scanning_rules

Creates, updates, deletes, gets or lists a scanning_rules resource.

Overview

Name	scanning_rules
Type	Resource
Id	datadog.security.scanning_rules

Fields

The following fields are returned by SELECT queries:

SELECT not supported for this resource, use SHOW METHODS to view available operations for the resource.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
create_scanning_rule	insert	data, meta		Create a scanning rule in a sensitive data scanner group, ordered last.<br />The posted rule MUST include a group relationship.<br />It MUST include either a standard_pattern relationship or a regex attribute, but not both.<br />If included_attributes is empty or missing, we will scan all attributes except<br />excluded_attributes. If both are missing, we will scan the whole event.
update_scanning_rule	update	rule_id, data, meta		Update a scanning rule.<br />The request body MUST NOT include a standard_pattern relationship, as that relationship<br />is non-editable. Trying to edit the regex attribute of a rule with a standard_pattern<br />relationship will also result in an error.
delete_scanning_rule	delete	rule_id		Delete a given rule.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
rule_id	string	The ID of the rule.
site	string	The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both.

INSERT examples

create_scanning_rule

Create a scanning rule in a sensitive data scanner group, ordered last.<br />The posted rule MUST include a group relationship.<br />It MUST include either a standard_pattern relationship or a regex attribute, but not both.<br />If included_attributes is empty or missing, we will scan all attributes except<br />excluded_attributes. If both are missing, we will scan the whole event.

INSERT INTO datadog.security.scanning_rules (
data,
meta
)
SELECT 
'{{ data }}' /* required */,
'{{ meta }}' /* required */
RETURNING
data,
meta
;

Manifest

# Description fields are for documentation purposes
- name: scanning_rules
props:
  - name: data
    description: |
      Data related to the creation of a rule.
    value:
      attributes:
        description: "{{ description }}"
        excluded_namespaces:
          - "{{ excluded_namespaces }}"
        included_keyword_configuration:
          character_count: {{ character_count }}
          keywords:
            - "{{ keywords }}"
          use_recommended_keywords: {{ use_recommended_keywords }}
        is_enabled: {{ is_enabled }}
        name: "{{ name }}"
        namespaces:
          - "{{ namespaces }}"
        pattern: "{{ pattern }}"
        priority: {{ priority }}
        suppressions:
          ends_with:
            - "{{ ends_with }}"
          exact_match:
            - "{{ exact_match }}"
          starts_with:
            - "{{ starts_with }}"
        tags:
          - "{{ tags }}"
        text_replacement:
          number_of_chars: {{ number_of_chars }}
          replacement_string: "{{ replacement_string }}"
          should_save_match: {{ should_save_match }}
          type: "{{ type }}"
      relationships:
        group:
          data:
            id: "{{ id }}"
            type: "{{ type }}"
        standard_pattern:
          data:
            id: "{{ id }}"
            type: "{{ type }}"
      type: "{{ type }}"
  - name: meta
    description: |
      Meta payload containing information about the API.
    value:
      version: {{ version }}

UPDATE examples

update_scanning_rule

Update a scanning rule.<br />The request body MUST NOT include a standard_pattern relationship, as that relationship<br />is non-editable. Trying to edit the regex attribute of a rule with a standard_pattern<br />relationship will also result in an error.

UPDATE datadog.security.scanning_rules
SET 
data = '{{ data }}',
meta = '{{ meta }}'
WHERE 
rule_id = '{{ rule_id }}' --required
AND data = '{{ data }}' --required
AND meta = '{{ meta }}' --required
RETURNING
meta;

DELETE examples

delete_scanning_rule

Delete a given rule.

DELETE FROM datadog.security.scanning_rules
WHERE rule_id = '{{ rule_id }}' --required
;