297 lines
12 KiB
JSON
297 lines
12 KiB
JSON
{
|
|
"name": "FindSecurityAlerts",
|
|
"fully_qualified_name": "DatadogApi.FindSecurityAlerts@0.1.0",
|
|
"description": "Retrieve historical security monitoring signals from Datadog.\n\nThis tool is used to search and retrieve historical security monitoring signals in Datadog. Ideal for extracting past security incident data and analysis.",
|
|
"toolkit": {
|
|
"name": "ArcadeDatadogApi",
|
|
"description": null,
|
|
"version": "0.1.0"
|
|
},
|
|
"input": {
|
|
"parameters": [
|
|
{
|
|
"name": "minimum_timestamp",
|
|
"required": false,
|
|
"description": "The start timestamp for filtering requested security signals. Use ISO 8601 format.",
|
|
"value_schema": {
|
|
"val_type": "string",
|
|
"inner_val_type": null,
|
|
"enum": null,
|
|
"properties": null,
|
|
"inner_properties": null,
|
|
"description": "The minimum timestamp for requested security signals."
|
|
},
|
|
"inferrable": true,
|
|
"http_endpoint_parameter_name": "filter.from"
|
|
},
|
|
{
|
|
"name": "search_query_for_security_signals",
|
|
"required": false,
|
|
"description": "Search query to filter and list specific security signals. Use keywords and operators to refine results.",
|
|
"value_schema": {
|
|
"val_type": "string",
|
|
"inner_val_type": null,
|
|
"enum": null,
|
|
"properties": null,
|
|
"inner_properties": null,
|
|
"description": "Search query for listing security signals."
|
|
},
|
|
"inferrable": true,
|
|
"http_endpoint_parameter_name": "filter.query"
|
|
},
|
|
{
|
|
"name": "maximum_timestamp_for_signals",
|
|
"required": false,
|
|
"description": "The maximum timestamp for requested security signals, formatted as a string.",
|
|
"value_schema": {
|
|
"val_type": "string",
|
|
"inner_val_type": null,
|
|
"enum": null,
|
|
"properties": null,
|
|
"inner_properties": null,
|
|
"description": "The maximum timestamp for requested security signals."
|
|
},
|
|
"inferrable": true,
|
|
"http_endpoint_parameter_name": "filter.to"
|
|
},
|
|
{
|
|
"name": "pagination_cursor",
|
|
"required": false,
|
|
"description": "String used to fetch the next set of results based on a previous query's cursor.",
|
|
"value_schema": {
|
|
"val_type": "string",
|
|
"inner_val_type": null,
|
|
"enum": null,
|
|
"properties": null,
|
|
"inner_properties": null,
|
|
"description": "A list of results using the cursor provided in the previous query."
|
|
},
|
|
"inferrable": true,
|
|
"http_endpoint_parameter_name": "page.cursor"
|
|
},
|
|
{
|
|
"name": "max_security_signals",
|
|
"required": false,
|
|
"description": "Specify the maximum number of security signals to retrieve in the response.",
|
|
"value_schema": {
|
|
"val_type": "integer",
|
|
"inner_val_type": null,
|
|
"enum": null,
|
|
"properties": null,
|
|
"inner_properties": null,
|
|
"description": "The maximum number of security signals in the response."
|
|
},
|
|
"inferrable": true,
|
|
"http_endpoint_parameter_name": "page.limit"
|
|
},
|
|
{
|
|
"name": "sort_order",
|
|
"required": false,
|
|
"description": "The criteria for sorting security signals, either 'timestamp' or '-timestamp'.",
|
|
"value_schema": {
|
|
"val_type": "string",
|
|
"inner_val_type": null,
|
|
"enum": [
|
|
"timestamp",
|
|
"-timestamp"
|
|
],
|
|
"properties": null,
|
|
"inner_properties": null,
|
|
"description": "The sort parameters used for querying security signals."
