diff --git a/hugo/content/en/agent/fleet_automation/_index.md b/hugo/content/en/agent/fleet_automation/_index.md index e2ff0d3b4f2..a100638c181 100644 --- a/hugo/content/en/agent/fleet_automation/_index.md +++ b/hugo/content/en/agent/fleet_automation/_index.md @@ -37,6 +37,7 @@ Datadog Fleet Automation allows you to centrally govern and remotely manage Data With Fleet Automation, you can: - **[View Agent and OTel Collector configurations][3]** along with historical changes to confirm deployment updates and verify configuration consistency. - **[Configure Datadog Agents][4]** to centralize setup and gain visibility into your environments faster. +- **[Manage Datadog Agent tags][4]** _(Preview)_ to correct and standardize tagging across your fleet. - **[Keep your fleet up to date][5]** by identifying and upgrading outdated Agent and OTel Collector versions. - **[Send a support flare remotely][6]**, reducing the time it takes to debug issues on an Agent or DDOT Collector. - **[View your fleet by Kubernetes cluster][7]** to inspect and configure Agents grouped by cluster instead of as individual hosts. diff --git a/hugo/content/en/agent/fleet_automation/configure_agents.md b/hugo/content/en/agent/fleet_automation/configure_agents.md index e8748ca2193..0a7217c0dc0 100644 --- a/hugo/content/en/agent/fleet_automation/configure_agents.md +++ b/hugo/content/en/agent/fleet_automation/configure_agents.md @@ -23,6 +23,10 @@ Use [Fleet Automation][3] to roll out and manage Datadog Agent configuration at Remote configuration of Agents in containerized workloads is in Preview. If you're interested in this feature, complete the form to request access. {{< /callout >}} +{{< callout url="https://www.datadoghq.com/product-preview/modify-tags-fleet-automation/" header="Join the Preview!" >}} +Managing Datadog Agent tags with Fleet Automation is in Preview. If you're interested in this feature, complete the form to request access. +{{< /callout >}} + ## Configure multiple Agents 1. In Fleet Automation, open the [Configuration][1] tab and click {{< ui >}}Configure Agents{{< /ui >}}. diff --git a/hugo/content/en/api/v2/csm-ownership/examples.json b/hugo/content/en/api/v2/csm-ownership/examples.json index b48a3486ede..ea7957a24c9 100644 --- a/hugo/content/en/api/v2/csm-ownership/examples.json +++ b/hugo/content/en/api/v2/csm-ownership/examples.json @@ -666,8 +666,6 @@ "data": { "attributes": { "action": "confirm", - "actor_handle": "user@example.com", - "actor_type": "user", "inference_checksum": "abc123" }, "type": "ownership_feedback" @@ -677,8 +675,6 @@ "data": { "attributes": { "action": "confirm", - "actor_handle": "user@example.com", - "actor_type": "user", "corrected_owner_handle": "team-b", "corrected_owner_type": "team", "inference_checksum": "abc123", @@ -687,7 +683,7 @@ "type": "ownership_feedback" } }, - "html": "
data [required]
\nobject
The data wrapper for an ownership feedback request.
attributes [required]
\nobject
The attributes of an ownership feedback request.
action [required]
\nenum
The feedback action to apply to an inference. \nAllowed enum values: confirm,reject,correct,persist
actor_handle [required]
\nstring
The handle of the actor submitting the feedback.
actor_type [required]
\nstring
The type of actor submitting the feedback, for example user or service.
corrected_owner_handle
\nstring
The corrected owner handle. Required when action is correct.
corrected_owner_type
\nstring
The corrected owner type. Required when action is correct.
inference_checksum [required]
\nstring
The checksum of the inference being acted upon. Must match the current inference checksum or the request returns a conflict.
reason
\nstring
An optional free-form reason explaining the feedback.
type [required]
\nenum
The type of the ownership feedback request resource. The value should always be ownership_feedback. \nAllowed enum values: ownership_feedback
default: ownership_feedback
data [required]
\nobject
The data wrapper for an ownership feedback request.
attributes [required]
\nobject
The attributes of an ownership feedback request.
action [required]
\nenum
The feedback action to apply to an inference. \nAllowed enum values: confirm,reject,correct,persist
corrected_owner_handle
\nstring
The corrected owner handle. Required when action is correct.
corrected_owner_type
\nstring
The corrected owner type. Required when action is correct.
inference_checksum [required]
\nstring
The checksum of the inference being acted upon. Must match the current inference checksum or the request returns a conflict.
reason
\nstring
An optional free-form reason explaining the feedback.
