DAdatadog
Security Monitoring

Override the severity of security findings

Set or clear the manual severity override of security findings.

You can update up to 100 security findings per request. Use the set action with a value to apply a manual severity override. value is required for set and must be omitted for clear. The info value sets the lowest severity the finding type allows. Use the clear action to remove a manual severity override. clear does not remove a severity set by an automation rule. The optional description is accepted with both actions and has a limit of 280 characters.

Auto-closed findings are excluded. Findings whose severity was set by an automation rule are skipped and listed in the response meta.warnings. If every finding is skipped this way, the request fails with a 400 error. Findings that cannot be found are skipped without a warning. The request fails with a 404 error only if none of the findings can be found.

patch/api/v2/security/findings/severity

Request

Request body

Example request

{
  "data": {
    "attributes": {
      "severity": {
        "action": "set",
        "description": "Database contains sensitive data.",
        "value": "high"
      }
    },
    "id": "00000000-0000-0000-0000-000000000001",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
            "type": "findings"
          }
        ]
      }
    },
    "type": "severity_override"
  }
}

Response

Accepted

Example response

{
  "data": {
    "id": "00000000-0000-0000-0000-000000000001",
    "type": "severity_override"
  },
  "meta": {
    "warnings": [
      {
        "detail": "cannot set severity on finding because it is overridden by an automation severity modifier rule; disable or update the automation rule first",
        "finding_id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
        "status": 400,
        "title": "Bad Request"
      }
    ]
  }
}

Changes

Changes to this operation have not been checked yet.