DAdatadog
Security Monitoring

Create or update an indicator triage state

Set the triage state of an indicator of compromise (IoC). This creates or updates the triage state for the indicator in your organization.

post/api/v2/security/siem/ioc-explorer/triage

Request

  • Base URL
    https://api.datadoghq.com
  • URL
    https://api.datadoghq.com/api/v2/security/siem/ioc-explorer/triage
  • Auth
    • API key in header DD-API-KEY and API key in header DD-APPLICATION-KEY
    • or OAuth 2
      Authorization code: /oauth2/v1/authorize
      Token URL: /oauth2/v1/token scopes: security_monitoring_signals_write

Request body

Example request

{
  "data": {
    "attributes": {
      "indicator": "192.0.2.1",
      "triage_state": "not_reviewed"
    },
    "type": "ioc_triage_state"
  }
}

Response

Created

Example response

{
  "data": {
    "attributes": {
      "triage_state": "not_reviewed"
    }
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.