monitoring_rules

Creates, updates, deletes, gets or lists a monitoring_rules resource.

Overview

Name	monitoring_rules
Type	Resource
Id	datadog.security.monitoring_rules

Fields

The following fields are returned by SELECT queries:

get_security_monitoring_rule

Name	Datatype	Description
id	string	The ID of the rule.
name	string	The name of the rule.
creation_author_id	integer (int64)	User ID of the user who created the rule. (wire: creationAuthorId)
update_author_id	integer (int64)	User ID of the user who updated the rule. (wire: updateAuthorId)
custom_name	string	Custom/Overridden name of the rule (used in case of Default rule update). (wire: customName)
calculated_fields	array	Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined. (wire: calculatedFields)
cases	array	Cases for generating signals.
compliance_signal_options	object	How to generate compliance signals. Useful for cloud_configuration rules only. (wire: complianceSignalOptions)
created_at	integer (int64)	When the rule was created, timestamp in milliseconds. (wire: createdAt)
custom_message	string	Custom/Overridden message for generated signals (used in case of Default rule update). (wire: customMessage)
default_tags	array	Default Tags for default rules (included in tags) (wire: defaultTags)
deprecation_date	integer (int64)	When the rule will be deprecated, timestamp in milliseconds. (wire: deprecationDate)
filters	array	Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
group_signals_by	array	Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. (wire: groupSignalsBy)
has_extended_title	boolean	Whether the notifications include the triggering group-by values in their title. (wire: hasExtendedTitle)
is_default	boolean	Whether the rule is included by default. (wire: isDefault)
is_deleted	boolean	Whether the rule has been deleted. (wire: isDeleted)
is_enabled	boolean	Whether the rule is enabled. (wire: isEnabled)
message	string	Message for generated signals.
options	object	Options.
queries	array	Queries for selecting logs which are part of the rule.
reference_tables	array	Reference tables for the rule. (wire: referenceTables)
scheduling_options	object	Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs. (wire: schedulingOptions)
tags	array	Tags for generated signals.
third_party_cases	array	Cases for generating signals from third-party rules. Only available for third-party rules. (wire: thirdPartyCases)
type	string	The rule type. (log_detection, infrastructure_configuration, workload_security, cloud_configuration, application_security, api_security, workload_activity)
updated_at	integer (int64)	The date the rule was last updated, in milliseconds. (wire: updatedAt)
version	integer (int64)	The version of the rule.

