Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Datadog Provider
  4. API Docs
  5. SecurityFindingsInboxRule
Viewing docs for Datadog v5.12.0
published on Friday, Sep 25, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-datadog

datadog.SecurityFindingsInboxRule

datadog logo
Viewing docs for Datadog v5.12.0
published on Friday, Sep 25, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-datadog

    Provides a Datadog security findings automation inbox rule resource. This can be used to create and manage inbox rules that push matching security findings into the Security Inbox triage view. Use the datadog.SecurityFindingsInboxRulesOrder resource to manage the evaluation order of inbox rules.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as datadog from "@pulumi/datadog";

// Create a new inbox rule that pushes prod misconfigurations into the Security Inbox.
const triageProductionMisconfigurations = new datadog.SecurityFindingsInboxRule("triage_production_misconfigurations", {
    name: "Triage production misconfigurations",
    enabled: true,
    rule: {
        finding_types: ["misconfiguration"],
        query: "env:prod team:platform",
    },
    action: {
        description: "Needs triage",
    },
});

    import pulumi
import pulumi_datadog as datadog

# Create a new inbox rule that pushes prod misconfigurations into the Security Inbox.
triage_production_misconfigurations = datadog.SecurityFindingsInboxRule("triage_production_misconfigurations",
    name="Triage production misconfigurations",
    enabled=True,
    rule={
        "finding_types": ["misconfiguration"],
        "query": "env:prod team:platform",
    },
    action={
        "description": "Needs triage",
    })

    package main

import (
	"github.com/pulumi/pulumi-datadog/sdk/v5/go/datadog"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Create a new inbox rule that pushes prod misconfigurations into the Security Inbox.
		_, err := datadog.NewSecurityFindingsInboxRule(ctx, "triage_production_misconfigurations", &datadog.SecurityFindingsInboxRuleArgs{
			Name:    pulumi.String("Triage production misconfigurations"),
			Enabled: pulumi.Bool(true),
			Rule: &datadog.SecurityFindingsInboxRuleRuleArgs{
				Finding_types: []string{
					"misconfiguration",
				},
				Query: pulumi.String("env:prod team:platform"),
			},
			Action: &datadog.SecurityFindingsInboxRuleActionArgs{
				Description: pulumi.String("Needs triage"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Datadog = Pulumi.Datadog;

return await Deployment.RunAsync(() => 
{
    // Create a new inbox rule that pushes prod misconfigurations into the Security Inbox.
    var triageProductionMisconfigurations = new Datadog.SecurityFindingsInboxRule("triage_production_misconfigurations", new()
    {
        Name = "Triage production misconfigurations",
        Enabled = true,
        Rule = new Datadog.Inputs.SecurityFindingsInboxRuleRuleArgs
        {
            Finding_types = new[]
            {
                "misconfiguration",
            },
            Query = "env:prod team:platform",
        },
        Action = new Datadog.Inputs.SecurityFindingsInboxRuleActionArgs
        {
            Description = "Needs triage",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.datadog.SecurityFindingsInboxRule;
import com.pulumi.datadog.SecurityFindingsInboxRuleArgs;
import com.pulumi.datadog.inputs.SecurityFindingsInboxRuleRuleArgs;
import com.pulumi.datadog.inputs.SecurityFindingsInboxRuleActionArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Create a new inbox rule that pushes prod misconfigurations into the Security Inbox.
        var triageProductionMisconfigurations = new SecurityFindingsInboxRule("triageProductionMisconfigurations", SecurityFindingsInboxRuleArgs.builder()
            .name("Triage production misconfigurations")
            .enabled(true)
            .rule(SecurityFindingsInboxRuleRuleArgs.builder()
                .finding_types(Arrays.asList("misconfiguration"))
                .query("env:prod team:platform")
                .build())
            .action(SecurityFindingsInboxRuleActionArgs.builder()
                .description("Needs triage")
                .build())
            .build());

    }
}

    resources:
  # Create a new inbox rule that pushes prod misconfigurations into the Security Inbox.
  triageProductionMisconfigurations:
    type: datadog:SecurityFindingsInboxRule
    name: triage_production_misconfigurations
    properties:
      name: Triage production misconfigurations
      enabled: true
      rule:
        finding_types:
          - misconfiguration
        query: env:prod team:platform
      action:
        description: Needs triage

    pulumi {
  required_providers {
    datadog = {
      source = "pulumi/datadog"
    }
  }
}

