monitoring_datasets

Creates, updates, deletes, gets or lists a monitoring_datasets resource.

Overview

Name	monitoring_datasets
Type	Resource
Id	datadog.security.monitoring_datasets

Fields

The following fields are returned by SELECT queries:

get_security_monitoring_dataset

Name	Datatype	Description
id	string	The UUID of the dataset. (example: 123e4567-e89b-12d3-a456-426614174000)
attributes	object	The attributes of a Cloud SIEM dataset.
type	string	The type of resource for a dataset response. (dataset) (example: dataset)

list_security_monitoring_datasets

Name	Datatype	Description
id	string	The UUID of the dataset. (example: 123e4567-e89b-12d3-a456-426614174000)
attributes	object	The attributes of a Cloud SIEM dataset.
type	string	The type of resource for a dataset response. (dataset) (example: dataset)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_security_monitoring_dataset	select	dataset_id		Get the current version of a Cloud SIEM dataset by ID.
list_security_monitoring_datasets	select		page[size], page[number], sort, filter[query]	List all Cloud SIEM datasets available to the organization, including both<br />customer-defined datasets and Datadog out-of-the-box datasets.
create_security_monitoring_dataset	insert	data		Create a new Cloud SIEM dataset. A dataset bundles a data source, a set of<br />indexes, and a search query that can be referenced from detection rules.
update_security_monitoring_dataset	update	dataset_id, data		Update an existing Cloud SIEM dataset. The current version of the dataset can be<br />provided to detect concurrent modifications.
delete_security_monitoring_dataset	delete	dataset_id		Delete a Cloud SIEM dataset. Out-of-the-box datasets cannot be deleted and<br />deleting a dataset that is referenced by a detection rule is rejected.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
dataset_id	string	The UUID of the dataset.
site	string	The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both.
filter[query]	string	A search query to filter datasets by name or description.
page[number]	integer (int64)	Specific page number to return.
page[size]	integer (int64)	Size for a given page. The maximum allowed value is 100.
sort	string	Attribute used to sort datasets. Prefix with - to sort in descending order.

SELECT examples

get_security_monitoring_dataset

Get the current version of a Cloud SIEM dataset by ID.

SELECT
id,
attributes,
type
FROM datadog.security.monitoring_datasets
WHERE dataset_id = '{{ dataset_id }}' -- required
;

list_security_monitoring_datasets

List all Cloud SIEM datasets available to the organization, including both<br />customer-defined datasets and Datadog out-of-the-box datasets.

SELECT
id,
attributes,
type
FROM datadog.security.monitoring_datasets
WHERE page[size] = '{{ page[size] }}'
AND page[number] = '{{ page[number] }}'
AND sort = '{{ sort }}'
AND filter[query] = '{{ filter[query] }}'
;

INSERT examples

create_security_monitoring_dataset

Create a new Cloud SIEM dataset. A dataset bundles a data source, a set of<br />indexes, and a search query that can be referenced from detection rules.

INSERT INTO datadog.security.monitoring_datasets (
data
)
SELECT 
'{{ data }}' /* required */
RETURNING
data
;

Manifest

# Description fields are for documentation purposes
- name: monitoring_datasets
props:
  - name: data
    description: |
      The data wrapper of a dataset create request.
    value:
      attributes:
        definition:
          columns:
            - column: "{{ column }}"
              type: "{{ type }}"
          data_source: "{{ data_source }}"
          indexes:
            - "{{ indexes }}"
          name: "{{ name }}"
          query_filter: "{{ query_filter }}"
          search:
            query: "{{ query }}"
          storage: "{{ storage }}"
          table_name: "{{ table_name }}"
          time_window:
            from: {{ from }}
            to: {{ to }}
        description: "{{ description }}"
        version: {{ version }}
      type: "{{ type }}"

UPDATE examples

update_security_monitoring_dataset

Update an existing Cloud SIEM dataset. The current version of the dataset can be<br />provided to detect concurrent modifications.

UPDATE datadog.security.monitoring_datasets
SET 
data = '{{ data }}'
WHERE 
dataset_id = '{{ dataset_id }}' --required
AND data = '{{ data }}' --required;

DELETE examples

delete_security_monitoring_dataset

Delete a Cloud SIEM dataset. Out-of-the-box datasets cannot be deleted and<br />deleting a dataset that is referenced by a detection rule is rejected.

DELETE FROM datadog.security.monitoring_datasets
WHERE dataset_id = '{{ dataset_id }}' --required
;