Datadog/security Rules
@webframp/datadog/security-rulesv2026.07.20.11
01README
Datadog Security Rules — detection rule CRUD and management
02Release Notes
2026.07.20.11
Added: Initial code-generated release of @webframp/datadog/security-rules with 11 methods covering the Datadog security rules API surface.
03Models
@webframp/datadog/security-rulesv2026.07.20.11datadog/security_rules.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| apiKey | string | Datadog API key (DD-API-KEY) |
| appKey | string | Datadog application key (DD-APPLICATION-KEY) |
| site | enum | Datadog site |
fn list_security_monitoring_rules(query?: string, sort?: string)
List rules
| Argument | Type | Description |
|---|---|---|
| query? | string | A search query to filter security rules. You can filter by attributes such as... |
| sort? | string | Attribute used to sort rules. Prefix with `-` to sort in descending order. |
fn create_security_monitoring_rule(calculatedFields?: array, cases: array, filters?: array, groupSignalsBy?: array, hasExtendedTitle?: boolean, isEnabled: boolean, message: string, name: string, options: unknown, queries: array, referenceTables?: array, schedulingOptions?: unknown, tags?: array, thirdPartyCases?: array, type?: unknown)
Create a detection rule
| Argument | Type | Description |
|---|---|---|
| calculatedFields? | array | Calculated fields. Only allowed for scheduled rules - in other words, when sc... |
| cases | array | Cases for generating signals. |
| filters? | array | Additional queries to filter matched events before they are processed. This f... |
| groupSignalsBy? | array | Additional grouping to perform on top of the existing groups in the query sec... |
| hasExtendedTitle? | boolean | Whether the notifications include the triggering group-by values in their title. |
| isEnabled | boolean | Whether the rule is enabled. |
| message | string | Message for generated signals. |
| name | string | The name of the rule. |
| options | unknown | |
| queries | array | Queries for selecting logs which are part of the rule. |
| referenceTables? | array | Reference tables for the rule. |
| schedulingOptions? | unknown | |
| tags? | array | Tags for generated signals. |
| thirdPartyCases? | array | Cases for generating signals from third-party rules. Only available for third... |
| type? | unknown |
fn bulk_delete_security_monitoring_rules(ruleIds: array)
Bulk delete security monitoring rules
| Argument | Type | Description |
|---|---|---|
| ruleIds | array | List of rule IDs to delete. |
fn convert_security_monitoring_rule_from_json_to_terraform(calculatedFields?: array, cases: array, customMessage?: string, customName?: string, filters?: array, groupSignalsBy?: array, hasExtendedTitle?: boolean, isEnabled: boolean, message: string, name: string, options: unknown, queries: array, referenceTables?: array, schedulingOptions?: unknown, tags?: array, thirdPartyCases?: array, type?: unknown)
Convert a rule from JSON to Terraform
| Argument | Type | Description |
|---|---|---|
| calculatedFields? | array | Calculated fields. Only allowed for scheduled rules - in other words, when sc... |
| cases | array | Cases for generating signals. |
| customMessage? | string | |
| customName? | string | Custom/Overridden name of the rule (used in case of Default rule update). |
| filters? | array | Additional queries to filter matched events before they are processed. This f... |
| groupSignalsBy? | array | Additional grouping to perform on top of the existing groups in the query sec... |
| hasExtendedTitle? | boolean | Whether the notifications include the triggering group-by values in their title. |
| isEnabled | boolean | Whether the rule is enabled. |
| message | string | Message for generated signals. |
| name | string | The name of the rule. |
| options | unknown | |
| queries | array | Queries for selecting logs which are part of the rule. |
| referenceTables? | array | Reference tables for the rule. |
| schedulingOptions? | unknown | |
| tags? | array | Tags for generated signals. |
| thirdPartyCases? | array | Cases for generating signals from third-party rules. Only available for third... |
| type? | unknown |
fn test_security_monitoring_rule(rule?: unknown, ruleQueryPayloads?: array)
Test a rule
| Argument | Type | Description |
|---|---|---|
| rule? | unknown | |
| ruleQueryPayloads? | array | Data payloads used to test rules query with the expected result. |
fn validate_security_monitoring_rule(calculatedFields?: array, cases: array, customMessage?: string, customName?: string, filters?: array, groupSignalsBy?: array, hasExtendedTitle?: boolean, isEnabled: boolean, message: string, name: string, options: unknown, queries: array, referenceTables?: array, schedulingOptions?: unknown, tags?: array, thirdPartyCases?: array, type?: unknown)
