create_security_monitoring_rules
Create detection rules to monitor security events and identify potential threats in your Datadog environment.
Instructions
Create a detection rule.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
This server cannot be installed
Other Tools from MCP Datadog Server
- aggregate_ci_pipelines_analytics
- aggregate_ci_tests_analytics
- aggregate_logs_analytics
- aggregate_network_connections
- aggregate_network_dns
- aggregate_rum_analytics
- aggregate_spans_analytics
- can_delete_monitors
- can_delete_slos
- create_actions_connections
- create_agentless_scanning_accounts_aws
- create_agentless_scanning_ondemand_aws
- create_api_keys
- create_apm_config_metrics
- create_apm_config_retention_filters
- create_app_builder_app_deployment
- create_app_builder_apps
- create_application_keys
- create_authn_mappings
- create_case_archive
- create_case_assign
- create_case_attributes
- create_case_priority
- create_cases
- create_cases_projects
- create_case_status
- create_case_unarchive
- create_case_unassign
- create_catalog_entities
- create_catalog_kinds
- create_check_runs
- create_ci_pipelines
- create_cloud_security_management_custom_frameworks
- create_cost_aws_cur_configs
- create_cost_azure_uc_configs
- create_cost_gcp_uc_configs
- create_current_user_application_keys
- create_dashboard_lists_manual_dashboards
- create_dashboard_lists_manuals
- create_dashboard_public_invitation
- create_dashboard_publics
- create_dashboards
- create_dashboard_v1
- create_dora_deployments_v2
- create_dora_deployments_v2_2
- create_dora_failures_v2
- create_dora_failures_v2_2
- create_downtimes
- create_events
- create_graph_embeds
- create_integration_aws
- create_integration_aws_event_bridges
- create_integration_aws_filterings
- create_integration_aws_logs
- create_integration_aws_logs_check_asyncs
- create_integration_aws_logs_services
- create_integration_aws_logs_services_asyncs
- create_integration_azure_host_filters
- create_integration_azures
- create_integration_gcp_accounts
- create_integration_gcp_sts_delegates
- create_integration_ms_teams_configuration_tenant_based_handles
- create_integration_ms_teams_configuration_workflows_webhook_handles
- create_integration_opsgenie_services
- create_integration_pagerduty_configuration_services
- create_integrations_cloudflare_accounts
- create_integrations_confluent_cloud_account_resources
- create_integrations_confluent_cloud_accounts
- create_integrations_fastly_accounts
- create_integrations_fastly_account_services
- create_integration_slack_configuration_account_channels
- create_integrations_okta_accounts
- create_integration_webhooks_configuration_custom_variables
- create_integration_webhooks_configuration_webhooks
- create_logs_config_archive_readers
- create_logs_config_archives
- create_logs_config_custom_destinations
- create_logs_config_indexes
- create_logs_config_metrics
- create_logs_config_pipelines
- create_metrics_config_bulk_tags
- create_metric_tags
- create_monitor
- create_monitor_notification_rules
- create_monitor_policies
- create_monitor_v1
- create_notebooks
- create_on_call_escalation_policies
- create_on_call_schedules
- create_org_downgrade
- create_orgs
- create_powerpacks
- create_remote_config_products_asm_waf_custom_rules
- create_remote_config_products_asm_waf_exclusion_filters
- create_remote_config_products_cws_agent_rules
- create_remote_config_products_cws_policies
- create_restriction_policy
- create_role_clone
- create_role_permissions
- create_roles
- create_role_users
- create_rum_application_retention_filters
- create_rum_applications
- create_rum_config_metrics
- create_saml_configurations_idp_metadatas
- create_security_monitoring_cloud_workload_security_agent_rules
- create_security_monitoring_configuration_security_filters
- create_security_monitoring_configuration_suppressions
- create_security_monitoring_configuration_suppressions_rules
- create_security_monitoring_configuration_suppressions_validations
- create_security_monitoring_rules
- create_security_monitoring_rules_converts
- create_security_monitoring_rules_tests
- create_security_monitoring_rules_validations
- create_security_monitoring_rule_test
