DAdatadog
Security Monitoring

Create a batch migration

Create a batch migration in the draft status, together with 1 to 100 initial resources. Each resource holds one source rule to translate into a Cloud SIEM detection rule. To load more rules, add them with the add resources endpoint before starting the batch migration. A batch migration can hold up to 1000 resources. The response does not include the created resources: list the resources of the batch migration to retrieve them. Alternatively, use the start-a-rule-proposal endpoint to get a single proposed rule.

post/api/v2/security_monitoring/batch-migrations

Request

Request body

Example request

{
  "data": {
    "attributes": {
      "description": "Rules imported from Splunk",
      "name": "Splunk migration",
      "resources": [
        {
          "description": "Detects repeated failed Windows authentication attempts.",
          "input": "index=wineventlog EventCode=4625",
          "inputType": "spl",
          "name": "Repeated Windows login failures"
        }
      ],
      "tags": [
        "source:splunk"
      ]
    },
    "type": "batchMigration"
  }
}

Response

Created

Example response

{
  "data": {
    "attributes": {
      "createdAt": "2026-09-21T12:00:00Z",
      "createdBy": "3653d3c6-0c75-11ea-ad28-fb5701eabc7d",
      "description": "Rules imported from Splunk",
      "inputSource": "batch_migration",
      "lastUpdatedAt": "2026-09-21T12:00:00Z",
      "lastUpdatedBy": "3653d3c6-0c75-11ea-ad28-fb5701eabc7d",
      "name": "Splunk migration",
      "orgId": 123456,
      "resourceStatusCounts": {
        "pending": 1
      },
      "status": "draft",
      "tags": [
        "source:splunk"
      ]
    },
    "id": "7cdb3a75-64fb-46ce-9445-41969e78fe8e",
    "type": "batchMigration"
  }
}

Changes

Changes to this operation have not been checked yet.