list_security_monitoring_rules

Name	Datatype	Description
id	string	The ID of the rule.
name	string	The name of the rule.
creation_author_id	integer (int64)	User ID of the user who created the rule. (wire: creationAuthorId)
update_author_id	integer (int64)	User ID of the user who updated the rule. (wire: updateAuthorId)
custom_name	string	Custom/Overridden name of the rule (used in case of Default rule update). (wire: customName)
calculated_fields	array	Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined. (wire: calculatedFields)
cases	array	Cases for generating signals.
compliance_signal_options	object	How to generate compliance signals. Useful for cloud_configuration rules only. (wire: complianceSignalOptions)
created_at	integer (int64)	When the rule was created, timestamp in milliseconds. (wire: createdAt)
custom_message	string	Custom/Overridden message for generated signals (used in case of Default rule update). (wire: customMessage)
default_tags	array	Default Tags for default rules (included in tags) (wire: defaultTags)
deprecation_date	integer (int64)	When the rule will be deprecated, timestamp in milliseconds. (wire: deprecationDate)
filters	array	Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
group_signals_by	array	Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. (wire: groupSignalsBy)
has_extended_title	boolean	Whether the notifications include the triggering group-by values in their title. (wire: hasExtendedTitle)
is_default	boolean	Whether the rule is included by default. (wire: isDefault)
is_deleted	boolean	Whether the rule has been deleted. (wire: isDeleted)
is_enabled	boolean	Whether the rule is enabled. (wire: isEnabled)
message	string	Message for generated signals.
options	object	Options.
queries	array	Queries for selecting logs which are part of the rule.
reference_tables	array	Reference tables for the rule. (wire: referenceTables)
scheduling_options	object	Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs. (wire: schedulingOptions)
tags	array	Tags for generated signals.
third_party_cases	array	Cases for generating signals from third-party rules. Only available for third-party rules. (wire: thirdPartyCases)
type	string	The rule type. (log_detection, infrastructure_configuration, workload_security, cloud_configuration, application_security, api_security, workload_activity)
updated_at	integer (int64)	The date the rule was last updated, in milliseconds. (wire: updatedAt)
version	integer (int64)	The version of the rule.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_security_monitoring_rule	select	rule_id		Get a rule's details.
list_security_monitoring_rules	select		page[size], page[number], query, sort	List rules.
create_security_monitoring_rule	insert	name, is_enabled, queries, options, cases, message, compliance_signal_options		Create a detection rule.
update_security_monitoring_rule	replace	rule_id		Update an existing rule. When updating cases, queries or options, the whole field<br />must be included. For example, when modifying a query all queries must be included.<br />Default rules can only be updated to be enabled, to change notifications, or to update<br />the tags (default tags cannot be removed).
delete_security_monitoring_rule	delete	rule_id		Delete an existing rule. Default rules cannot be deleted.
bulk_delete_security_monitoring_rules	delete			Delete multiple security monitoring rules in a single request. Default rules cannot be deleted.
convert_security_monitoring_rule_from_jsonto_terraform	exec	name, isEnabled, queries, options, cases, message		Convert a rule that doesn't (yet) exist from JSON to Terraform for Datadog provider<br />resource datadog_security_monitoring_rule. You can do so for the following rule types:<br />- App and API Protection<br />- Cloud SIEM (log detection and signal correlation)<br />- Workload Protection<br /><br />You can convert Cloud Security configuration rules using Terraform's [Datadog Cloud Configuration Rule resource](https:​//registry.terraform.io/providers/DataDog/datadog/latest/docs/resources/cloud_configuration_rule).
test_security_monitoring_rule	exec			Test a rule.
validate_security_monitoring_rule	exec	name, isEnabled, queries, options, cases, message, complianceSignalOptions		Validate a detection rule.
convert_existing_security_monitoring_rule	exec	rule_id		Convert an existing rule from JSON to Terraform for Datadog provider<br />resource datadog_security_monitoring_rule. You can do so for the following rule types:<br />- App and API Protection<br />- Cloud SIEM (log detection and signal correlation)<br />- Workload Protection<br /><br />You can convert Cloud Security configuration rules using Terraform's [Datadog Cloud Configuration Rule resource](https:​//registry.terraform.io/providers/DataDog/datadog/latest/docs/resources/cloud_configuration_rule).
restore_security_monitoring_rule	exec	rule_id, version		Restores a custom detection rule to a previously saved historical version.<br />Only custom rules can be restored. Default and partner rules return 400.<br />The restore creates a new version entry; it does not overwrite history.
test_existing_security_monitoring_rule	exec	rule_id		Test an existing rule.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
rule_id	string	The ID of the rule.
site	string	The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both.
version	integer (int64)	The historical version number of the rule.
page[number]	integer (int64)	Specific page number to return.
page[size]	integer (int64)	Number of items to return per page. The maximum allowed value is 100.
query	string	A search query to filter security rules. You can filter by attributes such as type, source, tags. (example: type:signal_correlation source:cloudtrail)
sort	string	Attribute used to sort rules. Prefix with - to sort in descending order.

SELECT examples

get_security_monitoring_rule

Get a rule's details.

SELECT
id,
name,
creation_author_id,
update_author_id,
custom_name,
calculated_fields,
cases,
compliance_signal_options,
created_at,
custom_message,
default_tags,
deprecation_date,
filters,
group_signals_by,
has_extended_title,
is_default,
is_deleted,
is_enabled,
message,
options,
queries,
reference_tables,
scheduling_options,
tags,
third_party_cases,
type,
updated_at,
version
FROM datadog.security.monitoring_rules
WHERE rule_id = '{{ rule_id }}' -- required
;

list_security_monitoring_rules

List rules.

SELECT
id,
name,
creation_author_id,
update_author_id,
custom_name,
calculated_fields,
cases,
compliance_signal_options,
created_at,
custom_message,
default_tags,
deprecation_date,
filters,
group_signals_by,
has_extended_title,
is_default,
is_deleted,
is_enabled,
message,
options,
queries,
reference_tables,
scheduling_options,
tags,
third_party_cases,
type,
updated_at,
version
FROM datadog.security.monitoring_rules
WHERE page[size] = '{{ page[size] }}'
AND page[number] = '{{ page[number] }}'
AND query = '{{ query }}'
AND sort = '{{ sort }}'
;

INSERT examples

create_security_monitoring_rule

Create a detection rule.

