Datadog Jobs API

openapi: 3.0.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Account Jobs API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Jobs
paths:
  /api/v2/siem-historical-detections/jobs:
    get:
      description: List historical jobs.
      operationId: ListHistoricalJobs
      parameters:
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageNumber'
      - description: The order of the jobs in results.
        example: status
        in: query
        name: sort
        required: false
        schema:
          type: string
      - description: Query used to filter items from the fetched list.
        example: security:attack status:high
        in: query
        name: filter[query]
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListHistoricalJobsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ: []
      summary: Datadog List Historical Jobs
      tags:
      - Jobs
      x-menu-order: 20
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.

        Please check the documentation regularly for updates.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      description: Run a historical job.
      operationId: RunHistoricalJob
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RunHistoricalJobRequest'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JobCreateResponse'
          description: Status created
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Run a Historical Job
      tags:
      - Jobs
      x-codegen-request-body-name: body
      x-given:
        historical_job:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"historicalDetectionsJobCreate\",\n    \"attributes\": {\n      \"jobDefinition\": {\n        \"type\": \"log_detection\",\n        \"name\": \"Excessive number of failed attempts.\",\n        \"queries\": [\n          {\n            \"query\": \"source:non_existing_src_weekend\",\n            \"aggregation\": \"count\",\n            \"groupByFields\": [],\n            \"distinctFields\": []\n          }\n        ],\n        \"cases\": [\n          {\n            \"name\": \"Condition 1\",\n            \"status\": \"info\",\n            \"notifications\": [],\n            \"condition\": \"a > 1\"\n          }\n        ],\n        \"options\": {\n          \"keepAlive\": 3600,\n          \"maxSignalDuration\": 86400,\n          \"evaluationWindow\": 900\n        },\n        \"message\": \"A large number of failed login attempts.\",\n        \"tags\": [],\n        \"from\": 1730387522611,\n        \"to\": 1730387532611,\n        \"index\": \"main\"\n      }\n    }\n  }\n}"
          step: there is a valid "historical_job" in the system
      x-menu-order: 19
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.

        Please check the documentation regularly for updates.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/siem-historical-detections/jobs/signal_convert:
    post:
      description: Convert a job result to a signal.
      operationId: ConvertJobResultToSignal
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConvertJobResultsToSignalsRequest'
        required: true
      responses:
        '204':
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Convert a Job Result to a Signal
      tags:
      - Jobs
      x-codegen-request-body-name: body
      x-menu-order: 24
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_signals_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.

        Please check the documentation regularly for updates.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/siem-historical-detections/jobs/{job_id}:
    delete:
      description: Delete an existing job.
      operationId: DeleteHistoricalJob
      parameters:
      - $ref: '#/components/parameters/HistoricalJobID'
      responses:
        '204':
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ: []
      summary: Datadog Delete an Existing Job
      tags:
      - Jobs
      x-menu-order: 23
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.

        Please check the documentation regularly for updates.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/siem-historical-detections/jobs/{job_id}/cancel:
    patch:
      description: Cancel a historical job.
      operationId: CancelHistoricalJob
      parameters:
      - $ref: '#/components/parameters/HistoricalJobID'
      responses:
        '204':
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Cancel a Historical Job
      tags:
      - Jobs
      x-menu-order: 22
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.

        Please check the documentation regularly for updates.'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    SecurityMonitoringRuleEvaluationWindow:
      description: 'A time window is specified to match when at least one of the cases matches true. This is a sliding window

        and evaluates in real time. For third party detection method, this field is not used.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    SecurityMonitoringStandardDataSource:
      default: logs
      description: Source of events, either logs, audit trail, or Datadog events.
      enum:
      - logs
      - audit
      - app_sec_spans
      - spans
      - security_runtime
      - network
      - events
      example: logs
      type: string
      x-enum-varnames:
      - LOGS
      - AUDIT
      - APP_SEC_SPANS
      - SPANS
      - SECURITY_RUNTIME
      - NETWORK
      - EVENTS
    SecurityMonitoringRuleMaxSignalDuration:
      description: 'A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.

