Datadog v4.59.0 published on Wednesday, Oct 22, 2025 by Pulumi
datadog.SecurityMonitoringSuppression
Provides a Datadog Security Monitoring Suppression API resource. It can be used to create and manage Datadog security monitoring suppression rules.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as datadog from "@pulumi/datadog";
const mySuppression = new datadog.SecurityMonitoringSuppression("my_suppression", {
name: "My suppression",
description: "Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024",
enabled: true,
ruleQuery: "severity:low source:cloudtrail",
suppressionQuery: "@usr.id:john.doe",
dataExclusionQuery: "env:test",
startDate: "2024-12-01T16:00:00Z",
expirationDate: "2024-12-31T12:00:00Z",
});
import pulumi
import pulumi_datadog as datadog
my_suppression = datadog.SecurityMonitoringSuppression("my_suppression",
name="My suppression",
description="Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024",
enabled=True,
rule_query="severity:low source:cloudtrail",
suppression_query="@usr.id:john.doe",
data_exclusion_query="env:test",
start_date="2024-12-01T16:00:00Z",
expiration_date="2024-12-31T12:00:00Z")
package main
import (
"github.com/pulumi/pulumi-datadog/sdk/v4/go/datadog"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := datadog.NewSecurityMonitoringSuppression(ctx, "my_suppression", &datadog.SecurityMonitoringSuppressionArgs{
Name: pulumi.String("My suppression"),
Description: pulumi.String("Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024"),
Enabled: pulumi.Bool(true),
RuleQuery: pulumi.String("severity:low source:cloudtrail"),
SuppressionQuery: pulumi.String("@usr.id:john.doe"),
DataExclusionQuery: pulumi.String("env:test"),
StartDate: pulumi.String("2024-12-01T16:00:00Z"),
ExpirationDate: pulumi.String("2024-12-31T12:00:00Z"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Datadog = Pulumi.Datadog;
return await Deployment.RunAsync(() =>
{
var mySuppression = new Datadog.SecurityMonitoringSuppression("my_suppression", new()
{
Name = "My suppression",
Description = "Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024",
Enabled = true,
RuleQuery = "severity:low source:cloudtrail",
SuppressionQuery = "@usr.id:john.doe",
DataExclusionQuery = "env:test",
StartDate = "2024-12-01T16:00:00Z",
ExpirationDate = "2024-12-31T12:00:00Z",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.datadog.SecurityMonitoringSuppression;
import com.pulumi.datadog.SecurityMonitoringSuppressionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var mySuppression = new SecurityMonitoringSuppression("mySuppression", SecurityMonitoringSuppressionArgs.builder()
.name("My suppression")
.description("Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024")
.enabled(true)
.ruleQuery("severity:low source:cloudtrail")
.suppressionQuery("@usr.id:john.doe")
.dataExclusionQuery("env:test")
.startDate("2024-12-01T16:00:00Z")
.expirationDate("2024-12-31T12:00:00Z")
.build());
}
}
resources:
mySuppression:
type: datadog:SecurityMonitoringSuppression
name: my_suppression
properties:
name: My suppression
description: Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024
enabled: true
ruleQuery: severity:low source:cloudtrail
suppressionQuery: '@usr.id:john.doe'
dataExclusionQuery: env:test
startDate: 2024-12-01T16:00:00Z
expirationDate: 2024-12-31T12:00:00Z
Create SecurityMonitoringSuppression Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new SecurityMonitoringSuppression(name: string, args: SecurityMonitoringSuppressionArgs, opts?: CustomResourceOptions);@overload
def SecurityMonitoringSuppression(resource_name: str,
args: SecurityMonitoringSuppressionArgs,
opts: Optional[ResourceOptions] = None)
@overload
def SecurityMonitoringSuppression(resource_name: str,
opts: Optional[ResourceOptions] = None,
enabled: Optional[bool] = None,
name: Optional[str] = None,
rule_query: Optional[str] = None,
data_exclusion_query: Optional[str] = None,
description: Optional[str] = None,
expiration_date: Optional[str] = None,
start_date: Optional[str] = None,
suppression_query: Optional[str] = None,
validate: Optional[bool] = None)func NewSecurityMonitoringSuppression(ctx *Context, name string, args SecurityMonitoringSuppressionArgs, opts ...ResourceOption) (*SecurityMonitoringSuppression, error)public SecurityMonitoringSuppression(string name, SecurityMonitoringSuppressionArgs args, CustomResourceOptions? opts = null)
public SecurityMonitoringSuppression(String name, SecurityMonitoringSuppressionArgs args)
public SecurityMonitoringSuppression(String name, SecurityMonitoringSuppressionArgs args, CustomResourceOptions options)
type: datadog:SecurityMonitoringSuppression
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args SecurityMonitoringSuppressionArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args SecurityMonitoringSuppressionArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args SecurityMonitoringSuppressionArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args SecurityMonitoringSuppressionArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args SecurityMonitoringSuppressionArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var securityMonitoringSuppressionResource = new Datadog.SecurityMonitoringSuppression("securityMonitoringSuppressionResource", new()
{
Enabled = false,
Name = "string",
RuleQuery = "string",
DataExclusionQuery = "string",
Description = "string",
ExpirationDate = "string",
StartDate = "string",
SuppressionQuery = "string",
Validate = false,
});
example, err := datadog.NewSecurityMonitoringSuppression(ctx, "securityMonitoringSuppressionResource", &datadog.SecurityMonitoringSuppressionArgs{
