monitoring_hist_signals

Creates, updates, deletes, gets or lists a monitoring_hist_signals resource.

Overview

Name	monitoring_hist_signals
Type	Resource
Id	datadog.security.monitoring_hist_signals

Fields

The following fields are returned by SELECT queries:

get_security_monitoring_histsignal

Name	Datatype	Description
id	string	The unique ID of the security signal. (example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA)
attributes	object	The object containing all signal attributes and their associated values.
type	string	The type of event. (signal) (default: signal, example: signal)

get_security_monitoring_histsignals_by_job_id

Name	Datatype	Description
id	string	The unique ID of the security signal. (example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA)
attributes	object	The object containing all signal attributes and their associated values.
type	string	The type of event. (signal) (default: signal, example: signal)

list_security_monitoring_histsignals

Name	Datatype	Description
id	string	The unique ID of the security signal. (example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA)
attributes	object	The object containing all signal attributes and their associated values.
type	string	The type of event. (signal) (default: signal, example: signal)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_security_monitoring_histsignal	select	histsignal_id		Get a hist signal's details.
get_security_monitoring_histsignals_by_job_id	select	job_id	filter[query], filter[from], filter[to], sort, page[cursor], page[limit]	Get a job's hist signals.
list_security_monitoring_histsignals	select		filter[query], filter[from], filter[to], sort, page[cursor], page[limit]	List hist signals.
search_security_monitoring_histsignals	exec			Search hist signals.
convert_job_result_to_signal	exec			Convert a job result to a signal.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
histsignal_id	string	The ID of the historical signal.
job_id	string	The ID of the job.
site	string	The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both.
filter[from]	string (date-time)	The minimum timestamp for requested security signals. (example: 2019-01-02T09:42:36.320Z)
filter[query]	string	The search query for security signals. (example: security:attack status:high)
filter[to]	string (date-time)	The maximum timestamp for requested security signals. (example: 2019-01-03T09:42:36.320Z)
page[cursor]	string	A list of results using the cursor provided in the previous query. (example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==)
page[limit]	integer (int32)	The maximum number of security signals in the response. (example: 25)
sort	string	The order of the security signals in results.

SELECT examples

get_security_monitoring_histsignal

Get a hist signal's details.

SELECT
id,
attributes,
type
FROM datadog.security.monitoring_hist_signals
WHERE histsignal_id = '{{ histsignal_id }}' -- required
;

get_security_monitoring_histsignals_by_job_id

Get a job's hist signals.

SELECT
id,
attributes,
type
FROM datadog.security.monitoring_hist_signals
WHERE job_id = '{{ job_id }}' -- required
AND filter[query] = '{{ filter[query] }}'
AND filter[from] = '{{ filter[from] }}'
AND filter[to] = '{{ filter[to] }}'
AND sort = '{{ sort }}'
AND page[cursor] = '{{ page[cursor] }}'
AND page[limit] = '{{ page[limit] }}'
;

list_security_monitoring_histsignals

List hist signals.

SELECT
id,
attributes,
type
FROM datadog.security.monitoring_hist_signals
WHERE filter[query] = '{{ filter[query] }}'
AND filter[from] = '{{ filter[from] }}'
AND filter[to] = '{{ filter[to] }}'
AND sort = '{{ sort }}'
AND page[cursor] = '{{ page[cursor] }}'
AND page[limit] = '{{ page[limit] }}'
;

Lifecycle Methods

EXEC variables use wire (API) names.

search_security_monitoring_histsignals

Search hist signals.

EXEC datadog.security.monitoring_hist_signals.search_security_monitoring_histsignals 
@@json=
'{
"filter": "{{ filter }}", 
"page": "{{ page }}", 
"sort": "{{ sort }}"
}'
;

convert_job_result_to_signal

Convert a job result to a signal.

EXEC datadog.security.monitoring_hist_signals.convert_job_result_to_signal 
@@json=
'{
"data": "{{ data }}"
}'
;