Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Datadog Provider
  4. API Docs
  5. SecurityFindingsSeverityModifierRule
Viewing docs for Datadog v5.12.0
published on Friday, Sep 25, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-datadog

datadog.SecurityFindingsSeverityModifierRule

datadog logo
Viewing docs for Datadog v5.12.0
published on Friday, Sep 25, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-datadog

    Provides a Datadog security findings automation severity modifier rule resource. This can be used to create and manage rules that automatically adjust the severity of matching security findings. Use the datadog.SecurityFindingsSeverityModifierRulesOrder resource to manage the evaluation order of severity modifier rules.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as datadog from "@pulumi/datadog";

// Create a new severity modifier rule that raises the severity of secrets found in production.
const escalateProdSecrets = new datadog.SecurityFindingsSeverityModifierRule("escalate_prod_secrets", {
    name: "Escalate secrets found in production",
    enabled: true,
    rule: {
        finding_types: ["secret"],
        query: "env:prod",
    },
    action: {
        set: {
            severity: "critical",
            description: "Secrets in production are always treated as critical.",
        },
    },
});
// Create a severity modifier rule that shifts the severity of a finding down by one rank.
const deprioritizeDevMisconfigurations = new datadog.SecurityFindingsSeverityModifierRule("deprioritize_dev_misconfigurations", {
    name: "Deprioritize misconfigurations in dev",
    enabled: true,
    rule: {
        finding_types: ["misconfiguration"],
        query: "env:dev",
    },
    action: {
        shift: {
            severityDelta: "down_one",
            description: "Misconfigurations in dev are lower priority.",
        },
    },
});

    import pulumi
import pulumi_datadog as datadog

# Create a new severity modifier rule that raises the severity of secrets found in production.
escalate_prod_secrets = datadog.SecurityFindingsSeverityModifierRule("escalate_prod_secrets",
    name="Escalate secrets found in production",
    enabled=True,
    rule={
        "finding_types": ["secret"],
        "query": "env:prod",
    },
    action={
        "set": {
            "severity": "critical",
            "description": "Secrets in production are always treated as critical.",
        },
    })
# Create a severity modifier rule that shifts the severity of a finding down by one rank.
deprioritize_dev_misconfigurations = datadog.SecurityFindingsSeverityModifierRule("deprioritize_dev_misconfigurations",
    name="Deprioritize misconfigurations in dev",
    enabled=True,
    rule={
        "finding_types": ["misconfiguration"],
        "query": "env:dev",
    },
    action={
        "shift": {
            "severity_delta": "down_one",
            "description": "Misconfigurations in dev are lower priority.",
        },
    })

    package main

import (
	"github.com/pulumi/pulumi-datadog/sdk/v5/go/datadog"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Create a new severity modifier rule that raises the severity of secrets found in production.
		_, err := datadog.NewSecurityFindingsSeverityModifierRule(ctx, "escalate_prod_secrets", &datadog.SecurityFindingsSeverityModifierRuleArgs{
			Name:    pulumi.String("Escalate secrets found in production"),
			Enabled: pulumi.Bool(true),
			Rule: &datadog.SecurityFindingsSeverityModifierRuleRuleArgs{
				Finding_types: []string{
					"secret",
				},
				Query: pulumi.String("env:prod"),
			},
			Action: &datadog.SecurityFindingsSeverityModifierRuleActionArgs{
				Set: &datadog.SecurityFindingsSeverityModifierRuleActionSetArgs{
					Severity:    pulumi.String("critical"),
					Description: pulumi.String("Secrets in production are always treated as critical."),
				},
			},
		})
		if err != nil {
			return err
		}
		// Create a severity modifier rule that shifts the severity of a finding down by one rank.
		_, err = datadog.NewSecurityFindingsSeverityModifierRule(ctx, "deprioritize_dev_misconfigurations", &datadog.SecurityFindingsSeverityModifierRuleArgs{
			Name:    pulumi.String("Deprioritize misconfigurations in dev"),
			Enabled: pulumi.Bool(true),
			Rule: &datadog.SecurityFindingsSeverityModifierRuleRuleArgs{
				Finding_types: []string{
					"misconfiguration",
				},
				Query: pulumi.String("env:dev"),
			},
			Action: &datadog.SecurityFindingsSeverityModifierRuleActionArgs{
				Shift: &datadog.SecurityFindingsSeverityModifierRuleActionShiftArgs{
					SeverityDelta: pulumi.String("down_one"),
					Description:   pulumi.String("Misconfigurations in dev are lower priority."),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Datadog = Pulumi.Datadog;