# Create a new inbox rule that pushes prod misconfigurations into the Security Inbox.
resource "datadog_securityfindingsinboxrule" "triage_production_misconfigurations" {
  name    = "Triage production misconfigurations"
  enabled = true
  rule = {
    finding_types = ["misconfiguration"]
    query         = "env:prod team:platform"
  }
  action = {
    description = "Needs triage"
  }
}

    Create SecurityFindingsInboxRule Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecurityFindingsInboxRule(name: string, args: SecurityFindingsInboxRuleArgs, opts?: CustomResourceOptions);
    @overload
def SecurityFindingsInboxRule(resource_name: str,
                              args: SecurityFindingsInboxRuleArgs,
                              opts: Optional[ResourceOptions] = None)

@overload
def SecurityFindingsInboxRule(resource_name: str,
                              opts: Optional[ResourceOptions] = None,
                              action: Optional[SecurityFindingsInboxRuleActionArgs] = None,
                              name: Optional[str] = None,
                              rule: Optional[SecurityFindingsInboxRuleRuleArgs] = None,
                              enabled: Optional[bool] = None)
    func NewSecurityFindingsInboxRule(ctx *Context, name string, args SecurityFindingsInboxRuleArgs, opts ...ResourceOption) (*SecurityFindingsInboxRule, error)
    public SecurityFindingsInboxRule(string name, SecurityFindingsInboxRuleArgs args, CustomResourceOptions? opts = null)
    public SecurityFindingsInboxRule(String name, SecurityFindingsInboxRuleArgs args)
public SecurityFindingsInboxRule(String name, SecurityFindingsInboxRuleArgs args, CustomResourceOptions options)

    type: datadog:SecurityFindingsInboxRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "datadog_security_findings_inbox_rule" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecurityFindingsInboxRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecurityFindingsInboxRuleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecurityFindingsInboxRuleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecurityFindingsInboxRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecurityFindingsInboxRuleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var securityFindingsInboxRuleResource = new Datadog.SecurityFindingsInboxRule("securityFindingsInboxRuleResource", new()
{
    Action = new Datadog.Inputs.SecurityFindingsInboxRuleActionArgs
    {
        Description = "string",
    },
    Name = "string",
    Rule = new Datadog.Inputs.SecurityFindingsInboxRuleRuleArgs
    {
        FindingTypes = new[]
        {
            "string",
        },
        Query = "string",
    },
    Enabled = false,
});

    example, err := datadog.NewSecurityFindingsInboxRule(ctx, "securityFindingsInboxRuleResource", &datadog.SecurityFindingsInboxRuleArgs{
	Action: &datadog.SecurityFindingsInboxRuleActionArgs{
		Description: pulumi.String("string"),
	},
	Name: pulumi.String("string"),
	Rule: &datadog.SecurityFindingsInboxRuleRuleArgs{
		FindingTypes: pulumi.StringArray{
			pulumi.String("string"),
		},
		Query: pulumi.String("string"),
	},
	Enabled: pulumi.Bool(false),
})

    resource "datadog_security_findings_inbox_rule" "securityFindingsInboxRuleResource" {
  lifecycle {
    create_before_destroy = true
  }
  action = {
    description = "string"
  }
  name = "string"
  rule = {
    finding_types = ["string"]
    query         = "string"
  }
  enabled = false
}

    var securityFindingsInboxRuleResource = new SecurityFindingsInboxRule("securityFindingsInboxRuleResource", SecurityFindingsInboxRuleArgs.builder()
    .action(SecurityFindingsInboxRuleActionArgs.builder()
        .description("string")
        .build())
    .name("string")
    .rule(SecurityFindingsInboxRuleRuleArgs.builder()
        .findingTypes("string")
        .query("string")
        .build())
    .enabled(false)
    .build());

    security_findings_inbox_rule_resource = datadog.SecurityFindingsInboxRule("securityFindingsInboxRuleResource",
    action={
        "description": "string",
    },
    name="string",
    rule={
        "finding_types": ["string"],
        "query": "string",
    },
    enabled=False)

    const securityFindingsInboxRuleResource = new datadog.SecurityFindingsInboxRule("securityFindingsInboxRuleResource", {
    action: {
        description: "string",
    },
    name: "string",
    rule: {
        findingTypes: ["string"],
        query: "string",
    },
    enabled: false,
});

    type: datadog:SecurityFindingsInboxRule
properties:
    action:
        description: string
    enabled: false
    name: string
    rule:
        findingTypes:
            - string
        query: string

