monitoring_rules

Creates, updates, deletes, gets or lists a monitoring_rules resource.

Overview

Name	monitoring_rules
Type	Resource
Id	datadog.security.monitoring_rules

Fields

The following fields are returned by SELECT queries:

get_security_monitoring_rule

Name	Datatype	Description

list_security_monitoring_rules

Name	Datatype	Description

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_security_monitoring_rule	select	rule_id, region		Get a rule's details.
list_security_monitoring_rules	select	region	page[size], page[number]	List rules.
create_security_monitoring_rule	insert	region, data__name, data__isEnabled, data__queries, data__options, data__cases, data__message		Create a detection rule.
update_security_monitoring_rule	replace	rule_id, region		Update an existing rule. When updating cases, queries or options, the whole field must be included. For example, when modifying a query all queries must be included. Default rules can only be updated to be enabled, to change notifications, or to update the tags (default tags cannot be removed).
delete_security_monitoring_rule	delete	rule_id, region		Delete an existing rule. Default rules cannot be deleted.
convert_security_monitoring_rule_from_jsonto_terraform	exec	region, name, isEnabled, queries, options, cases, message		Convert a rule that doesn't (yet) exist from JSON to Terraform for datadog provider resource datadog_security_monitoring_rule.
test_security_monitoring_rule	exec	region		Test a rule.
validate_security_monitoring_rule	exec	region, name, isEnabled, queries, options, cases, message		Validate a detection rule.
convert_existing_security_monitoring_rule	exec	rule_id, region		Convert an existing rule from JSON to Terraform for datadog provider resource datadog_security_monitoring_rule.
test_existing_security_monitoring_rule	exec	rule_id, region		Test an existing rule.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	(default: datadoghq.com)
rule_id	string	The ID of the rule.
page[number]	integer (int64)	Specific page number to return.
page[size]	integer (int64)	Size for a given page. The maximum allowed value is 100.

SELECT examples

get_security_monitoring_rule

Get a rule's details.

SELECT
*
FROM datadog.security.monitoring_rules
WHERE rule_id = '{{ rule_id }}' -- required
AND region = '{{ region }}' -- required
;

list_security_monitoring_rules

List rules.

SELECT
*
FROM datadog.security.monitoring_rules
WHERE region = '{{ region }}' -- required
AND page[size] = '{{ page[size] }}'
AND page[number] = '{{ page[number] }}'
;

INSERT examples

create_security_monitoring_rule

Create a detection rule.

INSERT INTO datadog.security.monitoring_rules (
data__calculatedFields,
data__cases,
data__filters,
data__groupSignalsBy,
data__hasExtendedTitle,
data__isEnabled,
data__message,
data__name,
data__options,
data__queries,
data__referenceTables,
data__schedulingOptions,
data__tags,
data__thirdPartyCases,
data__type,
region
)
SELECT 
'{{ calculatedFields }}',
'{{ cases }}' /* required */,
'{{ filters }}',
'{{ groupSignalsBy }}',
{{ hasExtendedTitle }},
{{ isEnabled }} /* required */,
'{{ message }}' /* required */,
'{{ name }}' /* required */,
'{{ options }}' /* required */,
'{{ queries }}' /* required */,
'{{ referenceTables }}',
'{{ schedulingOptions }}',
'{{ tags }}',
'{{ thirdPartyCases }}',
'{{ type }}',
'{{ region }}'
;

Manifest

# Description fields are for documentation purposes
- name: monitoring_rules
  props:
    - name: region
      value: string
      description: Required parameter for the monitoring_rules resource.
    - name: calculatedFields
      value: array
      description: |
        Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.
    - name: cases
      value: array
      description: |
        Cases for generating signals.
    - name: filters
      value: array
      description: |
        Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
    - name: groupSignalsBy
      value: array
      description: |
        Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
    - name: hasExtendedTitle
      value: boolean
      description: |
        Whether the notifications include the triggering group-by values in their title.
    - name: isEnabled
      value: boolean
      description: |
        Whether the rule is enabled.
    - name: message
      value: string
      description: |
        Message for generated signals.
    - name: name
      value: string
      description: |
        The name of the rule.
    - name: options
      value: object
      description: |
        Options.
    - name: queries
      value: array
      description: |
        Queries for selecting logs which are part of the rule.
    - name: referenceTables
      value: array
      description: |
        Reference tables for the rule.
    - name: schedulingOptions
      value: object
      description: |
        Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
    - name: tags
      value: array
      description: |
        Tags for generated signals.
    - name: thirdPartyCases
      value: array
      description: |
        Cases for generating signals from third-party rules. Only available for third-party rules.
    - name: type
      value: string
      description: |
        The rule type.
      valid_values: ['api_security', 'application_security', 'log_detection', 'workload_security']

REPLACE examples

update_security_monitoring_rule

Update an existing rule. When updating cases, queries or options, the whole field
must be included. For example, when modifying a query all queries must be included.
Default rules can only be updated to be enabled, to change notifications, or to update
the tags (default tags cannot be removed).

REPLACE datadog.security.monitoring_rules
SET 
data__calculatedFields = '{{ calculatedFields }}',
data__cases = '{{ cases }}',
data__complianceSignalOptions = '{{ complianceSignalOptions }}',
data__customMessage = '{{ customMessage }}',
data__customName = '{{ customName }}',
data__filters = '{{ filters }}',
data__groupSignalsBy = '{{ groupSignalsBy }}',
data__hasExtendedTitle = {{ hasExtendedTitle }},
data__isEnabled = {{ isEnabled }},
data__message = '{{ message }}',
data__name = '{{ name }}',
data__options = '{{ options }}',
data__queries = '{{ queries }}',
data__referenceTables = '{{ referenceTables }}',
data__schedulingOptions = '{{ schedulingOptions }}',
data__tags = '{{ tags }}',
data__thirdPartyCases = '{{ thirdPartyCases }}',
data__version = {{ version }}
WHERE 
rule_id = '{{ rule_id }}' --required
AND region = '{{ region }}' --required;

DELETE examples

delete_security_monitoring_rule

Delete an existing rule. Default rules cannot be deleted.

DELETE FROM datadog.security.monitoring_rules
WHERE rule_id = '{{ rule_id }}' --required
AND region = '{{ region }}' --required
;

Lifecycle Methods

convert_security_monitoring_rule_from_jsonto_terraform

Convert a rule that doesn't (yet) exist from JSON to Terraform for datadog provider
resource datadog_security_monitoring_rule.

EXEC datadog.security.monitoring_rules.convert_security_monitoring_rule_from_jsonto_terraform 
@region='{{ region }}' --required 
@@json=
'{
"calculatedFields": "{{ calculatedFields }}", 
"cases": "{{ cases }}", 
"customMessage": "{{ customMessage }}", 
"customName": "{{ customName }}", 
"filters": "{{ filters }}", 
"groupSignalsBy": "{{ groupSignalsBy }}", 
"hasExtendedTitle": {{ hasExtendedTitle }}, 
"isEnabled": {{ isEnabled }}, 
"message": "{{ message }}", 
"name": "{{ name }}", 
"options": "{{ options }}", 
"queries": "{{ queries }}", 
"referenceTables": "{{ referenceTables }}", 
"schedulingOptions": "{{ schedulingOptions }}", 
"tags": "{{ tags }}", 
"thirdPartyCases": "{{ thirdPartyCases }}", 
"type": "{{ type }}"
}'
;

test_security_monitoring_rule

Test a rule.

EXEC datadog.security.monitoring_rules.test_security_monitoring_rule 
@region='{{ region }}' --required 
@@json=
'{
"rule": "{{ rule }}", 
"ruleQueryPayloads": "{{ ruleQueryPayloads }}"
}'
;

validate_security_monitoring_rule

Validate a detection rule.

EXEC datadog.security.monitoring_rules.validate_security_monitoring_rule 
@region='{{ region }}' --required 
@@json=
'{
"calculatedFields": "{{ calculatedFields }}", 
"cases": "{{ cases }}", 
"customMessage": "{{ customMessage }}", 
"customName": "{{ customName }}", 
"filters": "{{ filters }}", 
"groupSignalsBy": "{{ groupSignalsBy }}", 
"hasExtendedTitle": {{ hasExtendedTitle }}, 
"isEnabled": {{ isEnabled }}, 
"message": "{{ message }}", 
"name": "{{ name }}", 
"options": "{{ options }}", 
"queries": "{{ queries }}", 
"referenceTables": "{{ referenceTables }}", 
"schedulingOptions": "{{ schedulingOptions }}", 
"tags": "{{ tags }}", 
"thirdPartyCases": "{{ thirdPartyCases }}", 
"type": "{{ type }}"
}'
;

convert_existing_security_monitoring_rule

Convert an existing rule from JSON to Terraform for datadog provider
resource datadog_security_monitoring_rule.

EXEC datadog.security.monitoring_rules.convert_existing_security_monitoring_rule 
@rule_id='{{ rule_id }}' --required, 
@region='{{ region }}' --required
;

test_existing_security_monitoring_rule

Test an existing rule.

EXEC datadog.security.monitoring_rules.test_existing_security_monitoring_rule 
@rule_id='{{ rule_id }}' --required, 
@region='{{ region }}' --required 
@@json=
'{
"rule": "{{ rule }}", 
"ruleQueryPayloads": "{{ ruleQueryPayloads }}"
}'
;