DatadogCloudSIEMV2

Datadog Cloud SIEM integration for XSOAR provides security signal management capabilities. This integration allows you to retrieve, filter, and manage security signals from Datadog's Cloud SIEM platform, enabling security teams to investigate threats, manage signal triage states, and assign signals to team members. Supports incoming mirroring of signals to XSOAR incidents.

Analytics & SIEM · Datadog Cloud SIEM

Details

IDDatadogCloudSIEMV2
ProviderDatadog
CategoryAnalytics & SIEM
From Version6.8.0
Docker Imagedemisto/datadog-api-client:1.0.0.10133006
Supported ModulesAgentix XSIAM

README

Datadog Cloud SIEM

Datadog Cloud SIEM integration for Cortex XSOAR provides security signal management and log search capabilities for threat detection and incident response.

This integration allows security teams to:

  • Fetch security signals as XSOAR incidents automatically
  • Retrieve and filter security signals from Datadog’s Cloud SIEM platform
  • Manage signal triage states and assignments
  • Search security logs for investigations
  • Extract IOCs (IPs, URLs, file hashes) from security signals

This integration was integrated and tested with version 2.12.0 of datadog-api-client.

Configure Datadog Cloud SIEM on Cortex XSOAR

  1. Navigate to Settings > Integrations > Instances.
  2. Search for Datadog Cloud SIEM.
  3. Click Add instance to create and configure a new integration instance.
Parameter Description Required
Server URL Datadog website URL True
API Key The API Key to use for authentication True
Application Key The APP Key to use for authentication True
Trust any certificate (not secure)   False
Use system proxy settings   False
Fetch incidents Enable fetching security signals as incidents False
Incident type The incident type to assign to fetched incidents False
First fetch time First fetch time range. How far back to fetch security signals on the first run. Examples “3 days”, “7 days”, “1 week” False
Max fetch Maximum number of incidents to fetch per cycle. Maximum is 200, recommended less than 100. False
Fetch severity Fetch only security signals with these severity levels or higher. False
Fetch state Fetch only security signals in this state. Default is “open”. False
Fetch query Additional custom query filter for fetching security signals. Uses Datadog search syntax. False
Incident Mirroring Direction Choose the mirroring direction for incidents. Incoming mirrors changes from Datadog to XSOAR. Cortex XSOAR only parameter. False
Close Mirrored XSOAR Incident When selected, archiving the Datadog security signal is mirrored in XSOAR and closes the XSOAR incident. Cortex XSOAR only parameter. False
  1. Click Test to validate the URLs, keys, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

datadog-get-signal

Get a specific security signal by ID from Datadog Cloud SIEM.

Base Command

datadog-get-signal

Input
Argument Name Description Required
signal_id The unique identifier of the security signal to retrieve. If not provided, will attempt to get it from the current incident. Optional
Context Output
Path Type Description
Datadog.SecuritySignal.id String The unique identifier of the security signal.
Datadog.SecuritySignal.event_id String The event ID of the security signal.
Datadog.SecuritySignal.timestamp String The timestamp when the security signal was generated.
Datadog.SecuritySignal.host String Host associated with the security signal.
Datadog.SecuritySignal.service String Services associated with the security signal.
Datadog.SecuritySignal.severity String The severity level of the security signal (info, low, medium, high, critical).
Datadog.SecuritySignal.title String The title of the security signal.
Datadog.SecuritySignal.message String The message describing the security signal.
Datadog.SecuritySignal.tags Unknown List of tags associated with the security signal.
Datadog.SecuritySignal.triggering_log_id String ID of the log that triggered the security signal.
Datadog.SecuritySignal.url String URL to view the security signal in Datadog UI.
Datadog.SecuritySignal.rule.id String The unique identifier of the security rule.
Datadog.SecuritySignal.rule.url String URL to view the security rule in Datadog UI.
Datadog.SecuritySignal.triage.state String The current triage state of the security signal (open, under_review, archived).
Datadog.SecuritySignal.triage.archive_comment String The archive comment of the security signal.
Datadog.SecuritySignal.triage.archive_reason String The archive reason of the security signal.
Datadog.SecuritySignal.triage.assignee.name String The name of the user assigned to the security signal.
Datadog.SecuritySignal.triage.assignee.handle String The handle of the user assigned to the security signal.
Datadog.SecuritySignal.raw Unknown The raw signal object returned by the API.
Command example

!datadog-get-signal signal_id=AZm-wsEuAACEnzdcj-YEigAA

!datadog-get-signal

datadog-list-signals

Get a list of security signals from Datadog Cloud SIEM with optional filtering and pagination.

Base Command

datadog-list-signals

Input
Argument Name Description Required
state Filter signals by state. Possible values are: open, under_review, archived. Optional
severity Filter signals by severity level. Possible values are: info, low, medium, high, critical. Optional
source Filter signals by source. Optional
query Custom query string for advanced filtering. Uses Datadog search syntax. Optional
from_date Start date for the search. Format can be relative (e.g., “7 days ago”) or absolute (e.g., “2023-01-01T00:00:00Z”). Default: -7days. Optional
to_date End date for the search. Format can be relative (e.g., “now”) or absolute (e.g., “2023-01-01T23:59:59Z”). Default: now. Optional
sort Sort order for results. Possible values are: asc, desc. Default: desc. Optional
page_size Number of results per page. Optional
limit Maximum number of results to return. If page_size is specified, limit is ignored. Default: 50. Optional
Context Output
Path Type Description
Datadog.SecuritySignal.id String The unique identifier of the security signal.
Datadog.SecuritySignal.event_id String The event ID of the security signal.
Datadog.SecuritySignal.timestamp String The timestamp when the security signal was generated.
Datadog.SecuritySignal.host String Host associated with the security signal.
Datadog.SecuritySignal.service String Services associated with the security signal.
Datadog.SecuritySignal.severity String The severity level of the security signal (info, low, medium, high, critical).
Datadog.SecuritySignal.title String The title of the security signal.
Datadog.SecuritySignal.message String The message describing the security signal.
Datadog.SecuritySignal.tags Unknown List of tags associated with the security signal.
Datadog.SecuritySignal.triggering_log_id String ID of the log that triggered the security signal.
Datadog.SecuritySignal.url String URL to view the security signal in Datadog UI.
Datadog.SecuritySignal.rule.id String The unique identifier of the security rule.
Datadog.SecuritySignal.rule.url String URL to view the security rule in Datadog UI.
Datadog.SecuritySignal.triage.state String The current triage state of the security signal (open, under_review, archived).
Datadog.SecuritySignal.triage.archive_comment String The archive comment of the security signal.
Datadog.SecuritySignal.triage.archive_reason String The archive reason of the security signal.
Datadog.SecuritySignal.triage.assignee.name String The name of the user assigned to the security signal.
Datadog.SecuritySignal.triage.assignee.handle String The handle of the user assigned to the security signal.
Datadog.SecuritySignal.raw Unknown The raw signal object returned by the API.
Command example

!datadog-list-signals state=open severity=high

!datadog-list-signals from_date="-3days" to_date="now" limit=10

datadog-update-signal-state

Update a security signal’s assignee and/or state in Datadog Cloud SIEM. Can update assignee only, state only, or both in a single command.

