historical_jobs

Creates, updates, deletes, gets or lists a historical_jobs resource.

Overview

Name	historical_jobs
Type	Resource
Id	datadog.security.historical_jobs

Fields

The following fields are returned by SELECT queries:

get_historical_job

Name	Datatype	Description
id	string	ID of the job.
attributes	object	Historical job attributes.
type	string	Type of payload. (historicalDetectionsJob)

list_historical_jobs

Name	Datatype	Description
id	string	ID of the job.
attributes	object	Historical job attributes.
type	string	Type of payload. (historicalDetectionsJob)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_historical_job	select	job_id		Get a job's details.
list_historical_jobs	select		page[size], page[number], sort, filter[query]	List historical jobs.
run_historical_job	insert			Run a historical job.
cancel_historical_job	update	job_id		Cancel a historical job.
delete_historical_job	delete	job_id		Delete an existing job.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
job_id	string	The ID of the job.
site	string	The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both.
filter[query]	string	Query used to filter items from the fetched list. (example: security:attack status:high)
page[number]	integer (int64)	Specific page number to return.
page[size]	integer (int64)	Number of items to return per page. The maximum allowed value is 100.
sort	string	The order of the jobs in results. (example: status)

SELECT examples

get_historical_job

Get a job's details.

SELECT
id,
attributes,
type
FROM datadog.security.historical_jobs
WHERE job_id = '{{ job_id }}' -- required
;

list_historical_jobs

List historical jobs.

SELECT
id,
attributes,
type
FROM datadog.security.historical_jobs
WHERE page[size] = '{{ page[size] }}'
AND page[number] = '{{ page[number] }}'
AND sort = '{{ sort }}'
AND filter[query] = '{{ filter[query] }}'
;

INSERT examples

run_historical_job

Run a historical job.

INSERT INTO datadog.security.historical_jobs (
data
)
SELECT 
'{{ data }}'
RETURNING
data
;

Manifest

# Description fields are for documentation purposes
- name: historical_jobs
props:
  - name: data
    description: |
      Data for running a historical job request.
    value:
      attributes:
        fromRule:
          caseIndex: {{ caseIndex }}
          from: {{ from }}
          id: "{{ id }}"
          index: "{{ index }}"
          notifications:
            - "{{ notifications }}"
          to: {{ to }}
        jobDefinition:
          calculatedFields:
            - expression: "{{ expression }}"
              name: "{{ name }}"
          cases:
            - actions: "{{ actions }}"
              condition: "{{ condition }}"
              name: "{{ name }}"
              notifications: "{{ notifications }}"
              status: "{{ status }}"
          from: {{ from }}
          groupSignalsBy:
            - "{{ groupSignalsBy }}"
          index: "{{ index }}"
          message: "{{ message }}"
          name: "{{ name }}"
          options:
            anomalyDetectionOptions:
              bucketDuration: {{ bucketDuration }}
              detectionTolerance: {{ detectionTolerance }}
              instantaneousBaseline: {{ instantaneousBaseline }}
              learningDuration: {{ learningDuration }}
              learningPeriodBaseline: {{ learningPeriodBaseline }}
            detectionMethod: "{{ detectionMethod }}"
            evaluationWindow: {{ evaluationWindow }}
            impossibleTravelOptions:
              baselineUserLocations: {{ baselineUserLocations }}
              baselineUserLocationsDuration: {{ baselineUserLocationsDuration }}
            keepAlive: {{ keepAlive }}
            maxSignalDuration: {{ maxSignalDuration }}
            newValueOptions:
              forgetAfter: {{ forgetAfter }}
              instantaneousBaseline: {{ instantaneousBaseline }}
              learningDuration: {{ learningDuration }}
              learningMethod: "{{ learningMethod }}"
              learningThreshold: {{ learningThreshold }}
            sequenceDetectionOptions:
              stepTransitions: "{{ stepTransitions }}"
              steps: "{{ steps }}"
            thirdPartyRuleOptions:
              defaultNotifications: "{{ defaultNotifications }}"
              defaultStatus: "{{ defaultStatus }}"
              rootQueries: "{{ rootQueries }}"
              signalTitleTemplate: "{{ signalTitleTemplate }}"
          queries:
            - additionalFilters: "{{ additionalFilters }}"
              aggregation: "{{ aggregation }}"
              correlatedByFields: "{{ correlatedByFields }}"
              correlatedQueryIndex: {{ correlatedQueryIndex }}
              customQueryExtension: "{{ customQueryExtension }}"
              dataSource: "{{ dataSource }}"
              datasetIds: "{{ datasetIds }}"
              distinctFields: "{{ distinctFields }}"
              groupByFields: "{{ groupByFields }}"
              hasOptionalGroupByFields: {{ hasOptionalGroupByFields }}
              index: "{{ index }}"
              indexes: "{{ indexes }}"
              metrics: "{{ metrics }}"
              name: "{{ name }}"
              query: "{{ query }}"
              queryLanguage: "{{ queryLanguage }}"
          referenceTables:
            - checkPresence: {{ checkPresence }}
              columnName: "{{ columnName }}"
              logFieldPath: "{{ logFieldPath }}"
              ruleQueryName: "{{ ruleQueryName }}"
              tableName: "{{ tableName }}"
          tags:
            - "{{ tags }}"
          thirdPartyCases:
            - name: "{{ name }}"
              notifications: "{{ notifications }}"
              query: "{{ query }}"
              status: "{{ status }}"
          to: {{ to }}
          type: "{{ type }}"
        signalOutput: {{ signalOutput }}
      type: "{{ type }}"

UPDATE examples

cancel_historical_job

Cancel a historical job.

UPDATE datadog.security.historical_jobs
SET 
-- No updatable properties
WHERE 
job_id = '{{ job_id }}' --required;

DELETE examples

delete_historical_job

Delete an existing job.

DELETE FROM datadog.security.historical_jobs
WHERE job_id = '{{ job_id }}' --required
;