- create_security_signals_notification_rules
- create_security_vulnerabilities_notification_rules
- create_sensitive_data_scanner_config_groups
- create_sensitive_data_scanner_config_rules
- create_service_account_application_keys
- create_service_accounts
- create_services_definitions
- create_slo_bulk_deletes
- create_slo_corrections
- create_slos
- create_synthetics_private_locations
- create_synthetics_settings_on_demand_concurrency_caps
- create_synthetics_tests
- create_synthetics_tests_browsers
- create_synthetics_tests_deletes
- create_synthetics_tests_mobiles
- create_synthetics_tests_trigger_cis
- create_synthetics_tests_triggers
- create_synthetics_tests_uptimes
- create_synthetics_variables
- create_tags_host
- create_team_links
- create_team_memberships
- create_teams
- create_user_invitations
- create_users
- create_workflow_instances
- create_workflows
- delete_actions_app_key_registration
- delete_actions_connection
- delete_agentless_scanning_accounts_aw
- delete_api_key
- delete_apm_config_metric
- delete_apm_config_retention_filter
- delete_app_builder_app
- delete_app_builder_app_deployment
- delete_app_builder_apps
- delete_application_key
- delete_authn_mapping
- delete_cases_project
- delete_catalog_entity
- delete_catalog_kind
- delete_cloud_security_management_custom_framework
- delete_cost_aws_cur_config
- delete_cost_azure_uc_config
- delete_cost_budget
- delete_cost_custom_cost
- delete_cost_gcp_uc_config
- delete_current_user_application_key
- delete_dashboard
- delete_dashboard_lists_manual
- delete_dashboard_lists_manual_dashboards
- delete_dashboard_public
- delete_dashboard_public_invitation
- delete_dashboards
- delete_dashboard_v1
- delete_downtime
- delete_integration_aws
- delete_integration_aws_event_bridges
- delete_integration_aws_filterings
- delete_integration_aws_logs
- delete_integration_azures
- delete_integration_gcp_account
- delete_integration_ms_teams_configuration_tenant_based_handle
- delete_integration_ms_teams_configuration_workflows_webhook_handle
- delete_integration_opsgenie_service
- delete_integration_pagerduty_configuration_service
- delete_integrations_cloudflare_account
- delete_integrations_confluent_cloud_account
- delete_integrations_confluent_cloud_account_resources
- delete_integrations_fastly_account
- delete_integrations_fastly_account_services
- delete_integration_slack_configuration_account_channels
- delete_integrations_okta_account
- delete_integration_webhooks_configuration_custom_variable
- delete_integration_webhooks_configuration_webhook
- delete_logs_config_archive
- delete_logs_config_archive_readers
- delete_logs_config_custom_destination
- delete_logs_config_indexe
- delete_logs_config_metric
- delete_logs_config_pipeline
- delete_metrics_config_bulk_tags
- delete_metric_tags
- delete_monitor
- delete_monitor_notification_rule
- delete_monitor_policy
- delete_monitor_v1
- delete_notebook
- delete_on_call_escalation_policy
- delete_on_call_schedule
- delete_powerpack
- delete_remote_config_products_asm_waf_custom_rule
- delete_remote_config_products_asm_waf_exclusion_filter
- delete_remote_config_products_cws_agent_rule
- delete_remote_config_products_cws_policy
- delete_restriction_policy
- delete_role
- delete_role_permissions
- delete_role_users
- delete_rum_application
- delete_rum_application_retention_filters
- delete_rum_config_metric
- delete_security_monitoring_cloud_workload_security_agent_rule
- delete_security_monitoring_configuration_security_filter
- delete_security_monitoring_configuration_suppression
- delete_security_monitoring_rule
- delete_security_signals_notification_rule
- delete_security_vulnerabilities_notification_rule
- delete_sensitive_data_scanner_config_group
- delete_sensitive_data_scanner_config_rule
- delete_service_account_application_keys
- delete_services_definition
- delete_slo
- delete_slo_correction
- delete_synthetics_private_location
- delete_synthetics_variable
- delete_tags_host
- delete_team
- delete_team_links
- delete_team_memberships
- delete_user
- delete_workflow
- downtimes_cancel
- downtimes_create
- downtimes_list
- estimate_metric
- events_list
- events_post
- get_actions_app_key_registration
