@email.com"
      ]
    },
    "type": "notification_rules"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/configuration/notification_rules/send_notification_preview" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "enabled": true,
      "name": "Rule 1",
      "selectors": {
        "query": "env:prod",
        "rule_types": [
          "log_detection"
        ],
        "severities": [
          "critical"
        ],
        "trigger_source": "security_signals"
      },
      "targets": [
        "@john.doe@email.com"
      ]
    },
    "type": "notification_rules"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/configuration/notification_rules/send_notification_preview" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "enabled": true,
      "name": "Rule 1",
      "selectors": {
        "query": "env:prod",
        "rule_types": [
          "log_detection"
        ],
        "severities": [
          "critical"
        ],
        "trigger_source": "security_signals"
      },
      "targets": [
        "@john.doe@email.com"
      ]
    },
    "type": "notification_rules"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/configuration/notification_rules/send_notification_preview" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "enabled": true,
      "name": "Rule 1",
      "selectors": {
        "query": "env:prod",
        "rule_types": [
          "log_detection"
        ],
        "severities": [
          "critical"
        ],
        "trigger_source": "security_signals"
      },
      "targets": [
        "@john.doe@email.com"
      ]
    },
    "type": "notification_rules"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/configuration/notification_rules/send_notification_preview" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "enabled": true,
      "name": "Rule 1",
      "selectors": {
        "query": "env:prod",
        "rule_types": [
          "log_detection"
        ],
        "severities": [
          "critical"
        ],
        "trigger_source": "security_signals"
      },
      "targets": [
        "@john.doe@email.com"
      ]
    },
    "type": "notification_rules"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/configuration/notification_rules/send_notification_preview" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "enabled": true,
      "name": "Rule 1",
      "selectors": {
        "query": "env:prod",
        "rule_types": [
          "log_detection"
        ],
        "severities": [
          "critical"
        ],
        "trigger_source": "security_signals"
      },
      "targets": [
        "@john.doe@email.com"
      ]
    },
    "type": "notification_rules"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/configuration/notification_rules/send_notification_preview" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "enabled": true,
      "name": "Rule 1",
      "selectors": {
        "query": "env:prod",
        "rule_types": [
          "log_detection"
        ],
        "severities": [
          "critical"
        ],
        "trigger_source": "security_signals"
      },
      "targets": [
        "@john.doe@email.com"
      ]
    },
    "type": "notification_rules"
  }
}
EOF