Security Monitoring

List indicators of compromise

Get a list of indicators of compromise (IoCs) matching the specified filters.

get/api/v2/security/siem/ioc-explorer

Request

Base URL
https://api.datadoghq.com
URL
https://api.datadoghq.com/api/v2/security/siem/ioc-explorer
Auth
- API key in header DD-API-KEY and API key in header DD-APPLICATION-KEY
- or OAuth 2
  Authorization code: /oauth2/v1/authorize
  Token URL: /oauth2/v1/token scopes: security_monitoring_signals_read

limitinteger

Number of results per page.

offsetinteger

Pagination offset.

querystring

Search/filter query (supports field:value syntax).

sort[column]string

Sort column: score, first_seen_ts_epoch, last_seen_ts_epoch, indicator, indicator_type, signal_count, log_count, category, as_type.

sort[order]string

Sort order: asc or desc.

ocsfboolean

When true, return only OCSF field-based matches. When false, return regex/message-based matches.

worked_bystring

Filter indicators whose triage state was updated by a specific user identified by their handle.

triage_state'not_reviewed' | 'reviewed'

Current triage state of the indicator.

Example:not_reviewed

Filter by triage state.

{
  "data": {
    "attributes": {
      "data": [
        {
          "triage_state": "not_reviewed"
        }
      ]
    }
  }
}

No recorded changes to this operation across all 1 revision of this API.