skills.rest
lauhon
lauhonCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security

Query Datadog security signals and list detection rules via the pup CLI.

5|2|Updated Mar 9, 2026
Search Tags:#incident response#threat detection#datadog#detection rules#siem#security monitoring#security signals
One-click install
npx skills add https://github.com/lauhon/pi --skill security-lauhon
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security
Source: https://github.com/lauhon/pi/tree/main/skills/security
Command: npx skills add https://github.com/lauhon/pi --skill security-lauhon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Investigating security threats requires manually querying Datadog's Security Monitoring API with correct query syntax, time ranges, and filters, which is slow and error-prone during incident response. ## Core Features & Use Cases - Security Signal Search: Query security signals with flexible filters on severity, status, rule name, source, tags, and custom time ranges. - Detection Rule Listing: View all configured security detection rules and their enabled status. - Threat Triage: Prioritize critical and high-severity signals such as brute force attacks, SQL injection, and data exfiltration attempts. - Use Case: During a suspected breach, ask for high-severity signals from the last 24 hours to quickly identify brute force attempts, unusual logins, and suspicious network traffic across production services. ## Quick Start Show me all high-severity security signals from the last 24 hours in my Datadog account.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I search Datadog security signals by severity?▼

Search Datadog security signals by severity using the query filter status:high, status:medium, status:low, or status:info with the pup security signals command. Combine it with --from and --to parameters to bound the time range, such as the last hour or 24 hours.

How do I list Datadog security detection rules from the CLI?▼

List Datadog security detection rules by running pup security rules, which returns all configured rules with their ID, name, and enabled status. This requires the DD_API_KEY and DD_APP_KEY environment variables to be set.

What query syntax does Datadog security signal search support?▼

Datadog security signal search supports filters on status, rule.name with wildcards, source such as cloudtrail or kubernetes_audit, tags like env:production, and attributes like @usr.name. It also supports boolean operators AND, OR, NOT and time ranges in relative, Unix timestamp, or ISO formats.

Why does the Datadog security query fail with a credentials error?▼

The query fails because the DD_API_KEY or DD_APP_KEY environment variables are missing. Export both variables, and optionally DD_SITE, before running pup security commands, and ensure the keys have security monitoring permissions.

Can I create or modify Datadog security detection rules with this tool?▼

No, security rule creation and signal management are not currently supported and are planned for future updates. Use the Datadog Security Monitoring UI to create custom detection rules or manage signal states.

Related Skills

Explore More Software Engineering Skills→
swtch1swtch1

datadog

Query Datadog logs and list services from the command line.

Community
Intermediate
dandyedandye
85

ip-get-gti-report

Retrieves GTI reputation, ASN, and geolocation reports for IP addresses.

Community
Intermediate
opensearch-projectopensearch-project
34

correlation

Correlate OpenTelemetry traces, logs, and metrics using shared fields and PPL queries.

Official
Advanced
alexmaruccialexmarucci

security

Query and manage Datadog security monitoring signals and rules via API.

Community
Intermediate