For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/ko/api/latest/security-monitoring/get-an-indicator-of-compromise.md. A documentation index is available at /llms.txt.
homeHomedocs문서apiAPI
Language
Datadog site

침해 지표 가져오기

경고Note: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates.
GEThttps://api.datadoghq.com/api/v2/security/siem/ioc-explorer/indicatorhttps://api.us3.datadoghq.com/api/v2/security/siem/ioc-explorer/indicatorhttps://api.us5.datadoghq.com/api/v2/security/siem/ioc-explorer/indicatorhttps://api.datadoghq.eu/api/v2/security/siem/ioc-explorer/indicatorhttps://api.ap1.datadoghq.com/api/v2/security/siem/ioc-explorer/indicatorhttps://api.ap2.datadoghq.com/api/v2/security/siem/ioc-explorer/indicatorhttps://api.uk1.datadoghq.com/api/v2/security/siem/ioc-explorer/indicatorhttps://api.ddog-gov.com/api/v2/security/siem/ioc-explorer/indicatorhttps://api.us2.ddog-gov.com/api/v2/security/siem/ioc-explorer/indicator

개요

특정 IoC(침해 지표)에 대한 자세한 정보를 가져옵니다.

OAuth apps require the security_monitoring_signals_read authorization scope to access this endpoint.

인수

쿼리 문자열

이름
유형
설명
indicator [required]
string

The indicator value to look up (for example, an IP address or domain).

ocsf
boolean

When true, return only OCSF field-based matches. When false, return regex/message-based matches.

Default: true
include_triage_history
boolean

Include full triage history for the indicator.

Default: false
triage_history_limit
integer

Maximum number of triage history events returned. Only applied when include_triage_history is true.

Default: 50
triage_history_offset
integer

Pagination offset into the triage history. Only applied when include_triage_history is true.

Default: 0

응답

OK

Response for the get indicator of compromise endpoint.

항목
유형
설명
data
object

IoC indicator response data object.

코드 예시

침해 지표 가져오기
# Required query arguments
export indicator="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/indicator?indicator=${indicator}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export indicator="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/indicator?indicator=${indicator}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export indicator="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/indicator?indicator=${indicator}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export indicator="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/indicator?indicator=${indicator}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export indicator="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/indicator?indicator=${indicator}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export indicator="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/indicator?indicator=${indicator}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export indicator="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/indicator?indicator=${indicator}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export indicator="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/indicator?indicator=${indicator}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export indicator="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/siem/ioc-explorer/indicator?indicator=${indicator}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"