return await Deployment.RunAsync(() => 
{
    // Create a new severity modifier rule that raises the severity of secrets found in production.
    var escalateProdSecrets = new Datadog.SecurityFindingsSeverityModifierRule("escalate_prod_secrets", new()
    {
        Name = "Escalate secrets found in production",
        Enabled = true,
        Rule = new Datadog.Inputs.SecurityFindingsSeverityModifierRuleRuleArgs
        {
            Finding_types = new[]
            {
                "secret",
            },
            Query = "env:prod",
        },
        Action = new Datadog.Inputs.SecurityFindingsSeverityModifierRuleActionArgs
        {
            Set = new Datadog.Inputs.SecurityFindingsSeverityModifierRuleActionSetArgs
            {
                Severity = "critical",
                Description = "Secrets in production are always treated as critical.",
            },
        },
    });

    // Create a severity modifier rule that shifts the severity of a finding down by one rank.
    var deprioritizeDevMisconfigurations = new Datadog.SecurityFindingsSeverityModifierRule("deprioritize_dev_misconfigurations", new()
    {
        Name = "Deprioritize misconfigurations in dev",
        Enabled = true,
        Rule = new Datadog.Inputs.SecurityFindingsSeverityModifierRuleRuleArgs
        {
            Finding_types = new[]
            {
                "misconfiguration",
            },
            Query = "env:dev",
        },
        Action = new Datadog.Inputs.SecurityFindingsSeverityModifierRuleActionArgs
        {
            Shift = new Datadog.Inputs.SecurityFindingsSeverityModifierRuleActionShiftArgs
            {
                SeverityDelta = "down_one",
                Description = "Misconfigurations in dev are lower priority.",
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.datadog.SecurityFindingsSeverityModifierRule;
import com.pulumi.datadog.SecurityFindingsSeverityModifierRuleArgs;
import com.pulumi.datadog.inputs.SecurityFindingsSeverityModifierRuleRuleArgs;
import com.pulumi.datadog.inputs.SecurityFindingsSeverityModifierRuleActionArgs;
import com.pulumi.datadog.inputs.SecurityFindingsSeverityModifierRuleActionSetArgs;
import com.pulumi.datadog.inputs.SecurityFindingsSeverityModifierRuleActionShiftArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Create a new severity modifier rule that raises the severity of secrets found in production.
        var escalateProdSecrets = new SecurityFindingsSeverityModifierRule("escalateProdSecrets", SecurityFindingsSeverityModifierRuleArgs.builder()
            .name("Escalate secrets found in production")
            .enabled(true)
            .rule(SecurityFindingsSeverityModifierRuleRuleArgs.builder()
                .finding_types(Arrays.asList("secret"))
                .query("env:prod")
                .build())
            .action(SecurityFindingsSeverityModifierRuleActionArgs.builder()
                .set(SecurityFindingsSeverityModifierRuleActionSetArgs.builder()
                    .severity("critical")
                    .description("Secrets in production are always treated as critical.")
                    .build())
                .build())
            .build());