|
|
},
|
|
"inferrable": true,
|
|
"http_endpoint_parameter_name": "sort"
|
|
}
|
|
]
|
|
},
|
|
"output": {
|
|
"description": "Response from the API endpoint 'SearchSecurityMonitoringHistsignals'.",
|
|
"available_modes": [
|
|
"value",
|
|
"error",
|
|
"null"
|
|
],
|
|
"value_schema": {
|
|
"val_type": "json",
|
|
"inner_val_type": null,
|
|
"enum": null,
|
|
"properties": null,
|
|
"inner_properties": null,
|
|
"description": null
|
|
}
|
|
},
|
|
"requirements": {
|
|
"authorization": null,
|
|
"secrets": [
|
|
{
|
|
"key": "DATADOG_API_KEY"
|
|
},
|
|
{
|
|
"key": "DATADOG_APPLICATION_KEY"
|
|
},
|
|
{
|
|
"key": "DATADOG_BASE_URL"
|
|
}
|
|
],
|
|
"metadata": null
|
|
},
|
|
"deprecation_message": null,
|
|
"metadata": {
|
|
"object_type": "api_wrapper_tool",
|
|
"version": "1.1.0",
|
|
"description": "Tools that enable LLMs to interact directly with the Datadog API."
|
|
},
|
|
"http_endpoint": {
|
|
"metadata": {
|
|
"object_type": "http_endpoint",
|
|
"version": "1.2.0",
|
|
"description": ""
|
|
},
|
|
"url": "https://{datadog_base_url}/api/v2/siem-historical-detections/histsignals/search",
|
|
"http_method": "GET",
|
|
"headers": {},
|
|
"parameters": [
|
|
{
|
|
"name": "filter.from",
|
|
"tool_parameter_name": "minimum_timestamp",
|
|
"description": "The minimum timestamp for requested security signals.",
|
|
"value_schema": {
|
|
"val_type": "string",
|
|
"inner_val_type": null,
|
|
"enum": null,
|
|
"properties": null,
|
|
"inner_properties": null,
|
|
"description": "The minimum timestamp for requested security signals."
|
|
},
|
|
"accepted_as": "body",
|
|
"required": false,
|
|
"deprecated": false,
|
|
"default": null,
|
|
"documentation_urls": []
|
|
},
|
|
{
|
|
"name": "filter.query",
|
|
"tool_parameter_name": "search_query_for_security_signals",
|
|
"description": "Search query for listing security signals.",
|
|
"value_schema": {
|
|
"val_type": "string",
|
|
"inner_val_type": null,
|
|
"enum": null,
|
|
"properties": null,
|
|
"inner_properties": null,
|
|
"description": "Search query for listing security signals."
|
|
},
|
|
"accepted_as": "body",
|
|
"required": false,
|
|
"deprecated": false,
|
|
"default": null,
|
|
"documentation_urls": []
|
|
},
|
|
{
|
|
"name": "filter.to",
|
|
"tool_parameter_name": "maximum_timestamp_for_signals",
|
|
"description": "The maximum timestamp for requested security signals.",
|
|
"value_schema": {
|
|
"val_type": "string",
|
|
"inner_val_type": null,
|
|
"enum": null,
|
|
"properties": null,
|
|
"inner_properties": null,
|
|
"description": "The maximum timestamp for requested security signals."
|
|
},
|
|
"accepted_as": "body",
|
|
"required": false,
|
|
"deprecated": false,
|
|
"default": null,
|
|
"documentation_urls": []
|
|
},
|
|
{
|
|
"name": "page.cursor",
|
|
"tool_parameter_name": "pagination_cursor",
|
|
"description": "A list of results using the cursor provided in the previous query.",
|
|
"value_schema": {
|
|
"val_type": "string",
|
|
"inner_val_type": null,
|
|
"enum": null,
|
|
"properties": null,
|
|
"inner_properties": null,
|
|
"description": "A list of results using the cursor provided in the previous query."
|
|
},
|
|
"accepted_as": "body",
|
|
"required": false,
|
|
"deprecated": false,
|
|
"default": null,
|
|
"documentation_urls": []
|
|
},
|
|
{
|
|
"name": "page.limit",
|
|
"tool_parameter_name": "max_security_signals",
|
|
"description": "The maximum number of security signals in the response.",
|
|
"value_schema": {
|
|
"val_type": "integer",
|
|
"inner_val_type": null,
|
|
"enum": null,
|
|
"properties": null,
|
|
"inner_properties": null,
|
|
"description": "The maximum number of security signals in the response."
