security_findings

Creates, updates, deletes, gets or lists a security_findings resource.

Overview

Name	security_findings
Type	Resource
Id	datadog.security.security_findings

Fields

The following fields are returned by SELECT queries:

list_security_findings

Name	Datatype	Description
id	string	The unique ID of the security finding. (example: ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==)
attributes	object	The JSON object containing all attributes of the security finding.
type	string	The type of the security finding resource. (finding) (default: finding, example: finding)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_security_findings	select		filter[query], page[cursor], page[limit], sort	Get a list of security findings that match a search query. [See the schema for security findings](https:​//docs.datadoghq.com/security/guide/findings-schema/).<br /><br />### Query Syntax<br /><br />This endpoint uses the logs query syntax. Findings attributes (living in the attributes.attributes. namespace) are prefixed by @ when queried. Tags are queried without a prefix.<br /><br />Example: @severity:(critical OR high) @status:open team:platform
update_findings_assignee	exec	data		Assign or unassign security findings.<br />You can assign up to 100 security findings per request. Set assignee_id to the unique identifier of the Datadog user you want to assign the findings to. Omit assignee_id (or set it to null) to unassign the findings. Per-finding warnings and failures are returned in the response meta object.
search_security_findings	exec			Get a list of security findings that match a search query. [See the schema for security findings](https:​//docs.datadoghq.com/security/guide/findings-schema/).<br /><br />### Query Syntax<br /><br />The API uses the logs query syntax. Findings attributes (living in the attributes.attributes. namespace) are prefixed by @ when queried. Tags are queried without a prefix.<br /><br />Example: @severity:(critical OR high) @status:open team:platform

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
site	string	The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both.
filter[query]	string	The search query following log search syntax. (example: @severity:(critical OR high) @status:open team:platform)
page[cursor]	string	Get the next page of results with a cursor provided in the previous query. (example: eyJhZnRlciI6IkF3QUFBWnPcm1pd0FBQUJbVlBQUKBa1pqRTVdZUzSTBNemN0YWiIsLTE3Mjk0MzYwMjFdfQ==)
page[limit]	integer (int64)	The maximum number of findings in the response. (example: 25)
sort	string	Sorts by @detection_changed_at.

SELECT examples

list_security_findings

Get a list of security findings that match a search query. [See the schema for security findings](https:​//docs.datadoghq.com/security/guide/findings-schema/).<br /><br />### Query Syntax<br /><br />This endpoint uses the logs query syntax. Findings attributes (living in the attributes.attributes. namespace) are prefixed by @ when queried. Tags are queried without a prefix.<br /><br />Example: @severity:(critical OR high) @status:open team:platform

SELECT
id,
attributes,
type
FROM datadog.security.security_findings
WHERE filter[query] = '{{ filter[query] }}'
AND page[cursor] = '{{ page[cursor] }}'
AND page[limit] = '{{ page[limit] }}'
AND sort = '{{ sort }}'
;

Lifecycle Methods

EXEC variables use wire (API) names.

update_findings_assignee

Assign or unassign security findings.<br />You can assign up to 100 security findings per request. Set assignee_id to the unique identifier of the Datadog user you want to assign the findings to. Omit assignee_id (or set it to null) to unassign the findings. Per-finding warnings and failures are returned in the response meta object.

EXEC datadog.security.security_findings.update_findings_assignee 
@@json=
'{
"data": "{{ data }}"
}'
;

search_security_findings

Get a list of security findings that match a search query. [See the schema for security findings](https:​//docs.datadoghq.com/security/guide/findings-schema/).<br /><br />### Query Syntax<br /><br />The API uses the logs query syntax. Findings attributes (living in the attributes.attributes. namespace) are prefixed by @ when queried. Tags are queried without a prefix.<br /><br />Example: @severity:(critical OR high) @status:open team:platform

EXEC datadog.security.security_findings.search_security_findings 
@@json=
'{
"data": "{{ data }}"
}'
;