Validate a detection rule
| Argument | Type | Description |
|---|---|---|
| calculatedFields? | array | Calculated fields. Only allowed for scheduled rules - in other words, when sc... |
| cases | array | Cases for generating signals. |
| customMessage? | string | |
| customName? | string | Custom/Overridden name of the rule (used in case of Default rule update). |
| filters? | array | Additional queries to filter matched events before they are processed. This f... |
| groupSignalsBy? | array | Additional grouping to perform on top of the existing groups in the query sec... |
| hasExtendedTitle? | boolean | Whether the notifications include the triggering group-by values in their title. |
| isEnabled | boolean | Whether the rule is enabled. |
| message | string | Message for generated signals. |
| name | string | The name of the rule. |
| options | unknown | |
| queries | array | Queries for selecting logs which are part of the rule. |
| referenceTables? | array | Reference tables for the rule. |
| schedulingOptions? | unknown | |
| tags? | array | Tags for generated signals. |
| thirdPartyCases? | array | Cases for generating signals from third-party rules. Only available for third... |
| type? | unknown |
fn get_security_monitoring_rule(rule_id: string)
Get a rule's details
| Argument | Type | Description |
|---|---|---|
| rule_id | string | The ID of the rule. |
fn update_security_monitoring_rule(rule_id: string, calculatedFields?: array, cases?: array, complianceSignalOptions?: unknown, customMessage?: string, customName?: string, filters?: array, groupSignalsBy?: array, hasExtendedTitle?: boolean, isEnabled?: boolean, message?: string, name?: string, options?: unknown, queries?: array, referenceTables?: array, schedulingOptions?: unknown, tags?: array, thirdPartyCases?: array, version?: number)
Update an existing rule
| Argument | Type | Description |
|---|---|---|
| rule_id | string | The ID of the rule. |
| calculatedFields? | array | Calculated fields. Only allowed for scheduled rules - in other words, when sc... |
| cases? | array | Cases for generating signals. |
| complianceSignalOptions? | unknown | |
| customMessage? | string | |
| customName? | string | Custom/Overridden name (used in case of Default rule update). |
| filters? | array | Additional queries to filter matched events before they are processed. This f... |
| groupSignalsBy? | array | Additional grouping to perform on top of the existing groups in the query sec... |
| hasExtendedTitle? | boolean | Whether the notifications include the triggering group-by values in their title. |
| isEnabled? | boolean | Whether the rule is enabled. |
| message? | string | Message for generated signals. |
| name? | string | Name of the rule. |
| options? | unknown | |
| queries? | array | Queries for selecting logs which are part of the rule. |
| referenceTables? | array | Reference tables for the rule. |
| schedulingOptions? | unknown | |
| tags? | array | Tags for generated signals. |
| thirdPartyCases? | array | Cases for generating signals from third-party rules. Only available for third... |
| version? | number | The version of the rule being updated. |
fn delete_security_monitoring_rule(rule_id: string)
Delete an existing rule
| Argument | Type | Description |
|---|---|---|
| rule_id | string | The ID of the rule. |
fn convert_existing_security_monitoring_rule(rule_id: string)
Convert an existing rule from JSON to Terraform
| Argument | Type | Description |
|---|---|---|
| rule_id | string | The ID of the rule. |
fn test_existing_security_monitoring_rule(rule_id: string, rule?: unknown, ruleQueryPayloads?: array)
Test an existing rule
| Argument | Type | Description |
|---|---|---|
| rule_id | string | The ID of the rule. |
| rule? | unknown | |
| ruleQueryPayloads? | array | Data payloads used to test rules query with the expected result. |
Resources
security_monitoring_rules(infinite)— List rules
security_monitoring_rule(infinite)— Create a detection rule
convert_security_monitoring_rule_from_json_to_terraform(infinite)— Convert a rule from JSON to Terraform
test_security_monitoring_rule(infinite)— Test a rule
validate_security_monitoring_rule(infinite)— Validate a detection rule
convert_existing_security_monitoring_rule(infinite)— Convert an existing rule from JSON to Terraform
test_existing_security_monitoring_rule(infinite)— Test an existing rule
04Stats
A
100 / 100
Downloads
0
Archive size
14.8 KB
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned
05Platforms
06Labels