DAdatadog
Compliance

Get the rule-based view of compliance findings

This endpoint is deprecated. Use the Security Monitoring - Search Security Findings endpoint instead.

Get an aggregated view of compliance rules with their pass, fail, and muted finding counts. Supports filtering by compliance framework, framework version, and additional query filters.

get/api/v2/compliance_findings/rule_based_view

Request

  • Base URL
    https://api.datadoghq.com
  • URL
    https://api.datadoghq.com/api/v2/compliance_findings/rule_based_view
  • Auth
    • API key in header DD-API-KEY and API key in header DD-APPLICATION-KEY
    • or OAuth 2
      Authorization code: /oauth2/v1/authorize
      Token URL: /oauth2/v1/token scopes: security_monitoring_findings_read

Query parameters

tointeger required
Example:1739982278000

Timestamp of the query end, in milliseconds since the Unix epoch.

frameworkstring
Example:hipaa

Compliance framework handle to filter rules and findings by.

versionstring
Example:1

Version of the compliance framework to filter rules and findings by.

query_findings_without_framework_versionboolean

When true, returns findings without a framework_version tag. Used for findings from custom frameworks or those created before framework versioning was introduced.

include_rules_without_findingsboolean

When true, includes rules in the response that have no associated findings.

is_customboolean

Set to true when the requested framework is a custom framework.

querystring
Example:scored:true

Additional event-platform filters applied to the underlying findings query. For example, scored:true project_id:datadog-prod-us5.

Response

OK

Example response

{
  "data": {
    "attributes": {
      "count": 1,
      "rules": [
        {
          "compliance_frameworks": [
            {
              "control": "164.308-a-4-i",
              "framework": "hipaa",
              "is_default": true,
              "requirement": "Information-Access-Management",
              "version": "1"
            }
          ],
          "enabled": true,
          "id": "qjx-udx-xo8",
          "name": "IAM roles should not allow untrusted GitHub Actions to assume them",
          "resourceAttributes": [
            "instance_id"
          ],
          "resourceCategory": "identity",
          "resourceType": "aws_iam_role",
          "stats": {
            "pass": 3
          },
          "status": "critical",
          "tags": [
            "security:compliance"
          ],
          "type": "cloud_configuration"
        }
      ]
    },
    "id": "JSONAPI_USELESS_ID",
    "type": "rule_based_view"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.