DAdatadog
Security Monitoring

Publish a batch migration

Create a Cloud SIEM detection rule from the output of each selected completed resource of a batch migration. Completed resources can be published while the rest of the batch migration is still being translated. When resourceIds is omitted or empty, every completed resource is published. Published rules are created disabled.

Every requested resource must be publishable: completed, or left in publishing for more than one minute after an uncertain result. Otherwise, the request returns 409 Conflict and nothing is published. Already published resources are not publishable.

The response reports the outcome of each resource, and some resources can be published while others fail. A failed result that contains a ruleId means the rule was created: do not retry that resource. Publishing a rule with a block_ip or block_user action requires the appsec_protect_write permission.

post/api/v2/security_monitoring/batch-migrations/{batch_id}/publish

Request

Path parameters

batch_idstring uuid required
Example:7cdb3a75-64fb-46ce-9445-41969e78fe8e

The UUID of the batch migration.

Request body

Example request

{
  "data": {
    "attributes": {
      "resourceIds": [
        "c968cf83-56c2-4d54-a993-6c86dfb83527"
      ]
    },
    "type": "batchMigrationPublish"
  }
}

Response

OK

Example response

{
  "data": [
    {
      "attributes": {
        "error": "failed to create rule",
        "ruleId": "abc-def-ghi",
        "status": "published"
      },
      "id": "c968cf83-56c2-4d54-a993-6c86dfb83527",
      "type": "batchMigrationPublishedResource"
    }
  ]
}

Changes

Changes to this operation have not been checked yet.