Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Datadog Provider
  3. API Docs
  4. SecurityMonitoringRule
Datadog v4.49.0 published on Thursday, Apr 17, 2025 by Pulumi
pulumi/pulumi-datadog

datadog.SecurityMonitoringRule

Explore with Pulumi AI

Datadog v4.49.0 published on Thursday, Apr 17, 2025 by Pulumi
pulumi/pulumi-datadog

Provides a Datadog Security Monitoring Rule API resource. This can be used to create and manage Datadog security monitoring rules. To change settings for a default rule use datadog_security_default_rule instead.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as datadog from "@pulumi/datadog";

const myrule = new datadog.SecurityMonitoringRule("myrule", {
    name: "My rule",
    message: "The rule has triggered.",
    enabled: true,
    queries: [
        {
            name: "errors",
            query: "status:error",
            aggregation: "count",
            dataSource: "logs",
            groupByFields: ["host"],
        },
        {
            name: "warnings",
            query: "status:warning",
            aggregation: "count",
            dataSource: "logs",
            groupByFields: ["host"],
        },
    ],
    cases: [{
        status: "high",
        condition: "errors > 3 && warnings > 10",
        notifications: ["@user"],
    }],
    options: {
        evaluationWindow: 300,
        keepAlive: 600,
        maxSignalDuration: 900,
    },
    tags: ["type:dos"],
});
Copy
import pulumi
import pulumi_datadog as datadog

myrule = datadog.SecurityMonitoringRule("myrule",
    name="My rule",
    message="The rule has triggered.",
    enabled=True,
    queries=[
        {
            "name": "errors",
            "query": "status:error",
            "aggregation": "count",
            "data_source": "logs",
            "group_by_fields": ["host"],
        },
        {
            "name": "warnings",
            "query": "status:warning",
            "aggregation": "count",
            "data_source": "logs",
            "group_by_fields": ["host"],
        },
    ],
    cases=[{
        "status": "high",
        "condition": "errors > 3 && warnings > 10",
        "notifications": ["@user"],
    }],
    options={
        "evaluation_window": 300,
        "keep_alive": 600,
        "max_signal_duration": 900,
    },
    tags=["type:dos"])
Copy
package main

import (
	"github.com/pulumi/pulumi-datadog/sdk/v4/go/datadog"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := datadog.NewSecurityMonitoringRule(ctx, "myrule", &datadog.SecurityMonitoringRuleArgs{
			Name:    pulumi.String("My rule"),
			Message: pulumi.String("The rule has triggered."),
			Enabled: pulumi.Bool(true),
			Queries: datadog.SecurityMonitoringRuleQueryArray{
				&datadog.SecurityMonitoringRuleQueryArgs{
					Name:        pulumi.String("errors"),
					Query:       pulumi.String("status:error"),
					Aggregation: pulumi.String("count"),
					DataSource:  pulumi.String("logs"),
					GroupByFields: pulumi.StringArray{
						pulumi.String("host"),
					},
				},
				&datadog.SecurityMonitoringRuleQueryArgs{
					Name:        pulumi.String("warnings"),
					Query:       pulumi.String("status:warning"),
					Aggregation: pulumi.String("count"),
					DataSource:  pulumi.String("logs"),
					GroupByFields: pulumi.StringArray{
						pulumi.String("host"),
					},
				},
			},
			Cases: datadog.SecurityMonitoringRuleCaseArray{
				&datadog.SecurityMonitoringRuleCaseArgs{
					Status:    pulumi.String("high"),
					Condition: pulumi.String("errors > 3 && warnings > 10"),
					Notifications: pulumi.StringArray{
						pulumi.String("@user"),
					},
				},
			},
			Options: &datadog.SecurityMonitoringRuleOptionsArgs{
				EvaluationWindow:  pulumi.Int(300),
				KeepAlive:         pulumi.Int(600),
				MaxSignalDuration: pulumi.Int(900),
			},
			Tags: pulumi.StringArray{
				pulumi.String("type:dos"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Datadog = Pulumi.Datadog;

return await Deployment.RunAsync(() => 
{
    var myrule = new Datadog.SecurityMonitoringRule("myrule", new()
    {
        Name = "My rule",
        Message = "The rule has triggered.",
        Enabled = true,
        Queries = new[]
        {
            new Datadog.Inputs.SecurityMonitoringRuleQueryArgs
            {
                Name = "errors",
                Query = "status:error",
                Aggregation = "count",
                DataSource = "logs",
                GroupByFields = new[]
                {
                    "host",
                },
            },
            new Datadog.Inputs.SecurityMonitoringRuleQueryArgs
            {
                Name = "warnings",
                Query = "status:warning",
                Aggregation = "count",
                DataSource = "logs",
                GroupByFields = new[]
                {
                    "host",
                },
            },
        },
        Cases = new[]
        {
            new Datadog.Inputs.SecurityMonitoringRuleCaseArgs
            {
                Status = "high",
                Condition = "errors > 3 && warnings > 10",
                Notifications = new[]
                {
                    "@user",
                },
            },
        },
        Options = new Datadog.Inputs.SecurityMonitoringRuleOptionsArgs
        {
            EvaluationWindow = 300,
            KeepAlive = 600,
            MaxSignalDuration = 900,
        },
        Tags = new[]
        {
            "type:dos",
        },
    });

});
Copy
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.datadog.SecurityMonitoringRule;
import com.pulumi.datadog.SecurityMonitoringRuleArgs;
import com.pulumi.datadog.inputs.SecurityMonitoringRuleQueryArgs;
import com.pulumi.datadog.inputs.SecurityMonitoringRuleCaseArgs;
import com.pulumi.datadog.inputs.SecurityMonitoringRuleOptionsArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var myrule = new SecurityMonitoringRule("myrule", SecurityMonitoringRuleArgs.builder()
            .name("My rule")
            .message("The rule has triggered.")
            .enabled(true)
            .queries(            
                SecurityMonitoringRuleQueryArgs.builder()
                    .name("errors")
                    .query("status:error")
                    .aggregation("count")
                    .dataSource("logs")
                    .groupByFields("host")
                    .build(),
                SecurityMonitoringRuleQueryArgs.builder()
                    .name("warnings")
                    .query("status:warning")
                    .aggregation("count")
                    .dataSource("logs")
                    .groupByFields("host")
                    .build())
            .cases(SecurityMonitoringRuleCaseArgs.builder()
                .status("high")
                .condition("errors > 3 && warnings > 10")
                .notifications("@user")
                .build())
            .options(SecurityMonitoringRuleOptionsArgs.builder()
                .evaluationWindow(300)
                .keepAlive(600)
                .maxSignalDuration(900)
                .build())
            .tags("type:dos")
            .build());

    }
}
Copy
resources:
  myrule:
    type: datadog:SecurityMonitoringRule
    properties:
      name: My rule
      message: The rule has triggered.
      enabled: true
      queries:
        - name: errors
          query: status:error
          aggregation: count
          dataSource: logs
          groupByFields:
            - host
        - name: warnings
          query: status:warning
          aggregation: count
          dataSource: logs
          groupByFields:
            - host
      cases:
        - status: high
          condition: errors > 3 && warnings > 10
          notifications:
            - '@user'
      options:
        evaluationWindow: 300
        keepAlive: 600
        maxSignalDuration: 900
      tags:
        - type:dos
Copy

Create SecurityMonitoringRule Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new SecurityMonitoringRule(name: string, args: SecurityMonitoringRuleArgs, opts?: CustomResourceOptions);
@overload
def SecurityMonitoringRule(resource_name: str,
                           args: SecurityMonitoringRuleArgs,
                           opts: Optional[ResourceOptions] = None)

@overload
def SecurityMonitoringRule(resource_name: str,
                           opts: Optional[ResourceOptions] = None,
                           message: Optional[str] = None,
                           name: Optional[str] = None,
                           group_signals_bies: Optional[Sequence[str]] = None,
                           cases: Optional[Sequence[SecurityMonitoringRuleCaseArgs]] = None,
                           has_extended_title: Optional[bool] = None,
                           filters: Optional[Sequence[SecurityMonitoringRuleFilterArgs]] = None,
                           enabled: Optional[bool] = None,
                           options: Optional[SecurityMonitoringRuleOptionsArgs] = None,
                           queries: Optional[Sequence[SecurityMonitoringRuleQueryArgs]] = None,
                           reference_tables: Optional[Sequence[SecurityMonitoringRuleReferenceTableArgs]] = None,
                           signal_queries: Optional[Sequence[SecurityMonitoringRuleSignalQueryArgs]] = None,
                           tags: Optional[Sequence[str]] = None,
                           third_party_cases: Optional[Sequence[SecurityMonitoringRuleThirdPartyCaseArgs]] = None,
                           type: Optional[str] = None,
                           validate: Optional[bool] = None)
func NewSecurityMonitoringRule(ctx *Context, name string, args SecurityMonitoringRuleArgs, opts ...ResourceOption) (*SecurityMonitoringRule, error)
public SecurityMonitoringRule(string name, SecurityMonitoringRuleArgs args, CustomResourceOptions? opts = null)
public SecurityMonitoringRule(String name, SecurityMonitoringRuleArgs args)
public SecurityMonitoringRule(String name, SecurityMonitoringRuleArgs args, CustomResourceOptions options)