type [required]
\nenum
The type of the ownership feedback request resource. The value should always be ownership_feedback. \nAllowed enum values: ownership_feedback
default: ownership_feedback
data
\n[object]
A list of Agent rules objects
attributes
\nobject
A Cloud Workload Security Agent rule returned by the API
actions
\n[object]
The array of actions the rule can perform if triggered
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agentConstraint
\nstring
The version of the Agent
blocking
\n[string]
The blocking policies that the rule belongs to
category
\nstring
The category of the Agent rule
creationAuthorUuId
\nstring
The ID of the user who created the rule
creationDate
\nint64
When the Agent rule was created, timestamp in milliseconds
creator
\nobject
The attributes of the user who created the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
defaultRule
\nboolean
Whether the rule is included by default
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
expression
\nstring
The SECL expression of the Agent rule
filters
\n[string]
The platforms the Agent rule is supported on
monitoring
\n[string]
The monitoring policies that the rule belongs to
name
\nstring
The name of the Agent rule
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
updateAuthorUuId
\nstring
The ID of the user who updated the rule
updateDate
\nint64
Timestamp in milliseconds when the Agent rule was last updated
updatedAt
\nint64
When the Agent rule was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
version
\nint64
The version of the Agent rule
id
\nstring
The ID of the Agent rule
type
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data
\n[object]
A list of Agent rules objects
attributes
\nobject
A Cloud Workload Security Agent rule returned by the API
actions
\n[object]
The array of actions the rule can perform if triggered
disabled
\nboolean
Whether the action is disabled
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agentConstraint
\nstring
The version of the Agent
agent_version
\nstring
The version constraint of the Datadog Agent the rule applies to
blocking
\n[string]
The blocking policies that the rule belongs to
category
\nstring
The category of the Agent rule
creationAuthorUuId
\nstring
The ID of the user who created the rule
creationDate
\nint64
When the Agent rule was created, timestamp in milliseconds
creator
\nobject
The attributes of the user who created the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
defaultRule
\nboolean
Whether the rule is included by default
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
every
\nint64
The rate limiting duration of the Agent rule, in nanoseconds
expression
\nstring
The SECL expression of the Agent rule
filters
\n[string]
The platforms the Agent rule is supported on
group_id
\nstring
The group of rules the Agent rule belongs to
monitoring
\n[string]
The monitoring policies that the rule belongs to
name
\nstring
The name of the Agent rule
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
updateAuthorUuId
\nstring
The ID of the user who updated the rule
updateDate
\nint64
Timestamp in milliseconds when the Agent rule was last updated
updatedAt
\nint64
When the Agent rule was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
version
\nint64
The version of the Agent rule
id
\nstring
The ID of the Agent rule
type
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data
\nobject
Object for a single Agent rule
attributes
\nobject
A Cloud Workload Security Agent rule returned by the API
actions
\n[object]
The array of actions the rule can perform if triggered
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agentConstraint
\nstring
The version of the Agent
blocking
\n[string]
The blocking policies that the rule belongs to
category
\nstring
The category of the Agent rule
creationAuthorUuId
\nstring
The ID of the user who created the rule
creationDate
\nint64
When the Agent rule was created, timestamp in milliseconds
creator
\nobject
The attributes of the user who created the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
defaultRule
\nboolean
Whether the rule is included by default
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
expression
\nstring
The SECL expression of the Agent rule
filters
\n[string]
The platforms the Agent rule is supported on
monitoring
\n[string]
The monitoring policies that the rule belongs to
name
\nstring
The name of the Agent rule
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
updateAuthorUuId
\nstring
The ID of the user who updated the rule
updateDate
\nint64
Timestamp in milliseconds when the Agent rule was last updated
updatedAt
\nint64
When the Agent rule was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
version
\nint64
The version of the Agent rule
id
\nstring
The ID of the Agent rule
type
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data
\nobject
Object for a single Agent rule
attributes
\nobject
A Cloud Workload Security Agent rule returned by the API
actions
\n[object]
The array of actions the rule can perform if triggered
disabled
\nboolean
Whether the action is disabled
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agentConstraint
\nstring
The version of the Agent
agent_version
\nstring
The version constraint of the Datadog Agent the rule applies to
blocking
\n[string]
The blocking policies that the rule belongs to
category
\nstring
The category of the Agent rule
creationAuthorUuId
\nstring
The ID of the user who created the rule
creationDate
\nint64
When the Agent rule was created, timestamp in milliseconds
creator
\nobject
The attributes of the user who created the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
defaultRule
\nboolean
Whether the rule is included by default
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
every
\nint64
The rate limiting duration of the Agent rule, in nanoseconds
expression
\nstring
The SECL expression of the Agent rule
filters
\n[string]
The platforms the Agent rule is supported on
group_id
\nstring
The group of rules the Agent rule belongs to
monitoring
\n[string]
The monitoring policies that the rule belongs to
name
\nstring
The name of the Agent rule
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
updateAuthorUuId
\nstring
The ID of the user who updated the rule
updateDate
\nint64
Timestamp in milliseconds when the Agent rule was last updated
updatedAt
\nint64
When the Agent rule was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
version
\nint64
The version of the Agent rule
id
\nstring
The ID of the Agent rule
type
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data [required]
\nobject
Object for a single Agent rule
attributes [required]
\nobject
Create a new Cloud Workload Security Agent rule.
actions
\n[object]
The array of actions the rule can perform if triggered
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agent_version
\nstring
Constrain the rule to specific versions of the Datadog Agent.
blocking
\n[string]
The blocking policies that the rule belongs to.
description
\nstring
The description of the Agent rule.
disabled
\n[string]
The disabled policies that the rule belongs to.
enabled
\nboolean
Whether the Agent rule is enabled.
expression [required]
\nstring
The SECL expression of the Agent rule.
filters
\n[string]
The platforms the Agent rule is supported on.
monitoring
\n[string]
The monitoring policies that the rule belongs to.
name [required]
\nstring
The name of the Agent rule.
policy_id
\nstring
The ID of the policy where the Agent rule is saved.
product_tags
\n[string]
The list of product tags associated with the rule.
silent
\nboolean
Whether the rule is silent.
type [required]
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data [required]
\nobject
Object for a single Agent rule
attributes [required]
\nobject
Create a new Cloud Workload Security Agent rule.
actions
\n[object]
The array of actions the rule can perform if triggered
disabled
\nboolean
Whether the action is disabled
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agent_version
\nstring
Constrain the rule to specific versions of the Datadog Agent.
blocking
\n[string]
The blocking policies that the rule belongs to.
description
\nstring
The description of the Agent rule.
disabled
\n[string]
The disabled policies that the rule belongs to.
enabled
\nboolean
Whether the Agent rule is enabled.
expression [required]
\nstring
The SECL expression of the Agent rule.
filters
\n[string]
The platforms the Agent rule is supported on.
monitoring
\n[string]
The monitoring policies that the rule belongs to.
name [required]
\nstring
The name of the Agent rule.
policy_id
\nstring
The ID of the policy where the Agent rule is saved.
product_tags
\n[string]
The list of product tags associated with the rule.
silent
\nboolean
Whether the rule is silent.
