monitoring_signals

Creates, updates, deletes, gets or lists a monitoring_signals resource.

Overview

Name	monitoring_signals
Type	Resource
Id	datadog.security.monitoring_signals

Fields

The following fields are returned by SELECT queries:

get_security_monitoring_signal

Name	Datatype	Description
id	string	The unique ID of the security signal. (example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA)
attributes	object	The object containing all signal attributes and their associated values.
type	string	The type of event. (signal) (default: signal, example: signal)

list_security_monitoring_signals

Name	Datatype	Description
id	string	The unique ID of the security signal. (example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA)
attributes	object	The object containing all signal attributes and their associated values.
type	string	The type of event. (signal) (default: signal, example: signal)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_security_monitoring_signal	select	signal_id		Get a signal's details.
list_security_monitoring_signals	select		filter[query], filter[from], filter[to], sort, page[cursor], page[limit]	The list endpoint returns security signals that match a search query.<br />Both this endpoint and the POST endpoint can be used interchangeably when listing<br />security signals.
bulk_edit_security_monitoring_signals_assignee	exec	data		Change the triage assignees of multiple security signals at once.<br />The maximum number of signals that can be updated in a single request is 199.
bulk_edit_security_monitoring_signals_state	exec	data		Change the triage states of multiple security signals at once.<br />The maximum number of signals that can be updated in a single request is 199.
bulk_edit_security_monitoring_signals	exec	data		Update the triage state or assignee of multiple security signals at once.<br />The maximum number of signals that can be updated in a single request is 199.
search_security_monitoring_signals	exec			Returns security signals that match a search query.<br />Both this endpoint and the GET endpoint can be used interchangeably for listing<br />security signals.
edit_security_monitoring_signal_assignee	exec	signal_id, data		Modify the triage assignee of a security signal.
edit_security_monitoring_signal_incidents	exec	signal_id, data		Change the related incidents for a security signal.
edit_security_monitoring_signal_state	exec	signal_id, data		Change the triage state of a security signal.
edit_security_monitoring_signal	exec	signal_id, data		Update the triage state or assignee of a security signal.
add_security_monitoring_signal_to_incident	exec	signal_id, incident_id		Add a security signal to an incident. This makes it possible to search for signals by incident within the signal explorer and to view the signals on the incident timeline.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
signal_id	string	The ID of the signal.
site	string	The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both.
filter[from]	string (date-time)	The minimum timestamp for requested security signals. (example: 2019-01-02T09:42:36.320Z)
filter[query]	string	The search query for security signals. (example: security:attack status:high)
filter[to]	string (date-time)	The maximum timestamp for requested security signals. (example: 2019-01-03T09:42:36.320Z)
page[cursor]	string	A list of results using the cursor provided in the previous query. (example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==)
page[limit]	integer (int32)	The maximum number of security signals in the response. (example: 25)
sort	string	The order of the security signals in results.

SELECT examples

get_security_monitoring_signal

Get a signal's details.

SELECT
id,
attributes,
type
FROM datadog.security.monitoring_signals
WHERE signal_id = '{{ signal_id }}' -- required
;

list_security_monitoring_signals

The list endpoint returns security signals that match a search query.<br />Both this endpoint and the POST endpoint can be used interchangeably when listing<br />security signals.

SELECT
id,
attributes,
type
FROM datadog.security.monitoring_signals
WHERE filter[query] = '{{ filter[query] }}'
AND filter[from] = '{{ filter[from] }}'
AND filter[to] = '{{ filter[to] }}'
AND sort = '{{ sort }}'
AND page[cursor] = '{{ page[cursor] }}'
AND page[limit] = '{{ page[limit] }}'
;

Lifecycle Methods

EXEC variables use wire (API) names.

bulk_edit_security_monitoring_signals_assignee

Change the triage assignees of multiple security signals at once.<br />The maximum number of signals that can be updated in a single request is 199.

EXEC datadog.security.monitoring_signals.bulk_edit_security_monitoring_signals_assignee 
@@json=
'{
"data": "{{ data }}"
}'
;

bulk_edit_security_monitoring_signals_state

Change the triage states of multiple security signals at once.<br />The maximum number of signals that can be updated in a single request is 199.

EXEC datadog.security.monitoring_signals.bulk_edit_security_monitoring_signals_state 
@@json=
'{
"data": "{{ data }}"
}'
;

bulk_edit_security_monitoring_signals

Update the triage state or assignee of multiple security signals at once.<br />The maximum number of signals that can be updated in a single request is 199.

EXEC datadog.security.monitoring_signals.bulk_edit_security_monitoring_signals 
@@json=
'{
"data": "{{ data }}"
}'
;

search_security_monitoring_signals

Returns security signals that match a search query.<br />Both this endpoint and the GET endpoint can be used interchangeably for listing<br />security signals.

EXEC datadog.security.monitoring_signals.search_security_monitoring_signals 
@@json=
'{
"filter": "{{ filter }}", 
"page": "{{ page }}", 
"sort": "{{ sort }}"
}'
;

edit_security_monitoring_signal_assignee

Modify the triage assignee of a security signal.

EXEC datadog.security.monitoring_signals.edit_security_monitoring_signal_assignee 
@signal_id='{{ signal_id }}' --required, 
@@json=
'{
"data": "{{ data }}"
}'
;

edit_security_monitoring_signal_incidents

Change the related incidents for a security signal.

EXEC datadog.security.monitoring_signals.edit_security_monitoring_signal_incidents 
@signal_id='{{ signal_id }}' --required, 
@@json=
'{
"data": "{{ data }}"
}'
;

edit_security_monitoring_signal_state

Change the triage state of a security signal.

EXEC datadog.security.monitoring_signals.edit_security_monitoring_signal_state 
@signal_id='{{ signal_id }}' --required, 
@@json=
'{
"data": "{{ data }}"
}'
;

edit_security_monitoring_signal

Update the triage state or assignee of a security signal.

EXEC datadog.security.monitoring_signals.edit_security_monitoring_signal 
@signal_id='{{ signal_id }}' --required, 
@@json=
'{
"data": "{{ data }}"
}'
;

add_security_monitoring_signal_to_incident

Add a security signal to an incident. This makes it possible to search for signals by incident within the signal explorer and to view the signals on the incident timeline.

EXEC datadog.security.monitoring_signals.add_security_monitoring_signal_to_incident 
@signal_id='{{ signal_id }}' --required, 
@@json=
'{
"add_to_signal_timeline": {{ add_to_signal_timeline }}, 
"incident_id": {{ incident_id }}, 
"version": {{ version }}
}'
;