INSERT INTO datadog.security.monitoring_rules (
calculated_fields,
cases,
filters,
group_signals_by,
has_extended_title,
is_enabled,
message,
name,
options,
queries,
reference_tables,
scheduling_options,
tags,
third_party_cases,
type,
compliance_signal_options
)
SELECT 
'{{ calculated_fields }}',
'{{ cases }}' /* required */,
'{{ filters }}',
'{{ group_signals_by }}',
{{ has_extended_title }},
{{ is_enabled }} /* required */,
'{{ message }}' /* required */,
'{{ name }}' /* required */,
'{{ options }}' /* required */,
'{{ queries }}' /* required */,
'{{ reference_tables }}',
'{{ scheduling_options }}',
'{{ tags }}',
'{{ third_party_cases }}',
'{{ type }}',
'{{ compliance_signal_options }}' /* required */
RETURNING
id,
name,
creation_author_id,
update_author_id,
custom_name,
calculated_fields,
cases,
compliance_signal_options,
created_at,
custom_message,
default_tags,
deprecation_date,
filters,
group_signals_by,
has_extended_title,
is_default,
is_deleted,
is_enabled,
message,
options,
queries,
reference_tables,
scheduling_options,
tags,
third_party_cases,
type,
updated_at,
version
;

Manifest

# Description fields are for documentation purposes
- name: monitoring_rules
props:
  - name: calculated_fields
    description: |
      Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.
    value:
      - expression: "{{ expression }}"
        name: "{{ name }}"
  - name: cases
    description: |
      Cases for generating signals.
    value:
      - actions: "{{ actions }}"
        condition: "{{ condition }}"
        name: "{{ name }}"
        notifications: "{{ notifications }}"
        status: "{{ status }}"
  - name: filters
    description: |
      Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
    value:
      - action: "{{ action }}"
        query: "{{ query }}"
  - name: group_signals_by
    value:
      - "{{ group_signals_by }}"
    description: |
      Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
  - name: has_extended_title
    value: {{ has_extended_title }}
    description: |
      Whether the notifications include the triggering group-by values in their title.
  - name: is_enabled
    value: {{ is_enabled }}
    description: |
      Whether the rule is enabled.
  - name: message
    value: "{{ message }}"
    description: |
      Message for generated signals.
  - name: name
    value: "{{ name }}"
    description: |
      The name of the rule.
  - name: options
    description: |
      Options.
    value:
      anomalyDetectionOptions:
        bucketDuration: {{ bucketDuration }}
        detectionTolerance: {{ detectionTolerance }}
        instantaneousBaseline: {{ instantaneousBaseline }}
        learningDuration: {{ learningDuration }}
        learningPeriodBaseline: {{ learningPeriodBaseline }}
      complianceRuleOptions:
        complexRule: {{ complexRule }}
        regoRule:
          policy: "{{ policy }}"
          resourceTypes:
            - "{{ resourceTypes }}"
        resourceType: "{{ resourceType }}"
      decreaseCriticalityBasedOnEnv: {{ decreaseCriticalityBasedOnEnv }}
      detectionMethod: "{{ detectionMethod }}"
      evaluationWindow: {{ evaluationWindow }}
      hardcodedEvaluatorType: "{{ hardcodedEvaluatorType }}"
      impossibleTravelOptions:
        baselineUserLocations: {{ baselineUserLocations }}
        baselineUserLocationsDuration: {{ baselineUserLocationsDuration }}
      keepAlive: {{ keepAlive }}
      maxSignalDuration: {{ maxSignalDuration }}
      newValueOptions:
        forgetAfter: {{ forgetAfter }}
        instantaneousBaseline: {{ instantaneousBaseline }}
        learningDuration: {{ learningDuration }}
        learningMethod: "{{ learningMethod }}"
        learningThreshold: {{ learningThreshold }}
      sequenceDetectionOptions:
        stepTransitions:
          - child: "{{ child }}"
            evaluationWindow: {{ evaluationWindow }}
            parent: "{{ parent }}"
        steps:
          - condition: "{{ condition }}"
            evaluationWindow: {{ evaluationWindow }}
            name: "{{ name }}"
      thirdPartyRuleOptions:
        defaultNotifications:
          - "{{ defaultNotifications }}"
        defaultStatus: "{{ defaultStatus }}"
        rootQueries:
          - groupByFields: "{{ groupByFields }}"
            query: "{{ query }}"
        signalTitleTemplate: "{{ signalTitleTemplate }}"
  - name: queries
    description: |
      Queries for selecting logs which are part of the rule.
    value:
      - aggregation: "{{ aggregation }}"
        customQueryExtension: "{{ customQueryExtension }}"
        dataSource: "{{ dataSource }}"
        distinctFields: "{{ distinctFields }}"
        groupByFields: "{{ groupByFields }}"
        hasOptionalGroupByFields: {{ hasOptionalGroupByFields }}
        index: "{{ index }}"
        indexes: "{{ indexes }}"
        metric: "{{ metric }}"
        metrics: "{{ metrics }}"
        name: "{{ name }}"
        query: "{{ query }}"
  - name: reference_tables
    description: |
      Reference tables for the rule.
    value:
      - checkPresence: {{ checkPresence }}
        columnName: "{{ columnName }}"
        logFieldPath: "{{ logFieldPath }}"
        ruleQueryName: "{{ ruleQueryName }}"
        tableName: "{{ tableName }}"
  - name: scheduling_options
    description: |
      Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
    value:
      rrule: "{{ rrule }}"
      start: "{{ start }}"
      timezone: "{{ timezone }}"
  - name: tags
    value:
      - "{{ tags }}"
    description: |
      Tags for generated signals.
  - name: third_party_cases
    description: |
      Cases for generating signals from third-party rules. Only available for third-party rules.
    value:
      - name: "{{ name }}"
        notifications: "{{ notifications }}"
        query: "{{ query }}"
        status: "{{ status }}"
  - name: type
    value: "{{ type }}"
    description: |
      The rule type.
    valid_values: ['api_security', 'application_security', 'log_detection', 'workload_activity', 'workload_security']
  - name: compliance_signal_options
    description: |
      How to generate compliance signals. Useful for cloud_configuration rules only.
    value:
      defaultActivationStatus: {{ defaultActivationStatus }}
      defaultGroupByFields:
        - "{{ defaultGroupByFields }}"
      userActivationStatus: {{ userActivationStatus }}
      userGroupByFields:
        - "{{ userGroupByFields }}"

