datadog.SecurityMonitoringSuppression
Explore with Pulumi AI
Provides a Datadog Security Monitoring Suppression API resource. It can be used to create and manage Datadog security monitoring suppression rules.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as datadog from "@pulumi/datadog";
const mySuppression = new datadog.SecurityMonitoringSuppression("my_suppression", {
name: "My suppression",
description: "Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024",
enabled: true,
ruleQuery: "severity:low source:cloudtrail",
suppressionQuery: "@usr.id:john.doe",
dataExclusionQuery: "env:test",
expirationDate: "2024-12-31T12:00:00Z",
});
import pulumi
import pulumi_datadog as datadog
my_suppression = datadog.SecurityMonitoringSuppression("my_suppression",
name="My suppression",
description="Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024",
enabled=True,
rule_query="severity:low source:cloudtrail",
suppression_query="@usr.id:john.doe",
data_exclusion_query="env:test",
expiration_date="2024-12-31T12:00:00Z")
package main
import (
"github.com/pulumi/pulumi-datadog/sdk/v4/go/datadog"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := datadog.NewSecurityMonitoringSuppression(ctx, "my_suppression", &datadog.SecurityMonitoringSuppressionArgs{
Name: pulumi.String("My suppression"),
Description: pulumi.String("Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024"),
Enabled: pulumi.Bool(true),
RuleQuery: pulumi.String("severity:low source:cloudtrail"),
SuppressionQuery: pulumi.String("@usr.id:john.doe"),
DataExclusionQuery: pulumi.String("env:test"),
ExpirationDate: pulumi.String("2024-12-31T12:00:00Z"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Datadog = Pulumi.Datadog;
return await Deployment.RunAsync(() =>
{
var mySuppression = new Datadog.SecurityMonitoringSuppression("my_suppression", new()
{
Name = "My suppression",
Description = "Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024",
Enabled = true,
RuleQuery = "severity:low source:cloudtrail",
SuppressionQuery = "@usr.id:john.doe",
DataExclusionQuery = "env:test",
ExpirationDate = "2024-12-31T12:00:00Z",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.datadog.SecurityMonitoringSuppression;
import com.pulumi.datadog.SecurityMonitoringSuppressionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var mySuppression = new SecurityMonitoringSuppression("mySuppression", SecurityMonitoringSuppressionArgs.builder()
.name("My suppression")
.description("Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024")
.enabled(true)
.ruleQuery("severity:low source:cloudtrail")
.suppressionQuery("@usr.id:john.doe")
.dataExclusionQuery("env:test")
.expirationDate("2024-12-31T12:00:00Z")
.build());
}
}
resources:
mySuppression:
type: datadog:SecurityMonitoringSuppression
name: my_suppression
properties:
name: My suppression
description: Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024
enabled: true
ruleQuery: severity:low source:cloudtrail
suppressionQuery: '@usr.id:john.doe'
dataExclusionQuery: env:test
expirationDate: 2024-12-31T12:00:00Z
Create SecurityMonitoringSuppression Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new SecurityMonitoringSuppression(name: string, args: SecurityMonitoringSuppressionArgs, opts?: CustomResourceOptions);
@overload
def SecurityMonitoringSuppression(resource_name: str,
args: SecurityMonitoringSuppressionArgs,
opts: Optional[ResourceOptions] = None)
@overload
def SecurityMonitoringSuppression(resource_name: str,
opts: Optional[ResourceOptions] = None,
enabled: Optional[bool] = None,
name: Optional[str] = None,
rule_query: Optional[str] = None,
data_exclusion_query: Optional[str] = None,
description: Optional[str] = None,
expiration_date: Optional[str] = None,
suppression_query: Optional[str] = None)
func NewSecurityMonitoringSuppression(ctx *Context, name string, args SecurityMonitoringSuppressionArgs, opts ...ResourceOption) (*SecurityMonitoringSuppression, error)
public SecurityMonitoringSuppression(string name, SecurityMonitoringSuppressionArgs args, CustomResourceOptions? opts = null)
public SecurityMonitoringSuppression(String name, SecurityMonitoringSuppressionArgs args)
public SecurityMonitoringSuppression(String name, SecurityMonitoringSuppressionArgs args, CustomResourceOptions options)
type: datadog:SecurityMonitoringSuppression
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args SecurityMonitoringSuppressionArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args SecurityMonitoringSuppressionArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args SecurityMonitoringSuppressionArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args SecurityMonitoringSuppressionArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args SecurityMonitoringSuppressionArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var securityMonitoringSuppressionResource = new Datadog.SecurityMonitoringSuppression("securityMonitoringSuppressionResource", new()
{
Enabled = false,
Name = "string",
RuleQuery = "string",
DataExclusionQuery = "string",
Description = "string",
ExpirationDate = "string",
SuppressionQuery = "string",
});
example, err := datadog.NewSecurityMonitoringSuppression(ctx, "securityMonitoringSuppressionResource", &datadog.SecurityMonitoringSuppressionArgs{
Enabled: pulumi.Bool(false),
Name: pulumi.String("string"),
RuleQuery: pulumi.String("string"),
DataExclusionQuery: pulumi.String("string"),
Description: pulumi.String("string"),
ExpirationDate: pulumi.String("string"),
SuppressionQuery: pulumi.String("string"),
})
var securityMonitoringSuppressionResource = new SecurityMonitoringSuppression("securityMonitoringSuppressionResource", SecurityMonitoringSuppressionArgs.builder()
.enabled(false)
.name("string")
.ruleQuery("string")
.dataExclusionQuery("string")
.description("string")
.expirationDate("string")
.suppressionQuery("string")
.build());
security_monitoring_suppression_resource = datadog.SecurityMonitoringSuppression("securityMonitoringSuppressionResource",
enabled=False,
name="string",
rule_query="string",
data_exclusion_query="string",
description="string",
expiration_date="string",
suppression_query="string")
const securityMonitoringSuppressionResource = new datadog.SecurityMonitoringSuppression("securityMonitoringSuppressionResource", {
enabled: false,
name: "string",
ruleQuery: "string",
dataExclusionQuery: "string",
description: "string",
expirationDate: "string",
suppressionQuery: "string",
});
type: datadog:SecurityMonitoringSuppression
properties:
dataExclusionQuery: string
description: string
enabled: false
expirationDate: string
name: string
ruleQuery: string
suppressionQuery: string
SecurityMonitoringSuppression Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
The SecurityMonitoringSuppression resource accepts the following input properties:
- Enabled bool
- Whether the suppression rule is enabled.
