SQL Server / Datadog API Collection / Get a list of security signals
Back to Collection Items
-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
DECLARE @hr int
DECLARE @iTmp0 int
-- Important: Do not use nvarchar(max). See the warning about using nvarchar(max).
DECLARE @sTmp0 nvarchar(4000)
-- This example assumes the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.
DECLARE @http int
-- Use "Chilkat_9_5_0.Http" for versions of Chilkat < 10.0.0
EXEC @hr = sp_OACreate 'Chilkat.Http', @http OUT
IF @hr <> 0
BEGIN
PRINT 'Failed to create ActiveX component'
RETURN
END
DECLARE @success int
-- Use this online tool to generate code from sample JSON: Generate Code to Create JSON
-- The following JSON is sent in the request body.
-- {
-- "filter": {
-- "from": "<dateTime>",
-- "query": "<string>",
-- "to": "<dateTime>"
-- },
-- "page": {
-- "cursor": "<string>",
-- "limit": 10
-- },
-- "sort": "timestamp"
-- }
DECLARE @json int
-- Use "Chilkat_9_5_0.JsonObject" for versions of Chilkat < 10.0.0
EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @json OUT
EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'filter.from', '<dateTime>'
EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'filter.query', '<string>'
EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'filter.to', '<dateTime>'
EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'page.cursor', '<string>'
EXEC sp_OAMethod @json, 'UpdateInt', @success OUT, 'page.limit', 10
EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'sort', 'timestamp'
EXEC sp_OAMethod @http, 'SetRequestHeader', NULL, 'Content-Type', 'application/json'
EXEC sp_OAMethod @http, 'SetRequestHeader', NULL, 'Accept', 'application/json'
DECLARE @resp int
EXEC sp_OAMethod @http, 'PostJson3', @resp OUT, 'https://api.app.ddog-gov.com/api/v2/security_monitoring/signals/search', 'application/json', @json
EXEC sp_OAGetProperty @http, 'LastMethodSuccess', @iTmp0 OUT
IF @iTmp0 = 0
BEGIN
EXEC sp_OAGetProperty @http, 'LastErrorText', @sTmp0 OUT
PRINT @sTmp0
EXEC @hr = sp_OADestroy @http
EXEC @hr = sp_OADestroy @json
RETURN
END
DECLARE @sbResponseBody int
-- Use "Chilkat_9_5_0.StringBuilder" for versions of Chilkat < 10.0.0
EXEC @hr = sp_OACreate 'Chilkat.StringBuilder', @sbResponseBody OUT
EXEC sp_OAMethod @resp, 'GetBodySb', @success OUT, @sbResponseBody
DECLARE @jResp int
-- Use "Chilkat_9_5_0.JsonObject" for versions of Chilkat < 10.0.0
EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @jResp OUT
EXEC sp_OAMethod @jResp, 'LoadSb', @success OUT, @sbResponseBody
EXEC sp_OASetProperty @jResp, 'EmitCompact', 0
PRINT 'Response Body:'
EXEC sp_OAMethod @jResp, 'Emit', @sTmp0 OUT
PRINT @sTmp0
DECLARE @respStatusCode int
EXEC sp_OAGetProperty @resp, 'StatusCode', @respStatusCode OUT
PRINT 'Response Status Code = ' + @respStatusCode
IF @respStatusCode >= 400
BEGIN
PRINT 'Response Header:'
EXEC sp_OAGetProperty @resp, 'Header', @sTmp0 OUT
PRINT @sTmp0
PRINT 'Failed.'
EXEC @hr = sp_OADestroy @resp
EXEC @hr = sp_OADestroy @http
EXEC @hr = sp_OADestroy @json
EXEC @hr = sp_OADestroy @sbResponseBody
EXEC @hr = sp_OADestroy @jResp
RETURN
END
EXEC @hr = sp_OADestroy @resp
-- Sample JSON response:
-- (Sample code for parsing the JSON response is shown below)
-- {
-- "data": [
-- {
-- "attributes": {
-- "attributes": {
-- "laboris6b": {},
-- "qui_4_": {},
-- "sintcb": {}
-- },
-- "message": "<string>",
-- "tags": [
-- "<string>",
-- "<string>"
-- ],
-- "timestamp": "<dateTime>"
-- },
-- "id": "<string>",
-- "type": "signal"
-- },
-- {
-- "attributes": {
-- "attributes": {
-- "cillumc": {},
-- "ut_75": {}
-- },
-- "message": "<string>",
-- "tags": [
-- "<string>",
-- "<string>"
-- ],
-- "timestamp": "<dateTime>",
-- "sit5": {}
-- },
-- "id": "<string>",
-- "type": "signal"
-- }
-- ],
-- "links": {
-- "next": "<string>"
-- },
-- "meta": {
-- "page": {
-- "after": "<string>"
-- }
-- }
-- }
-- Sample code for parsing the JSON response...
-- Use this online tool to generate parsing code from sample JSON: Generate JSON Parsing Code
DECLARE @Message nvarchar(4000)
DECLARE @Timestamp nvarchar(4000)
DECLARE @id nvarchar(4000)
DECLARE @v_type nvarchar(4000)
DECLARE @j int
DECLARE @count_j int
DECLARE @strVal nvarchar(4000)
DECLARE @v_Next nvarchar(4000)
EXEC sp_OAMethod @jResp, 'StringOf', @v_Next OUT, 'links.next'
DECLARE @After nvarchar(4000)
EXEC sp_OAMethod @jResp, 'StringOf', @After OUT, 'meta.page.after'
DECLARE @i int
SELECT @i = 0
DECLARE @count_i int
EXEC sp_OAMethod @jResp, 'SizeOfArray', @count_i OUT, 'data'
WHILE @i < @count_i
BEGIN
EXEC sp_OASetProperty @jResp, 'I', @i
EXEC sp_OAMethod @jResp, 'StringOf', @Message OUT, 'data[i].attributes.message'
EXEC sp_OAMethod @jResp, 'StringOf', @Timestamp OUT, 'data[i].attributes.timestamp'
EXEC sp_OAMethod @jResp, 'StringOf', @id OUT, 'data[i].id'
EXEC sp_OAMethod @jResp, 'StringOf', @v_type OUT, 'data[i].type'
SELECT @j = 0
EXEC sp_OAMethod @jResp, 'SizeOfArray', @count_j OUT, 'data[i].attributes.tags'
WHILE @j < @count_j
BEGIN
EXEC sp_OASetProperty @jResp, 'J', @j
EXEC sp_OAMethod @jResp, 'StringOf', @strVal OUT, 'data[i].attributes.tags[j]'
SELECT @j = @j + 1
END
SELECT @i = @i + 1
END
EXEC @hr = sp_OADestroy @http
EXEC @hr = sp_OADestroy @json
EXEC @hr = sp_OADestroy @sbResponseBody
EXEC @hr = sp_OADestroy @jResp
END
GO
Curl Command
curl -X POST
-H "Content-Type: application/json"
-H "Accept: application/json"
-d '{
"filter": {
"from": "<dateTime>",
"query": "<string>",
"to": "<dateTime>"
},
"page": {
"cursor": "<string>",
"limit": 10
},
"sort": "timestamp"
}'
https://api.app.ddog-gov.com/api/v2/security_monitoring/signals/search
Postman Collection Item JSON
{
"name": "Get a list of security signals",
"request": {
"method": "POST",
"header": [
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "Accept",
"value": "application/json"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"filter\": {\n \"from\": \"<dateTime>\",\n \"query\": \"<string>\",\n \"to\": \"<dateTime>\"\n },\n \"page\": {\n \"cursor\": \"<string>\",\n \"limit\": 10\n },\n \"sort\": \"timestamp\"\n}",
"options": {
"raw": {
"headerFamily": "json",
"language": "json"
}
}
},
"url": {
"raw": "{{baseUrl}}/api/v2/security_monitoring/signals/search",
"host": [
"{{baseUrl}}"
],
"path": [
"api",
"v2",
"security_monitoring",
"signals",
"search"
]
},
"description": "Returns security signals that match a search query.\nBoth this endpoint and the GET endpoint can be used interchangeably for listing\nsecurity signals."
},
"response": [
{
"name": "OK",
"originalRequest": {
"method": "POST",
"header": [
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "Accept",
"value": "application/json"
},
{
"description": "Added as a part of security scheme: apikey",
"key": "DD-API-KEY",
"value": "<API Key>"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"filter\": {\n \"from\": \"<dateTime>\",\n \"query\": \"<string>\",\n \"to\": \"<dateTime>\"\n },\n \"page\": {\n \"cursor\": \"<string>\",\n \"limit\": 10\n },\n \"sort\": \"timestamp\"\n}",
"options": {
"raw": {
"headerFamily": "json",
"language": "json"
}
}
},
"url": {
"raw": "{{baseUrl}}/api/v2/security_monitoring/signals/search",
"host": [
"{{baseUrl}}"
],
"path": [
"api",
"v2",
"security_monitoring",
"signals",
"search"
]
}
},
"status": "OK",
"code": 200,
"_postman_previewlanguage": "json",
"header": [
{
"key": "Content-Type",
"value": "application/json"
}
],
"cookie": [
],
"body": "{\n \"data\": [\n {\n \"attributes\": {\n \"attributes\": {\n \"laboris6b\": {},\n \"qui_4_\": {},\n \"sintcb\": {}\n },\n \"message\": \"<string>\",\n \"tags\": [\n \"<string>\",\n \"<string>\"\n ],\n \"timestamp\": \"<dateTime>\"\n },\n \"id\": \"<string>\",\n \"type\": \"signal\"\n },\n {\n \"attributes\": {\n \"attributes\": {\n \"cillumc\": {},\n \"ut_75\": {}\n },\n \"message\": \"<string>\",\n \"tags\": [\n \"<string>\",\n \"<string>\"\n ],\n \"timestamp\": \"<dateTime>\",\n \"sit5\": {}\n },\n \"id\": \"<string>\",\n \"type\": \"signal\"\n }\n ],\n \"links\": {\n \"next\": \"<string>\"\n },\n \"meta\": {\n \"page\": {\n \"after\": \"<string>\"\n }\n }\n}"
},
{
"name": "Bad Request",
"originalRequest": {
"method": "POST",
"header": [
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "Accept",
"value": "application/json"
},
{
"description": "Added as a part of security scheme: apikey",
"key": "DD-API-KEY",
"value": "<API Key>"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"filter\": {\n \"from\": \"<dateTime>\",\n \"query\": \"<string>\",\n \"to\": \"<dateTime>\"\n },\n \"page\": {\n \"cursor\": \"<string>\",\n \"limit\": 10\n },\n \"sort\": \"timestamp\"\n}",
"options": {
"raw": {
"headerFamily": "json",
"language": "json"
}
}
},
"url": {
"raw": "{{baseUrl}}/api/v2/security_monitoring/signals/search",
"host": [
"{{baseUrl}}"
],
"path": [
"api",
"v2",
"security_monitoring",
"signals",
"search"
]
}
},
"status": "Bad Request",
"code": 400,
"_postman_previewlanguage": "json",
"header": [
{
"key": "Content-Type",
"value": "application/json"
}
],
"cookie": [
],
"body": "{\n \"errors\": [\n \"<string>\",\n \"<string>\"\n ]\n}"
},
{
"name": "Not Authorized",
"originalRequest": {
"method": "POST",
"header": [
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "Accept",
"value": "application/json"
},
{
"description": "Added as a part of security scheme: apikey",
"key": "DD-API-KEY",
"value": "<API Key>"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"filter\": {\n \"from\": \"<dateTime>\",\n \"query\": \"<string>\",\n \"to\": \"<dateTime>\"\n },\n \"page\": {\n \"cursor\": \"<string>\",\n \"limit\": 10\n },\n \"sort\": \"timestamp\"\n}",
"options": {
"raw": {
"headerFamily": "json",
"language": "json"
}
}
},
"url": {
"raw": "{{baseUrl}}/api/v2/security_monitoring/signals/search",
"host": [
"{{baseUrl}}"
],
"path": [
"api",
"v2",
"security_monitoring",
"signals",
"search"
]
}
},
"status": "Forbidden",
"code": 403,
"_postman_previewlanguage": "json",
"header": [
{
"key": "Content-Type",
"value": "application/json"
}
],
"cookie": [
],
"body": "{\n \"errors\": [\n \"<string>\",\n \"<string>\"\n ]\n}"
},
{
"name": "Too many requests",
"originalRequest": {
"method": "POST",
"header": [
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "Accept",
"value": "application/json"
},
{
"description": "Added as a part of security scheme: apikey",
"key": "DD-API-KEY",
"value": "<API Key>"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"filter\": {\n \"from\": \"<dateTime>\",\n \"query\": \"<string>\",\n \"to\": \"<dateTime>\"\n },\n \"page\": {\n \"cursor\": \"<string>\",\n \"limit\": 10\n },\n \"sort\": \"timestamp\"\n}",
"options": {
"raw": {
"headerFamily": "json",
"language": "json"
}
}
},
"url": {
"raw": "{{baseUrl}}/api/v2/security_monitoring/signals/search",
"host": [
"{{baseUrl}}"
],
"path": [
"api",
"v2",
"security_monitoring",
"signals",
"search"
]
}
},
"status": "Too Many Requests",
"code": 429,
"_postman_previewlanguage": "json",
"header": [
{
"key": "Content-Type",
"value": "application/json"
}
],
"cookie": [
],
"body": "{\n \"errors\": [\n \"<string>\",\n \"<string>\"\n ]\n}"
}
]
}
