Datadog Rules API is one of 186 APIs that Datadog publishes on the APIs.io network, described by a machine-readable OpenAPI specification.
This API exposes 4 JSON Schema definitions.
Tagged areas include Rules. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, authentication docs, an API reference, and 4 JSON Schemas.
This API exposes
3 operations
across 3 paths,
and defines 64 schemas.
It is described by OpenAPI 3.2.0, at version 1.0.
Requests are made against 3 base URLs: https://{subdomain}.{site}, {protocol}://{name}, https://{subdomain}.{site}.
The identity and technical contract details declared by the specification.
SecurityMonitoringRuleImpossibleTravelOptions
object
Options on impossible travel detection method.
1 property
SensitiveDataScannerRuleRelationships
object
Relationships of a scanning rule.
2 properties
SecurityMonitoringRuleCaseActionType
string
The action type.
APIErrorResponse
object
API error response.
1 property
1 required
SecurityMonitoringThirdPartyRootQuery
object
A query to be combined with the third party case query.
2 properties
SecurityMonitoringRuleQueryAggregation
string
The aggregation type.
SecurityMonitoringRuleQueryPayload
object
Payload to test a rule query with the expected result.
3 properties
SecurityMonitoringRuleCaseAction
object
Action to perform when a signal is triggered. Only available for Application Security rule type.
2 properties
SecurityMonitoringUser
object
A user.
2 properties
SecurityMonitoringRuleOptions
object
Options.
10 properties
SecurityMonitoringRuleNewValueOptions
object
Options on new value detection method.
4 properties
SensitiveDataScannerStandardPattern
object
Data containing the standard pattern id.
2 properties
CloudConfigurationRegoRule
object
Rule details.
2 properties
2 required
SecurityMonitoringSuppressionResponse
object
Response object containing a single suppression rule.
1 property
SecurityMonitoringSuppressionUpdateRequest
object
Request object containing the fields to update on the suppression rule.
1 property
1 required
SecurityMonitoringRuleTestPayload
Test a rule.
SensitiveDataScannerTextReplacement
object
Object describing how the scanned event will be replaced.
3 properties
SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv
boolean
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise. The severity is dec…
SensitiveDataScannerGroupType
string
Sensitive Data Scanner group type.
SecurityMonitoringReferenceTable
object
Reference tables used in the queries.
5 properties
SecurityMonitoringSuppressionUpdateData
object
The new suppression properties; partial updates are supported.
2 properties
2 required
SecurityMonitoringSuppressionType
string
The type of the resource. The value should always be suppressions.
SecurityMonitoringRuleTestRequest
object
Test the rule queries of a rule (rule property is ignored when applied to an existing rule)
2 properties
SecurityMonitoringSuppressionAttributes
object
The attributes of the suppression rule.
14 properties
SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations
boolean
If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise a…
SecurityMonitoringFilter
object
The rule's suppression filter.
2 properties
SecurityMonitoringRuleCaseCreate
object
Case when signal is generated.
5 properties
1 required
SensitiveDataScannerStandardPatternType
string
Sensitive Data Scanner standard pattern type.
SensitiveDataScannerTextReplacementType
string
Type of the replacement text. None means no replacement. hash means the data will be stubbed. replacementstring means that one can chose a text to replace the…
SensitiveDataScannerGroupData
object
A scanning group data.
1 property
SecurityMonitoringThirdPartyRuleCaseCreate
object
Case when a signal is generated by a third party rule.
4 properties
1 required
SecurityMonitoringRuleNewValueOptionsLearningDuration
integer
The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be…
SensitiveDataScannerIncludedKeywordConfiguration
object
Object defining a set of keywords and a number of characters that help reduce noise. You can provide a list of keywords you would like to check within a define…
3 properties
2 required
SecurityMonitoringRuleEvaluationWindow
integer
A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection…
SecurityMonitoringRuleHardcodedEvaluatorType
string
Hardcoded evaluator type.
SecurityMonitoringSuppressionUpdateAttributes
object
The suppression rule properties to be updated.
9 properties
SensitiveDataScannerGroup
object
A scanning group.
2 properties
SensitiveDataScannerRuleType
string
Sensitive Data Scanner rule type.
SecurityMonitoringRuleTestResponse
object
Result of the test of the rule queries.
1 property
SecurityMonitoringRuleCaseActionOptionsUserBehaviorName
string
Used with the case action of type 'userbehavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
CloudConfigurationComplianceRuleOptions
object
Options for cloudconfiguration rules. Fields resourceType and regoRule are mandatory when managing custom cloudconfiguration rules.
3 properties
SecurityMonitoringRuleKeepAlive
integer
Once a signal is generated, the signal will remain "open" if a case is matched at least once within this keep alive window. For third party detection method, t…
SecurityMonitoringSuppression
object
The suppression rule's properties.
3 properties
SecurityMonitoringRuleDetectionMethod
string
The detection method.
SensitiveDataScannerRuleUpdateRequest
object
Update rule request.
2 properties
2 required
SecurityMonitoringRuleNewValueOptionsForgetAfter
integer
The duration in days after which a learned value is forgotten.
SecurityMonitoringRuleNewValueOptionsLearningThreshold
integer
A number of occurrences after which signals will be generated for values that weren't learned.
SecurityMonitoringFilterAction
string
The type of filtering action.
SecurityMonitoringRuleThirdPartyOptions
object
Options on third party detection method.
4 properties
SecurityMonitoringStandardRuleQuery
object
Query for matching rule.
9 properties
SecurityMonitoringStandardDataSource
string
Source of events, either logs, audit trail, or Datadog events.
SensitiveDataScannerMetaVersionOnly
object
Meta payload containing information about the API.
1 property
SecurityMonitoringSuppressionID
string
The ID of the suppression rule.
SensitiveDataScannerRuleUpdate
object
Data related to the update of a rule.
4 properties
SensitiveDataScannerRuleAttributes
object
Attributes of the Sensitive Data Scanner rule.
10 properties
SensitiveDataScannerRuleUpdateResponse
object
Update rule response.
1 property
SecurityMonitoringRuleNewValueOptionsLearningMethod
string
The learning method used to determine when signals should be generated for values that weren't learned.
SecurityMonitoringRuleTypeTest
string
The rule type.
SensitiveDataScannerStandardPatternData
object
A standard pattern.
1 property
SecurityMonitoringRuleSeverity
string
Severity of the Security Signal.
SecurityMonitoringRuleCaseActionOptions
object
Options for the rule action
2 properties
SecurityMonitoringRuleMaxSignalDuration
integer
A signal will "close" regardless of the query being matched once the time exceeds the maximum duration. This time is calculated from the first seen timestamp.
SecurityMonitoringRuleQueryPayloadData
object
Payload used to test the rule query.
5 properties
SecurityMonitoringStandardRuleTestPayload
object
The payload of a rule to test
13 properties
6 required
The full machine-readable OpenAPI contract behind this narrative.
Other APIs Datadog publishes across the network.
