Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Datadog Provider
  3. API Docs
  4. SecurityMonitoringSuppression
Datadog v4.48.1 published on Saturday, Apr 5, 2025 by Pulumi
pulumi/pulumi-datadog

datadog.SecurityMonitoringSuppression

Explore with Pulumi AI

Datadog v4.48.1 published on Saturday, Apr 5, 2025 by Pulumi
pulumi/pulumi-datadog

Provides a Datadog Security Monitoring Suppression API resource. It can be used to create and manage Datadog security monitoring suppression rules.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as datadog from "@pulumi/datadog";

const mySuppression = new datadog.SecurityMonitoringSuppression("my_suppression", {
    name: "My suppression",
    description: "Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024",
    enabled: true,
    ruleQuery: "severity:low source:cloudtrail",
    suppressionQuery: "@usr.id:john.doe",
    dataExclusionQuery: "env:test",
    startDate: "2024-12-01T16:00:00Z",
    expirationDate: "2024-12-31T12:00:00Z",
});
Copy
import pulumi
import pulumi_datadog as datadog

my_suppression = datadog.SecurityMonitoringSuppression("my_suppression",
    name="My suppression",
    description="Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024",
    enabled=True,
    rule_query="severity:low source:cloudtrail",
    suppression_query="@usr.id:john.doe",
    data_exclusion_query="env:test",
    start_date="2024-12-01T16:00:00Z",
    expiration_date="2024-12-31T12:00:00Z")
Copy
package main

import (
	"github.com/pulumi/pulumi-datadog/sdk/v4/go/datadog"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := datadog.NewSecurityMonitoringSuppression(ctx, "my_suppression", &datadog.SecurityMonitoringSuppressionArgs{
			Name:               pulumi.String("My suppression"),
			Description:        pulumi.String("Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024"),
			Enabled:            pulumi.Bool(true),
			RuleQuery:          pulumi.String("severity:low source:cloudtrail"),
			SuppressionQuery:   pulumi.String("@usr.id:john.doe"),
			DataExclusionQuery: pulumi.String("env:test"),
			StartDate:          pulumi.String("2024-12-01T16:00:00Z"),
			ExpirationDate:     pulumi.String("2024-12-31T12:00:00Z"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Datadog = Pulumi.Datadog;

return await Deployment.RunAsync(() => 
{
    var mySuppression = new Datadog.SecurityMonitoringSuppression("my_suppression", new()
    {
        Name = "My suppression",
        Description = "Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024",
        Enabled = true,
        RuleQuery = "severity:low source:cloudtrail",
        SuppressionQuery = "@usr.id:john.doe",
        DataExclusionQuery = "env:test",
        StartDate = "2024-12-01T16:00:00Z",
        ExpirationDate = "2024-12-31T12:00:00Z",
    });

});
Copy
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.datadog.SecurityMonitoringSuppression;
import com.pulumi.datadog.SecurityMonitoringSuppressionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var mySuppression = new SecurityMonitoringSuppression("mySuppression", SecurityMonitoringSuppressionArgs.builder()
            .name("My suppression")
            .description("Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024")
            .enabled(true)
            .ruleQuery("severity:low source:cloudtrail")
            .suppressionQuery("@usr.id:john.doe")
            .dataExclusionQuery("env:test")
            .startDate("2024-12-01T16:00:00Z")
            .expirationDate("2024-12-31T12:00:00Z")
            .build());

    }
}
Copy
resources:
  mySuppression:
    type: datadog:SecurityMonitoringSuppression
    name: my_suppression
    properties:
      name: My suppression
      description: Suppression for low severity CloudTrail signals from John Doe, excluding test environments from analysis, limited to 2024
      enabled: true
      ruleQuery: severity:low source:cloudtrail
      suppressionQuery: '@usr.id:john.doe'
      dataExclusionQuery: env:test
      startDate: 2024-12-01T16:00:00Z
      expirationDate: 2024-12-31T12:00:00Z
Copy

Create SecurityMonitoringSuppression Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new SecurityMonitoringSuppression(name: string, args: SecurityMonitoringSuppressionArgs, opts?: CustomResourceOptions);
@overload
def SecurityMonitoringSuppression(resource_name: str,
                                  args: SecurityMonitoringSuppressionArgs,
                                  opts: Optional[ResourceOptions] = None)