        // Create a severity modifier rule that shifts the severity of a finding down by one rank.
        var deprioritizeDevMisconfigurations = new SecurityFindingsSeverityModifierRule("deprioritizeDevMisconfigurations", SecurityFindingsSeverityModifierRuleArgs.builder()
            .name("Deprioritize misconfigurations in dev")
            .enabled(true)
            .rule(SecurityFindingsSeverityModifierRuleRuleArgs.builder()
                .finding_types(Arrays.asList("misconfiguration"))
                .query("env:dev")
                .build())
            .action(SecurityFindingsSeverityModifierRuleActionArgs.builder()
                .shift(SecurityFindingsSeverityModifierRuleActionShiftArgs.builder()
                    .severityDelta("down_one")
                    .description("Misconfigurations in dev are lower priority.")
                    .build())
                .build())
            .build());

    }
}

    resources:
  # Create a new severity modifier rule that raises the severity of secrets found in production.
  escalateProdSecrets:
    type: datadog:SecurityFindingsSeverityModifierRule
    name: escalate_prod_secrets
    properties:
      name: Escalate secrets found in production
      enabled: true
      rule:
        finding_types:
          - secret
        query: env:prod
      action:
        set:
          severity: critical
          description: Secrets in production are always treated as critical.
  # Create a severity modifier rule that shifts the severity of a finding down by one rank.
  deprioritizeDevMisconfigurations:
    type: datadog:SecurityFindingsSeverityModifierRule
    name: deprioritize_dev_misconfigurations
    properties:
      name: Deprioritize misconfigurations in dev
      enabled: true
      rule:
        finding_types:
          - misconfiguration
        query: env:dev
      action:
        shift:
          severityDelta: down_one
          description: Misconfigurations in dev are lower priority.

    pulumi {
  required_providers {
    datadog = {
      source = "pulumi/datadog"
    }
  }
}

# Create a new severity modifier rule that raises the severity of secrets found in production.
resource "datadog_securityfindingsseveritymodifierrule" "escalate_prod_secrets" {
  name    = "Escalate secrets found in production"
  enabled = true
  rule = {
    finding_types = ["secret"]
    query         = "env:prod"
  }
  action = {
    set = {
      severity    = "critical"
      description = "Secrets in production are always treated as critical."
    }
  }
}
# Create a severity modifier rule that shifts the severity of a finding down by one rank.
resource "datadog_securityfindingsseveritymodifierrule" "deprioritize_dev_misconfigurations" {
  name    = "Deprioritize misconfigurations in dev"
  enabled = true
  rule = {
    finding_types = ["misconfiguration"]
    query         = "env:dev"
  }
  action = {
    shift = {
      severity_delta = "down_one"
      description    = "Misconfigurations in dev are lower priority."
    }
  }
}

    Create SecurityFindingsSeverityModifierRule Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecurityFindingsSeverityModifierRule(name: string, args: SecurityFindingsSeverityModifierRuleArgs, opts?: CustomResourceOptions);
    @overload
def SecurityFindingsSeverityModifierRule(resource_name: str,
                                         args: SecurityFindingsSeverityModifierRuleArgs,
                                         opts: Optional[ResourceOptions] = None)

@overload
def SecurityFindingsSeverityModifierRule(resource_name: str,
                                         opts: Optional[ResourceOptions] = None,
                                         action: Optional[SecurityFindingsSeverityModifierRuleActionArgs] = None,
                                         name: Optional[str] = None,
                                         rule: Optional[SecurityFindingsSeverityModifierRuleRuleArgs] = None,
                                         enabled: Optional[bool] = None)
    func NewSecurityFindingsSeverityModifierRule(ctx *Context, name string, args SecurityFindingsSeverityModifierRuleArgs, opts ...ResourceOption) (*SecurityFindingsSeverityModifierRule, error)
    public SecurityFindingsSeverityModifierRule(string name, SecurityFindingsSeverityModifierRuleArgs args, CustomResourceOptions? opts = null)
    public SecurityFindingsSeverityModifierRule(String name, SecurityFindingsSeverityModifierRuleArgs args)
public SecurityFindingsSeverityModifierRule(String name, SecurityFindingsSeverityModifierRuleArgs args, CustomResourceOptions options)

    type: datadog:SecurityFindingsSeverityModifierRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "datadog_security_findings_severity_modifier_rule" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecurityFindingsSeverityModifierRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecurityFindingsSeverityModifierRuleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecurityFindingsSeverityModifierRuleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecurityFindingsSeverityModifierRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecurityFindingsSeverityModifierRuleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var securityFindingsSeverityModifierRuleResource = new Datadog.SecurityFindingsSeverityModifierRule("securityFindingsSeverityModifierRuleResource", new()
{
    Action = new Datadog.Inputs.SecurityFindingsSeverityModifierRuleActionArgs
    {
        Set = new Datadog.Inputs.SecurityFindingsSeverityModifierRuleActionSetArgs
        {
            Severity = "string",
            Description = "string",
        },
        Shift = new Datadog.Inputs.SecurityFindingsSeverityModifierRuleActionShiftArgs
        {
            SeverityDelta = "string",
            Description = "string",
        },
    },
    Name = "string",
    Rule = new Datadog.Inputs.SecurityFindingsSeverityModifierRuleRuleArgs
    {
        FindingTypes = new[]
        {
            "string",
        },
        Query = "string",
    },
    Enabled = false,
});

    example, err := datadog.NewSecurityFindingsSeverityModifierRule(ctx, "securityFindingsSeverityModifierRuleResource", &datadog.SecurityFindingsSeverityModifierRuleArgs{
	Action: &datadog.SecurityFindingsSeverityModifierRuleActionArgs{
		Set: &datadog.SecurityFindingsSeverityModifierRuleActionSetArgs{
			Severity:    pulumi.String("string"),
			Description: pulumi.String("string"),
		},
		Shift: &datadog.SecurityFindingsSeverityModifierRuleActionShiftArgs{
			SeverityDelta: pulumi.String("string"),
			Description:   pulumi.String("string"),
		},
	},
	Name: pulumi.String("string"),
	Rule: &datadog.SecurityFindingsSeverityModifierRuleRuleArgs{
		FindingTypes: pulumi.StringArray{
			pulumi.String("string"),
		},
		Query: pulumi.String("string"),
	},
	Enabled: pulumi.Bool(false),
})

    resource "datadog_security_findings_severity_modifier_rule" "securityFindingsSeverityModifierRuleResource" {
  lifecycle {
    create_before_destroy = true
  }
  action = {
    set = {
      severity    = "string"
      description = "string"
    }
    shift = {
      severity_delta = "string"
      description    = "string"
    }
  }
  name = "string"
  rule = {
    finding_types = ["string"]
    query         = "string"
  }
  enabled = false
}

    var securityFindingsSeverityModifierRuleResource = new SecurityFindingsSeverityModifierRule("securityFindingsSeverityModifierRuleResource", SecurityFindingsSeverityModifierRuleArgs.builder()
    .action(SecurityFindingsSeverityModifierRuleActionArgs.builder()
        .set(SecurityFindingsSeverityModifierRuleActionSetArgs.builder()
            .severity("string")
            .description("string")
            .build())
        .shift(SecurityFindingsSeverityModifierRuleActionShiftArgs.builder()
            .severityDelta("string")
            .description("string")
            .build())
        .build())
    .name("string")
    .rule(SecurityFindingsSeverityModifierRuleRuleArgs.builder()
        .findingTypes("string")
        .query("string")
        .build())
    .enabled(false)
    .build());

    security_findings_severity_modifier_rule_resource = datadog.SecurityFindingsSeverityModifierRule("securityFindingsSeverityModifierRuleResource",
    action={
        "set": {
            "severity": "string",
            "description": "string",
        },
        "shift": {
            "severity_delta": "string",
            "description": "string",
        },
    },
    name="string",
    rule={
        "finding_types": ["string"],
        "query": "string",
    },
    enabled=False)

    const securityFindingsSeverityModifierRuleResource = new datadog.SecurityFindingsSeverityModifierRule("securityFindingsSeverityModifierRuleResource", {
    action: {
        set: {
            severity: "string",
            description: "string",
        },
        shift: {
            severityDelta: "string",
            description: "string",
        },
    },
    name: "string",
    rule: {
        findingTypes: ["string"],
        query: "string",
    },
    enabled: false,
});

    type: datadog:SecurityFindingsSeverityModifierRule
properties:
    action:
        set:
            description: string
            severity: string
        shift:
            description: string
            severityDelta: string
    enabled: false
    name: string
    rule:
        findingTypes:
            - string
        query: string

    SecurityFindingsSeverityModifierRule Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecurityFindingsSeverityModifierRule resource accepts the following input properties:

    Action SecurityFindingsSeverityModifierRuleAction
    The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one severity rank. In this resource the union is expressed as the set and shift blocks; exactly one must be provided. A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace. Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
    Name string
    The name of the severity modifier rule.
    Rule SecurityFindingsSeverityModifierRuleRule
    Defines the scope of findings to which the automation rule applies.
    Enabled bool
    Whether the severity modifier rule is enabled. Defaults to true.
    Action SecurityFindingsSeverityModifierRuleActionArgs
    The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one severity rank. In this resource the union is expressed as the set and shift blocks; exactly one must be provided. A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace. Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
    Name string
    The name of the severity modifier rule.
    Rule SecurityFindingsSeverityModifierRuleRuleArgs
    Defines the scope of findings to which the automation rule applies.
    Enabled bool
    Whether the severity modifier rule is enabled. Defaults to true.
    action object
    The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one severity rank. In this resource the union is expressed as the set and shift blocks; exactly one must be provided. A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace. Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
    name string
    The name of the severity modifier rule.
    rule object
    Defines the scope of findings to which the automation rule applies.
    enabled bool
    Whether the severity modifier rule is enabled. Defaults to true.
    action SecurityFindingsSeverityModifierRuleAction
    The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one severity rank. In this resource the union is expressed as the set and shift blocks; exactly one must be provided. A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace. Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
    name String
    The name of the severity modifier rule.
    rule SecurityFindingsSeverityModifierRuleRule
    Defines the scope of findings to which the automation rule applies.
    enabled Boolean
    Whether the severity modifier rule is enabled. Defaults to true.
    action SecurityFindingsSeverityModifierRuleAction
    The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one severity rank. In this resource the union is expressed as the set and shift blocks; exactly one must be provided. A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace. Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
    name string
    The name of the severity modifier rule.
    rule SecurityFindingsSeverityModifierRuleRule
    Defines the scope of findings to which the automation rule applies.
    enabled boolean
    Whether the severity modifier rule is enabled. Defaults to true.
    action SecurityFindingsSeverityModifierRuleActionArgs
    The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one severity rank. In this resource the union is expressed as the set and shift blocks; exactly one must be provided. A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace. Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
    name str
    The name of the severity modifier rule.
    rule SecurityFindingsSeverityModifierRuleRuleArgs
    Defines the scope of findings to which the automation rule applies.
    enabled bool
    Whether the severity modifier rule is enabled. Defaults to true.
    action Property Map
    The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one severity rank. In this resource the union is expressed as the set and shift blocks; exactly one must be provided. A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace. Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
    name String
    The name of the severity modifier rule.
    rule Property Map
    Defines the scope of findings to which the automation rule applies.
    enabled Boolean
    Whether the severity modifier rule is enabled. Defaults to true.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecurityFindingsSeverityModifierRule resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing SecurityFindingsSeverityModifierRule Resource

    Get an existing SecurityFindingsSeverityModifierRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecurityFindingsSeverityModifierRuleState, opts?: CustomResourceOptions): SecurityFindingsSeverityModifierRule
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        action: Optional[SecurityFindingsSeverityModifierRuleActionArgs] = None,
        enabled: Optional[bool] = None,
        name: Optional[str] = None,
        rule: Optional[SecurityFindingsSeverityModifierRuleRuleArgs] = None) -> SecurityFindingsSeverityModifierRule
    func GetSecurityFindingsSeverityModifierRule(ctx *Context, name string, id IDInput, state *SecurityFindingsSeverityModifierRuleState, opts ...ResourceOption) (*SecurityFindingsSeverityModifierRule, error)
    public static SecurityFindingsSeverityModifierRule Get(string name, Input<string> id, SecurityFindingsSeverityModifierRuleState? state, CustomResourceOptions? opts = null)
    public static SecurityFindingsSeverityModifierRule get(String name, Output<String> id, SecurityFindingsSeverityModifierRuleState state, CustomResourceOptions options)
    resources:  _:    type: datadog:SecurityFindingsSeverityModifierRule    get:      id: ${id}
    import {
  to = datadog_security_findings_severity_modifier_rule.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Action SecurityFindingsSeverityModifierRuleAction
    The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one severity rank. In this resource the union is expressed as the set and shift blocks; exactly one must be provided. A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace. Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
    Enabled bool
    Whether the severity modifier rule is enabled. Defaults to true.
    Name string
    The name of the severity modifier rule.
    Rule SecurityFindingsSeverityModifierRuleRule
    Defines the scope of findings to which the automation rule applies.
    Action SecurityFindingsSeverityModifierRuleActionArgs
    The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one severity rank. In this resource the union is expressed as the set and shift blocks; exactly one must be provided. A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace. Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
    Enabled bool
    Whether the severity modifier rule is enabled. Defaults to true.
    Name string
    The name of the severity modifier rule.
    Rule SecurityFindingsSeverityModifierRuleRuleArgs
    Defines the scope of findings to which the automation rule applies.
    action object
    The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one severity rank. In this resource the union is expressed as the set and shift blocks; exactly one must be provided. A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace. Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
    enabled bool
    Whether the severity modifier rule is enabled. Defaults to true.
    name string
    The name of the severity modifier rule.
    rule object
    Defines the scope of findings to which the automation rule applies.
    action SecurityFindingsSeverityModifierRuleAction
    The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one severity rank. In this resource the union is expressed as the set and shift blocks; exactly one must be provided. A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace. Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
    enabled Boolean
    Whether the severity modifier rule is enabled. Defaults to true.
    name String
    The name of the severity modifier rule.
    rule SecurityFindingsSeverityModifierRuleRule
    Defines the scope of findings to which the automation rule applies.
    action SecurityFindingsSeverityModifierRuleAction
    The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one severity rank. In this resource the union is expressed as the set and shift blocks; exactly one must be provided. A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace. Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
    enabled boolean
    Whether the severity modifier rule is enabled. Defaults to true.
    name string
    The name of the severity modifier rule.
    rule SecurityFindingsSeverityModifierRuleRule
    Defines the scope of findings to which the automation rule applies.
    action SecurityFindingsSeverityModifierRuleActionArgs
    The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one severity rank. In this resource the union is expressed as the set and shift blocks; exactly one must be provided. A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace. Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
    enabled bool
    Whether the severity modifier rule is enabled. Defaults to true.
    name str
    The name of the severity modifier rule.
    rule SecurityFindingsSeverityModifierRuleRuleArgs
    Defines the scope of findings to which the automation rule applies.
    action Property Map
    The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one severity rank. In this resource the union is expressed as the set and shift blocks; exactly one must be provided. A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace. Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
    enabled Boolean
    Whether the severity modifier rule is enabled. Defaults to true.
    name String
    The name of the severity modifier rule.
    rule Property Map
    Defines the scope of findings to which the automation rule applies.

    Supporting Types

    SecurityFindingsSeverityModifierRuleAction, SecurityFindingsSeverityModifierRuleActionArgs

    Set SecurityFindingsSeverityModifierRuleActionSet
    Sets matched findings to a fixed severity.
    Shift SecurityFindingsSeverityModifierRuleActionShift
    Shifts matched findings up or down by one severity rank.
    Set SecurityFindingsSeverityModifierRuleActionSet
    Sets matched findings to a fixed severity.
    Shift SecurityFindingsSeverityModifierRuleActionShift
    Shifts matched findings up or down by one severity rank.
    set object
    Sets matched findings to a fixed severity.
    shift object
    Shifts matched findings up or down by one severity rank.
    set SecurityFindingsSeverityModifierRuleActionSet
    Sets matched findings to a fixed severity.
    shift SecurityFindingsSeverityModifierRuleActionShift
    Shifts matched findings up or down by one severity rank.
    set SecurityFindingsSeverityModifierRuleActionSet
    Sets matched findings to a fixed severity.
    shift SecurityFindingsSeverityModifierRuleActionShift
    Shifts matched findings up or down by one severity rank.
    set SecurityFindingsSeverityModifierRuleActionSet
    Sets matched findings to a fixed severity.
    shift SecurityFindingsSeverityModifierRuleActionShift
    Shifts matched findings up or down by one severity rank.
    set Property Map
    Sets matched findings to a fixed severity.
    shift Property Map
    Shifts matched findings up or down by one severity rank.

    SecurityFindingsSeverityModifierRuleActionSet, SecurityFindingsSeverityModifierRuleActionSetArgs

    Severity string
    The severity to assign to matched findings. infoNone is not supported for the iacMisconfiguration, runtimeCodeVulnerability, secret, or staticCodeVulnerability finding types. Valid values are infoNone, low, medium, high, critical.
    Description string
    An optional free-form explanation for the severity change.
    Severity string
    The severity to assign to matched findings. infoNone is not supported for the iacMisconfiguration, runtimeCodeVulnerability, secret, or staticCodeVulnerability finding types. Valid values are infoNone, low, medium, high, critical.
    Description string
    An optional free-form explanation for the severity change.
    severity string
    The severity to assign to matched findings. infoNone is not supported for the iacMisconfiguration, runtimeCodeVulnerability, secret, or staticCodeVulnerability finding types. Valid values are infoNone, low, medium, high, critical.
    description string
    An optional free-form explanation for the severity change.
    severity String
    The severity to assign to matched findings. infoNone is not supported for the iacMisconfiguration, runtimeCodeVulnerability, secret, or staticCodeVulnerability finding types. Valid values are infoNone, low, medium, high, critical.
    description String
    An optional free-form explanation for the severity change.
    severity string
    The severity to assign to matched findings. infoNone is not supported for the iacMisconfiguration, runtimeCodeVulnerability, secret, or staticCodeVulnerability finding types. Valid values are infoNone, low, medium, high, critical.
    description string
    An optional free-form explanation for the severity change.
    severity str
    The severity to assign to matched findings. infoNone is not supported for the iacMisconfiguration, runtimeCodeVulnerability, secret, or staticCodeVulnerability finding types. Valid values are infoNone, low, medium, high, critical.
    description str
    An optional free-form explanation for the severity change.
    severity String
    The severity to assign to matched findings. infoNone is not supported for the iacMisconfiguration, runtimeCodeVulnerability, secret, or staticCodeVulnerability finding types. Valid values are infoNone, low, medium, high, critical.
    description String
    An optional free-form explanation for the severity change.