|
|
},
|
|
"accepted_as": "body",
|
|
"required": false,
|
|
"deprecated": false,
|
|
"default": 10,
|
|
"documentation_urls": []
|
|
},
|
|
{
|
|
"name": "sort",
|
|
"tool_parameter_name": "sort_order",
|
|
"description": "The sort parameters used for querying security signals.",
|
|
"value_schema": {
|
|
"val_type": "string",
|
|
"inner_val_type": null,
|
|
"enum": [
|
|
"timestamp",
|
|
"-timestamp"
|
|
],
|
|
"properties": null,
|
|
"inner_properties": null,
|
|
"description": "The sort parameters used for querying security signals."
|
|
},
|
|
"accepted_as": "body",
|
|
"required": false,
|
|
"deprecated": false,
|
|
"default": null,
|
|
"documentation_urls": []
|
|
}
|
|
],
|
|
"documentation_urls": [],
|
|
"secrets": [
|
|
{
|
|
"arcade_key": "DATADOG_API_KEY",
|
|
"parameter_name": "DD-API-KEY",
|
|
"accepted_as": "header",
|
|
"formatted_value": null,
|
|
"description": "",
|
|
"is_auth_token": false
|
|
},
|
|
{
|
|
"arcade_key": "DATADOG_APPLICATION_KEY",
|
|
"parameter_name": "DD-APPLICATION-KEY",
|
|
"accepted_as": "header",
|
|
"formatted_value": null,
|
|
"description": "",
|
|
"is_auth_token": false
|
|
},
|
|
{
|
|
"arcade_key": "DATADOG_BASE_URL",
|
|
"parameter_name": "datadog_base_url",
|
|
"accepted_as": "path",
|
|
"formatted_value": null,
|
|
"description": "",
|
|
"is_auth_token": false
|
|
}
|
|
],
|
|
"request_body_spec": "{\n \"content\": {\n \"application/json\": {\n \"schema\": {\n \"description\": \"The request for a security signal list.\",\n \"properties\": {\n \"filter\": {\n \"description\": \"Search filters for listing security signals.\",\n \"properties\": {\n \"from\": {\n \"description\": \"The minimum timestamp for requested security signals.\",\n \"example\": \"2019-01-02T09:42:36.320Z\",\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"query\": {\n \"description\": \"Search query for listing security signals.\",\n \"example\": \"security:attack status:high\",\n \"type\": \"string\"\n },\n \"to\": {\n \"description\": \"The maximum timestamp for requested security signals.\",\n \"example\": \"2019-01-03T09:42:36.320Z\",\n \"format\": \"date-time\",\n \"type\": \"string\"\n }\n },\n \"type\": \"object\"\n },\n \"page\": {\n \"description\": \"The paging attributes for listing security signals.\",\n \"properties\": {\n \"cursor\": {\n \"description\": \"A list of results using the cursor provided in the previous query.\",\n \"example\": \"eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==\",\n \"type\": \"string\"\n },\n \"limit\": {\n \"default\": 10,\n \"description\": \"The maximum number of security signals in the response.\",\n \"example\": 25,\n \"format\": \"int32\",\n \"maximum\": 1000,\n \"type\": \"integer\"\n }\n },\n \"type\": \"object\"\n },\n \"sort\": {\n \"description\": \"The sort parameters used for querying security signals.\",\n \"enum\": [\n \"timestamp\",\n \"-timestamp\"\n ],\n \"type\": \"string\",\n \"x-enum-varnames\": [\n \"TIMESTAMP_ASCENDING\",\n \"TIMESTAMP_DESCENDING\"\n ]\n }\n },\n \"type\": \"object\"\n }\n }\n },\n \"required\": false\n}",
|
|
"use_request_body_schema_mode": false,
|
|
"validate_request_body_schema": false
|
|
}
|
|
}
|