Security Monitoring

Import security vulnerabilities

Import security vulnerabilities from an external scanner in CycloneDX 1.5 format.

The payload is validated against the CycloneDX 1.5 JSON schema and the following additional constraints:

metadata, metadata.component, and metadata.component.name are required.
metadata.tools.components must contain exactly one element with a name field.
components cannot be empty. Each component requires bom-ref, type, name, and version.
When type is library, purl is required and must be a valid PURL.
When type is operating-system, name must be one of the supported OS values: alma, alpine, amazon, azurelinux, bottlerocket, cbl-mariner, chainguard, centos, debian, fedora, opensuse, opensuse-leap, opensuse-tumbleweed, oracle, photon, redhat, rocky, slem, sles, ubuntu, wolfi, windows, macos.
vulnerabilities cannot be empty. Each vulnerability requires id, exactly one ratings entry, and at least one affects entry.
Each affects[].ref must match a bom-ref value in components.

post/api/v2/security/vulnerabilities

Request

Base URL
https://api.datadoghq.com
URL
https://api.datadoghq.com/api/v2/security/vulnerabilities
Auth
- API key in header DD-API-KEY and API key in header DD-APPLICATION-KEY
- or OAuth 2
  Authorization code: /oauth2/v1/authorize
  Token URL: /oauth2/v1/token scopes: security_monitoring_findings_write

Request body

bomFormatstring required

The BOM format identifier. Must be CycloneDX.

specVersionstring required

The CycloneDX specification version. Must be 1.5.

versioninteger

The version number of the BOM document.

Example request

{
  "bomFormat": "CycloneDX",
  "components": [
    {
      "bom-ref": "a3390fca-c315-41ae-ae05-af5e7859cdee",
      "name": "lodash",
      "purl": "pkg:npm/lodash@4.17.21",
      "type": "library",
      "version": "4.17.21"
    }
  ],
  "metadata": {
    "component": {
      "bom-ref": "host-ref-abc123",
      "name": "i-12345",
      "type": "operating-system"
    },
    "tools": {
      "components": [
        {
          "name": "my-scanner",
          "type": "application"
        }
      ]
    }
  },
  "specVersion": "1.5",
  "version": 1,
  "vulnerabilities": [
    {
      "advisories": [
        {
          "url": "https://example.com/advisory/CVE-2021-1234"
        }
      ],
      "affects": [
        {
          "ref": "a3390fca-c315-41ae-ae05-af5e7859cdee"
        }
      ],
      "analysis": {
        "state": "resolved"
      },
      "cwes": [
        123,
        345
      ],
      "description": "Sample vulnerability detected in the application.",
      "detail": "Details about the vulnerability.",
      "id": "CVE-2021-1234",
      "ratings": [
        {
          "score": 9,
          "severity": "high",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"
        }
      ],
      "references": [
        {
          "id": "GHSA-35m5-8cvj-8783",
          "source": {
            "url": "https://example.com"
          }
        }
      ]
    }
  ]
}

Response

Vulnerabilities accepted successfully.

Changes

No recorded changes to this operation across all 1 revision of this API.