Enabled: pulumi.Bool(false),
Name: pulumi.String("string"),
RuleQuery: pulumi.String("string"),
DataExclusionQuery: pulumi.String("string"),
Description: pulumi.String("string"),
ExpirationDate: pulumi.String("string"),
StartDate: pulumi.String("string"),
SuppressionQuery: pulumi.String("string"),
Validate: pulumi.Bool(false),
})
var securityMonitoringSuppressionResource = new SecurityMonitoringSuppression("securityMonitoringSuppressionResource", SecurityMonitoringSuppressionArgs.builder()
.enabled(false)
.name("string")
.ruleQuery("string")
.dataExclusionQuery("string")
.description("string")
.expirationDate("string")
.startDate("string")
.suppressionQuery("string")
.validate(false)
.build());
security_monitoring_suppression_resource = datadog.SecurityMonitoringSuppression("securityMonitoringSuppressionResource",
enabled=False,
name="string",
rule_query="string",
data_exclusion_query="string",
description="string",
expiration_date="string",
start_date="string",
suppression_query="string",
validate=False)
const securityMonitoringSuppressionResource = new datadog.SecurityMonitoringSuppression("securityMonitoringSuppressionResource", {
enabled: false,
name: "string",
ruleQuery: "string",
dataExclusionQuery: "string",
description: "string",
expirationDate: "string",
startDate: "string",
suppressionQuery: "string",
validate: false,
});
type: datadog:SecurityMonitoringSuppression
properties:
dataExclusionQuery: string
description: string
enabled: false
expirationDate: string
name: string
ruleQuery: string
startDate: string
suppressionQuery: string
validate: false
SecurityMonitoringSuppression Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The SecurityMonitoringSuppression resource accepts the following input properties:
- Enabled bool
- Whether the suppression rule is enabled.
- Name string
- The name of the suppression rule.
- Rule
Query string - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- Data
Exclusion stringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- Description string
- A description for the suppression rule.
- Expiration
Date string - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- Start
Date string - A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
- Suppression
Query string - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- Validate bool
- Whether to validate the suppression rule during
pulumi preview. When set totrue, the rule is validated against Datadog's suppression validation endpoint. Defaults totrue.
- Enabled bool
- Whether the suppression rule is enabled.
- Name string
- The name of the suppression rule.
- Rule
Query string - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- Data
Exclusion stringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- Description string
- A description for the suppression rule.
- Expiration
Date string - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- Start
Date string - A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
- Suppression
Query string - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- Validate bool
- Whether to validate the suppression rule during
pulumi preview. When set totrue, the rule is validated against Datadog's suppression validation endpoint. Defaults totrue.
- enabled Boolean
- Whether the suppression rule is enabled.
- name String
- The name of the suppression rule.
- rule
Query String - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- data
Exclusion StringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- description String
- A description for the suppression rule.
- expiration
Date String - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- start
Date String - A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
- suppression
Query String - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- validate Boolean
- Whether to validate the suppression rule during
pulumi preview. When set totrue, the rule is validated against Datadog's suppression validation endpoint. Defaults totrue.
- enabled boolean
- Whether the suppression rule is enabled.
- name string
- The name of the suppression rule.
- rule
Query string - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- data
Exclusion stringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- description string
- A description for the suppression rule.
- expiration
Date string - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- start
Date string - A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
- suppression
Query string - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- validate boolean
- Whether to validate the suppression rule during
pulumi preview. When set totrue, the rule is validated against Datadog's suppression validation endpoint. Defaults totrue.
- enabled bool
- Whether the suppression rule is enabled.
- name str
- The name of the suppression rule.
- rule_
query str - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- data_
exclusion_ strquery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- description str
- A description for the suppression rule.
- expiration_
date str - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- start_
date str - A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
- suppression_
query str - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- validate bool
- Whether to validate the suppression rule during
pulumi preview. When set totrue, the rule is validated against Datadog's suppression validation endpoint. Defaults totrue.
- enabled Boolean
- Whether the suppression rule is enabled.
- name String
- The name of the suppression rule.
- rule
Query String - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- data
Exclusion StringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- description String
- A description for the suppression rule.
- expiration
Date String - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- start
Date String - A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
- suppression
Query String - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- validate Boolean
- Whether to validate the suppression rule during
pulumi preview. When set totrue, the rule is validated against Datadog's suppression validation endpoint. Defaults totrue.
Outputs
All input properties are implicitly available as output properties. Additionally, the SecurityMonitoringSuppression resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Id string
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
- id string
- The provider-assigned unique ID for this managed resource.
- id str
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
Look up Existing SecurityMonitoringSuppression Resource
Get an existing SecurityMonitoringSuppression resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: SecurityMonitoringSuppressionState, opts?: CustomResourceOptions): SecurityMonitoringSuppression@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
data_exclusion_query: Optional[str] = None,
description: Optional[str] = None,
enabled: Optional[bool] = None,
expiration_date: Optional[str] = None,
name: Optional[str] = None,
rule_query: Optional[str] = None,
start_date: Optional[str] = None,
suppression_query: Optional[str] = None,
validate: Optional[bool] = None) -> SecurityMonitoringSuppressionfunc GetSecurityMonitoringSuppression(ctx *Context, name string, id IDInput, state *SecurityMonitoringSuppressionState, opts ...ResourceOption) (*SecurityMonitoringSuppression, error)public static SecurityMonitoringSuppression Get(string name, Input<string> id, SecurityMonitoringSuppressionState? state, CustomResourceOptions? opts = null)public static SecurityMonitoringSuppression get(String name, Output<String> id, SecurityMonitoringSuppressionState state, CustomResourceOptions options)resources: _: type: datadog:SecurityMonitoringSuppression get: id: ${id}- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Data
Exclusion stringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- Description string
- A description for the suppression rule.
- Enabled bool
- Whether the suppression rule is enabled.
- Expiration
Date string - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- Name string
- The name of the suppression rule.
- Rule
Query string - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- Start
Date string - A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
- Suppression
Query string - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- Validate bool
- Whether to validate the suppression rule during
pulumi preview. When set totrue, the rule is validated against Datadog's suppression validation endpoint. Defaults totrue.
- Data
Exclusion stringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- Description string
- A description for the suppression rule.
- Enabled bool
- Whether the suppression rule is enabled.
- Expiration
Date string - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- Name string
- The name of the suppression rule.
- Rule
Query string - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- Start
Date string - A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
- Suppression
Query string - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- Validate bool
- Whether to validate the suppression rule during
pulumi preview. When set totrue, the rule is validated against Datadog's suppression validation endpoint. Defaults totrue.
- data
Exclusion StringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- description String
- A description for the suppression rule.
- enabled Boolean
- Whether the suppression rule is enabled.
- expiration
Date String - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- name String
- The name of the suppression rule.
- rule
Query String - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- start
Date String - A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
- suppression
Query String - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- validate Boolean
- Whether to validate the suppression rule during
pulumi preview. When set totrue, the rule is validated against Datadog's suppression validation endpoint. Defaults totrue.
- data
Exclusion stringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- description string
- A description for the suppression rule.
- enabled boolean
- Whether the suppression rule is enabled.
- expiration
Date string - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- name string
- The name of the suppression rule.
- rule
Query string - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- start
Date string - A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
- suppression
Query string - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- validate boolean
- Whether to validate the suppression rule during
pulumi preview. When set totrue, the rule is validated against Datadog's suppression validation endpoint. Defaults totrue.
- data_
exclusion_ strquery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- description str
- A description for the suppression rule.
- enabled bool
- Whether the suppression rule is enabled.
- expiration_
date str - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- name str
- The name of the suppression rule.
- rule_
query str - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- start_
date str - A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
- suppression_
query str - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- validate bool
- Whether to validate the suppression rule during
pulumi preview. When set totrue, the rule is validated against Datadog's suppression validation endpoint. Defaults totrue.
- data
Exclusion StringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- description String
- A description for the suppression rule.
- enabled Boolean
- Whether the suppression rule is enabled.
- expiration
Date String - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- name String
- The name of the suppression rule.
- rule
Query String - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- start
Date String - A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
- suppression
Query String - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- validate Boolean
- Whether to validate the suppression rule during
pulumi preview. When set totrue, the rule is validated against Datadog's suppression validation endpoint. Defaults totrue.
Import
The pulumi import command can be used, for example:
Security monitoring suppressions can be imported using ID, for example:
$ pulumi import datadog:index/securityMonitoringSuppression:SecurityMonitoringSuppression my_suppression m0o-hto-lkb
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- Datadog pulumi/pulumi-datadog
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
datadogTerraform Provider.