        This time is calculated from the first seen timestamp.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    SecurityMonitoringRuleCaseActionOptionsUserBehaviorName:
      description: Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
      type: string
    SecurityMonitoringRuleNewValueOptionsLearningThreshold:
      default: 0
      description: A number of occurrences after which signals will be generated for values that weren't learned.
      enum:
      - 0
      - 1
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_OCCURRENCES
      - ONE_OCCURRENCE
    SecurityMonitoringRuleNewValueOptionsForgetAfter:
      description: The duration in days after which a learned value is forgotten.
      enum:
      - 1
      - 2
      - 7
      - 14
      - 21
      - 28
      format: int32
      type: integer
      x-enum-varnames:
      - ONE_DAY
      - TWO_DAYS
      - ONE_WEEK
      - TWO_WEEKS
      - THREE_WEEKS
      - FOUR_WEEKS
    SecurityMonitoringRuleCaseActionOptions:
      additionalProperties: {}
      description: Options for the rule action
      properties:
        duration:
          description: Duration of the action in seconds. 0 indicates no expiration.
          example: 0
          format: int64
          minimum: 0
          type: integer
        userBehaviorName:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsUserBehaviorName'
      type: object
    HistoricalJobOptions:
      description: Job options.
      properties:
        detectionMethod:
          $ref: '#/components/schemas/SecurityMonitoringRuleDetectionMethod'
        evaluationWindow:
          $ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
        impossibleTravelOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptions'
        keepAlive:
          $ref: '#/components/schemas/SecurityMonitoringRuleKeepAlive'
        maxSignalDuration:
          $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
        newValueOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
        thirdPartyRuleOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
      type: object
    ConvertJobResultsToSignalsAttributes:
      description: Attributes for converting historical job results to signals.
      properties:
        id:
          description: Request ID.
          type: string
          example: abc-123-def
        jobResultIds:
          description: Job result IDs.
          example:
          - ''
          items:
            type: string
          type: array
        notifications:
          description: Notifications sent.
          example:
          - ''
          items:
            type: string
          type: array
        signalMessage:
          description: Message of generated signals.
          example: A large number of failed login attempts.
          type: string
        signalSeverity:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      required:
      - jobResultIds
      - signalSeverity
      - signalMessage
      - notifications
      type: object
    RunHistoricalJobRequestDataType:
      description: Type of data.
      enum:
      - historicalDetectionsJobCreate
      type: string
      x-enum-varnames:
      - HISTORICALDETECTIONSJOBCREATE
    APIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          example:
          - Bad Request
          items:
            description: A list of items.
            example: Bad Request
            type: string
          type: array
      required:
      - errors
      type: object
    HistoricalJobListMeta:
      description: Metadata about the list of jobs.
      properties:
        totalCount:
          description: Number of jobs in the list.
          format: int32
          maximum: 2147483647
          type: integer
          example: 42
      type: object
    SecurityMonitoringThirdPartyRootQuery:
      description: A query to be combined with the third party case query.
      properties:
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        query:
          description: Query to run on logs.
          example: source:cloudtrail
          type: string
      type: object
    SecurityMonitoringRuleQueryAggregation:
      description: The aggregation type.
      enum:
      - count
      - cardinality
      - sum
      - max
      - new_value
      - geo_data
      - event_count
      - none
      type: string
      x-enum-varnames:
      - COUNT
      - CARDINALITY
      - SUM
      - MAX
      - NEW_VALUE
      - GEO_DATA
      - EVENT_COUNT
      - NONE
    SecurityMonitoringRuleNewValueOptionsLearningMethod:
      default: duration
      description: The learning method used to determine when signals should be generated for values that weren't learned.
      enum:
      - duration
      - threshold
      type: string
      x-enum-varnames:
      - DURATION
      - THRESHOLD
    HistoricalJobResponseData:
      description: Historical job response data.
      properties:
        attributes:
          $ref: '#/components/schemas/HistoricalJobResponseAttributes'
        id:
          description: ID of the job.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/HistoricalJobDataType'
      type: object
    HistoricalJobQuery:
      description: Query for selecting logs analyzed by the historical job.
      properties:
        aggregation:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
        dataSource:
          $ref: '#/components/schemas/SecurityMonitoringStandardDataSource'
        distinctFields:
          description: Field for which the cardinality is measured. Sent as an array.
          items:
            description: Field.
            type: string
          type: array
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        hasOptionalGroupByFields:
          description: When false, events without a group-by value are ignored by the query. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values.
          example: false
          readOnly: true
          type: boolean
        metrics:
          description: Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
          items:
            description: Field.
            type: string
          type: array
        name:
          description: Name of the query.
          type: string
          example: Example Monitor
        query:
          description: Query to run on logs.
          example: a > 3
          type: string
      type: object
    SecurityMonitoringRuleCaseAction:
      description: Action to perform when a signal is triggered. Only available for Application Security rule type.
      properties:
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptions'
        type:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionType'
      type: object
    JobDefinition:
      description: Definition of a historical job.
      properties:
        calculatedFields:
          description: Calculated fields.
          items:
            $ref: '#/components/schemas/CalculatedField'
          type: array
        cases:
          description: Cases used for generating job results.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseCreate'
          type: array
        from:
          description: Starting time of data analyzed by the job.
          example: 1729843470000
          format: int64
          type: integer
        groupSignalsBy:
          description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
          example:
          - service
          items:
            description: Field to group by.
            type: string
          type: array
        index:
          description: Index used to load the data.
          example: cloud_siem
          type: string
        message:
          description: Message for generated results.
          example: A large number of failed login attempts.
          type: string
        name:
          description: Job name.
          example: Excessive number of failed attempts.
          type: string
        options:
          $ref: '#/components/schemas/HistoricalJobOptions'
        queries:
          description: Queries for selecting logs analyzed by the job.
          items:
            $ref: '#/components/schemas/HistoricalJobQuery'
          type: array
        referenceTables:
          description: Reference tables used in the queries.
          items:
            $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
          type: array
        tags:
          description: Tags for generated signals.
          items:
            type: string
          type: array
        thirdPartyCases:
          description: Cases for generating results from third-party detection method. Only available for third-party detection method.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate'
          type: array
        to:
          description: Ending time of data analyzed by the job.
          example: 1729847070000
          format: int64
          type: integer
        type:
          description: Job type.
          type: string
          example: metric alert
      required:
      - from
      - to
      - index
      - name
      - cases
      - queries
      - message
      type: object
    ConvertJobResultsToSignalsDataType:
      description: Type of payload.
      enum:
      - historicalDetectionsJobResultSignalConversion
      type: string
      x-enum-varnames:
      - HISTORICALDETECTIONSJOBRESULTSIGNALCONVERSION
    ConvertJobResultsToSignalsData:
      description: Data for converting historical job results to signals.
      properties:
        attributes:
          $ref: '#/components/schemas/ConvertJobResultsToSignalsAttributes'
        type:
          $ref: '#/components/schemas/ConvertJobResultsToSignalsDataType'
      type: object
    JobCreateResponse:
      description: Run a historical job response.
      properties:
        data:
          $ref: '#/components/schemas/JobCreateResponseData'
      type: object
    SecurityMonitoringRuleNewValueOptionsLearningDuration:
      default: 0
      description: 'The duration in days during which values are learned, and after which signals will be generated for values that

