---
title: "Get the list of vulnerability notification rules"
method: GET
path: "/api/v2/security/vulnerabilities/notification_rules"
tags: ["Security Monitoring"]
---

# Get the list of vulnerability notification rules

`GET /api/v2/security/vulnerabilities/notification_rules`

Returns the list of notification rules for security vulnerabilities.

## Response `200`

The list of notification rules.

- NotificationRulesListResponse — The list of notification rules.
  - `data` NotificationRule[]
    - `attributes` NotificationRuleAttributes, required — Attributes of the notification rule.
      - `created_at` integer, required — Date as Unix timestamp in milliseconds.
      - `created_by` RuleUser, required — User creating or modifying a rule.
        - `handle` string — The user handle.
        - `name` string — The user name.
      - `enabled` boolean, required — Field used to enable or disable the rule.
      - `modified_at` integer, required — Date as Unix timestamp in milliseconds.
      - `modified_by` RuleUser, required — User creating or modifying a rule.
        - `handle` string — The user handle.
        - `name` string — The user name.
      - `name` string, required — Name of the notification rule.
      - `selectors` Selectors, required — Selectors are used to filter security issues for which notifications should be generated. Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source. Only the trigger_source field is required.
        - `query` string — The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
        - `rule_types` RuleTypesItems[] — Security rule types used as filters in security rules.
        - `severities` RuleSeverity[] — The security rules severities to consider.
        - `trigger_source` 'security_findings' | 'security_signals', required — The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals", while notification rules based on security vulnerabilities need to use the trigger source "security_findings".
      - `targets` string[], required — List of recipients to notify when a notification rule is triggered. Many different target types are supported, such as email addresses, Slack channels, and PagerDuty services. The appropriate integrations need to be properly configured to send notifications to the specified targets.
      - `time_aggregation` integer — Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation. Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation. Notifications are only sent for new issues discovered during the window. Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation is done.
      - `version` integer, required — Version of the notification rule. It is updated when the rule is modified.
    - `id` string, required — The ID of a notification rule.
    - `type` 'notification_rules', required — The rule type associated to notification rules.

## Other responses

- `403` — Forbidden
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/versions/da68bf029e4c/schema)