monitoring_signal_investigation_queries

Creates, updates, deletes, gets or lists a monitoring_signal_investigation_queries resource.

Overview

Name	monitoring_signal_investigation_queries
Type	Resource
Id	datadog.security.monitoring_signal_investigation_queries

Fields

The following fields are returned by SELECT queries:

get_investigation_log_queries_matching_signal

Name	Datatype	Description
id	string	The unique ID of the suggested action. (example: w00-t10-992)
attributes	object	Attributes of a suggested action for a security signal. The available fields depend on the action type.
type	string	The type of the suggested action resource. (investigation_log_queries, recommended_blog_posts) (example: investigation_log_queries)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_investigation_log_queries_matching_signal	select	signal_id		Get the list of investigation log queries available for a given security signal.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
signal_id	string	The ID of the signal.
site	string	The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both.

SELECT examples

get_investigation_log_queries_matching_signal

Get the list of investigation log queries available for a given security signal.

SELECT
id,
attributes,
type
FROM datadog.security.monitoring_signal_investigation_queries
WHERE signal_id = '{{ signal_id }}' -- required
;