Tester une règle existante
https://api.datadoghq.com/api/v2/security_monitoring/rules/{rule_id}/testhttps://api.us3.datadoghq.com/api/v2/security_monitoring/rules/{rule_id}/testhttps://api.us5.datadoghq.com/api/v2/security_monitoring/rules/{rule_id}/testhttps://api.datadoghq.eu/api/v2/security_monitoring/rules/{rule_id}/testhttps://api.ap1.datadoghq.com/api/v2/security_monitoring/rules/{rule_id}/testhttps://api.ap2.datadoghq.com/api/v2/security_monitoring/rules/{rule_id}/testhttps://api.uk1.datadoghq.com/api/v2/security_monitoring/rules/{rule_id}/testhttps://api.ddog-gov.com/api/v2/security_monitoring/rules/{rule_id}/testhttps://api.us2.ddog-gov.com/api/v2/security_monitoring/rules/{rule_id}/testPrésentation
Testez une règle existante.
OAuth apps require the security_monitoring_rules_write authorization scope to access this endpoint.
Arguments
Paramètres du chemin
rule_id [required]The ID of the rule.
Requête
Body Data (required)
ruleTester les requêtes d'une règle (la propriété de règle est ignorée lorsqu'elle est appliquée à une règle existante)
<type=log_detection>The payload of a rule to test
calculatedFieldsCalculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.
expression [required]Expression.
name [required]Field name.
cases [required]Cases for generating signals.
actionsAction to perform for each rule case.
optionsOptions for the rule action
durationDuration of the action in seconds. 0 indicates no expiration.
flaggedIPTypeUsed with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses.
SUSPICIOUS, FLAGGEDuserBehaviorNameUsed with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
typeThe action type.
block_ip, block_user, user_behavior, flag_ipconditionA case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated
based on the event counts in the previously defined queries.
nameName of the case.
notificationsNotification targets.
status [required]Severity of the Security Signal.
info, low, medium, high, criticalfiltersAdditional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
actionThe type of filtering action.
require, suppressqueryQuery for selecting logs to apply the filtering action.
groupSignalsByAdditional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
hasExtendedTitleWhether the notifications include the triggering group-by values in their title.
isEnabled [required]Whether the rule is enabled.
message [required]Message for generated signals.
name [required]The name of the rule.
options [required]Options.
anomalyDetectionOptionsOptions on anomaly detection method.
bucketDurationDuration in seconds of the time buckets used to aggregate events matched by the rule. Must be greater than or equal to 300.
300, 600, 900, 1800, 3600, 10800detectionToleranceAn optional parameter that sets how permissive anomaly detection is. Higher values require higher deviations before triggering a signal.
1, 2, 3, 4, 5instantaneousBaselineWhen set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDurationLearning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating.
1, 6, 12, 24, 48, 168, 336learningPeriodBaselineAn optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0.
complianceRuleOptionsOptions for cloud_configuration rules.
Fields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRuleWhether the rule is a complex one.
Must be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
regoRuleRule details.
policy [required]The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/
resourceTypes [required]List of resource types that will be evaluated upon. Must have at least one element.
resourceTypeMain resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnvIf true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.
The severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.
The decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethodThe detection method.
threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party, anomaly_threshold, sequence_detectionevaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400hardcodedEvaluatorTypeHardcoded evaluator type.
log4shellimpossibleTravelOptionsOptions on impossible travel detection method.
baselineUserLocationsIf true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
baselineUserLocationsDurationThe duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations.
keepAliveOnce a signal is generated, the signal will remain "open" if a case is matched at least once within this keep alive window. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400maxSignalDurationA signal will "close" regardless of the query being matched once the time exceeds the maximum duration. This time is calculated from the first seen timestamp.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400newValueOptionsOptions on new value detection method.
forgetAfterThe duration in days after which a learned value is forgotten.
instantaneousBaselineWhen set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDurationThe duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
0learningMethodThe learning method used to determine when signals should be generated for values that weren't learned.
durationduration, thresholdlearningThresholdA number of occurrences after which signals will be generated for values that weren't learned.