type [required]
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data
\nobject
Object for a single Agent rule
attributes
\nobject
A Cloud Workload Security Agent rule returned by the API
actions
\n[object]
The array of actions the rule can perform if triggered
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agentConstraint
\nstring
The version of the Agent
blocking
\n[string]
The blocking policies that the rule belongs to
category
\nstring
The category of the Agent rule
creationAuthorUuId
\nstring
The ID of the user who created the rule
creationDate
\nint64
When the Agent rule was created, timestamp in milliseconds
creator
\nobject
The attributes of the user who created the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
defaultRule
\nboolean
Whether the rule is included by default
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
expression
\nstring
The SECL expression of the Agent rule
filters
\n[string]
The platforms the Agent rule is supported on
monitoring
\n[string]
The monitoring policies that the rule belongs to
name
\nstring
The name of the Agent rule
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
updateAuthorUuId
\nstring
The ID of the user who updated the rule
updateDate
\nint64
Timestamp in milliseconds when the Agent rule was last updated
updatedAt
\nint64
When the Agent rule was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
version
\nint64
The version of the Agent rule
id
\nstring
The ID of the Agent rule
type
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data
\nobject
Object for a single Agent rule
attributes
\nobject
A Cloud Workload Security Agent rule returned by the API
actions
\n[object]
The array of actions the rule can perform if triggered
disabled
\nboolean
Whether the action is disabled
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agentConstraint
\nstring
The version of the Agent
agent_version
\nstring
The version constraint of the Datadog Agent the rule applies to
blocking
\n[string]
The blocking policies that the rule belongs to
category
\nstring
The category of the Agent rule
creationAuthorUuId
\nstring
The ID of the user who created the rule
creationDate
\nint64
When the Agent rule was created, timestamp in milliseconds
creator
\nobject
The attributes of the user who created the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
defaultRule
\nboolean
Whether the rule is included by default
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
every
\nint64
The rate limiting duration of the Agent rule, in nanoseconds
expression
\nstring
The SECL expression of the Agent rule
filters
\n[string]
The platforms the Agent rule is supported on
group_id
\nstring
The group of rules the Agent rule belongs to
monitoring
\n[string]
The monitoring policies that the rule belongs to
name
\nstring
The name of the Agent rule
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
updateAuthorUuId
\nstring
The ID of the user who updated the rule
updateDate
\nint64
Timestamp in milliseconds when the Agent rule was last updated
updatedAt
\nint64
When the Agent rule was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
version
\nint64
The version of the Agent rule
id
\nstring
The ID of the Agent rule
type
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data
\nobject
Object for a single Agent rule
attributes
\nobject
A Cloud Workload Security Agent rule returned by the API
actions
\n[object]
The array of actions the rule can perform if triggered
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agentConstraint
\nstring
The version of the Agent
blocking
\n[string]
The blocking policies that the rule belongs to
category
\nstring
The category of the Agent rule
creationAuthorUuId
\nstring
The ID of the user who created the rule
creationDate
\nint64
When the Agent rule was created, timestamp in milliseconds
creator
\nobject
The attributes of the user who created the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
defaultRule
\nboolean
Whether the rule is included by default
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
expression
\nstring
The SECL expression of the Agent rule
filters
\n[string]
The platforms the Agent rule is supported on
monitoring
\n[string]
The monitoring policies that the rule belongs to
name
\nstring
The name of the Agent rule
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
updateAuthorUuId
\nstring
The ID of the user who updated the rule
updateDate
\nint64
Timestamp in milliseconds when the Agent rule was last updated
updatedAt
\nint64
When the Agent rule was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
version
\nint64
The version of the Agent rule
id
\nstring
The ID of the Agent rule
type
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data
\nobject
Object for a single Agent rule
attributes
\nobject
A Cloud Workload Security Agent rule returned by the API
actions
\n[object]
The array of actions the rule can perform if triggered
disabled
\nboolean
Whether the action is disabled
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agentConstraint
\nstring
The version of the Agent
agent_version
\nstring
The version constraint of the Datadog Agent the rule applies to
blocking
\n[string]
The blocking policies that the rule belongs to
category
\nstring
The category of the Agent rule
creationAuthorUuId
\nstring
The ID of the user who created the rule
creationDate
\nint64
When the Agent rule was created, timestamp in milliseconds
creator
\nobject
The attributes of the user who created the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
defaultRule
\nboolean
Whether the rule is included by default
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
every
\nint64
The rate limiting duration of the Agent rule, in nanoseconds
expression
\nstring
The SECL expression of the Agent rule
filters
\n[string]
The platforms the Agent rule is supported on
group_id
\nstring
The group of rules the Agent rule belongs to
monitoring
\n[string]
The monitoring policies that the rule belongs to
name
\nstring
The name of the Agent rule
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
updateAuthorUuId
\nstring
The ID of the user who updated the rule
updateDate
\nint64
Timestamp in milliseconds when the Agent rule was last updated
updatedAt
\nint64
When the Agent rule was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
version
\nint64
The version of the Agent rule
id
\nstring
The ID of the Agent rule
type
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data [required]
\nobject
Object for a single Agent rule
attributes [required]
\nobject
Update an existing Cloud Workload Security Agent rule
actions
\n[object]
The array of actions the rule can perform if triggered
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agent_version
\nstring
Constrain the rule to specific versions of the Datadog Agent
blocking
\n[string]
The blocking policies that the rule belongs to
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
expression
\nstring
The SECL expression of the Agent rule
monitoring
\n[string]
The monitoring policies that the rule belongs to
policy_id
\nstring
The ID of the policy where the Agent rule is saved
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