Base Command

datadog-update-signal-state

Input
Argument Name Description Required
signal_id The unique identifier of the security signal to update. If not provided, will attempt to get it from the current incident. Optional
assignee Name or email of the user to assign to the security signal. Leave empty to unassign. At least one of assignee or state must be provided. Optional
state The new state of the security signal. Possible values are: open, under_review, archived. At least one of assignee or state must be provided. Optional
archive_reason Reason for the state change (used when changing state to archived). Possible values are: none, false_positive, testing_or_maintenance, remediated, investigated_case_opened, other, true_positive_benign, true_positive_malicious. Optional
archive_comment Comment about the state change (used when changing state to archived). Optional
Context Output
Path Type Description
Datadog.SecuritySignal.id String The unique identifier of the security signal.
Datadog.SecuritySignal.event_id String The event ID of the security signal.
Datadog.SecuritySignal.timestamp String The timestamp when the security signal was generated.
Datadog.SecuritySignal.host String Host associated with the security signal.
Datadog.SecuritySignal.service String Services associated with the security signal.
Datadog.SecuritySignal.severity String The severity level of the security signal (info, low, medium, high, critical).
Datadog.SecuritySignal.title String The title of the security signal.
Datadog.SecuritySignal.message String The message describing the security signal.
Datadog.SecuritySignal.tags Unknown List of tags associated with the security signal.
Datadog.SecuritySignal.triggering_log_id String ID of the log that triggered the security signal.
Datadog.SecuritySignal.url String URL to view the security signal in Datadog UI.
Datadog.SecuritySignal.rule.id String The unique identifier of the security rule.
Datadog.SecuritySignal.rule.url String URL to view the security rule in Datadog UI.
Datadog.SecuritySignal.triage.state String The current triage state of the security signal (open, under_review, archived).
Datadog.SecuritySignal.triage.archive_comment String The archive comment of the security signal.
Datadog.SecuritySignal.triage.archive_reason String The archive reason of the security signal.
Datadog.SecuritySignal.triage.assignee.name String The name of the user assigned to the security signal.
Datadog.SecuritySignal.triage.assignee.handle String The handle of the user assigned to the security signal.
Datadog.SecuritySignal.raw Unknown The raw signal object returned by the API.
Command example

!datadog-update-signal-state signal_id=AZm-wsEuAACEnzdcj-YEigAA state=archived archive_reason=false_positive archive_comment="Not a real threat"

!datadog-update-signal-state assignee=user@example.com

!datadog-update-signal-state state=under_review

datadog-add-signal-comment

Add a comment to a security signal in Datadog Cloud SIEM.

Base Command

datadog-add-signal-comment

Input
Argument Name Description Required
event_id The event ID of the security signal to add a comment to. If not provided, will attempt to get it from the current incident. Optional
comment The comment text to add to the security signal. Required
Context Output
Path Type Description
Datadog.SecurityComment.id String The unique identifier of the comment.
Datadog.SecurityComment.created_at String The timestamp when the comment was created.
Datadog.SecurityComment.user_uuid String The UUID of the user who created the comment.
Datadog.SecurityComment.text String The comment text content.
Datadog.SecurityComment.user.name String The name of the user who created the comment.
Datadog.SecurityComment.user.handle String The handle of the user who created the comment.
Command example

!datadog-add-signal-comment event_id=AZm-wsEuAACEnzdcj-YEigAA comment="Investigating this signal"

!datadog-add-signal-comment comment="False positive confirmed"

datadog-list-signal-comments

List all comments for a security signal in Datadog Cloud SIEM.

Base Command

datadog-list-signal-comments

Input
Argument Name Description Required
event_id The event ID of the security signal to list comments for. If not provided, will attempt to get it from the current incident. Optional
Context Output
Path Type Description
Datadog.SecurityComment.id String The unique identifier of the comment.
Datadog.SecurityComment.created_at String The timestamp when the comment was created.
Datadog.SecurityComment.user_uuid String The UUID of the user who created the comment.
Datadog.SecurityComment.text String The comment text content.
Datadog.SecurityComment.user.name String The name of the user who created the comment.
Datadog.SecurityComment.user.handle String The handle of the user who created the comment.
Command example

!datadog-list-signal-comments event_id=AZm-wsEuAACEnzdcj-YEigAA

!datadog-list-signal-comments

datadog-get-rule

Get a specific security monitoring rule by ID from Datadog Cloud SIEM.

Base Command

datadog-get-rule

Input
Argument Name Description Required
rule_id The unique identifier of the security rule to retrieve. If not provided, will attempt to get it from the current incident. Optional
Context Output
Path Type Description
Datadog.SecurityRule.id String The unique identifier of the security rule.
Datadog.SecurityRule.name String The name of the security rule.
Datadog.SecurityRule.type String The type of the security rule.
Datadog.SecurityRule.isEnabled Boolean Whether the security rule is enabled.
Datadog.SecurityRule.createdAt String Timestamp when the rule was created.
Datadog.SecurityRule.message String Message for the security rule.
Datadog.SecurityRule.queries Unknown Queries associated with the security rule.
Datadog.SecurityRule.cases Unknown Cases (severity and notifications) for the rule.
Datadog.SecurityRule.options Unknown Options for the security rule.
Datadog.SecurityRule.tags Unknown Tags associated with the security rule.
Datadog.SecurityRule.url String URL to view the security rule in Datadog UI.
Datadog.SecurityRule.raw Unknown The raw rule object returned by the API.
Command example

!datadog-get-rule rule_id=abc-123-def

!datadog-get-rule

datadog-query-logs

Query logs in Datadog Cloud SIEM with optional filtering for security investigations.

Base Command

datadog-query-logs

Input
Argument Name Description Required
query Custom search query string. Uses Datadog search syntax. Required unless running from an incident with a Datadog Security Signal (will use rule’s query as fallback). Optional
from_date Start date for the search. Format can be relative (e.g., “7 days ago”) or absolute (e.g., “2023-01-01T00:00:00Z”). Default: -7days. Optional
to_date End date for the search. Format can be relative (e.g., “now”) or absolute (e.g., “2023-01-01T23:59:59Z”). Default: now. Optional
sort Sort order for results. Possible values are: asc, desc. Default: desc. Optional
limit Maximum number of results to return. Default: 50. Optional
Context Output
Path Type Description
Datadog.Log.id String The unique identifier of the log entry.
Datadog.Log.timestamp String The timestamp when the log was generated.
Datadog.Log.message String The log message content.
Datadog.Log.service String The service that generated the log.
Datadog.Log.host String The host that generated the log.
Datadog.Log.source String The source of the log entry.
Datadog.Log.status String The status/level of the log entry.
Datadog.Log.tags Unknown List of tags associated with the log entry.
Datadog.Log.url String URL to view the log in Datadog UI.
Datadog.Log.raw Unknown The raw log object returned by the API.
Command example

!datadog-query-logs query="source:nginx status:error" from_date="-1hour" limit=50

!datadog-query-logs

datadog-update-signal-assignee

Update a security signal’s assignee in Datadog Cloud SIEM.