    SecurityFindingsInboxRule Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecurityFindingsInboxRule resource accepts the following input properties:

    Action SecurityFindingsInboxRuleAction
    The action to take when the inbox rule matches a finding.
    Name string
    The name of the inbox rule.
    Rule SecurityFindingsInboxRuleRule
    Defines the scope of findings to which the automation rule applies.
    Enabled bool
    Whether the inbox rule is enabled. Defaults to true.
    Action SecurityFindingsInboxRuleActionArgs
    The action to take when the inbox rule matches a finding.
    Name string
    The name of the inbox rule.
    Rule SecurityFindingsInboxRuleRuleArgs
    Defines the scope of findings to which the automation rule applies.
    Enabled bool
    Whether the inbox rule is enabled. Defaults to true.
    action object
    The action to take when the inbox rule matches a finding.
    name string
    The name of the inbox rule.
    rule object
    Defines the scope of findings to which the automation rule applies.
    enabled bool
    Whether the inbox rule is enabled. Defaults to true.
    action SecurityFindingsInboxRuleAction
    The action to take when the inbox rule matches a finding.
    name String
    The name of the inbox rule.
    rule SecurityFindingsInboxRuleRule
    Defines the scope of findings to which the automation rule applies.
    enabled Boolean
    Whether the inbox rule is enabled. Defaults to true.
    action SecurityFindingsInboxRuleAction
    The action to take when the inbox rule matches a finding.
    name string
    The name of the inbox rule.
    rule SecurityFindingsInboxRuleRule
    Defines the scope of findings to which the automation rule applies.
    enabled boolean
    Whether the inbox rule is enabled. Defaults to true.
    action SecurityFindingsInboxRuleActionArgs
    The action to take when the inbox rule matches a finding.
    name str
    The name of the inbox rule.
    rule SecurityFindingsInboxRuleRuleArgs
    Defines the scope of findings to which the automation rule applies.
    enabled bool
    Whether the inbox rule is enabled. Defaults to true.
    action Property Map
    The action to take when the inbox rule matches a finding.
    name String
    The name of the inbox rule.
    rule Property Map
    Defines the scope of findings to which the automation rule applies.
    enabled Boolean
    Whether the inbox rule is enabled. Defaults to true.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecurityFindingsInboxRule resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing SecurityFindingsInboxRule Resource

    Get an existing SecurityFindingsInboxRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecurityFindingsInboxRuleState, opts?: CustomResourceOptions): SecurityFindingsInboxRule
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        action: Optional[SecurityFindingsInboxRuleActionArgs] = None,
        enabled: Optional[bool] = None,
        name: Optional[str] = None,
        rule: Optional[SecurityFindingsInboxRuleRuleArgs] = None) -> SecurityFindingsInboxRule
    func GetSecurityFindingsInboxRule(ctx *Context, name string, id IDInput, state *SecurityFindingsInboxRuleState, opts ...ResourceOption) (*SecurityFindingsInboxRule, error)
    public static SecurityFindingsInboxRule Get(string name, Input<string> id, SecurityFindingsInboxRuleState? state, CustomResourceOptions? opts = null)
    public static SecurityFindingsInboxRule get(String name, Output<String> id, SecurityFindingsInboxRuleState state, CustomResourceOptions options)
    resources:  _:    type: datadog:SecurityFindingsInboxRule    get:      id: ${id}
    import {
  to = datadog_security_findings_inbox_rule.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Action SecurityFindingsInboxRuleAction
    The action to take when the inbox rule matches a finding.
    Enabled bool
    Whether the inbox rule is enabled. Defaults to true.
    Name string
    The name of the inbox rule.
    Rule SecurityFindingsInboxRuleRule
    Defines the scope of findings to which the automation rule applies.
    Action SecurityFindingsInboxRuleActionArgs
    The action to take when the inbox rule matches a finding.
    Enabled bool
    Whether the inbox rule is enabled. Defaults to true.
    Name string
    The name of the inbox rule.
    Rule SecurityFindingsInboxRuleRuleArgs
    Defines the scope of findings to which the automation rule applies.
    action object
    The action to take when the inbox rule matches a finding.
    enabled bool
    Whether the inbox rule is enabled. Defaults to true.
    name string
    The name of the inbox rule.
    rule object
    Defines the scope of findings to which the automation rule applies.
    action SecurityFindingsInboxRuleAction
    The action to take when the inbox rule matches a finding.
    enabled Boolean
    Whether the inbox rule is enabled. Defaults to true.
    name String
    The name of the inbox rule.
    rule SecurityFindingsInboxRuleRule
    Defines the scope of findings to which the automation rule applies.
    action SecurityFindingsInboxRuleAction
    The action to take when the inbox rule matches a finding.
    enabled boolean
    Whether the inbox rule is enabled. Defaults to true.
    name string
    The name of the inbox rule.
    rule SecurityFindingsInboxRuleRule
    Defines the scope of findings to which the automation rule applies.
    action SecurityFindingsInboxRuleActionArgs
    The action to take when the inbox rule matches a finding.
    enabled bool
    Whether the inbox rule is enabled. Defaults to true.
    name str
    The name of the inbox rule.
    rule SecurityFindingsInboxRuleRuleArgs
    Defines the scope of findings to which the automation rule applies.
    action Property Map
    The action to take when the inbox rule matches a finding.
    enabled Boolean
    Whether the inbox rule is enabled. Defaults to true.
    name String
    The name of the inbox rule.
    rule Property Map
    Defines the scope of findings to which the automation rule applies.

