v1
latestOpenAPI 3.0.02026-07-141,4077,1665.2 MBSecurity Monitoring
Get suppressions affecting future rule
Get the list of suppressions that would affect a rule.
post/api/v2/security_monitoring/configuration/suppressions/rules
Request body
Example request
{
"calculatedFields": [
{
"expression": "@request_end_timestamp - @request_start_timestamp",
"name": "response_time"
}
],
"cases": [],
"groupSignalsBy": [
"service"
],
"hasExtendedTitle": true,
"isEnabled": true,
"name": "My security monitoring rule.",
"options": {
"anomalyDetectionOptions": {
"bucketDuration": 300,
"detectionTolerance": 5
},
"complianceRuleOptions": {
"regoRule": {
"policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}",
"resourceTypes": [
"gcp_iam_service_account",
"gcp_iam_policy"
]
},
"resourceType": "aws_acm"
},
"impossibleTravelOptions": {
"baselineUserLocations": true
},
"thirdPartyRuleOptions": {
"defaultStatus": "critical",
"rootQueries": [
{
"query": "source:cloudtrail"
}
]
}
},
"queries": [],
"schedulingOptions": {
"rrule": "FREQ=HOURLY;INTERVAL=1;",
"start": "2025-07-14T12:00:00",
"timezone": "America/New_York"
},
"tags": [
"env:prod",
"team:security"
],
"thirdPartyCases": []
}Response
OK
Example response
{
"data": [
{
"attributes": {
"creator": {
"handle": "john.doe@datadoghq.com",
"name": "John Doe"
},
"data_exclusion_query": "source:cloudtrail account_id:12345",
"description": "This rule suppresses low-severity signals in staging environments.",
"editable": true,
"enabled": true,
"expiration_date": 1703187336000,
"name": "Custom suppression",
"rule_query": "type:log_detection source:cloudtrail",
"start_date": 1703187336000,
"suppression_query": "env:staging status:low",
"tags": [
"technique:T1110-brute-force",
"source:cloudtrail"
],
"updater": {
"handle": "john.doe@datadoghq.com",
"name": "John Doe"
},
"version": 42
},
"id": "3dd-0uc-h1s",
"type": "suppressions"
}
]
}