DAdatadog
Security Monitoring

Get an indicator of compromise

Get detailed information about a specific indicator of compromise (IoC).

get/api/v2/security/siem/ioc-explorer/indicator

Request

  • Base URL
    https://api.datadoghq.com
  • URL
    https://api.datadoghq.com/api/v2/security/siem/ioc-explorer/indicator
  • Auth
    • API key in header DD-API-KEY and API key in header DD-APPLICATION-KEY
    • or OAuth 2
      Authorization code: /oauth2/v1/authorize
      Token URL: /oauth2/v1/token scopes: security_monitoring_signals_read

Query parameters

indicatorstring required

The indicator value to look up (for example, an IP address or domain).

ocsfboolean

When true, return only OCSF field-based matches. When false, return regex/message-based matches.

include_triage_historyboolean

Include full triage history for the indicator.

triage_history_limitinteger

Maximum number of triage history events returned. Only applied when include_triage_history is true.

triage_history_offsetinteger

Pagination offset into the triage history. Only applied when include_triage_history is true.

Response

OK

Example response

{
  "data": {
    "attributes": {
      "data": {
        "triage_history": [
          {
            "triage_state": "not_reviewed"
          }
        ],
        "triage_state": "not_reviewed"
      }
    }
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.