openapi: 3.0.0
info:
contact:
email: support@datadoghq.com
name: Datadog Support
url: https://www.datadoghq.com/support/
description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
title: Datadog Account Historical API
version: '1.0'
servers:
- url: https://{subdomain}.{site}
variables:
site:
default: datadoghq.com
description: The regional site for Datadog customers.
enum:
- datadoghq.com
- us3.datadoghq.com
- us5.datadoghq.com
- ap1.datadoghq.com
- datadoghq.eu
- ddog-gov.com
subdomain:
default: api
description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
variables:
name:
default: api.datadoghq.com
description: Full site DNS name.
protocol:
default: https
description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
variables:
site:
default: datadoghq.com
description: Any Datadog deployment.
subdomain:
default: api
description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
appKeyAuth: []
tags:
- name: Historical
paths:
/api/v2/siem-historical-detections/jobs:
get:
description: List historical jobs.
operationId: ListHistoricalJobs
parameters:
- $ref: '#/components/parameters/PageSize'
- $ref: '#/components/parameters/PageNumber'
- description: The order of the jobs in results.
example: status
in: query
name: sort
required: false
schema:
type: string
- description: Query used to filter items from the fetched list.
example: security:attack status:high
in: query
name: filter[query]
required: false
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/ListHistoricalJobsResponse'
description: OK
'400':
$ref: '#/components/responses/BadRequestResponse'
'403':
$ref: '#/components/responses/NotAuthorizedResponse'
'429':
$ref: '#/components/responses/TooManyRequestsResponse'
security:
- apiKeyAuth: []
appKeyAuth: []
- AuthZ: []
summary: Datadog List Historical Jobs
tags:
- Historical
x-menu-order: 20
x-undo:
type: safe
x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
Please check the documentation regularly for updates.'
x-api-evangelist-processing:
PascalCaseOperationSummaries: true
ChooseTags: true
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
post:
description: Run a historical job.
operationId: RunHistoricalJob
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/RunHistoricalJobRequest'
required: true
responses:
'201':
content:
application/json:
schema:
$ref: '#/components/schemas/JobCreateResponse'
description: Status created
'400':
$ref: '#/components/responses/BadRequestResponse'
'401':
$ref: '#/components/responses/ConcurrentModificationResponse'
'403':
$ref: '#/components/responses/NotAuthorizedResponse'
'404':
$ref: '#/components/responses/NotFoundResponse'
'429':
$ref: '#/components/responses/TooManyRequestsResponse'
security:
- apiKeyAuth: []
appKeyAuth: []
- AuthZ:
- security_monitoring_rules_write
summary: Datadog Run a Historical Job
tags:
- Historical
x-codegen-request-body-name: body
x-given:
historical_job:
parameters:
- name: body
value: "{\n \"data\": {\n \"type\": \"historicalDetectionsJobCreate\",\n \"attributes\": {\n \"jobDefinition\": {\n \"type\": \"log_detection\",\n \"name\": \"Excessive number of failed attempts.\",\n \"queries\": [\n {\n \"query\": \"source:non_existing_src_weekend\",\n \"aggregation\": \"count\",\n \"groupByFields\": [],\n \"distinctFields\": []\n }\n ],\n \"cases\": [\n {\n \"name\": \"Condition 1\",\n \"status\": \"info\",\n \"notifications\": [],\n \"condition\": \"a > 1\"\n }\n ],\n \"options\": {\n \"keepAlive\": 3600,\n \"maxSignalDuration\": 86400,\n \"evaluationWindow\": 900\n },\n \"message\": \"A large number of failed login attempts.\",\n \"tags\": [],\n \"from\": 1730387522611,\n \"to\": 1730387532611,\n \"index\": \"main\"\n }\n }\n }\n}"
step: there is a valid "historical_job" in the system
x-menu-order: 19
x-permission:
operator: OR
permissions:
- security_monitoring_rules_write
x-undo:
type: idempotent
x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
Please check the documentation regularly for updates.'
x-api-evangelist-processing:
PascalCaseOperationSummaries: true
ChooseTags: true
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/api/v2/siem-historical-detections/jobs/{job_id}/cancel:
patch:
description: Cancel a historical job.