    SecurityFindingsSeverityModifierRuleActionShift, SecurityFindingsSeverityModifierRuleActionShiftArgs

    SeverityDelta string
    The direction in which to shift the severity of matched findings by one rank. Valid values are upOne, downOne.
    Description string
    An optional free-form explanation for the severity change.
    SeverityDelta string
    The direction in which to shift the severity of matched findings by one rank. Valid values are upOne, downOne.
    Description string
    An optional free-form explanation for the severity change.
    severity_delta string
    The direction in which to shift the severity of matched findings by one rank. Valid values are upOne, downOne.
    description string
    An optional free-form explanation for the severity change.
    severityDelta String
    The direction in which to shift the severity of matched findings by one rank. Valid values are upOne, downOne.
    description String
    An optional free-form explanation for the severity change.
    severityDelta string
    The direction in which to shift the severity of matched findings by one rank. Valid values are upOne, downOne.
    description string
    An optional free-form explanation for the severity change.
    severity_delta str
    The direction in which to shift the severity of matched findings by one rank. Valid values are upOne, downOne.
    description str
    An optional free-form explanation for the severity change.
    severityDelta String
    The direction in which to shift the severity of matched findings by one rank. Valid values are upOne, downOne.
    description String
    An optional free-form explanation for the severity change.

    SecurityFindingsSeverityModifierRuleRule, SecurityFindingsSeverityModifierRuleRuleArgs

    FindingTypes List<string>
    The list of security finding types that the automation rule applies to. Valid values are apiSecurity, attackPath, hostAndContainerVulnerability, iacMisconfiguration, identityRisk, libraryVulnerability, misconfiguration, runtimeCodeVulnerability, secret, staticCodeVulnerability, workloadActivity.
    Query string
    A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
    FindingTypes []string
    The list of security finding types that the automation rule applies to. Valid values are apiSecurity, attackPath, hostAndContainerVulnerability, iacMisconfiguration, identityRisk, libraryVulnerability, misconfiguration, runtimeCodeVulnerability, secret, staticCodeVulnerability, workloadActivity.
    Query string
    A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
    finding_types list(string)
    The list of security finding types that the automation rule applies to. Valid values are apiSecurity, attackPath, hostAndContainerVulnerability, iacMisconfiguration, identityRisk, libraryVulnerability, misconfiguration, runtimeCodeVulnerability, secret, staticCodeVulnerability, workloadActivity.
    query string
    A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
    findingTypes List<String>
    The list of security finding types that the automation rule applies to. Valid values are apiSecurity, attackPath, hostAndContainerVulnerability, iacMisconfiguration, identityRisk, libraryVulnerability, misconfiguration, runtimeCodeVulnerability, secret, staticCodeVulnerability, workloadActivity.
    query String
    A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
    findingTypes string[]
    The list of security finding types that the automation rule applies to. Valid values are apiSecurity, attackPath, hostAndContainerVulnerability, iacMisconfiguration, identityRisk, libraryVulnerability, misconfiguration, runtimeCodeVulnerability, secret, staticCodeVulnerability, workloadActivity.
    query string
    A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
    finding_types Sequence[str]
    The list of security finding types that the automation rule applies to. Valid values are apiSecurity, attackPath, hostAndContainerVulnerability, iacMisconfiguration, identityRisk, libraryVulnerability, misconfiguration, runtimeCodeVulnerability, secret, staticCodeVulnerability, workloadActivity.
    query str
    A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
    findingTypes List<String>
    The list of security finding types that the automation rule applies to. Valid values are apiSecurity, attackPath, hostAndContainerVulnerability, iacMisconfiguration, identityRisk, libraryVulnerability, misconfiguration, runtimeCodeVulnerability, secret, staticCodeVulnerability, workloadActivity.
    query String
    A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.

    Import

    The pulumi import command can be used, for example:

    $ pulumi import datadog:index/securityFindingsSeverityModifierRule:SecurityFindingsSeverityModifierRule escalate_prod_secrets "00000000-0000-0000-0000-000000000000"

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Datadog pulumi/pulumi-datadog
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the datadog Terraform Provider.
    datadog logo
    Viewing docs for Datadog v5.12.0
    published on Friday, Sep 25, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-datadog

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial