csm_threats_agent_rules

Creates, updates, deletes, gets or lists a csm_threats_agent_rules resource.

Overview

Name	csm_threats_agent_rules
Type	Resource
Id	datadog.remote_config.csm_threats_agent_rules

Fields

The following fields are returned by SELECT queries:

get_csmthreats_agent_rule

Name	Datatype	Description
id	string	The ID of the Agent rule (example: 3dd-0uc-h1s)
attributes	object	A Cloud Workload Security Agent rule returned by the API
type	string	The type of the resource, must always be agent_rule (agent_rule) (default: agent_rule, example: agent_rule)

list_csmthreats_agent_rules

Name	Datatype	Description
id	string	The ID of the Agent rule (example: 3dd-0uc-h1s)
attributes	object	A Cloud Workload Security Agent rule returned by the API
type	string	The type of the resource, must always be agent_rule (agent_rule) (default: agent_rule, example: agent_rule)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_csmthreats_agent_rule	select	agent_rule_id	policy_id	Get the details of a specific Workload Protection agent rule.<br /><br />Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.
list_csmthreats_agent_rules	select		policy_id	Get the list of Workload Protection agent rules.<br /><br />Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.
create_csmthreats_agent_rule	insert	data		Create a new Workload Protection agent rule with the given parameters.<br /><br />Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.
update_csmthreats_agent_rule	update	agent_rule_id, data	policy_id	Update a specific Workload Protection Agent rule.<br />Returns the agent rule object when the request is successful.<br /><br />Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.
delete_csmthreats_agent_rule	delete	agent_rule_id	policy_id	Delete a specific Workload Protection agent rule.<br /><br />Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
agent_rule_id	string	The ID of the Agent rule (example: 3b5-v82-ns6)
site	string	The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both.
policy_id	string	The ID of the Agent policy (example: 6517fcc1-cec7-4394-a655-8d6e9d085255)

SELECT examples

get_csmthreats_agent_rule

Get the details of a specific Workload Protection agent rule.<br /><br />Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.

SELECT
id,
attributes,
type
FROM datadog.remote_config.csm_threats_agent_rules
WHERE agent_rule_id = '{{ agent_rule_id }}' -- required
AND policy_id = '{{ policy_id }}'
;

list_csmthreats_agent_rules

Get the list of Workload Protection agent rules.<br /><br />Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.

SELECT
id,
attributes,
type
FROM datadog.remote_config.csm_threats_agent_rules
WHERE policy_id = '{{ policy_id }}'
;

INSERT examples

create_csmthreats_agent_rule

Create a new Workload Protection agent rule with the given parameters.<br /><br />Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.

INSERT INTO datadog.remote_config.csm_threats_agent_rules (
data
)
SELECT 
'{{ data }}' /* required */
RETURNING
data
;

Manifest

# Description fields are for documentation purposes
- name: csm_threats_agent_rules
props:
  - name: data
    description: |
      Object for a single Agent rule
    value:
      attributes:
        actions:
          - filter: "{{ filter }}"
            hash:
              field: "{{ field }}"
            kill:
              signal: "{{ signal }}"
            metadata:
              image_tag: "{{ image_tag }}"
              service: "{{ service }}"
              short_image: "{{ short_image }}"
            set:
              append: {{ append }}
              default_value: "{{ default_value }}"
              expression: "{{ expression }}"
              field: "{{ field }}"
              inherited: {{ inherited }}
              name: "{{ name }}"
              scope: "{{ scope }}"
              size: {{ size }}
              ttl: {{ ttl }}
              value: "{{ value }}"
        agent_version: "{{ agent_version }}"
        blocking:
          - "{{ blocking }}"
        description: "{{ description }}"
        disabled:
          - "{{ disabled }}"
        enabled: {{ enabled }}
        expression: "{{ expression }}"
        filters:
          - "{{ filters }}"
        monitoring:
          - "{{ monitoring }}"
        name: "{{ name }}"
        policy_id: "{{ policy_id }}"
        product_tags:
          - "{{ product_tags }}"
        silent: {{ silent }}
      type: "{{ type }}"

UPDATE examples

update_csmthreats_agent_rule

Update a specific Workload Protection Agent rule.<br />Returns the agent rule object when the request is successful.<br /><br />Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.

UPDATE datadog.remote_config.csm_threats_agent_rules
SET 
data = '{{ data }}'
WHERE 
agent_rule_id = '{{ agent_rule_id }}' --required
AND data = '{{ data }}' --required
AND policy_id = '{{ policy_id}}'
RETURNING
data;

DELETE examples

delete_csmthreats_agent_rule

Delete a specific Workload Protection agent rule.<br /><br />Note: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.

DELETE FROM datadog.remote_config.csm_threats_agent_rules
WHERE agent_rule_id = '{{ agent_rule_id }}' --required
AND policy_id = '{{ policy_id }}'
;