Base Command

datadog-update-signal-assignee

Input
Argument Name Description Required
signal_id The unique identifier of the security signal to update. If not provided, will attempt to get it from the current incident. Optional
assignee Name or email of the user to assign to the security signal. Leave empty to unassign. Optional
Context Output

Same as datadog-get-signal command.

Command example

!datadog-update-signal-assignee signal_id=AZm-wsEuAACEnzdcj-YEigAA assignee=user@example.com

!datadog-update-signal-assignee assignee=""

datadog-update-suppression

Update an existing suppression rule by ID.

Base Command

datadog-update-suppression

Input
Argument Name Description Required
rule_id The unique identifier of the suppression rule. Required
enabled Enable or disable the suppression rule. Optional
name New name for the suppression rule. Optional
description New description for the suppression rule. Optional
data_exclusion_query New data exclusion query for the suppression rule. Optional
Context Output

Same as datadog-get-rule command.

Command example

!datadog-update-suppression rule_id=abc-123 enabled=false

datadog-list-suppressions

List all suppressions affecting a specific security monitoring rule.

Base Command

datadog-list-suppressions

Input
Argument Name Description Required
rule_id The unique identifier of the security rule. Required
Context Output

Returns list of suppression rules associated with the specified rule.

Command example

!datadog-list-suppressions rule_id=abc-123

datadog-list-security-filters

List all security filters from Datadog Cloud SIEM.

Base Command

datadog-list-security-filters

Input

There are no input arguments for this command.

Context Output

Returns list of security filters.

Command example

!datadog-list-security-filters

datadog-list-signal-notification-rules

List all signal notification rules from Datadog Cloud SIEM.

Base Command

datadog-list-signal-notification-rules

Input

There are no input arguments for this command.

Context Output

Returns list of signal notification rules.

Command example

!datadog-list-signal-notification-rules

datadog-list-vulnerability-notification-rules

List all vulnerability notification rules from Datadog Cloud SIEM.

Base Command

datadog-list-vulnerability-notification-rules

Input

There are no input arguments for this command.

Context Output

Returns list of vulnerability notification rules.

Command example

!datadog-list-vulnerability-notification-rules

datadog-bitsai-get-investigation

Get the BitsAI investigation for a security signal.

Base Command

datadog-bitsai-get-investigation

Input
Argument Name Description Required
signal_id The unique identifier of the security signal. Required
Context Output

Returns BitsAI investigation analysis for the signal.

Command example

!datadog-bitsai-get-investigation signal_id=AZm-wsEuAACEnzdcj-YEigAA

datadog-list-risk-scores

List risk scores from Datadog Cloud SIEM.

Base Command

datadog-list-risk-scores

Input
Argument Name Description Required
entity Filter by entity name or identifier. Optional
from_date Start date for the risk score query. Optional
to_date End date for the risk score query. Optional
limit Maximum number of risk scores to return. Default is 100. Optional
Context Output

Returns list of risk scores for monitored entities.

Command example

!datadog-list-risk-scores limit=50

Incident Fetching

This integration supports fetching security signals from Datadog Cloud SIEM as Cortex XSOAR incidents.

Configuration

To enable incident fetching:

  1. In the integration instance configuration, check Fetch incidents.
  2. Configure the following parameters:
    • First fetch time: How far back to fetch signals on first run (e.g., “3 days”, “7 days”)
    • Max fetch: Maximum incidents per fetch cycle (recommended: 50, max: 200)
    • Fetch severity: Comma-separated list of severities to fetch (leave empty for all)
    • Fetch state: Signal state to fetch (default: “open”)
    • Fetch query: Additional custom filter query (optional)
  3. Set the Incident type if you want to classify fetched incidents.

Incident Fields

Each fetched incident includes:

  • Name: Security signal title
  • Occurred: Signal timestamp
  • Severity: Mapped from Datadog severity (Low=1, Medium=2, High=3, Critical=4)
  • Raw JSON: Complete signal data for mapping and enrichment

Troubleshooting

Authentication Errors

  • Verify API Key and APP Key are correct
  • Ensure keys have appropriate permissions in Datadog
  • Check Server URL matches your Datadog site (e.g., datadoghq.com, datadoghq.eu)

Fetch Issues

  • Check First Fetch Time is not too far in the past (max 90 days recommended)
  • Verify Fetch Query syntax using Datadog’s query language
  • Review integration logs for detailed error messages

Configuration parameters

  • site — Server URL (required)
  • api_key — API Key (required)
  • app_key — Application Key (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • first_fetch — First fetch time
  • max_fetch — Max fetch
  • fetch_severity — Fetch severity
  • fetch_state — Fetch state
  • fetch_query — Fetch query
  • mirror_direction — Incident Mirroring Direction
  • close_incident — Close Mirrored XSOAR Incident

Commands (18)

  • datadog-add-signal-comment

    Add a comment to a security signal in Datadog Cloud SIEM .

  • datadog-bitsai-get-investigation

    Get the BitsAI investigation for a security signal from Datadog Cloud SIEM . BitsAI provides AI-powered analysis and investigation steps for security signals.

  • datadog-get-rule

    Get a specific security monitoring rule by ID from Datadog Cloud SIEM .

  • datadog-get-signal

    Get a specific security signal by ID from Datadog Cloud SIEM .

  • datadog-list-risk-scores

    List risk scores from Datadog Cloud SIEM . Risk scores provide a quantitative assessment of security risks associated with entities in your environment.

  • datadog-list-security-filters

    List all security filters from Datadog Cloud SIEM . Security filters control which logs are indexed and analyzed by the Cloud SIEM platform.

  • datadog-list-signal-comments

    List all comments for a security signal in Datadog Cloud SIEM .

  • datadog-list-signal-notification-rules

    List all signal notification rules from Datadog Cloud SIEM . Signal notification rules define how and when security signals should trigger notifications to specified channels (e.g., email, Slack, PagerDuty).

  • datadog-list-signals

    Get a list of security signals from Datadog Cloud SIEM with optional filtering and pagination.

  • datadog-list-suppressions

    List all suppressions affecting a specific security monitoring rule in Datadog Cloud SIEM .

  • datadog-list-vulnerability-notification-rules

    List all vulnerability notification rules from Datadog Cloud SIEM. Vulnerability notification rules define how and when vulnerability findings should trigger notifications to specified channels (e.g., email, Slack, PagerDuty).

