For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/fr/api/latest/security-monitoring/list-vulnerabilities.md. A documentation index is available at /llms.txt.
Language
Datadog site

Énumérer les vulnérabilités

WARNINGNote: This endpoint is deprecated. See the List Security Findings endpoint.
GEThttps://api.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.us3.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.us5.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.datadoghq.eu/api/v2/security/vulnerabilitieshttps://api.ap1.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.ap2.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.uk1.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.ddog-gov.com/api/v2/security/vulnerabilitieshttps://api.us2.ddog-gov.com/api/v2/security/vulnerabilities

Présentation

Récupérer une liste de vulnérabilités.

Pagination

La pagination est activée par défaut dans vulnerabilities et assets. La taille de la page varie selon l'endpoint et ne peut pas être modifiée. Pour automatiser la requête de la page suivante, vous pouvez utiliser la section links de la réponse.

Cet endpoint renvoie des réponses paginées. Les pages sont stockées dans la section links de la réponse :

{
 "data": [...],
 "meta": {...},
 "links": {
 "self": "https://.../api/v2/security/vulnerabilities",
 "first": "https://.../api/v2/security/vulnerabilities?page[number]=1&page[token]=abc",
 "last": "https://.../api/v2/security/vulnerabilities?page[number]=43&page[token]=abc",
 "next": "https://.../api/v2/security/vulnerabilities?page[number]=2&page[token]=abc"
 }
}
  • links.previous est vide si la première page est demandée.
  • links.next est vide si la dernière page est demandée.

Token

Les vulnérabilités peuvent être créées, mises à jour ou supprimées à tout moment.

Lors de la première requête, un token est créé pour assurer la cohérence entre les requêtes paginées suivantes.

Un token est valide uniquement pendant 24 heures.

Première requête

Une requête est considérée comme la première requête lorsqu'il n'y a pas de paramètre page[token].

La réponse de cette première requête contient le token nouvellement créé dans la section links.

Ce token peut ensuite être utilisé dans les requêtes paginées suivantes.

Remarque : la première requête peut prendre plus de temps à se terminer que les requêtes suivantes.

Requêtes suivantes

Toute requête contenant des paramètres page[token] et page[number] valides sera considérée comme une requête suivante.

Si le token est invalide, une réponse 404 sera renvoyée.

Si le numéro de page est invalide, une réponse 400 sera renvoyée.

Le token renvoyé est valide pour toutes les requêtes de la séquence de pagination. Pour envoyer des requêtes paginées en parallèle, réutilisez le même token et modifiez uniquement le paramètre page[number].

Filtrage

La requête peut inclure des paramètres de filtre pour filtrer les données à récupérer. Le format des paramètres de filtre suit le format JSON:API : filter[$prop_name], où prop_name est le nom de la propriété de l'entité filtrée.

Tous les filtres peuvent inclure plusieurs valeurs, les données étant filtrées avec une clause OR : filter[title]=Title1,Title2 filtrera toutes les vulnérabilités dont le titre est égal à Title1 OU Title2.

Les filtres de type chaîne de caractères sont sensibles à la casse.

Les filtres booléens acceptent true ou false comme valeurs.

Les filtres numériques doivent inclure un opérateur comme second paramètre de filtre : filter[$prop_name][$operator]. Par exemple, pour l'endpoint des vulnérabilités : filter[cvss.base.score][lte]=8.

Les opérateurs disponibles sont : eq (==), lt (<), lte (<=), gt (>) et gte (>=).

Métadonnées

Conformément au format JSON:API, l'objet inclut des méta-informations non standard.

Cet endpoint inclut le membre meta dans la réponse. Pour plus de détails sur chacune des propriétés incluses dans cette section, consultez les tableaux de réponse des endpoints.

{
 "data": [...],
 "meta": {
 "total": 1500,
 "count": 18732,
 "token": "some_token"
 },
 "links": {...}
}

Extensions

Les requêtes peuvent inclure des extensions pour modifier le comportement de l'endpoint demandé. Les paramètres de filtre suivent le format JSON:API extensions : ext:$extension_name, où extension_name est le nom du modificateur appliqué.

Les extensions ne peuvent inclure qu'une seule valeur : ext:modifier=value.

This endpoint requires the appsec_vm_read permission.

Arguments

Chaînes de requête

Name
Type
Description
page[token]
string

Its value must come from the links section of the response of the first request. Do not manually edit it.

page[number]
integer

The page number to be retrieved. It should be equal or greater than 1

filter[type]
enum

Filter by vulnerability type.