- Name string
- The name of the suppression rule.
- Rule
Query string - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- Data
Exclusion stringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- Description string
- A description for the suppression rule.
- Expiration
Date string - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- Suppression
Query string - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- Enabled bool
- Whether the suppression rule is enabled.
- Name string
- The name of the suppression rule.
- Rule
Query string - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- Data
Exclusion stringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- Description string
- A description for the suppression rule.
- Expiration
Date string - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- Suppression
Query string - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- enabled Boolean
- Whether the suppression rule is enabled.
- name String
- The name of the suppression rule.
- rule
Query String - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- data
Exclusion StringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- description String
- A description for the suppression rule.
- expiration
Date String - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- suppression
Query String - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- enabled boolean
- Whether the suppression rule is enabled.
- name string
- The name of the suppression rule.
- rule
Query string - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- data
Exclusion stringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- description string
- A description for the suppression rule.
- expiration
Date string - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- suppression
Query string - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- enabled bool
- Whether the suppression rule is enabled.
- name str
- The name of the suppression rule.
- rule_
query str - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- data_
exclusion_ strquery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- description str
- A description for the suppression rule.
- expiration_
date str - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- suppression_
query str - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- enabled Boolean
- Whether the suppression rule is enabled.
- name String
- The name of the suppression rule.
- rule
Query String - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- data
Exclusion StringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- description String
- A description for the suppression rule.
- expiration
Date String - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- suppression
Query String - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
Outputs
All input properties are implicitly available as output properties. Additionally, the SecurityMonitoringSuppression resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Id string
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
- id string
- The provider-assigned unique ID for this managed resource.
- id str
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
Look up Existing SecurityMonitoringSuppression Resource
Get an existing SecurityMonitoringSuppression resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: SecurityMonitoringSuppressionState, opts?: CustomResourceOptions): SecurityMonitoringSuppression
@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
data_exclusion_query: Optional[str] = None,
description: Optional[str] = None,
enabled: Optional[bool] = None,
expiration_date: Optional[str] = None,
name: Optional[str] = None,
rule_query: Optional[str] = None,
suppression_query: Optional[str] = None) -> SecurityMonitoringSuppression
func GetSecurityMonitoringSuppression(ctx *Context, name string, id IDInput, state *SecurityMonitoringSuppressionState, opts ...ResourceOption) (*SecurityMonitoringSuppression, error)
public static SecurityMonitoringSuppression Get(string name, Input<string> id, SecurityMonitoringSuppressionState? state, CustomResourceOptions? opts = null)
public static SecurityMonitoringSuppression get(String name, Output<String> id, SecurityMonitoringSuppressionState state, CustomResourceOptions options)
Resource lookup is not supported in YAML
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Data
Exclusion stringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- Description string
- A description for the suppression rule.
- Enabled bool
- Whether the suppression rule is enabled.
- Expiration
Date string - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- Name string
- The name of the suppression rule.
- Rule
Query string - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- Suppression
Query string - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- Data
Exclusion stringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- Description string
- A description for the suppression rule.
- Enabled bool
- Whether the suppression rule is enabled.
- Expiration
Date string - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- Name string
- The name of the suppression rule.
- Rule
Query string - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- Suppression
Query string - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- data
Exclusion StringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- description String
- A description for the suppression rule.
- enabled Boolean
- Whether the suppression rule is enabled.
- expiration
Date String - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- name String
- The name of the suppression rule.
- rule
Query String - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- suppression
Query String - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- data
Exclusion stringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- description string
- A description for the suppression rule.
- enabled boolean
- Whether the suppression rule is enabled.
- expiration
Date string - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- name string
- The name of the suppression rule.
- rule
Query string - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- suppression
Query string - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- data_
exclusion_ strquery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- description str
- A description for the suppression rule.
- enabled bool
- Whether the suppression rule is enabled.
- expiration_
date str - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- name str
- The name of the suppression rule.
- rule_
query str - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- suppression_
query str - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
- data
Exclusion StringQuery - An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
- description String
- A description for the suppression rule.
- enabled Boolean
- Whether the suppression rule is enabled.
- expiration
Date String - A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
- name String
- The name of the suppression rule.
- rule
Query String - The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
- suppression
Query String - The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
Import
Security monitoring suppressions can be imported using ID, for example:
$ pulumi import datadog:index/securityMonitoringSuppression:SecurityMonitoringSuppression my_suppression m0o-hto-lkb
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- Datadog pulumi/pulumi-datadog
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
datadog
Terraform Provider.