data [required]
\nobject
The data object for a data observability monitor run status response.
attributes [required]
\nobject
The attributes of a data observability monitor run status response.
error_message
\nstring
Error message describing why the monitor run failed. Only present when status is error.
status [required]
\nenum
The status of a data observability monitor run. \nAllowed enum values: pending,ok,warn,alert,error
id [required]
\nstring
The unique identifier of the monitor run.
type [required]
\nenum
The JSON:API resource type for a data observability monitor run. \nAllowed enum values: monitor_run
default: monitor_run
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[string]
A list of errors.
data [required]
\nobject
The data object returned when a data observability monitor run is triggered.
id [required]
\nstring
The unique identifier of the monitor run.
type [required]
\nenum
The JSON:API resource type for a data observability monitor run. \nAllowed enum values: monitor_run
default: monitor_run
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[string]
A list of errors.
Option 1
\nobject
Rule.
calculatedFields
\n[object]
Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.
expression [required]
\nstring
Expression.
name [required]
\nstring
Field name.
cases
\n[object]
Cases for generating signals.
actions
\n[object]
Action to perform for each rule case.
options
\nobject
Options for the rule action
duration
\nint64
Duration of the action in seconds. 0 indicates no expiration.
flaggedIPType
\nenum
Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED
userBehaviorName
\nstring
Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
type
\nenum
The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip
condition
\nstring
A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.
customStatus
\nenum
Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical
name
\nstring
Name of the case.
notifications
\n[string]
Notification targets for each rule case.
status
\nenum
Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical
complianceSignalOptions
\nobject
How to generate compliance signals. Useful for cloud_configuration rules only.
defaultActivationStatus
\nboolean
The default activation status.
defaultGroupByFields
\n[string]
The default group by fields.
userActivationStatus
\nboolean
Whether signals will be sent.
userGroupByFields
\n[string]
Fields to use to group findings by when sending signals.
createdAt
\nint64
When the rule was created, timestamp in milliseconds.
creationAuthorId
\nint64
User ID of the user who created the rule.
customMessage
\nstring
Custom/Overridden message for generated signals (used in case of Default rule update).
customName
\nstring
Custom/Overridden name of the rule (used in case of Default rule update).
defaultTags
\n[string]
Default Tags for default rules (included in tags)
deprecationDate
\nint64
When the rule will be deprecated, timestamp in milliseconds.
filters
\n[object]
Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
action
\nenum
The type of filtering action. \nAllowed enum values: require,suppress
query
\nstring
Query for selecting logs to apply the filtering action.
groupSignalsBy
\n[string]
Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
hasExtendedTitle
\nboolean
Whether the notifications include the triggering group-by values in their title.
id
\nstring
The ID of the rule.
isDefault
\nboolean
Whether the rule is included by default.
isDeleted
\nboolean
Whether the rule has been deleted.
isEnabled
\nboolean
Whether the rule is enabled.
message
\nstring
Message for generated signals.
name
\nstring
The name of the rule.
options
\nobject
Options.
anomalyDetectionOptions
\nobject
Options on anomaly detection method.
bucketDuration
\nenum
Duration in seconds of the time buckets used to aggregate events matched by the rule.\nMust be greater than or equal to 300. \nAllowed enum values: 300,600,900,1800,3600,10800
detectionTolerance
\nenum
An optional parameter that sets how permissive anomaly detection is.\nHigher values require higher deviations before triggering a signal. \nAllowed enum values: 1,2,3,4,5
instantaneousBaseline
\nboolean
When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDuration
\nenum
Learning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating. \nAllowed enum values: 1,6,12,24,48,168,336
learningPeriodBaseline
\nint64
An optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0.
complianceRuleOptions
\nobject
Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRule
\nboolean
Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
regoRule
\nobject
Rule details.
policy [required]
\nstring
The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/
resourceTypes [required]
\n[string]
List of resource types that will be evaluated upon. Must have at least one element.
resourceType
\nstring
Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnv
\nboolean
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethod
\nenum
The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection
evaluationWindow
\nenum
A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more
,43200,86400
hardcodedEvaluatorType
\nenum
Hardcoded evaluator type. \nAllowed enum values: log4shell
impossibleTravelOptions
\nobject
Options on impossible travel detection method.
baselineUserLocations
\nboolean
If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
baselineUserLocationsDuration
\nint32
The duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations.
