Get a quick list of security signals
GET {{baseUrl}}/api/v2/security_monitoring/signals?filter[query]=security:attack status:high&filter[from]=2019-01-02T09:42:36.320Z&filter[to]=2019-01-03T09:42:36.320Z&sort=-timestamp&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==&page[limit]=25
The list endpoint returns security signals that match a search query. Both this endpoint and the POST endpoint can be used interchangeably when listing security signals.
Request Params
| Key | Datatype | Required | Description |
|---|---|---|---|
filter[query] | string | The search query for security signals. | |
filter[from] | string | The minimum timestamp for requested security signals. | |
filter[to] | string | The maximum timestamp for requested security signals. | |
sort | string | The order of the security signals in results. | |
page[cursor] | string | A list of results using the cursor provided in the previous query. | |
page[limit] | number | The maximum number of security signals in the response. |
HEADERS
| Key | Datatype | Required | Description |
|---|---|---|---|
Accept | string |
RESPONSES
status: OK
{"data":[{"attributes":{"custom":{"workflow":{"first_seen":"2020-06-23T14:46:01.000Z","last_seen":"2020-06-23T14:46:49.000Z","rule":{"name":"Brute Force Attack Grouped By User ","version":12}}},"message":"Detect Account Take Over (ATO) through brute force attempts","tags":["security:attack","technique:T1110-brute-force"],"timestamp":"2019-01-02T09:42:36.320Z","essed":{},"Duis_4_1":{}},"id":"AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA","type":"signal"},{"attributes":{"custom":{"workflow":{"first_seen":"2020-06-23T14:46:01.000Z","last_seen":"2020-06-23T14:46:49.000Z","rule":{"name":"Brute Force Attack Grouped By User ","version":12}}},"message":"Detect Account Take Over (ATO) through brute force attempts","tags":["security:attack","technique:T1110-brute-force"],"timestamp":"2019-01-02T09:42:36.320Z"},"id":"AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA","type":"signal"}],"links":{"next":"https://app.datadoghq.com/api/v2/security_monitoring/signals?filter[query]=foo\u0026page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ=="},"meta":{"page":{"after":"eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ=="}}}