DAdatadog
Security Monitoring

Start a rule proposal

Start generating a proposed Cloud SIEM detection rule from a natural-language description, or from an SPL or KQL rule. The proposal is based on your organization's log sources, log fields, and existing detection rules. When logs from the matching source are available, the proposed query is tested against your recent logs.

The proposed rule is generated asynchronously. This endpoint returns a proposal id with the status pending. To get the proposed rule, pass this id to the get-a-rule-proposal endpoint and poll the endpoint until the status is completed or failed. A proposal usually takes a few minutes, and up to 10 minutes.

This endpoint does not create or modify any detection rules in Cloud SIEM. To translate many rules at once, use batch migrations instead.

post/api/v2/security_monitoring/rules/proposals

Request

Request body

Example request

{
  "data": {
    "attributes": {
      "input": "Detect repeated failed Okta logins followed by a successful login from the same IP.",
      "inputType": "natural_language"
    },
    "type": "rule_proposals"
  }
}

Response

Accepted

Example response

{
  "data": {
    "attributes": {
      "status": "pending"
    },
    "id": "c968cf83-56c2-4d54-a993-6c86dfb83527",
    "type": "rule_proposals"
  }
}

Changes

Changes to this operation have not been checked yet.