v1
latestOpenAPI 3.0.02026-07-141,4077,1665.2 MBSecurity Monitoring
Get a list of security signals
Returns security signals that match a search query. Both this endpoint and the GET endpoint can be used interchangeably for listing security signals.
post/api/v2/security_monitoring/signals/search
Request body
Example request
{
"filter": {
"from": "2019-01-02T09:42:36.320Z",
"query": "security:attack status:high",
"to": "2019-01-03T09:42:36.320Z"
},
"page": {
"cursor": "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==",
"limit": 25
}
}Response
OK
Example response
{
"data": [
{
"attributes": {
"custom": {
"workflow": {
"first_seen": "2020-06-23T14:46:01.000Z",
"last_seen": "2020-06-23T14:46:49.000Z",
"rule": {
"id": "0f5-e0c-805",
"name": "Brute Force Attack Grouped By User",
"version": 12
}
}
},
"message": "Detect Account Take Over (ATO) through brute force attempts",
"tags": [
"security:attack",
"technique:T1110-brute-force"
],
"timestamp": "2019-01-02T09:42:36.320Z"
},
"id": "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA",
"type": "signal"
}
],
"links": {
"next": "https://app.datadoghq.com/api/v2/security_monitoring/signals?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ=="
},
"meta": {
"page": {
"after": "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ=="
}
}
}