id
\nstring
The ID of the Agent rule
type [required]
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data [required]
\nobject
Object for a single Agent rule
attributes [required]
\nobject
Update an existing Cloud Workload Security Agent rule
actions
\n[object]
The array of actions the rule can perform if triggered
disabled
\nboolean
Whether the action is disabled
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agent_version
\nstring
Constrain the rule to specific versions of the Datadog Agent
blocking
\n[string]
The blocking policies that the rule belongs to
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
expression
\nstring
The SECL expression of the Agent rule
monitoring
\n[string]
The monitoring policies that the rule belongs to
policy_id
\nstring
The ID of the policy where the Agent rule is saved
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
id
\nstring
The ID of the Agent rule
type [required]
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data
\n[object]
A list of Agent policy objects
attributes
\nobject
A Cloud Workload Security Agent policy returned by the API
blockingRulesCount
\nint32
The number of rules with the blocking feature in this policy
datadogManaged
\nboolean
Whether the policy is managed by Datadog
description
\nstring
The description of the policy
disabledRulesCount
\nint32
The number of rules that are disabled in this policy
enabled
\nboolean
Whether the Agent policy is enabled
hostTags
\n[string]
The host tags defining where this policy is deployed
hostTagsLists
\n[array]
The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR
monitoringRulesCount
\nint32
The number of rules in the monitoring state in this policy
name
\nstring
The name of the policy
pinned
\nboolean
Whether the policy is pinned
policyType
\nstring
The type of the policy
policyVersion
\nstring
The version of the policy
priority
\nint64
The priority of the policy
ruleCount
\nint32
The number of rules in this policy
updateDate
\nint64
Timestamp in milliseconds when the policy was last updated
updatedAt
\nint64
When the policy was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the policy
handle
\nstring
The handle of the user
name
\nstring
The name of the user
versions
\n[object]
The versions of the policy
date
\nstring
The date and time the version was created
name
\nstring
The version of the policy
id
\nstring
The ID of the Agent policy
type
\nenum
The type of the resource, must always be policy \nAllowed enum values: policy
default: policy
data
\n[object]
A list of Agent policy objects
attributes
\nobject
A Cloud Workload Security Agent policy returned by the API
blockingRulesCount
\nint32
The number of rules with the blocking feature in this policy
contentPackUpdateAvailable
\nboolean
Whether an update is available for the content pack. Only set for activated content packs, null otherwise
datadogManaged
\nboolean
Whether the policy is managed by Datadog
description
\nstring
The description of the policy
disabledRulesCount
\nint32
The number of rules that are disabled in this policy
enabled
\nboolean
Whether the Agent policy is enabled
hostTags
\n[string]
The host tags defining where this policy is deployed
hostTagsLists
\n[array]
The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR
monitoringRulesCount
\nint32
The number of rules in the monitoring state in this policy
name
\nstring
The name of the policy
pinned
\nboolean
Whether the policy is pinned
policyType
\nstring
The type of the policy
policyVersion
\nstring
The version of the policy
priority
\nint64
The priority of the policy
ruleCount
\nint32
The number of rules in this policy
sourceDefaultPolicyId
\nstring
The ID of the Datadog-managed default policy this policy is derived from
updateDate
\nint64
Timestamp in milliseconds when the policy was last updated
updatedAt
\nint64
When the policy was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the policy
handle
\nstring
The handle of the user
name
\nstring
The name of the user
versions
\n[object]
The versions of the policy
date
\nstring
The date and time the version was created
name
\nstring
The version of the policy
id
\nstring
The ID of the Agent policy
type
\nenum
The type of the resource, must always be policy \nAllowed enum values: policy
default: policy
data
\nobject
Object for a single Agent policy
attributes
\nobject
A Cloud Workload Security Agent policy returned by the API
blockingRulesCount
\nint32
The number of rules with the blocking feature in this policy
datadogManaged
\nboolean
Whether the policy is managed by Datadog
description
\nstring
The description of the policy
disabledRulesCount
\nint32
The number of rules that are disabled in this policy
enabled
\nboolean
Whether the Agent policy is enabled
hostTags
\n[string]
The host tags defining where this policy is deployed
hostTagsLists
\n[array]
The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR
monitoringRulesCount
\nint32
The number of rules in the monitoring state in this policy
name
\nstring
The name of the policy
pinned
\nboolean
Whether the policy is pinned
policyType
\nstring
The type of the policy
policyVersion
\nstring
The version of the policy
priority
\nint64
The priority of the policy
ruleCount
\nint32
The number of rules in this policy
updateDate
\nint64
Timestamp in milliseconds when the policy was last updated
updatedAt
\nint64
When the policy was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the policy
handle
\nstring
The handle of the user
name
\nstring
The name of the user
versions
\n[object]
The versions of the policy
date
\nstring
The date and time the version was created
name
\nstring
The version of the policy
id
\nstring
The ID of the Agent policy
type
\nenum
The type of the resource, must always be policy \nAllowed enum values: policy
default: policy
data
\nobject
Object for a single Agent policy
attributes
\nobject
A Cloud Workload Security Agent policy returned by the API
blockingRulesCount
\nint32
The number of rules with the blocking feature in this policy
contentPackUpdateAvailable
\nboolean
Whether an update is available for the content pack. Only set for activated content packs, null otherwise
datadogManaged
\nboolean
Whether the policy is managed by Datadog
description
\nstring
The description of the policy
disabledRulesCount
\nint32
The number of rules that are disabled in this policy
enabled
\nboolean
Whether the Agent policy is enabled
hostTags
\n[string]
The host tags defining where this policy is deployed
hostTagsLists
\n[array]
The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR
monitoringRulesCount
\nint32
The number of rules in the monitoring state in this policy
name
\nstring
The name of the policy
pinned
\nboolean
Whether the policy is pinned
policyType
\nstring
The type of the policy
policyVersion
\nstring
The version of the policy
priority
\nint64
The priority of the policy
ruleCount
\nint32
The number of rules in this policy
sourceDefaultPolicyId
\nstring
The ID of the Datadog-managed default policy this policy is derived from
updateDate
\nint64
Timestamp in milliseconds when the policy was last updated
updatedAt
\nint64
When the policy was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the policy
handle
\nstring
The handle of the user
name
\nstring
The name of the user
versions
\n[object]
The versions of the policy
date
\nstring
The date and time the version was created
name
\nstring
The version of the policy
id
\nstring
The ID of the Agent policy
type
\nenum
The type of the resource, must always be policy \nAllowed enum values: policy
default: policy
data
\nobject
Object for a single Agent policy
attributes
\nobject
A Cloud Workload Security Agent policy returned by the API
blockingRulesCount
\nint32
The number of rules with the blocking feature in this policy
datadogManaged
\nboolean
Whether the policy is managed by Datadog
description
\nstring
The description of the policy
disabledRulesCount
\nint32
The number of rules that are disabled in this policy
enabled
\nboolean
Whether the Agent policy is enabled
hostTags
\n[string]
The host tags defining where this policy is deployed
hostTagsLists
\n[array]
The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR
monitoringRulesCount
\nint32
The number of rules in the monitoring state in this policy
name
\nstring
The name of the policy
pinned
\nboolean
Whether the policy is pinned
policyType
\nstring
The type of the policy
policyVersion
\nstring
The version of the policy
priority
\nint64
The priority of the policy
ruleCount
\nint32
The number of rules in this policy
updateDate
\nint64
Timestamp in milliseconds when the policy was last updated
updatedAt
\nint64
When the policy was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the policy
handle
\nstring
The handle of the user
name
\nstring
The name of the user
versions
\n[object]
The versions of the policy
date
\nstring
The date and time the version was created
name
\nstring
The version of the policy
id
\nstring
The ID of the Agent policy
type
\nenum
The type of the resource, must always be policy \nAllowed enum values: policy
default: policy
data
\nobject
Object for a single Agent policy
attributes
\nobject
A Cloud Workload Security Agent policy returned by the API
blockingRulesCount
\nint32
The number of rules with the blocking feature in this policy
contentPackUpdateAvailable
\nboolean
Whether an update is available for the content pack. Only set for activated content packs, null otherwise
datadogManaged
\nboolean
Whether the policy is managed by Datadog
description
\nstring
The description of the policy
disabledRulesCount
\nint32
The number of rules that are disabled in this policy
enabled
\nboolean
Whether the Agent policy is enabled
hostTags
\n[string]
The host tags defining where this policy is deployed
hostTagsLists
\n[array]
The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR
monitoringRulesCount
\nint32
The number of rules in the monitoring state in this policy
name
\nstring
The name of the policy
pinned
\nboolean
Whether the policy is pinned
policyType
\nstring
The type of the policy
policyVersion
\nstring
The version of the policy
priority
\nint64
The priority of the policy
ruleCount
\nint32
The number of rules in this policy
sourceDefaultPolicyId
\nstring
The ID of the Datadog-managed default policy this policy is derived from
updateDate
\nint64
Timestamp in milliseconds when the policy was last updated
updatedAt
\nint64
When the policy was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the policy
handle
\nstring
The handle of the user
name
\nstring
The name of the user
versions
\n[object]
The versions of the policy
date
\nstring
The date and time the version was created
name
\nstring
The version of the policy
id
\nstring
The ID of the Agent policy
type
\nenum
The type of the resource, must always be policy \nAllowed enum values: policy
default: policy
data
\nobject
Object for a single Agent policy
attributes
\nobject
A Cloud Workload Security Agent policy returned by the API
blockingRulesCount
\nint32
The number of rules with the blocking feature in this policy
datadogManaged
\nboolean
Whether the policy is managed by Datadog
description
\nstring
The description of the policy
disabledRulesCount
\nint32
The number of rules that are disabled in this policy
enabled
\nboolean
Whether the Agent policy is enabled
hostTags
\n[string]
The host tags defining where this policy is deployed
hostTagsLists
\n[array]
The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR
monitoringRulesCount
\nint32
The number of rules in the monitoring state in this policy
name
\nstring
The name of the policy
pinned
\nboolean
Whether the policy is pinned
policyType
\nstring
The type of the policy
policyVersion
\nstring
The version of the policy
priority
\nint64
The priority of the policy
ruleCount
\nint32
The number of rules in this policy
updateDate
\nint64
Timestamp in milliseconds when the policy was last updated
updatedAt
\nint64
When the policy was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the policy
handle
\nstring
The handle of the user
name
\nstring
The name of the user
versions
\n[object]
The versions of the policy
date
\nstring
The date and time the version was created
name
\nstring
The version of the policy
id
\nstring
The ID of the Agent policy
type
\nenum
The type of the resource, must always be policy \nAllowed enum values: policy
default: policy
data
\nobject
Object for a single Agent policy
attributes
\nobject
A Cloud Workload Security Agent policy returned by the API
blockingRulesCount
\nint32
The number of rules with the blocking feature in this policy
contentPackUpdateAvailable
\nboolean
Whether an update is available for the content pack. Only set for activated content packs, null otherwise
datadogManaged
\nboolean
Whether the policy is managed by Datadog
description
\nstring
The description of the policy
disabledRulesCount
\nint32
The number of rules that are disabled in this policy
enabled
\nboolean
Whether the Agent policy is enabled
hostTags
\n[string]
The host tags defining where this policy is deployed
hostTagsLists
\n[array]
The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR
monitoringRulesCount
\nint32
The number of rules in the monitoring state in this policy
name
\nstring
The name of the policy
pinned
\nboolean
Whether the policy is pinned
policyType
\nstring
The type of the policy
policyVersion
\nstring
The version of the policy
priority
\nint64
The priority of the policy
ruleCount
\nint32
The number of rules in this policy
sourceDefaultPolicyId
\nstring
The ID of the Datadog-managed default policy this policy is derived from
updateDate
\nint64
Timestamp in milliseconds when the policy was last updated
updatedAt
\nint64
When the policy was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the policy
handle
\nstring
The handle of the user
name
\nstring
The name of the user
versions
\n[object]
The versions of the policy
date
\nstring
The date and time the version was created
name
\nstring
The version of the policy
id
\nstring
The ID of the Agent policy
type
\nenum
The type of the resource, must always be policy \nAllowed enum values: policy
default: policy
data
\n[object]
A list of Agent rules objects
attributes
\nobject
A Cloud Workload Security Agent rule returned by the API
actions
\n[object]
The array of actions the rule can perform if triggered
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agentConstraint
\nstring
The version of the Agent
blocking
\n[string]
The blocking policies that the rule belongs to
category
\nstring
The category of the Agent rule
creationAuthorUuId
\nstring
The ID of the user who created the rule
creationDate
\nint64
When the Agent rule was created, timestamp in milliseconds
creator
\nobject
The attributes of the user who created the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
defaultRule
\nboolean
Whether the rule is included by default
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
expression
\nstring
The SECL expression of the Agent rule
filters
\n[string]
The platforms the Agent rule is supported on
monitoring
\n[string]
The monitoring policies that the rule belongs to
name
\nstring
The name of the Agent rule
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
updateAuthorUuId
\nstring
The ID of the user who updated the rule
updateDate
\nint64
Timestamp in milliseconds when the Agent rule was last updated
updatedAt
\nint64
When the Agent rule was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
version
\nint64
The version of the Agent rule
id
\nstring
The ID of the Agent rule
type
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data
\n[object]
A list of Agent rules objects
attributes
\nobject
A Cloud Workload Security Agent rule returned by the API
actions
\n[object]
The array of actions the rule can perform if triggered
disabled
\nboolean
Whether the action is disabled
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agentConstraint
\nstring
The version of the Agent
agent_version
\nstring
The version constraint of the Datadog Agent the rule applies to
blocking
\n[string]
The blocking policies that the rule belongs to
category
\nstring
The category of the Agent rule
creationAuthorUuId
\nstring
The ID of the user who created the rule
creationDate
\nint64
When the Agent rule was created, timestamp in milliseconds
creator
\nobject
The attributes of the user who created the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
defaultRule
\nboolean
Whether the rule is included by default
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
every
\nint64
The rate limiting duration of the Agent rule, in nanoseconds
expression
\nstring
The SECL expression of the Agent rule
filters
\n[string]
The platforms the Agent rule is supported on
group_id
\nstring
The group of rules the Agent rule belongs to
monitoring
\n[string]
The monitoring policies that the rule belongs to
name
\nstring
The name of the Agent rule
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
updateAuthorUuId
\nstring
The ID of the user who updated the rule
updateDate
\nint64
Timestamp in milliseconds when the Agent rule was last updated
updatedAt
\nint64
When the Agent rule was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
version
\nint64
The version of the Agent rule
id
\nstring
The ID of the Agent rule
type
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data
\nobject
Object for a single Agent rule
attributes
\nobject
A Cloud Workload Security Agent rule returned by the API
actions
\n[object]
The array of actions the rule can perform if triggered
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agentConstraint
\nstring
The version of the Agent
blocking
\n[string]
The blocking policies that the rule belongs to
category
\nstring
The category of the Agent rule
creationAuthorUuId
\nstring
The ID of the user who created the rule
creationDate
\nint64
When the Agent rule was created, timestamp in milliseconds
creator
\nobject
The attributes of the user who created the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
defaultRule
\nboolean
Whether the rule is included by default
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
expression
\nstring
The SECL expression of the Agent rule
filters
\n[string]
The platforms the Agent rule is supported on
monitoring
\n[string]
The monitoring policies that the rule belongs to
name
\nstring
The name of the Agent rule
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
updateAuthorUuId
\nstring
The ID of the user who updated the rule
updateDate
\nint64
Timestamp in milliseconds when the Agent rule was last updated
updatedAt
\nint64
When the Agent rule was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
version
\nint64
The version of the Agent rule
id
\nstring
The ID of the Agent rule
type
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data
\nobject
Object for a single Agent rule
attributes
\nobject
A Cloud Workload Security Agent rule returned by the API
actions
\n[object]
The array of actions the rule can perform if triggered
disabled
\nboolean
Whether the action is disabled
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agentConstraint
\nstring
The version of the Agent
agent_version
\nstring
The version constraint of the Datadog Agent the rule applies to
blocking
\n[string]
The blocking policies that the rule belongs to
category
\nstring
The category of the Agent rule
creationAuthorUuId
\nstring
The ID of the user who created the rule
creationDate
\nint64
When the Agent rule was created, timestamp in milliseconds
creator
\nobject
The attributes of the user who created the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
defaultRule
\nboolean
Whether the rule is included by default
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
every
\nint64
The rate limiting duration of the Agent rule, in nanoseconds
expression
\nstring
The SECL expression of the Agent rule
filters
\n[string]
The platforms the Agent rule is supported on
group_id
\nstring
The group of rules the Agent rule belongs to
monitoring
\n[string]
The monitoring policies that the rule belongs to
name
\nstring
The name of the Agent rule
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
updateAuthorUuId
\nstring
The ID of the user who updated the rule
updateDate
\nint64
Timestamp in milliseconds when the Agent rule was last updated
updatedAt
\nint64
When the Agent rule was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
version
\nint64
The version of the Agent rule
id
\nstring
The ID of the Agent rule
type
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data [required]
\nobject
Object for a single Agent rule
attributes [required]
\nobject
Create a new Cloud Workload Security Agent rule.
actions
\n[object]
The array of actions the rule can perform if triggered
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agent_version
\nstring
Constrain the rule to specific versions of the Datadog Agent.
blocking
\n[string]
The blocking policies that the rule belongs to.
description
\nstring
The description of the Agent rule.
disabled
\n[string]
The disabled policies that the rule belongs to.
enabled
\nboolean
Whether the Agent rule is enabled.
expression [required]
\nstring
The SECL expression of the Agent rule.
filters
\n[string]
The platforms the Agent rule is supported on.
monitoring
\n[string]
The monitoring policies that the rule belongs to.
name [required]
\nstring
The name of the Agent rule.
policy_id
\nstring
The ID of the policy where the Agent rule is saved.
product_tags
\n[string]
The list of product tags associated with the rule.
silent
\nboolean
Whether the rule is silent.
