Sign in

v1

latestOpenAPI 3.0.02026-07-141,4077,1665.2 MB
Security Monitoring

Convert a rule from JSON to Terraform

Convert a rule that doesn't (yet) exist from JSON to Terraform for Datadog provider resource datadog_security_monitoring_rule. You can do so for the following rule types:

  • App and API Protection
  • Cloud SIEM (log detection and signal correlation)
  • Workload Protection

You can convert Cloud Security configuration rules using Terraform's Datadog Cloud Configuration Rule resource.

post/api/v2/security_monitoring/rules/convert

Request body

OR

Example request

{
  "calculatedFields": [
    {
      "expression": "@request_end_timestamp - @request_start_timestamp",
      "name": "response_time"
    }
  ],
  "cases": [],
  "groupSignalsBy": [
    "service"
  ],
  "hasExtendedTitle": true,
  "isEnabled": true,
  "name": "My security monitoring rule.",
  "options": {
    "anomalyDetectionOptions": {
      "bucketDuration": 300,
      "detectionTolerance": 5
    },
    "complianceRuleOptions": {
      "regoRule": {
        "policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n  # Logic that evaluates to true if the resource should be skipped\n  true\n} else = \"pass\" {\n  # Logic that evaluates to true if the resource is compliant\n  true\n} else = \"fail\" {\n  # Logic that evaluates to true if the resource is not compliant\n  true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n  some resource in input.resources[input.main_resource_type]\n  result := dd_output.format(resource, eval(resource))\n}",
        "resourceTypes": [
          "gcp_iam_service_account",
          "gcp_iam_policy"
        ]
      },
      "resourceType": "aws_acm"
    },
    "impossibleTravelOptions": {
      "baselineUserLocations": true
    },
    "thirdPartyRuleOptions": {
      "defaultStatus": "critical",
      "rootQueries": [
        {
          "query": "source:cloudtrail"
        }
      ]
    }
  },
  "queries": [],
  "schedulingOptions": {
    "rrule": "FREQ=HOURLY;INTERVAL=1;",
    "start": "2025-07-14T12:00:00",
    "timezone": "America/New_York"
  },
  "tags": [
    "env:prod",
    "team:security"
  ],
  "thirdPartyCases": []
}

Response

OK

ruleIdstring

the ID of the rule.

terraformContentstring

Terraform string as a result of converting the rule from JSON.