siem_ioc_explorer_indicators

Creates, updates, deletes, gets or lists a siem_ioc_explorer_indicators resource.

Overview

Name	siem_ioc_explorer_indicators
Type	Resource
Id	datadog.security.siem_ioc_explorer_indicators

Fields

The following fields are returned by SELECT queries:

get_indicator_of_compromise

Name	Datatype	Description
id	string	Unique identifier for the response.
attributes	object	Attributes of the get indicator response.
type	string	Response type identifier.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_indicator_of_compromise	select	indicator	ocsf, include_triage_history, triage_history_limit, triage_history_offset	Get detailed information about a specific indicator of compromise (IoC).

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
indicator	string	The indicator value to look up (for example, an IP address or domain).
site	string	The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both.
include_triage_history	boolean	Include full triage history for the indicator.
ocsf	boolean	When true, return only OCSF field-based matches. When false, return regex/message-based matches.
triage_history_limit	integer (int32)	Maximum number of triage history events returned. Only applied when include_triage_history is true.
triage_history_offset	integer (int32)	Pagination offset into the triage history. Only applied when include_triage_history is true.

SELECT examples

get_indicator_of_compromise

Get detailed information about a specific indicator of compromise (IoC).

SELECT
id,
attributes,
type
FROM datadog.security.siem_ioc_explorer_indicators
WHERE indicator = '{{ indicator }}' -- required
AND ocsf = '{{ ocsf }}'
AND include_triage_history = '{{ include_triage_history }}'
AND triage_history_limit = '{{ triage_history_limit }}'
AND triage_history_offset = '{{ triage_history_offset }}'
;