  • datadog-query-logs

    Query logs in Datadog Cloud SIEM with optional filtering for security investigations.

  • datadog-update-signal-assignee

    Update a security signal's assignee in Datadog Cloud SIEM.

  • datadog-update-signal-state

    Update a security signal's state in Datadog Cloud SIEM.

  • datadog-update-suppression

    Update an existing suppression rule by ID. Allows updating enabled state, name, description, and data exclusion query. At least one attribute must be provided to update.

  • get-mapping-fields

    Get the mapping fields for Datadog Cloud SIEM security signals. This command is used for debugging the mirroring integration and returns the schema of available fields.

  • get-modified-remote-data

    Get the list of signal IDs that were modified since lastUpdate. This command is used for debugging the mirroring integration.

  • get-remote-data

    Get remote data from Datadog Cloud SIEM for mirroring. This command is used for debugging the mirroring integration.

Source

DatadogCloudSIEM.py DatadogCloudSIEM_test.py DatadogCloudSIEM.yml DatadogCloudSIEM_description.md
Download History Raw 
category: Analytics & SIEM
provider: Datadog
commonfields:
  id: DatadogCloudSIEMV2
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- additionalinfo: Datadog website URL
  display: Server URL
  name: site
  type: 15
  options:
  - datadoghq.com
  - us3.datadoghq.com
  - us5.datadoghq.com
  - ap1.datadoghq.com
  - ap2.datadoghq.com
  - datadoghq.eu
  - ddog-gov.com
  defaultvalue: "datadoghq.com"
  required: true
  section: Connect
- additionalinfo: The API Key to use for authentication
  display: API Key
  name: api_key
  type: 9
  displaypassword: API Key
  hiddenusername: true
  required: true
  section: Connect
- additionalinfo: The APP Key to use for authentication
  display: Application Key
  name: app_key
  type: 9
  displaypassword: Application Key
  hiddenusername: true
  required: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- additionalinfo: First fetch time range. How far back to fetch security signals on the first run. Examples "3 days", "7 days", "1 week"
  display: First fetch time
  name: first_fetch
  type: 0
  defaultvalue: "3 days"
  required: false
  section: Collect
- additionalinfo: Maximum number of incidents to fetch per cycle. Maximum is 200, recommended less than 100.
  display: Max fetch
  name: max_fetch
  type: 0
  defaultvalue: "50"
  required: false
  section: Collect
- additionalinfo: Fetch only security signals with these severity levels or higher.
  display: Fetch severity
  name: fetch_severity
  type: 15
  options:
  - info
  - low
  - medium
  - high
  - critical
  defaultvalue: "medium"
  required: false
  section: Collect
- additionalinfo: Fetch only security signals in this state. Default is "open".
  display: Fetch state
  name: fetch_state
  type: 15
  options:
  - open
  - under_review
  - archived
  defaultvalue: "open"
  required: false
  section: Collect
- additionalinfo: Additional custom query filter for fetching security signals. Uses Datadog search syntax.
  display: Fetch query
  name: fetch_query
  type: 0
  required: false
  section: Collect
- display: Incident Mirroring Direction
  name: mirror_direction
  type: 15
  options:
  - None
  - Incoming
  defaultvalue: None
  additionalinfo: Choose the mirroring direction for incidents. Incoming mirrors changes from Datadog to XSOAR. Cortex XSOAR only parameter.
  required: false
  section: Collect
  hidden:
  - marketplacev2
  - platform
- display: Close Mirrored XSOAR Incident
  name: close_incident
  type: 8
  additionalinfo: When selected, archiving the Datadog security signal is mirrored in XSOAR and closes the XSOAR incident. Cortex XSOAR only parameter.
  required: false
  section: Collect
  hidden:
  - marketplacev2
  - platform
description: Datadog Cloud SIEM integration for XSOAR provides security signal management capabilities. This integration allows you to retrieve, filter, and manage security signals from Datadog's Cloud SIEM platform, enabling security teams to investigate threats, manage signal triage states, and assign signals to team members. Supports incoming mirroring of signals to XSOAR incidents.
display: Datadog Cloud SIEM
name: DatadogCloudSIEMV2
script:
  commands:
  - arguments:
    - description: The unique identifier of the security signal to retrieve. If not provided, will attempt to get it from the current incident.
      name: signal_id
    name: datadog-get-signal
    description: Get a specific security signal by ID from Datadog Cloud SIEM .
    outputs:
    - contextPath: Datadog.SecuritySignal.id
      description: The unique identifier of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.event_id
      description: The event ID of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.timestamp
      description: The timestamp when the security signal was generated.
      type: Number
    - contextPath: Datadog.SecuritySignal.title
      description: The title of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.message
      description: The message describing the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.severity
      description: The severity level of the security signal (low, medium, high, critical).
      type: String
    - contextPath: Datadog.SecuritySignal.host
      description: Host associated with the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.service
      description: List of services associated with the security signal.
      type: Unknown
    - contextPath: Datadog.SecuritySignal.tags
      description: List of tags associated with the security signal.
      type: Unknown
    - contextPath: Datadog.SecuritySignal.triggering_log_id
      description: ID of the log that triggered the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.rule.id
      description: The unique identifier of the security rule.
      type: String
    - contextPath: Datadog.SecuritySignal.rule.url
      description: URL to view the security rule in Datadog UI.
      type: String
    - contextPath: Datadog.SecuritySignal.triage.state
      description: The current triage state of the security signal (open, under_review, archived).
      type: String
    - contextPath: Datadog.SecuritySignal.triage.archive_comment
      description: The archive comment of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.triage.archive_reason
      description: The archive reason of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.triage.assignee.name
      description: The name of the user assigned to the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.triage.assignee.handle
      description: The handle of the user assigned to the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.url
      description: URL to view the security signal in Datadog UI.
      type: String
    - contextPath: Datadog.SecuritySignal.raw
      description: The raw signal object returned by the API.
      type: Unknown
  - arguments:
    - description: Filter signals by state (open, under_review, archived).
      name: state
      auto: PREDEFINED
      predefined:
      - open
      - under_review
      - archived
    - description: Filter signals by severity level (info, low, medium, high, critical).
      name: severity
      auto: PREDEFINED
      predefined:
      - info
      - low
      - medium
      - high
      - critical
    - description: Filter signals by source.
      name: source
    - description: Custom query string for advanced filtering. Uses Datadog search syntax.
      name: query
    - description: Start date for the search. Format can be relative (e.g., "7 days ago") or absolute (e.g., "2023-01-01T00:00:00Z"). Default is -7days.
      name: from_date
    - description: End date for the search. Format can be relative (e.g., "now") or absolute (e.g., "2023-01-01T23:59:59Z"). Default is now.
      name: to_date
    - description: Sort order for results. Default is desc.
      name: sort
      auto: PREDEFINED
      predefined:
      - asc
      - desc
    - description: Number of results per page.
      name: page_size
    - description: Maximum number of results to return. If page_size is specified, limit is ignored. Default is 50.
      name: limit
    name: datadog-list-signals
