Test an existing rule

{
  "rule": {
    "calculatedFields": [
      {
        "expression": "@request_end_timestamp - @request_start_timestamp",
        "name": "response_time"
      }
    ],
    "cases": [],
    "groupSignalsBy": [
      "service"
    ],
    "hasExtendedTitle": true,
    "isEnabled": true,
    "name": "My security monitoring rule.",
    "options": {
      "anomalyDetectionOptions": {
        "bucketDuration": 300,
        "detectionTolerance": 5
      },
      "complianceRuleOptions": {
        "regoRule": {
          "policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n  # Logic that evaluates to true if the resource should be skipped\n  true\n} else = \"pass\" {\n  # Logic that evaluates to true if the resource is compliant\n  true\n} else = \"fail\" {\n  # Logic that evaluates to true if the resource is not compliant\n  true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n  some resource in input.resources[input.main_resource_type]\n  result := dd_output.format(resource, eval(resource))\n}",
          "resourceTypes": [
            "gcp_iam_service_account",
            "gcp_iam_policy"
          ]
        },
        "resourceType": "aws_acm"
      },
      "impossibleTravelOptions": {
        "baselineUserLocations": true
      },
      "thirdPartyRuleOptions": {
        "defaultStatus": "critical",
        "rootQueries": [
          {
            "query": "source:cloudtrail"
          }
        ]
      }
    },
    "queries": [],
    "schedulingOptions": {
      "rrule": "FREQ=HOURLY;INTERVAL=1;",
      "start": "2025-07-14T12:00:00",
      "timezone": "America/New_York"
    },
    "tags": [
      "env:prod",
      "team:security"
    ],
    "thirdPartyCases": []
  },
  "ruleQueryPayloads": [
    {
      "expectedResult": true,
      "payload": {
        "ddsource": "nginx",
        "ddtags": "env:staging,version:5.1",
        "hostname": "i-012345678",
        "message": "2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World",
        "service": "payment"
      }
    }
  ]
}