DAdatadog
Security Monitoring

Get a rule proposal

Get the status of a rule proposal started with the start-a-rule-proposal endpoint. While the status is pending or in_progress, the proposed rule is still being generated. Poll this endpoint again later. If the status is completed, the response's rule field contains the proposed Cloud SIEM detection rule. If the status is failed, the response's error field contains the reason a rule could not be generated.

This endpoint does not create or modify any detection rules in Cloud SIEM. To create the proposed rule, use the create-a-detection-rule endpoint.

get/api/v2/security_monitoring/rules/proposals/{proposal_id}

Request

Path parameters

proposal_idstring uuid required
Example:c968cf83-56c2-4d54-a993-6c86dfb83527

The ID of the rule proposal, returned by the start a rule proposal endpoint.

Response

OK

Example response

{
  "data": {
    "attributes": {
      "error": {
        "kind": "translation_error",
        "message": "No log source matches the described activity.",
        "type": "NoRuleProduced"
      },
      "status": "completed"
    },
    "id": "c968cf83-56c2-4d54-a993-6c86dfb83527",
    "type": "rule_proposals"
  }
}

Changes

Changes to this operation have not been checked yet.