- get_actions_app_key_registrations
- get_actions_connection
- get_agentless_scanning_accounts_aw
- get_agentless_scanning_accounts_aws
- get_agentless_scanning_ondemand_aw
- get_agentless_scanning_ondemand_aws
- get_api_key
- get_api_keys
- get_apm_config_metric
- get_apm_config_metrics
- get_apm_config_retention_filter
- get_apm_config_retention_filters
- get_app_builder_app
- get_app_builder_apps
- get_application_key
- get_application_keys
- get_audit_events
- get_authn_mapping
- get_authn_mappings
- get_case
- get_cases
- get_cases_project
- get_cases_projects
- get_catalog_entities
- get_catalog_kinds
- get_catalog_relations
- get_ci_pipelines_events
- get_ci_tests_events
- get_cloud_security_management_custom_framework
- get_cloud_security_management_resource_filters
- get_container_images
- get_containers
- get_cost_aws_cur_configs
- get_cost_azure_uc_configs
- get_cost_budget
- get_cost_budgets
- get_cost_by_tag_active_billing_dimensions
- get_cost_by_tag_monthly_cost_attributions
- get_cost_custom_cost
- get_cost_custom_costs
- get_cost_gcp_uc_configs
- get_csm_onboarding_agents
- get_csm_onboarding_coverage_analysis_cloud_accounts
- get_csm_onboarding_coverage_analysis_hosts_and_containers
- get_csm_onboarding_coverage_analysis_serverless
- get_csm_onboarding_serverless_agents
- get_current_user_application_key
- get_current_user_application_keys
- get_dashboard
- get_dashboard_by_id
- get_dashboard_lists_manual
- get_dashboard_lists_manual_dashboards
- get_dashboard_lists_manuals
- get_dashboard_public
- get_dashboard_public_invitation
- get_dashboards
- get_domain_allowlists
- get_dora_deployment
- get_dora_failure
- get_downtime
- get_downtimes
- get_error_tracking_issue
- get_event
- get_events
- get_graph_embed
- get_graph_embed_enable
- get_graph_embed_revoke
- get_graph_embeds
- get_graph_snapshots
- get_hosts
- get_hosts_totals
- get_integration_aws
- get_integration_aws_available_namespace_rules
- get_integration_aws_event_bridges
- get_integration_aws_filterings
- get_integration_aws_iam_permissions
- get_integration_aws_logs
- get_integration_aws_logs_services
- get_integration_azures
- get_integration_gcp_accounts
- get_integration_gcp_sts_delegates
- get_integration_ms_teams_configuration_channel
- get_integration_ms_teams_configuration_tenant_based_handle
- get_integration_ms_teams_configuration_tenant_based_handles
- get_integration_ms_teams_configuration_workflows_webhook_handle
- get_integration_ms_teams_configuration_workflows_webhook_handles
- get_integration_opsgenie_service
- get_integration_opsgenie_services
- get_integration_pagerduty_configuration_service
- get_integrations_cloudflare_account
- get_integrations_cloudflare_accounts
- get_integrations_confluent_cloud_account
- get_integrations_confluent_cloud_account_resources_v2
- get_integrations_confluent_cloud_account_resources_v2_2
- get_integrations_confluent_cloud_accounts
- get_integrations_fastly_account
- get_integrations_fastly_accounts
- get_integrations_fastly_account_services_v2
- get_integrations_fastly_account_services_v2_2
- get_integration_slack_configuration_account_channels_v1
- get_integration_slack_configuration_account_channels_v1_2
- get_integrations_okta_account
- get_integrations_okta_accounts
- get_integration_webhooks_configuration_custom_variable
- get_integration_webhooks_configuration_webhook
- get_ip_allowlists
- get_logs_config_archive
- get_logs_config_archive_orders
- get_logs_config_archive_readers
- get_logs_config_archives
- get_logs_config_custom_destination
- get_logs_config_custom_destinations
- get_logs_config_indexe
- get_logs_config_indexes
- get_logs_config_index_orders
- get_logs_config_metric
- get_logs_config_metrics
- get_logs_config_pipeline
- get_logs_config_pipeline_orders
- get_logs_config_pipelines
- get_logs_events
- get_metric
- get_metric_active_configurations
- get_metric_all_tags
- get_metric_assets
- get_metrics_v1
- get_metrics_v2
- get_metric_tag_cardinalities
- get_metric_tags
- get_metric_volumes
- get_monitor
- get_monitor_by_id
- get_monitor_downtime_matches
- get_monitor_notification_rule
- get_monitor_notification_rules
- get_monitor_policies
- get_monitor_policy
- get_monitors