type: datadog:SecurityMonitoringRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name This property is required. string
The unique name of the resource.
args This property is required. SecurityMonitoringRuleArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name This property is required. str
The unique name of the resource.
args This property is required. SecurityMonitoringRuleArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name This property is required. string
The unique name of the resource.
args This property is required. SecurityMonitoringRuleArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name This property is required. string
The unique name of the resource.
args This property is required. SecurityMonitoringRuleArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name This property is required. String
The unique name of the resource.
args This property is required. SecurityMonitoringRuleArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var securityMonitoringRuleResource = new Datadog.SecurityMonitoringRule("securityMonitoringRuleResource", new()
{
    Message = "string",
    Name = "string",
    GroupSignalsBies = new[]
    {
        "string",
    },
    Cases = new[]
    {
        new Datadog.Inputs.SecurityMonitoringRuleCaseArgs
        {
            Status = "string",
            Actions = new[]
            {
                new Datadog.Inputs.SecurityMonitoringRuleCaseActionArgs
                {
                    Type = "string",
                    Options = new Datadog.Inputs.SecurityMonitoringRuleCaseActionOptionsArgs
                    {
                        Duration = 0,
                    },
                },
            },
            Condition = "string",
            Name = "string",
            Notifications = new[]
            {
                "string",
            },
        },
    },
    HasExtendedTitle = false,
    Filters = new[]
    {
        new Datadog.Inputs.SecurityMonitoringRuleFilterArgs
        {
            Action = "string",
            Query = "string",
        },
    },
    Enabled = false,
    Options = new Datadog.Inputs.SecurityMonitoringRuleOptionsArgs
    {
        DecreaseCriticalityBasedOnEnv = false,
        DetectionMethod = "string",
        EvaluationWindow = 0,
        ImpossibleTravelOptions = new Datadog.Inputs.SecurityMonitoringRuleOptionsImpossibleTravelOptionsArgs
        {
            BaselineUserLocations = false,
        },
        KeepAlive = 0,
        MaxSignalDuration = 0,
        NewValueOptions = new Datadog.Inputs.SecurityMonitoringRuleOptionsNewValueOptionsArgs
        {
            ForgetAfter = 0,
            LearningDuration = 0,
            LearningMethod = "string",
            LearningThreshold = 0,
        },
        ThirdPartyRuleOptions = new Datadog.Inputs.SecurityMonitoringRuleOptionsThirdPartyRuleOptionsArgs
        {
            DefaultStatus = "string",
            RootQueries = new[]
            {
                new Datadog.Inputs.SecurityMonitoringRuleOptionsThirdPartyRuleOptionsRootQueryArgs
                {
                    Query = "string",
                    GroupByFields = new[]
                    {
                        "string",
                    },
                },
            },
            DefaultNotifications = new[]
            {
                "string",
            },
            SignalTitleTemplate = "string",
        },
    },
    Queries = new[]
    {
        new Datadog.Inputs.SecurityMonitoringRuleQueryArgs
        {
            Query = "string",
            Aggregation = "string",
            DataSource = "string",
            DistinctFields = new[]
            {
                "string",
            },
            GroupByFields = new[]
            {
                "string",
            },
            Metrics = new[]
            {
                "string",
            },
            Name = "string",
        },
    },
    ReferenceTables = new[]
    {
        new Datadog.Inputs.SecurityMonitoringRuleReferenceTableArgs
        {
            CheckPresence = false,
            ColumnName = "string",
            LogFieldPath = "string",
            RuleQueryName = "string",
            TableName = "string",
        },
    },
    SignalQueries = new[]
    {
        new Datadog.Inputs.SecurityMonitoringRuleSignalQueryArgs
        {
            RuleId = "string",
            Aggregation = "string",
            CorrelatedByFields = new[]
            {
                "string",
            },
            CorrelatedQueryIndex = "string",
            DefaultRuleId = "string",
            Name = "string",
        },
    },
    Tags = new[]
    {
        "string",
    },
    ThirdPartyCases = new[]
    {
        new Datadog.Inputs.SecurityMonitoringRuleThirdPartyCaseArgs
        {
            Status = "string",
            Name = "string",
            Notifications = new[]
            {
                "string",
            },
            Query = "string",
        },
    },
    Type = "string",
    Validate = false,
});
Copy
example, err := datadog.NewSecurityMonitoringRule(ctx, "securityMonitoringRuleResource", &datadog.SecurityMonitoringRuleArgs{
	Message: pulumi.String("string"),
	Name:    pulumi.String("string"),
	GroupSignalsBies: pulumi.StringArray{
		pulumi.String("string"),
	},
	Cases: datadog.SecurityMonitoringRuleCaseArray{
		&datadog.SecurityMonitoringRuleCaseArgs{
			Status: pulumi.String("string"),
			Actions: datadog.SecurityMonitoringRuleCaseActionArray{
				&datadog.SecurityMonitoringRuleCaseActionArgs{
					Type: pulumi.String("string"),
					Options: &datadog.SecurityMonitoringRuleCaseActionOptionsArgs{
						Duration: pulumi.Int(0),
					},
				},
			},
			Condition: pulumi.String("string"),
			Name:      pulumi.String("string"),
			Notifications: pulumi.StringArray{
				pulumi.String("string"),
			},
		},
	},
	HasExtendedTitle: pulumi.Bool(false),
	Filters: datadog.SecurityMonitoringRuleFilterArray{
		&datadog.SecurityMonitoringRuleFilterArgs{
			Action: pulumi.String("string"),
			Query:  pulumi.String("string"),
		},
	},
	Enabled: pulumi.Bool(false),
	Options: &datadog.SecurityMonitoringRuleOptionsArgs{
		DecreaseCriticalityBasedOnEnv: pulumi.Bool(false),
		DetectionMethod:               pulumi.String("string"),
		EvaluationWindow:              pulumi.Int(0),
		ImpossibleTravelOptions: &datadog.SecurityMonitoringRuleOptionsImpossibleTravelOptionsArgs{
			BaselineUserLocations: pulumi.Bool(false),
		},
		KeepAlive:         pulumi.Int(0),
		MaxSignalDuration: pulumi.Int(0),
		NewValueOptions: &datadog.SecurityMonitoringRuleOptionsNewValueOptionsArgs{
			ForgetAfter:       pulumi.Int(0),
			LearningDuration:  pulumi.Int(0),
			LearningMethod:    pulumi.String("string"),
			LearningThreshold: pulumi.Int(0),
		},
		ThirdPartyRuleOptions: &datadog.SecurityMonitoringRuleOptionsThirdPartyRuleOptionsArgs{
			DefaultStatus: pulumi.String("string"),
			RootQueries: datadog.SecurityMonitoringRuleOptionsThirdPartyRuleOptionsRootQueryArray{
				&datadog.SecurityMonitoringRuleOptionsThirdPartyRuleOptionsRootQueryArgs{
					Query: pulumi.String("string"),
					GroupByFields: pulumi.StringArray{
						pulumi.String("string"),
					},
				},
			},
			DefaultNotifications: pulumi.StringArray{
				pulumi.String("string"),
			},
			SignalTitleTemplate: pulumi.String("string"),
		},
	},
	Queries: datadog.SecurityMonitoringRuleQueryArray{
		&datadog.SecurityMonitoringRuleQueryArgs{
			Query:       pulumi.String("string"),
			Aggregation: pulumi.String("string"),
			DataSource:  pulumi.String("string"),
			DistinctFields: pulumi.StringArray{
				pulumi.String("string"),
			},
			GroupByFields: pulumi.StringArray{
				pulumi.String("string"),
			},
			Metrics: pulumi.StringArray{
				pulumi.String("string"),
			},
			Name: pulumi.String("string"),
		},
	},
	ReferenceTables: datadog.SecurityMonitoringRuleReferenceTableArray{
		&datadog.SecurityMonitoringRuleReferenceTableArgs{
			CheckPresence: pulumi.Bool(false),
			ColumnName:    pulumi.String("string"),
			LogFieldPath:  pulumi.String("string"),
			RuleQueryName: pulumi.String("string"),
			TableName:     pulumi.String("string"),
		},
	},
	SignalQueries: datadog.SecurityMonitoringRuleSignalQueryArray{
		&datadog.SecurityMonitoringRuleSignalQueryArgs{
			RuleId:      pulumi.String("string"),
			Aggregation: pulumi.String("string"),
			CorrelatedByFields: pulumi.StringArray{
				pulumi.String("string"),
			},
			CorrelatedQueryIndex: pulumi.String("string"),
			DefaultRuleId:        pulumi.String("string"),
			Name:                 pulumi.String("string"),
		},
	},
	Tags: pulumi.StringArray{
		pulumi.String("string"),
	},
	ThirdPartyCases: datadog.SecurityMonitoringRuleThirdPartyCaseArray{
		&datadog.SecurityMonitoringRuleThirdPartyCaseArgs{
			Status: pulumi.String("string"),
			Name:   pulumi.String("string"),
			Notifications: pulumi.StringArray{
				pulumi.String("string"),
			},
			Query: pulumi.String("string"),
		},
	},
	Type:     pulumi.String("string"),
	Validate: pulumi.Bool(false),
})
Copy
var securityMonitoringRuleResource = new SecurityMonitoringRule("securityMonitoringRuleResource", SecurityMonitoringRuleArgs.builder()
    .message("string")
    .name("string")