operationId: CancelHistoricalJob
parameters:
- $ref: '#/components/parameters/HistoricalJobID'
responses:
'204':
description: OK
'400':
$ref: '#/components/responses/BadRequestResponse'
'401':
$ref: '#/components/responses/ConcurrentModificationResponse'
'403':
$ref: '#/components/responses/NotAuthorizedResponse'
'404':
$ref: '#/components/responses/NotFoundResponse'
'409':
$ref: '#/components/responses/ConflictResponse'
'429':
$ref: '#/components/responses/TooManyRequestsResponse'
security:
- apiKeyAuth: []
appKeyAuth: []
- AuthZ:
- security_monitoring_rules_write
summary: Datadog Cancel a Historical Job
tags:
- Historical
x-menu-order: 22
x-permission:
operator: OR
permissions:
- security_monitoring_rules_write
x-undo:
type: idempotent
x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
Please check the documentation regularly for updates.'
x-api-evangelist-processing:
PascalCaseOperationSummaries: true
ChooseTags: true
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/api/v2/usage/historical_cost:
get:
description: 'Get historical cost across multi-org and single root-org accounts.
Cost data for a given month becomes available no later than the 16th of the following month.
This endpoint is only accessible for [parent-level organizations](https://docs.datadoghq.com/account_management/multi_organization/).'
operationId: GetHistoricalCostByOrg
parameters:
- description: String to specify whether cost is broken down at a parent-org level or at the sub-org level. Available views are `summary` and `sub-org`. Defaults to `summary`.
in: query
name: view
required: false
schema:
type: string
example: example_value
- description: 'Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost beginning this month.'
in: query
name: start_month
required: true
schema:
format: date-time
type: string
example: example_value
- description: 'Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost ending this month.'
in: query
name: end_month
required: false
schema:
format: date-time
type: string
example: example_value
- description: 'Boolean to specify whether to include accounts connected to the current account as partner customers in the Datadog partner network program. Defaults to `false`. '
in: query
name: include_connected_accounts
required: false
schema:
default: false
type: boolean
example: true
responses:
'200':
content:
application/json;datetime-format=rfc3339:
schema:
$ref: '#/components/schemas/CostByOrgResponse'
description: OK
'400':
content:
application/json;datetime-format=rfc3339:
schema:
$ref: '#/components/schemas/APIErrorResponse'
description: Bad Request
'403':
content:
application/json;datetime-format=rfc3339:
schema:
$ref: '#/components/schemas/APIErrorResponse'
description: Forbidden - User is not authorized
'429':
content:
application/json;datetime-format=rfc3339:
schema:
$ref: '#/components/schemas/APIErrorResponse'
description: Too many requests
security:
- apiKeyAuth: []
appKeyAuth: []
- AuthZ:
- usage_read
summary: Datadog Get Historical Cost Across Your Account
tags:
- Historical
x-menu-order: 5
x-permission:
operator: OR
permissions:
- usage_read
x-undo:
type: safe
x-api-evangelist-processing:
PascalCaseOperationSummaries: true
ChooseTags: true
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
components:
schemas:
SecurityMonitoringRuleEvaluationWindow:
description: 'A time window is specified to match when at least one of the cases matches true. This is a sliding window
and evaluates in real time. For third party detection method, this field is not used.'
enum:
- 0
- 60
- 300
- 600
- 900
- 1800
- 3600
- 7200
- 10800
- 21600
- 43200
- 86400
format: int32
type: integer
x-enum-varnames:
- ZERO_MINUTES
- ONE_MINUTE
- FIVE_MINUTES
- TEN_MINUTES
- FIFTEEN_MINUTES
- THIRTY_MINUTES
- ONE_HOUR
- TWO_HOURS
- THREE_HOURS
- SIX_HOURS
- TWELVE_HOURS
- ONE_DAY
CostByOrgType:
default: cost_by_org
description: Type of cost data.
enum:
- cost_by_org
example: cost_by_org
type: string
x-enum-varnames:
- COST_BY_ORG
SecurityMonitoringStandardDataSource:
default: logs
description: Source of events, either logs, audit trail, or Datadog events.
enum:
- logs
- audit
- app_sec_spans
- spans
- security_runtime
- network
- events
example: logs
type: string
x-enum-varnames:
- LOGS
- AUDIT
- APP_SEC_SPANS
- SPANS
- SECURITY_RUNTIME
- NETWORK
- EVENTS
SecurityMonitoringRuleMaxSignalDuration:
description: 'A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.