    description: Get a list of security signals from Datadog Cloud SIEM  with optional filtering and pagination.
    outputs:
    - contextPath: Datadog.SecuritySignal.id
      description: The unique identifier of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.event_id
      description: The event ID of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.timestamp
      description: The timestamp when the security signal was generated.
      type: Number
    - contextPath: Datadog.SecuritySignal.host
      description: Host associated with the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.service
      description: List of services associated with the security signal.
      type: Unknown
    - contextPath: Datadog.SecuritySignal.severity
      description: The severity level of the security signal (low, medium, high, critical).
      type: String
    - contextPath: Datadog.SecuritySignal.title
      description: The title of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.message
      description: The message describing the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.tags
      description: List of tags associated with the security signal.
      type: Unknown
    - contextPath: Datadog.SecuritySignal.triggering_log_id
      description: ID of the log that triggered the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.rule.id
      description: The unique identifier of the security rule.
      type: String
    - contextPath: Datadog.SecuritySignal.rule.url
      description: URL to view the security rule in Datadog UI.
      type: String
    - contextPath: Datadog.SecuritySignal.triage.state
      description: The current triage state of the security signal (open, under_review, archived).
      type: String
    - contextPath: Datadog.SecuritySignal.triage.archive_comment
      description: The archive comment of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.triage.archive_reason
      description: The archive reason of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.triage.assignee.name
      description: The name of the user assigned to the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.triage.assignee.handle
      description: The handle of the user assigned to the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.url
      description: URL to view the security signal in Datadog UI.
      type: String
    - contextPath: Datadog.SecuritySignal.raw
      description: The raw signal object returned by the API.
      type: Unknown
  - arguments:
    - description: The unique identifier of the security signal to update. If not provided, will attempt to get it from the current incident.
      name: signal_id
    - description: The new state of the security signal. At least one of assignee or state must be provided.
      name: state
      auto: PREDEFINED
      predefined:
      - open
      - under_review
      - archived
    - description: Reason for the state change (used when changing state to archived).
      name: archive_reason
      auto: PREDEFINED
      predefined:
      - none
      - false_positive
      - testing_or_maintenance
      - remediated
      - investigated_case_opened
      - other
      - true_positive_benign
      - true_positive_malicious
    - description: Comment about the state change (used when changing state to archived).
      name: archive_comment
    name: datadog-update-signal-state
    description: Update a security signal's state in Datadog Cloud SIEM.
    outputs:
    - contextPath: Datadog.SecuritySignal.id
      description: The unique identifier of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.event_id
      description: The event ID of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.timestamp
      description: The timestamp when the security signal was generated.
      type: Number
    - contextPath: Datadog.SecuritySignal.title
      description: The title of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.message
      description: The message describing the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.severity
      description: The severity level of the security signal (low, medium, high, critical).
      type: String
    - contextPath: Datadog.SecuritySignal.host
      description: Host associated with the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.service
      description: List of services associated with the security signal.
      type: Unknown
    - contextPath: Datadog.SecuritySignal.tags
      description: List of tags associated with the security signal.
      type: Unknown
    - contextPath: Datadog.SecuritySignal.triggering_log_id
      description: ID of the log that triggered the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.rule.id
      description: The unique identifier of the security rule.
      type: String
    - contextPath: Datadog.SecuritySignal.rule.url
      description: URL to view the security rule in Datadog UI.
      type: String
    - contextPath: Datadog.SecuritySignal.triage.state
      description: The current triage state of the security signal (open, under_review, archived).
      type: String
    - contextPath: Datadog.SecuritySignal.triage.archive_comment
      description: The archive comment of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.triage.archive_reason
      description: The archive reason of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.triage.assignee.handle
      description: The handle of the user assigned to the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.triage.assignee.name
      description: The name of the user assigned to the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.url
      description: URL to view the security signal in Datadog UI.
      type: String
    - contextPath: Datadog.SecuritySignal.raw
      description: The raw signal object returned by the API.
      type: Unknown
  - arguments:
    - description: The unique identifier of the security signal to update. If not provided, will attempt to get it from the current incident.
      name: signal_id
    - description: Name or email of the user to assign to the security signal. Leave empty to unassign. At least one of assignee or state must be provided.
      name: assignee
    name: datadog-update-signal-assignee
    description: Update a security signal's assignee in Datadog Cloud SIEM.
    outputs:
    - contextPath: Datadog.SecuritySignal.id
      description: The unique identifier of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.event_id
      description: The event ID of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.timestamp
      description: The timestamp when the security signal was generated.
      type: Number
    - contextPath: Datadog.SecuritySignal.title
      description: The title of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.message
      description: The message describing the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.severity
      description: The severity level of the security signal (low, medium, high, critical).
      type: String
    - contextPath: Datadog.SecuritySignal.host
      description: Host associated with the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.service
      description: List of services associated with the security signal.
      type: Unknown
    - contextPath: Datadog.SecuritySignal.tags
      description: List of tags associated with the security signal.
      type: Unknown
    - contextPath: Datadog.SecuritySignal.triggering_log_id
      description: ID of the log that triggered the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.rule.id
      description: The unique identifier of the security rule.
      type: String
    - contextPath: Datadog.SecuritySignal.rule.url
      description: URL to view the security rule in Datadog UI.
      type: String
    - contextPath: Datadog.SecuritySignal.triage.state
      description: The current triage state of the security signal (open, under_review, archived).
      type: String
    - contextPath: Datadog.SecuritySignal.triage.archive_comment
      description: The archive comment of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.triage.archive_reason
      description: The archive reason of the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.triage.assignee.handle
