category: Analytics & SIEM provider: Datadog commonfields: id: DatadogCloudSIEMV2 version: -1 sectionorder: - Connect - Collect configuration: - additionalinfo: Datadog website URL display: Server URL name: site type: 15 options: - datadoghq.com - us3.datadoghq.com - us5.datadoghq.com - ap1.datadoghq.com - ap2.datadoghq.com - datadoghq.eu - ddog-gov.com defaultvalue: "datadoghq.com" required: true section: Connect - additionalinfo: The API Key to use for authentication display: API Key name: api_key type: 9 displaypassword: API Key hiddenusername: true required: true section: Connect - additionalinfo: The APP Key to use for authentication display: Application Key name: app_key type: 9 displaypassword: Application Key hiddenusername: true required: true section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - display: Fetch incidents name: isFetch type: 8 required: false section: Collect - display: Incident type name: incidentType type: 13 required: false section: Collect - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 section: Collect advanced: true - additionalinfo: First fetch time range. How far back to fetch security signals on the first run. Examples "3 days", "7 days", "1 week" display: First fetch time name: first_fetch type: 0 defaultvalue: "3 days" required: false section: Collect - additionalinfo: Maximum number of incidents to fetch per cycle. Maximum is 200, recommended less than 100. display: Max fetch name: max_fetch type: 0 defaultvalue: "50" required: false section: Collect - additionalinfo: Fetch only security signals with these severity levels or higher. display: Fetch severity name: fetch_severity type: 15 options: - info - low - medium - high - critical defaultvalue: "medium" required: false section: Collect - additionalinfo: Fetch only security signals in this state. Default is "open". display: Fetch state name: fetch_state type: 15 options: - open - under_review - archived defaultvalue: "open" required: false section: Collect - additionalinfo: Additional custom query filter for fetching security signals. Uses Datadog search syntax. display: Fetch query name: fetch_query type: 0 required: false section: Collect - display: Incident Mirroring Direction name: mirror_direction type: 15 options: - None - Incoming defaultvalue: None additionalinfo: Choose the mirroring direction for incidents. Incoming mirrors changes from Datadog to XSOAR. Cortex XSOAR only parameter. required: false section: Collect hidden: - marketplacev2 - platform - display: Close Mirrored XSOAR Incident name: close_incident type: 8 additionalinfo: When selected, archiving the Datadog security signal is mirrored in XSOAR and closes the XSOAR incident. Cortex XSOAR only parameter. required: false section: Collect hidden: - marketplacev2 - platform description: Datadog Cloud SIEM integration for XSOAR provides security signal management capabilities. This integration allows you to retrieve, filter, and manage security signals from Datadog's Cloud SIEM platform, enabling security teams to investigate threats, manage signal triage states, and assign signals to team members. Supports incoming mirroring of signals to XSOAR incidents. display: Datadog Cloud SIEM name: DatadogCloudSIEMV2 script: commands: - arguments: - description: The unique identifier of the security signal to retrieve. If not provided, will attempt to get it from the current incident. name: signal_id name: datadog-get-signal description: Get a specific security signal by ID from Datadog Cloud SIEM . outputs: - contextPath: Datadog.SecuritySignal.id description: The unique identifier of the security signal. type: String - contextPath: Datadog.SecuritySignal.event_id description: The event ID of the security signal. type: String - contextPath: Datadog.SecuritySignal.timestamp description: The timestamp when the security signal was generated. type: Number - contextPath: Datadog.SecuritySignal.title description: The title of the security signal. type: String - contextPath: Datadog.SecuritySignal.message description: The message describing the security signal. type: String - contextPath: Datadog.SecuritySignal.severity description: The severity level of the security signal (low, medium, high, critical). type: String - contextPath: Datadog.SecuritySignal.host description: Host associated with the security signal. type: String - contextPath: Datadog.SecuritySignal.service description: List of services associated with the security signal. type: Unknown - contextPath: Datadog.SecuritySignal.tags description: List of tags associated with the security signal. type: Unknown - contextPath: Datadog.SecuritySignal.triggering_log_id description: ID of the log that triggered