published on Saturday, Jul 25, 2026 by Pulumi
published on Saturday, Jul 25, 2026 by Pulumi
Provides a Datadog security findings automation mute rule resource. This can be used to create and manage mute rules that automatically suppress matching security findings. Use the datadog.SecurityFindingsMuteRulesOrder resource to manage the evaluation order of mute rules.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as datadog from "@pulumi/datadog";
// Create a new mute rule that suppresses accepted risks in dev environments.
const acceptedRisksDev = new datadog.SecurityFindingsMuteRule("accepted_risks_dev", {
name: "Mute accepted risks in dev",
enabled: true,
rule: {
finding_types: ["misconfiguration"],
query: "env:dev team:platform @severity:low",
},
action: {
reason: "risk_accepted",
reason_description: "Accepted for dev environments only",
expire_at: 4070908800000,
},
});
import pulumi
import pulumi_datadog as datadog
# Create a new mute rule that suppresses accepted risks in dev environments.
accepted_risks_dev = datadog.SecurityFindingsMuteRule("accepted_risks_dev",
name="Mute accepted risks in dev",
enabled=True,
rule={
"finding_types": ["misconfiguration"],
"query": "env:dev team:platform @severity:low",
},
action={
"reason": "risk_accepted",
"reason_description": "Accepted for dev environments only",
"expire_at": 4070908800000,
})
package main
import (
"github.com/pulumi/pulumi-datadog/sdk/v5/go/datadog"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
// Create a new mute rule that suppresses accepted risks in dev environments.
_, err := datadog.NewSecurityFindingsMuteRule(ctx, "accepted_risks_dev", &datadog.SecurityFindingsMuteRuleArgs{
Name: pulumi.String("Mute accepted risks in dev"),
Enabled: pulumi.Bool(true),
Rule: &datadog.SecurityFindingsMuteRuleRuleArgs{
Finding_types: []string{
"misconfiguration",
},
Query: pulumi.String("env:dev team:platform @severity:low"),
},
Action: &datadog.SecurityFindingsMuteRuleActionArgs{
Reason: pulumi.String("risk_accepted"),
Reason_description: "Accepted for dev environments only",
Expire_at: 4070908800000,
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Datadog = Pulumi.Datadog;
return await Deployment.RunAsync(() =>
{
// Create a new mute rule that suppresses accepted risks in dev environments.
var acceptedRisksDev = new Datadog.SecurityFindingsMuteRule("accepted_risks_dev", new()
{
Name = "Mute accepted risks in dev",
Enabled = true,
Rule = new Datadog.Inputs.SecurityFindingsMuteRuleRuleArgs
{
Finding_types = new[]
{
"misconfiguration",
},
Query = "env:dev team:platform @severity:low",
},
Action = new Datadog.Inputs.SecurityFindingsMuteRuleActionArgs
{
Reason = "risk_accepted",
Reason_description = "Accepted for dev environments only",
Expire_at = 4070908800000,
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.datadog.SecurityFindingsMuteRule;
import com.pulumi.datadog.SecurityFindingsMuteRuleArgs;
import com.pulumi.datadog.inputs.SecurityFindingsMuteRuleRuleArgs;
import com.pulumi.datadog.inputs.SecurityFindingsMuteRuleActionArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
// Create a new mute rule that suppresses accepted risks in dev environments.
var acceptedRisksDev = new SecurityFindingsMuteRule("acceptedRisksDev", SecurityFindingsMuteRuleArgs.builder()
.name("Mute accepted risks in dev")
.enabled(true)
.rule(SecurityFindingsMuteRuleRuleArgs.builder()
.finding_types(Arrays.asList("misconfiguration"))
.query("env:dev team:platform @severity:low")
.build())
.action(SecurityFindingsMuteRuleActionArgs.builder()
.reason("risk_accepted")
.reason_description("Accepted for dev environments only")
.expire_at(4070908800000)
.build())
.build());
}
}
resources:
# Create a new mute rule that suppresses accepted risks in dev environments.
acceptedRisksDev:
type: datadog:SecurityFindingsMuteRule
name: accepted_risks_dev
properties:
name: Mute accepted risks in dev
enabled: true
rule:
finding_types:
- misconfiguration
query: env:dev team:platform @severity:low
action:
reason: risk_accepted
reason_description: Accepted for dev environments only
expire_at: 4.0709088e+12
pulumi {
required_providers {
datadog = {
source = "pulumi/datadog"
}
}
}
# Create a new mute rule that suppresses accepted risks in dev environments.
resource "datadog_securityfindingsmuterule" "accepted_risks_dev" {
name = "Mute accepted risks in dev"
enabled = true
rule = {
finding_types = ["misconfiguration"]
query = "env:dev team:platform @severity:low"
}
action = {
reason = "risk_accepted"
reason_description = "Accepted for dev environments only"
expire_at = 4070908800000
}
}
Create SecurityFindingsMuteRule Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new SecurityFindingsMuteRule(name: string, args: SecurityFindingsMuteRuleArgs, opts?: CustomResourceOptions);@overload
def SecurityFindingsMuteRule(resource_name: str,
args: SecurityFindingsMuteRuleArgs,
opts: Optional[ResourceOptions] = None)
@overload
def SecurityFindingsMuteRule(resource_name: str,
opts: Optional[ResourceOptions] = None,
action: Optional[SecurityFindingsMuteRuleActionArgs] = None,
name: Optional[str] = None,
rule: Optional[SecurityFindingsMuteRuleRuleArgs] = None,
enabled: Optional[bool] = None)func NewSecurityFindingsMuteRule(ctx *Context, name string, args SecurityFindingsMuteRuleArgs, opts ...ResourceOption) (*SecurityFindingsMuteRule, error)public SecurityFindingsMuteRule(string name, SecurityFindingsMuteRuleArgs args, CustomResourceOptions? opts = null)
public SecurityFindingsMuteRule(String name, SecurityFindingsMuteRuleArgs args)
public SecurityFindingsMuteRule(String name, SecurityFindingsMuteRuleArgs args, CustomResourceOptions options)
type: datadog:SecurityFindingsMuteRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
resource "datadog_security_findings_mute_rule" "name" {
# resource properties
}Parameters
- name string
- The unique name of the resource.
- args SecurityFindingsMuteRuleArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args SecurityFindingsMuteRuleArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args SecurityFindingsMuteRuleArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args SecurityFindingsMuteRuleArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args SecurityFindingsMuteRuleArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var securityFindingsMuteRuleResource = new Datadog.SecurityFindingsMuteRule("securityFindingsMuteRuleResource", new()
{
Action = new Datadog.Inputs.SecurityFindingsMuteRuleActionArgs
{
Reason = "string",
ExpireAt = 0,
ReasonDescription = "string",
},
Name = "string",
Rule = new Datadog.Inputs.SecurityFindingsMuteRuleRuleArgs
{
FindingTypes = new[]
{
"string",
},
Query = "string",
},
Enabled = false,
});
example, err := datadog.NewSecurityFindingsMuteRule(ctx, "securityFindingsMuteRuleResource", &datadog.SecurityFindingsMuteRuleArgs{
Action: &datadog.SecurityFindingsMuteRuleActionArgs{
Reason: pulumi.String("string"),
ExpireAt: pulumi.Int(0),
ReasonDescription: pulumi.String("string"),
},
Name: pulumi.String("string"),
Rule: &datadog.SecurityFindingsMuteRuleRuleArgs{
FindingTypes: pulumi.StringArray{
pulumi.String("string"),
},
Query: pulumi.String("string"),
},
Enabled: pulumi.Bool(false),
})
resource "datadog_security_findings_mute_rule" "securityFindingsMuteRuleResource" {
lifecycle {
create_before_destroy = true
}
action = {
reason = "string"
expire_at = 0
reason_description = "string"