- get_ndm_device
- get_ndm_devices
- get_ndm_interfaces
- get_ndm_tags_device
- get_notebook
- get_notebooks
- get_on_call_escalation_policy
- get_on_call_schedule
- get_on_call_schedule_on_call
- get_on_call_team_on_call
- get_on_call_team_routing_rules
- get_org
- get_org_config
- get_org_configs
- get_orgs
- get_permissions
- get_powerpack
- get_powerpacks
- get_processes
- get_remote_config_products_asm_waf_custom_rule
- get_remote_config_products_asm_waf_custom_rules
- get_remote_config_products_asm_waf_exclusion_filter
- get_remote_config_products_asm_waf_exclusion_filters
- get_remote_config_products_cws_agent_rule
- get_remote_config_products_cws_agent_rules
- get_remote_config_products_cws_policies
- get_remote_config_products_cws_policy
- get_remote_config_products_cws_policy_downloads
- get_resources
- get_restriction_policy
- get_role
- get_role_permissions
- get_roles
- get_role_users
- get_rum_application
- get_rum_application_retention_filters_v2
- get_rum_application_retention_filters_v2_2
- get_rum_applications
- get_rum_config_metric
- get_rum_config_metrics
- get_rum_events
- get_security_cloud_workload_policy_downloads
- get_security_monitoring_cloud_workload_security_agent_rule
- get_security_monitoring_cloud_workload_security_agent_rules
- get_security_monitoring_configuration_security_filter
- get_security_monitoring_configuration_security_filters
- get_security_monitoring_configuration_suppression
- get_security_monitoring_configuration_suppressions
- get_security_monitoring_configuration_suppressions_rule
- get_security_monitoring_rule
- get_security_monitoring_rule_convert
- get_security_monitoring_rules
- get_security_monitoring_signal
- get_security_monitoring_signals
- get_security_signals_notification_rule
- get_security_signals_notification_rules
- get_security_vulnerabilities_notification_rule
- get_security_vulnerabilities_notification_rules
- get_sensitive_data_scanner_configs
- get_sensitive_data_scanner_config_standard_patterns
- get_service_account_application_keys_v2
- get_service_account_application_keys_v2_2
- get_services_definition
- get_services_definitions
- get_slo
- get_slo_correction
- get_slo_corrections_v1
- get_slo_corrections_v1_2
- get_slo_history
- get_slos
- get_spans_events
- get_synthetics_ci_batch
- get_synthetics_locations
- get_synthetics_private_location
- get_synthetics_settings_default_locations
- get_synthetics_settings_on_demand_concurrency_caps
- get_synthetics_test_results_v1
- get_synthetics_test_results_v1_2
- get_synthetics_tests
- get_synthetics_tests_browser
- get_synthetics_tests_browser_results_v1
- get_synthetics_tests_browser_results_v1_2
- get_synthetics_tests_mobile
- get_synthetics_test_v1
- get_synthetics_test_v1_2
- get_synthetics_variable
- get_synthetics_variables
- get_tags_host
- get_tags_hosts
- get_team
- get_team_links_v2
- get_team_links_v2_2
- get_team_memberships
- get_team_permission_settings
- get_teams
- get_usage_billable_summaries
- get_usage_billing_dimension_mappings
- get_usage_estimated_costs
- get_usage_historical_costs
- get_usage_hourly_attributions
- get_usage_hourly_usages
- get_usage_logs_by_indexs
- get_usage_monthly_attributions
- get_usage_projected_costs
- get_usage_summaries
- get_usage_top_avg_metrics
- get_user
- get_user_invitation
- get_user_memberships
- get_user_orgs
- get_user_permissions
- get_users
- get_workflow
- get_workflow_instances_v2
- get_workflow_instances_v2_2
- incidents_create
- incidents_get
- incidents_list
- incidents_update
- list_dashboards
- list_monitors
- logs_aggregate_analytics
- logs_search_events
- logs_send
- metrics_query_scalars
- metrics_query_timeseries
- metrics_submit_series
- mute_host
- mute_monitor
- mute_monitor_v1
- notebooks_create
- notebooks_delete
- notebooks_get
- notebooks_list
- notebooks_update
- query_resources
- query_scalars
- query_timeseries
- roles_get
- roles_list
- search_audit_events
- search_ci_pipelines_events
- search_ci_tests_events
- search_error_tracking_issues
- search_events
- search_logs_events
- search_monitor_groups
- search_monitors
- search_resources
- search_rum_events
- search_security_monitoring_signals
- search_slos
- search_spans_events