REPLACE examples

update_security_monitoring_rule

Update an existing rule. When updating cases, queries or options, the whole field<br />must be included. For example, when modifying a query all queries must be included.<br />Default rules can only be updated to be enabled, to change notifications, or to update<br />the tags (default tags cannot be removed).

REPLACE datadog.security.monitoring_rules
SET 
calculated_fields = '{{ calculated_fields }}',
cases = '{{ cases }}',
compliance_signal_options = '{{ compliance_signal_options }}',
custom_message = '{{ custom_message }}',
custom_name = '{{ custom_name }}',
filters = '{{ filters }}',
group_signals_by = '{{ group_signals_by }}',
has_extended_title = {{ has_extended_title }},
is_enabled = {{ is_enabled }},
message = '{{ message }}',
name = '{{ name }}',
options = '{{ options }}',
queries = '{{ queries }}',
reference_tables = '{{ reference_tables }}',
scheduling_options = '{{ scheduling_options }}',
tags = '{{ tags }}',
third_party_cases = '{{ third_party_cases }}',
version = {{ version }}
WHERE 
rule_id = '{{ rule_id }}' --required
RETURNING
id,
name,
creation_author_id,
update_author_id,
custom_name,
calculated_fields,
cases,
compliance_signal_options,
created_at,
custom_message,
default_tags,
deprecation_date,
filters,
group_signals_by,
has_extended_title,
is_default,
is_deleted,
is_enabled,
message,
options,
queries,
reference_tables,
scheduling_options,
tags,
third_party_cases,
type,
updated_at,
version;

DELETE examples

delete_security_monitoring_rule

Delete an existing rule. Default rules cannot be deleted.

DELETE FROM datadog.security.monitoring_rules
WHERE rule_id = '{{ rule_id }}' --required
;

bulk_delete_security_monitoring_rules

Delete multiple security monitoring rules in a single request. Default rules cannot be deleted.