      description: The handle of the user assigned to the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.triage.assignee.name
      description: The name of the user assigned to the security signal.
      type: String
    - contextPath: Datadog.SecuritySignal.url
      description: URL to view the security signal in Datadog UI.
      type: String
    - contextPath: Datadog.SecuritySignal.raw
      description: The raw signal object returned by the API.
      type: Unknown
  - arguments:
    - description: The unique identifier of the security rule to retrieve. If not provided, will attempt to get it from the current incident.
      name: rule_id
    name: datadog-get-rule
    description: Get a specific security monitoring rule by ID from Datadog Cloud SIEM .
    outputs:
    - contextPath: Datadog.SecurityRule.id
      description: The unique identifier of the security rule.
      type: String
    - contextPath: Datadog.SecurityRule.name
      description: The name of the security rule.
      type: String
    - contextPath: Datadog.SecurityRule.type
      description: The type of the security rule.
      type: String
    - contextPath: Datadog.SecurityRule.isEnabled
      description: Whether the security rule is enabled.
      type: Boolean
    - contextPath: Datadog.SecurityRule.createdAt
      description: Timestamp when the rule was created.
      type: Number
    - contextPath: Datadog.SecurityRule.message
      description: Message for the security rule.
      type: String
    - contextPath: Datadog.SecurityRule.queries
      description: Queries associated with the security rule.
      type: Unknown
    - contextPath: Datadog.SecurityRule.cases
      description: Cases (severity and notifications) for the rule.
      type: Unknown
    - contextPath: Datadog.SecurityRule.options
      description: Options for the security rule.
      type: Unknown
    - contextPath: Datadog.SecurityRule.tags
      description: Tags associated with the security rule.
      type: Unknown
    - contextPath: Datadog.SecurityRule.url
      description: URL to view the security rule in Datadog UI.
      type: String
    - contextPath: Datadog.SecurityRule.raw
      description: The raw rule object returned by the API.
      type: Unknown
  - arguments:
    - description: The unique identifier of the suppression to update.
      name: suppression_id
      required: true
    - description: Whether the suppression is enabled.
      name: enabled
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    - description: Name of the suppression.
      name: name
    - description: Description of the suppression.
      name: description
    - description: Data exclusion query to filter signals. Uses Datadog search syntax.
      name: data_exclusion_query
    name: datadog-update-suppression
    description: Update an existing suppression rule by ID. Allows updating enabled state, name, description, and data exclusion query. At least one attribute must be provided to update.
    outputs:
    - contextPath: Datadog.SecuritySuppression.id
      description: The unique identifier of the suppression.
      type: String
    - contextPath: Datadog.SecuritySuppression.name
      description: The name of the suppression.
      type: String
    - contextPath: Datadog.SecuritySuppression.description
      description: The description of the suppression.
      type: String
    - contextPath: Datadog.SecuritySuppression.enabled
      description: Whether the suppression is enabled.
      type: Boolean
    - contextPath: Datadog.SecuritySuppression.dataExclusionQuery
      description: Query to match signals to suppress.
      type: String
    - contextPath: Datadog.SecuritySuppression.ruleQuery
      description: Query to target specific security rules.
      type: String
    - contextPath: Datadog.SecuritySuppression.creationAt
      description: Unix timestamp when the suppression was created (in seconds since epoch).
      type: Number
    - contextPath: Datadog.SecuritySuppression.updateAt
      description: Unix timestamp when the suppression was last updated (in seconds since epoch).
      type: Number
    - contextPath: Datadog.SecuritySuppression.creator
      description: The creator of the suppression (name and email).
      type: String
    - contextPath: Datadog.SecuritySuppression.updater
      description: The user who last updated the suppression (name and email).
      type: String
    - contextPath: Datadog.SecuritySuppression.url
      description: URL to view the suppression in Datadog UI.
      type: String
    - contextPath: Datadog.SecuritySuppression.raw
      description: The raw suppression object returned by the API.
      type: Unknown
  - arguments:
    - description: The ID of the security rule to list suppressions for. If not provided, will attempt to get it from the current incident.
      name: rule_id
    name: datadog-list-suppressions
    description: List all suppressions affecting a specific security monitoring rule in Datadog Cloud SIEM .
    outputs:
    - contextPath: Datadog.SecuritySuppression.id
      description: The unique identifier of the suppression.
      type: String
    - contextPath: Datadog.SecuritySuppression.name
      description: The name of the suppression.
      type: String
    - contextPath: Datadog.SecuritySuppression.description
      description: The description of the suppression.
      type: String
    - contextPath: Datadog.SecuritySuppression.enabled
      description: Whether the suppression is enabled.
      type: Boolean
    - contextPath: Datadog.SecuritySuppression.creationAt
      description: Unix timestamp when the suppression was created (in seconds since epoch).
      type: Number
    - contextPath: Datadog.SecuritySuppression.updateAt
      description: Unix timestamp when the suppression was last updated (in seconds since epoch).
      type: Number
    - contextPath: Datadog.SecuritySuppression.creator
      description: The creator of the suppression (name and email).
      type: String
    - contextPath: Datadog.SecuritySuppression.updater
      description: The user who last updated the suppression (name and email).
      type: String
    - contextPath: Datadog.SecuritySuppression.dataExclusionQuery
      description: Query to match signals to suppress.
      type: String
    - contextPath: Datadog.SecuritySuppression.ruleQuery
      description: Query to target specific security rules.
      type: String
    - contextPath: Datadog.SecuritySuppression.suppressionQuery
      description: Additional suppression query filters.
      type: String
    - contextPath: Datadog.SecuritySuppression.url
      description: URL to view the suppression in Datadog UI.
      type: String
    - contextPath: Datadog.SecuritySuppression.raw
      description: The raw suppression object returned by the API.
      type: Unknown
  - arguments:
    - description: The event ID of the security signal to add a comment to. If not provided, will attempt to get it from the current incident.
      name: event_id
    - description: The comment text to add to the security signal.
      name: comment
      required: true
    name: datadog-add-signal-comment
    description: Add a comment to a security signal in Datadog Cloud SIEM .
    outputs:
    - contextPath: Datadog.SecurityComment.id
      description: The unique identifier of the comment.
      type: String
    - contextPath: Datadog.SecurityComment.created_at
      description: The timestamp when the comment was created.
      type: String
    - contextPath: Datadog.SecurityComment.user_uuid
      description: The UUID of the user who created the comment.
      type: String
    - contextPath: Datadog.SecurityComment.text
      description: The comment text content.
      type: String
    - contextPath: Datadog.SecurityComment.user.name
      description: The name of the user who created the comment.
      type: String
    - contextPath: Datadog.SecurityComment.user.handle
      description: The handle of the user who created the comment.
      type: String
  - arguments:
    - description: The event ID of the security signal to list comments for. If not provided, will attempt to get it from the current incident.
      name: event_id
    name: datadog-list-signal-comments
    description: List all comments for a security signal in Datadog Cloud SIEM .
    outputs:
    - contextPath: Datadog.SecurityComment.id
      description: The unique identifier of the comment.
      type: String
    - contextPath: Datadog.SecurityComment.created_at
      description: The timestamp when the comment was created.
      type: String
    - contextPath: Datadog.SecurityComment.user_uuid
      description: The UUID of the user who created the comment.
      type: String
    - contextPath: Datadog.SecurityComment.text
      description: The comment text content.
      type: String
    - contextPath: Datadog.SecurityComment.user.name
      description: The name of the user who created the comment.
      type: String
    - contextPath: Datadog.SecurityComment.user.handle
      description: The handle of the user who created the comment.
      type: String
  - arguments:
    - description: Custom search query string. Uses Datadog search syntax. Required unless running from an incident with a Datadog Security Signal (will use rule's query as fallback).
      name: query
    - description: Start date for the search. Format can be relative (e.g., "7 days ago") or absolute (e.g., "2023-01-01T00:00:00Z"). Default is -7days.
      name: from_date
    - description: End date for the search. Format can be relative (e.g., "now") or absolute (e.g., "2023-01-01T23:59:59Z"). Default is now.
      name: to_date
    - description: Specifies storage type as indexes, online-archives or flex.
      name: storage_tier
      auto: PREDEFINED
      predefined:
      - indexes
      - online-archives
      - flex
    - description: Sort order for results. Default is desc.
      name: sort
      auto: PREDEFINED
      predefined:
      - asc
      - desc
    - description: Maximum number of results to return. Default is 50.
      name: limit
    name: datadog-query-logs
    description: Query logs in Datadog Cloud SIEM  with optional filtering for security investigations.
    outputs:
    - contextPath: Datadog.Log.id
      description: The unique identifier of the log entry.
      type: String
    - contextPath: Datadog.Log.timestamp
      description: The timestamp when the log was generated.
      type: Number
    - contextPath: Datadog.Log.message
      description: The log message content.
      type: String
    - contextPath: Datadog.Log.service
      description: The service that generated the log.
      type: String
    - contextPath: Datadog.Log.host
      description: The host that generated the log.
      type: String
    - contextPath: Datadog.Log.source
      description: The source of the log entry.
      type: String
    - contextPath: Datadog.Log.status
      description: The status/level of the log entry.
      type: String
    - contextPath: Datadog.Log.tags
      description: List of tags associated with the log entry.
      type: Unknown
    - contextPath: Datadog.Log.url
      description: URL to view the log in Datadog UI.
      type: String
    - contextPath: Datadog.Log.raw
      description: The raw log object returned by the API.
      type: Unknown
  - name: datadog-list-security-filters
    description: List all security filters from Datadog Cloud SIEM . Security filters control which logs are indexed and analyzed by the Cloud SIEM platform.
    outputs:
    - contextPath: Datadog.SecurityFilter.id
      description: The unique identifier of the security filter.
      type: String
    - contextPath: Datadog.SecurityFilter.name
      description: The name of the security filter.
      type: String
    - contextPath: Datadog.SecurityFilter.filteredDataType
      description: The type of data being filtered (e.g., logs).
      type: String
    - contextPath: Datadog.SecurityFilter.enabled
      description: Whether the security filter is enabled.
      type: Boolean
    - contextPath: Datadog.SecurityFilter.builtin
      description: Whether the security filter is a built-in filter.
      type: Boolean
    - contextPath: Datadog.SecurityFilter.query
      description: The query used by the security filter.
      type: String
    - contextPath: Datadog.SecurityFilter.exclusionFilters
      description: List of exclusion filters applied.
      type: Unknown
    - contextPath: Datadog.SecurityFilter.raw
      description: The raw filter object returned by the API.
      type: Unknown
  - name: datadog-list-signal-notification-rules
    description: List all signal notification rules from Datadog Cloud SIEM . Signal notification rules define how and when security signals should trigger notifications to specified channels (e.g., email, Slack, PagerDuty).
    outputs:
    - contextPath: Datadog.SecurityNotificationRule.id
      description: The unique identifier of the notification rule.
      type: String
    - contextPath: Datadog.SecurityNotificationRule.name
      description: The name of the notification rule.
      type: String
    - contextPath: Datadog.SecurityNotificationRule.enabled
      description: Whether the notification rule is enabled.
      type: Boolean
    - contextPath: Datadog.SecurityNotificationRule.createdAt
      description: Unix timestamp when the notification rule was created (in seconds since epoch).
      type: Number
    - contextPath: Datadog.SecurityNotificationRule.createdBy
      description: The creator of the notification rule (name and email).
      type: String
    - contextPath: Datadog.SecurityNotificationRule.modifiedAt
      description: Unix timestamp when the notification rule was last modified (in seconds since epoch).
      type: Number
    - contextPath: Datadog.SecurityNotificationRule.modifiedBy
      description: The user who last modified the notification rule (name and email).
      type: String
    - contextPath: Datadog.SecurityNotificationRule.targets
      description: List of notification targets (e.g., email addresses, Slack channels).
      type: Unknown
    - contextPath: Datadog.SecurityNotificationRule.selectors.severities
      description: List of severity levels that trigger this notification rule.
      type: Unknown
    - contextPath: Datadog.SecurityNotificationRule.selectors.ruleTypes
      description: List of rule types that trigger this notification rule.
      type: Unknown
    - contextPath: Datadog.SecurityNotificationRule.selectors.query
      description: Query filter for signals that trigger this notification rule.
      type: String
    - contextPath: Datadog.SecurityNotificationRule.selectors.triggerSource
      description: The source that triggers this notification rule (e.g., security_signals).
      type: String
    - contextPath: Datadog.SecurityNotificationRule.timeAggregation
      description: Time aggregation in seconds for batching notifications.
      type: Number
    - contextPath: Datadog.SecurityNotificationRule.version
      description: The version number of the notification rule.
      type: Number
    - contextPath: Datadog.SecurityNotificationRule.raw
      description: The raw notification rule object returned by the API.
      type: Unknown
  - name: datadog-list-vulnerability-notification-rules
    description: List all vulnerability notification rules from Datadog Cloud SIEM. Vulnerability notification rules define how and when vulnerability findings should trigger notifications to specified channels (e.g., email, Slack, PagerDuty).
    outputs:
    - contextPath: Datadog.VulnerabilityNotificationRule.id
      description: The unique identifier of the notification rule.
      type: String
    - contextPath: Datadog.VulnerabilityNotificationRule.name
      description: The name of the notification rule.
      type: String
    - contextPath: Datadog.VulnerabilityNotificationRule.enabled
      description: Whether the notification rule is enabled.
      type: Boolean
    - contextPath: Datadog.VulnerabilityNotificationRule.createdAt
      description: Unix timestamp when the notification rule was created (in seconds since epoch).
      type: Number
    - contextPath: Datadog.VulnerabilityNotificationRule.createdBy
      description: The creator of the notification rule (name and email).
      type: String
    - contextPath: Datadog.VulnerabilityNotificationRule.modifiedAt
      description: Unix timestamp when the notification rule was last modified (in seconds since epoch).
      type: Number
    - contextPath: Datadog.VulnerabilityNotificationRule.modifiedBy