keepAlive
\nenum
Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more
,43200,86400
maxSignalDuration
\nenum
A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more
,43200,86400
newValueOptions
\nobject
Options on new value detection method.
forgetAfter
\nint32
The duration in days after which a learned value is forgotten.
instantaneousBaseline
\nboolean
When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDuration
\nint32
The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
learningMethod
\nenum
The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold
default: duration
learningThreshold
\nenum
A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1
sequenceDetectionOptions
\nobject
Options on sequence detection method.
stepTransitions
\n[object]
Transitions defining the allowed order of steps and their evaluation windows.
child
\nstring
Name of the child step.
evaluationWindow
\nenum
A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more
,43200,86400
parent
\nstring
Name of the parent step.
steps
\n[object]
Steps that define the conditions to be matched in sequence.
condition
\nstring
Condition referencing rule queries (e.g., a > 0).
evaluationWindow
\nenum
A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more
,43200,86400
name
\nstring
Unique name identifying the step.
thirdPartyRuleOptions
\nobject
Options on third party detection method.
defaultNotifications
\n[string]
Notification targets for the logs that do not correspond to any of the cases.
defaultStatus
\nenum
Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical
rootQueries
\n[object]
Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
groupByFields
\n[string]
Fields to group by.
query
\nstring
Query to run on logs.
signalTitleTemplate
\nstring
A template for the signal title; if omitted, the title is generated based on the case name.
queries
\n[object]
Queries for selecting logs which are part of the rule.
aggregation
\nenum
The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none
customQueryExtension
\nstring
Query extension to append to the logs query.
dataSource
\nenum
Source of events, either logs, audit trail, security signals, or Datadog events. app_sec_spans is deprecated in favor of spans. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events,security_signals
default: logs
distinctFields
\n[string]
Field for which the cardinality is measured. Sent as an array.
groupByFields
\n[string]
Fields to group by.
hasOptionalGroupByFields
\nboolean
When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.
index
\nstring
This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.
indexes
\n[string]
List of indexes to query when the dataSource is logs. Only used for scheduled rules, such as when the schedulingOptions field is present in the rule payload.
metric
\nstring
DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.
metrics
\n[string]
Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
name
\nstring
Name of the query.
query
\nstring
Query to run on logs.
referenceTables
\n[object]
Reference tables for the rule.
checkPresence
\nboolean
Whether to include or exclude the matched values.
columnName
\nstring
The name of the column in the reference table.
logFieldPath
\nstring
The field in the log to match against the reference table.
ruleQueryName
\nstring
The name of the query to apply the reference table to.
tableName
\nstring
The name of the reference table.
schedulingOptions
\nobject
Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
rrule
\nstring
Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.
start
\nstring
Start date for the schedule, in ISO 8601 format without timezone.
tags
\n[string]
Tags for generated signals.
thirdPartyCases
\n[object]
Cases for generating signals from third-party rules. Only available for third-party rules.
customStatus
\nenum
Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical
name
\nstring
Name of the case.
notifications
\n[string]
Notification targets for each rule case.
query
\nstring
A query to map a third party event to this case.
status
\nenum
Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical
type
\nenum
The rule type. \nAllowed enum values: log_detection,infrastructure_configuration,workload_security,cloud_configuration,application_security,api_security,workload_activity
updateAuthorId
\nint64
User ID of the user who updated the rule.
updatedAt
\nint64
The date the rule was last updated, in milliseconds.
version
\nint64
The version of the rule.
Option 2
\nobject
Rule.
cases
\n[object]
Cases for generating signals.
actions
\n[object]
Action to perform for each rule case.
options
\nobject
Options for the rule action
duration
\nint64
Duration of the action in seconds. 0 indicates no expiration.
flaggedIPType
\nenum
Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED
userBehaviorName
\nstring
Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
type
\nenum
The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip
condition
\nstring
A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.
customStatus
\nenum
Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical
name
\nstring
Name of the case.
notifications
\n[string]
Notification targets for each rule case.
status
\nenum
Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical
createdAt
\nint64
When the rule was created, timestamp in milliseconds.
creationAuthorId
\nint64
User ID of the user who created the rule.
customMessage
\nstring
Custom/Overridden message for generated signals (used in case of Default rule update).
customName
\nstring
Custom/Overridden name of the rule (used in case of Default rule update).
deprecationDate
\nint64
When the rule will be deprecated, timestamp in milliseconds.
filters
\n[object]
Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
action
\nenum
The type of filtering action. \nAllowed enum values: require,suppress
query
\nstring
Query for selecting logs to apply the filtering action.
hasExtendedTitle
\nboolean
Whether the notifications include the triggering group-by values in their title.
id
\nstring
The ID of the rule.
isDefault
\nboolean
Whether the rule is included by default.
isDeleted
\nboolean
Whether the rule has been deleted.
isEnabled
\nboolean
Whether the rule is enabled.
message
\nstring
Message for generated signals.
name
\nstring
The name of the rule.
options
\nobject
Options.
anomalyDetectionOptions
\nobject
Options on anomaly detection method.
bucketDuration
\nenum
Duration in seconds of the time buckets used to aggregate events matched by the rule.\nMust be greater than or equal to 300. \nAllowed enum values: 300,600,900,1800,3600,10800
detectionTolerance
\nenum
An optional parameter that sets how permissive anomaly detection is.\nHigher values require higher deviations before triggering a signal. \nAllowed enum values: 1,2,3,4,5
instantaneousBaseline
\nboolean
When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDuration
\nenum
Learning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating. \nAllowed enum values: 1,6,12,24,48,168,336
learningPeriodBaseline
\nint64
An optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0.
complianceRuleOptions
\nobject
Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.
complexRule
\nboolean
Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.
regoRule
\nobject
Rule details.
policy [required]
\nstring
The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/
resourceTypes [required]
\n[string]
List of resource types that will be evaluated upon. Must have at least one element.
resourceType
\nstring
Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.
decreaseCriticalityBasedOnEnv
\nboolean
If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.
detectionMethod
\nenum
The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection
evaluationWindow
\nenum
A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more
,43200,86400
hardcodedEvaluatorType
\nenum
Hardcoded evaluator type. \nAllowed enum values: log4shell
impossibleTravelOptions
\nobject
Options on impossible travel detection method.
baselineUserLocations
\nboolean
If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
baselineUserLocationsDuration
\nint32
The duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations.
keepAlive
\nenum
Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more
,43200,86400
maxSignalDuration
\nenum
A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more
,43200,86400
newValueOptions
\nobject
Options on new value detection method.
forgetAfter
\nint32
The duration in days after which a learned value is forgotten.
instantaneousBaseline
\nboolean
When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
learningDuration
\nint32
The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
learningMethod
\nenum
The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold
default: duration
learningThreshold
\nenum
A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1
sequenceDetectionOptions
\nobject
Options on sequence detection method.
stepTransitions
\n[object]
Transitions defining the allowed order of steps and their evaluation windows.
child
\nstring
Name of the child step.
evaluationWindow
\nenum
A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more
,43200,86400
parent
\nstring
Name of the parent step.
steps
\n[object]
Steps that define the conditions to be matched in sequence.
condition
\nstring
Condition referencing rule queries (e.g., a > 0).
evaluationWindow
\nenum
A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600Show 2 more
,43200,86400
name
\nstring
Unique name identifying the step.
thirdPartyRuleOptions
\nobject
Options on third party detection method.
defaultNotifications
\n[string]
Notification targets for the logs that do not correspond to any of the cases.
defaultStatus
\nenum
Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical
rootQueries
\n[object]
Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
groupByFields
\n[string]
Fields to group by.
query
\nstring
Query to run on logs.
signalTitleTemplate
\nstring
A template for the signal title; if omitted, the title is generated based on the case name.
queries
\n[object]
Queries for selecting logs which are part of the rule.
aggregation
\nenum
The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none
correlatedByFields
\n[string]
Fields to correlate by.
correlatedQueryIndex
\nint32
Index of the rule query used to retrieve the correlated field.
defaultRuleId
\nstring
Default Rule ID to match on signals.
distinctFields
\n[string]
Field for which the cardinality is measured. Sent as an array.
groupByFields
\n[string]
Fields to group by.
metrics
\n[string]
Group of target fields to aggregate over.
name
\nstring
Name of the query.
ruleId
\nstring
Rule ID to match on signals.
tags
\n[string]
Tags for generated signals.
type
\nenum
The rule type. \nAllowed enum values: signal_correlation
updateAuthorId
\nint64
User ID of the user who updated the rule.
version
\nint64
The version of the rule.
errors [required]
\n[string]
A list of errors.
errors [required]
\n[string]
A list of errors.
errors [required]
\n[string]
A list of errors.
errors [required]
\n[string]
A list of errors.
errors [required]
\n[string]
A list of errors.