Docs Home Pulumi IaC Pulumi ESC Pulumi Cloud Packages Tutorials
  1. Packages
  2. Datadog Provider
  3. API Docs
  4. SecurityMonitoringSuppression
Datadog v4.36.1 published on Friday, Nov 15, 2024 by Pulumi
pulumi/pulumi-datadog

datadog.SecurityMonitoringSuppression

Explore with Pulumi AI

datadog logo
Datadog v4.36.1 published on Friday, Nov 15, 2024 by Pulumi
pulumi/pulumi-datadog

    Provides a Datadog Security Monitoring Suppression API resource. It can be used to create and manage Datadog security monitoring suppression rules.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as datadog from "@pulumi/datadog";

const mySuppression = new datadog.SecurityMonitoringSuppression("my_suppression", {
    name: "My suppression",
    description: "Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024",
    enabled: true,
    ruleQuery: "severity:low source:cloudtrail",
    suppressionQuery: "@usr.id:john.doe",
    dataExclusionQuery: "env:test",
    expirationDate: "2024-12-31T12:00:00Z",
});

    import pulumi
import pulumi_datadog as datadog

my_suppression = datadog.SecurityMonitoringSuppression("my_suppression",
    name="My suppression",
    description="Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024",
    enabled=True,
    rule_query="severity:low source:cloudtrail",
    suppression_query="@usr.id:john.doe",
    data_exclusion_query="env:test",
    expiration_date="2024-12-31T12:00:00Z")

    package main

import (
	"github.com/pulumi/pulumi-datadog/sdk/v4/go/datadog"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := datadog.NewSecurityMonitoringSuppression(ctx, "my_suppression", &datadog.SecurityMonitoringSuppressionArgs{
			Name:               pulumi.String("My suppression"),
			Description:        pulumi.String("Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024"),
			Enabled:            pulumi.Bool(true),
			RuleQuery:          pulumi.String("severity:low source:cloudtrail"),
			SuppressionQuery:   pulumi.String("@usr.id:john.doe"),
			DataExclusionQuery: pulumi.String("env:test"),
			ExpirationDate:     pulumi.String("2024-12-31T12:00:00Z"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Datadog = Pulumi.Datadog;

return await Deployment.RunAsync(() => 
{
    var mySuppression = new Datadog.SecurityMonitoringSuppression("my_suppression", new()
    {
        Name = "My suppression",
        Description = "Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024",
        Enabled = true,
        RuleQuery = "severity:low source:cloudtrail",
        SuppressionQuery = "@usr.id:john.doe",
        DataExclusionQuery = "env:test",
        ExpirationDate = "2024-12-31T12:00:00Z",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.datadog.SecurityMonitoringSuppression;
import com.pulumi.datadog.SecurityMonitoringSuppressionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var mySuppression = new SecurityMonitoringSuppression("mySuppression", SecurityMonitoringSuppressionArgs.builder()
            .name("My suppression")
            .description("Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024")
            .enabled(true)
            .ruleQuery("severity:low source:cloudtrail")
            .suppressionQuery("@usr.id:john.doe")
            .dataExclusionQuery("env:test")
            .expirationDate("2024-12-31T12:00:00Z")
            .build());

    }
}

    resources:
  mySuppression:
    type: datadog:SecurityMonitoringSuppression
    name: my_suppression
    properties:
      name: My suppression
      description: Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024
      enabled: true
      ruleQuery: severity:low source:cloudtrail
      suppressionQuery: '@usr.id:john.doe'
      dataExclusionQuery: env:test
      expirationDate: 2024-12-31T12:00:00Z

    Create SecurityMonitoringSuppression Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecurityMonitoringSuppression(name: string, args: SecurityMonitoringSuppressionArgs, opts?: CustomResourceOptions);
    @overload
def SecurityMonitoringSuppression(resource_name: str,
                                  args: SecurityMonitoringSuppressionArgs,
                                  opts: Optional[ResourceOptions] = None)

@overload
def SecurityMonitoringSuppression(resource_name: str,
                                  opts: Optional[ResourceOptions] = None,
                                  enabled: Optional[bool] = None,
                                  name: Optional[str] = None,
                                  rule_query: Optional[str] = None,
                                  data_exclusion_query: Optional[str] = None,
                                  description: Optional[str] = None,
                                  expiration_date: Optional[str] = None,
                                  suppression_query: Optional[str] = None)
    func NewSecurityMonitoringSuppression(ctx *Context, name string, args SecurityMonitoringSuppressionArgs, opts ...ResourceOption) (*SecurityMonitoringSuppression, error)
    public SecurityMonitoringSuppression(string name, SecurityMonitoringSuppressionArgs args, CustomResourceOptions? opts = null)
    public SecurityMonitoringSuppression(String name, SecurityMonitoringSuppressionArgs args)
public SecurityMonitoringSuppression(String name, SecurityMonitoringSuppressionArgs args, CustomResourceOptions options)

    type: datadog:SecurityMonitoringSuppression
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args SecurityMonitoringSuppressionArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecurityMonitoringSuppressionArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecurityMonitoringSuppressionArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecurityMonitoringSuppressionArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecurityMonitoringSuppressionArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var securityMonitoringSuppressionResource = new Datadog.SecurityMonitoringSuppression("securityMonitoringSuppressionResource", new()
{
    Enabled = false,
    Name = "string",
    RuleQuery = "string",
    DataExclusionQuery = "string",
    Description = "string",
    ExpirationDate = "string",
    SuppressionQuery = "string",
});

    example, err := datadog.NewSecurityMonitoringSuppression(ctx, "securityMonitoringSuppressionResource", &datadog.SecurityMonitoringSuppressionArgs{
	Enabled:            pulumi.Bool(false),
	Name:               pulumi.String("string"),
	RuleQuery:          pulumi.String("string"),
	DataExclusionQuery: pulumi.String("string"),
	Description:        pulumi.String("string"),
	ExpirationDate:     pulumi.String("string"),
	SuppressionQuery:   pulumi.String("string"),
})

    var securityMonitoringSuppressionResource = new SecurityMonitoringSuppression("securityMonitoringSuppressionResource", SecurityMonitoringSuppressionArgs.builder()
    .enabled(false)
    .name("string")
    .ruleQuery("string")
    .dataExclusionQuery("string")
    .description("string")
    .expirationDate("string")
    .suppressionQuery("string")
    .build());

    security_monitoring_suppression_resource = datadog.SecurityMonitoringSuppression("securityMonitoringSuppressionResource",
    enabled=False,
    name="string",
    rule_query="string",
    data_exclusion_query="string",
    description="string",
    expiration_date="string",
    suppression_query="string")

    const securityMonitoringSuppressionResource = new datadog.SecurityMonitoringSuppression("securityMonitoringSuppressionResource", {
    enabled: false,
    name: "string",
    ruleQuery: "string",
    dataExclusionQuery: "string",
    description: "string",
    expirationDate: "string",
    suppressionQuery: "string",
});

    type: datadog:SecurityMonitoringSuppression
properties:
    dataExclusionQuery: string
    description: string
    enabled: false
    expirationDate: string
    name: string
    ruleQuery: string
    suppressionQuery: string

    SecurityMonitoringSuppression Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecurityMonitoringSuppression resource accepts the following input properties:

