v1

latestOpenAPI 3.0.02026-07-141,4077,1665.2 MB

Security Monitoring

Get investigation queries for a signal

Get the list of investigation log queries available for a given security signal.

get/api/v2/security_monitoring/signals/{signal_id}/investigation_queries

Path parameters

signal_idstring required

The ID of the signal.

Response

Example response

{
  "data": [
    {
      "attributes": {
        "name": "Cloudtrail events for user ARN",
        "query_filter": "source:cloudtrail @userIdentity.arn:\"foo\"",
        "template_variables": {
          "@userIdentity.arn": [
            "foo"
          ]
        },
        "url": "/logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22"
      },
      "id": "w00-t10-992",
      "type": "investigation_log_queries"
    },
    {
      "attributes": {
        "title": "Monitor Okta logs to track system access and unusual activity",
        "url": "https://www.datadoghq.com/blog/monitor-activity-with-okta/"
      },
      "id": "bxy-o8v-i1a",
      "type": "recommended_blog_posts"
    }
  ]
}