type [required]
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data [required]
\nobject
Object for a single Agent rule
attributes [required]
\nobject
Create a new Cloud Workload Security Agent rule.
actions
\n[object]
The array of actions the rule can perform if triggered
disabled
\nboolean
Whether the action is disabled
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agent_version
\nstring
Constrain the rule to specific versions of the Datadog Agent.
blocking
\n[string]
The blocking policies that the rule belongs to.
description
\nstring
The description of the Agent rule.
disabled
\n[string]
The disabled policies that the rule belongs to.
enabled
\nboolean
Whether the Agent rule is enabled.
expression [required]
\nstring
The SECL expression of the Agent rule.
filters
\n[string]
The platforms the Agent rule is supported on.
monitoring
\n[string]
The monitoring policies that the rule belongs to.
name [required]
\nstring
The name of the Agent rule.
policy_id
\nstring
The ID of the policy where the Agent rule is saved.
product_tags
\n[string]
The list of product tags associated with the rule.
silent
\nboolean
Whether the rule is silent.
type [required]
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data
\nobject
Object for a single Agent rule
attributes
\nobject
A Cloud Workload Security Agent rule returned by the API
actions
\n[object]
The array of actions the rule can perform if triggered
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agentConstraint
\nstring
The version of the Agent
blocking
\n[string]
The blocking policies that the rule belongs to
category
\nstring
The category of the Agent rule
creationAuthorUuId
\nstring
The ID of the user who created the rule
creationDate
\nint64
When the Agent rule was created, timestamp in milliseconds
creator
\nobject
The attributes of the user who created the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
defaultRule
\nboolean
Whether the rule is included by default
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
expression
\nstring
The SECL expression of the Agent rule
filters
\n[string]
The platforms the Agent rule is supported on
monitoring
\n[string]
The monitoring policies that the rule belongs to
name
\nstring
The name of the Agent rule
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
updateAuthorUuId
\nstring
The ID of the user who updated the rule
updateDate
\nint64
Timestamp in milliseconds when the Agent rule was last updated
updatedAt
\nint64
When the Agent rule was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
version
\nint64
The version of the Agent rule
id
\nstring
The ID of the Agent rule
type
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data
\nobject
Object for a single Agent rule
attributes
\nobject
A Cloud Workload Security Agent rule returned by the API
actions
\n[object]
The array of actions the rule can perform if triggered
disabled
\nboolean
Whether the action is disabled
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agentConstraint
\nstring
The version of the Agent
agent_version
\nstring
The version constraint of the Datadog Agent the rule applies to
blocking
\n[string]
The blocking policies that the rule belongs to
category
\nstring
The category of the Agent rule
creationAuthorUuId
\nstring
The ID of the user who created the rule
creationDate
\nint64
When the Agent rule was created, timestamp in milliseconds
creator
\nobject
The attributes of the user who created the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
defaultRule
\nboolean
Whether the rule is included by default
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
every
\nint64
The rate limiting duration of the Agent rule, in nanoseconds
expression
\nstring
The SECL expression of the Agent rule
filters
\n[string]
The platforms the Agent rule is supported on
group_id
\nstring
The group of rules the Agent rule belongs to
monitoring
\n[string]
The monitoring policies that the rule belongs to
name
\nstring
The name of the Agent rule
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
updateAuthorUuId
\nstring
The ID of the user who updated the rule
updateDate
\nint64
Timestamp in milliseconds when the Agent rule was last updated
updatedAt
\nint64
When the Agent rule was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
version
\nint64
The version of the Agent rule
id
\nstring
The ID of the Agent rule
type
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data
\nobject
Object for a single Agent rule
attributes
\nobject
A Cloud Workload Security Agent rule returned by the API
actions
\n[object]
The array of actions the rule can perform if triggered
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agentConstraint
\nstring
The version of the Agent
blocking
\n[string]
The blocking policies that the rule belongs to
category
\nstring
The category of the Agent rule
creationAuthorUuId
\nstring
The ID of the user who created the rule
creationDate
\nint64
When the Agent rule was created, timestamp in milliseconds
creator
\nobject
The attributes of the user who created the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
defaultRule
\nboolean
Whether the rule is included by default
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
expression
\nstring
The SECL expression of the Agent rule
filters
\n[string]
The platforms the Agent rule is supported on
monitoring
\n[string]
The monitoring policies that the rule belongs to
name
\nstring
The name of the Agent rule
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
updateAuthorUuId
\nstring
The ID of the user who updated the rule
updateDate
\nint64
Timestamp in milliseconds when the Agent rule was last updated
updatedAt
\nint64
When the Agent rule was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
version
\nint64
The version of the Agent rule
id
\nstring
The ID of the Agent rule
type
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data
\nobject
Object for a single Agent rule
attributes
\nobject
A Cloud Workload Security Agent rule returned by the API
actions
\n[object]
The array of actions the rule can perform if triggered
disabled
\nboolean
Whether the action is disabled
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agentConstraint
\nstring
The version of the Agent
agent_version
\nstring
The version constraint of the Datadog Agent the rule applies to
blocking
\n[string]
The blocking policies that the rule belongs to
category
\nstring
The category of the Agent rule
creationAuthorUuId
\nstring
The ID of the user who created the rule
creationDate
\nint64
When the Agent rule was created, timestamp in milliseconds
creator
\nobject
The attributes of the user who created the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
defaultRule
\nboolean
Whether the rule is included by default
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
every
\nint64
The rate limiting duration of the Agent rule, in nanoseconds
expression
\nstring
The SECL expression of the Agent rule
filters
\n[string]
The platforms the Agent rule is supported on
group_id
\nstring
The group of rules the Agent rule belongs to
monitoring
\n[string]
The monitoring policies that the rule belongs to
name
\nstring
The name of the Agent rule
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
updateAuthorUuId
\nstring
The ID of the user who updated the rule
updateDate
\nint64
Timestamp in milliseconds when the Agent rule was last updated
updatedAt
\nint64
When the Agent rule was last updated, timestamp in milliseconds
updater
\nobject
The attributes of the user who last updated the Agent rule
handle
\nstring
The handle of the user
name
\nstring
The name of the user
version
\nint64
The version of the Agent rule
id
\nstring
The ID of the Agent rule
type
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data [required]
\nobject
Object for a single Agent rule
attributes [required]
\nobject
Update an existing Cloud Workload Security Agent rule
actions
\n[object]
The array of actions the rule can perform if triggered
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agent_version
\nstring
Constrain the rule to specific versions of the Datadog Agent
blocking
\n[string]
The blocking policies that the rule belongs to
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
expression
\nstring
The SECL expression of the Agent rule
monitoring
\n[string]
The monitoring policies that the rule belongs to
policy_id
\nstring
The ID of the policy where the Agent rule is saved
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
id
\nstring
The ID of the Agent rule
type [required]
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data [required]
\nobject
Object for a single Agent rule
attributes [required]
\nobject
Update an existing Cloud Workload Security Agent rule
actions
\n[object]
The array of actions the rule can perform if triggered
disabled
\nboolean
Whether the action is disabled
filter
\nstring
SECL expression used to target the container to apply the action on
hash
\nobject
Hash file specified by the field attribute
field
\nstring
The field of the hash action
kill
\nobject
Kill system call applied on the container matching the rule
signal
\nstring
Supported signals for the kill system call
metadata
\nobject
The metadata action applied on the scope matching the rule
image_tag
\nstring
The image tag of the metadata action
service
\nstring
The service of the metadata action
short_image
\nstring
The short image of the metadata action
set
\nobject
The set action applied on the scope matching the rule
append
\nboolean
Whether the value should be appended to the field.
default_value
\nstring
The default value of the set action
expression
\nstring
The expression of the set action.
field
\nstring
The field of the set action
inherited
\nboolean
Whether the value should be inherited.
name
\nstring
The name of the set action
scope
\nstring
The scope of the set action.
size
\nint64
The size of the set action.
ttl
\nint64
The time to live of the set action.
value
\n<oneOf>
The value of the set action
Object 1
\nstring
Object 2
\nint32
Object 3
\nboolean
agent_version
\nstring
Constrain the rule to specific versions of the Datadog Agent
blocking
\n[string]
The blocking policies that the rule belongs to
description
\nstring
The description of the Agent rule
disabled
\n[string]
The disabled policies that the rule belongs to
enabled
\nboolean
Whether the Agent rule is enabled
expression
\nstring
The SECL expression of the Agent rule
monitoring
\n[string]
The monitoring policies that the rule belongs to
policy_id
\nstring
The ID of the policy where the Agent rule is saved
product_tags
\n[string]
The list of product tags associated with the rule
silent
\nboolean
Whether the rule is silent.
id
\nstring
The ID of the Agent rule
type [required]
\nenum
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
data [required]
\nobject
The notification preview response data.
attributes [required]
\nobject
Attributes of the notification preview response.
preview_results [required]
\n[object]
List of preview results for each rule type matched by the notification rule.
notification_status [required]
\nenum
The notification status for the given rule type. SUCCESS means a matching event was found and the notification was sent successfully. DEFAULT means no matching event was found and a default placeholder notification was sent instead. ERROR means an error occurred while sending the notification. \nAllowed enum values: SUCCESS,DEFAULT,ERROR
rule_type [required]
\nenum
Security rule type which can be used in security rules.\nSignal-based notification rules can filter signals based on rule types application_security, log_detection,\nworkload_security, signal_correlation, cloud_configuration and infrastructure_configuration.\nVulnerability-based notification rules can filter vulnerabilities based on rule types application_code_vulnerability,\napplication_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration,\napi_security, host_vulnerability, iac_misconfiguration, sast_vulnerability, secret_vulnerability and workload_activity. \nAllowed enum values: application_security,log_detection,workload_security,signal_correlation,cloud_configuration,infrastructure_configuration,application_code_vulnerability,application_library_vulnerability,attack_path,container_image_vulnerabilityShow 8 more
,identity_risk,misconfiguration,api_security,host_vulnerability,iac_misconfiguration,sast_vulnerability,secret_vulnerability,workload_activity
id
\nstring
The ID of the notification preview response.
type [required]
\nenum
The type of the notification preview response. \nAllowed enum values: notification_preview_response
data [required]
\nobject
The notification preview response data.
attributes [required]
\nobject
Attributes of the notification preview response.
preview_results [required]
\n[object]
List of preview results for each rule type matched by the notification rule.
notification_status [required]
\nenum
The notification status for the given rule type. SUCCESS means a matching event was found and the notification was sent successfully. DEFAULT means no matching event was found and a default placeholder notification was sent instead. ERROR means an error occurred while sending the notification. \nAllowed enum values: SUCCESS,DEFAULT,ERROR
rule_type [required]
\nenum
Security rule type which can be used in security rules.\nSignal-based notification rules can filter signals based on rule types application_security, log_detection,\nworkload_security, signal_correlation, cloud_configuration and infrastructure_configuration.\nVulnerability-based notification rules can filter vulnerabilities based on rule types application_code_vulnerability,\napplication_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration,\napi_security, host_vulnerability, iac_misconfiguration, sast_vulnerability, secret_vulnerability, workload_activity,\nsensitive_data and serverless_function_code_vulnerability. \nAllowed enum values: application_security,log_detection,workload_security,signal_correlation,cloud_configuration,infrastructure_configuration,application_code_vulnerability,application_library_vulnerability,attack_path,container_image_vulnerabilityShow 10 more
,identity_risk,misconfiguration,api_security,host_vulnerability,iac_misconfiguration,sast_vulnerability,secret_vulnerability,workload_activity,sensitive_data,serverless_function_code_vulnerability
id
\nstring
The ID of the notification preview response.
type [required]
\nenum
The type of the notification preview response. \nAllowed enum values: notification_preview_response