the security signal. type: String - contextPath: Datadog.SecuritySignal.rule.id description: The unique identifier of the security rule. type: String - contextPath: Datadog.SecuritySignal.rule.url description: URL to view the security rule in Datadog UI. type: String - contextPath: Datadog.SecuritySignal.triage.state description: The current triage state of the security signal (open, under_review, archived). type: String - contextPath: Datadog.SecuritySignal.triage.archive_comment description: The archive comment of the security signal. type: String - contextPath: Datadog.SecuritySignal.triage.archive_reason description: The archive reason of the security signal. type: String - contextPath: Datadog.SecuritySignal.triage.assignee.name description: The name of the user assigned to the security signal. type: String - contextPath: Datadog.SecuritySignal.triage.assignee.handle description: The handle of the user assigned to the security signal. type: String - contextPath: Datadog.SecuritySignal.url description: URL to view the security signal in Datadog UI. type: String - contextPath: Datadog.SecuritySignal.raw description: The raw signal object returned by the API. type: Unknown - arguments: - description: Filter signals by state (open, under_review, archived). name: state auto: PREDEFINED predefined: - open - under_review - archived - description: Filter signals by severity level (info, low, medium, high, critical). name: severity auto: PREDEFINED predefined: - info - low - medium - high - critical - description: Filter signals by source. name: source - description: Custom query string for advanced filtering. Uses Datadog search syntax. name: query - description: Start date for the search. Format can be relative (e.g., "7 days ago") or absolute (e.g., "2023-01-01T00:00:00Z"). Default is -7days. name: from_date - description: End date for the search. Format can be relative (e.g., "now") or absolute (e.g., "2023-01-01T23:59:59Z"). Default is now. name: to_date - description: Sort order for results. Default is desc. name: sort auto: PREDEFINED predefined: - asc - desc - description: Number of results per page. name: page_size - description: Maximum number of results to return. If page_size is specified, limit is ignored. Default is 50. name: limit name: datadog-list-signals description: Get a list of security signals from Datadog Cloud SIEM with optional filtering and pagination. outputs: - contextPath: Datadog.SecuritySignal.id description: The unique identifier of the security signal. type: String - contextPath: Datadog.SecuritySignal.event_id description: The event ID of the security signal. type: String - contextPath: Datadog.SecuritySignal.timestamp description: The timestamp when the security signal was generated. type: Number - contextPath: Datadog.SecuritySignal.host description: Host associated with the security signal. type: String - contextPath: Datadog.SecuritySignal.service description: List of services associated with the security signal. type: Unknown - contextPath: Datadog.SecuritySignal.severity description: The severity level of the security signal (low, medium, high, critical). type: String - contextPath: Datadog.SecuritySignal.title description: The title of the security signal. type: String - contextPath: Datadog.SecuritySignal.message description: The message describing the security signal. type: String - contextPath: Datadog.SecuritySignal.tags description: List of tags associated with the security signal. type: Unknown - contextPath: Datadog.SecuritySignal.triggering_log_id description: ID of the log that triggered the security signal. type: String - contextPath: Datadog.SecuritySignal.rule.id description: The unique identifier of the security rule. type: String - contextPath: Datadog.SecuritySignal.rule.url description: URL to view the security rule in Datadog UI. type: String - contextPath: Datadog.SecuritySignal.triage.state description: The current triage state of the security signal (open, under_review, archived). type: String - contextPath: Datadog.SecuritySignal.triage.archive_comment description: The archive comment of the security signal. type: String - contextPath: Datadog.SecuritySignal.triage.archive_reason description: The archive reason of the security signal. type: String - contextPath: Datadog.SecuritySignal.triage.assignee.name description: The name of the user assigned to the security signal. type: String - contextPath: Datadog.SecuritySignal.triage.assignee.handle description: The handle of the user assigned to the security signal. type: String - contextPath: Datadog.SecuritySignal.url description: URL to view the security signal in Datadog UI. type: String - contextPath: Datadog.SecuritySignal.raw description: The raw signal object returned by the API. type: Unknown - arguments: - description: The unique identifier of the security signal to update. If not provided, will attempt to get it from the current incident. name: signal_id - description: The new state of the security signal. At least one of assignee or state must be provided. name: state auto: PREDEFINED predefined: - open - under_review - archived - description: Reason for the state change (used when changing state to archived). name: archive_reason auto: PREDEFINED predefined: - none - false_positive - testing_or_maintenance - remediated - investigated_case_opened - other - true_positive_benign - true_positive_malicious - description: Comment about the state change (used when changing state to archived). name: archive_comment name: datadog-update-signal-state description: Update a security signal's state in Datadog Cloud SIEM. outputs: - contextPath: Datadog.SecuritySignal.id description: The unique identifier of the security signal. type: String - contextPath: Datadog.SecuritySignal.event_id description: The event ID of the security signal. type: String - contextPath: Datadog.SecuritySignal.timestamp description: The timestamp when the security signal was generated. type: Number - contextPath: Datadog.SecuritySignal.title description: The title of the security signal. type: String - contextPath: Datadog.SecuritySignal.message description: The message describing the security signal. type: String - contextPath: Datadog.SecuritySignal.severity description: The severity level of the security signal (low, medium, high, critical). type: String - contextPath: Datadog.SecuritySignal.host description: Host associated with the security signal. type: String - contextPath: Datadog.SecuritySignal.service description: List of services associated with the security signal. type: Unknown - contextPath: Datadog.SecuritySignal.tags description: List of tags associated with the security signal. type: Unknown - contextPath: Datadog.SecuritySignal.triggering_log_id description: ID of the log that triggered the security signal. type: String - contextPath: Datadog.SecuritySignal.rule.id description: The unique identifier of the security rule. type: String - contextPath: Datadog.SecuritySignal.rule.url description: URL to view the security rule in Datadog UI. type: String - contextPath: Datadog.SecuritySignal.triage.state description: The current triage state of the security signal (open, under_review, archived). type: String - contextPath: Datadog.SecuritySignal.triage.archive_comment description: The archive comment of the security signal. type: String - contextPath: Datadog.SecuritySignal.triage.archive_reason description: The archive reason of the security signal. type: String - contextPath: Datadog.SecuritySignal.triage.assignee.handle description: The handle of the user assigned to the security signal. type: String - contextPath: Datadog.SecuritySignal.triage.assignee.name description: The name of the user assigned to the security signal. type: String - contextPath: Datadog.SecuritySignal.url description: URL to view the security signal in Datadog UI. type: String - contextPath: Datadog.SecuritySignal.raw description: The raw signal object returned by the API. type: Unknown - arguments: - description: The unique identifier of the security signal to update. If not provided, will attempt to get it from the current incident. name: signal_id - description: Name or email of the user to assign to the security signal. Leave empty to unassign. At least one of assignee or state must be provided. name: assignee name: datadog-update-signal-assignee description: Update a security signal's assignee in Datadog Cloud SIEM. outputs: - contextPath: Datadog.SecuritySignal.id description: The unique identifier of the security signal. type: String - contextPath: Datadog.SecuritySignal.event_id description: The event ID of the security signal. type: String - contextPath: Datadog.SecuritySignal.timestamp description: The timestamp when the security signal was generated. type: Number - contextPath: Datadog.SecuritySignal.title description: The title of the security signal. type: String - contextPath: Datadog.SecuritySignal.message description: The message describing the security signal. type: String - contextPath: Datadog.SecuritySignal.severity description: The severity level of the security signal (low, medium, high, critical). type: String - contextPath: Datadog.SecuritySignal.host description: Host associated with the security signal. type: String - contextPath: Datadog.SecuritySignal.service description: List of services associated with the security signal. type: Unknown - contextPath: Datadog.SecuritySignal.tags description: List of tags associated with the security signal. type: Unknown - contextPath: Datadog.SecuritySignal.triggering_log_id description: ID of the log that triggered the security signal. type: String - contextPath: Datadog.SecuritySignal.rule.id description: The unique identifier of the security rule. type: String - contextPath: Datadog.SecuritySignal.rule.url description: URL to view the security rule in Datadog UI. type: String - contextPath: Datadog.SecuritySignal.triage.state description: The current triage state of the security signal (open, under_review, archived). type: String - contextPath: Datadog.SecuritySignal.triage.archive_comment description: The archive comment of the security signal. type: String - contextPath: Datadog.SecuritySignal.triage.archive_reason description: The archive reason of the security signal. type: String - contextPath: Datadog.SecuritySignal.triage.assignee.handle description: The handle of the user assigned to the security signal. type: String - contextPath: Datadog.SecuritySignal.triage.assignee.name description: The name of the user assigned to the security signal. type: String - contextPath: Datadog.SecuritySignal.url description: URL to view the security signal in Datadog UI. type: String - contextPath: Datadog.SecuritySignal.raw description: The raw signal object returned by the API. type: Unknown - arguments: - description: The unique identifier of the security rule to retrieve. If not provided, will attempt to get it from the current incident. name: rule_id name: datadog-get-rule description: Get a specific security monitoring rule by ID from Datadog Cloud SIEM . outputs: - contextPath: Datadog.SecurityRule.id description: The unique identifier of the security rule. type: String - contextPath: Datadog.SecurityRule.name description: The name of the security rule. type: String - contextPath: Datadog.SecurityRule.type description: The type of the security rule. type: String - contextPath: Datadog.SecurityRule.isEnabled description: Whether the security rule is enabled. type: Boolean - contextPath: Datadog.SecurityRule.createdAt description: Timestamp when the rule was created. type: Number - contextPath: Datadog.SecurityRule.message description: Message for the security rule. type: String - contextPath: Datadog.SecurityRule.queries description: Queries associated with the security rule. type: Unknown - contextPath: Datadog.SecurityRule.cases description: Cases (severity and notifications) for the rule. type: Unknown - contextPath: Datadog.SecurityRule.options description: Options for the security rule. type: Unknown - contextPath: Datadog.SecurityRule.tags description: Tags associated with the security rule. type: Unknown - contextPath: Datadog.SecurityRule.url description: URL to view the security rule in Datadog UI. type: String - contextPath: Datadog.SecurityRule.raw description: The raw rule object returned by the API. type: Unknown - arguments: - description: The unique identifier of the suppression to update. name: suppression_id required: true - description: Whether the suppression is enabled. name: enabled auto: PREDEFINED predefined: - "true" - "false" - description: Name of the suppression. name: name - description: Description of the suppression. name: description - description: Data exclusion query to filter signals. Uses Datadog search syntax. name: data_exclusion_query name: datadog-update-suppression description: Update an existing suppression rule by ID. Allows updating enabled state, name, description, and data exclusion query. At least one attribute must be provided to update. outputs: - contextPath: Datadog.SecuritySuppression.id description: The unique identifier of the suppression. type: String - contextPath: Datadog.SecuritySuppression.name description: The name of the suppression. type: String - contextPath: Datadog.SecuritySuppression.description description: The description of the suppression. type: String - contextPath: Datadog.SecuritySuppression.enabled description: Whether the suppression is enabled. type: Boolean - contextPath: Datadog.SecuritySuppression.dataExclusionQuery description: Query to match signals to suppress. type: String - contextPath: Datadog.SecuritySuppression.ruleQuery description: Query to target specific security rules. type: String - contextPath: Datadog.SecuritySuppression.creationAt description: Unix timestamp when the suppression was created (in seconds since epoch). type: Number - contextPath: Datadog.SecuritySuppression.updateAt description: Unix timestamp when the suppression was last updated (in seconds since epoch). type: Number - contextPath: Datadog.SecuritySuppression.creator description: The creator of the suppression (name and email). type: String - contextPath: Datadog.SecuritySuppression.updater description: The user who last updated the suppression (name and email). type: String - contextPath: Datadog.SecuritySuppression.url description: URL to view the suppression in Datadog UI. type: String - contextPath: Datadog.SecuritySuppression.raw description: The raw suppression object returned by the API. type: Unknown - arguments: - description: The ID of the security rule to list suppressions for. If not provided, will attempt to get it from the current incident. name: rule_id name: datadog-list-suppressions description: List all suppressions affecting a specific security monitoring rule in Datadog Cloud SIEM . outputs: - contextPath: Datadog.SecuritySuppression.id description: The unique identifier of the suppression. type: String - contextPath: Datadog.SecuritySuppression.name description: The name of the suppression. type: String - contextPath: Datadog.SecuritySuppression.description description: The description of the suppression. type: String - contextPath: Datadog.SecuritySuppression.enabled description: Whether the suppression is enabled. type: Boolean - contextPath: Datadog.SecuritySuppression.creationAt description: Unix timestamp when the suppression was created (in seconds since epoch). type: Number - contextPath: Datadog.SecuritySuppression.updateAt description: Unix timestamp when the suppression was last updated (in seconds since epoch). type: Number - contextPath: Datadog.SecuritySuppression.creator description: The creator of the suppression (name and email). type: String - contextPath: Datadog.SecuritySuppression.updater description: The user who last updated the suppression (name and email). type: String - contextPath: Datadog.SecuritySuppression.dataExclusionQuery description: Query to match signals to suppress. type: String - contextPath: Datadog.SecuritySuppression.ruleQuery description: Query to target specific security rules. type: String - contextPath: Datadog.SecuritySuppression.suppressionQuery description: Additional suppression query filters. type: String - contextPath: Datadog.SecuritySuppression.url description: URL to view the suppression in Datadog UI. type: String - contextPath: Datadog.SecuritySuppression.raw description: The raw suppression object returned by the API. type: Unknown - arguments: - description: The event ID of the security signal to add a comment to. If not provided, will attempt to get it from the current incident. name: event_id - description: The comment text to add to the security signal. name: comment required: true name: datadog-add-signal-comment description: Add a comment to a security signal in Datadog Cloud SIEM . outputs: - contextPath: Datadog.SecurityComment.id description: The unique identifier of the comment. type: String - contextPath: Datadog.SecurityComment.created_at description: The timestamp when the comment was created. type: String - contextPath: Datadog.SecurityComment.user_uuid description: The UUID of the user who created the comment. type: String - contextPath: Datadog.SecurityComment.text description: The comment text content. type: String - contextPath: Datadog.SecurityComment.user.name description: The name of the user who created the comment. type: String - contextPath: Datadog.SecurityComment.user.handle description: The handle of the user who created the comment. type: String - arguments: - description: The event ID of the security signal to list comments for. If not provided, will attempt to get it from the current incident. name: event_id name: datadog-list-signal-comments description: List all comments for a security signal in Datadog Cloud SIEM . outputs: - contextPath: Datadog.SecurityComment.id description: The unique identifier of the comment. type: String - contextPath: Datadog.SecurityComment.created_at description: The timestamp when the comment was created. type: String - contextPath: Datadog.SecurityComment.user_uuid description: The UUID of the user who created the comment. type: String - contextPath: Datadog.SecurityComment.text description: The comment text content. type: String - contextPath: Datadog.SecurityComment.user.name description: The name of the user who created the comment. type: String - contextPath: Datadog.SecurityComment.user.handle description: The handle of the user who created the comment. type: String - arguments: - description: Custom search query string. Uses Datadog search syntax. Required unless running from an incident with a Datadog Security Signal (will use rule's query as fallback). name: query - description: Start date for the search. Format