v1

latestOpenAPI 3.0.02026-07-141,4077,1665.2 MB

Compliance

Get the rule-based view of compliance findings

This endpoint is deprecated. Use the Security Monitoring - Search Security Findings endpoint instead.

Get an aggregated view of compliance rules with their pass, fail, and muted finding counts. Supports filtering by compliance framework, framework version, and additional query filters.

get/api/v2/compliance_findings/rule_based_view

Query parameters

tointeger required

Example:1739982278000

Timestamp of the query end, in milliseconds since the Unix epoch.

frameworkstring

Example:hipaa

Compliance framework handle to filter rules and findings by.

versionstring

Example:1

Version of the compliance framework to filter rules and findings by.

query_findings_without_framework_versionboolean

When true, returns findings without a framework_version tag. Used for findings from custom frameworks or those created before framework versioning was introduced.

include_rules_without_findingsboolean

When true, includes rules in the response that have no associated findings.

is_customboolean

Set to true when the requested framework is a custom framework.

querystring

Example:scored:true

Additional event-platform filters applied to the underlying findings query. For example, scored:true project_id:datadog-prod-us5.

Response

Example response

{
  "data": {
    "attributes": {
      "count": 1,
      "rules": [
        {
          "compliance_frameworks": [
            {
              "control": "164.308-a-4-i",
              "framework": "hipaa",
              "is_default": true,
              "requirement": "Information-Access-Management",
              "version": "1"
            }
          ],
          "enabled": true,
          "id": "qjx-udx-xo8",
          "name": "IAM roles should not allow untrusted GitHub Actions to assume them",
          "resourceAttributes": [
            "instance_id"
          ],
          "resourceCategory": "identity",
          "resourceType": "aws_iam_role",
          "stats": {
            "pass": 3
          },
          "status": "critical",
          "tags": [
            "security:compliance"
          ],
          "type": "cloud_configuration"
        }
      ]
    },
    "id": "JSONAPI_USELESS_ID",
    "type": "rule_based_view"
  }
}