    .groupSignalsBies("string")
    .cases(SecurityMonitoringRuleCaseArgs.builder()
        .status("string")
        .actions(SecurityMonitoringRuleCaseActionArgs.builder()
            .type("string")
            .options(SecurityMonitoringRuleCaseActionOptionsArgs.builder()
                .duration(0)
                .build())
            .build())
        .condition("string")
        .name("string")
        .notifications("string")
        .build())
    .hasExtendedTitle(false)
    .filters(SecurityMonitoringRuleFilterArgs.builder()
        .action("string")
        .query("string")
        .build())
    .enabled(false)
    .options(SecurityMonitoringRuleOptionsArgs.builder()
        .decreaseCriticalityBasedOnEnv(false)
        .detectionMethod("string")
        .evaluationWindow(0)
        .impossibleTravelOptions(SecurityMonitoringRuleOptionsImpossibleTravelOptionsArgs.builder()
            .baselineUserLocations(false)
            .build())
        .keepAlive(0)
        .maxSignalDuration(0)
        .newValueOptions(SecurityMonitoringRuleOptionsNewValueOptionsArgs.builder()
            .forgetAfter(0)
            .learningDuration(0)
            .learningMethod("string")
            .learningThreshold(0)
            .build())
        .thirdPartyRuleOptions(SecurityMonitoringRuleOptionsThirdPartyRuleOptionsArgs.builder()
            .defaultStatus("string")
            .rootQueries(SecurityMonitoringRuleOptionsThirdPartyRuleOptionsRootQueryArgs.builder()
                .query("string")
                .groupByFields("string")
                .build())
            .defaultNotifications("string")
            .signalTitleTemplate("string")
            .build())
        .build())
    .queries(SecurityMonitoringRuleQueryArgs.builder()
        .query("string")
        .aggregation("string")
        .dataSource("string")
        .distinctFields("string")
        .groupByFields("string")
        .metrics("string")
        .name("string")
        .build())
    .referenceTables(SecurityMonitoringRuleReferenceTableArgs.builder()
        .checkPresence(false)
        .columnName("string")
        .logFieldPath("string")
        .ruleQueryName("string")
        .tableName("string")
        .build())
    .signalQueries(SecurityMonitoringRuleSignalQueryArgs.builder()
        .ruleId("string")
        .aggregation("string")
        .correlatedByFields("string")
        .correlatedQueryIndex("string")
        .defaultRuleId("string")
        .name("string")
        .build())
    .tags("string")
    .thirdPartyCases(SecurityMonitoringRuleThirdPartyCaseArgs.builder()
        .status("string")
        .name("string")
        .notifications("string")
        .query("string")
        .build())
    .type("string")
    .validate(false)
    .build());
Copy
security_monitoring_rule_resource = datadog.SecurityMonitoringRule("securityMonitoringRuleResource",
    message="string",
    name="string",
    group_signals_bies=["string"],
    cases=[{
        "status": "string",
        "actions": [{
            "type": "string",
            "options": {
                "duration": 0,
            },
        }],
        "condition": "string",
        "name": "string",
        "notifications": ["string"],
    }],
    has_extended_title=False,
    filters=[{
        "action": "string",
        "query": "string",
    }],
    enabled=False,
    options={
        "decrease_criticality_based_on_env": False,
        "detection_method": "string",
        "evaluation_window": 0,
        "impossible_travel_options": {
            "baseline_user_locations": False,
        },
        "keep_alive": 0,
        "max_signal_duration": 0,
        "new_value_options": {
            "forget_after": 0,
            "learning_duration": 0,
            "learning_method": "string",
            "learning_threshold": 0,
        },
        "third_party_rule_options": {
            "default_status": "string",
            "root_queries": [{
                "query": "string",
                "group_by_fields": ["string"],
            }],
            "default_notifications": ["string"],
            "signal_title_template": "string",
        },
    },
    queries=[{
        "query": "string",
        "aggregation": "string",
        "data_source": "string",
        "distinct_fields": ["string"],
        "group_by_fields": ["string"],
        "metrics": ["string"],
        "name": "string",
    }],
    reference_tables=[{
        "check_presence": False,
        "column_name": "string",
        "log_field_path": "string",
        "rule_query_name": "string",
        "table_name": "string",
    }],
    signal_queries=[{
        "rule_id": "string",
        "aggregation": "string",
        "correlated_by_fields": ["string"],
        "correlated_query_index": "string",
        "default_rule_id": "string",
        "name": "string",
    }],
    tags=["string"],
    third_party_cases=[{
        "status": "string",
        "name": "string",
        "notifications": ["string"],
        "query": "string",
    }],
    type="string",
    validate=False)
Copy
const securityMonitoringRuleResource = new datadog.SecurityMonitoringRule("securityMonitoringRuleResource", {
    message: "string",
    name: "string",
    groupSignalsBies: ["string"],
    cases: [{
        status: "string",
        actions: [{
            type: "string",
            options: {
                duration: 0,
            },
        }],
        condition: "string",
        name: "string",
        notifications: ["string"],
    }],
    hasExtendedTitle: false,
    filters: [{
        action: "string",
        query: "string",
    }],
    enabled: false,
    options: {
        decreaseCriticalityBasedOnEnv: false,
        detectionMethod: "string",
        evaluationWindow: 0,
        impossibleTravelOptions: {
            baselineUserLocations: false,
        },
        keepAlive: 0,
        maxSignalDuration: 0,
        newValueOptions: {
            forgetAfter: 0,
            learningDuration: 0,
            learningMethod: "string",
            learningThreshold: 0,
        },
        thirdPartyRuleOptions: {
            defaultStatus: "string",
            rootQueries: [{
                query: "string",
                groupByFields: ["string"],
            }],
            defaultNotifications: ["string"],
            signalTitleTemplate: "string",
        },
    },
    queries: [{
        query: "string",
        aggregation: "string",
        dataSource: "string",
        distinctFields: ["string"],
        groupByFields: ["string"],
        metrics: ["string"],
        name: "string",
    }],
    referenceTables: [{
        checkPresence: false,
        columnName: "string",
        logFieldPath: "string",
        ruleQueryName: "string",
        tableName: "string",
    }],
    signalQueries: [{
        ruleId: "string",
        aggregation: "string",
        correlatedByFields: ["string"],
        correlatedQueryIndex: "string",
        defaultRuleId: "string",
        name: "string",
    }],
    tags: ["string"],
    thirdPartyCases: [{
        status: "string",
        name: "string",
        notifications: ["string"],
        query: "string",
    }],
    type: "string",
    validate: false,
});
Copy
type: datadog:SecurityMonitoringRule
properties:
    cases:
        - actions:
            - options:
                duration: 0
              type: string
          condition: string
          name: string
          notifications:
            - string
          status: string
    enabled: false
    filters:
        - action: string
          query: string
    groupSignalsBies:
        - string
    hasExtendedTitle: false
    message: string
    name: string
    options:
        decreaseCriticalityBasedOnEnv: false
        detectionMethod: string
        evaluationWindow: 0
        impossibleTravelOptions:
            baselineUserLocations: false
        keepAlive: 0
        maxSignalDuration: 0
        newValueOptions:
            forgetAfter: 0
            learningDuration: 0
            learningMethod: string
            learningThreshold: 0
        thirdPartyRuleOptions:
            defaultNotifications:
                - string
            defaultStatus: string
            rootQueries:
                - groupByFields:
                    - string
                  query: string
            signalTitleTemplate: string
    queries:
        - aggregation: string
          dataSource: string
          distinctFields:
            - string
          groupByFields:
            - string
          metrics:
            - string
          name: string
          query: string
    referenceTables:
        - checkPresence: false
          columnName: string
          logFieldPath: string
          ruleQueryName: string
          tableName: string
    signalQueries:
        - aggregation: string
          correlatedByFields:
            - string
          correlatedQueryIndex: string
          defaultRuleId: string
          name: string
          ruleId: string
    tags:
        - string
    thirdPartyCases:
        - name: string
          notifications:
            - string
          query: string
          status: string
    type: string
    validate: false
Copy

