DAdatadog
Security Monitoring

Create a dataset

Create a new Cloud SIEM dataset. A dataset bundles a data source, a set of indexes, and a search query that can be referenced from detection rules.

post/api/v2/security_monitoring/datasets

Request

  • Base URL
    https://api.datadoghq.com
  • URL
    https://api.datadoghq.com/api/v2/security_monitoring/datasets
  • Auth
    • API key in header DD-API-KEY and API key in header DD-APPLICATION-KEY
    • or OAuth 2
      Authorization code: /oauth2/v1/authorize
      Token URL: /oauth2/v1/token scopes: security_monitoring_rules_write

Request body

Example request

{
  "data": {
    "attributes": {
      "definition": {
        "columns": [
          {
            "column": "message",
            "type": "string"
          }
        ],
        "data_source": "logs",
        "name": "sample_dataset",
        "query_filter": "status = 'active'",
        "search": {
          "query": "*"
        },
        "storage": "hot",
        "table_name": "my_reference_table",
        "time_window": {
          "from": 1700000000000,
          "to": 1700003600000
        }
      },
      "description": "A sample dataset used for detection rules.",
      "version": 1
    },
    "type": "datasetCreate"
  }
}

Response

Created

Example response

{
  "data": {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "type": "dataset"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.