00, 1sequenceDetectionOptionsOptions on sequence detection method.
stepTransitionsTransitions defining the allowed order of steps and their evaluation windows.
childName of the child step.
evaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400parentName of the parent step.
stepsSteps that define the conditions to be matched in sequence.
conditionCondition referencing rule queries (e.g., a > 0).
evaluationWindowA time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.
0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600Show 2 more
43200, 86400nameUnique name identifying the step.
thirdPartyRuleOptionsOptions on third party detection method.
defaultNotificationsNotification targets for the logs that do not correspond to any of the cases.
defaultStatusSeverity of the Security Signal.
info, low, medium, high, criticalrootQueriesQueries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
groupByFieldsFields to group by.
queryQuery to run on logs.
signalTitleTemplateA template for the signal title; if omitted, the title is generated based on the case name.
queries [required]Queries for selecting logs which are part of the rule.
aggregationThe aggregation type.
count, cardinality, sum, max, new_value, geo_data, event_count, nonecustomQueryExtensionQuery extension to append to the logs query.
dataSourceSource of events, either logs, audit trail, security signals, or Datadog events. app_sec_spans is deprecated in favor of spans.
logslogs, audit, app_sec_spans, spans, security_runtime, network, events, security_signalsdatasetIdsIDs of the datasets queried by the rule. Only used when queryLanguage is sql.
datasetVersionsVersion of each dataset used by the rule, keyed by dataset ID. Only used when queryLanguage is sql.
<any-key>Dataset version.
distinctFieldsField for which the cardinality is measured. Sent as an array.
groupByFieldsFields to group by.
hasOptionalGroupByFieldsWhen false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.
falseindexThis field is currently unstable and might be removed in a minor version upgrade.
The index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.
indexesList of indexes to query when the dataSource is logs. Only used for scheduled rules, such as when the schedulingOptions field is present in the rule payload.
metricDEPRECATED (Deprecated) The target field to aggregate over when using the sum or max
aggregations. metrics field should be used instead.
metricsGroup of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
nameName of the query.
queryQuery to run on logs.
queryLanguageLanguage of the query. Use sql for SQL-based rules over datasets. Defaults to event_query.
referenceTablesReference tables for the rule.
checkPresenceWhether to include or exclude the matched values.
columnNameThe name of the column in the reference table.
logFieldPathThe field in the log to match against the reference table.
ruleQueryNameThe name of the query to apply the reference table to.
tableNameThe name of the reference table.
schedulingOptionsOptions for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
startStart date for the schedule, in ISO 8601 format without timezone.
tagsTags for generated signals.
thirdPartyCasesCases for generating signals from third-party rules. Only available for third-party rules.
nameName of the case.
notificationsNotification targets for each case.
queryA query to map a third party event to this case.
status [required]Severity of the Security Signal.
info, low, medium, high, criticaltypeThe rule type.
log_detectionruleQueryPayloadsData payloads used to test rules query with the expected result.
expectedResultExpected result of the test.
indexIndex of the query under test.
payloadPayload used to test the rule query.
ddsourceSource of the payload.
ddtagsTags associated with your data.
hostnameThe name of the originating host of the log.
messageThe message of the payload.
serviceThe name of the application or service generating the data.
{
"rule": {
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule message.",
"name": "My security monitoring rule.",
"options": {
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 0,
"keepAlive": 0,
"maxSignalDuration": 0
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [
"@userIdentity.assumed_role"
],
"name": "",
"query": "source:source_here"
}
],
"tags": [
"env:prod",
"team:security"
],
"type": "log_detection"
},
"ruleQueryPayloads": [
{
"expectedResult": true,
"index": 0,
"payload": {
"ddsource": "source_here",
"ddtags": "env:staging,version:5.1",
"hostname": "i-012345678",
"message": "2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World",
"service": "payment",
"userIdentity": {
"assumed_role": "fake assumed_role"
}
}
}
]
}Réponse
OK
Result of the test of the rule queries.
resultsAssert results are returned in the same order as the rule query payloads. For each payload, it returns True if the result matched the expected result, False otherwise.
{
"results": []
}Bad Request
API error response.
errors [required]A list of errors.
{
"errors": [
"Bad Request"
]
}Concurrent Modification
API error response.
errors [required]A list of errors.
{
"errors": [
"Bad Request"
]
}Not Authorized
API error response.
errors [required]A list of errors.
{
"errors": [
"Bad Request"
]
}Not Found
API error response.
errors [required]A list of errors.
{
"errors": [
"Bad Request"
]
}Too many requests
API error response.
errors [required]A list of errors.
{
"errors": [
"Bad Request"
]
}Exemple de code
# Path parameters
export rule_id="CHANGE_ME"
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/${rule_id}/test" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"rule": {
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule message.",
"name": "My security monitoring rule.",
"options": {
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 0,
"keepAlive": 0,
"maxSignalDuration": 0
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [
"@userIdentity.assumed_role"
],
"name": "",
"query": "source:source_here"
}
],
"tags": [
"env:prod",
"team:security"
],
"type": "log_detection"
},
"ruleQueryPayloads": [
{
"expectedResult": true,
"index": 0,
"payload": {
"ddsource": "source_here",
"ddtags": "env:staging,version:5.1",
"hostname": "i-012345678",
"message": "2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World",
"service": "payment",
"userIdentity": {
"assumed_role": "fake assumed_role"
}
}
}
]
}
EOF# Path parameters
export rule_id="CHANGE_ME"
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/${rule_id}/test" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"rule": {
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule message.",
"name": "My security monitoring rule.",
"options": {
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 0,
"keepAlive": 0,
"maxSignalDuration": 0
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [
"@userIdentity.assumed_role"
],
"name": "",
"query": "source:source_here"
}
],
"tags": [
"env:prod",
"team:security"
],
"type": "log_detection"
},
"ruleQueryPayloads": [
{
"expectedResult": true,
"index": 0,
"payload": {
"ddsource": "source_here",
"ddtags": "env:staging,version:5.1",
"hostname": "i-012345678",
"message": "2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World",
"service": "payment",
"userIdentity": {
"assumed_role": "fake assumed_role"
}
}
}
]
}
EOF# Path parameters
export rule_id="CHANGE_ME"
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/${rule_id}/test" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"rule": {
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule message.",
"name": "My security monitoring rule.",
"options": {
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 0,
"keepAlive": 0,
"maxSignalDuration": 0
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [
"@userIdentity.assumed_role"
],
"name": "",
"query": "source:source_here"
}
],
"tags": [
"env:prod",
"team:security"
],
"type": "log_detection"
},
"ruleQueryPayloads": [
{
"expectedResult": true,
"index": 0,
"payload": {
"ddsource": "source_here",
"ddtags": "env:staging,version:5.1",
"hostname": "i-012345678",
"message": "2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World",
"service": "payment",
"userIdentity": {
"assumed_role": "fake assumed_role"
}
}
}
]
}
EOF# Path parameters
export rule_id="CHANGE_ME"
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/${rule_id}/test" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"rule": {
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule message.",
"name": "My security monitoring rule.",
"options": {
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 0,
"keepAlive": 0,
"maxSignalDuration": 0
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [
"@userIdentity.assumed_role"
],
"name": "",
"query": "source:source_here"
}
],
"tags": [
"env:prod",
"team:security"
],
"type": "log_detection"
},
"ruleQueryPayloads": [
{
"expectedResult": true,
"index": 0,
"payload": {
"ddsource": "source_here",
"ddtags": "env:staging,version:5.1",
"hostname": "i-012345678",
"message": "2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World",
"service": "payment",
"userIdentity": {
"assumed_role": "fake assumed_role"
}
}
}
]
}
EOF# Path parameters
export rule_id="CHANGE_ME"
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/${rule_id}/test" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"rule": {
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule message.",
"name": "My security monitoring rule.",
"options": {
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 0,
"keepAlive": 0,
"maxSignalDuration": 0
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [
"@userIdentity.assumed_role"
],
"name": "",
"query": "source:source_here"
}
],
"tags": [
"env:prod",
"team:security"
],
"type": "log_detection"
},
"ruleQueryPayloads": [
{
"expectedResult": true,
"index": 0,
"payload": {
"ddsource": "source_here",
"ddtags": "env:staging,version:5.1",
"hostname": "i-012345678",
"message": "2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World",
"service": "payment",
"userIdentity": {
"assumed_role": "fake assumed_role"
}
}
}
]
}
EOF# Path parameters
export rule_id="CHANGE_ME"
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/${rule_id}/test" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"rule": {
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule message.",
"name": "My security monitoring rule.",
"options": {
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 0,
"keepAlive": 0,
"maxSignalDuration": 0
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [
"@userIdentity.assumed_role"
],
"name": "",
"query": "source:source_here"
}
],
"tags": [
"env:prod",
"team:security"
],
"type": "log_detection"
},
"ruleQueryPayloads": [
{
"expectedResult": true,
"index": 0,
"payload": {
"ddsource": "source_here",
"ddtags": "env:staging,version:5.1",
"hostname": "i-012345678",
"message": "2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World",
"service": "payment",
"userIdentity": {
"assumed_role": "fake assumed_role"
}
}
}
]
}
EOF# Path parameters
export rule_id="CHANGE_ME"
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/${rule_id}/test" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"rule": {
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule message.",
"name": "My security monitoring rule.",
"options": {
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 0,
"keepAlive": 0,
"maxSignalDuration": 0
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [
"@userIdentity.assumed_role"
],
"name": "",
"query": "source:source_here"
}
],
"tags": [
"env:prod",
"team:security"
],
"type": "log_detection"
},
"ruleQueryPayloads": [
{
"expectedResult": true,
"index": 0,
"payload": {
"ddsource": "source_here",
"ddtags": "env:staging,version:5.1",
"hostname": "i-012345678",
"message": "2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World",
"service": "payment",
"userIdentity": {
"assumed_role": "fake assumed_role"
}
}
}
]
}
EOF# Path parameters
export rule_id="CHANGE_ME"
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/${rule_id}/test" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"rule": {
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule message.",
"name": "My security monitoring rule.",
"options": {
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 0,
"keepAlive": 0,
"maxSignalDuration": 0
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [
"@userIdentity.assumed_role"
],
"name": "",
"query": "source:source_here"
}
],
"tags": [
"env:prod",
"team:security"
],
"type": "log_detection"
},
"ruleQueryPayloads": [
{
"expectedResult": true,
"index": 0,
"payload": {
"ddsource": "source_here",
"ddtags": "env:staging,version:5.1",
"hostname": "i-012345678",
"message": "2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World",
"service": "payment",
"userIdentity": {
"assumed_role": "fake assumed_role"
}
}
}
]
}
EOF# Path parameters
export rule_id="CHANGE_ME"
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"
curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/rules/${rule_id}/test" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
"rule": {
"cases": [
{
"condition": "a > 0",
"name": "",
"notifications": [],
"status": "info"
}
],
"hasExtendedTitle": true,
"isEnabled": true,
"message": "My security monitoring rule message.",
"name": "My security monitoring rule.",
"options": {
"decreaseCriticalityBasedOnEnv": false,
"detectionMethod": "threshold",
"evaluationWindow": 0,
"keepAlive": 0,
"maxSignalDuration": 0
},
"queries": [
{
"aggregation": "count",
"distinctFields": [],
"groupByFields": [
"@userIdentity.assumed_role"
],
"name": "",
"query": "source:source_here"
}
],
"tags": [
"env:prod",
"team:security"
],
"type": "log_detection"
},
"ruleQueryPayloads": [
{
"expectedResult": true,
"index": 0,
"payload": {
"ddsource": "source_here",
"ddtags": "env:staging,version:5.1",
"hostname": "i-012345678",
"message": "2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World",
"service": "payment",
"userIdentity": {
"assumed_role": "fake assumed_role"
}
}
}
]
}
EOF// Test an existing rule returns "OK" response
package main
import (
"context"
"encoding/json"
"fmt"
"os"
"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
)
func main() {
body := datadogV2.SecurityMonitoringRuleTestRequest{
RuleQueryPayloads: []datadogV2.SecurityMonitoringRuleQueryPayload{
{
ExpectedResult: datadog.PtrBool(true),
Index: datadog.PtrInt64(0),
Payload: &datadogV2.SecurityMonitoringRuleQueryPayloadData{
Ddsource: datadog.PtrString("nginx"),
Ddtags: datadog.PtrString("env:staging,version:5.1"),
Hostname: datadog.PtrString("i-012345678"),
Message: datadog.PtrString("2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World"),
Service: datadog.PtrString("payment"),
},
},
},
}
ctx := datadog.NewDefaultContext(context.Background())
ctx = context.WithValue(ctx, datadog.ContextAccessToken, os.Getenv("DD_BEARER_TOKEN"))
configuration := datadog.NewConfiguration()
apiClient := datadog.NewAPIClient(configuration)
api := datadogV2.NewSecurityMonitoringApi(apiClient)
resp, r, err := api.TestExistingSecurityMonitoringRule(ctx, "rule_id", body)
if err != nil {
fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.TestExistingSecurityMonitoringRule`: %v\n", err)
fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
}
responseContent, _ := json.MarshalIndent(resp, "", " ")
fmt.Fprintf(os.Stdout, "Response from `SecurityMonitoringApi.TestExistingSecurityMonitoringRule`:\n%s\n", responseContent)
}
Instructions
First install the library and its dependencies and then save the example to main.go and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"// Test an existing rule returns "OK" response
import com.datadog.api.client.ApiClient;
import com.datadog.api.client.ApiException;
import com.datadog.api.client.v2.api.SecurityMonitoringApi;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleQueryPayload;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleQueryPayloadData;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleTestRequest;
import com.datadog.api.client.v2.model.SecurityMonitoringRuleTestResponse;
import java.util.Collections;
public class Example {
public static void main(String[] args) {
ApiClient defaultClient = ApiClient.getDefaultApiClient();
defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN"));
SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient);
SecurityMonitoringRuleTestRequest body =
new SecurityMonitoringRuleTestRequest()
.ruleQueryPayloads(
Collections.singletonList(
new SecurityMonitoringRuleQueryPayload()
.expectedResult(true)
.index(0L)
.payload(
new SecurityMonitoringRuleQueryPayloadData()
.ddsource("nginx")
.ddtags("env:staging,version:5.1")
.hostname("i-012345678")
.message(
"2019-11-19T14:37:58,995 INFO [process.name][20081] Hello"
+ " World")
.service("payment"))));
try {
SecurityMonitoringRuleTestResponse result =
apiInstance.testExistingSecurityMonitoringRule("rule_id", body);
System.out.println(result);
} catch (ApiException e) {
System.err.println(
"Exception when calling SecurityMonitoringApi#testExistingSecurityMonitoringRule");
System.err.println("Status code: " + e.getCode());
System.err.println("Reason: " + e.getResponseBody());
System.err.println("Response headers: " + e.getResponseHeaders());
e.printStackTrace();
}
}
}
Instructions
First install the library and its dependencies and then save the example to Example.java and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java""""
Test an existing rule returns "OK" response
"""
from os import environ
from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
from datadog_api_client.v2.model.security_monitoring_rule_query_payload import SecurityMonitoringRuleQueryPayload
from datadog_api_client.v2.model.security_monitoring_rule_query_payload_data import (
SecurityMonitoringRuleQueryPayloadData,
)
from datadog_api_client.v2.model.security_monitoring_rule_test_request import SecurityMonitoringRuleTestRequest
body = SecurityMonitoringRuleTestRequest(
rule_query_payloads=[
SecurityMonitoringRuleQueryPayload(
expected_result=True,
index=0,
payload=SecurityMonitoringRuleQueryPayloadData(
ddsource="nginx",
ddtags="env:staging,version:5.1",
hostname="i-012345678",
message="2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World",
service="payment",
),
),
],
)
configuration = Configuration()
configuration.access_token = environ["DD_BEARER_TOKEN"]
with ApiClient(configuration) as api_client:
api_instance = SecurityMonitoringApi(api_client)
response = api_instance.test_existing_security_monitoring_rule(rule_id="rule_id", body=body)
print(response)
Instructions
First install the library and its dependencies and then save the example to example.py and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"# Test an existing rule returns "OK" response
require "datadog_api_client"
DatadogAPIClient.configure do |config|
config.access_token = ENV["DD_BEARER_TOKEN"]
end
api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
body = DatadogAPIClient::V2::SecurityMonitoringRuleTestRequest.new({
rule_query_payloads: [
DatadogAPIClient::V2::SecurityMonitoringRuleQueryPayload.new({
expected_result: true,
index: 0,
payload: DatadogAPIClient::V2::SecurityMonitoringRuleQueryPayloadData.new({
ddsource: "nginx",
ddtags: "env:staging,version:5.1",
hostname: "i-012345678",
message: "2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World",
service: "payment",
}),
}),
],
})
p api_instance.test_existing_security_monitoring_rule("rule_id", body)
Instructions
First install the library and its dependencies and then save the example to example.rb and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"// Test an existing rule returns "OK" response
use datadog_api_client::datadog;
use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleQueryPayload;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleQueryPayloadData;
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleTestRequest;
#[tokio::main]
async fn main() {
let body = SecurityMonitoringRuleTestRequest::new().rule_query_payloads(vec![
SecurityMonitoringRuleQueryPayload::new()
.expected_result(true)
.index(0)
.payload(
SecurityMonitoringRuleQueryPayloadData::new()
.ddsource("nginx".to_string())
.ddtags("env:staging,version:5.1".to_string())
.hostname("i-012345678".to_string())
.message(
"2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World"
.to_string(),
)
.service("payment".to_string()),
),
]);
let configuration = datadog::Configuration::new();
let api = SecurityMonitoringAPI::with_config(configuration);
let resp = api
.test_existing_security_monitoring_rule("rule_id".to_string(), body)
.await;
if let Ok(value) = resp {
println!("{:#?}", value);
} else {
println!("{:#?}", resp.unwrap_err());
}
}
Instructions
First install the library and its dependencies and then save the example to src/main.rs and run following commands:
DD_SITE="datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="us3.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="us5.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="datadoghq.eu" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="ap1.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="ap2.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="uk1.datadoghq.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo runDD_SITE="us2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo run/**
* Test an existing rule returns "OK" response
*/
import { client, v2 } from "@datadog/datadog-api-client";
const configuration = client.createConfiguration({
authMethods: {
AuthZ: {
accessToken: process.env.DD_BEARER_TOKEN as string,
},
},
});
const apiInstance = new v2.SecurityMonitoringApi(configuration);
const params: v2.SecurityMonitoringApiTestExistingSecurityMonitoringRuleRequest =
{
body: {
ruleQueryPayloads: [
{
expectedResult: true,
index: 0,
payload: {
ddsource: "nginx",
ddtags: "env:staging,version:5.1",
hostname: "i-012345678",
message:
"2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World",
service: "payment",
},
},
],
},
ruleId: "rule_id",
};
apiInstance
.testExistingSecurityMonitoringRule(params)
.then((data: v2.SecurityMonitoringRuleTestResponse) => {
console.log(
"API called successfully. Returned data: " + JSON.stringify(data)
);
})
.catch((error: any) => console.error(error));
Instructions
First install the library and its dependencies and then save the example to example.ts and run following commands:
DD_SITE="datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="us3.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="us5.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="datadoghq.eu" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="ap1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="ap2.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="uk1.datadoghq.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"DD_SITE="us2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"