For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/ko/api/latest/security-monitoring/create-or-update-an-indicator-triage-state.md. A documentation index is available at /llms.txt.
Language
Datadog site

지표 심사 상태 생성 또는 업데이트

경고Note: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates.
POSThttps://api.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.us3.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.us5.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.datadoghq.eu/api/v2/security/siem/ioc-explorer/triagehttps://api.ap1.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.ap2.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.uk1.datadoghq.com/api/v2/security/siem/ioc-explorer/triagehttps://api.ddog-gov.com/api/v2/security/siem/ioc-explorer/triagehttps://api.us2.ddog-gov.com/api/v2/security/siem/ioc-explorer/triage

개요

IoC(침해 지표)의 분류 상태를 설정합니다. 이 작업은 조직 내 지표에 대한 분류 상태 생성하거나 업데이트합니다.

OAuth apps require the security_monitoring_signals_write authorization scope to access this endpoint.

요청

Body Data (required)

지표에 대해 설정할 심사 상태입니다.

항목
유형
설명
data [required]
object

지표 심사 상태를 생성하거나 업데이트하기 위한 요청 본문입니다.

응답

Created

Response for the create indicator triage state endpoint.

항목
유형
설명
data
object

Data object of the triage write response.

코드 예시

Create or update an indicator triage state returns "Created" response
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/triage" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "reviewed"
    },
    "type": "ioc_triage_state"
  }
}
EOF