}
name = "string"
rule = {
finding_types = ["string"]
query = "string"
}
enabled = false
}
var securityFindingsMuteRuleResource = new SecurityFindingsMuteRule("securityFindingsMuteRuleResource", SecurityFindingsMuteRuleArgs.builder()
.action(SecurityFindingsMuteRuleActionArgs.builder()
.reason("string")
.expireAt(0)
.reasonDescription("string")
.build())
.name("string")
.rule(SecurityFindingsMuteRuleRuleArgs.builder()
.findingTypes("string")
.query("string")
.build())
.enabled(false)
.build());
security_findings_mute_rule_resource = datadog.SecurityFindingsMuteRule("securityFindingsMuteRuleResource",
action={
"reason": "string",
"expire_at": 0,
"reason_description": "string",
},
name="string",
rule={
"finding_types": ["string"],
"query": "string",
},
enabled=False)
const securityFindingsMuteRuleResource = new datadog.SecurityFindingsMuteRule("securityFindingsMuteRuleResource", {
action: {
reason: "string",
expireAt: 0,
reasonDescription: "string",
},
name: "string",
rule: {
findingTypes: ["string"],
query: "string",
},
enabled: false,
});
type: datadog:SecurityFindingsMuteRule
properties:
action:
expireAt: 0
reason: string
reasonDescription: string
enabled: false
name: string
rule:
findingTypes:
- string
query: string
SecurityFindingsMuteRule Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The SecurityFindingsMuteRule resource accepts the following input properties:
- Action
Security
Findings Mute Rule Action - The action to take when the mute rule matches a finding.
- Name string
- The name of the mute rule.
- Rule
Security
Findings Mute Rule Rule - Defines the scope of findings to which the automation rule applies.
- Enabled bool
- Whether the mute rule is enabled. Defaults to
true.
- Action
Security
Findings Mute Rule Action Args - The action to take when the mute rule matches a finding.
- Name string
- The name of the mute rule.
- Rule
Security
Findings Mute Rule Rule Args - Defines the scope of findings to which the automation rule applies.
- Enabled bool
- Whether the mute rule is enabled. Defaults to
true.
- action
Security
Findings Mute Rule Action - The action to take when the mute rule matches a finding.
- name String
- The name of the mute rule.
- rule
Security
Findings Mute Rule Rule - Defines the scope of findings to which the automation rule applies.
- enabled Boolean
- Whether the mute rule is enabled. Defaults to
true.
- action
Security
Findings Mute Rule Action - The action to take when the mute rule matches a finding.
- name string
- The name of the mute rule.
- rule
Security
Findings Mute Rule Rule - Defines the scope of findings to which the automation rule applies.
- enabled boolean
- Whether the mute rule is enabled. Defaults to
true.
- action
Security
Findings Mute Rule Action Args - The action to take when the mute rule matches a finding.
- name str
- The name of the mute rule.
- rule
Security
Findings Mute Rule Rule Args - Defines the scope of findings to which the automation rule applies.
- enabled bool
- Whether the mute rule is enabled. Defaults to
true.
- action Property Map
- The action to take when the mute rule matches a finding.
- name String
- The name of the mute rule.
- rule Property Map
- Defines the scope of findings to which the automation rule applies.
- enabled Boolean
- Whether the mute rule is enabled. Defaults to
true.
Outputs
All input properties are implicitly available as output properties. Additionally, the SecurityFindingsMuteRule resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Id string
- The provider-assigned unique ID for this managed resource.
- id string
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
- id string
- The provider-assigned unique ID for this managed resource.