This time is calculated from the first seen timestamp.'
enum:
- 0
- 60
- 300
- 600
- 900
- 1800
- 3600
- 7200
- 10800
- 21600
- 43200
- 86400
format: int32
type: integer
x-enum-varnames:
- ZERO_MINUTES
- ONE_MINUTE
- FIVE_MINUTES
- TEN_MINUTES
- FIFTEEN_MINUTES
- THIRTY_MINUTES
- ONE_HOUR
- TWO_HOURS
- THREE_HOURS
- SIX_HOURS
- TWELVE_HOURS
- ONE_DAY
SecurityMonitoringRuleCaseActionOptionsUserBehaviorName:
description: Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
type: string
SecurityMonitoringRuleNewValueOptionsLearningThreshold:
default: 0
description: A number of occurrences after which signals will be generated for values that weren't learned.
enum:
- 0
- 1
format: int32
type: integer
x-enum-varnames:
- ZERO_OCCURRENCES
- ONE_OCCURRENCE
SecurityMonitoringRuleNewValueOptionsForgetAfter:
description: The duration in days after which a learned value is forgotten.
enum:
- 1
- 2
- 7
- 14
- 21
- 28
format: int32
type: integer
x-enum-varnames:
- ONE_DAY
- TWO_DAYS
- ONE_WEEK
- TWO_WEEKS
- THREE_WEEKS
- FOUR_WEEKS
SecurityMonitoringRuleCaseActionOptions:
additionalProperties: {}
description: Options for the rule action
properties:
duration:
description: Duration of the action in seconds. 0 indicates no expiration.
example: 0
format: int64
minimum: 0
type: integer
userBehaviorName:
$ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsUserBehaviorName'
type: object
CostByOrg:
description: Cost data.
properties:
attributes:
$ref: '#/components/schemas/CostByOrgAttributes'
id:
description: Unique ID of the response.
type: string
example: abc-123-def
type:
$ref: '#/components/schemas/CostByOrgType'
type: object
CostByOrgResponse:
description: Chargeback Summary response.
properties:
data:
description: Response containing Chargeback Summary.
items:
$ref: '#/components/schemas/CostByOrg'
type: array
type: object
HistoricalJobOptions:
description: Job options.
properties:
detectionMethod:
$ref: '#/components/schemas/SecurityMonitoringRuleDetectionMethod'
evaluationWindow:
$ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
impossibleTravelOptions:
$ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptions'
keepAlive:
$ref: '#/components/schemas/SecurityMonitoringRuleKeepAlive'
maxSignalDuration:
$ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
newValueOptions:
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
thirdPartyRuleOptions:
$ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
type: object
RunHistoricalJobRequestDataType:
description: Type of data.
enum:
- historicalDetectionsJobCreate
type: string
x-enum-varnames:
- HISTORICALDETECTIONSJOBCREATE
APIErrorResponse:
description: API error response.
properties:
errors:
description: A list of errors.
example:
- Bad Request
items:
description: A list of items.
example: Bad Request
type: string
type: array
required:
- errors
type: object
HistoricalJobListMeta:
description: Metadata about the list of jobs.
properties:
totalCount:
description: Number of jobs in the list.
format: int32
maximum: 2147483647
type: integer
example: 42
type: object
SecurityMonitoringThirdPartyRootQuery:
description: A query to be combined with the third party case query.
properties:
groupByFields:
description: Fields to group by.
items:
description: Field.
type: string
type: array
query:
description: Query to run on logs.
example: source:cloudtrail
type: string
type: object
SecurityMonitoringRuleQueryAggregation:
description: The aggregation type.
enum:
- count
- cardinality
- sum
- max
- new_value
- geo_data
- event_count
- none
type: string
x-enum-varnames:
- COUNT
- CARDINALITY
- SUM
- MAX
- NEW_VALUE
- GEO_DATA
- EVENT_COUNT
- NONE
SecurityMonitoringRuleNewValueOptionsLearningMethod:
default: duration
description: The learning method used to determine when signals should be generated for values that weren't learned.
enum:
- duration
- threshold
type: string
x-enum-varnames:
- DURATION
- THRESHOLD
HistoricalJobResponseData:
description: Historical job response data.
properties:
attributes:
$ref: '#/components/schemas/HistoricalJobResponseAttributes'
id:
description: ID of the job.
type: string
example: abc-123-def
type:
$ref: '#/components/schemas/HistoricalJobDataType'
type: object
HistoricalJobQuery:
description: Query for selecting logs analyzed by the historical job.
properties:
aggregation:
$ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
dataSource:
$ref: '#/components/schemas/SecurityMonitoringStandardDataSource'
distinctFields:
description: Field for which the cardinality is measured. Sent as an array.
items:
description: Field.
type: string
type: array
groupByFields:
description: Fields to group by.
items:
description: Field.
