Sign in

v1

latestOpenAPI 3.0.02026-07-141,4077,1665.2 MB
Security Monitoring

List vulnerabilities

Get a list of vulnerabilities.

Pagination

Pagination is enabled by default in both vulnerabilities and assets. The size of the page varies depending on the endpoint and cannot be modified. To automate the request of the next page, you can use the links section in the response.

This endpoint will return paginated responses. The pages are stored in the links section of the response:

{
  "data": [...],
  "meta": {...},
  "links": {
    "self": "https://.../api/v2/security/vulnerabilities",
    "first": "https://.../api/v2/security/vulnerabilities?page[number]=1&page[token]=abc",
    "last": "https://.../api/v2/security/vulnerabilities?page[number]=43&page[token]=abc",
    "next": "https://.../api/v2/security/vulnerabilities?page[number]=2&page[token]=abc"
  }
}
  • links.previous is empty if the first page is requested.
  • links.next is empty if the last page is requested.

Token

Vulnerabilities can be created, updated or deleted at any point in time.

Upon the first request, a token is created to ensure consistency across subsequent paginated requests.

A token is valid only for 24 hours.

First request

We consider a request to be the first request when there is no page[token] parameter.

The response of this first request contains the newly created token in the links section.

This token can then be used in the subsequent paginated requests.

Note: The first request may take longer to complete than subsequent requests.

Subsequent requests

Any request containing valid page[token] and page[number] parameters will be considered a subsequent request.

If the token is invalid, a 404 response will be returned.

If the page number is invalid, a 400 response will be returned.

The returned token is valid for all requests in the pagination sequence. To send paginated requests in parallel, reuse the same token and change only the page[number] parameter.

Filtering

The request can include some filter parameters to filter the data to be retrieved. The format of the filter parameters follows the JSON:API format: filter[$prop_name], where prop_name is the property name in the entity being filtered by.

All filters can include multiple values, where data will be filtered with an OR clause: filter[title]=Title1,Title2 will filter all vulnerabilities where title is equal to Title1 OR Title2.

String filters are case sensitive.

Boolean filters accept true or false as values.

Number filters must include an operator as a second filter input: filter[$prop_name][$operator]. For example, for the vulnerabilities endpoint: filter[cvss.base.score][lte]=8.

Available operators are: eq (==), lt (<), lte (<=), gt (>) and gte (>=).

Metadata

Following JSON:API format, object including non-standard meta-information.

This endpoint includes the meta member in the response. For more details on each of the properties included in this section, check the endpoints response tables.

{
  "data": [...],
  "meta": {
    "total": 1500,
    "count": 18732,
    "token": "some_token"
  },
  "links": {...}
}

Extensions

Requests may include extensions to modify the behavior of the requested endpoint. The filter parameters follow the JSON:API format format: ext:$extension_name, where extension_name is the name of the modifier that is being applied.

Extensions can only include one value: ext:modifier=value.

get/api/v2/security/vulnerabilities

Query parameters

page[token]string

Its value must come from the links section of the response of the first request. Do not manually edit it.

page[number]integer

The page number to be retrieved. It should be equal or greater than 1

filter[type]'AdminConsoleActive' | 'CodeInjection' | 'CommandInjection' | 'ComponentWithKnownVulnerability' | 'DangerousWorkflows' | 'DefaultAppDeployed' | 'DefaultHtmlEscapeInvalid' | 'DirectoryListingLeak' | 'EmailHtmlInjection' | 'EndOfLife' | 'HardcodedPassword' | 'HardcodedSecret' | 'HeaderInjection' | 'HstsHeaderMissing' | 'InsecureAuthProtocol' | 'InsecureCookie' | 'InsecureJspLayout' | 'LdapInjection' | 'MaliciousPackage' | 'MandatoryRemediation' | 'NoHttpOnlyCookie' | 'NoSameSiteCookie' | 'NoSqlMongoDbInjection' | 'PathTraversal' | 'ReflectionInjection' | 'RiskyLicense' | 'SessionRewriting' | 'SessionTimeout' | 'SqlInjection' | 'Ssrf' | 'StackTraceLeak' | 'TrustBoundaryViolation' | 'Unmaintained' | 'UntrustedDeserialization' | 'UnvalidatedRedirect' | 'VerbTampering' | 'WeakCipher' | 'WeakHash' | 'WeakRandomness' | 'XContentTypeHeaderMissing' | 'XPathInjection' | 'Xss'

The vulnerability type.

Example:WeakCipher

Filter by vulnerability type.

filter[cvss.base.score][`$op`]number double

Filter by vulnerability base (i.e. from the original advisory) severity score.

filter[cvss.base.severity]'Unknown' | 'None' | 'Low' | 'Medium' | 'High' | 'Critical'

The vulnerability severity.

Example:Medium

Filter by vulnerability base severity.

filter[cvss.base.vector]string

Filter by vulnerability base CVSS vector.

filter[cvss.datadog.score][`$op`]number double

Filter by vulnerability Datadog severity score.

filter[cvss.datadog.severity]'Unknown' | 'None' | 'Low' | 'Medium' | 'High' | 'Critical'

The vulnerability severity.

Example:Medium

Filter by vulnerability Datadog severity.

filter[cvss.datadog.vector]string

Filter by vulnerability Datadog CVSS vector.

filter[status]'Open' | 'Muted' | 'Remediated' | 'InProgress' | 'AutoClosed'

The vulnerability status.

Example:Open

Filter by the status of the vulnerability.

filter[tool]'IAST' | 'SCA' | 'Infra' | 'SAST'

The vulnerability tool.

Example:SCA

Filter by the tool of the vulnerability.

filter[library.name]string

Filter by library name.

filter[library.version]string

Filter by library version.

filter[advisory.id]string

Filter by advisory ID.

filter[risks.exploitation_probability]boolean

Filter by exploitation probability.

filter[risks.poc_exploit_available]boolean

Filter by POC exploit availability.

filter[risks.exploit_available]boolean

Filter by public exploit availability.

filter[risks.epss.score][`$op`]number double

Filter by vulnerability EPSS severity score.

filter[risks.epss.severity]'Unknown' | 'None' | 'Low' | 'Medium' | 'High' | 'Critical'

The vulnerability severity.

Example:Medium

Filter by vulnerability EPSS severity.

filter[language]string

Filter by language.

filter[ecosystem]'PyPI' | 'Maven' | 'NuGet' | 'Npm' | 'RubyGems' | 'Go' | 'Packagist' | 'Deb' | 'Rpm' | 'Apk' | 'Windows' | 'Generic' | 'MacOs' | 'Oci' | 'BottleRocket' | 'None'

The related vulnerability asset ecosystem.

Filter by ecosystem.

filter[code_location.location]string

Filter by vulnerability location.

filter[code_location.file_path]string

Filter by vulnerability file path.

filter[code_location.method]string

Filter by method.

filter[fix_available]boolean

Filter by fix availability.

filter[repo_digests]string

Filter by vulnerability repo_digest (when the vulnerability is related to Image asset).

filter[origin]string

Filter by origin.

filter[running_kernel]boolean

Filter for whether the vulnerability affects a running kernel (for vulnerabilities related to a Host asset).

filter[asset.name]string

Filter by asset name. This field supports the usage of wildcards (*).

filter[asset.type]'Repository' | 'Service' | 'Host' | 'HostImage' | 'Image' | 'ServerlessFunction'

The asset type

Example:Repository

Filter by asset type.

filter[asset.version.first]string

Filter by the first version of the asset this vulnerability has been detected on.

filter[asset.version.last]string

Filter by the last version of the asset this vulnerability has been detected on.

filter[asset.repository_url]string

Filter by the repository url associated to the asset.

filter[asset.risks.in_production]boolean

Filter whether the asset is in production or not.

filter[asset.risks.under_attack]boolean

Filter whether the asset is under attack or not.

filter[asset.risks.is_publicly_accessible]boolean

Filter whether the asset is publicly accessible or not.

filter[asset.risks.has_privileged_access]boolean

Filter whether the asset is publicly accessible or not.

filter[asset.risks.has_access_to_sensitive_data]boolean

Filter whether the asset has access to sensitive data or not.

filter[asset.environments]string

Filter by asset environments.

filter[asset.teams]string

Filter by asset teams.

filter[asset.arch]string

Filter by asset architecture.

filter[asset.operating_system.name]string

Filter by asset operating system name.

filter[asset.operating_system.version]string

Filter by asset operating system version.

Response

OK

Example response

{
  "data": [
    {
      "attributes": {
        "advisory": {
          "id": "TRIVY-CVE-2023-0615",
          "last_modification_date": "2024-09-19 21:23:08+00:00",
          "publish_date": "2024-09-19 21:23:08+00:00"
        },
        "advisory_id": "TRIVY-CVE-2023-0615",
        "code_location": {
          "file_path": "src/Class.java:100",
          "location": "com.example.Class:100",
          "method": "FooBar"
        },
        "cve_list": [
          "CVE-2023-0615"
        ],
        "cvss": {
          "base": {
            "score": 4.5,
            "severity": "Medium",
            "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
          },
          "datadog": {
            "score": 4.5,
            "severity": "Medium",
            "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
          }
        },
        "dependency_locations": {
          "block": {
            "column_end": 140,
            "column_start": 5,
            "file_name": "src/go.mod",
            "line_end": 10,
            "line_start": 1
          },
          "name": {
            "column_end": 140,
            "column_start": 5,
            "file_name": "src/go.mod",
            "line_end": 10,
            "line_start": 1
          },
          "version": {
            "column_end": 140,
            "column_start": 5,
            "file_name": "src/go.mod",
            "line_end": 10,
            "line_start": 1
          }
        },
        "description": "LDAP Injection is a security vulnerability that occurs when untrusted user input is improperly handled and directly incorporated into LDAP queries without appropriate sanitization or validation. This vulnerability enables attackers to manipulate LDAP queries and potentially gain unauthorized access, modify data, or extract sensitive information from the directory server. By exploiting the LDAP injection vulnerability, attackers can execute malicious commands, bypass authentication mechanisms, and perform unauthorized actions within the directory service.",
        "exposure_time": 5618604,
        "first_detection": "2024-09-19 21:23:08+00:00",
        "language": "ubuntu",
        "last_detection": "2024-09-01 21:23:08+00:00",
        "library": {
          "additional_names": [
            "linux-tools-common"
          ],
          "name": "linux-aws-5.15",
          "version": "5.15.0"
        },
        "origin": [
          "agentless-scanner"
        ],
        "remediations": [
          {
            "avoided_advisories": [
              {
                "base_severity": "Critical",
                "id": "GHSA-4wrc-f8pq-fpqp",
                "severity": "Medium"
              }
            ],
            "fixed_advisories": [
              {
                "base_severity": "Critical",
                "id": "GHSA-4wrc-f8pq-fpqp",
                "severity": "Medium"
              }
            ],
            "library_name": "stdlib",
            "library_version": "Upgrade to a version >= 1.20.0",
            "new_advisories": [
              {
                "base_severity": "Critical",
                "id": "GHSA-4wrc-f8pq-fpqp",
                "severity": "Medium"
              }
            ],
            "remaining_advisories": [
              {
                "base_severity": "Critical",
                "id": "GHSA-4wrc-f8pq-fpqp",
                "severity": "Medium"
              }
            ],
            "type": "text"
          }
        ],
        "repo_digests": [
          "sha256:0ae7da091191787229d321e3638e39c319a97d6e20f927d465b519d699215bf7"
        ],
        "risks": {
          "epss": {
            "score": 0.2,
            "severity": "Medium"
          },
          "exploit_sources": [
            "NIST"
          ]
        },
        "running_kernel": true,
        "status": "Open",
        "title": "LDAP Injection",
        "tool": "SCA",
        "type": "WeakCipher"
      },
      "id": "3ecdfea798f2ce8f6e964805a344945f",
      "relationships": {
        "affects": {
          "data": {
            "id": "Repository|github.com/DataDog/datadog-agent.git",
            "type": "assets"
          }
        }
      },
      "type": "vulnerabilities"
    }
  ],
  "links": {
    "first": "https://api.datadoghq.com/api/v2/security/vulnerabilities?page%5Bnumber%5D=1&page%5Btoken%5D=b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4",
    "last": "https://api.datadoghq.com/api/v2/security/vulnerabilities?page%5Bnumber%5D=15&page%5Btoken%5D=b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4",
    "next": "https://api.datadoghq.com/api/v2/security/vulnerabilities?page%5Bnumber%5D=16&page%5Btoken%5D=b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4",
    "previous": "https://api.datadoghq.com/api/v2/security/vulnerabilities?page%5Bnumber%5D=14&page%5Btoken%5D=b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4",
    "self": "https://api.datadoghq.com/api/v2/security/vulnerabilities?filter%5Btool%5D=Infra"
  },
  "meta": {
    "count": 150,
    "token": "b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4",
    "total": 152431
  }
}