Créer une règle de détection
https://api.datadoghq.com/api/v2/security_monitoring/ruleshttps://api.us3.datadoghq.com/api/v2/security_monitoring/ruleshttps://api.us5.datadoghq.com/api/v2/security_monitoring/ruleshttps://api.datadoghq.eu/api/v2/security_monitoring/ruleshttps://api.ap1.datadoghq.com/api/v2/security_monitoring/ruleshttps://api.ap2.datadoghq.com/api/v2/security_monitoring/ruleshttps://api.uk1.datadoghq.com/api/v2/security_monitoring/ruleshttps://api.ddog-gov.com/api/v2/security_monitoring/ruleshttps://api.us2.ddog-gov.com/api/v2/security_monitoring/rulesPrésentation
Créez une règle de détection.
OAuth apps require the security_monitoring_rules_write authorization scope to access this endpoint.
Requête
Body Data (required)
Option 1Créez une nouvelle règle.
calculatedFieldsCalculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.
expression [required]Expression.
name [required]Field name.
cases [required]Cases for generating signals.
actionsAction to perform for each rule case.
optionsOptions for the rule action
durationDuration of the action in seconds. 0 indicates no expiration.
flaggedIPTypeUsed with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses.
SUSPICIOUS, FLAGGEDuserBehaviorNameUsed with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
typeThe action type.
block_ip, block_user, user_behavior, flag_ipconditionA case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated
based on the event counts in the previously defined queries.
nameName of the case.
notificationsNotification targets.
status [required]Severity of the Security Signal.
info, low, medium, high, criticalfiltersAdditional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
actionThe type of filtering action.
require, suppressqueryQuery for selecting logs to apply the filtering action.
groupSignalsByAdditional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
hasExtendedTitleWhether the notifications include the triggering group-by values in their title.
isEnabled [required]Whether the rule is enabled.
message [required]Message for generated signals.
name [required]The name of the rule.
options [required]Options.
anomalyDetectionOptionsOptions on anomaly detection method.
bucketDurationDuration in seconds of the time buckets used to aggregate events matched by the rule. Must be greater than or equal to 300.
300, 600, 900, 1800, 3600, 10800detectionToleranceAn optional parameter that sets how permissive anomaly detection is. Higher values require higher deviations before triggering a signal.
1, 2, 3, 4, 5instantaneousBaselineWhen set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDurationLearning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating.
1, 6, 12, 24, 48, 168, 336learningPeriodBaselineAn optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0.
complianceRuleOptionsOptions for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRuleWhether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
regoRuleRule details.
policy [required]The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/
resourceTypes [required]List of resource types that will be evaluated upon. Must have at least one element.
resourceTypeMain resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnvIf true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.
The severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.
The decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethodThe detection method.
threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party, anomaly_threshold, sequence_detectionevaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400hardcodedEvaluatorTypeHardcoded evaluator type.
log4shellimpossibleTravelOptionsOptions on impossible travel detection method.
baselineUserLocationsIf true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
baselineUserLocationsDurationThe duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations.
keepAliveOnce a signal is generated, the signal will remain "open" if a case is matched at least once within this keep alive window. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400maxSignalDurationA signal will "close" regardless of the query being matched once the time exceeds the maximum duration. This time is calculated from the first seen timestamp.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400newValueOptionsOptions on new value detection method.
forgetAfterThe duration in days after which a learned value is forgotten.
instantaneousBaselineWhen set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDurationThe duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
0learningMethodThe learning method used to determine when signals should be generated for values that weren't learned.
durationduration, thresholdlearningThresholdA number of occurrences after which signals will be generated for values that weren't learned.
00, 1sequenceDetectionOptionsOptions on sequence detection method.
stepTransitionsTransitions defining the allowed order of steps and their evaluation windows.
childName of the child step.
evaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400parentName of the parent step.
stepsSteps that define the conditions to be matched in sequence.
conditionCondition referencing rule queries (e.g., a > 0).
evaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400nameUnique name identifying the step.
thirdPartyRuleOptionsOptions on third party detection method.
defaultNotificationsNotification targets for the logs that do not correspond to any of the cases.
defaultStatusSeverity of the Security Signal.
info, low, medium, high, criticalrootQueriesQueries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
groupByFieldsFields to group by.
queryQuery to run on logs.
signalTitleTemplateA template for the signal title; if omitted, the title is generated based on the case name.
queries [required]Queries for selecting logs which are part of the rule.
aggregationThe aggregation type.
count, cardinality, sum, max, new_value, geo_data, event_count, nonecustomQueryExtensionQuery extension to append to the logs query.
dataSourceSource of events, either logs, audit trail, security signals, or Datadog events. app_sec_spans is deprecated in favor of spans.
logslogs, audit, app_sec_spans, spans, security_runtime, network, events, security_signalsdatasetIdsIDs of the datasets queried by the rule. Only used when queryLanguage is sql.
datasetVersionsVersion of each dataset used by the rule, keyed by dataset ID. Only used when queryLanguage is sql.
<any-key>Dataset version.
distinctFieldsField for which the cardinality is measured. Sent as an array.
groupByFieldsFields to group by.
hasOptionalGroupByFieldsWhen false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.
falseindexThis field is currently unstable and might be removed in a minor version upgrade.
The index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.
indexesList of indexes to query when the dataSource is logs. Only used for scheduled rules, such as when the schedulingOptions field is present in the rule payload.
metricDEPRECATED (Deprecated) The target field to aggregate over when using the sum or max
aggregations. metrics field should be used instead.
metricsGroup of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
nameName of the query.
queryQuery to run on logs.
queryLanguageLanguage of the query. Use sql for SQL-based rules over datasets. Defaults to event_query.
referenceTablesReference tables for the rule.
checkPresenceWhether to include or exclude the matched values.
columnNameThe name of the column in the reference table.
logFieldPathThe field in the log to match against the reference table.
ruleQueryNameThe name of the query to apply the reference table to.
tableNameThe name of the reference table.
schedulingOptionsOptions for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
startStart date for the schedule, in ISO 8601 format without timezone.
tagsTags for generated signals.
thirdPartyCasesCases for generating signals from third-party rules. Only available for third-party rules.
nameName of the case.
notificationsNotification targets for each case.
queryA query to map a third party event to this case.
status [required]Severity of the Security Signal.
info, low, medium, high, criticaltypeThe rule type.
api_security, application_security, log_detection, workload_activity, workload_securityOption 2Create a new signal correlation rule.
cases [required]Cases for generating signals.
actionsAction to perform for each rule case.
optionsOptions for the rule action
durationDuration of the action in seconds. 0 indicates no expiration.
flaggedIPTypeUsed with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses.
SUSPICIOUS, FLAGGEDuserBehaviorNameUsed with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
typeThe action type.
block_ip, block_user, user_behavior, flag_ipconditionA case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated
based on the event counts in the previously defined queries.
nameName of the case.
notificationsNotification targets.
status [required]Severity of the Security Signal.
info, low, medium, high, criticalfiltersAdditional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
actionThe type of filtering action.
require, suppressqueryQuery for selecting logs to apply the filtering action.
hasExtendedTitleWhether the notifications include the triggering group-by values in their title.
isEnabled [required]Whether the rule is enabled.
message [required]Message for generated signals.
name [required]The name of the rule.
options [required]Options.
anomalyDetectionOptionsOptions on anomaly detection method.
bucketDurationDuration in seconds of the time buckets used to aggregate events matched by the rule. Must be greater than or equal to 300.
300, 600, 900, 1800, 3600, 10800detectionToleranceAn optional parameter that sets how permissive anomaly detection is. Higher values require higher deviations before triggering a signal.
1, 2, 3, 4, 5instantaneousBaselineWhen set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDurationLearning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating.
1, 6, 12, 24, 48, 168, 336learningPeriodBaselineAn optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0.
complianceRuleOptionsOptions for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRuleWhether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
regoRuleRule details.
policy [required]The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/
resourceTypes [required]List of resource types that will be evaluated upon. Must have at least one element.
resourceTypeMain resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnvIf true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.
The severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.
The decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethodThe detection method.
threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party, anomaly_threshold, sequence_detectionevaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400hardcodedEvaluatorTypeHardcoded evaluator type.
log4shellimpossibleTravelOptionsOptions on impossible travel detection method.
baselineUserLocationsIf true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
baselineUserLocationsDurationThe duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations.
keepAliveOnce a signal is generated, the signal will remain "open" if a case is matched at least once within this keep alive window. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400maxSignalDurationA signal will "close" regardless of the query being matched once the time exceeds the maximum duration. This time is calculated from the first seen timestamp.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400newValueOptionsOptions on new value detection method.
forgetAfterThe duration in days after which a learned value is forgotten.
instantaneousBaselineWhen set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDurationThe duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
0learningMethodThe learning method used to determine when signals should be generated for values that weren't learned.
durationduration, thresholdlearningThresholdA number of occurrences after which signals will be generated for values that weren't learned.
00, 1sequenceDetectionOptionsOptions on sequence detection method.
stepTransitionsTransitions defining the allowed order of steps and their evaluation windows.
childName of the child step.
evaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400parentName of the parent step.
stepsSteps that define the conditions to be matched in sequence.
conditionCondition referencing rule queries (e.g., a > 0).
evaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400nameUnique name identifying the step.
thirdPartyRuleOptionsOptions on third party detection method.
defaultNotificationsNotification targets for the logs that do not correspond to any of the cases.
defaultStatusSeverity of the Security Signal.
info, low, medium, high, criticalrootQueriesQueries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
groupByFieldsFields to group by.
queryQuery to run on logs.
signalTitleTemplateA template for the signal title; if omitted, the title is generated based on the case name.
queries [required]Queries for selecting signals which are part of the rule.
aggregationThe aggregation type.
count, cardinality, sum, max, new_value, geo_data, event_count, nonecorrelatedByFieldsFields to group by.
correlatedQueryIndexIndex of the rule query used to retrieve the correlated field.
metricsGroup of target fields to aggregate over.
nameName of the query.
ruleId [required]Rule ID to match on signals.
tagsTags for generated signals.
typeThe rule type.
signal_correlationOption 3Create a new cloud configuration rule.
cases [required]Description of generated findings and signals (severity and channels to be notified in case of a signal). Must contain exactly one item.
notificationsNotification targets for each rule case.
status [required]Severity of the Security Signal.
info, low, medium, high, criticalcomplianceSignalOptions [required]How to generate compliance signals. Useful for cloud_configuration rules only.
defaultActivationStatusThe default activation status.
defaultGroupByFieldsThe default group by fields.
userActivationStatusWhether signals will be sent.
userGroupByFieldsFields to use to group findings by when sending signals.
filtersAdditional queries to filter matched events before they are processed.
actionThe type of filtering action.
require, suppressqueryQuery for selecting logs to apply the filtering action.
isEnabled [required]Whether the rule is enabled.
message [required]Message in markdown format for generated findings and signals.
name [required]The name of the rule.
options [required]Options on cloud configuration rules.
complianceRuleOptions [required]Options for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRuleWhether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
regoRuleRule details.
policy [required]The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/
resourceTypes [required]List of resource types that will be evaluated upon. Must have at least one element.
resourceTypeMain resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
tagsTags for generated findings and signals.
typeThe rule type.
cloud_configurationCreate a cloud_configuration rule returns "OK" response
{
"type": "cloud_configuration",
"name": "Example-Security-Monitoring_cloud",
"isEnabled": false,
"cases": [
{
"status": "info",
"notifications": [
"channel"
]
}
],
"options": {
"complianceRuleOptions": {
"resourceType": "gcp_compute_disk",
"complexRule": false,
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\n\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\nmilliseconds_in_a_day := ((1000 * 60) * 60) * 24\n\neval(iam_service_account_key) = \"skip\" if {\n\tiam_service_account_key.disabled\n} else = \"pass\" if {\n\t(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90\n} else = \"fail\"\n\n# This part remains unchanged for all rules\nresults contains result if {\n\tsome resource in input.resources[input.main_resource_type]\n\tresult := dd_output.format(resource, eval(resource))\n}\n",
"resourceTypes": [
"gcp_compute_disk"
]
}
}
},
"message": "ddd",
"tags": [
"my:tag"
],
"complianceSignalOptions": {
"userActivationStatus": true,
"userGroupByFields": [
"@account_id"
]
},
"filters": [
{
"action": "require",
"query": "resource_id:helo*"
},
{
"action": "suppress",
"query": "control:helo*"
}
]
}Create a detection rule returns "OK" response
{
"name": "Example-Security-Monitoring",
"queries": [
{
"query": "@test:true",
"aggregation": "count",
"groupByFields": [],
"distinctFields": [],
"metric": ""
}
],
"filters": [],
"cases": [
{
"name": "",
"status": "info",
"condition": "a > 0",
"notifications": []
}
],
"options": {
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400
},
"message": "Test rule",
"tags": [],
"isEnabled": true,
"type": "log_detection",
"referenceTables": [
{
"tableName": "synthetics_test_reference_table_dont_delete",
"columnName": "value",
"logFieldPath": "testtag",
"checkPresence": true,
"ruleQueryName": "a"
}
]
}Create a detection rule with detection method 'anomaly_detection' returns "OK" response
{
"name": "Example-Security-Monitoring",
"type": "log_detection",
"isEnabled": true,
"queries": [
{
"aggregation": "count",
"dataSource": "logs",
"distinctFields": [],
"groupByFields": [
"@usr.email",
"@network.client.ip"
],
"hasOptionalGroupByFields": false,
"name": "",
"query": "service:app status:error"
}
],
"cases": [
{
"name": "",
"status": "info",
"notifications": [],
"condition": "a > 0.995"
}
],
"message": "An anomaly detection rule",
"options": {
"detectionMethod": "anomaly_detection",
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400,
"anomalyDetectionOptions": {
"bucketDuration": 300,
"learningDuration": 24,
"detectionTolerance": 3,
"learningPeriodBaseline": 10
}
},
"tags": [],
"filters": []
}Réponse
OK
Create a new rule.
Option 1Rule.
calculatedFieldsCalculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.
expression [required]Expression.
name [required]Field name.
casesCases for generating signals.
actionsAction to perform for each rule case.
optionsOptions for the rule action
durationDuration of the action in seconds. 0 indicates no expiration.
flaggedIPTypeUsed with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses.
SUSPICIOUS, FLAGGEDuserBehaviorNameUsed with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
typeThe action type.
block_ip, block_user, user_behavior, flag_ipconditionA rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated
based on the event counts in the previously defined queries.
customStatusSeverity of the Security Signal.
info, low, medium, high, criticalnameName of the case.
notificationsNotification targets for each rule case.
statusSeverity of the Security Signal.
info, low, medium, high, criticalcompatibleVersionThe version of the rule at which its detection logic last changed. Updates that only change the name, message, tags, or notifications do not change this value.
complianceSignalOptionsHow to generate compliance signals. Useful for cloud_configuration rules only.
defaultActivationStatusThe default activation status.
defaultGroupByFieldsThe default group by fields.
userActivationStatusWhether signals will be sent.
userGroupByFieldsFields to use to group findings by when sending signals.
createdAtWhen the rule was created, timestamp in milliseconds.
creationAuthorIdUser ID of the user who created the rule.
customMessageCustom/Overridden message for generated signals (used in case of Default rule update).
customNameCustom/Overridden name of the rule (used in case of Default rule update).
defaultTagsDefault Tags for default rules (included in tags)
deprecationDateWhen the rule will be deprecated, timestamp in milliseconds.
filtersAdditional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
actionThe type of filtering action.
require, suppressqueryQuery for selecting logs to apply the filtering action.
groupSignalsByAdditional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
hasExtendedTitleWhether the notifications include the triggering group-by values in their title.
idThe ID of the rule.
isDefaultWhether the rule is included by default.
isDeletedWhether the rule has been deleted.
isEnabledWhether the rule is enabled.
messageMessage for generated signals.
nameThe name of the rule.
optionsOptions.
anomalyDetectionOptionsOptions on anomaly detection method.
bucketDurationDuration in seconds of the time buckets used to aggregate events matched by the rule. Must be greater than or equal to 300.
300, 600, 900, 1800, 3600, 10800detectionToleranceAn optional parameter that sets how permissive anomaly detection is. Higher values require higher deviations before triggering a signal.
1, 2, 3, 4, 5instantaneousBaselineWhen set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDurationLearning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating.
1, 6, 12, 24, 48, 168, 336learningPeriodBaselineAn optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0.
complianceRuleOptionsOptions for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRuleWhether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
regoRuleRule details.
policy [required]The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/
resourceTypes [required]List of resource types that will be evaluated upon. Must have at least one element.
resourceTypeMain resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnvIf true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.
The severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.
The decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethodThe detection method.
threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party, anomaly_threshold, sequence_detectionevaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400hardcodedEvaluatorTypeHardcoded evaluator type.
log4shellimpossibleTravelOptionsOptions on impossible travel detection method.
baselineUserLocationsIf true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
baselineUserLocationsDurationThe duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations.
keepAliveOnce a signal is generated, the signal will remain "open" if a case is matched at least once within this keep alive window. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400maxSignalDurationA signal will "close" regardless of the query being matched once the time exceeds the maximum duration. This time is calculated from the first seen timestamp.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400newValueOptionsOptions on new value detection method.
forgetAfterThe duration in days after which a learned value is forgotten.
instantaneousBaselineWhen set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDurationThe duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
0learningMethodThe learning method used to determine when signals should be generated for values that weren't learned.
durationduration, thresholdlearningThresholdA number of occurrences after which signals will be generated for values that weren't learned.
00, 1sequenceDetectionOptionsOptions on sequence detection method.
stepTransitionsTransitions defining the allowed order of steps and their evaluation windows.
childName of the child step.
evaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400parentName of the parent step.
stepsSteps that define the conditions to be matched in sequence.
conditionCondition referencing rule queries (e.g., a > 0).
evaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400nameUnique name identifying the step.
thirdPartyRuleOptionsOptions on third party detection method.
defaultNotificationsNotification targets for the logs that do not correspond to any of the cases.
defaultStatusSeverity of the Security Signal.
info, low, medium, high, criticalrootQueriesQueries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
groupByFieldsFields to group by.
queryQuery to run on logs.
signalTitleTemplateA template for the signal title; if omitted, the title is generated based on the case name.
queriesQueries for selecting logs which are part of the rule.
aggregationThe aggregation type.
count, cardinality, sum, max, new_value, geo_data, event_count, nonecustomQueryExtensionQuery extension to append to the logs query.
dataSourceSource of events, either logs, audit trail, security signals, or Datadog events. app_sec_spans is deprecated in favor of spans.
logslogs, audit, app_sec_spans, spans, security_runtime, network, events, security_signalsdatasetIdsIDs of the datasets queried by the rule. Only used when queryLanguage is sql.
datasetVersionsVersion of each dataset used by the rule, keyed by dataset ID. Only used when queryLanguage is sql.
<any-key>Dataset version.
distinctFieldsField for which the cardinality is measured. Sent as an array.
groupByFieldsFields to group by.
hasOptionalGroupByFieldsWhen false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.
falseindexThis field is currently unstable and might be removed in a minor version upgrade.
The index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.
indexesList of indexes to query when the dataSource is logs. Only used for scheduled rules, such as when the schedulingOptions field is present in the rule payload.
metricDEPRECATED (Deprecated) The target field to aggregate over when using the sum or max
aggregations. metrics field should be used instead.
metricsGroup of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
nameName of the query.
queryQuery to run on logs.
queryLanguageLanguage of the query. Use sql for SQL-based rules over datasets. Defaults to event_query.
referenceTablesReference tables for the rule.
checkPresenceWhether to include or exclude the matched values.
columnNameThe name of the column in the reference table.
logFieldPathThe field in the log to match against the reference table.
ruleQueryNameThe name of the query to apply the reference table to.
tableNameThe name of the reference table.
schedulingOptionsOptions for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
startStart date for the schedule, in ISO 8601 format without timezone.
tagsTags for generated signals.
thirdPartyCasesCases for generating signals from third-party rules. Only available for third-party rules.
customStatusSeverity of the Security Signal.
info, low, medium, high, criticalnameName of the case.
notificationsNotification targets for each rule case.
queryA query to map a third party event to this case.
statusSeverity of the Security Signal.
info, low, medium, high, criticaltypeThe rule type.
log_detection, infrastructure_configuration, workload_security, cloud_configuration, application_security, api_security, workload_activityupdateAuthorIdUser ID of the user who updated the rule.
updatedAtThe date the rule was last updated, in milliseconds.
versionThe version of the rule.
Option 2Rule.
casesCases for generating signals.
actionsAction to perform for each rule case.
optionsOptions for the rule action
durationDuration of the action in seconds. 0 indicates no expiration.
flaggedIPTypeUsed with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses.
SUSPICIOUS, FLAGGEDuserBehaviorNameUsed with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
typeThe action type.
block_ip, block_user, user_behavior, flag_ipconditionA rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated
based on the event counts in the previously defined queries.
customStatusSeverity of the Security Signal.
info, low, medium, high, criticalnameName of the case.
notificationsNotification targets for each rule case.
statusSeverity of the Security Signal.
info, low, medium, high, criticalcompatibleVersionThe version of the rule at which its detection logic last changed. Updates that only change the name, message, tags, or notifications do not change this value.
createdAtWhen the rule was created, timestamp in milliseconds.
creationAuthorIdUser ID of the user who created the rule.
customMessageCustom/Overridden message for generated signals (used in case of Default rule update).
customNameCustom/Overridden name of the rule (used in case of Default rule update).
deprecationDateWhen the rule will be deprecated, timestamp in milliseconds.
filtersAdditional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
actionThe type of filtering action.
require, suppressqueryQuery for selecting logs to apply the filtering action.
hasExtendedTitleWhether the notifications include the triggering group-by values in their title.
idThe ID of the rule.
isDefaultWhether the rule is included by default.
isDeletedWhether the rule has been deleted.
isEnabledWhether the rule is enabled.
messageMessage for generated signals.
nameThe name of the rule.
optionsOptions.
anomalyDetectionOptionsOptions on anomaly detection method.
bucketDurationDuration in seconds of the time buckets used to aggregate events matched by the rule. Must be greater than or equal to 300.
300, 600, 900, 1800, 3600, 10800detectionToleranceAn optional parameter that sets how permissive anomaly detection is. Higher values require higher deviations before triggering a signal.
1, 2, 3, 4, 5instantaneousBaselineWhen set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDurationLearning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating.
1, 6, 12, 24, 48, 168, 336learningPeriodBaselineAn optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0.
complianceRuleOptionsOptions for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRuleWhether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
regoRuleRule details.
policy [required]The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/
resourceTypes [required]List of resource types that will be evaluated upon. Must have at least one element.
resourceTypeMain resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnvIf true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.
The severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.
The decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethodThe detection method.
threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party, anomaly_threshold, sequence_detectionevaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400hardcodedEvaluatorTypeHardcoded evaluator type.
log4shellimpossibleTravelOptionsOptions on impossible travel detection method.
baselineUserLocationsIf true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
baselineUserLocationsDurationThe duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations.
keepAliveOnce a signal is generated, the signal will remain "open" if a case is matched at least once within this keep alive window. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400maxSignalDurationA signal will "close" regardless of the query being matched once the time exceeds the maximum duration. This time is calculated from the first seen timestamp.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400newValueOptionsOptions on new value detection method.
forgetAfterThe duration in days after which a learned value is forgotten.
instantaneousBaselineWhen set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDurationThe duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
0learningMethodThe learning method used to determine when signals should be generated for values that weren't learned.
durationduration, thresholdlearningThresholdA number of occurrences after which signals will be generated for values that weren't learned.
00, 1sequenceDetectionOptionsOptions on sequence detection method.
stepTransitionsTransitions defining the allowed order of steps and their evaluation windows.
childName of the child step.
evaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400parentName of the parent step.
stepsSteps that define the conditions to be matched in sequence.
conditionCondition referencing rule queries (e.g., a > 0).
evaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400nameUnique name identifying the step.
thirdPartyRuleOptionsOptions on third party detection method.
defaultNotificationsNotification targets for the logs that do not correspond to any of the cases.
defaultStatusSeverity of the Security Signal.
info, low, medium, high, criticalrootQueriesQueries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
groupByFieldsFields to group by.
queryQuery to run on logs.
signalTitleTemplateA template for the signal title; if omitted, the title is generated based on the case name.
queriesQueries for selecting logs which are part of the rule.
aggregationThe aggregation type.
count, cardinality, sum, max, new_value, geo_data, event_count, nonecorrelatedByFieldsFields to correlate by.
correlatedQueryIndexIndex of the rule query used to retrieve the correlated field.
defaultRuleIdDefault Rule ID to match on signals.
distinctFieldsField for which the cardinality is measured. Sent as an array.
groupByFieldsFields to group by.
metricsGroup of target fields to aggregate over.
nameName of the query.
ruleIdRule ID to match on signals.
tagsTags for generated signals.
typeThe rule type.
signal_correlationupdateAuthorIdUser ID of the user who updated the rule.
versionThe version of the rule.
{
"calculatedFields": [
{
"expression": "@request_end_timestamp - @request_start_timestamp",
"name": "response_time"
}
],
"cases": [
{
"actions": [
{
"options": {
"duration": 0,
"flaggedIPType": "FLAGGED",
"userBehaviorName": "string"
},
"type": "string"
}
],
"condition": "string",
"customStatus": "critical",
"name": "string",
"notifications": [],
"status": "critical"
}
],
"compatibleVersion": 1,
"complianceSignalOptions": {
"defaultActivationStatus": false,
"defaultGroupByFields": [],
"userActivationStatus": false,
"userGroupByFields": []
},
"createdAt": "integer",
"creationAuthorId": "integer",
"customMessage": "string",
"customName": "string",
"defaultTags": [
"security:attacks"
],
"deprecationDate": "integer",
"filters": [
{
"action": "string",
"query": "string"
}
],
"groupSignalsBy": [
"service"
],
"hasExtendedTitle": false,
"id": "string",
"isDefault": false,
"isDeleted": false,
"isEnabled": false,
"message": "string",
"name": "string",
"options": {
"anomalyDetectionOptions": {
"bucketDuration": 300,
"detectionTolerance": 5,
"instantaneousBaseline": false,
"learningDuration": "integer",
"learningPeriodBaseline": "integer"
},
"complianceRuleOptions": {
"complexRule": false,
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}",
"resourceTypes": [
"gcp_iam_service_account",
"gcp_iam_policy"
]
},
"resourceType": "aws_acm"
},
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "string",
"evaluationWindow": "integer",
"hardcodedEvaluatorType": "string",
"impossibleTravelOptions": {
"baselineUserLocations": true,
"baselineUserLocationsDuration": "integer"
},
"keepAlive": "integer",
"maxSignalDuration": "integer",
"newValueOptions": {
"forgetAfter": "integer",
"instantaneousBaseline": false,
"learningDuration": "integer",
"learningMethod": "string",
"learningThreshold": "integer"
},
"sequenceDetectionOptions": {
"stepTransitions": [
{
"child": "string",
"evaluationWindow": "integer",
"parent": "string"
}
],
"steps": [
{
"condition": "string",
"evaluationWindow": "integer",
"name": "string"
}
]
},
"thirdPartyRuleOptions": {
"defaultNotifications": [],
"defaultStatus": "critical",
"rootQueries": [
{
"groupByFields": [],
"query": "source:cloudtrail"
}
],
"signalTitleTemplate": "string"
}
},
"queries": [
{
"aggregation": "string",
"customQueryExtension": "a > 3",
"dataSource": "logs",
"datasetIds": [],
"datasetVersions": {
"<any-key>": "integer"
},
"distinctFields": [],
"groupByFields": [],
"hasOptionalGroupByFields": false,
"index": "string",
"indexes": [],
"metric": "string",
"metrics": [],
"name": "string",
"query": "a > 3",
"queryLanguage": "sql"
}
],
"referenceTables": [
{
"checkPresence": false,
"columnName": "string",
"logFieldPath": "string",
"ruleQueryName": "string",
"tableName": "string"
}
],
"schedulingOptions": {
"rrule": "FREQ=HOURLY;INTERVAL=1;",
"start": "2025-07-14T12:00:00",
"timezone": "America/New_York"
},
"tags": [],
"thirdPartyCases": [
{
"customStatus": "critical",
"name": "string",
"notifications": [],
"query": "string",
"status": "critical"
}
],
"type": "string",
"updateAuthorId": "integer",
"updatedAt": "integer",
"version": "integer"
}Bad Request
API error response.
errors [required]A list of errors.
{
"errors": [
"Bad Request"
]
}Not Authorized
API error response.
errors [required]A list of errors.
{
"errors": [
"Bad Request"
]
}Too many requests
API error response.
errors [required]A list of errors.
{
"errors": [
"Bad Request"
]
}Exemple de code
Create a cloud_configuration rule returns "OK" response
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"type": "cloud_configuration",
"name": "Example-Security-Monitoring_cloud",
"isEnabled": false,
"cases": [
{
"status": "info",
"notifications": [
"channel"
]
}
],
"options": {
"complianceRuleOptions": {
"resourceType": "gcp_compute_disk",
"complexRule": false,
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\n\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\nmilliseconds_in_a_day := ((1000 * 60) * 60) * 24\n\neval(iam_service_account_key) = \"skip\" if {\n\tiam_service_account_key.disabled\n} else = \"pass\" if {\n\t(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90\n} else = \"fail\"\n\n# This part remains unchanged for all rules\nresults contains result if {\n\tsome resource in input.resources[input.main_resource_type]\n\tresult := dd_output.format(resource, eval(resource))\n}\n",
"resourceTypes": [
"gcp_compute_disk"
]
}
}
},
"message": "ddd",
"tags": [
"my:tag"
],
"complianceSignalOptions": {
"userActivationStatus": true,
"userGroupByFields": [
"@account_id"
]
},
"filters": [
{
"action": "require",
"query": "resource_id:helo*"
},
{
"action": "suppress",
"query": "control:helo*"
}
]
}
EOF# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"type": "cloud_configuration",
"name": "Example-Security-Monitoring_cloud",
"isEnabled": false,
"cases": [
{
"status": "info",
"notifications": [
"channel"
]
}
],
"options": {
"complianceRuleOptions": {
"resourceType": "gcp_compute_disk",
"complexRule": false,
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\n\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\nmilliseconds_in_a_day := ((1000 * 60) * 60) * 24\n\neval(iam_service_account_key) = \"skip\" if {\n\tiam_service_account_key.disabled\n} else = \"pass\" if {\n\t(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90\n} else = \"fail\"\n\n# This part remains unchanged for all rules\nresults contains result if {\n\tsome resource in input.resources[input.main_resource_type]\n\tresult := dd_output.format(resource, eval(resource))\n}\n",
"resourceTypes": [
"gcp_compute_disk"
]
}
}
},
"message": "ddd",
"tags": [
"my:tag"
],
"complianceSignalOptions": {
"userActivationStatus": true,
"userGroupByFields": [
"@account_id"
]
},
"filters": [
{
"action": "require",
"query": "resource_id:helo*"
},
{
"action": "suppress",
"query": "control:helo*"
}
]
}
EOF# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"type": "cloud_configuration",
"name": "Example-Security-Monitoring_cloud",
"isEnabled": false,
"cases": [
{
"status": "info",
"notifications": [
"channel"
]
}
],
"options": {
"complianceRuleOptions": {
"resourceType": "gcp_compute_disk",
"complexRule": false,
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\n\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\nmilliseconds_in_a_day := ((1000 * 60) * 60) * 24\n\neval(iam_service_account_key) = \"skip\" if {\n\tiam_service_account_key.disabled\n} else = \"pass\" if {\n\t(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90\n} else = \"fail\"\n\n# This part remains unchanged for all rules\nresults contains result if {\n\tsome resource in input.resources[input.main_resource_type]\n\tresult := dd_output.format(resource, eval(resource))\n}\n",
"resourceTypes": [
"gcp_compute_disk"
]
}
}
},
"message": "ddd",
"tags": [
"my:tag"
],
"complianceSignalOptions": {
"userActivationStatus": true,
"userGroupByFields": [
"@account_id"
]
},
"filters": [
{
"action": "require",
"query": "resource_id:helo*"
},
{
"action": "suppress",
"query": "control:helo*"
}
]
}
EOF# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"type": "cloud_configuration",
"name": "Example-Security-Monitoring_cloud",
"isEnabled": false,
"cases": [
{
"status": "info",
"notifications": [
"channel"
]
}
],
"options": {
"complianceRuleOptions": {
"resourceType": "gcp_compute_disk",
"complexRule": false,
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\n\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\nmilliseconds_in_a_day := ((1000 * 60) * 60) * 24\n\neval(iam_service_account_key) = \"skip\" if {\n\tiam_service_account_key.disabled\n} else = \"pass\" if {\n\t(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90\n} else = \"fail\"\n\n# This part remains unchanged for all rules\nresults contains result if {\n\tsome resource in input.resources[input.main_resource_type]\n\tresult := dd_output.format(resource, eval(resource))\n}\n",
"resourceTypes": [
"gcp_compute_disk"
]
}
}
},
"message": "ddd",
"tags": [
"my:tag"
],
"complianceSignalOptions": {
"userActivationStatus": true,
"userGroupByFields": [
"@account_id"
]
},
"filters": [
{
"action": "require",
"query": "resource_id:helo*"
},
{
"action": "suppress",
"query": "control:helo*"
}
]
}
EOF# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"type": "cloud_configuration",
"name": "Example-Security-Monitoring_cloud",
"isEnabled": false,
"cases": [
{
"status": "info",
"notifications": [
"channel"
]
}
],
"options": {
"complianceRuleOptions": {
"resourceType": "gcp_compute_disk",
"complexRule": false,
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\n\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\nmilliseconds_in_a_day := ((1000 * 60) * 60) * 24\n\neval(iam_service_account_key) = \"skip\" if {\n\tiam_service_account_key.disabled\n} else = \"pass\" if {\n\t(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90\n} else = \"fail\"\n\n# This part remains unchanged for all rules\nresults contains result if {\n\tsome resource in input.resources[input.main_resource_type]\n\tresult := dd_output.format(resource, eval(resource))\n}\n",
"resourceTypes": [
"gcp_compute_disk"
]
}
}
},
"message": "ddd",
"tags": [
"my:tag"
],
"complianceSignalOptions": {
"userActivationStatus": true,
"userGroupByFields": [
"@account_id"
]
},
"filters": [
{
"action": "require",
"query": "resource_id:helo*"
},
{
"action": "suppress",
"query": "control:helo*"
}
]
}
EOF# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"type": "cloud_configuration",
"name": "Example-Security-Monitoring_cloud",
"isEnabled": false,
"cases": [
{
"status": "info",
"notifications": [
"channel"
]
}
],
"options": {
"complianceRuleOptions": {
"resourceType": "gcp_compute_disk",
"complexRule": false,
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\n\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\nmilliseconds_in_a_day := ((1000 * 60) * 60) * 24\n\neval(iam_service_account_key) = \"skip\" if {\n\tiam_service_account_key.disabled\n} else = \"pass\" if {\n\t(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90\n} else = \"fail\"\n\n# This part remains unchanged for all rules\nresults contains result if {\n\tsome resource in input.resources[input.main_resource_type]\n\tresult := dd_output.format(resource, eval(resource))\n}\n",
"resourceTypes": [
"gcp_compute_disk"
]
}
}
},
"message": "ddd",
"tags": [
"my:tag"
],
"complianceSignalOptions": {
"userActivationStatus": true,
"userGroupByFields": [
"@account_id"
]
},
"filters": [
{
"action": "require",
"query": "resource_id:helo*"
},
{
"action": "suppress",
"query": "control:helo*"
}
]
}
EOF# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"type": "cloud_configuration",
"name": "Example-Security-Monitoring_cloud",
"isEnabled": false,
"cases": [
{
"status": "info",
"notifications": [
"channel"
]
}
],
"options": {
"complianceRuleOptions": {
"resourceType": "gcp_compute_disk",
"complexRule": false,
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\n\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\nmilliseconds_in_a_day := ((1000 * 60) * 60) * 24\n\neval(iam_service_account_key) = \"skip\" if {\n\tiam_service_account_key.disabled\n} else = \"pass\" if {\n\t(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90\n} else = \"fail\"\n\n# This part remains unchanged for all rules\nresults contains result if {\n\tsome resource in input.resources[input.main_resource_type]\n\tresult := dd_output.format(resource, eval(resource))\n}\n",
"resourceTypes": [
"gcp_compute_disk"
]
}
}
},
"message": "ddd",
"tags": [
"my:tag"
],
"complianceSignalOptions": {
"userActivationStatus": true,
"userGroupByFields": [
"@account_id"
]
},
"filters": [
{
"action": "require",
"query": "resource_id:helo*"
},
{
"action": "suppress",
"query": "control:helo*"
}
]
}
EOF# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"type": "cloud_configuration",
"name": "Example-Security-Monitoring_cloud",
"isEnabled": false,
"cases": [
{
"status": "info",
"notifications": [
"channel"
]
}
],
"options": {
"complianceRuleOptions": {
"resourceType": "gcp_compute_disk",
"complexRule": false,
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\n\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\nmilliseconds_in_a_day := ((1000 * 60) * 60) * 24\n\neval(iam_service_account_key) = \"skip\" if {\n\tiam_service_account_key.disabled\n} else = \"pass\" if {\n\t(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90\n} else = \"fail\"\n\n# This part remains unchanged for all rules\nresults contains result if {\n\tsome resource in input.resources[input.main_resource_type]\n\tresult := dd_output.format(resource, eval(resource))\n}\n",
"resourceTypes": [
"gcp_compute_disk"
]
}
}
},
"message": "ddd",
"tags": [
"my:tag"
],
"complianceSignalOptions": {
"userActivationStatus": true,
"userGroupByFields": [
"@account_id"
]
},
"filters": [
{
"action": "require",
"query": "resource_id:helo*"
},
{
"action": "suppress",
"query": "control:helo*"
}
]
}
EOF# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"type": "cloud_configuration",
"name": "Example-Security-Monitoring_cloud",
"isEnabled": false,
"cases": [
{
"status": "info",
"notifications": [
"channel"
]
}
],
"options": {
"complianceRuleOptions": {
"resourceType": "gcp_compute_disk",
"complexRule": false,
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\n\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\nmilliseconds_in_a_day := ((1000 * 60) * 60) * 24\n\neval(iam_service_account_key) = \"skip\" if {\n\tiam_service_account_key.disabled\n} else = \"pass\" if {\n\t(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90\n} else = \"fail\"\n\n# This part remains unchanged for all rules\nresults contains result if {\n\tsome resource in input.resources[input.main_resource_type]\n\tresult := dd_output.format(resource, eval(resource))\n}\n",
"resourceTypes": [
"gcp_compute_disk"
]
}
}
},
"message": "ddd",
"tags": [
"my:tag"
],
"complianceSignalOptions": {
"userActivationStatus": true,
"userGroupByFields": [
"@account_id"
]
},
"filters": [
{
"action": "require",
"query": "resource_id:helo*"
},
{
"action": "suppress",
"query": "control:helo*"
}
]
}
EOFCreate a detection rule returns "OK" response
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"queries": [
{
"query": "@test:true",
"aggregation": "count",
"groupByFields": [],
"distinctFields": [],
"metric": ""
}
],
"filters": [],
"cases": [
{
"name": "",
"status": "info",
"condition": "a > 0",
"notifications": []
}
],
"options": {
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400
},
"message": "Test rule",
"tags": [],
"isEnabled": true,
"type": "log_detection",
"referenceTables": [
{
"tableName": "synthetics_test_reference_table_dont_delete",
"columnName": "value",
"logFieldPath": "testtag",
"checkPresence": true,
"ruleQueryName": "a"
}
]
}
EOF# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"queries": [
{
"query": "@test:true",
"aggregation": "count",
"groupByFields": [],
"distinctFields": [],
"metric": ""
}
],
"filters": [],
"cases": [
{
"name": "",
"status": "info",
"condition": "a > 0",
"notifications": []
}
],
"options": {
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400
},
"message": "Test rule",
"tags": [],
"isEnabled": true,
"type": "log_detection",
"referenceTables": [
{
"tableName": "synthetics_test_reference_table_dont_delete",
"columnName": "value",
"logFieldPath": "testtag",
"checkPresence": true,
"ruleQueryName": "a"
}
]
}
EOF# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"queries": [
{
"query": "@test:true",
"aggregation": "count",
"groupByFields": [],
"distinctFields": [],
"metric": ""
}
],
"filters": [],
"cases": [
{
"name": "",
"status": "info",
"condition": "a > 0",
"notifications": []
}
],
"options": {
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400
},
"message": "Test rule",
"tags": [],
"isEnabled": true,
"type": "log_detection",
"referenceTables": [
{
"tableName": "synthetics_test_reference_table_dont_delete",
"columnName": "value",
"logFieldPath": "testtag",
"checkPresence": true,
"ruleQueryName": "a"
}
]
}
EOF# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"queries": [
{
"query": "@test:true",
"aggregation": "count",
"groupByFields": [],
"distinctFields": [],
"metric": ""
}
],
"filters": [],
"cases": [
{
"name": "",
"status": "info",
"condition": "a > 0",
"notifications": []
}
],
"options": {
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400
},
"message": "Test rule",
"tags": [],
"isEnabled": true,
"type": "log_detection",
"referenceTables": [
{
"tableName": "synthetics_test_reference_table_dont_delete",
"columnName": "value",
"logFieldPath": "testtag",
"checkPresence": true,
"ruleQueryName": "a"
}
]
}
EOF# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"queries": [
{
"query": "@test:true",
"aggregation": "count",
"groupByFields": [],
"distinctFields": [],
"metric": ""
}
],
"filters": [],
"cases": [
{
"name": "",
"status": "info",
"condition": "a > 0",
"notifications": []
}
],
"options": {
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400
},
"message": "Test rule",
"tags": [],
"isEnabled": true,
"type": "log_detection",
"referenceTables": [
{
"tableName": "synthetics_test_reference_table_dont_delete",
"columnName": "value",
"logFieldPath": "testtag",
"checkPresence": true,
"ruleQueryName": "a"
}
]
}
EOF# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"queries": [
{
"query": "@test:true",
"aggregation": "count",
"groupByFields": [],
"distinctFields": [],
"metric": ""
}
],
"filters": [],
"cases": [
{
"name": "",
"status": "info",
"condition": "a > 0",
"notifications": []
}
],
"options": {
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400
},
"message": "Test rule",
"tags": [],
"isEnabled": true,
"type": "log_detection",
"referenceTables": [
{
"tableName": "synthetics_test_reference_table_dont_delete",
"columnName": "value",
"logFieldPath": "testtag",
"checkPresence": true,
"ruleQueryName": "a"
}
]
}
EOF# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"queries": [
{
"query": "@test:true",
"aggregation": "count",
"groupByFields": [],
"distinctFields": [],
"metric": ""
}
],
"filters": [],
"cases": [
{
"name": "",
"status": "info",
"condition": "a > 0",
"notifications": []
}
],
"options": {
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400
},
"message": "Test rule",
"tags": [],
"isEnabled": true,
"type": "log_detection",
"referenceTables": [
{
"tableName": "synthetics_test_reference_table_dont_delete",
"columnName": "value",
"logFieldPath": "testtag",
"checkPresence": true,
"ruleQueryName": "a"
}
]
}
EOF# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"queries": [
{
"query": "@test:true",
"aggregation": "count",
"groupByFields": [],
"distinctFields": [],
"metric": ""
}
],
"filters": [],
"cases": [
{
"name": "",
"status": "info",
"condition": "a > 0",
"notifications": []
}
],
"options": {
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400
},
"message": "Test rule",
"tags": [],
"isEnabled": true,
"type": "log_detection",
"referenceTables": [
{
"tableName": "synthetics_test_reference_table_dont_delete",
"columnName": "value",
"logFieldPath": "testtag",
"checkPresence": true,
"ruleQueryName": "a"
}
]
}
EOF# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"queries": [
{
"query": "@test:true",
"aggregation": "count",
"groupByFields": [],
"distinctFields": [],
"metric": ""
}
],
"filters": [],
"cases": [
{
"name": "",
"status": "info",
"condition": "a > 0",
"notifications": []
}
],
"options": {
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400
},
"message": "Test rule",
"tags": [],
"isEnabled": true,
"type": "log_detection",
"referenceTables": [
{
"tableName": "synthetics_test_reference_table_dont_delete",
"columnName": "value",
"logFieldPath": "testtag",
"checkPresence": true,
"ruleQueryName": "a"
}
]
}
EOFCreate a detection rule with detection method 'anomaly_detection' returns "OK" response
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"type": "log_detection",
"isEnabled": true,
"queries": [
{
"aggregation": "count",
"dataSource": "logs",
"distinctFields": [],
"groupByFields": [
"@usr.email",
"@network.client.ip"
],
"hasOptionalGroupByFields": false,
"name": "",
"query": "service:app status:error"
}
],
"cases": [
{
"name": "",
"status": "info",
"notifications": [],
"condition": "a > 0.995"
}
],
"message": "An anomaly detection rule",
"options": {
"detectionMethod": "anomaly_detection",
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400,
"anomalyDetectionOptions": {
"bucketDuration": 300,
"learningDuration": 24,
"detectionTolerance": 3,
"learningPeriodBaseline": 10
}
},
"tags": [],
"filters": []
}
EOF# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"type": "log_detection",
"isEnabled": true,
"queries": [
{
"aggregation": "count",
"dataSource": "logs",
"distinctFields": [],
"groupByFields": [
"@usr.email",
"@network.client.ip"
],
"hasOptionalGroupByFields": false,
"name": "",
"query": "service:app status:error"
}
],
"cases": [
{
"name": "",
"status": "info",
"notifications": [],
"condition": "a > 0.995"
}
],
"message": "An anomaly detection rule",
"options": {
"detectionMethod": "anomaly_detection",
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400,
"anomalyDetectionOptions": {
"bucketDuration": 300,
"learningDuration": 24,
"detectionTolerance": 3,
"learningPeriodBaseline": 10
}
},
"tags": [],
"filters": []
}
EOF# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"type": "log_detection",
"isEnabled": true,
"queries": [
{
"aggregation": "count",
"dataSource": "logs",
"distinctFields": [],
"groupByFields": [
"@usr.email",
"@network.client.ip"
],
"hasOptionalGroupByFields": false,
"name": "",
"query": "service:app status:error"
}
],
"cases": [
{
"name": "",
"status": "info",
"notifications": [],
"condition": "a > 0.995"
}
],
"message": "An anomaly detection rule",
"options": {
"detectionMethod": "anomaly_detection",
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400,
"anomalyDetectionOptions": {
"bucketDuration": 300,
"learningDuration": 24,
"detectionTolerance": 3,
"learningPeriodBaseline": 10
}
},
"tags": [],
"filters": []
}
EOF# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"type": "log_detection",
"isEnabled": true,
"queries": [
{
"aggregation": "count",
"dataSource": "logs",
"distinctFields": [],
"groupByFields": [
"@usr.email",
"@network.client.ip"
],
"hasOptionalGroupByFields": false,
"name": "",
"query": "service:app status:error"
}
],
"cases": [
{
"name": "",
"status": "info",
"notifications": [],
"condition": "a > 0.995"
}
],
"message": "An anomaly detection rule",
"options": {
"detectionMethod": "anomaly_detection",
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400,
"anomalyDetectionOptions": {
"bucketDuration": 300,
"learningDuration": 24,
"detectionTolerance": 3,
"learningPeriodBaseline": 10
}
},
"tags": [],
"filters": []
}
EOF# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"type": "log_detection",
"isEnabled": true,
"queries": [
{
"aggregation": "count",
"dataSource": "logs",
"distinctFields": [],
"groupByFields": [
"@usr.email",
"@network.client.ip"
],
"hasOptionalGroupByFields": false,
"name": "",
"query": "service:app status:error"
}
],
"cases": [
{
"name": "",
"status": "info",
"notifications": [],
"condition": "a > 0.995"
}
],
"message": "An anomaly detection rule",
"options": {
"detectionMethod": "anomaly_detection",
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400,
"anomalyDetectionOptions": {
"bucketDuration": 300,
"learningDuration": 24,
"detectionTolerance": 3,
"learningPeriodBaseline": 10
}
},
"tags": [],
"filters": []
}
EOF# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"type": "log_detection",
"isEnabled": true,
"queries": [
{
"aggregation": "count",
"dataSource": "logs",
"distinctFields": [],
"groupByFields": [
"@usr.email",
"@network.client.ip"
],
"hasOptionalGroupByFields": false,
"name": "",
"query": "service:app status:error"
}
],
"cases": [
{
"name": "",
"status": "info",
"notifications": [],
"condition": "a > 0.995"
}
],
"message": "An anomaly detection rule",
"options": {
"detectionMethod": "anomaly_detection",
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400,
"anomalyDetectionOptions": {
"bucketDuration": 300,
"learningDuration": 24,
"detectionTolerance": 3,
"learningPeriodBaseline": 10
}
},
"tags": [],
"filters": []
}
EOF# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"type": "log_detection",
"isEnabled": true,
"queries": [
{
"aggregation": "count",
"dataSource": "logs",
"distinctFields": [],
"groupByFields": [
"@usr.email",
"@network.client.ip"
],
"hasOptionalGroupByFields": false,
"name": "",
"query": "service:app status:error"
}
],
"cases": [
{
"name": "",
"status": "info",
"notifications": [],
"condition": "a > 0.995"
}
],
"message": "An anomaly detection rule",
"options": {
"detectionMethod": "anomaly_detection",
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400,
"anomalyDetectionOptions": {
"bucketDuration": 300,
"learningDuration": 24,
"detectionTolerance": 3,
"learningPeriodBaseline": 10
}
},
"tags": [],
"filters": []
}
EOF# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"type": "log_detection",
"isEnabled": true,
"queries": [
{
"aggregation": "count",
"dataSource": "logs",
"distinctFields": [],
"groupByFields": [
"@usr.email",
"@network.client.ip"
],
"hasOptionalGroupByFields": false,
"name": "",
"query": "service:app status:error"
}
],
"cases": [
{
"name": "",
"status": "info",
"notifications": [],
"condition": "a > 0.995"
}
],
"message": "An anomaly detection rule",
"options": {
"detectionMethod": "anomaly_detection",
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400,
"anomalyDetectionOptions": {
"bucketDuration": 300,
"learningDuration": 24,
"detectionTolerance": 3,
"learningPeriodBaseline": 10
}
},
"tags": [],
"filters": []
}
EOF# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"name": "Example-Security-Monitoring",
"type": "log_detection",
"isEnabled": true,
"queries": [
{
"aggregation": "count",
"dataSource": "logs",
"distinctFields": [],
"groupByFields": [
"@usr.email",
"@network.client.ip"
],
"hasOptionalGroupByFields": false,
"name": "",
"query": "service:app status:error"
}
],
"cases": [
{
"name": "",
"status": "info",
"notifications": [],
"condition": "a > 0.995"
}
],
"message": "An anomaly detection rule",
"options": {
"detectionMethod": "anomaly_detection",
"evaluationWindow": 900,
"keepAlive": 3600,
"maxSignalDuration": 86400,
"anomalyDetectionOptions": {
"bucketDuration": 300,
"learningDuration": 24,
"detectionTolerance": 3,
"learningPeriodBaseline": 10
}
},
"tags": [],
"filters": []
}
EOFCreate a cloud_configuration rule returns "OK" response
// Create a cloud_configuration rule returns "OK" response
package main
import (
"context"
"encoding/json"
"fmt"
"os"
"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
)
func main() {
body := datadogV2.SecurityMonitoringRuleCreatePayload{
CloudConfigurationRuleCreatePayload: &datadogV2.CloudConfigurationRuleCreatePayload{
Type: datadogV2.CLOUDCONFIGURATIONRULETYPE_CLOUD_CONFIGURATION.Ptr(),
Name: "Example-Security-Monitoring_cloud",
IsEnabled: false,
Cases: []datadogV2.CloudConfigurationRuleCaseCreate{
{
Status: datadogV2.SECURITYMONITORINGRULESEVERITY_INFO,
Notifications: []string{
"channel",
},
},
},
Options: datadogV2.CloudConfigurationRuleOptions{
ComplianceRuleOptions: datadogV2.CloudConfigurationComplianceRuleOptions{
ResourceType: datadog.PtrString("gcp_compute_disk"),
ComplexRule: datadog.PtrBool(false),
RegoRule: &datadogV2.CloudConfigurationRegoRule{
Policy: `package datadog
import data.datadog.output as dd_output
import future.keywords.contains
import future.keywords.if
import future.keywords.in
milliseconds_in_a_day := ((1000 * 60) * 60) * 24
eval(iam_service_account_key) = "skip" if {
iam_service_account_key.disabled
} else = "pass" if {
(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90
} else = "fail"
# This part remains unchanged for all rules
results contains result if {
some resource in input.resources[input.main_resource_type]
result := dd_output.format(resource, eval(resource))
}
`,
ResourceTypes: []string{
"gcp_compute_disk",
},
},
},
},
Message: "ddd",
Tags: []string{
"my:tag",
},
ComplianceSignalOptions: datadogV2.CloudConfigurationRuleComplianceSignalOptions{
UserActivationStatus: *datadog.NewNullableBool(datadog.PtrBool(true)),
UserGroupByFields: *datadog.NewNullableList(&[]string{
"@account_id",
}),
},
Filters: []datadogV2.SecurityMonitoringFilter{
{
Action: datadogV2.SECURITYMONITORINGFILTERACTION_REQUIRE.Ptr(),
Query: datadog.PtrString("resource_id:helo*"),
},
{
Action: datadogV2.SECURITYMONITORINGFILTERACTION_SUPPRESS.Ptr(),
Query: datadog.PtrString("control:helo*"),
},
},
}}
ctx := datadog.NewDefaultContext(context.Background())
ctx = context.WithValue(ctx, datadog.ContextAccessToken, os.Getenv("DD_BEARER_TOKEN"))
configuration := datadog.NewConfiguration()
apiClient := datadog.NewAPIClient(configuration)
api := datadogV2.NewSecurityMonitoringApi(apiClient)
resp, r, err := api.CreateSecurityMonitoringRule(ctx, body)
if err != nil {
fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.CreateSecurityMonitoringRule`: %v\n", err)
fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
}
responseContent, _ := json.MarshalIndent(resp, "", " ")
fmt.Fprintf(os.Stdout, "Response from `SecurityMonitoringApi.CreateSecurityMonitoringRule`:\n%s\n", responseContent)
}
Create a detection rule returns "OK" response
// Create a detection rule returns "OK" response
package main
import (
"context"
"encoding/json"
"fmt"
"os"
"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
)
func main() {
body := datadogV2.SecurityMonitoringRuleCreatePayload{
SecurityMonitoringStandardRuleCreatePayload: &datadogV2.SecurityMonitoringStandardRuleCreatePayload{
Name: "Example-Security-Monitoring",
Queries: []datadogV2.SecurityMonitoringStandardRuleQuery{
{
Query: datadog.PtrString("@test:true"),
Aggregation: datadogV2.SECURITYMONITORINGRULEQUERYAGGREGATION_COUNT.Ptr(),
GroupByFields: []string{},
DistinctFields: []string{},
Metric: datadog.PtrString(""),
},
},
Filters: []datadogV2.SecurityMonitoringFilter{},
Cases: []datadogV2.SecurityMonitoringRuleCaseCreate{
{
Name: datadog.PtrString(""),
Status: datadogV2.SECURITYMONITORINGRULESEVERITY_INFO,
Condition: datadog.PtrString("a > 0"),
Notifications: []string{},
},
},
Options: datadogV2.SecurityMonitoringRuleOptions{
EvaluationWindow: datadogV2.SECURITYMONITORINGRULEEVALUATIONWINDOW_FIFTEEN_MINUTES.Ptr(),
KeepAlive: datadogV2.SECURITYMONITORINGRULEKEEPALIVE_ONE_HOUR.Ptr(),
MaxSignalDuration: datadogV2.SECURITYMONITORINGRULEMAXSIGNALDURATION_ONE_DAY.Ptr(),
},
Message: "Test rule",
Tags: []string{},
IsEnabled: true,
Type: datadogV2.SECURITYMONITORINGRULETYPECREATE_LOG_DETECTION.Ptr(),
ReferenceTables: []datadogV2.SecurityMonitoringReferenceTable{
{
TableName: datadog.PtrString("synthetics_test_reference_table_dont_delete"),
ColumnName: datadog.PtrString("value"),
LogFieldPath: datadog.PtrString("testtag"),
CheckPresence: datadog.PtrBool(true),
RuleQueryName: datadog.PtrString("a"),
},
},
}}
ctx := datadog.NewDefaultContext(context.Background())
ctx = context.WithValue(ctx, datadog.ContextAccessToken, os.Getenv("DD_BEARER_TOKEN"))
configuration := datadog.NewConfiguration()
apiClient := datadog.NewAPIClient(configuration)
api := datadogV2.NewSecurityMonitoringApi(apiClient)
resp, r, err := api.CreateSecurityMonitoringRule(ctx, body)
if err != nil {
fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.CreateSecurityMonitoringRule`: %v\n", err)
fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
}
responseContent, _ := json.MarshalIndent(resp, "", " ")
fmt.Fprintf(os.Stdout, "Response from `SecurityMonitoringApi.CreateSecurityMonitoringRule`:\n%s\n", responseContent)
}
Create a detection rule with detection method 'anomaly_detection' returns "OK" response
// Create a detection rule with detection method 'anomaly_detection' returns "OK" response
package main
import (
"context"
"encoding/json"
"fmt"
"os"
"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
)
func main() {
body := datadogV2.SecurityMonitoringRuleCreatePayload{
SecurityMonitoringStandardRuleCreatePayload: &datadogV2.SecurityMonitoringStandardRuleCreatePayload{
Name: "Example-Security-Monitoring",
Type: datadogV2.SECURITYMONITORINGRULETYPECREATE_LOG_DETECTION.Ptr(),
IsEnabled: true,
Queries: []datadogV2.SecurityMonitoringStandardRuleQuery{
{
Aggregation: datadogV2.SECURITYMONITORINGRULEQUERYAGGREGATION_COUNT.Ptr(),
DataSource: datadogV2.SECURITYMONITORINGSTANDARDDATASOURCE_LOGS.Ptr(),
DistinctFields: []string{},
GroupByFields: []string{
"@usr.email",
"@network.client.ip",
},
HasOptionalGroupByFields: datadog.PtrBool(false),
Name: datadog.PtrString(""),
Query: datadog.PtrString("service:app status:error"),
},
},
Cases: []datadogV2.SecurityMonitoringRuleCaseCreate{
{
Name: datadog.PtrString(""),
Status: datadogV2.SECURITYMONITORINGRULESEVERITY_INFO,
Notifications: []string{},
Condition: datadog.PtrString("a > 0.995"),
},
},
Message: "An anomaly detection rule",
Options: datadogV2.SecurityMonitoringRuleOptions{
DetectionMethod: datadogV2.SECURITYMONITORINGRULEDETECTIONMETHOD_ANOMALY_DETECTION.Ptr(),
EvaluationWindow: datadogV2.SECURITYMONITORINGRULEEVALUATIONWINDOW_FIFTEEN_MINUTES.Ptr(),
KeepAlive: datadogV2.SECURITYMONITORINGRULEKEEPALIVE_ONE_HOUR.Ptr(),
MaxSignalDuration: datadogV2.SECURITYMONITORINGRULEMAXSIGNALDURATION_ONE_DAY.Ptr(),
AnomalyDetectionOptions: &datadogV2.SecurityMonitoringRuleAnomalyDetectionOptions{
BucketDuration: datadogV2.SECURITYMONITORINGRULEANOMALYDETECTIONOPTIONSBUCKETDURATION_FIVE_MINUTES.Ptr(),
LearningDuration: datadogV2.SECURITYMONITORINGRULEANOMALYDETECTIONOPTIONSLEARNINGDURATION_ONE_DAY.Ptr(),
DetectionTolerance: datadogV2.SECURITYMONITORINGRULEANOMALYDETECTIONOPTIONSDETECTIONTOLERANCE_THREE.Ptr(),
LearningPeriodBaseline: datadog.PtrInt64(10),
},
},
Tags: []string{},
Filters: []datadogV2.SecurityMonitoringFilter{},
}}
ctx := datadog.NewDefaultContext(context.Background())
ctx = context.WithValue(ctx, datadog.ContextAccessToken, os.Getenv("DD_BEARER_TOKEN"))
configuration := datadog.NewConfiguration()
apiClient := datadog.NewAPIClient(configuration)
api := datadogV2.NewSecurityMonitoringApi(apiClient)
resp, r, err := api.CreateSecurityMonitoringRule(ctx, body)
if err != nil {
fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.CreateSecurityMonitoringRule`: %v\n", err)
fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
}
responseContent, _ := json.MarshalIndent(resp, "", " ")
fmt.Fprintf(os.Stdout, "Response from `SecurityMonitoringApi.CreateSecurityMonitoringRule`:\n%s\n", responseContent)
}
Instructions
First install the library and its dependencies and then save the example to main.go and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"Create a cloud_configuration rule returns "OK" response
// Create a cloud_configuration rule returns "OK" response
import com.datadog.api.client.ApiClient;
import com.datadog.api.client.ApiException;
import com.datadog.api.client.v2.api.SecurityMonitoringApi;
import com.datadog.api.client.v2.model.CloudConfigurationComplianceRuleOptions;
import com.datadog.api.client.v2.model.CloudConfigurationRegoRule;
import com.datadog.api.client.v2.model.CloudConfigurationRuleCaseCreate;
import com.datadog.api.client.v2.model.CloudConfigurationRuleComplianceSignalOptions;
import com.datadog.api.client.v2.model.CloudConfigurationRuleCreatePayload;
import com.datadog.api.client.v2.model.CloudConfigurationRuleOptions;
import com.datadog.api.client.v2.model.CloudConfigurationRuleType;
import com.datadog.api.client.v2.model.SecurityMonitoringFilter;
import com.datadog.api.client.v2.model.SecurityMonitoringFilterAction;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleCreatePayload;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleResponse;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleSeverity;
import java.util.Arrays;
import java.util.Collections;
public class Example {
public static void main(String[] args) {
ApiClient defaultClient = ApiClient.getDefaultApiClient();
defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN"));
SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient);
SecurityMonitoringRuleCreatePayload body =
new SecurityMonitoringRuleCreatePayload(
new CloudConfigurationRuleCreatePayload()
.type(CloudConfigurationRuleType.CLOUD_CONFIGURATION)
.name("Example-Security-Monitoring_cloud")
.isEnabled(false)
.cases(
Collections.singletonList(
new CloudConfigurationRuleCaseCreate()
.status(SecurityMonitoringRuleSeverity.INFO)
.notifications(Collections.singletonList("channel"))))
.options(
new CloudConfigurationRuleOptions()
.complianceRuleOptions(
new CloudConfigurationComplianceRuleOptions()
.resourceType("gcp_compute_disk")
.complexRule(false)
.regoRule(
new CloudConfigurationRegoRule()
.policy(
"""
package datadog
import data.datadog.output as dd_output
import future.keywords.contains
import future.keywords.if
import future.keywords.in
milliseconds_in_a_day := ((1000 * 60) * 60) * 24
eval(iam_service_account_key) = "skip" if {
iam_service_account_key.disabled
} else = "pass" if {
(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90
} else = "fail"
# This part remains unchanged for all rules
results contains result if {
some resource in input.resources[input.main_resource_type]
result := dd_output.format(resource, eval(resource))
}
""")
.resourceTypes(
Collections.singletonList("gcp_compute_disk")))))
.message("ddd")
.tags(Collections.singletonList("my:tag"))
.complianceSignalOptions(
new CloudConfigurationRuleComplianceSignalOptions()
.userActivationStatus(true)
.userGroupByFields(Collections.singletonList("@account_id")))
.filters(
Arrays.asList(
new SecurityMonitoringFilter()
.action(SecurityMonitoringFilterAction.REQUIRE)
.query("resource_id:helo*"),
new SecurityMonitoringFilter()
.action(SecurityMonitoringFilterAction.SUPPRESS)
.query("control:helo*"))));
try {
SecurityMonitoringRuleResponse result = apiInstance.createSecurityMonitoringRule(body);
System.out.println(result);
} catch (ApiException e) {
System.err.println(
"Exception when calling SecurityMonitoringApi#createSecurityMonitoringRule");
System.err.println("Status code: " + e.getCode());
System.err.println("Reason: " + e.getResponseBody());
System.err.println("Response headers: " + e.getResponseHeaders());
e.printStackTrace();
}
}
}
Create a detection rule returns "OK" response
// Create a detection rule returns "OK" response
import com.datadog.api.client.ApiClient;
import com.datadog.api.client.ApiException;
import com.datadog.api.client.v2.api.SecurityMonitoringApi;
import com.datadog.api.client.v2.model.SecurityMonitoringReferenceTable;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleCaseCreate;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleCreatePayload;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleEvaluationWindow;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleKeepAlive;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleMaxSignalDuration;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleOptions;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleQueryAggregation;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleResponse;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleSeverity;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleTypeCreate;
import com.datadog.api.client.v2.model.SecurityMonitoringStandardRuleCreatePayload;
import com.datadog.api.client.v2.model.SecurityMonitoringStandardRuleQuery;
import java.util.Collections;
public class Example {
public static void main(String[] args) {
ApiClient defaultClient = ApiClient.getDefaultApiClient();
defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN"));
SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient);
SecurityMonitoringRuleCreatePayload body =
new SecurityMonitoringRuleCreatePayload(
new SecurityMonitoringStandardRuleCreatePayload()
.name("Example-Security-Monitoring")
.queries(
Collections.singletonList(
new SecurityMonitoringStandardRuleQuery()
.query("@test:true")
.aggregation(SecurityMonitoringRuleQueryAggregation.COUNT)
.metric("")))
.cases(
Collections.singletonList(
new SecurityMonitoringRuleCaseCreate()
.name("")
.status(SecurityMonitoringRuleSeverity.INFO)
.condition("a > 0")))
.options(
new SecurityMonitoringRuleOptions()
.evaluationWindow(SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES)
.keepAlive(SecurityMonitoringRuleKeepAlive.ONE_HOUR)
.maxSignalDuration(SecurityMonitoringRuleMaxSignalDuration.ONE_DAY))
.message("Test rule")
.isEnabled(true)
.type(SecurityMonitoringRuleTypeCreate.LOG_DETECTION)
.referenceTables(
Collections.singletonList(
new SecurityMonitoringReferenceTable()
.tableName("synthetics_test_reference_table_dont_delete")
.columnName("value")
.logFieldPath("testtag")
.checkPresence(true)
.ruleQueryName("a"))));
try {
SecurityMonitoringRuleResponse result = apiInstance.createSecurityMonitoringRule(body);
System.out.println(result);
} catch (ApiException e) {
System.err.println(
"Exception when calling SecurityMonitoringApi#createSecurityMonitoringRule");
System.err.println("Status code: " + e.getCode());
System.err.println("Reason: " + e.getResponseBody());
System.err.println("Response headers: " + e.getResponseHeaders());
e.printStackTrace();
}
}
}
Create a detection rule with detection method 'anomaly_detection' returns "OK" response
// Create a detection rule with detection method 'anomaly_detection' returns "OK" response
import com.datadog.api.client.ApiClient;
import com.datadog.api.client.ApiException;
import com.datadog.api.client.v2.api.SecurityMonitoringApi;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleAnomalyDetectionOptions;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleCaseCreate;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleCreatePayload;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleDetectionMethod;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleEvaluationWindow;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleKeepAlive;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleMaxSignalDuration;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleOptions;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleQueryAggregation;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleResponse;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleSeverity;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleTypeCreate;
import com.datadog.api.client.v2.model.SecurityMonitoringStandardDataSource;
import com.datadog.api.client.v2.model.SecurityMonitoringStandardRuleCreatePayload;
import com.datadog.api.client.v2.model.SecurityMonitoringStandardRuleQuery;
import java.util.Arrays;
import java.util.Collections;
public class Example {
public static void main(String[] args) {
ApiClient defaultClient = ApiClient.getDefaultApiClient();
defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN"));
SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient);
SecurityMonitoringRuleCreatePayload body =
new SecurityMonitoringRuleCreatePayload(
new SecurityMonitoringStandardRuleCreatePayload()
.name("Example-Security-Monitoring")
.type(SecurityMonitoringRuleTypeCreate.LOG_DETECTION)
.isEnabled(true)
.queries(
Collections.singletonList(
new SecurityMonitoringStandardRuleQuery()
.aggregation(SecurityMonitoringRuleQueryAggregation.COUNT)
.dataSource(SecurityMonitoringStandardDataSource.LOGS)
.groupByFields(Arrays.asList("@usr.email", "@network.client.ip"))
.hasOptionalGroupByFields(false)
.name("")
.query("service:app status:error")))
.cases(
Collections.singletonList(
new SecurityMonitoringRuleCaseCreate()
.name("")
.status(SecurityMonitoringRuleSeverity.INFO)
.condition("a > 0.995")))
.message("An anomaly detection rule")
.options(
new SecurityMonitoringRuleOptions()
.detectionMethod(SecurityMonitoringRuleDetectionMethod.ANOMALY_DETECTION)
.evaluationWindow(SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES)
.keepAlive(SecurityMonitoringRuleKeepAlive.ONE_HOUR)
.maxSignalDuration(SecurityMonitoringRuleMaxSignalDuration.ONE_DAY)
.anomalyDetectionOptions(
new SecurityMonitoringRuleAnomalyDetectionOptions()
.bucketDuration(
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration
.FIVE_MINUTES)
.learningDuration(
SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration
.ONE_DAY)
.detectionTolerance(
SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance
.THREE)
.learningPeriodBaseline(10L))));
try {
SecurityMonitoringRuleResponse result = apiInstance.createSecurityMonitoringRule(body);
System.out.println(result);
} catch (ApiException e) {
System.err.println(
"Exception when calling SecurityMonitoringApi#createSecurityMonitoringRule");
System.err.println("Status code: " + e.getCode());
System.err.println("Reason: " + e.getResponseBody());
System.err.println("Response headers: " + e.getResponseHeaders());
e.printStackTrace();
}
}
}
Instructions
First install the library and its dependencies and then save the example to Example.java and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"Create a cloud_configuration rule returns "OK" response
"""
Create a cloud_configuration rule returns "OK" response
"""
from os import environ
from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
from datadog_api_client.v2.model.cloud_configuration_compliance_rule_options import (
CloudConfigurationComplianceRuleOptions,
)
from datadog_api_client.v2.model.cloud_configuration_rego_rule import CloudConfigurationRegoRule
from datadog_api_client.v2.model.cloud_configuration_rule_case_create import CloudConfigurationRuleCaseCreate
from datadog_api_client.v2.model.cloud_configuration_rule_compliance_signal_options import (
CloudConfigurationRuleComplianceSignalOptions,
)
from datadog_api_client.v2.model.cloud_configuration_rule_create_payload import CloudConfigurationRuleCreatePayload
from datadog_api_client.v2.model.cloud_configuration_rule_options import CloudConfigurationRuleOptions
from datadog_api_client.v2.model.cloud_configuration_rule_type import CloudConfigurationRuleType
from datadog_api_client.v2.model.security_monitoring_filter import SecurityMonitoringFilter
from datadog_api_client.v2.model.security_monitoring_filter_action import SecurityMonitoringFilterAction
from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity
body = CloudConfigurationRuleCreatePayload(
type=CloudConfigurationRuleType.CLOUD_CONFIGURATION,
name="Example-Security-Monitoring_cloud",
is_enabled=False,
cases=[
CloudConfigurationRuleCaseCreate(
status=SecurityMonitoringRuleSeverity.INFO,
notifications=[
"channel",
],
),
],
options=CloudConfigurationRuleOptions(
compliance_rule_options=CloudConfigurationComplianceRuleOptions(
resource_type="gcp_compute_disk",
complex_rule=False,
rego_rule=CloudConfigurationRegoRule(
policy='package datadog\n\nimport data.datadog.output as dd_output\n\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\nmilliseconds_in_a_day := ((1000 * 60) * 60) * 24\n\neval(iam_service_account_key) = "skip" if {\n\tiam_service_account_key.disabled\n} else = "pass" if {\n\t(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90\n} else = "fail"\n\n# This part remains unchanged for all rules\nresults contains result if {\n\tsome resource in input.resources[input.main_resource_type]\n\tresult := dd_output.format(resource, eval(resource))\n}\n',
resource_types=[
"gcp_compute_disk",
],
),
),
),
message="ddd",
tags=[
"my:tag",
],
compliance_signal_options=CloudConfigurationRuleComplianceSignalOptions(
user_activation_status=True,
user_group_by_fields=[
"@account_id",
],
),
filters=[
SecurityMonitoringFilter(
action=SecurityMonitoringFilterAction.REQUIRE,
query="resource_id:helo*",
),
SecurityMonitoringFilter(
action=SecurityMonitoringFilterAction.SUPPRESS,
query="control:helo*",
),
],
)
configuration = Configuration()
configuration.access_token = environ["DD_BEARER_TOKEN"]
with ApiClient(configuration) as api_client:
api_instance = SecurityMonitoringApi(api_client)
response = api_instance.create_security_monitoring_rule(body=body)
print(response)
Create a detection rule returns "OK" response
"""
Create a detection rule returns "OK" response
"""
from os import environ
from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
from datadog_api_client.v2.model.security_monitoring_reference_table import SecurityMonitoringReferenceTable
from datadog_api_client.v2.model.security_monitoring_rule_case_create import SecurityMonitoringRuleCaseCreate
from datadog_api_client.v2.model.security_monitoring_rule_evaluation_window import (
SecurityMonitoringRuleEvaluationWindow,
)
from datadog_api_client.v2.model.security_monitoring_rule_keep_alive import SecurityMonitoringRuleKeepAlive
from datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration import (
SecurityMonitoringRuleMaxSignalDuration,
)
from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions
from datadog_api_client.v2.model.security_monitoring_rule_query_aggregation import (
SecurityMonitoringRuleQueryAggregation,
)
from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity
from datadog_api_client.v2.model.security_monitoring_rule_type_create import SecurityMonitoringRuleTypeCreate
from datadog_api_client.v2.model.security_monitoring_standard_rule_create_payload import (
SecurityMonitoringStandardRuleCreatePayload,
)
from datadog_api_client.v2.model.security_monitoring_standard_rule_query import SecurityMonitoringStandardRuleQuery
body = SecurityMonitoringStandardRuleCreatePayload(
name="Example-Security-Monitoring",
queries=[
SecurityMonitoringStandardRuleQuery(
query="@test:true",
aggregation=SecurityMonitoringRuleQueryAggregation.COUNT,
group_by_fields=[],
distinct_fields=[],
metric="",
),
],
filters=[],
cases=[
SecurityMonitoringRuleCaseCreate(
name="",
status=SecurityMonitoringRuleSeverity.INFO,
condition="a > 0",
notifications=[],
),
],
options=SecurityMonitoringRuleOptions(
evaluation_window=SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES,
keep_alive=SecurityMonitoringRuleKeepAlive.ONE_HOUR,
max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.ONE_DAY,
),
message="Test rule",
tags=[],
is_enabled=True,
type=SecurityMonitoringRuleTypeCreate.LOG_DETECTION,
reference_tables=[
SecurityMonitoringReferenceTable(
table_name="synthetics_test_reference_table_dont_delete",
column_name="value",
log_field_path="testtag",
check_presence=True,
rule_query_name="a",
),
],
)
configuration = Configuration()
configuration.access_token = environ["DD_BEARER_TOKEN"]
with ApiClient(configuration) as api_client:
api_instance = SecurityMonitoringApi(api_client)
response = api_instance.create_security_monitoring_rule(body=body)
print(response)
Create a detection rule with detection method 'anomaly_detection' returns "OK" response
"""
Create a detection rule with detection method 'anomaly_detection' returns "OK" response
"""
from os import environ
from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
from datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options import (
SecurityMonitoringRuleAnomalyDetectionOptions,
)
from datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options_bucket_duration import (
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration,
)
from datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options_detection_tolerance import (
SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance,
)
from datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options_learning_duration import (
SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration,
)
from datadog_api_client.v2.model.security_monitoring_rule_case_create import SecurityMonitoringRuleCaseCreate
from datadog_api_client.v2.model.security_monitoring_rule_detection_method import SecurityMonitoringRuleDetectionMethod
from datadog_api_client.v2.model.security_monitoring_rule_evaluation_window import (
SecurityMonitoringRuleEvaluationWindow,
)
from datadog_api_client.v2.model.security_monitoring_rule_keep_alive import SecurityMonitoringRuleKeepAlive
from datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration import (
SecurityMonitoringRuleMaxSignalDuration,
)
from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions
from datadog_api_client.v2.model.security_monitoring_rule_query_aggregation import (
SecurityMonitoringRuleQueryAggregation,
)
from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity
from datadog_api_client.v2.model.security_monitoring_rule_type_create import SecurityMonitoringRuleTypeCreate
from datadog_api_client.v2.model.security_monitoring_standard_data_source import SecurityMonitoringStandardDataSource
from datadog_api_client.v2.model.security_monitoring_standard_rule_create_payload import (
SecurityMonitoringStandardRuleCreatePayload,
)
from datadog_api_client.v2.model.security_monitoring_standard_rule_query import SecurityMonitoringStandardRuleQuery
body = SecurityMonitoringStandardRuleCreatePayload(
name="Example-Security-Monitoring",
type=SecurityMonitoringRuleTypeCreate.LOG_DETECTION,
is_enabled=True,
queries=[
SecurityMonitoringStandardRuleQuery(
aggregation=SecurityMonitoringRuleQueryAggregation.COUNT,
data_source=SecurityMonitoringStandardDataSource.LOGS,
distinct_fields=[],
group_by_fields=[
"@usr.email",
"@network.client.ip",
],
has_optional_group_by_fields=False,
name="",
query="service:app status:error",
),
],
cases=[
SecurityMonitoringRuleCaseCreate(
name="",
status=SecurityMonitoringRuleSeverity.INFO,
notifications=[],
condition="a > 0.995",
),
],
message="An anomaly detection rule",
options=SecurityMonitoringRuleOptions(
detection_method=SecurityMonitoringRuleDetectionMethod.ANOMALY_DETECTION,
evaluation_window=SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES,
keep_alive=SecurityMonitoringRuleKeepAlive.ONE_HOUR,
max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.ONE_DAY,
anomaly_detection_options=SecurityMonitoringRuleAnomalyDetectionOptions(
bucket_duration=SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration.FIVE_MINUTES,
learning_duration=SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration.ONE_DAY,
detection_tolerance=SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance.THREE,
learning_period_baseline=10,
),
),
tags=[],
filters=[],
)
configuration = Configuration()
configuration.access_token = environ["DD_BEARER_TOKEN"]
with ApiClient(configuration) as api_client:
api_instance = SecurityMonitoringApi(api_client)
response = api_instance.create_security_monitoring_rule(body=body)
print(response)
Instructions
First install the library and its dependencies and then save the example to example.py and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"Create a cloud_configuration rule returns "OK" response
# Create a cloud_configuration rule returns "OK" response
require "datadog_api_client"
DatadogAPIClient.configure do |config|
config.access_token = ENV["DD_BEARER_TOKEN"]
end
api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
body = DatadogAPIClient::V2::CloudConfigurationRuleCreatePayload.new({
type: DatadogAPIClient::V2::CloudConfigurationRuleType::CLOUD_CONFIGURATION,
name: "Example-Security-Monitoring_cloud",
is_enabled: false,
cases: [
DatadogAPIClient::V2::CloudConfigurationRuleCaseCreate.new({
status: DatadogAPIClient::V2::SecurityMonitoringRuleSeverity::INFO,
notifications: [
"channel",
],
}),
],
options: DatadogAPIClient::V2::CloudConfigurationRuleOptions.new({
compliance_rule_options: DatadogAPIClient::V2::CloudConfigurationComplianceRuleOptions.new({
resource_type: "gcp_compute_disk",
complex_rule: false,
rego_rule: DatadogAPIClient::V2::CloudConfigurationRegoRule.new({
policy: 'package datadog\n\nimport data.datadog.output as dd_output\n\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\nmilliseconds_in_a_day := ((1000 * 60) * 60) * 24\n\neval(iam_service_account_key) = "skip" if {\n\tiam_service_account_key.disabled\n} else = "pass" if {\n\t(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90\n} else = "fail"\n\n# This part remains unchanged for all rules\nresults contains result if {\n\tsome resource in input.resources[input.main_resource_type]\n\tresult := dd_output.format(resource, eval(resource))\n}\n',
resource_types: [
"gcp_compute_disk",
],
}),
}),
}),
message: "ddd",
tags: [
"my:tag",
],
compliance_signal_options: DatadogAPIClient::V2::CloudConfigurationRuleComplianceSignalOptions.new({
user_activation_status: true,
user_group_by_fields: [
"@account_id",
],
}),
filters: [
DatadogAPIClient::V2::SecurityMonitoringFilter.new({
action: DatadogAPIClient::V2::SecurityMonitoringFilterAction::REQUIRE,
query: "resource_id:helo*",
}),
DatadogAPIClient::V2::SecurityMonitoringFilter.new({
action: DatadogAPIClient::V2::SecurityMonitoringFilterAction::SUPPRESS,
query: "control:helo*",
}),
],
})
p api_instance.create_security_monitoring_rule(body)
Create a detection rule returns "OK" response
# Create a detection rule returns "OK" response
require "datadog_api_client"
DatadogAPIClient.configure do |config|
config.access_token = ENV["DD_BEARER_TOKEN"]
end
api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
body = DatadogAPIClient::V2::SecurityMonitoringStandardRuleCreatePayload.new({
name: "Example-Security-Monitoring",
queries: [
DatadogAPIClient::V2::SecurityMonitoringStandardRuleQuery.new({
query: "@test:true",
aggregation: DatadogAPIClient::V2::SecurityMonitoringRuleQueryAggregation::COUNT,
group_by_fields: [],
distinct_fields: [],
metric: "",
}),
],
filters: [],
cases: [
DatadogAPIClient::V2::SecurityMonitoringRuleCaseCreate.new({
name: "",
status: DatadogAPIClient::V2::SecurityMonitoringRuleSeverity::INFO,
condition: "a > 0",
notifications: [],
}),
],
options: DatadogAPIClient::V2::SecurityMonitoringRuleOptions.new({
evaluation_window: DatadogAPIClient::V2::SecurityMonitoringRuleEvaluationWindow::FIFTEEN_MINUTES,
keep_alive: DatadogAPIClient::V2::SecurityMonitoringRuleKeepAlive::ONE_HOUR,
max_signal_duration: DatadogAPIClient::V2::SecurityMonitoringRuleMaxSignalDuration::ONE_DAY,
}),
message: "Test rule",
tags: [],
is_enabled: true,
type: DatadogAPIClient::V2::SecurityMonitoringRuleTypeCreate::LOG_DETECTION,
reference_tables: [
DatadogAPIClient::V2::SecurityMonitoringReferenceTable.new({
table_name: "synthetics_test_reference_table_dont_delete",
column_name: "value",
log_field_path: "testtag",
check_presence: true,
rule_query_name: "a",
}),
],
})
p api_instance.create_security_monitoring_rule(body)
Create a detection rule with detection method 'anomaly_detection' returns "OK" response
# Create a detection rule with detection method 'anomaly_detection' returns "OK" response
require "datadog_api_client"
DatadogAPIClient.configure do |config|
config.access_token = ENV["DD_BEARER_TOKEN"]
end
api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
body = DatadogAPIClient::V2::SecurityMonitoringStandardRuleCreatePayload.new({
name: "Example-Security-Monitoring",
type: DatadogAPIClient::V2::SecurityMonitoringRuleTypeCreate::LOG_DETECTION,
is_enabled: true,
queries: [
DatadogAPIClient::V2::SecurityMonitoringStandardRuleQuery.new({
aggregation: DatadogAPIClient::V2::SecurityMonitoringRuleQueryAggregation::COUNT,
data_source: DatadogAPIClient::V2::SecurityMonitoringStandardDataSource::LOGS,
distinct_fields: [],
group_by_fields: [
"@usr.email",
"@network.client.ip",
],
has_optional_group_by_fields: false,
name: "",
query: "service:app status:error",
}),
],
cases: [
DatadogAPIClient::V2::SecurityMonitoringRuleCaseCreate.new({
name: "",
status: DatadogAPIClient::V2::SecurityMonitoringRuleSeverity::INFO,
notifications: [],
condition: "a > 0.995",
}),
],
message: "An anomaly detection rule",
options: DatadogAPIClient::V2::SecurityMonitoringRuleOptions.new({
detection_method: DatadogAPIClient::V2::SecurityMonitoringRuleDetectionMethod::ANOMALY_DETECTION,
evaluation_window: DatadogAPIClient::V2::SecurityMonitoringRuleEvaluationWindow::FIFTEEN_MINUTES,
keep_alive: DatadogAPIClient::V2::SecurityMonitoringRuleKeepAlive::ONE_HOUR,
max_signal_duration: DatadogAPIClient::V2::SecurityMonitoringRuleMaxSignalDuration::ONE_DAY,
anomaly_detection_options: DatadogAPIClient::V2::SecurityMonitoringRuleAnomalyDetectionOptions.new({
bucket_duration: DatadogAPIClient::V2::SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration::FIVE_MINUTES,
learning_duration: DatadogAPIClient::V2::SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration::ONE_DAY,
detection_tolerance: DatadogAPIClient::V2::SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance::THREE,
learning_period_baseline: 10,
}),
}),
tags: [],
filters: [],
})
p api_instance.create_security_monitoring_rule(body)
Instructions
First install the library and its dependencies and then save the example to example.rb and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"Create a cloud_configuration rule returns "OK" response
// Create a cloud_configuration rule returns "OK" response
use datadog_api_client::datadog;
use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;
use datadog_api_client::datadogV2::model::CloudConfigurationComplianceRuleOptions;
use datadog_api_client::datadogV2::model::CloudConfigurationRegoRule;
use datadog_api_client::datadogV2::model::CloudConfigurationRuleCaseCreate;
use datadog_api_client::datadogV2::model::CloudConfigurationRuleComplianceSignalOptions;
use datadog_api_client::datadogV2::model::CloudConfigurationRuleCreatePayload;
use datadog_api_client::datadogV2::model::CloudConfigurationRuleOptions;
use datadog_api_client::datadogV2::model::CloudConfigurationRuleType;
use datadog_api_client::datadogV2::model::SecurityMonitoringFilter;
use datadog_api_client::datadogV2::model::SecurityMonitoringFilterAction;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleCreatePayload;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleSeverity;
#[tokio::main]
async fn main() {
let body =
SecurityMonitoringRuleCreatePayload::CloudConfigurationRuleCreatePayload(
Box::new(
CloudConfigurationRuleCreatePayload::new(
vec![
CloudConfigurationRuleCaseCreate::new(
SecurityMonitoringRuleSeverity::INFO,
).notifications(vec!["channel".to_string()])
],
CloudConfigurationRuleComplianceSignalOptions::new()
.user_activation_status(Some(true))
.user_group_by_fields(Some(vec!["@account_id".to_string()])),
false,
"ddd".to_string(),
"Example-Security-Monitoring_cloud".to_string(),
CloudConfigurationRuleOptions::new(
CloudConfigurationComplianceRuleOptions::new()
.complex_rule(false)
.rego_rule(
CloudConfigurationRegoRule::new(
r#"package datadog
import data.datadog.output as dd_output
import future.keywords.contains
import future.keywords.if
import future.keywords.in
milliseconds_in_a_day := ((1000 * 60) * 60) * 24
eval(iam_service_account_key) = "skip" if {
iam_service_account_key.disabled
} else = "pass" if {
(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90
} else = "fail"
# This part remains unchanged for all rules
results contains result if {
some resource in input.resources[input.main_resource_type]
result := dd_output.format(resource, eval(resource))
}
"#.to_string(),
vec!["gcp_compute_disk".to_string()],
),
)
.resource_type("gcp_compute_disk".to_string()),
),
)
.filters(
vec![
SecurityMonitoringFilter::new()
.action(SecurityMonitoringFilterAction::REQUIRE)
.query("resource_id:helo*".to_string()),
SecurityMonitoringFilter::new()
.action(SecurityMonitoringFilterAction::SUPPRESS)
.query("control:helo*".to_string())
],
)
.tags(vec!["my:tag".to_string()])
.type_(CloudConfigurationRuleType::CLOUD_CONFIGURATION),
),
);
let configuration = datadog::Configuration::new();
let api = SecurityMonitoringAPI::with_config(configuration);
let resp = api.create_security_monitoring_rule(body).await;
if let Ok(value) = resp {
println!("{:#?}", value);
} else {
println!("{:#?}", resp.unwrap_err());
}
}
Create a detection rule returns "OK" response
// Create a detection rule returns "OK" response
use datadog_api_client::datadog;
use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;
use datadog_api_client::datadogV2::model::SecurityMonitoringReferenceTable;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleCaseCreate;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleCreatePayload;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleEvaluationWindow;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleKeepAlive;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleMaxSignalDuration;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleOptions;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleQueryAggregation;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleSeverity;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleTypeCreate;
use datadog_api_client::datadogV2::model::SecurityMonitoringStandardRuleCreatePayload;
use datadog_api_client::datadogV2::model::SecurityMonitoringStandardRuleQuery;
#[tokio::main]
async fn main() {
let body =
SecurityMonitoringRuleCreatePayload::SecurityMonitoringStandardRuleCreatePayload(Box::new(
SecurityMonitoringStandardRuleCreatePayload::new(
vec![
SecurityMonitoringRuleCaseCreate::new(SecurityMonitoringRuleSeverity::INFO)
.condition("a > 0".to_string())
.name("".to_string())
.notifications(vec![]),
],
true,
"Test rule".to_string(),
"Example-Security-Monitoring".to_string(),
SecurityMonitoringRuleOptions::new()
.evaluation_window(SecurityMonitoringRuleEvaluationWindow::FIFTEEN_MINUTES)
.keep_alive(SecurityMonitoringRuleKeepAlive::ONE_HOUR)
.max_signal_duration(SecurityMonitoringRuleMaxSignalDuration::ONE_DAY),
vec![SecurityMonitoringStandardRuleQuery::new()
.aggregation(SecurityMonitoringRuleQueryAggregation::COUNT)
.distinct_fields(vec![])
.group_by_fields(vec![])
.metric("".to_string())
.query("@test:true".to_string())],
)
.filters(vec![])
.reference_tables(vec![SecurityMonitoringReferenceTable::new()
.check_presence(true)
.column_name("value".to_string())
.log_field_path("testtag".to_string())
.rule_query_name("a".to_string())
.table_name("synthetics_test_reference_table_dont_delete".to_string())])
.tags(vec![])
.type_(SecurityMonitoringRuleTypeCreate::LOG_DETECTION),
));
let configuration = datadog::Configuration::new();
let api = SecurityMonitoringAPI::with_config(configuration);
let resp = api.create_security_monitoring_rule(body).await;
if let Ok(value) = resp {
println!("{:#?}", value);
} else {
println!("{:#?}", resp.unwrap_err());
}
}
Create a detection rule with detection method 'anomaly_detection' returns "OK" response
// Create a detection rule with detection method 'anomaly_detection' returns "OK"
// response
use datadog_api_client::datadog;
use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleAnomalyDetectionOptions;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleCaseCreate;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleCreatePayload;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleDetectionMethod;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleEvaluationWindow;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleKeepAlive;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleMaxSignalDuration;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleOptions;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleQueryAggregation;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleSeverity;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleTypeCreate;
use datadog_api_client::datadogV2::model::SecurityMonitoringStandardDataSource;
use datadog_api_client::datadogV2::model::SecurityMonitoringStandardRuleCreatePayload;
use datadog_api_client::datadogV2::model::SecurityMonitoringStandardRuleQuery;
#[tokio::main]
async fn main() {
let body =
SecurityMonitoringRuleCreatePayload::SecurityMonitoringStandardRuleCreatePayload(
Box::new(
SecurityMonitoringStandardRuleCreatePayload::new(
vec![
SecurityMonitoringRuleCaseCreate::new(SecurityMonitoringRuleSeverity::INFO)
.condition("a > 0.995".to_string())
.name("".to_string())
.notifications(vec![])
],
true,
"An anomaly detection rule".to_string(),
"Example-Security-Monitoring".to_string(),
SecurityMonitoringRuleOptions::new()
.anomaly_detection_options(
SecurityMonitoringRuleAnomalyDetectionOptions::new()
.bucket_duration(
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration::FIVE_MINUTES,
)
.detection_tolerance(
SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance::THREE,
)
.learning_duration(
SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration::ONE_DAY,
)
.learning_period_baseline(10),
)
.detection_method(SecurityMonitoringRuleDetectionMethod::ANOMALY_DETECTION)
.evaluation_window(SecurityMonitoringRuleEvaluationWindow::FIFTEEN_MINUTES)
.keep_alive(SecurityMonitoringRuleKeepAlive::ONE_HOUR)
.max_signal_duration(SecurityMonitoringRuleMaxSignalDuration::ONE_DAY),
vec![
SecurityMonitoringStandardRuleQuery::new()
.aggregation(SecurityMonitoringRuleQueryAggregation::COUNT)
.data_source(SecurityMonitoringStandardDataSource::LOGS)
.distinct_fields(vec![])
.group_by_fields(vec!["@usr.email".to_string(), "@network.client.ip".to_string()])
.has_optional_group_by_fields(false)
.name("".to_string())
.query("service:app status:error".to_string())
],
)
.filters(vec![])
.tags(vec![])
.type_(SecurityMonitoringRuleTypeCreate::LOG_DETECTION),
),
);
let configuration = datadog::Configuration::new();
let api = SecurityMonitoringAPI::with_config(configuration);
let resp = api.create_security_monitoring_rule(body).await;
if let Ok(value) = resp {
println!("{:#?}", value);
} else {
println!("{:#?}", resp.unwrap_err());
}
}
Instructions
First install the library and its dependencies and then save the example to src/main.rs and run following commands:
DD_SITE="datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="us3.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="us5.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="datadoghq.eu" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="ap1.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="ap2.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="uk1.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="us2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runCreate a cloud_configuration rule returns "OK" response
/**
* Create a cloud_configuration rule returns "OK" response
*/
import { client, v2 } from "@datadog/datadog-api-client";
const configuration = client.createConfiguration({
authMethods: {
AuthZ: {
accessToken: process.env.DD_BEARER_TOKEN as string,
},
},
});
const apiInstance = new v2.SecurityMonitoringApi(configuration);
const params: v2.SecurityMonitoringApiCreateSecurityMonitoringRuleRequest = {
body: {
type: "cloud_configuration",
name: "Example-Security-Monitoring_cloud",
isEnabled: false,
cases: [
{
status: "info",
notifications: ["channel"],
},
],
options: {
complianceRuleOptions: {
resourceType: "gcp_compute_disk",
complexRule: false,
regoRule: {
policy: `package datadog
import data.datadog.output as dd_output
import future.keywords.contains
import future.keywords.if
import future.keywords.in
milliseconds_in_a_day := ((1000 * 60) * 60) * 24
eval(iam_service_account_key) = "skip" if {
iam_service_account_key.disabled
} else = "pass" if {
(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90
} else = "fail"
# This part remains unchanged for all rules
results contains result if {
some resource in input.resources[input.main_resource_type]
result := dd_output.format(resource, eval(resource))
}
`,
resourceTypes: ["gcp_compute_disk"],
},
},
},
message: "ddd",
tags: ["my:tag"],
complianceSignalOptions: {
userActivationStatus: true,
userGroupByFields: ["@account_id"],
},
filters: [
{
action: "require",
query: "resource_id:helo*",
},
{
action: "suppress",
query: "control:helo*",
},
],
},
};
apiInstance
.createSecurityMonitoringRule(params)
.then((data: v2.SecurityMonitoringRuleResponse) => {
console.log(
"API called successfully. Returned data: " + JSON.stringify(data)
);
})
.catch((error: any) => console.error(error));
Create a detection rule returns "OK" response
/**
* Create a detection rule returns "OK" response
*/
import { client, v2 } from "@datadog/datadog-api-client";
const configuration = client.createConfiguration({
authMethods: {
AuthZ: {
accessToken: process.env.DD_BEARER_TOKEN as string,
},
},
});
const apiInstance = new v2.SecurityMonitoringApi(configuration);
const params: v2.SecurityMonitoringApiCreateSecurityMonitoringRuleRequest = {
body: {
name: "Example-Security-Monitoring",
queries: [
{
query: "@test:true",
aggregation: "count",
groupByFields: [],
distinctFields: [],
metric: "",
},
],
filters: [],
cases: [
{
name: "",
status: "info",
condition: "a > 0",
notifications: [],
},
],
options: {
evaluationWindow: 900,
keepAlive: 3600,
maxSignalDuration: 86400,
},
message: "Test rule",
tags: [],
isEnabled: true,
type: "log_detection",
referenceTables: [
{
tableName: "synthetics_test_reference_table_dont_delete",
columnName: "value",
logFieldPath: "testtag",
checkPresence: true,
ruleQueryName: "a",
},
],
},
};
apiInstance
.createSecurityMonitoringRule(params)
.then((data: v2.SecurityMonitoringRuleResponse) => {
console.log(
"API called successfully. Returned data: " + JSON.stringify(data)
);
})
.catch((error: any) => console.error(error));
Create a detection rule with detection method 'anomaly_detection' returns "OK" response
/**
* Create a detection rule with detection method 'anomaly_detection' returns "OK" response
*/
import { client, v2 } from "@datadog/datadog-api-client";
const configuration = client.createConfiguration({
authMethods: {
AuthZ: {
accessToken: process.env.DD_BEARER_TOKEN as string,
},
},
});
const apiInstance = new v2.SecurityMonitoringApi(configuration);
const params: v2.SecurityMonitoringApiCreateSecurityMonitoringRuleRequest = {
body: {
name: "Example-Security-Monitoring",
type: "log_detection",
isEnabled: true,
queries: [
{
aggregation: "count",
dataSource: "logs",
distinctFields: [],
groupByFields: ["@usr.email", "@network.client.ip"],
hasOptionalGroupByFields: false,
name: "",
query: "service:app status:error",
},
],
cases: [
{
name: "",
status: "info",
notifications: [],
condition: "a > 0.995",
},
],
message: "An anomaly detection rule",
options: {
detectionMethod: "anomaly_detection",
evaluationWindow: 900,
keepAlive: 3600,
maxSignalDuration: 86400,
anomalyDetectionOptions: {
bucketDuration: 300,
learningDuration: 24,
detectionTolerance: 3,
learningPeriodBaseline: 10,
},
},
tags: [],
filters: [],
},
};
apiInstance
.createSecurityMonitoringRule(params)
.then((data: v2.SecurityMonitoringRuleResponse) => {
console.log(
"API called successfully. Returned data: " + JSON.stringify(data)
);
})
.catch((error: any) => console.error(error));
Instructions
First install the library and its dependencies and then save the example to example.ts and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"