siem_ioc_explorers

Creates, updates, deletes, gets or lists a siem_ioc_explorers resource.

Overview

Name	siem_ioc_explorers
Type	Resource
Id	datadog.security.siem_ioc_explorers

Fields

The following fields are returned by SELECT queries:

list_indicators_of_compromise

Name	Datatype	Description
id	string	Unique identifier for the response.
attributes	object	Attributes of the IoC Explorer list response.
type	string	Response type identifier.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_indicators_of_compromise	select		limit, offset, query, sort[column], sort[order], ocsf, worked_by, triage_state	Get a list of indicators of compromise (IoCs) matching the specified filters.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
site	string	The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both.
limit	integer (int32)	Number of results per page.
ocsf	boolean	When true, return only OCSF field-based matches. When false, return regex/message-based matches.
offset	integer (int32)	Pagination offset.
query	string	Search/filter query (supports field:value syntax).
sort[column]	string	Sort column: score, first_seen_ts_epoch, last_seen_ts_epoch, indicator, indicator_type, signal_count, log_count, category, as_type.
sort[order]	string	Sort order: asc or desc.
triage_state	string	Filter by triage state.
worked_by	string	Filter indicators whose triage state was updated by a specific user identified by their handle.

SELECT examples

list_indicators_of_compromise

Get a list of indicators of compromise (IoCs) matching the specified filters.

SELECT
id,
attributes,
type
FROM datadog.security.siem_ioc_explorers
WHERE limit = '{{ limit }}'
AND offset = '{{ offset }}'
AND query = '{{ query }}'
AND sort[column] = '{{ sort[column] }}'
AND sort[order] = '{{ sort[order] }}'
AND ocsf = '{{ ocsf }}'
AND worked_by = '{{ worked_by }}'
AND triage_state = '{{ triage_state }}'
;