@overload
def SecurityMonitoringSuppression(resource_name: str,
                                  opts: Optional[ResourceOptions] = None,
                                  enabled: Optional[bool] = None,
                                  name: Optional[str] = None,
                                  rule_query: Optional[str] = None,
                                  data_exclusion_query: Optional[str] = None,
                                  description: Optional[str] = None,
                                  expiration_date: Optional[str] = None,
                                  start_date: Optional[str] = None,
                                  suppression_query: Optional[str] = None)
func NewSecurityMonitoringSuppression(ctx *Context, name string, args SecurityMonitoringSuppressionArgs, opts ...ResourceOption) (*SecurityMonitoringSuppression, error)
public SecurityMonitoringSuppression(string name, SecurityMonitoringSuppressionArgs args, CustomResourceOptions? opts = null)
public SecurityMonitoringSuppression(String name, SecurityMonitoringSuppressionArgs args)
public SecurityMonitoringSuppression(String name, SecurityMonitoringSuppressionArgs args, CustomResourceOptions options)

type: datadog:SecurityMonitoringSuppression
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name This property is required. string
The unique name of the resource.
args This property is required. SecurityMonitoringSuppressionArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name This property is required. str
The unique name of the resource.
args This property is required. SecurityMonitoringSuppressionArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name This property is required. string
The unique name of the resource.
args This property is required. SecurityMonitoringSuppressionArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name This property is required. string
The unique name of the resource.
args This property is required. SecurityMonitoringSuppressionArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name This property is required. String
The unique name of the resource.
args This property is required. SecurityMonitoringSuppressionArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var securityMonitoringSuppressionResource = new Datadog.SecurityMonitoringSuppression("securityMonitoringSuppressionResource", new()
{
    Enabled = false,
    Name = "string",
    RuleQuery = "string",
    DataExclusionQuery = "string",
    Description = "string",
    ExpirationDate = "string",
    StartDate = "string",
    SuppressionQuery = "string",
});
Copy
example, err := datadog.NewSecurityMonitoringSuppression(ctx, "securityMonitoringSuppressionResource", &datadog.SecurityMonitoringSuppressionArgs{
	Enabled:            pulumi.Bool(false),
	Name:               pulumi.String("string"),
	RuleQuery:          pulumi.String("string"),
	DataExclusionQuery: pulumi.String("string"),
	Description:        pulumi.String("string"),
	ExpirationDate:     pulumi.String("string"),
	StartDate:          pulumi.String("string"),
	SuppressionQuery:   pulumi.String("string"),
})
Copy
var securityMonitoringSuppressionResource = new SecurityMonitoringSuppression("securityMonitoringSuppressionResource", SecurityMonitoringSuppressionArgs.builder()
    .enabled(false)
    .name("string")
    .ruleQuery("string")
    .dataExclusionQuery("string")
    .description("string")
    .expirationDate("string")
    .startDate("string")
    .suppressionQuery("string")
    .build());
Copy
security_monitoring_suppression_resource = datadog.SecurityMonitoringSuppression("securityMonitoringSuppressionResource",
    enabled=False,
    name="string",
    rule_query="string",
    data_exclusion_query="string",
    description="string",
    expiration_date="string",
    start_date="string",
    suppression_query="string")
Copy
const securityMonitoringSuppressionResource = new datadog.SecurityMonitoringSuppression("securityMonitoringSuppressionResource", {
    enabled: false,
    name: "string",
    ruleQuery: "string",
    dataExclusionQuery: "string",
    description: "string",
    expirationDate: "string",
    startDate: "string",
    suppressionQuery: "string",
});
Copy
type: datadog:SecurityMonitoringSuppression
properties:
    dataExclusionQuery: string
    description: string
    enabled: false
    expirationDate: string
    name: string
    ruleQuery: string
    startDate: string
    suppressionQuery: string
Copy

SecurityMonitoringSuppression Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The SecurityMonitoringSuppression resource accepts the following input properties:

Enabled This property is required. bool
Whether the suppression rule is enabled.
Name This property is required. string
The name of the suppression rule.
RuleQuery This property is required. string
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
DataExclusionQuery string
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
Description string
A description for the suppression rule.
ExpirationDate string
A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
StartDate string
A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
SuppressionQuery string
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
Enabled This property is required. bool
Whether the suppression rule is enabled.
Name This property is required. string
The name of the suppression rule.
RuleQuery This property is required. string
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
DataExclusionQuery string
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
Description string
A description for the suppression rule.
ExpirationDate string
A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
StartDate string
A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
SuppressionQuery string
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
enabled This property is required. Boolean
Whether the suppression rule is enabled.
name This property is required. String
The name of the suppression rule.
ruleQuery This property is required. String
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
dataExclusionQuery String
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description String
A description for the suppression rule.
expirationDate String
A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
startDate String
A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
suppressionQuery String
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
enabled This property is required. boolean
Whether the suppression rule is enabled.
name This property is required. string
The name of the suppression rule.
ruleQuery This property is required. string
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
dataExclusionQuery string
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description string
A description for the suppression rule.
expirationDate string
A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
startDate string
A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
suppressionQuery string
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
enabled This property is required. bool
Whether the suppression rule is enabled.
name This property is required. str
The name of the suppression rule.
rule_query This property is required. str
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
data_exclusion_query str
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description str
A description for the suppression rule.
expiration_date str
A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
start_date str
A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
suppression_query str
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
enabled This property is required. Boolean
Whether the suppression rule is enabled.
name This property is required. String
The name of the suppression rule.
ruleQuery This property is required. String
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
dataExclusionQuery String
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description String
A description for the suppression rule.
expirationDate String
A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
startDate String
A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
suppressionQuery String
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.

Outputs

All input properties are implicitly available as output properties. Additionally, the SecurityMonitoringSuppression resource produces the following output properties:

Id string
The provider-assigned unique ID for this managed resource.
Id string
The provider-assigned unique ID for this managed resource.
id String
The provider-assigned unique ID for this managed resource.
id string
The provider-assigned unique ID for this managed resource.
id str
The provider-assigned unique ID for this managed resource.
id String
The provider-assigned unique ID for this managed resource.

Look up Existing SecurityMonitoringSuppression Resource

Get an existing SecurityMonitoringSuppression resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: SecurityMonitoringSuppressionState, opts?: CustomResourceOptions): SecurityMonitoringSuppression
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        data_exclusion_query: Optional[str] = None,
        description: Optional[str] = None,
        enabled: Optional[bool] = None,
        expiration_date: Optional[str] = None,
        name: Optional[str] = None,
        rule_query: Optional[str] = None,
        start_date: Optional[str] = None,
        suppression_query: Optional[str] = None) -> SecurityMonitoringSuppression
func GetSecurityMonitoringSuppression(ctx *Context, name string, id IDInput, state *SecurityMonitoringSuppressionState, opts ...ResourceOption) (*SecurityMonitoringSuppression, error)
public static SecurityMonitoringSuppression Get(string name, Input<string> id, SecurityMonitoringSuppressionState? state, CustomResourceOptions? opts = null)
public static SecurityMonitoringSuppression get(String name, Output<String> id, SecurityMonitoringSuppressionState state, CustomResourceOptions options)
resources:  _:    type: datadog:SecurityMonitoringSuppression    get:      id: ${id}
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
DataExclusionQuery string
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
Description string
A description for the suppression rule.
Enabled bool
Whether the suppression rule is enabled.
ExpirationDate string
A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
Name string
The name of the suppression rule.
RuleQuery string
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
StartDate string
A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
SuppressionQuery string
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
DataExclusionQuery string
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
Description string
A description for the suppression rule.
Enabled bool
Whether the suppression rule is enabled.
ExpirationDate string
A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
Name string
The name of the suppression rule.
RuleQuery string
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
StartDate string
A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
SuppressionQuery string
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
dataExclusionQuery String
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description String
A description for the suppression rule.
enabled Boolean
Whether the suppression rule is enabled.
expirationDate String
A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
name String
The name of the suppression rule.
ruleQuery String
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
startDate String
A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
suppressionQuery String
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
dataExclusionQuery string
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description string
A description for the suppression rule.
enabled boolean
Whether the suppression rule is enabled.
expirationDate string
A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
name string
The name of the suppression rule.
ruleQuery string
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
startDate string
A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
suppressionQuery string
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
data_exclusion_query str
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description str
A description for the suppression rule.
enabled bool
Whether the suppression rule is enabled.
expiration_date str
A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
name str
The name of the suppression rule.
rule_query str
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
start_date str
A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
suppression_query str
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
dataExclusionQuery String
An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
description String
A description for the suppression rule.
enabled Boolean
Whether the suppression rule is enabled.
expirationDate String
A RFC3339 timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
name String
The name of the suppression rule.
ruleQuery String
The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
startDate String
A RFC3339 timestamp giving a start date for the suppression rule. Before this date, it doesn't suppress signals.
suppressionQuery String
The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.

Import

Security monitoring suppressions can be imported using ID, for example:

$ pulumi import datadog:index/securityMonitoringSuppression:SecurityMonitoringSuppression my_suppression m0o-hto-lkb
Copy

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository
Datadog pulumi/pulumi-datadog
License
Apache-2.0
Notes
This Pulumi package is based on the datadog Terraform Provider.
Datadog v4.48.1 published on Saturday, Apr 5, 2025 by Pulumi
pulumi/pulumi-datadog