    Enabled bool
    Whether the suppression rule is enabled.
    Name string
    The name of the suppression rule.
    RuleQuery string
    The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
    DataExclusionQuery string
    An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
    Description string
    A description for the suppression rule.
    ExpirationDate string
    A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
    SuppressionQuery string
    The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
    Enabled bool
    Whether the suppression rule is enabled.
    Name string
    The name of the suppression rule.
    RuleQuery string
    The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
    DataExclusionQuery string
    An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
    Description string
    A description for the suppression rule.
    ExpirationDate string
    A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
    SuppressionQuery string
    The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
    enabled Boolean
    Whether the suppression rule is enabled.
    name String
    The name of the suppression rule.
    ruleQuery String
    The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
    dataExclusionQuery String
    An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
    description String
    A description for the suppression rule.
    expirationDate String
    A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
    suppressionQuery String
    The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
    enabled boolean
    Whether the suppression rule is enabled.
    name string
    The name of the suppression rule.
    ruleQuery string
    The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
    dataExclusionQuery string
    An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
    description string
    A description for the suppression rule.
    expirationDate string
    A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
    suppressionQuery string
    The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
    enabled bool
    Whether the suppression rule is enabled.
    name str
    The name of the suppression rule.
    rule_query str
    The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
    data_exclusion_query str
    An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
    description str
    A description for the suppression rule.
    expiration_date str
    A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
    suppression_query str
    The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
    enabled Boolean
    Whether the suppression rule is enabled.
    name String
    The name of the suppression rule.
    ruleQuery String
    The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
    dataExclusionQuery String
    An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
    description String
    A description for the suppression rule.
    expirationDate String
    A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
    suppressionQuery String
    The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecurityMonitoringSuppression resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing SecurityMonitoringSuppression Resource

    Get an existing SecurityMonitoringSuppression resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecurityMonitoringSuppressionState, opts?: CustomResourceOptions): SecurityMonitoringSuppression
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        data_exclusion_query: Optional[str] = None,
        description: Optional[str] = None,
        enabled: Optional[bool] = None,
        expiration_date: Optional[str] = None,
        name: Optional[str] = None,
        rule_query: Optional[str] = None,
        suppression_query: Optional[str] = None) -> SecurityMonitoringSuppression
    func GetSecurityMonitoringSuppression(ctx *Context, name string, id IDInput, state *SecurityMonitoringSuppressionState, opts ...ResourceOption) (*SecurityMonitoringSuppression, error)
    public static SecurityMonitoringSuppression Get(string name, Input<string> id, SecurityMonitoringSuppressionState? state, CustomResourceOptions? opts = null)
    public static SecurityMonitoringSuppression get(String name, Output<String> id, SecurityMonitoringSuppressionState state, CustomResourceOptions options)
    Resource lookup is not supported in YAML
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    DataExclusionQuery string
    An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
    Description string
    A description for the suppression rule.
    Enabled bool
    Whether the suppression rule is enabled.
    ExpirationDate string
    A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
    Name string
    The name of the suppression rule.
    RuleQuery string
    The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
    SuppressionQuery string
    The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
    DataExclusionQuery string
    An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
    Description string
    A description for the suppression rule.
    Enabled bool
    Whether the suppression rule is enabled.
    ExpirationDate string
    A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
    Name string
    The name of the suppression rule.
    RuleQuery string
    The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
    SuppressionQuery string
    The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
    dataExclusionQuery String
    An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
    description String
    A description for the suppression rule.
    enabled Boolean
    Whether the suppression rule is enabled.
    expirationDate String
    A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
    name String
    The name of the suppression rule.
    ruleQuery String
    The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
    suppressionQuery String
    The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
    dataExclusionQuery string
    An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
    description string
    A description for the suppression rule.
    enabled boolean
    Whether the suppression rule is enabled.
    expirationDate string
    A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
    name string
    The name of the suppression rule.
    ruleQuery string
    The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
    suppressionQuery string
    The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
    data_exclusion_query str
    An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
    description str
    A description for the suppression rule.
    enabled bool
    Whether the suppression rule is enabled.
    expiration_date str
    A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
    name str
    The name of the suppression rule.
    rule_query str
    The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
    suppression_query str
    The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
    dataExclusionQuery String
    An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
    description String
    A description for the suppression rule.
    enabled Boolean
    Whether the suppression rule is enabled.
    expirationDate String
    A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
    name String
    The name of the suppression rule.
    ruleQuery String
    The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
    suppressionQuery String
    The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.

    Import

    Security monitoring suppressions can be imported using ID, for example:

    $ pulumi import datadog:index/securityMonitoringSuppression:SecurityMonitoringSuppression my_suppression m0o-hto-lkb

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Datadog pulumi/pulumi-datadog
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the datadog Terraform Provider.
    datadog logo
    Datadog v4.36.1 published on Friday, Nov 15, 2024 by Pulumi
    pulumi/pulumi-datadog