Allowed enum values: AdminConsoleActive, CodeInjection, CommandInjection, ComponentWithKnownVulnerability, DangerousWorkflows, DefaultAppDeployed, DefaultHtmlEscapeInvalid, DirectoryListingLeak, EmailHtmlInjection, EndOfLife
Show 34 moreHardcodedPassword, HardcodedSecret, HeaderInjection, HstsHeaderMissing, InsecureAuthProtocol, InsecureCookie, InsecureJspLayout, LdapInjection, MaliciousPackage, MandatoryRemediation, NoHttpOnlyCookie, NoSameSiteCookie, NoSqlMongoDbInjection, PathTraversal, ReflectionInjection, RiskyLicense, SessionRewriting, SessionRewritting, SessionTimeout, SqlInjection, Ssrf, StackTraceLeak, TemplateInjection, TrustBoundaryViolation, Unmaintained, UntrustedDeserialization, UnvalidatedRedirect, VerbTampering, WeakCipher, WeakHash, WeakRandomness, XContentTypeHeaderMissing, XPathInjection, Xss
filter[cvss.base.score][`$op`]
number

Filter by vulnerability base (i.e. from the original advisory) severity score.

filter[cvss.base.severity]
enum

Filter by vulnerability base severity.

Allowed enum values: Unknown, None, Low, Medium, High, Critical
filter[cvss.base.vector]
string

Filter by vulnerability base CVSS vector.

filter[cvss.datadog.score][`$op`]
number

Filter by vulnerability Datadog severity score.

filter[cvss.datadog.severity]
enum

Filter by vulnerability Datadog severity.

Allowed enum values: Unknown, None, Low, Medium, High, Critical
filter[cvss.datadog.vector]
string

Filter by vulnerability Datadog CVSS vector.

filter[status]
enum

Filter by the status of the vulnerability.

Allowed enum values: Open, Muted, Remediated, InProgress, AutoClosed
filter[tool]
enum

Filter by the tool of the vulnerability.

Allowed enum values: IAST, SCA, Infra, SAST
filter[library.name]
string

Filter by library name.

filter[library.version]
string

Filter by library version.

filter[advisory.id]
string

Filter by advisory ID.

filter[risks.exploitation_probability]
boolean

Filter by exploitation probability.

filter[risks.poc_exploit_available]
boolean

Filter by POC exploit availability.

filter[risks.exploit_available]
boolean

Filter by public exploit availability.

filter[risks.epss.score][`$op`]
number

Filter by vulnerability EPSS severity score.

filter[risks.epss.severity]
enum

Filter by vulnerability EPSS severity.

Allowed enum values: Unknown, None, Low, Medium, High, Critical
filter[language]
string

Filter by language.

filter[ecosystem]
enum

Filter by ecosystem.

Allowed enum values: PyPI, Maven, NuGet, Npm, RubyGems, Go, Packagist, Deb, Rpm, Apk
Show 6 moreWindows, Generic, MacOs, Oci, BottleRocket, None
filter[code_location.location]
string

Filter by vulnerability location.

filter[code_location.file_path]
string

Filter by vulnerability file path.

filter[code_location.method]
string

Filter by method.

filter[fix_available]
boolean

Filter by fix availability.

filter[repo_digests]
string

Filter by vulnerability repo_digest (when the vulnerability is related to Image asset).

filter[origin]
string

Filter by origin.

filter[running_kernel]
boolean

Filter for whether the vulnerability affects a running kernel (for vulnerabilities related to a Host asset).

filter[asset.name]
string

Filter by asset name. This field supports the usage of wildcards (*).

filter[asset.type]
enum

Filter by asset type.

Allowed enum values: Repository, Service, Host, HostImage, Image, ServerlessFunction
filter[asset.version.first]
string

Filter by the first version of the asset this vulnerability has been detected on.

filter[asset.version.last]
string

Filter by the last version of the asset this vulnerability has been detected on.

filter[asset.repository_url]
string

Filter by the repository url associated to the asset.

filter[asset.risks.in_production]
boolean

Filter whether the asset is in production or not.

filter[asset.risks.under_attack]
boolean

Filter whether the asset is under attack or not.

filter[asset.risks.is_publicly_accessible]
boolean

Filter whether the asset is publicly accessible or not.

filter[asset.risks.has_privileged_access]
boolean

Filter whether the asset is publicly accessible or not.

filter[asset.risks.has_access_to_sensitive_data]
boolean

Filter whether the asset has access to sensitive data or not.

filter[asset.environments]
string

Filter by asset environments.

filter[asset.teams]
string

Filter by asset teams.

filter[asset.arch]
string

Filter by asset architecture.

filter[asset.operating_system.name]
string

Filter by asset operating system name.

filter[asset.operating_system.version]
string

Filter by asset operating system version.

Réponse

OK

The expected response schema when listing vulnerabilities.

Champ
Type
Description
data [required]
[object]

List of vulnerabilities.

links
object

The JSON:API links related to pagination.

meta
object

The metadata related to this request.

Exemple de code

Énumérer les vulnérabilités
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"