- id str
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
Look up Existing SecurityFindingsMuteRule Resource
Get an existing SecurityFindingsMuteRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: SecurityFindingsMuteRuleState, opts?: CustomResourceOptions): SecurityFindingsMuteRule@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
action: Optional[SecurityFindingsMuteRuleActionArgs] = None,
enabled: Optional[bool] = None,
name: Optional[str] = None,
rule: Optional[SecurityFindingsMuteRuleRuleArgs] = None) -> SecurityFindingsMuteRulefunc GetSecurityFindingsMuteRule(ctx *Context, name string, id IDInput, state *SecurityFindingsMuteRuleState, opts ...ResourceOption) (*SecurityFindingsMuteRule, error)public static SecurityFindingsMuteRule Get(string name, Input<string> id, SecurityFindingsMuteRuleState? state, CustomResourceOptions? opts = null)public static SecurityFindingsMuteRule get(String name, Output<String> id, SecurityFindingsMuteRuleState state, CustomResourceOptions options)resources: _: type: datadog:SecurityFindingsMuteRule get: id: ${id}import {
to = datadog_security_findings_mute_rule.example
id = "${id}"
}
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Action
Security
Findings Mute Rule Action - The action to take when the mute rule matches a finding.
- Enabled bool
- Whether the mute rule is enabled. Defaults to
true. - Name string
- The name of the mute rule.
- Rule
Security
Findings Mute Rule Rule - Defines the scope of findings to which the automation rule applies.
- Action
Security
Findings Mute Rule Action Args - The action to take when the mute rule matches a finding.
- Enabled bool
- Whether the mute rule is enabled. Defaults to
true. - Name string
- The name of the mute rule.
- Rule
Security
Findings Mute Rule Rule Args - Defines the scope of findings to which the automation rule applies.
- action
Security
Findings Mute Rule Action - The action to take when the mute rule matches a finding.
- enabled Boolean
- Whether the mute rule is enabled. Defaults to
true. - name String
- The name of the mute rule.
- rule
Security
Findings Mute Rule Rule - Defines the scope of findings to which the automation rule applies.
- action
Security
Findings Mute Rule Action - The action to take when the mute rule matches a finding.
- enabled boolean
- Whether the mute rule is enabled. Defaults to
true. - name string
- The name of the mute rule.
- rule
Security
Findings Mute Rule Rule - Defines the scope of findings to which the automation rule applies.
- action
Security
Findings Mute Rule Action Args - The action to take when the mute rule matches a finding.
- enabled bool
- Whether the mute rule is enabled. Defaults to
true. - name str
- The name of the mute rule.
- rule
Security
Findings Mute Rule Rule Args - Defines the scope of findings to which the automation rule applies.
- action Property Map
- The action to take when the mute rule matches a finding.
- enabled Boolean
- Whether the mute rule is enabled. Defaults to
true. - name String
- The name of the mute rule.
- rule Property Map
- Defines the scope of findings to which the automation rule applies.
Supporting Types
SecurityFindingsMuteRuleAction, SecurityFindingsMuteRuleActionArgs
- Reason string
- The reason for muting a security finding. Valid values are
duplicate,falsePositive,noFix,other,pendingFix,riskAccepted. - Expire
At int - The Unix timestamp in milliseconds at which the mute expires. If omitted, the mute does not expire.
- Reason
Description string - An optional description providing more context for the mute reason.
- Reason string
- The reason for muting a security finding. Valid values are
duplicate,falsePositive,noFix,other,pendingFix,riskAccepted. - Expire
At int - The Unix timestamp in milliseconds at which the mute expires. If omitted, the mute does not expire.
- Reason
Description string - An optional description providing more context for the mute reason.
- reason string
- The reason for muting a security finding. Valid values are
duplicate,falsePositive,noFix,other,pendingFix,riskAccepted. - expire_
at number - The Unix timestamp in milliseconds at which the mute expires. If omitted, the mute does not expire.
- reason_
description string - An optional description providing more context for the mute reason.
- reason String
- The reason for muting a security finding. Valid values are
duplicate,falsePositive,noFix,other,pendingFix,riskAccepted. - expire
At Integer - The Unix timestamp in milliseconds at which the mute expires. If omitted, the mute does not expire.
- reason
Description String - An optional description providing more context for the mute reason.
- reason string
- The reason for muting a security finding. Valid values are
duplicate,falsePositive,noFix,other,pendingFix,riskAccepted. - expire
At number - The Unix timestamp in milliseconds at which the mute expires. If omitted, the mute does not expire.
- reason
Description string - An optional description providing more context for the mute reason.