    Supporting Types

    SecurityFindingsInboxRuleAction, SecurityFindingsInboxRuleActionArgs

    Description string
    An optional description providing more context for the rule.
    Description string
    An optional description providing more context for the rule.
    description string
    An optional description providing more context for the rule.
    description String
    An optional description providing more context for the rule.
    description string
    An optional description providing more context for the rule.
    description str
    An optional description providing more context for the rule.
    description String
    An optional description providing more context for the rule.

    SecurityFindingsInboxRuleRule, SecurityFindingsInboxRuleRuleArgs

    FindingTypes List<string>
    The list of security finding types that the automation rule applies to. Valid values are apiSecurity, attackPath, hostAndContainerVulnerability, iacMisconfiguration, identityRisk, libraryVulnerability, misconfiguration, runtimeCodeVulnerability, secret, staticCodeVulnerability, workloadActivity.
    Query string
    A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
    FindingTypes []string
    The list of security finding types that the automation rule applies to. Valid values are apiSecurity, attackPath, hostAndContainerVulnerability, iacMisconfiguration, identityRisk, libraryVulnerability, misconfiguration, runtimeCodeVulnerability, secret, staticCodeVulnerability, workloadActivity.
    Query string
    A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
    finding_types list(string)
    The list of security finding types that the automation rule applies to. Valid values are apiSecurity, attackPath, hostAndContainerVulnerability, iacMisconfiguration, identityRisk, libraryVulnerability, misconfiguration, runtimeCodeVulnerability, secret, staticCodeVulnerability, workloadActivity.
    query string
    A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
    findingTypes List<String>
    The list of security finding types that the automation rule applies to. Valid values are apiSecurity, attackPath, hostAndContainerVulnerability, iacMisconfiguration, identityRisk, libraryVulnerability, misconfiguration, runtimeCodeVulnerability, secret, staticCodeVulnerability, workloadActivity.
    query String
    A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
    findingTypes string[]
    The list of security finding types that the automation rule applies to. Valid values are apiSecurity, attackPath, hostAndContainerVulnerability, iacMisconfiguration, identityRisk, libraryVulnerability, misconfiguration, runtimeCodeVulnerability, secret, staticCodeVulnerability, workloadActivity.
    query string
    A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
    finding_types Sequence[str]
    The list of security finding types that the automation rule applies to. Valid values are apiSecurity, attackPath, hostAndContainerVulnerability, iacMisconfiguration, identityRisk, libraryVulnerability, misconfiguration, runtimeCodeVulnerability, secret, staticCodeVulnerability, workloadActivity.
    query str
    A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
    findingTypes List<String>
    The list of security finding types that the automation rule applies to. Valid values are apiSecurity, attackPath, hostAndContainerVulnerability, iacMisconfiguration, identityRisk, libraryVulnerability, misconfiguration, runtimeCodeVulnerability, secret, staticCodeVulnerability, workloadActivity.
    query String
    A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.

    Import

    The pulumi import command can be used, for example:

    $ pulumi import datadog:index/securityFindingsInboxRule:SecurityFindingsInboxRule triage_production_misconfigurations "00000000-0000-0000-0000-000000000000"

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Datadog pulumi/pulumi-datadog
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the datadog Terraform Provider.
    datadog logo
    Viewing docs for Datadog v5.12.0
    published on Friday, Sep 25, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-datadog

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial