Datadog/security Rules
@webframp/datadog/security-rulesv2026.09.08.1
01README
Datadog Security Rules — detection rule CRUD and management
02Release Notes
2026.09.08.1
Added: Initial code-generated release of @webframp/datadog/security-rules with 11 methods covering the Datadog security rules API surface.
03Models
@webframp/datadog/security-rulesv2026.09.08.1datadog/security_rules.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| apiKey | string | Datadog API key (DD-API-KEY) |
| appKey | string | Datadog application key (DD-APPLICATION-KEY) |
| site | enum | Datadog site |
fn list_security_monitoring_rules(query?: string, sort?: string)
List rules
| Argument | Type | Description |
|---|---|---|
| query? | string | A search query to filter security rules. You can filter by attributes such as... |
| sort? | string | Attribute used to sort rules. Prefix with `-` to sort in descending order. |
fn create_security_monitoring_rule(calculatedFields?: array, cases: array, filters?: array, groupSignalsBy?: array, hasExtendedTitle?: boolean, isEnabled: boolean, message: string, name: string, options: unknown, queries: array, referenceTables?: array, schedulingOptions?: unknown, tags?: array, thirdPartyCases?: array, type?: unknown)
Create a detection rule
| Argument | Type | Description |
|---|---|---|
| calculatedFields? | array | Calculated fields. Only allowed for scheduled rules - in other words, when sc... |
| cases | array | Cases for generating signals. |
| filters? | array | Additional queries to filter matched events before they are processed. This f... |
| groupSignalsBy? | array | Additional grouping to perform on top of the existing groups in the query sec... |
| hasExtendedTitle? | boolean | Whether the notifications include the triggering group-by values in their title. |
| isEnabled | boolean | Whether the rule is enabled. |
| message | string | Message for generated signals. |
| name | string | The name of the rule. |
| options | unknown | |
| queries | array | Queries for selecting logs which are part of the rule. |
| referenceTables? | array | Reference tables for the rule. |
| schedulingOptions? | unknown | |
| tags? | array | Tags for generated signals. |
| thirdPartyCases? | array | Cases for generating signals from third-party rules. Only available for third... |
| type? | unknown |
fn bulk_delete_security_monitoring_rules(ruleIds: array)
Bulk delete security monitoring rules
| Argument | Type | Description |
|---|---|---|
| ruleIds | array | List of rule IDs to delete. |
fn convert_security_monitoring_rule_from_json_to_terraform(calculatedFields?: array, cases: array, customMessage?: string, customName?: string, filters?: array, groupSignalsBy?: array, hasExtendedTitle?: boolean, isEnabled: boolean, message: string, name: string, options: unknown, queries: array, referenceTables?: array, schedulingOptions?: unknown, tags?: array, thirdPartyCases?: array, type?: unknown)
Convert a rule from JSON to Terraform
| Argument | Type | Description |
|---|---|---|
| calculatedFields? | array | Calculated fields. Only allowed for scheduled rules - in other words, when sc... |
| cases | array | Cases for generating signals. |
| customMessage? | string | |
| customName? | string | Custom/Overridden name of the rule (used in case of Default rule update). |
| filters? | array | Additional queries to filter matched events before they are processed. This f... |
| groupSignalsBy? | array | Additional grouping to perform on top of the existing groups in the query sec... |
| hasExtendedTitle? | boolean | Whether the notifications include the triggering group-by values in their title. |
| isEnabled | boolean | Whether the rule is enabled. |
| message | string | Message for generated signals. |
| name | string | The name of the rule. |
| options | unknown | |
| queries | array | Queries for selecting logs which are part of the rule. |
| referenceTables? | array | Reference tables for the rule. |
| schedulingOptions? | unknown | |
| tags? | array | Tags for generated signals. |
| thirdPartyCases? | array | Cases for generating signals from third-party rules. Only available for third... |
| type? | unknown |
fn test_security_monitoring_rule(rule?: unknown, ruleQueryPayloads?: array)
Test a rule
| Argument | Type | Description |
|---|---|---|
| rule? | unknown | |
| ruleQueryPayloads? | array | Data payloads used to test rules query with the expected result. |
fn validate_security_monitoring_rule(calculatedFields?: array, cases: array, customMessage?: string, customName?: string, filters?: array, groupSignalsBy?: array, hasExtendedTitle?: boolean, isEnabled: boolean, message: string, name: string, options: unknown, queries: array, referenceTables?: array, schedulingOptions?: unknown, tags?: array, thirdPartyCases?: array, type?: unknown)
Validate a detection rule
| Argument | Type | Description |
|---|---|---|
| calculatedFields? | array | Calculated fields. Only allowed for scheduled rules - in other words, when sc... |
| cases | array | Cases for generating signals. |
| customMessage? | string | |
| customName? | string | Custom/Overridden name of the rule (used in case of Default rule update). |
| filters? | array | Additional queries to filter matched events before they are processed. This f... |
| groupSignalsBy? | array | Additional grouping to perform on top of the existing groups in the query sec... |
| hasExtendedTitle? | boolean | Whether the notifications include the triggering group-by values in their title. |
| isEnabled | boolean | Whether the rule is enabled. |
| message | string | Message for generated signals. |
| name | string | The name of the rule. |
| options | unknown | |
| queries | array | Queries for selecting logs which are part of the rule. |
| referenceTables? | array | Reference tables for the rule. |
| schedulingOptions? | unknown | |
| tags? | array | Tags for generated signals. |
| thirdPartyCases? | array | Cases for generating signals from third-party rules. Only available for third... |
| type? | unknown |
fn get_security_monitoring_rule(rule_id: string)
Get a rule's details
| Argument | Type | Description |
|---|---|---|
| rule_id | string | The ID of the rule. |
