Sign in

v1

latestOpenAPI 3.0.02026-07-141,4077,1665.2 MB
Security Monitoring

Restore a rule to a historical version

Restores a custom detection rule to a previously saved historical version. Only custom rules can be restored. Default and partner rules return 400. The restore creates a new version entry; it does not overwrite history.

post/api/v2/security_monitoring/rules/{rule_id}/restore/{version}

Path parameters

rule_idstring required

The ID of the rule.

versioninteger required
Example:1

The historical version number of the rule.

Response

OK

OR

Example response

{
  "calculatedFields": [
    {
      "expression": "@request_end_timestamp - @request_start_timestamp",
      "name": "response_time"
    }
  ],
  "cases": [
    {
      "actions": [
        {
          "options": {
            "flaggedIPType": "FLAGGED"
          }
        }
      ],
      "customStatus": "critical",
      "status": "critical"
    }
  ],
  "defaultTags": [
    "security:attacks"
  ],
  "groupSignalsBy": [
    "service"
  ],
  "options": {
    "anomalyDetectionOptions": {
      "bucketDuration": 300,
      "detectionTolerance": 5
    },
    "complianceRuleOptions": {
      "regoRule": {
        "policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n  # Logic that evaluates to true if the resource should be skipped\n  true\n} else = \"pass\" {\n  # Logic that evaluates to true if the resource is compliant\n  true\n} else = \"fail\" {\n  # Logic that evaluates to true if the resource is not compliant\n  true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n  some resource in input.resources[input.main_resource_type]\n  result := dd_output.format(resource, eval(resource))\n}",
        "resourceTypes": [
          "gcp_iam_service_account",
          "gcp_iam_policy"
        ]
      },
      "resourceType": "aws_acm"
    },
    "impossibleTravelOptions": {
      "baselineUserLocations": true
    },
    "thirdPartyRuleOptions": {
      "defaultStatus": "critical",
      "rootQueries": [
        {
          "query": "source:cloudtrail"
        }
      ]
    }
  },
  "queries": [
    {
      "customQueryExtension": "a > 3",
      "dataSource": "logs",
      "query": "a > 3"
    }
  ],
  "schedulingOptions": {
    "rrule": "FREQ=HOURLY;INTERVAL=1;",
    "start": "2025-07-14T12:00:00",
    "timezone": "America/New_York"
  },
  "thirdPartyCases": []
}