type: string
type: array
hasOptionalGroupByFields:
description: When false, events without a group-by value are ignored by the query. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values.
example: false
readOnly: true
type: boolean
metrics:
description: Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
items:
description: Field.
type: string
type: array
name:
description: Name of the query.
type: string
example: Example Monitor
query:
description: Query to run on logs.
example: a > 3
type: string
type: object
SecurityMonitoringRuleCaseAction:
description: Action to perform when a signal is triggered. Only available for Application Security rule type.
properties:
options:
$ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptions'
type:
$ref: '#/components/schemas/SecurityMonitoringRuleCaseActionType'
type: object
JobDefinition:
description: Definition of a historical job.
properties:
calculatedFields:
description: Calculated fields.
items:
$ref: '#/components/schemas/CalculatedField'
type: array
cases:
description: Cases used for generating job results.
items:
$ref: '#/components/schemas/SecurityMonitoringRuleCaseCreate'
type: array
from:
description: Starting time of data analyzed by the job.
example: 1729843470000
format: int64
type: integer
groupSignalsBy:
description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
example:
- service
items:
description: Field to group by.
type: string
type: array
index:
description: Index used to load the data.
example: cloud_siem
type: string
message:
description: Message for generated results.
example: A large number of failed login attempts.
type: string
name:
description: Job name.
example: Excessive number of failed attempts.
type: string
options:
$ref: '#/components/schemas/HistoricalJobOptions'
queries:
description: Queries for selecting logs analyzed by the job.
items:
$ref: '#/components/schemas/HistoricalJobQuery'
type: array
referenceTables:
description: Reference tables used in the queries.
items:
$ref: '#/components/schemas/SecurityMonitoringReferenceTable'
type: array
tags:
description: Tags for generated signals.
items:
type: string
type: array
thirdPartyCases:
description: Cases for generating results from third-party detection method. Only available for third-party detection method.
example: []
items:
$ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate'
type: array
to:
description: Ending time of data analyzed by the job.
example: 1729847070000
format: int64
type: integer
type:
description: Job type.
type: string
example: metric alert
required:
- from
- to
- index
- name
- cases
- queries
- message
type: object
JobCreateResponse:
description: Run a historical job response.
properties:
data:
$ref: '#/components/schemas/JobCreateResponseData'
type: object
SecurityMonitoringRuleNewValueOptionsLearningDuration:
default: 0
description: 'The duration in days during which values are learned, and after which signals will be generated for values that
weren''t learned. If set to 0, a signal will be generated for all new values after the first value is learned.'
enum:
- 0
- 1
- 7
format: int32
type: integer
x-enum-varnames:
- ZERO_DAYS
- ONE_DAY
- SEVEN_DAYS
HistoricalJobResponseAttributes:
description: Historical job attributes.
properties:
createdAt:
description: Time when the job was created.
type: string
example: example_value
createdByHandle:
description: The handle of the user who created the job.
type: string
example: example_value
createdByName:
description: The name of the user who created the job.
type: string
example: Example Monitor
createdFromRuleId:
description: ID of the rule used to create the job (if it is created from a rule).
type: string
example: abc-123-def
jobDefinition:
$ref: '#/components/schemas/JobDefinition'
jobName:
description: Job name.
type: string
example: Example Monitor
jobStatus:
description: Job status.
type: string
example: OK
modifiedAt:
description: Last modification time of the job.
type: string
example: example_value
type: object
RunHistoricalJobRequest:
description: Run a historical job request.
properties:
data:
$ref: '#/components/schemas/RunHistoricalJobRequestData'
type: object
SecurityMonitoringRuleCaseCreate:
description: Case when signal is generated.
properties:
actions:
description: Action to perform for each rule case.
items:
$ref: '#/components/schemas/SecurityMonitoringRuleCaseAction'
type: array
condition:
description: 'A case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated
based on the event counts in the previously defined queries.'
type: string
example: example_value
name:
description: Name of the case.
type: string
example: Example Monitor
notifications:
description: Notification targets.
items:
description: Notification.
type: string
type: array
status:
$ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
required:
- status
type: object
SecurityMonitoringRuleThirdPartyOptions:
description: Options on third party detection method.
properties:
defaultNotifications:
description: Notification targets for the logs that do not correspond to any of the cases.
items:
description: Notification.
type: string
type: array
defaultStatus:
$ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
rootQueries:
description: Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
items:
$ref: '#/components/schemas/SecurityMonitoringThirdPartyRootQuery'
type: array
signalTitleTemplate:
description: A template for the signal title; if omitted, the title is generated based on the case name.
type: string
example: Example Monitor
type: object
ListHistoricalJobsResponse:
description: List of historical jobs.
properties:
data:
description: Array containing the list of historical jobs.
items:
$ref: '#/components/schemas/HistoricalJobResponseData'
type: array
meta:
$ref: '#/components/schemas/HistoricalJobListMeta'
type: object
RunHistoricalJobRequestData:
description: Data for running a historical job request.
properties:
attributes:
$ref: '#/components/schemas/RunHistoricalJobRequestAttributes'
type:
$ref: '#/components/schemas/RunHistoricalJobRequestDataType'
type: object
SecurityMonitoringRuleNewValueOptions:
description: Options on new value detection method.
properties:
forgetAfter:
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter'
learningDuration:
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration'
learningMethod:
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningMethod'
learningThreshold:
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningThreshold'
type: object
SecurityMonitoringThirdPartyRuleCaseCreate:
description: Case when a signal is generated by a third party rule.
properties:
name:
description: Name of the case.
type: string
example: Example Monitor
notifications:
description: Notification targets for each case.
items:
description: Notification.
type: string
type: array
query:
description: A query to map a third party event to this case.
type: string
example: avg:system.cpu.user{*}
status:
$ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
required:
- status
type: object
SecurityMonitoringRuleImpossibleTravelOptions:
description: Options on impossible travel detection method.
properties:
baselineUserLocations:
$ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations'
type: object
SecurityMonitoringReferenceTable:
description: Reference tables used in the queries.
properties:
checkPresence:
description: Whether to include or exclude the matched values.
type: boolean
example: true
columnName:
description: The name of the column in the reference table.
type: string
example: Example Monitor
logFieldPath:
description: The field in the log to match against the reference table.
type: string
example: example_value
ruleQueryName:
description: The name of the query to apply the reference table to.
type: string
example: Example Monitor
tableName:
description: The name of the reference table.
type: string
example: Example Monitor
type: object
SecurityMonitoringRuleKeepAlive:
description: 'Once a signal is generated, the signal will remain "open" if a case is matched at least once within
this keep alive window. For third party detection method, this field is not used.'
enum:
- 0
- 60
- 300
- 600
- 900
- 1800
- 3600
- 7200
- 10800
- 21600
- 43200
- 86400
format: int32
type: integer
x-enum-varnames:
- ZERO_MINUTES
- ONE_MINUTE
- FIVE_MINUTES
- TEN_MINUTES
- FIFTEEN_MINUTES
- THIRTY_MINUTES
- ONE_HOUR
- TWO_HOURS
- THREE_HOURS
- SIX_HOURS
- TWELVE_HOURS
- ONE_DAY
ChargebackBreakdown:
description: Charges breakdown.
properties:
charge_type:
description: The type of charge for a particular product.
example: on_demand
type: string
cost:
description: The cost for a particular product and charge type during a given month.
format: double
type: number
example: 95.5
product_name:
description: The product for which cost is being reported.
example: infra_host
type: string
type: object
SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations:
description: 'If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user''s regular
access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.'
example: true
type: boolean
CalculatedField:
description: Calculated field.
properties:
expression:
description: Expression.
example: '@request_end_timestamp - @request_start_timestamp'
type: string
name:
description: Field name.
example: response_time
type: string
required:
- name
- expression
type: object
HistoricalJobDataType:
description: Type of payload.
enum:
- historicalDetectionsJob
type: string
x-enum-varnames:
- HISTORICALDETECTIONSJOB
RunHistoricalJobRequestAttributes:
description: Run a historical job request.
properties:
fromRule:
$ref: '#/components/schemas/JobDefinitionFromRule'
id:
description: Request ID.
type: string
example: abc-123-def
jobDefinition:
$ref: '#/components/schemas/JobDefinition'
type: object
JobCreateResponseData:
description: The definition of `JobCreateResponseData` object.
properties:
id:
description: ID of the created job.
type: string
example: abc-123-def
type:
$ref: '#/components/schemas/HistoricalJobDataType'
type: object
JobDefinitionFromRule:
description: Definition of a historical job based on a security monitoring rule.
properties:
caseIndex:
description: Index of the rule case applied by the job.
example: 0
format: int32
maximum: 9
type: integer
from:
description: Starting time of data analyzed by the job.
example: 172984347000
# --- truncated at 32 KB (43 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/openapi/datadog-historical-api-openapi.yml