fn update_security_monitoring_rule(rule_id: string, calculatedFields?: array, cases?: array, complianceSignalOptions?: unknown, customMessage?: string, customName?: string, filters?: array, groupSignalsBy?: array, hasExtendedTitle?: boolean, isEnabled?: boolean, message?: string, name?: string, options?: unknown, queries?: array, referenceTables?: array, schedulingOptions?: unknown, tags?: array, thirdPartyCases?: array, version?: number)
Update an existing rule
| Argument | Type | Description |
|---|---|---|
| rule_id | string | The ID of the rule. |
| calculatedFields? | array | Calculated fields. Only allowed for scheduled rules - in other words, when sc... |
| cases? | array | Cases for generating signals. |
| complianceSignalOptions? | unknown | |
| customMessage? | string | |
| customName? | string | Custom/Overridden name (used in case of Default rule update). |
| filters? | array | Additional queries to filter matched events before they are processed. This f... |
| groupSignalsBy? | array | Additional grouping to perform on top of the existing groups in the query sec... |
| hasExtendedTitle? | boolean | Whether the notifications include the triggering group-by values in their title. |
| isEnabled? | boolean | Whether the rule is enabled. |
| message? | string | Message for generated signals. |
| name? | string | Name of the rule. |
| options? | unknown | |
| queries? | array | Queries for selecting logs which are part of the rule. |
| referenceTables? | array | Reference tables for the rule. |
| schedulingOptions? | unknown | |
| tags? | array | Tags for generated signals. |
| thirdPartyCases? | array | Cases for generating signals from third-party rules. Only available for third... |
| version? | number | The version of the rule being updated. |
fn delete_security_monitoring_rule(rule_id: string)
Delete an existing rule
| Argument | Type | Description |
|---|---|---|
| rule_id | string | The ID of the rule. |
fn convert_existing_security_monitoring_rule(rule_id: string)
Convert an existing rule from JSON to Terraform
| Argument | Type | Description |
|---|---|---|
| rule_id | string | The ID of the rule. |
fn test_existing_security_monitoring_rule(rule_id: string, rule?: unknown, ruleQueryPayloads?: array)
Test an existing rule
| Argument | Type | Description |
|---|---|---|
| rule_id | string | The ID of the rule. |
| rule? | unknown | |
| ruleQueryPayloads? | array | Data payloads used to test rules query with the expected result. |
Resources
security_monitoring_rules(infinite)— List rules
security_monitoring_rule(infinite)— Create a detection rule
convert_security_monitoring_rule_from_json_to_terraform(infinite)— Convert a rule from JSON to Terraform
test_security_monitoring_rule(infinite)— Test a rule
validate_security_monitoring_rule(infinite)— Validate a detection rule
convert_existing_security_monitoring_rule(infinite)— Convert an existing rule from JSON to Terraform
test_existing_security_monitoring_rule(infinite)— Test an existing rule
04Previous Versions
2026.08.28.2
2026.08.28.2
Hardened codegen: instance names sanitized against path traversal; string schema patterns emit regex validation; output schemas passthrough unknown fields.
2026.08.28.1
2026.08.28.1
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.26.2
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.24.1
2026.08.24.1
Added: Output metadata attributes for observability.
durationMs: Method execution duration in milliseconds.collectedBy: Extension name that produced the data.fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).
2026.08.21.2
2026.08.21.2
Changed: Error messages and input validation are more specific.
- API errors now name the HTTP method and path that was attempted (e.g.
Datadog API HTTP 404: GET /api/v2/security_monitoring/rules/abc-123) instead of just the raw status code and response body. - A network-level failure (DNS error, connection reset, timeout) reaching the
Datadog API now raises
Datadog API request failed: <METHOD> <path>: <reason>instead of an unlabeled fetch error. create_security_monitoring_rule,convert_security_monitoring_rule_from_json_to_terraform, andvalidate_security_monitoring_rulenow reject an emptycasesorqueriesarray before making a request, instead of letting Datadog return an opaque validation error for a rule with no cases or queries.bulk_delete_security_monitoring_rulesnow rejects an emptyruleIdsarray before making a request.
No changes to request/response shapes or existing successful-path behavior.
2026.08.21.1
Changed: Tightened and clarified Zod schemas as part of a repo-wide schema audit.
- Added
.min(1)toapiKeyandappKeyin the global arguments schema — both are sent directly as request headers, and an empty value would never be accepted by the Datadog API. - Added descriptions to previously undocumented
options,schedulingOptions,type,rule, andcomplianceSignalOptionsarguments across the create/update/validate/test rule methods.
No behavioral changes — these are documentation and validation tightenings only.
2026.07.20.11
Added: Initial code-generated release of @webframp/datadog/security-rules with 11 methods covering the Datadog security rules API surface.
2026.08.21.1
2026.08.21.1
Changed: Tightened and clarified Zod schemas as part of a repo-wide schema audit.
- Added
.min(1)toapiKeyandappKeyin the global arguments schema — both are sent directly as request headers, and an empty value would never be accepted by the Datadog API. - Added descriptions to previously undocumented
options,schedulingOptions,type,rule, andcomplianceSignalOptionsarguments across the create/update/validate/test rule methods.
No behavioral changes — these are documentation and validation tightenings only.
2026.07.20.11
Added: Initial code-generated release of @webframp/datadog/security-rules with 11 methods covering the Datadog security rules API surface.
2026.07.20.11
2026.07.20.11
Added: Initial code-generated release of @webframp/datadog/security-rules with 11 methods covering the Datadog security rules API surface.
05Stats
A
100 / 100
Downloads
0
Archive size
20.1 KB
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned
06Platforms
07Labels