SecurityMonitoringRule Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The SecurityMonitoringRule resource accepts the following input properties:

Message This property is required. string
Message for generated signals.
Name This property is required. string
The name of the rule.
Cases List<SecurityMonitoringRuleCase>
Cases for generating signals.
Enabled bool
Whether the rule is enabled. Defaults to true.
Filters List<SecurityMonitoringRuleFilter>
Additional queries to filter matched events before they are processed. Note: This field is deprecated for log detection, signal correlation, and workload security rules.
GroupSignalsBies List<string>
Additional grouping to perform on top of the query grouping.
HasExtendedTitle bool
Whether the notifications include the triggering group-by values in their title. Defaults to false.
Options SecurityMonitoringRuleOptions
Options on rules.
Queries List<SecurityMonitoringRuleQuery>
Queries for selecting logs which are part of the rule.
ReferenceTables List<SecurityMonitoringRuleReferenceTable>
Reference tables for filtering query results.
SignalQueries List<SecurityMonitoringRuleSignalQuery>
Queries for selecting logs which are part of the rule.
Tags List<string>
Tags for generated signals.
ThirdPartyCases List<SecurityMonitoringRuleThirdPartyCase>
Cases for generating signals for third-party rules. Only required and accepted for third-party rules
Type string
The rule type. Valid values are application_security, log_detection, workload_security, signal_correlation. Defaults to "log_detection".
Validate bool
Whether or not to validate the Rule.
Message This property is required. string
Message for generated signals.
Name This property is required. string
The name of the rule.
Cases []SecurityMonitoringRuleCaseArgs
Cases for generating signals.
Enabled bool
Whether the rule is enabled. Defaults to true.
Filters []SecurityMonitoringRuleFilterArgs
Additional queries to filter matched events before they are processed. Note: This field is deprecated for log detection, signal correlation, and workload security rules.
GroupSignalsBies []string
Additional grouping to perform on top of the query grouping.
HasExtendedTitle bool
Whether the notifications include the triggering group-by values in their title. Defaults to false.
Options SecurityMonitoringRuleOptionsArgs
Options on rules.
Queries []SecurityMonitoringRuleQueryArgs
Queries for selecting logs which are part of the rule.
ReferenceTables []SecurityMonitoringRuleReferenceTableArgs
Reference tables for filtering query results.
SignalQueries []SecurityMonitoringRuleSignalQueryArgs
Queries for selecting logs which are part of the rule.
Tags []string
Tags for generated signals.
ThirdPartyCases []SecurityMonitoringRuleThirdPartyCaseArgs
Cases for generating signals for third-party rules. Only required and accepted for third-party rules
Type string
The rule type. Valid values are application_security, log_detection, workload_security, signal_correlation. Defaults to "log_detection".
Validate bool
Whether or not to validate the Rule.
message This property is required. String
Message for generated signals.
name This property is required. String
The name of the rule.
cases List<SecurityMonitoringRuleCase>
Cases for generating signals.
enabled Boolean
Whether the rule is enabled. Defaults to true.
filters List<SecurityMonitoringRuleFilter>
Additional queries to filter matched events before they are processed. Note: This field is deprecated for log detection, signal correlation, and workload security rules.
groupSignalsBies List<String>
Additional grouping to perform on top of the query grouping.
hasExtendedTitle Boolean
Whether the notifications include the triggering group-by values in their title. Defaults to false.
options SecurityMonitoringRuleOptions
Options on rules.
queries List<SecurityMonitoringRuleQuery>
Queries for selecting logs which are part of the rule.
referenceTables List<SecurityMonitoringRuleReferenceTable>
Reference tables for filtering query results.
signalQueries List<SecurityMonitoringRuleSignalQuery>
Queries for selecting logs which are part of the rule.
tags List<String>
Tags for generated signals.
thirdPartyCases List<SecurityMonitoringRuleThirdPartyCase>
Cases for generating signals for third-party rules. Only required and accepted for third-party rules
type String
The rule type. Valid values are application_security, log_detection, workload_security, signal_correlation. Defaults to "log_detection".
validate Boolean
Whether or not to validate the Rule.
message This property is required. string
Message for generated signals.
name This property is required. string
The name of the rule.
cases SecurityMonitoringRuleCase[]
Cases for generating signals.
enabled boolean
Whether the rule is enabled. Defaults to true.
filters SecurityMonitoringRuleFilter[]
Additional queries to filter matched events before they are processed. Note: This field is deprecated for log detection, signal correlation, and workload security rules.
groupSignalsBies string[]
Additional grouping to perform on top of the query grouping.
hasExtendedTitle boolean
Whether the notifications include the triggering group-by values in their title. Defaults to false.
options SecurityMonitoringRuleOptions
Options on rules.
queries SecurityMonitoringRuleQuery[]
Queries for selecting logs which are part of the rule.
referenceTables SecurityMonitoringRuleReferenceTable[]
Reference tables for filtering query results.
signalQueries SecurityMonitoringRuleSignalQuery[]
Queries for selecting logs which are part of the rule.
tags string[]
Tags for generated signals.
thirdPartyCases SecurityMonitoringRuleThirdPartyCase[]
Cases for generating signals for third-party rules. Only required and accepted for third-party rules
type string
The rule type. Valid values are application_security, log_detection, workload_security, signal_correlation. Defaults to "log_detection".
validate boolean
Whether or not to validate the Rule.
message This property is required. str
Message for generated signals.
name This property is required. str
The name of the rule.
cases Sequence[SecurityMonitoringRuleCaseArgs]
Cases for generating signals.
enabled bool
Whether the rule is enabled. Defaults to true.
filters Sequence[SecurityMonitoringRuleFilterArgs]
Additional queries to filter matched events before they are processed. Note: This field is deprecated for log detection, signal correlation, and workload security rules.
group_signals_bies Sequence[str]
Additional grouping to perform on top of the query grouping.
has_extended_title bool
Whether the notifications include the triggering group-by values in their title. Defaults to false.
options SecurityMonitoringRuleOptionsArgs
Options on rules.
queries Sequence[SecurityMonitoringRuleQueryArgs]
Queries for selecting logs which are part of the rule.
reference_tables Sequence[SecurityMonitoringRuleReferenceTableArgs]
Reference tables for filtering query results.
signal_queries Sequence[SecurityMonitoringRuleSignalQueryArgs]
Queries for selecting logs which are part of the rule.
tags Sequence[str]
Tags for generated signals.
third_party_cases Sequence[SecurityMonitoringRuleThirdPartyCaseArgs]
Cases for generating signals for third-party rules. Only required and accepted for third-party rules
type str
The rule type. Valid values are application_security, log_detection, workload_security, signal_correlation. Defaults to "log_detection".
validate bool
Whether or not to validate the Rule.
message This property is required. String
Message for generated signals.
name This property is required. String
The name of the rule.
cases List<Property Map>
Cases for generating signals.
enabled Boolean
Whether the rule is enabled. Defaults to true.
filters List<Property Map>
Additional queries to filter matched events before they are processed. Note: This field is deprecated for log detection, signal correlation, and workload security rules.
groupSignalsBies List<String>
Additional grouping to perform on top of the query grouping.
hasExtendedTitle Boolean
Whether the notifications include the triggering group-by values in their title. Defaults to false.
options Property Map
Options on rules.
queries List<Property Map>
Queries for selecting logs which are part of the rule.
referenceTables List<Property Map>
Reference tables for filtering query results.
signalQueries List<Property Map>
Queries for selecting logs which are part of the rule.
tags List<String>
Tags for generated signals.
thirdPartyCases List<Property Map>
Cases for generating signals for third-party rules. Only required and accepted for third-party rules
type String
The rule type. Valid values are application_security, log_detection, workload_security, signal_correlation. Defaults to "log_detection".
validate Boolean
Whether or not to validate the Rule.

Outputs

All input properties are implicitly available as output properties. Additionally, the SecurityMonitoringRule resource produces the following output properties:

Id string
The provider-assigned unique ID for this managed resource.
Id string
The provider-assigned unique ID for this managed resource.
id String
The provider-assigned unique ID for this managed resource.
id string
The provider-assigned unique ID for this managed resource.
id str
The provider-assigned unique ID for this managed resource.
id String
The provider-assigned unique ID for this managed resource.