can be relative (e.g., "7 days ago") or absolute (e.g., "2023-01-01T00:00:00Z"). Default is -7days. name: from_date - description: End date for the search. Format can be relative (e.g., "now") or absolute (e.g., "2023-01-01T23:59:59Z"). Default is now. name: to_date - description: Specifies storage type as indexes, online-archives or flex. name: storage_tier auto: PREDEFINED predefined: - indexes - online-archives - flex - description: Sort order for results. Default is desc. name: sort auto: PREDEFINED predefined: - asc - desc - description: Maximum number of results to return. Default is 50. name: limit name: datadog-query-logs description: Query logs in Datadog Cloud SIEM with optional filtering for security investigations. outputs: - contextPath: Datadog.Log.id description: The unique identifier of the log entry. type: String - contextPath: Datadog.Log.timestamp description: The timestamp when the log was generated. type: Number - contextPath: Datadog.Log.message description: The log message content. type: String - contextPath: Datadog.Log.service description: The service that generated the log. type: String - contextPath: Datadog.Log.host description: The host that generated the log. type: String - contextPath: Datadog.Log.source description: The source of the log entry. type: String - contextPath: Datadog.Log.status description: The status/level of the log entry. type: String - contextPath: Datadog.Log.tags description: List of tags associated with the log entry. type: Unknown - contextPath: Datadog.Log.url description: URL to view the log in Datadog UI. type: String - contextPath: Datadog.Log.raw description: The raw log object returned by the API. type: Unknown - name: datadog-list-security-filters description: List all security filters from Datadog Cloud SIEM . Security filters control which logs are indexed and analyzed by the Cloud SIEM platform. outputs: - contextPath: Datadog.SecurityFilter.id description: The unique identifier of the security filter. type: String - contextPath: Datadog.SecurityFilter.name description: The name of the security filter. type: String - contextPath: Datadog.SecurityFilter.filteredDataType description: The type of data being filtered (e.g., logs). type: String - contextPath: Datadog.SecurityFilter.enabled description: Whether the security filter is enabled. type: Boolean - contextPath: Datadog.SecurityFilter.builtin description: Whether the security filter is a built-in filter. type: Boolean - contextPath: Datadog.SecurityFilter.query description: The query used by the security filter. type: String - contextPath: Datadog.SecurityFilter.exclusionFilters description: List of exclusion filters applied. type: Unknown - contextPath: Datadog.SecurityFilter.raw description: The raw filter object returned by the API. type: Unknown - name: datadog-list-signal-notification-rules description: List all signal notification rules from Datadog Cloud SIEM . Signal notification rules define how and when security signals should trigger notifications to specified channels (e.g., email, Slack, PagerDuty). outputs: - contextPath: Datadog.SecurityNotificationRule.id description: The unique identifier of the notification rule. type: String - contextPath: Datadog.SecurityNotificationRule.name description: The name of the notification rule. type: String - contextPath: Datadog.SecurityNotificationRule.enabled description: Whether the notification rule is enabled. type: Boolean - contextPath: Datadog.SecurityNotificationRule.createdAt description: Unix timestamp when the notification rule was created (in seconds since epoch). type: Number - contextPath: Datadog.SecurityNotificationRule.createdBy description: The creator of the notification rule (name and email). type: String - contextPath: Datadog.SecurityNotificationRule.modifiedAt description: Unix timestamp when the notification rule was last modified (in seconds since epoch). type: Number - contextPath: Datadog.SecurityNotificationRule.modifiedBy description: The user who last modified the notification rule (name and email). type: String - contextPath: Datadog.SecurityNotificationRule.targets description: List of notification targets (e.g., email addresses, Slack channels). type: Unknown - contextPath: Datadog.SecurityNotificationRule.selectors.severities description: List of severity levels that trigger this notification rule. type: Unknown - contextPath: Datadog.SecurityNotificationRule.selectors.ruleTypes description: List of rule types that trigger this notification rule. type: Unknown - contextPath: Datadog.SecurityNotificationRule.selectors.query description: Query filter for signals that trigger this notification rule. type: String - contextPath: Datadog.SecurityNotificationRule.selectors.triggerSource description: The source that triggers this notification rule (e.g., security_signals). type: String - contextPath: Datadog.SecurityNotificationRule.timeAggregation description: Time aggregation in seconds for batching notifications. type: Number - contextPath: Datadog.SecurityNotificationRule.version description: The version number of the notification rule. type: Number - contextPath: Datadog.SecurityNotificationRule.raw description: The raw notification rule object returned by the API. type: Unknown - name: datadog-list-vulnerability-notification-rules description: List all vulnerability notification rules from Datadog Cloud SIEM. Vulnerability notification rules define how and when vulnerability findings should trigger notifications to specified channels (e.g., email, Slack, PagerDuty). outputs: - contextPath: Datadog.VulnerabilityNotificationRule.id description: The unique identifier of the notification rule. type: String - contextPath: Datadog.VulnerabilityNotificationRule.name description: The name of the notification rule. type: String - contextPath: Datadog.VulnerabilityNotificationRule.enabled description: Whether the notification rule is enabled. type: Boolean - contextPath: Datadog.VulnerabilityNotificationRule.createdAt description: Unix timestamp when the notification rule was created (in seconds since epoch). type: Number - contextPath: Datadog.VulnerabilityNotificationRule.createdBy description: The creator of the notification rule (name and email). type: String - contextPath: Datadog.VulnerabilityNotificationRule.modifiedAt description: Unix timestamp when the notification rule was last modified (in seconds since epoch). type: Number - contextPath: Datadog.VulnerabilityNotificationRule.modifiedBy description: The user who last modified the notification rule (name and email). type: String - contextPath: Datadog.VulnerabilityNotificationRule.targets description: List of notification targets (e.g., email addresses, Slack channels). type: Unknown - contextPath: Datadog.VulnerabilityNotificationRule.selectors.severities description: List of severity levels that trigger this notification rule. type: Unknown - contextPath: Datadog.VulnerabilityNotificationRule.selectors.ruleTypes description: List of rule types that trigger this notification rule. type: Unknown - contextPath: Datadog.VulnerabilityNotificationRule.selectors.query description: Query filter for vulnerabilities that trigger this notification rule. type: String - contextPath: Datadog.VulnerabilityNotificationRule.selectors.triggerSource description: The source that triggers this notification rule (e.g., vulnerabilities). type: String - contextPath: Datadog.VulnerabilityNotificationRule.timeAggregation description: Time aggregation in seconds for batching notifications. type: Number - contextPath: Datadog.VulnerabilityNotificationRule.version description: The version number of the notification rule. type: Number - contextPath: Datadog.VulnerabilityNotificationRule.raw description: The raw notification rule object returned by the API. type: Unknown - arguments: - description: The unique identifier of the security signal to get investigation for. If not provided, will attempt to get it from the current incident. name: signal_id name: datadog-bitsai-get-investigation description: Get the BitsAI investigation for a security signal from Datadog Cloud SIEM . BitsAI provides AI-powered analysis and investigation steps for security signals. outputs: - contextPath: Datadog.SecurityInvestigation.signal_id description: The unique identifier of the security signal being investigated. type: String - contextPath: Datadog.SecurityInvestigation.verdict description: The overall verdict of the AI investigation (e.g., "benign", "suspicious", "malicious"). type: String - contextPath: Datadog.SecurityInvestigation.steps description: List of investigation steps performed by BitsAI. type: Unknown - contextPath: Datadog.SecurityInvestigation.steps.name description: The name of the investigation step. type: String - contextPath: Datadog.SecurityInvestigation.steps.verdict description: The verdict for this specific investigation step. type: String - contextPath: Datadog.SecurityInvestigation.steps.summary description: A summary of the findings for this investigation step. type: String - arguments: - description: Custom query string for filtering risk scores. Uses Datadog search syntax. name: query - description: Sort order for results. Use "-riskScore" for descending, "riskScore" for ascending. Default is "-riskScore". name: sort auto: PREDEFINED predefined: - riskScore - -riskScore - description: Number of results