      description: The user who last modified the notification rule (name and email).
      type: String
    - contextPath: Datadog.VulnerabilityNotificationRule.targets
      description: List of notification targets (e.g., email addresses, Slack channels).
      type: Unknown
    - contextPath: Datadog.VulnerabilityNotificationRule.selectors.severities
      description: List of severity levels that trigger this notification rule.
      type: Unknown
    - contextPath: Datadog.VulnerabilityNotificationRule.selectors.ruleTypes
      description: List of rule types that trigger this notification rule.
      type: Unknown
    - contextPath: Datadog.VulnerabilityNotificationRule.selectors.query
      description: Query filter for vulnerabilities that trigger this notification rule.
      type: String
    - contextPath: Datadog.VulnerabilityNotificationRule.selectors.triggerSource
      description: The source that triggers this notification rule (e.g., vulnerabilities).
      type: String
    - contextPath: Datadog.VulnerabilityNotificationRule.timeAggregation
      description: Time aggregation in seconds for batching notifications.
      type: Number
    - contextPath: Datadog.VulnerabilityNotificationRule.version
      description: The version number of the notification rule.
      type: Number
    - contextPath: Datadog.VulnerabilityNotificationRule.raw
      description: The raw notification rule object returned by the API.
      type: Unknown
  - arguments:
    - description: The unique identifier of the security signal to get investigation for. If not provided, will attempt to get it from the current incident.
      name: signal_id
    name: datadog-bitsai-get-investigation
    description: Get the BitsAI investigation for a security signal from Datadog Cloud SIEM . BitsAI provides AI-powered analysis and investigation steps for security signals.
    outputs:
    - contextPath: Datadog.SecurityInvestigation.signal_id
      description: The unique identifier of the security signal being investigated.
      type: String
    - contextPath: Datadog.SecurityInvestigation.verdict
      description: The overall verdict of the AI investigation (e.g., "benign", "suspicious", "malicious").
      type: String
    - contextPath: Datadog.SecurityInvestigation.steps
      description: List of investigation steps performed by BitsAI.
      type: Unknown
    - contextPath: Datadog.SecurityInvestigation.steps.name
      description: The name of the investigation step.
      type: String
    - contextPath: Datadog.SecurityInvestigation.steps.verdict
      description: The verdict for this specific investigation step.
      type: String
    - contextPath: Datadog.SecurityInvestigation.steps.summary
      description: A summary of the findings for this investigation step.
      type: String
  - arguments:
    - description: Custom query string for filtering risk scores. Uses Datadog search syntax.
      name: query
    - description: Sort order for results. Use "-riskScore" for descending, "riskScore" for ascending. Default is "-riskScore".
      name: sort
      auto: PREDEFINED
      predefined:
      - riskScore
      - -riskScore
    - description: Number of results per page. Default is 50.
      name: page_size
    - description: Page number to retrieve. Default is 1.
      name: page_number
    name: datadog-list-risk-scores
    description: List risk scores from Datadog Cloud SIEM . Risk scores provide a quantitative assessment of security risks associated with entities in your environment.
    outputs:
    - contextPath: Datadog.SecurityRiskInsights.id
      description: The unique identifier of the entity.
      type: String
    - contextPath: Datadog.SecurityRiskInsights.type
      description: The type of the entity risk score.
      type: String
    - contextPath: Datadog.SecurityRiskInsights.entityName
      description: The name of the entity.
      type: String
    - contextPath: Datadog.SecurityRiskInsights.entityType
      description: The type of the entity (e.g., "Code Repository", "User", "Host").
      type: String
    - contextPath: Datadog.SecurityRiskInsights.entityProviders
      description: List of providers for the entity (e.g., "GitHub", "AWS").
      type: Unknown
    - contextPath: Datadog.SecurityRiskInsights.entityRoles
      description: List of roles assigned to the entity.
      type: Unknown
    - contextPath: Datadog.SecurityRiskInsights.riskScore
      description: The calculated risk score for the entity.
      type: Number
    - contextPath: Datadog.SecurityRiskInsights.riskScoreEvolution
      description: The change in risk score over time.
      type: Number
    - contextPath: Datadog.SecurityRiskInsights.severity
      description: The severity level of the risk (e.g., "critical", "high", "medium", "low").
      type: String
    - contextPath: Datadog.SecurityRiskInsights.signalsDetected
      description: The number of security signals detected for this entity.
      type: Number
    - contextPath: Datadog.SecurityRiskInsights.firstDetected
      description: Unix timestamp when the entity was first detected (in seconds since epoch).
      type: Number
    - contextPath: Datadog.SecurityRiskInsights.lastDetected
      description: Unix timestamp when the entity was last detected (in seconds since epoch).
      type: Number
    - contextPath: Datadog.SecurityRiskInsights.configRisks.hasMisconfiguration
      description: Whether the entity has a misconfiguration.
      type: Boolean
    - contextPath: Datadog.SecurityRiskInsights.configRisks.hasIdentityRisk
      description: Whether the entity has identity-related risks.
      type: Boolean
    - contextPath: Datadog.SecurityRiskInsights.configRisks.isPubliclyAccessible
      description: Whether the entity is publicly accessible.
      type: Boolean
    - contextPath: Datadog.SecurityRiskInsights.configRisks.isProduction
      description: Whether the entity is in a production environment.
      type: Boolean
    - contextPath: Datadog.SecurityRiskInsights.configRisks.hasPrivilegedRole
      description: Whether the entity has a privileged role.
      type: Boolean
    - contextPath: Datadog.SecurityRiskInsights.configRisks.isPrivileged
      description: Whether the entity is privileged.
      type: Boolean
    - contextPath: Datadog.SecurityRiskInsights.entityMetadata.sources
      description: List of sources associated with the entity.
      type: Unknown
    - contextPath: Datadog.SecurityRiskInsights.entityMetadata.environments
      description: List of environments associated with the entity.
      type: Unknown
    - contextPath: Datadog.SecurityRiskInsights.entityMetadata.services
      description: List of services associated with the entity.
      type: Unknown
    - contextPath: Datadog.SecurityRiskInsights.entityMetadata.mitreTactics
      description: List of MITRE ATT&CK tactics associated with the entity.
      type: Unknown
    - contextPath: Datadog.SecurityRiskInsights.entityMetadata.mitreTechniques
      description: List of MITRE ATT&CK techniques associated with the entity.
      type: Unknown
    - contextPath: Datadog.SecurityRiskInsights.raw
      description: The raw risk insight object returned by the API.
      type: Unknown
  - arguments:
    - description: The signal ID to retrieve remote data for.
      name: id
      required: true
    name: get-remote-data
    description: Get remote data from Datadog Cloud SIEM for mirroring. This command is used for debugging the mirroring integration.
  - arguments:
    - description: Last update timestamp (ISO format).
      name: lastUpdate
      required: true
    name: get-modified-remote-data
    description: Get the list of signal IDs that were modified since lastUpdate. This command is used for debugging the mirroring integration.
  - name: get-mapping-fields
    description: Get the mapping fields for Datadog Cloud SIEM security signals. This command is used for debugging the mirroring integration and returns the schema of available fields.
  dockerimage: demisto/datadog-api-client:1.0.0.10133006
  isfetch: true
  ismappable: true
  isremotesyncin: true
  isremotesyncout: false
  runonce: false
  script: "-"
  subtype: python3
  type: python
defaultclassifier: Datadog Cloud SIEM V2
defaultmapperin: Datadog Cloud SIEM V2 - Incoming Mapper
tests:
- DatadogCloudSIEMV2
fromversion: 6.8.0