        weren''t learned. If set to 0, a signal will be generated for all new values after the first value is learned.'
      enum:
      - 0
      - 1
      - 7
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_DAYS
      - ONE_DAY
      - SEVEN_DAYS
    ConvertJobResultsToSignalsRequest:
      description: Request for converting historical job results to signals.
      properties:
        data:
          $ref: '#/components/schemas/ConvertJobResultsToSignalsData'
      type: object
    HistoricalJobResponseAttributes:
      description: Historical job attributes.
      properties:
        createdAt:
          description: Time when the job was created.
          type: string
          example: example_value
        createdByHandle:
          description: The handle of the user who created the job.
          type: string
          example: example_value
        createdByName:
          description: The name of the user who created the job.
          type: string
          example: Example Monitor
        createdFromRuleId:
          description: ID of the rule used to create the job (if it is created from a rule).
          type: string
          example: abc-123-def
        jobDefinition:
          $ref: '#/components/schemas/JobDefinition'
        jobName:
          description: Job name.
          type: string
          example: Example Monitor
        jobStatus:
          description: Job status.
          type: string
          example: OK
        modifiedAt:
          description: Last modification time of the job.
          type: string
          example: example_value
      type: object
    RunHistoricalJobRequest:
      description: Run a historical job request.
      properties:
        data:
          $ref: '#/components/schemas/RunHistoricalJobRequestData'
      type: object
    SecurityMonitoringRuleCaseCreate:
      description: Case when signal is generated.
      properties:
        actions:
          description: Action to perform for each rule case.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseAction'
          type: array
        condition:
          description: 'A case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated

            based on the event counts in the previously defined queries.'
          type: string
          example: example_value
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets.
          items:
            description: Notification.
            type: string
          type: array
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      required:
      - status
      type: object
    SecurityMonitoringRuleThirdPartyOptions:
      description: Options on third party detection method.
      properties:
        defaultNotifications:
          description: Notification targets for the logs that do not correspond to any of the cases.
          items:
            description: Notification.
            type: string
          type: array
        defaultStatus:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
        rootQueries:
          description: Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRootQuery'
          type: array
        signalTitleTemplate:
          description: A template for the signal title; if omitted, the title is generated based on the case name.
          type: string
          example: Example Monitor
      type: object
    ListHistoricalJobsResponse:
      description: List of historical jobs.
      properties:
        data:
          description: Array containing the list of historical jobs.
          items:
            $ref: '#/components/schemas/HistoricalJobResponseData'
          type: array
        meta:
          $ref: '#/components/schemas/HistoricalJobListMeta'
      type: object
    RunHistoricalJobRequestData:
      description: Data for running a historical job request.
      properties:
        attributes:
          $ref: '#/components/schemas/RunHistoricalJobRequestAttributes'
        type:
          $ref: '#/components/schemas/RunHistoricalJobRequestDataType'
      type: object
    SecurityMonitoringRuleNewValueOptions:
      description: Options on new value detection method.
      properties:
        forgetAfter:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter'
        learningDuration:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration'
        learningMethod:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningMethod'
        learningThreshold:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningThreshold'
      type: object
    SecurityMonitoringThirdPartyRuleCaseCreate:
      description: Case when a signal is generated by a third party rule.
      properties:
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets for each case.
          items:
            description: Notification.
            type: string
          type: array
        query:
          description: A query to map a third party event to this case.
          type: string
          example: avg:system.cpu.user{*}
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      required:
      - status
      type: object
    SecurityMonitoringRuleImpossibleTravelOptions:
      description: Options on impossible travel detection method.
      properties:
        baselineUserLocations:
          $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations'
      type: object
    SecurityMonitoringReferenceTable:
      description: Reference tables used in the queries.
      properties:
        checkPresence:
          description: Whether to include or exclude the matched values.
          type: boolean
          example: true
        columnName:
          description: The name of the column in the reference table.
          type: string
          example: Example Monitor
        logFieldPath:
          description: The field in the log to match against the reference table.
          type: string
          example: example_value
        ruleQueryName:
          description: The name of the query to apply the reference table to.
          type: string
          example: Example Monitor
        tableName:
          description: The name of the reference table.
          type: string
          example: Example Monitor
      type: object
    SecurityMonitoringRuleKeepAlive:
      description: 'Once a signal is generated, the signal will remain "open" if a case is matched at least once within

        this keep alive window. For third party detection method, this field is not used.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations:
      description: 'If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user''s regular

        access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.'
      example: true
      type: boolean
    CalculatedField:
      description: Calculated field.
      properties:
        expression:
          description: Expression.
          example: '@request_end_timestamp - @request_start_timestamp'
          type: string
        name:
          description: Field name.
          example: response_time
          type: string
      required:
      - name
      - expression
      type: object
    HistoricalJobDataType:
      description: Type of payload.
      enum:
      - historicalDetectionsJob
      type: string
      x-enum-varnames:
      - HISTORICALDETECTIONSJOB
    RunHistoricalJobRequestAttributes:
      description: Run a historical job request.
      properties:
        fromRule:
          $ref: '#/components/schemas/JobDefinitionFromRule'
        id:
          description: Request ID.
          type: string
          example: abc-123-def
        jobDefinition:
          $ref: '#/components/schemas/JobDefinition'
      type: object
    JobCreateResponseData:
      description: The definition of `JobCreateResponseData` object.
      properties:
        id:
          description: ID of the created job.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/HistoricalJobDataType'
      type: object
    JobDefinitionFromRule:
      description: Definition of a historical job based on a security monitoring rule.
      properties:
        caseIndex:
          description: Index of the rule case applied by the job.
          example: 0
          format: int32
          maximum: 9
          type: integer
        from:
          description: Starting time of data analyzed by the job.
          example: 1729843470000
          forma

# --- truncated at 32 KB (42 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/openapi/datadog-jobs-api-openapi.yml