- search_synthetics_tests
- send_logs
- slos_create
- slos_delete
- slos_get
- slos_list
- slos_update
- submit_distribution_points
- submit_series
- synthetics_create_test
- synthetics_delete_test
- synthetics_get_test
- synthetics_list_tests
- synthetics_update_test
- teams_get
- teams_list
- unmute_host
- unmute_monitor
- unmute_monitor_v1
- update_actions_app_key_registration
- update_actions_connection
- update_agentless_scanning_accounts_aw
- update_api_key
- update_apm_config_metric
- update_apm_config_retention_filter
- update_apm_config_retention_filters_execution_orders
- update_app_builder_app
- update_application_key
- update_authn_mapping
- update_cloud_security_management_custom_framework
- update_cloud_security_management_resource_filters
- update_cost_aws_cur_config
- update_cost_azure_uc_config
- update_cost_budgets
- update_cost_custom_costs
- update_cost_gcp_uc_config
- update_current_user_application_key
- update_dashboard
- update_dashboard_lists_manual
- update_dashboard_lists_manual_dashboards
- update_dashboard_public
- update_dashboards
- update_dashboard_v1
- update_domain_allowlists
- update_downtime
- update_error_tracking_issue_assignee
- update_error_tracking_issue_state
- update_integration_aws
- update_integration_aws_generate_new_external_ids
- update_integration_azures
- update_integration_gcp_account
- update_integration_ms_teams_configuration_tenant_based_handle
- update_integration_ms_teams_configuration_workflows_webhook_handle
- update_integration_opsgenie_service
- update_integration_pagerduty_configuration_service
- update_integrations_cloudflare_account
- update_integrations_confluent_cloud_account
- update_integrations_confluent_cloud_account_resources
- update_integrations_fastly_account
- update_integrations_fastly_account_services
- update_integration_slack_configuration_account_channels
- update_integrations_okta_account
- update_integration_webhooks_configuration_custom_variable
- update_integration_webhooks_configuration_webhook
- update_ip_allowlists
- update_logs_config_archive
- update_logs_config_archive_orders
- update_logs_config_custom_destination
- update_logs_config_indexe
- update_logs_config_index_orders
- update_logs_config_metric
- update_logs_config_pipeline
- update_logs_config_pipeline_orders
- update_metric
- update_metric_tags
- update_monitor
- update_monitor_notification_rule
- update_monitor_policy
- update_monitor_v1
- update_ndm_tags_device
- update_notebook
- update_on_call_escalation_policy
- update_on_call_schedule
- update_on_call_team_routing_rules
- update_org
- update_org_config
- update_powerpack
- update_remote_config_products_asm_waf_custom_rule
- update_remote_config_products_asm_waf_exclusion_filter
- update_remote_config_products_cws_agent_rule
- update_remote_config_products_cws_policy
- update_role
- update_rum_application
- update_rum_application_relationships_retention_filters
- update_rum_application_retention_filters
- update_rum_config_metric
- update_security_analytics_signal_add_to_incident
- update_security_monitoring_cloud_workload_security_agent_rule
- update_security_monitoring_configuration_security_filter
- update_security_monitoring_configuration_suppression
- update_security_monitoring_rule
- update_security_monitoring_signal_assignee
- update_security_monitoring_signal_incidents
- update_security_monitoring_signal_state
- update_security_signals_notification_rule
- update_security_vulnerabilities_notification_rule
- update_sensitive_data_scanner_config_group
- update_sensitive_data_scanner_config_rule
- update_sensitive_data_scanner_configs
- update_service_account_application_keys
- update_slo
- update_slo_correction
- update_synthetics_private_location
- update_synthetics_tests_browser
- update_synthetics_tests_mobile
- update_synthetics_test_status
- update_synthetics_test_v1
- update_synthetics_test_v1_2
- update_synthetics_variable
- update_tags_host
- update_team
- update_team_links
- update_team_memberships
- update_team_permission_settings
- update_user
- update_workflow
- update_workflow_instances_cancel
- users_create
- users_get
- users_list
- users_update
- validate_monitor_v1
- validate_monitor_v1_2
- validate_resources