DELETE FROM datadog.security.monitoring_rules
;

Lifecycle Methods

EXEC variables use wire (API) names.

convert_security_monitoring_rule_from_jsonto_terraform

Convert a rule that doesn't (yet) exist from JSON to Terraform for Datadog provider<br />resource datadog_security_monitoring_rule. You can do so for the following rule types:<br />- App and API Protection<br />- Cloud SIEM (log detection and signal correlation)<br />- Workload Protection<br /><br />You can convert Cloud Security configuration rules using Terraform's [Datadog Cloud Configuration Rule resource](https:​//registry.terraform.io/providers/DataDog/datadog/latest/docs/resources/cloud_configuration_rule).

EXEC datadog.security.monitoring_rules.convert_security_monitoring_rule_from_jsonto_terraform 
@@json=
'{
"calculatedFields": "{{ calculatedFields }}", 
"cases": "{{ cases }}", 
"customMessage": "{{ customMessage }}", 
"customName": "{{ customName }}", 
"filters": "{{ filters }}", 
"groupSignalsBy": "{{ groupSignalsBy }}", 
"hasExtendedTitle": {{ hasExtendedTitle }}, 
"isEnabled": {{ isEnabled }}, 
"message": "{{ message }}", 
"name": "{{ name }}", 
"options": "{{ options }}", 
"queries": "{{ queries }}", 
"referenceTables": "{{ referenceTables }}", 
"schedulingOptions": "{{ schedulingOptions }}", 
"tags": "{{ tags }}", 
"thirdPartyCases": "{{ thirdPartyCases }}", 
"type": "{{ type }}"
}'
;

test_security_monitoring_rule

Test a rule.

EXEC datadog.security.monitoring_rules.test_security_monitoring_rule 
@@json=
'{
"rule": "{{ rule }}", 
"ruleQueryPayloads": "{{ ruleQueryPayloads }}"
}'
;

validate_security_monitoring_rule

Validate a detection rule.

EXEC datadog.security.monitoring_rules.validate_security_monitoring_rule 
@@json=
'{
"calculatedFields": "{{ calculatedFields }}", 
"cases": "{{ cases }}", 
"customMessage": "{{ customMessage }}", 
"customName": "{{ customName }}", 
"filters": "{{ filters }}", 
"groupSignalsBy": "{{ groupSignalsBy }}", 
"hasExtendedTitle": {{ hasExtendedTitle }}, 
"isEnabled": {{ isEnabled }}, 
"message": "{{ message }}", 
"name": "{{ name }}", 
"options": "{{ options }}", 
"queries": "{{ queries }}", 
"referenceTables": "{{ referenceTables }}", 
"schedulingOptions": "{{ schedulingOptions }}", 
"tags": "{{ tags }}", 
"thirdPartyCases": "{{ thirdPartyCases }}", 
"type": "{{ type }}", 
"complianceSignalOptions": "{{ complianceSignalOptions }}"
}'
;

convert_existing_security_monitoring_rule

Convert an existing rule from JSON to Terraform for Datadog provider<br />resource datadog_security_monitoring_rule. You can do so for the following rule types:<br />- App and API Protection<br />- Cloud SIEM (log detection and signal correlation)<br />- Workload Protection<br /><br />You can convert Cloud Security configuration rules using Terraform's [Datadog Cloud Configuration Rule resource](https:​//registry.terraform.io/providers/DataDog/datadog/latest/docs/resources/cloud_configuration_rule).

EXEC datadog.security.monitoring_rules.convert_existing_security_monitoring_rule 
@rule_id='{{ rule_id }}' --required 
;

restore_security_monitoring_rule

Restores a custom detection rule to a previously saved historical version.<br />Only custom rules can be restored. Default and partner rules return 400.<br />The restore creates a new version entry; it does not overwrite history.

EXEC datadog.security.monitoring_rules.restore_security_monitoring_rule 
@rule_id='{{ rule_id }}' --required, 
@version='{{ version }}' --required 
;

test_existing_security_monitoring_rule

Test an existing rule.

EXEC datadog.security.monitoring_rules.test_existing_security_monitoring_rule 
@rule_id='{{ rule_id }}' --required, 
@@json=
'{
"rule": "{{ rule }}", 
"ruleQueryPayloads": "{{ ruleQueryPayloads }}"
}'
;