per page. Default is 50. name: page_size - description: Page number to retrieve. Default is 1. name: page_number name: datadog-list-risk-scores description: List risk scores from Datadog Cloud SIEM . Risk scores provide a quantitative assessment of security risks associated with entities in your environment. outputs: - contextPath: Datadog.SecurityRiskInsights.id description: The unique identifier of the entity. type: String - contextPath: Datadog.SecurityRiskInsights.type description: The type of the entity risk score. type: String - contextPath: Datadog.SecurityRiskInsights.entityName description: The name of the entity. type: String - contextPath: Datadog.SecurityRiskInsights.entityType description: The type of the entity (e.g., "Code Repository", "User", "Host"). type: String - contextPath: Datadog.SecurityRiskInsights.entityProviders description: List of providers for the entity (e.g., "GitHub", "AWS"). type: Unknown - contextPath: Datadog.SecurityRiskInsights.entityRoles description: List of roles assigned to the entity. type: Unknown - contextPath: Datadog.SecurityRiskInsights.riskScore description: The calculated risk score for the entity. type: Number - contextPath: Datadog.SecurityRiskInsights.riskScoreEvolution description: The change in risk score over time. type: Number - contextPath: Datadog.SecurityRiskInsights.severity description: The severity level of the risk (e.g., "critical", "high", "medium", "low"). type: String - contextPath: Datadog.SecurityRiskInsights.signalsDetected description: The number of security signals detected for this entity. type: Number - contextPath: Datadog.SecurityRiskInsights.firstDetected description: Unix timestamp when the entity was first detected (in seconds since epoch). type: Number - contextPath: Datadog.SecurityRiskInsights.lastDetected description: Unix timestamp when the entity was last detected (in seconds since epoch). type: Number - contextPath: Datadog.SecurityRiskInsights.configRisks.hasMisconfiguration description: Whether the entity has a misconfiguration. type: Boolean - contextPath: Datadog.SecurityRiskInsights.configRisks.hasIdentityRisk description: Whether the entity has identity-related risks. type: Boolean - contextPath: Datadog.SecurityRiskInsights.configRisks.isPubliclyAccessible description: Whether the entity is publicly accessible. type: Boolean - contextPath: Datadog.SecurityRiskInsights.configRisks.isProduction description: Whether the entity is in a production environment. type: Boolean - contextPath: Datadog.SecurityRiskInsights.configRisks.hasPrivilegedRole description: Whether the entity has a privileged role. type: Boolean - contextPath: Datadog.SecurityRiskInsights.configRisks.isPrivileged description: Whether the entity is privileged. type: Boolean - contextPath: Datadog.SecurityRiskInsights.entityMetadata.sources description: List of sources associated with the entity. type: Unknown - contextPath: Datadog.SecurityRiskInsights.entityMetadata.environments description: List of environments associated with the entity. type: Unknown - contextPath: Datadog.SecurityRiskInsights.entityMetadata.services description: List of services associated with the entity. type: Unknown - contextPath: Datadog.SecurityRiskInsights.entityMetadata.mitreTactics description: List of MITRE ATT&CK tactics associated with the entity. type: Unknown - contextPath: Datadog.SecurityRiskInsights.entityMetadata.mitreTechniques description: List of MITRE ATT&CK techniques associated with the entity. type: Unknown - contextPath: Datadog.SecurityRiskInsights.raw description: The raw risk insight object returned by the API. type: Unknown - arguments: - description: The signal ID to retrieve remote data for. name: id required: true name: get-remote-data description: Get remote data from Datadog Cloud SIEM for mirroring. This command is used for debugging the mirroring integration. - arguments: - description: Last update timestamp (ISO format). name: lastUpdate required: true name: get-modified-remote-data description: Get the list of signal IDs that were modified since lastUpdate. This command is used for debugging the mirroring integration. - name: get-mapping-fields description: Get the mapping fields for Datadog Cloud SIEM security signals. This command is used for debugging the mirroring integration and returns the schema of available fields. dockerimage: demisto/datadog-api-client:1.0.0.10133006 isfetch: true ismappable: true isremotesyncin: true isremotesyncout: false runonce: false script: "-" subtype: python3 type: python defaultclassifier: Datadog Cloud SIEM V2 defaultmapperin: Datadog Cloud SIEM V2 - Incoming Mapper tests: - DatadogCloudSIEMV2 fromversion: 6.8.0