- reason str
- The reason for muting a security finding. Valid values are
duplicate,falsePositive,noFix,other,pendingFix,riskAccepted. - expire_
at int - The Unix timestamp in milliseconds at which the mute expires. If omitted, the mute does not expire.
- reason_
description str - An optional description providing more context for the mute reason.
- reason String
- The reason for muting a security finding. Valid values are
duplicate,falsePositive,noFix,other,pendingFix,riskAccepted. - expire
At Number - The Unix timestamp in milliseconds at which the mute expires. If omitted, the mute does not expire.
- reason
Description String - An optional description providing more context for the mute reason.
SecurityFindingsMuteRuleRule, SecurityFindingsMuteRuleRuleArgs
- Finding
Types List<string> - The list of security finding types that the automation rule applies to. Valid values are
apiSecurity,attackPath,hostAndContainerVulnerability,iacMisconfiguration,identityRisk,libraryVulnerability,misconfiguration,runtimeCodeVulnerability,secret,staticCodeVulnerability,workloadActivity. - Query string
- A search query to further filter the findings matched by this rule. The
@workflow.*namespace and@statusfields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
- Finding
Types []string - The list of security finding types that the automation rule applies to. Valid values are
apiSecurity,attackPath,hostAndContainerVulnerability,iacMisconfiguration,identityRisk,libraryVulnerability,misconfiguration,runtimeCodeVulnerability,secret,staticCodeVulnerability,workloadActivity. - Query string
- A search query to further filter the findings matched by this rule. The
@workflow.*namespace and@statusfields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
- finding_
types list(string) - The list of security finding types that the automation rule applies to. Valid values are
apiSecurity,attackPath,hostAndContainerVulnerability,iacMisconfiguration,identityRisk,libraryVulnerability,misconfiguration,runtimeCodeVulnerability,secret,staticCodeVulnerability,workloadActivity. - query string
- A search query to further filter the findings matched by this rule. The
@workflow.*namespace and@statusfields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
- finding
Types List<String> - The list of security finding types that the automation rule applies to. Valid values are
apiSecurity,attackPath,hostAndContainerVulnerability,iacMisconfiguration,identityRisk,libraryVulnerability,misconfiguration,runtimeCodeVulnerability,secret,staticCodeVulnerability,workloadActivity. - query String
- A search query to further filter the findings matched by this rule. The
@workflow.*namespace and@statusfields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
- finding
Types string[] - The list of security finding types that the automation rule applies to. Valid values are
apiSecurity,attackPath,hostAndContainerVulnerability,iacMisconfiguration,identityRisk,libraryVulnerability,misconfiguration,runtimeCodeVulnerability,secret,staticCodeVulnerability,workloadActivity. - query string
- A search query to further filter the findings matched by this rule. The
@workflow.*namespace and@statusfields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
- finding_
types Sequence[str] - The list of security finding types that the automation rule applies to. Valid values are
apiSecurity,attackPath,hostAndContainerVulnerability,iacMisconfiguration,identityRisk,libraryVulnerability,misconfiguration,runtimeCodeVulnerability,secret,staticCodeVulnerability,workloadActivity. - query str
- A search query to further filter the findings matched by this rule. The
@workflow.*namespace and@statusfields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
- finding
Types List<String> - The list of security finding types that the automation rule applies to. Valid values are
apiSecurity,attackPath,hostAndContainerVulnerability,iacMisconfiguration,identityRisk,libraryVulnerability,misconfiguration,runtimeCodeVulnerability,secret,staticCodeVulnerability,workloadActivity. - query String
- A search query to further filter the findings matched by this rule. The
@workflow.*namespace and@statusfields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
Import
The pulumi import command can be used, for example:
$ pulumi import datadog:index/securityFindingsMuteRule:SecurityFindingsMuteRule accepted_risks_dev "00000000-0000-0000-0000-000000000000"
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- Datadog pulumi/pulumi-datadog
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
datadogTerraform Provider.
published on Saturday, Jul 25, 2026 by Pulumi