Look up Existing SecurityMonitoringRule Resource

Get an existing SecurityMonitoringRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: SecurityMonitoringRuleState, opts?: CustomResourceOptions): SecurityMonitoringRule
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        cases: Optional[Sequence[SecurityMonitoringRuleCaseArgs]] = None,
        enabled: Optional[bool] = None,
        filters: Optional[Sequence[SecurityMonitoringRuleFilterArgs]] = None,
        group_signals_bies: Optional[Sequence[str]] = None,
        has_extended_title: Optional[bool] = None,
        message: Optional[str] = None,
        name: Optional[str] = None,
        options: Optional[SecurityMonitoringRuleOptionsArgs] = None,
        queries: Optional[Sequence[SecurityMonitoringRuleQueryArgs]] = None,
        reference_tables: Optional[Sequence[SecurityMonitoringRuleReferenceTableArgs]] = None,
        signal_queries: Optional[Sequence[SecurityMonitoringRuleSignalQueryArgs]] = None,
        tags: Optional[Sequence[str]] = None,
        third_party_cases: Optional[Sequence[SecurityMonitoringRuleThirdPartyCaseArgs]] = None,
        type: Optional[str] = None,
        validate: Optional[bool] = None) -> SecurityMonitoringRule
func GetSecurityMonitoringRule(ctx *Context, name string, id IDInput, state *SecurityMonitoringRuleState, opts ...ResourceOption) (*SecurityMonitoringRule, error)
public static SecurityMonitoringRule Get(string name, Input<string> id, SecurityMonitoringRuleState? state, CustomResourceOptions? opts = null)
public static SecurityMonitoringRule get(String name, Output<String> id, SecurityMonitoringRuleState state, CustomResourceOptions options)
resources:  _:    type: datadog:SecurityMonitoringRule    get:      id: ${id}
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
Cases List<SecurityMonitoringRuleCase>
Cases for generating signals.
Enabled bool
Whether the rule is enabled. Defaults to true.
Filters List<SecurityMonitoringRuleFilter>
Additional queries to filter matched events before they are processed. Note: This field is deprecated for log detection, signal correlation, and workload security rules.
GroupSignalsBies List<string>
Additional grouping to perform on top of the query grouping.
HasExtendedTitle bool
Whether the notifications include the triggering group-by values in their title. Defaults to false.
Message string
Message for generated signals.
Name string
The name of the rule.
Options SecurityMonitoringRuleOptions
Options on rules.
Queries List<SecurityMonitoringRuleQuery>
Queries for selecting logs which are part of the rule.
ReferenceTables List<SecurityMonitoringRuleReferenceTable>
Reference tables for filtering query results.
SignalQueries List<SecurityMonitoringRuleSignalQuery>
Queries for selecting logs which are part of the rule.
Tags List<string>
Tags for generated signals.
ThirdPartyCases List<SecurityMonitoringRuleThirdPartyCase>
Cases for generating signals for third-party rules. Only required and accepted for third-party rules
Type string
The rule type. Valid values are application_security, log_detection, workload_security, signal_correlation. Defaults to "log_detection".
Validate bool
Whether or not to validate the Rule.
Cases []SecurityMonitoringRuleCaseArgs
Cases for generating signals.
Enabled bool
Whether the rule is enabled. Defaults to true.
Filters []SecurityMonitoringRuleFilterArgs
Additional queries to filter matched events before they are processed. Note: This field is deprecated for log detection, signal correlation, and workload security rules.
GroupSignalsBies []string
Additional grouping to perform on top of the query grouping.
HasExtendedTitle bool
Whether the notifications include the triggering group-by values in their title. Defaults to false.
Message string
Message for generated signals.
Name string
The name of the rule.
Options SecurityMonitoringRuleOptionsArgs
Options on rules.
Queries []SecurityMonitoringRuleQueryArgs
Queries for selecting logs which are part of the rule.
ReferenceTables []SecurityMonitoringRuleReferenceTableArgs
Reference tables for filtering query results.
SignalQueries []SecurityMonitoringRuleSignalQueryArgs
Queries for selecting logs which are part of the rule.
Tags []string
Tags for generated signals.
ThirdPartyCases []SecurityMonitoringRuleThirdPartyCaseArgs
Cases for generating signals for third-party rules. Only required and accepted for third-party rules
Type string
The rule type. Valid values are application_security, log_detection, workload_security, signal_correlation. Defaults to "log_detection".
Validate bool
Whether or not to validate the Rule.
cases List<SecurityMonitoringRuleCase>
Cases for generating signals.
enabled Boolean
Whether the rule is enabled. Defaults to true.
filters List<SecurityMonitoringRuleFilter>
Additional queries to filter matched events before they are processed. Note: This field is deprecated for log detection, signal correlation, and workload security rules.
groupSignalsBies List<String>
Additional grouping to perform on top of the query grouping.
hasExtendedTitle Boolean
Whether the notifications include the triggering group-by values in their title. Defaults to false.
message String
Message for generated signals.
name String
The name of the rule.
options SecurityMonitoringRuleOptions
Options on rules.
queries List<SecurityMonitoringRuleQuery>
Queries for selecting logs which are part of the rule.
referenceTables List<SecurityMonitoringRuleReferenceTable>
Reference tables for filtering query results.
signalQueries List<SecurityMonitoringRuleSignalQuery>
Queries for selecting logs which are part of the rule.
tags List<String>
Tags for generated signals.
thirdPartyCases List<SecurityMonitoringRuleThirdPartyCase>
Cases for generating signals for third-party rules. Only required and accepted for third-party rules
type String
The rule type. Valid values are application_security, log_detection, workload_security, signal_correlation. Defaults to "log_detection".
validate Boolean
Whether or not to validate the Rule.
cases SecurityMonitoringRuleCase[]
Cases for generating signals.
enabled boolean
Whether the rule is enabled. Defaults to true.
filters SecurityMonitoringRuleFilter[]
Additional queries to filter matched events before they are processed. Note: This field is deprecated for log detection, signal correlation, and workload security rules.
groupSignalsBies string[]
Additional grouping to perform on top of the query grouping.
hasExtendedTitle boolean
Whether the notifications include the triggering group-by values in their title. Defaults to false.
message string
Message for generated signals.
name string
The name of the rule.
options SecurityMonitoringRuleOptions
Options on rules.
queries SecurityMonitoringRuleQuery[]
Queries for selecting logs which are part of the rule.
referenceTables SecurityMonitoringRuleReferenceTable[]
Reference tables for filtering query results.
signalQueries SecurityMonitoringRuleSignalQuery[]
Queries for selecting logs which are part of the rule.
tags string[]
Tags for generated signals.
thirdPartyCases SecurityMonitoringRuleThirdPartyCase[]
Cases for generating signals for third-party rules. Only required and accepted for third-party rules
type string
The rule type. Valid values are application_security, log_detection, workload_security, signal_correlation. Defaults to "log_detection".
validate boolean
Whether or not to validate the Rule.
cases Sequence[SecurityMonitoringRuleCaseArgs]
Cases for generating signals.
enabled bool
Whether the rule is enabled. Defaults to true.
filters Sequence[SecurityMonitoringRuleFilterArgs]
Additional queries to filter matched events before they are processed. Note: This field is deprecated for log detection, signal correlation, and workload security rules.
group_signals_bies Sequence[str]
Additional grouping to perform on top of the query grouping.
has_extended_title bool
Whether the notifications include the triggering group-by values in their title. Defaults to false.
message str
Message for generated signals.
name str
The name of the rule.
options SecurityMonitoringRuleOptionsArgs
Options on rules.
queries Sequence[SecurityMonitoringRuleQueryArgs]
Queries for selecting logs which are part of the rule.
reference_tables Sequence[SecurityMonitoringRuleReferenceTableArgs]
Reference tables for filtering query results.
signal_queries Sequence[SecurityMonitoringRuleSignalQueryArgs]
Queries for selecting logs which are part of the rule.
tags Sequence[str]
Tags for generated signals.
third_party_cases Sequence[SecurityMonitoringRuleThirdPartyCaseArgs]
Cases for generating signals for third-party rules. Only required and accepted for third-party rules
type str
The rule type. Valid values are application_security, log_detection, workload_security, signal_correlation. Defaults to "log_detection".
validate bool
Whether or not to validate the Rule.
cases List<Property Map>
Cases for generating signals.
enabled Boolean
Whether the rule is enabled. Defaults to true.
filters List<Property Map>
Additional queries to filter matched events before they are processed. Note: This field is deprecated for log detection, signal correlation, and workload security rules.
groupSignalsBies List<String>
Additional grouping to perform on top of the query grouping.
hasExtendedTitle Boolean
Whether the notifications include the triggering group-by values in their title. Defaults to false.
message String
Message for generated signals.
name String
The name of the rule.
options Property Map
Options on rules.
queries List<Property Map>
Queries for selecting logs which are part of the rule.
referenceTables List<Property Map>
Reference tables for filtering query results.
signalQueries List<Property Map>
Queries for selecting logs which are part of the rule.
tags List<String>
Tags for generated signals.
thirdPartyCases List<Property Map>
Cases for generating signals for third-party rules. Only required and accepted for third-party rules
type String
The rule type. Valid values are application_security, log_detection, workload_security, signal_correlation. Defaults to "log_detection".
validate Boolean
Whether or not to validate the Rule.

Supporting Types

SecurityMonitoringRuleCase
, SecurityMonitoringRuleCaseArgs

Status This property is required. string
Severity of the Security Signal. Valid values are info, low, medium, high, critical.
Actions List<SecurityMonitoringRuleCaseAction>
Action to perform when the case trigger
Condition string
A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated based on the event counts in the previously defined queries.
Name string
Name of the case.
Notifications List<string>
Notification targets for each rule case.
Status This property is required. string
Severity of the Security Signal. Valid values are info, low, medium, high, critical.
Actions []SecurityMonitoringRuleCaseAction
Action to perform when the case trigger
Condition string
A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated based on the event counts in the previously defined queries.
Name string
Name of the case.
Notifications []string
Notification targets for each rule case.
status This property is required. String
Severity of the Security Signal. Valid values are info, low, medium, high, critical.
actions List<SecurityMonitoringRuleCaseAction>
Action to perform when the case trigger
condition String
A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated based on the event counts in the previously defined queries.
name String
Name of the case.
notifications List<String>
Notification targets for each rule case.
status This property is required. string
Severity of the Security Signal. Valid values are info, low, medium, high, critical.
actions SecurityMonitoringRuleCaseAction[]
Action to perform when the case trigger
condition string
A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated based on the event counts in the previously defined queries.
name string
Name of the case.
notifications string[]
Notification targets for each rule case.
status This property is required. str
Severity of the Security Signal. Valid values are info, low, medium, high, critical.
actions Sequence[SecurityMonitoringRuleCaseAction]
Action to perform when the case trigger
condition str
A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated based on the event counts in the previously defined queries.
name str
Name of the case.
notifications Sequence[str]
Notification targets for each rule case.
status This property is required. String
Severity of the Security Signal. Valid values are info, low, medium, high, critical.
actions List<Property Map>
Action to perform when the case trigger
condition String
A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated based on the event counts in the previously defined queries.
name String
Name of the case.
notifications List<String>
Notification targets for each rule case.

SecurityMonitoringRuleCaseAction
, SecurityMonitoringRuleCaseActionArgs

Type This property is required. string
Type of action to perform when the case triggers. Valid values are block_ip, block_user.
Options SecurityMonitoringRuleCaseActionOptions
Options for the action.
Type This property is required. string
Type of action to perform when the case triggers. Valid values are block_ip, block_user.
Options SecurityMonitoringRuleCaseActionOptions
Options for the action.
type This property is required. String
Type of action to perform when the case triggers. Valid values are block_ip, block_user.
options SecurityMonitoringRuleCaseActionOptions
Options for the action.
type This property is required. string
Type of action to perform when the case triggers. Valid values are block_ip, block_user.
options SecurityMonitoringRuleCaseActionOptions
Options for the action.
type This property is required. str
Type of action to perform when the case triggers. Valid values are block_ip, block_user.
options SecurityMonitoringRuleCaseActionOptions
Options for the action.
type This property is required. String
Type of action to perform when the case triggers. Valid values are block_ip, block_user.
options Property Map
Options for the action.

SecurityMonitoringRuleCaseActionOptions
, SecurityMonitoringRuleCaseActionOptionsArgs

Duration int
Duration of the action in seconds.
Duration int
Duration of the action in seconds.
duration Integer
Duration of the action in seconds.
duration number
Duration of the action in seconds.
duration int
Duration of the action in seconds.
duration Number
Duration of the action in seconds.

SecurityMonitoringRuleFilter
, SecurityMonitoringRuleFilterArgs

Action This property is required. string
The type of filtering action. Valid values are require, suppress.
Query This property is required. string
Query for selecting logs to apply the filtering action.
Action This property is required. string
The type of filtering action. Valid values are require, suppress.
Query This property is required. string
Query for selecting logs to apply the filtering action.
action This property is required. String
The type of filtering action. Valid values are require, suppress.
query This property is required. String
Query for selecting logs to apply the filtering action.
action This property is required. string
The type of filtering action. Valid values are require, suppress.
query This property is required. string
Query for selecting logs to apply the filtering action.
action This property is required. str
The type of filtering action. Valid values are require, suppress.
query This property is required. str
Query for selecting logs to apply the filtering action.
action This property is required. String
The type of filtering action. Valid values are require, suppress.
query This property is required. String
Query for selecting logs to apply the filtering action.

SecurityMonitoringRuleOptions
, SecurityMonitoringRuleOptionsArgs

DecreaseCriticalityBasedOnEnv bool
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with staging, test, or dev. Only available when the rule type is log_detection. Defaults to false.
DetectionMethod string
The detection method. Valid values are threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party, anomaly_threshold. Defaults to "threshold".
EvaluationWindow int
A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
ImpossibleTravelOptions SecurityMonitoringRuleOptionsImpossibleTravelOptions
Options for rules using the impossible travel detection method.
KeepAlive int
Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
MaxSignalDuration int
A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
NewValueOptions SecurityMonitoringRuleOptionsNewValueOptions
New value rules specific options.
ThirdPartyRuleOptions SecurityMonitoringRuleOptionsThirdPartyRuleOptions
Options for rules using the third-party detection method.
DecreaseCriticalityBasedOnEnv bool
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with staging, test, or dev. Only available when the rule type is log_detection. Defaults to false.
DetectionMethod string
The detection method. Valid values are threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party, anomaly_threshold. Defaults to "threshold".
EvaluationWindow int
A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
ImpossibleTravelOptions SecurityMonitoringRuleOptionsImpossibleTravelOptions
Options for rules using the impossible travel detection method.
KeepAlive int
Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
MaxSignalDuration int
A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
NewValueOptions SecurityMonitoringRuleOptionsNewValueOptions
New value rules specific options.
ThirdPartyRuleOptions SecurityMonitoringRuleOptionsThirdPartyRuleOptions
Options for rules using the third-party detection method.
decreaseCriticalityBasedOnEnv Boolean
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with staging, test, or dev. Only available when the rule type is log_detection. Defaults to false.
detectionMethod String
The detection method. Valid values are threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party, anomaly_threshold. Defaults to "threshold".
evaluationWindow Integer
A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
impossibleTravelOptions SecurityMonitoringRuleOptionsImpossibleTravelOptions
Options for rules using the impossible travel detection method.
keepAlive Integer
Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
maxSignalDuration Integer
A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
newValueOptions SecurityMonitoringRuleOptionsNewValueOptions
New value rules specific options.
thirdPartyRuleOptions SecurityMonitoringRuleOptionsThirdPartyRuleOptions
Options for rules using the third-party detection method.
decreaseCriticalityBasedOnEnv boolean
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with staging, test, or dev. Only available when the rule type is log_detection. Defaults to false.
detectionMethod string
The detection method. Valid values are threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party, anomaly_threshold. Defaults to "threshold".
evaluationWindow number
A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
impossibleTravelOptions SecurityMonitoringRuleOptionsImpossibleTravelOptions
Options for rules using the impossible travel detection method.
keepAlive number
Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
maxSignalDuration number
A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
newValueOptions SecurityMonitoringRuleOptionsNewValueOptions
New value rules specific options.
thirdPartyRuleOptions SecurityMonitoringRuleOptionsThirdPartyRuleOptions
Options for rules using the third-party detection method.
decrease_criticality_based_on_env bool
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with staging, test, or dev. Only available when the rule type is log_detection. Defaults to false.
detection_method str
The detection method. Valid values are threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party, anomaly_threshold. Defaults to "threshold".
evaluation_window int
A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
impossible_travel_options SecurityMonitoringRuleOptionsImpossibleTravelOptions
Options for rules using the impossible travel detection method.
keep_alive int
Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
max_signal_duration int
A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
new_value_options SecurityMonitoringRuleOptionsNewValueOptions
New value rules specific options.
third_party_rule_options SecurityMonitoringRuleOptionsThirdPartyRuleOptions
Options for rules using the third-party detection method.
decreaseCriticalityBasedOnEnv Boolean
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with staging, test, or dev. Only available when the rule type is log_detection. Defaults to false.
detectionMethod String
The detection method. Valid values are threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party, anomaly_threshold. Defaults to "threshold".
evaluationWindow Number
A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
impossibleTravelOptions Property Map
Options for rules using the impossible travel detection method.
keepAlive Number
Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
maxSignalDuration Number
A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
newValueOptions Property Map
New value rules specific options.
thirdPartyRuleOptions Property Map
Options for rules using the third-party detection method.

SecurityMonitoringRuleOptionsImpossibleTravelOptions
, SecurityMonitoringRuleOptionsImpossibleTravelOptionsArgs

BaselineUserLocations bool
If true, signals are suppressed for the first 24 hours. During that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access. Defaults to false.
BaselineUserLocations bool
If true, signals are suppressed for the first 24 hours. During that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access. Defaults to false.
baselineUserLocations Boolean
If true, signals are suppressed for the first 24 hours. During that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access. Defaults to false.
baselineUserLocations boolean
If true, signals are suppressed for the first 24 hours. During that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access. Defaults to false.
baseline_user_locations bool
If true, signals are suppressed for the first 24 hours. During that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access. Defaults to false.
baselineUserLocations Boolean
If true, signals are suppressed for the first 24 hours. During that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access. Defaults to false.

SecurityMonitoringRuleOptionsNewValueOptions
, SecurityMonitoringRuleOptionsNewValueOptionsArgs

ForgetAfter This property is required. int
The duration in days after which a learned value is forgotten. Valid values are 1, 2, 7, 14, 21, 28.
LearningDuration int
The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. Valid values are 0, 1, 7. Defaults to 1.
LearningMethod string
The learning method used to determine when signals should be generated for values that weren't learned. Valid values are duration, threshold. Defaults to "duration".
LearningThreshold int
A number of occurrences after which signals are generated for values that weren't learned. Valid values are 0, 1. Defaults to 0.
ForgetAfter This property is required. int
The duration in days after which a learned value is forgotten. Valid values are 1, 2, 7, 14, 21, 28.
LearningDuration int
The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. Valid values are 0, 1, 7. Defaults to 1.
LearningMethod string
The learning method used to determine when signals should be generated for values that weren't learned. Valid values are duration, threshold. Defaults to "duration".
LearningThreshold int
A number of occurrences after which signals are generated for values that weren't learned. Valid values are 0, 1. Defaults to 0.
forgetAfter This property is required. Integer
The duration in days after which a learned value is forgotten. Valid values are 1, 2, 7, 14, 21, 28.
learningDuration Integer
The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. Valid values are 0, 1, 7. Defaults to 1.
learningMethod String
The learning method used to determine when signals should be generated for values that weren't learned. Valid values are duration, threshold. Defaults to "duration".
learningThreshold Integer
A number of occurrences after which signals are generated for values that weren't learned. Valid values are 0, 1. Defaults to 0.
forgetAfter This property is required. number
The duration in days after which a learned value is forgotten. Valid values are 1, 2, 7, 14, 21, 28.
learningDuration number
The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. Valid values are 0, 1, 7. Defaults to 1.
learningMethod string
The learning method used to determine when signals should be generated for values that weren't learned. Valid values are duration, threshold. Defaults to "duration".
learningThreshold number
A number of occurrences after which signals are generated for values that weren't learned. Valid values are 0, 1. Defaults to 0.
forget_after This property is required. int
The duration in days after which a learned value is forgotten. Valid values are 1, 2, 7, 14, 21, 28.
learning_duration int
The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. Valid values are 0, 1, 7. Defaults to 1.
learning_method str
The learning method used to determine when signals should be generated for values that weren't learned. Valid values are duration, threshold. Defaults to "duration".
learning_threshold int
A number of occurrences after which signals are generated for values that weren't learned. Valid values are 0, 1. Defaults to 0.
forgetAfter This property is required. Number
The duration in days after which a learned value is forgotten. Valid values are 1, 2, 7, 14, 21, 28.
learningDuration Number
The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. Valid values are 0, 1, 7. Defaults to 1.
learningMethod String
The learning method used to determine when signals should be generated for values that weren't learned. Valid values are duration, threshold. Defaults to "duration".
learningThreshold Number
A number of occurrences after which signals are generated for values that weren't learned. Valid values are 0, 1. Defaults to 0.

SecurityMonitoringRuleOptionsThirdPartyRuleOptions
, SecurityMonitoringRuleOptionsThirdPartyRuleOptionsArgs

DefaultStatus This property is required. string
Severity of the default rule case, when none of the third-party cases match. Valid values are info, low, medium, high, critical.
RootQueries This property is required. List<SecurityMonitoringRuleOptionsThirdPartyRuleOptionsRootQuery>
Queries to be combined with third-party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
DefaultNotifications List<string>
Notification targets for the default rule case, when none of the third-party cases match.
SignalTitleTemplate string
A template for the signal title; if omitted, the title is generated based on the case name.
DefaultStatus This property is required. string
Severity of the default rule case, when none of the third-party cases match. Valid values are info, low, medium, high, critical.
RootQueries This property is required. []SecurityMonitoringRuleOptionsThirdPartyRuleOptionsRootQuery
Queries to be combined with third-party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
DefaultNotifications []string
Notification targets for the default rule case, when none of the third-party cases match.
SignalTitleTemplate string
A template for the signal title; if omitted, the title is generated based on the case name.
defaultStatus This property is required. String
Severity of the default rule case, when none of the third-party cases match. Valid values are info, low, medium, high, critical.
rootQueries This property is required. List<SecurityMonitoringRuleOptionsThirdPartyRuleOptionsRootQuery>
Queries to be combined with third-party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
defaultNotifications List<String>
Notification targets for the default rule case, when none of the third-party cases match.
signalTitleTemplate String
A template for the signal title; if omitted, the title is generated based on the case name.
defaultStatus This property is required. string
Severity of the default rule case, when none of the third-party cases match. Valid values are info, low, medium, high, critical.
rootQueries This property is required. SecurityMonitoringRuleOptionsThirdPartyRuleOptionsRootQuery[]
Queries to be combined with third-party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
defaultNotifications string[]
Notification targets for the default rule case, when none of the third-party cases match.
signalTitleTemplate string
A template for the signal title; if omitted, the title is generated based on the case name.
default_status This property is required. str
Severity of the default rule case, when none of the third-party cases match. Valid values are info, low, medium, high, critical.
root_queries This property is required. Sequence[SecurityMonitoringRuleOptionsThirdPartyRuleOptionsRootQuery]
Queries to be combined with third-party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
default_notifications Sequence[str]
Notification targets for the default rule case, when none of the third-party cases match.
signal_title_template str
A template for the signal title; if omitted, the title is generated based on the case name.
defaultStatus This property is required. String
Severity of the default rule case, when none of the third-party cases match. Valid values are info, low, medium, high, critical.
rootQueries This property is required. List<Property Map>
Queries to be combined with third-party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
defaultNotifications List<String>
Notification targets for the default rule case, when none of the third-party cases match.
signalTitleTemplate String
A template for the signal title; if omitted, the title is generated based on the case name.

SecurityMonitoringRuleOptionsThirdPartyRuleOptionsRootQuery
, SecurityMonitoringRuleOptionsThirdPartyRuleOptionsRootQueryArgs

Query This property is required. string
Query to filter logs.
GroupByFields List<string>
Fields to group by. If empty, each log triggers a signal.
Query This property is required. string
Query to filter logs.
GroupByFields []string
Fields to group by. If empty, each log triggers a signal.
query This property is required. String
Query to filter logs.
groupByFields List<String>
Fields to group by. If empty, each log triggers a signal.
query This property is required. string
Query to filter logs.
groupByFields string[]
Fields to group by. If empty, each log triggers a signal.
query This property is required. str
Query to filter logs.
group_by_fields Sequence[str]
Fields to group by. If empty, each log triggers a signal.
query This property is required. String
Query to filter logs.
groupByFields List<String>
Fields to group by. If empty, each log triggers a signal.

SecurityMonitoringRuleQuery
, SecurityMonitoringRuleQueryArgs

Query This property is required. string
Query to run on logs.
AgentRules List<SecurityMonitoringRuleQueryAgentRule>
Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource.

Deprecated: agent_rule has been deprecated in favor of new Agent Rule resource.

Aggregation string
The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "count".
DataSource string
Source of events. Valid values are logs, audit, app_sec_spans, spans, security_runtime, network. Defaults to "logs".
DistinctFields List<string>
Field for which the cardinality is measured. Sent as an array.
GroupByFields List<string>
Fields to group by.
Metric string
The target field to aggregate over when using the sum, max, or geo_data aggregations. Deprecated. Configure metrics instead. This attribute will be removed in the next major version of the provider.

Deprecated: Configure metrics instead. This attribute will be removed in the next major version of the provider.

Metrics List<string>
Group of target fields to aggregate over when using the sum, max, geo_data, or new_value aggregations. The sum, max, and geo_data aggregations only accept one value in this list, whereas the new_value aggregation accepts up to five values.
Name string
Name of the query. Not compatible with new_value aggregations.
Query This property is required. string
Query to run on logs.
AgentRules []SecurityMonitoringRuleQueryAgentRule
Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource.

Deprecated: agent_rule has been deprecated in favor of new Agent Rule resource.

Aggregation string
The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "count".
DataSource string
Source of events. Valid values are logs, audit, app_sec_spans, spans, security_runtime, network. Defaults to "logs".
DistinctFields []string
Field for which the cardinality is measured. Sent as an array.
GroupByFields []string
Fields to group by.
Metric string
The target field to aggregate over when using the sum, max, or geo_data aggregations. Deprecated. Configure metrics instead. This attribute will be removed in the next major version of the provider.

Deprecated: Configure metrics instead. This attribute will be removed in the next major version of the provider.

Metrics []string
Group of target fields to aggregate over when using the sum, max, geo_data, or new_value aggregations. The sum, max, and geo_data aggregations only accept one value in this list, whereas the new_value aggregation accepts up to five values.
Name string
Name of the query. Not compatible with new_value aggregations.
query This property is required. String
Query to run on logs.
agentRules List<SecurityMonitoringRuleQueryAgentRule>
Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource.

Deprecated: agent_rule has been deprecated in favor of new Agent Rule resource.

aggregation String
The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "count".
dataSource String
Source of events. Valid values are logs, audit, app_sec_spans, spans, security_runtime, network. Defaults to "logs".
distinctFields List<String>
Field for which the cardinality is measured. Sent as an array.
groupByFields List<String>
Fields to group by.
metric String
The target field to aggregate over when using the sum, max, or geo_data aggregations. Deprecated. Configure metrics instead. This attribute will be removed in the next major version of the provider.

Deprecated: Configure metrics instead. This attribute will be removed in the next major version of the provider.

metrics List<String>
Group of target fields to aggregate over when using the sum, max, geo_data, or new_value aggregations. The sum, max, and geo_data aggregations only accept one value in this list, whereas the new_value aggregation accepts up to five values.
name String
Name of the query. Not compatible with new_value aggregations.
query This property is required. string
Query to run on logs.
agentRules SecurityMonitoringRuleQueryAgentRule[]
Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource.

Deprecated: agent_rule has been deprecated in favor of new Agent Rule resource.

aggregation string
The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "count".
dataSource string
Source of events. Valid values are logs, audit, app_sec_spans, spans, security_runtime, network. Defaults to "logs".
distinctFields string[]
Field for which the cardinality is measured. Sent as an array.
groupByFields string[]
Fields to group by.
metric string
The target field to aggregate over when using the sum, max, or geo_data aggregations. Deprecated. Configure metrics instead. This attribute will be removed in the next major version of the provider.

Deprecated: Configure metrics instead. This attribute will be removed in the next major version of the provider.

metrics string[]
Group of target fields to aggregate over when using the sum, max, geo_data, or new_value aggregations. The sum, max, and geo_data aggregations only accept one value in this list, whereas the new_value aggregation accepts up to five values.
name string
Name of the query. Not compatible with new_value aggregations.
query This property is required. str
Query to run on logs.
agent_rules Sequence[SecurityMonitoringRuleQueryAgentRule]
Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource.

Deprecated: agent_rule has been deprecated in favor of new Agent Rule resource.

aggregation str
The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "count".
data_source str
Source of events. Valid values are logs, audit, app_sec_spans, spans, security_runtime, network. Defaults to "logs".
distinct_fields Sequence[str]
Field for which the cardinality is measured. Sent as an array.
group_by_fields Sequence[str]
Fields to group by.
metric str
The target field to aggregate over when using the sum, max, or geo_data aggregations. Deprecated. Configure metrics instead. This attribute will be removed in the next major version of the provider.

Deprecated: Configure metrics instead. This attribute will be removed in the next major version of the provider.

metrics Sequence[str]
Group of target fields to aggregate over when using the sum, max, geo_data, or new_value aggregations. The sum, max, and geo_data aggregations only accept one value in this list, whereas the new_value aggregation accepts up to five values.
name str
Name of the query. Not compatible with new_value aggregations.
query This property is required. String
Query to run on logs.
agentRules List<Property Map>
Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource.

Deprecated: agent_rule has been deprecated in favor of new Agent Rule resource.

aggregation String
The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "count".
dataSource String
Source of events. Valid values are logs, audit, app_sec_spans, spans, security_runtime, network. Defaults to "logs".
distinctFields List<String>
Field for which the cardinality is measured. Sent as an array.
groupByFields List<String>
Fields to group by.
metric String
The target field to aggregate over when using the sum, max, or geo_data aggregations. Deprecated. Configure metrics instead. This attribute will be removed in the next major version of the provider.

Deprecated: Configure metrics instead. This attribute will be removed in the next major version of the provider.

metrics List<String>
Group of target fields to aggregate over when using the sum, max, geo_data, or new_value aggregations. The sum, max, and geo_data aggregations only accept one value in this list, whereas the new_value aggregation accepts up to five values.
name String
Name of the query. Not compatible with new_value aggregations.

SecurityMonitoringRuleQueryAgentRule
, SecurityMonitoringRuleQueryAgentRuleArgs

AgentRuleId This property is required. string
Deprecated. It won't be applied anymore.
Expression This property is required. string
Deprecated. It won't be applied anymore.
AgentRuleId This property is required. string
Deprecated. It won't be applied anymore.
Expression This property is required. string
Deprecated. It won't be applied anymore.
agentRuleId This property is required. String
Deprecated. It won't be applied anymore.
expression This property is required. String
Deprecated. It won't be applied anymore.
agentRuleId This property is required. string
Deprecated. It won't be applied anymore.
expression This property is required. string
Deprecated. It won't be applied anymore.
agent_rule_id This property is required. str
Deprecated. It won't be applied anymore.
expression This property is required. str
Deprecated. It won't be applied anymore.
agentRuleId This property is required. String
Deprecated. It won't be applied anymore.
expression This property is required. String
Deprecated. It won't be applied anymore.

SecurityMonitoringRuleReferenceTable
, SecurityMonitoringRuleReferenceTableArgs

CheckPresence This property is required. bool
Whether to include or exclude logs that match the reference table.
ColumnName This property is required. string
The name of the column in the reference table.
LogFieldPath This property is required. string
The field in the log that should be matched against the reference table.
RuleQueryName This property is required. string
The name of the query to filter.
TableName This property is required. string
The name of the reference table.
CheckPresence This property is required. bool
Whether to include or exclude logs that match the reference table.
ColumnName This property is required. string
The name of the column in the reference table.
LogFieldPath This property is required. string
The field in the log that should be matched against the reference table.
RuleQueryName This property is required. string
The name of the query to filter.
TableName This property is required. string
The name of the reference table.
checkPresence This property is required. Boolean
Whether to include or exclude logs that match the reference table.
columnName This property is required. String
The name of the column in the reference table.
logFieldPath This property is required. String
The field in the log that should be matched against the reference table.
ruleQueryName This property is required. String
The name of the query to filter.
tableName This property is required. String
The name of the reference table.
checkPresence This property is required. boolean
Whether to include or exclude logs that match the reference table.
columnName This property is required. string
The name of the column in the reference table.
logFieldPath This property is required. string
The field in the log that should be matched against the reference table.
ruleQueryName This property is required. string
The name of the query to filter.
tableName This property is required. string
The name of the reference table.
check_presence This property is required. bool
Whether to include or exclude logs that match the reference table.
column_name This property is required. str
The name of the column in the reference table.
log_field_path This property is required. str
The field in the log that should be matched against the reference table.
rule_query_name This property is required. str
The name of the query to filter.
table_name This property is required. str
The name of the reference table.
checkPresence This property is required. Boolean
Whether to include or exclude logs that match the reference table.
columnName This property is required. String
The name of the column in the reference table.
logFieldPath This property is required. String
The field in the log that should be matched against the reference table.
ruleQueryName This property is required. String
The name of the query to filter.
tableName This property is required. String
The name of the reference table.

SecurityMonitoringRuleSignalQuery
, SecurityMonitoringRuleSignalQueryArgs

RuleId This property is required. string
Rule ID of the signal to correlate.
Aggregation string
The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "event_count".
CorrelatedByFields List<string>
Fields to correlate by.
CorrelatedQueryIndex string
Index of the rule query used to retrieve the correlated field. An empty string applies correlation on the non-projected per query attributes of the rule. Defaults to "".
DefaultRuleId string
Default Rule ID of the signal to correlate. This value is READ-ONLY.
Name string
Name of the query. Not compatible with new_value aggregations.
RuleId This property is required. string
Rule ID of the signal to correlate.
Aggregation string
The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "event_count".
CorrelatedByFields []string
Fields to correlate by.
CorrelatedQueryIndex string
Index of the rule query used to retrieve the correlated field. An empty string applies correlation on the non-projected per query attributes of the rule. Defaults to "".
DefaultRuleId string
Default Rule ID of the signal to correlate. This value is READ-ONLY.
Name string
Name of the query. Not compatible with new_value aggregations.
ruleId This property is required. String
Rule ID of the signal to correlate.
aggregation String
The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "event_count".
correlatedByFields List<String>
Fields to correlate by.
correlatedQueryIndex String
Index of the rule query used to retrieve the correlated field. An empty string applies correlation on the non-projected per query attributes of the rule. Defaults to "".
defaultRuleId String
Default Rule ID of the signal to correlate. This value is READ-ONLY.
name String
Name of the query. Not compatible with new_value aggregations.
ruleId This property is required. string
Rule ID of the signal to correlate.
aggregation string
The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "event_count".
correlatedByFields string[]
Fields to correlate by.
correlatedQueryIndex string
Index of the rule query used to retrieve the correlated field. An empty string applies correlation on the non-projected per query attributes of the rule. Defaults to "".
defaultRuleId string
Default Rule ID of the signal to correlate. This value is READ-ONLY.
name string
Name of the query. Not compatible with new_value aggregations.
rule_id This property is required. str
Rule ID of the signal to correlate.
aggregation str
The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "event_count".
correlated_by_fields Sequence[str]
Fields to correlate by.
correlated_query_index str
Index of the rule query used to retrieve the correlated field. An empty string applies correlation on the non-projected per query attributes of the rule. Defaults to "".
default_rule_id str
Default Rule ID of the signal to correlate. This value is READ-ONLY.
name str
Name of the query. Not compatible with new_value aggregations.
ruleId This property is required. String
Rule ID of the signal to correlate.
aggregation String
The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "event_count".
correlatedByFields List<String>
Fields to correlate by.
correlatedQueryIndex String
Index of the rule query used to retrieve the correlated field. An empty string applies correlation on the non-projected per query attributes of the rule. Defaults to "".
defaultRuleId String
Default Rule ID of the signal to correlate. This value is READ-ONLY.
name String
Name of the query. Not compatible with new_value aggregations.

SecurityMonitoringRuleThirdPartyCase
, SecurityMonitoringRuleThirdPartyCaseArgs

Status This property is required. string
Severity of the Security Signal. Valid values are info, low, medium, high, critical.
Name string
Name of the case.
Notifications List<string>
Notification targets for each rule case.
Query string
A query to associate a third-party event to this case.
Status This property is required. string
Severity of the Security Signal. Valid values are info, low, medium, high, critical.
Name string
Name of the case.
Notifications []string
Notification targets for each rule case.
Query string
A query to associate a third-party event to this case.
status This property is required. String
Severity of the Security Signal. Valid values are info, low, medium, high, critical.
name String
Name of the case.
notifications List<String>
Notification targets for each rule case.
query String
A query to associate a third-party event to this case.
status This property is required. string
Severity of the Security Signal. Valid values are info, low, medium, high, critical.
name string
Name of the case.
notifications string[]
Notification targets for each rule case.
query string
A query to associate a third-party event to this case.
status This property is required. str
Severity of the Security Signal. Valid values are info, low, medium, high, critical.
name str
Name of the case.
notifications Sequence[str]
Notification targets for each rule case.
query str
A query to associate a third-party event to this case.
status This property is required. String
Severity of the Security Signal. Valid values are info, low, medium, high, critical.
name String
Name of the case.
notifications List<String>
Notification targets for each rule case.
query String
A query to associate a third-party event to this case.

Import

Security monitoring rules can be imported using ID, e.g.

$ pulumi import datadog:index/securityMonitoringRule:SecurityMonitoringRule my_rule m0o-hto-lkb
Copy

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository
Datadog pulumi/pulumi-datadog
License
Apache-2.0
Notes
This Pulumi package is based on the datadog Terraform Provider.
Datadog v4.49.0 published on Thursday, Apr 17, 2025 by Pulumi
pulumi/pulumi-datadog