Skip to content

Commit 2fe4a7b

Browse files
author
ci.datadog-api-spec
committed
Regenerate client from commit 7dbf3069 of spec repo
1 parent afa0504 commit 2fe4a7b

16 files changed

+576
-4
lines changed

‎.apigentools-info

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
"spec_versions": {
55
"v1": {
66
"apigentools_version": "1.6.6",
7-
"regenerated": "2024-01-03 09:19:43.313571",
8-
"spec_repo_commit": "9fcd8e1e"
7+
"regenerated": "2024-01-03 15:13:05.979089",
8+
"spec_repo_commit": "7dbf3069"
99
},
1010
"v2": {
1111
"apigentools_version": "1.6.6",
12-
"regenerated": "2024-01-03 09:19:43.328470",
13-
"spec_repo_commit": "9fcd8e1e"
12+
"regenerated": "2024-01-03 15:13:05.993382",
13+
"spec_repo_commit": "7dbf3069"
1414
}
1515
}
1616
}

‎.generator/schemas/v2/openapi.yaml

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15617,6 +15617,8 @@ components:
1561715617
$ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
1561815618
newValueOptions:
1561915619
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
15620+
thirdPartyRuleOptions:
15621+
$ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
1562015622
type: object
1562115623
SecurityMonitoringRuleQuery:
1562215624
description: Query for matching rule.
@@ -15665,6 +15667,30 @@ components:
1566515667
- MEDIUM
1566615668
- HIGH
1566715669
- CRITICAL
15670+
SecurityMonitoringRuleThirdPartyOptions:
15671+
description: Options on third party rules.
15672+
properties:
15673+
defaultNotifications:
15674+
description: Notification targets for the logs that do not correspond to
15675+
any of the cases.
15676+
items:
15677+
description: Notification.
15678+
type: string
15679+
type: array
15680+
defaultStatus:
15681+
$ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
15682+
rootQueries:
15683+
description: Queries to be combined with third party case queries. Each
15684+
of them can have different group by fields, to aggregate differently based
15685+
on the type of alert.
15686+
items:
15687+
$ref: '#/components/schemas/SecurityMonitoringThirdPartyRootQuery'
15688+
type: array
15689+
signalTitleTemplate:
15690+
description: A template for the signal title; if omitted, the title is generated
15691+
based on the case name.
15692+
type: string
15693+
type: object
1566815694
SecurityMonitoringRuleTypeCreate:
1566915695
description: The rule type.
1567015696
enum:
@@ -15734,6 +15760,13 @@ components:
1573415760
description: Tag.
1573515761
type: string
1573615762
type: array
15763+
thirdPartyCases:
15764+
description: Cases for generating signals from third party rules. Only available
15765+
for third party rules.
15766+
example: []
15767+
items:
15768+
$ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCase'
15769+
type: array
1573715770
version:
1573815771
description: The version of the rule being updated.
1573915772
example: 1
@@ -16363,6 +16396,13 @@ components:
1636316396
description: Tag.
1636416397
type: string
1636516398
type: array
16399+
thirdPartyCases:
16400+
description: Cases for generating signals from third party rules. Only available
16401+
for third party rules.
16402+
example: []
16403+
items:
16404+
$ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate'
16405+
type: array
1636616406
type:
1636716407
$ref: '#/components/schemas/SecurityMonitoringRuleTypeCreate'
1636816408
required:
@@ -16484,6 +16524,13 @@ components:
1648416524
description: Tag.
1648516525
type: string
1648616526
type: array
16527+
thirdPartyCases:
16528+
description: Cases for generating signals from third party rules. Only available
16529+
for third party rules.
16530+
example: []
16531+
items:
16532+
$ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCase'
16533+
type: array
1648716534
type:
1648816535
$ref: '#/components/schemas/SecurityMonitoringRuleTypeRead'
1648916536
updateAuthorId:
@@ -16494,6 +16541,58 @@ components:
1649416541
description: The version of the rule.
1649516542
format: int64
1649616543
type: integer
16544+
SecurityMonitoringThirdPartyRootQuery:
16545+
description: A query to be combined with the third party case query.
16546+
properties:
16547+
groupByFields:
16548+
description: Fields to group by.
16549+
items:
16550+
description: Field.
16551+
type: string
16552+
type: array
16553+
query:
16554+
description: Query to run on logs.
16555+
example: source:cloudtrail
16556+
type: string
16557+
type: object
16558+
SecurityMonitoringThirdPartyRuleCase:
16559+
description: Case when signal is generated by a third party rule.
16560+
properties:
16561+
name:
16562+
description: Name of the case.
16563+
type: string
16564+
notifications:
16565+
description: Notification targets for each rule case.
16566+
items:
16567+
description: Notification.
16568+
type: string
16569+
type: array
16570+
query:
16571+
description: A query to map a third party event to this case.
16572+
type: string
16573+
status:
16574+
$ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
16575+
type: object
16576+
SecurityMonitoringThirdPartyRuleCaseCreate:
16577+
description: Case when a signal is generated by a third party rule.
16578+
properties:
16579+
name:
16580+
description: Name of the case.
16581+
type: string
16582+
notifications:
16583+
description: Notification targets for each rule case.
16584+
items:
16585+
description: Notification.
16586+
type: string
16587+
type: array
16588+
query:
16589+
description: A query to map a third party event to this case.
16590+
type: string
16591+
status:
16592+
$ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
16593+
required:
16594+
- status
16595+
type: object
1649716596
SecurityMonitoringTriageUser:
1649816597
description: Object representing a given user entity.
1649916598
properties:

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-detection-rule-with-detection-method-third_party-returns-OK-response_1476655317/frozen.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2024-01-03T15:07:54.290Z"

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-detection-rule-with-detection-method-third_party-returns-OK-response_1476655317/recording.har

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Create a detection rule with detection method 'third_party' returns \"OK\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "4a87db9d8ab6a6359a8738ed42c5f31b",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 613,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 588,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"cases\":[],\"isEnabled\":true,\"message\":\"This is a third party rule\",\"name\":\"Test-Create_a_detection_rule_with_detection_method_third_party_returns_OK_response-1704294474\",\"options\":{\"detectionMethod\":\"third_party\",\"keepAlive\":0,\"maxSignalDuration\":0,\"thirdPartyRuleOptions\":{\"defaultStatus\":\"info\",\"rootQueries\":[{\"groupByFields\":[\"instance-id\"],\"query\":\"source:guardduty @details.alertType:*EC2*\"},{\"groupByFields\":[],\"query\":\"source:guardduty\"}]}},\"queries\":[],\"thirdPartyCases\":[{\"name\":\"high\",\"query\":\"status:error\",\"status\":\"high\"},{\"name\":\"low\",\"query\":\"status:info\",\"status\":\"low\"}],\"type\":\"log_detection\"}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules"
39+
},
40+
"response": {
41+
"bodySize": 1259,
42+
"content": {
43+
"mimeType": "application/json",
44+
"size": 1259,
45+
"text": "{\"id\":\"ut1-s7a-0kn\",\"version\":1,\"name\":\"Test-Create_a_detection_rule_with_detection_method_third_party_returns_OK_response-1704294474\",\"createdAt\":1704294474748,\"creationAuthorId\":1445416,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"status:error\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"none\",\"name\":\"\"},{\"query\":\"status:info\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"none\",\"name\":\"\"}],\"options\":{\"keepAlive\":0,\"maxSignalDuration\":0,\"detectionMethod\":\"third_party\",\"evaluationWindow\":0,\"thirdPartyRuleOptions\":{\"defaultStatus\":\"info\",\"defaultNotifications\":[],\"rootQueries\":[{\"query\":\"source:guardduty @details.alertType:*EC2*\",\"groupByFields\":[\"instance-id\"]},{\"query\":\"source:guardduty\",\"groupByFields\":[]}]}},\"cases\":[{\"name\":\"high\",\"status\":\"high\",\"notifications\":[]},{\"name\":\"low\",\"status\":\"low\",\"notifications\":[]}],\"message\":\"This is a third party rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"log_detection\",\"filters\":[],\"thirdPartyCases\":[{\"name\":\"high\",\"status\":\"high\",\"notifications\":[],\"query\":\"status:error\"},{\"name\":\"low\",\"status\":\"low\",\"notifications\":[],\"query\":\"status:info\"}]}\n"
46+
},
47+
"cookies": [],
48+
"headers": [
49+
{
50+
"name": "content-type",
51+
"value": "application/json"
52+
}
53+
],
54+
"headersSize": 655,
55+
"httpVersion": "HTTP/1.1",
56+
"redirectURL": "",
57+
"status": 200,
58+
"statusText": "OK"
59+
},
60+
"startedDateTime": "2024-01-03T15:07:54.294Z",
61+
"time": 499
62+
},
63+
{
64+
"_id": "59d5aaa9367664c73c237fc46c3e36cc",
65+
"_order": 0,
66+
"cache": {},
67+
"request": {
68+
"bodySize": 0,
69+
"cookies": [],
70+
"headers": [
71+
{
72+
"_fromType": "array",
73+
"name": "accept",
74+
"value": "*/*"
75+
}
76+
],
77+
"headersSize": 536,
78+
"httpVersion": "HTTP/1.1",
79+
"method": "DELETE",
80+
"queryString": [],
81+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules/ut1-s7a-0kn"
82+
},
83+
"response": {
84+
"bodySize": 0,
85+
"content": {
86+
"mimeType": "text/plain",
87+
"size": 0
88+
},
89+
"cookies": [],
90+
"headers": [],
91+
"headersSize": 601,
92+
"httpVersion": "HTTP/1.1",
93+
"redirectURL": "",
94+
"status": 204,
95+
"statusText": "No Content"
96+
},
97+
"startedDateTime": "2024-01-03T15:07:54.802Z",
98+
"time": 533
99+
}
100+
],
101+
"pages": [],
102+
"version": "1.2"
103+
}
104+
}

‎examples/v2/security-monitoring/CreateSecurityMonitoringRule_3367706049.ts

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
/**
2+
* Create a detection rule with detection method 'third_party' returns "OK" response
3+
*/
4+
5+
import { client, v2 } from "@datadog/datadog-api-client";
6+
7+
const configuration = client.createConfiguration();
8+
const apiInstance = new v2.SecurityMonitoringApi(configuration);
9+
10+
const params: v2.SecurityMonitoringApiCreateSecurityMonitoringRuleRequest = {
11+
body: {
12+
name: "Example-Security-Monitoring",
13+
type: "log_detection",
14+
isEnabled: true,
15+
thirdPartyCases: [
16+
{
17+
query: "status:error",
18+
name: "high",
19+
status: "high",
20+
},
21+
{
22+
query: "status:info",
23+
name: "low",
24+
status: "low",
25+
},
26+
],
27+
queries: [],
28+
cases: [],
29+
message: "This is a third party rule",
30+
options: {
31+
detectionMethod: "third_party",
32+
keepAlive: 0,
33+
maxSignalDuration: 0,
34+
thirdPartyRuleOptions: {
35+
defaultStatus: "info",
36+
rootQueries: [
37+
{
38+
query: "source:guardduty @details.alertType:*EC2*",
39+
groupByFields: ["instance-id"],
40+
},
41+
{
42+
query: "source:guardduty",
43+
groupByFields: [],
44+
},
45+
],
46+
},
47+
},
48+
},
49+
};
50+
51+
apiInstance
52+
.createSecurityMonitoringRule(params)
53+
.then((data: v2.SecurityMonitoringRuleResponse) => {
54+
console.log(
55+
"API called successfully. Returned data: " + JSON.stringify(data)
56+
);
57+
})
58+
.catch((error: any) => console.error(error));

‎features/v2/security_monitoring.feature

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,17 @@ Feature: Security Monitoring
8383
And the response "type" is equal to "log_detection"
8484
And the response "message" is equal to "Test rule"
8585

86+
@team:DataDog/k9-cloud-security-platform
87+
Scenario: Create a detection rule with detection method 'third_party' returns "OK" response
88+
Given new "CreateSecurityMonitoringRule" request
89+
And body with value {"name":"{{ unique }}","type":"log_detection","isEnabled":true,"thirdPartyCases":[{"query":"status:error","name":"high","status":"high"},{"query":"status:info","name":"low","status":"low"}],"queries":[],"cases":[],"message":"This is a third party rule","options":{"detectionMethod":"third_party","keepAlive":0,"maxSignalDuration":0,"thirdPartyRuleOptions":{"defaultStatus":"info","rootQueries":[{"query":"source:guardduty @details.alertType:*EC2*", "groupByFields":["instance-id"]},{"query":"source:guardduty", "groupByFields":[]}]}}}
90+
When the request is sent
91+
Then the response status is 200 OK
92+
And the response "name" is equal to "{{ unique }}"
93+
And the response "type" is equal to "log_detection"
94+
And the response "options.detectionMethod" is equal to "third_party"
95+
And the response "third_party_cases[0].query" is equal to "status:error"
96+
8697
@skip-validation @team:DataDog/k9-cloud-security-platform
8798
Scenario: Create a detection rule with type 'impossible_travel' returns "OK" response
8899
Given new "CreateSecurityMonitoringRule" request

‎packages/datadog-api-client-v2/index.ts

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1443,6 +1443,7 @@ export { SecurityMonitoringRuleQuery } from "./models/SecurityMonitoringRuleQuer
14431443
export { SecurityMonitoringRuleQueryAggregation } from "./models/SecurityMonitoringRuleQueryAggregation";
14441444
export { SecurityMonitoringRuleResponse } from "./models/SecurityMonitoringRuleResponse";
14451445
export { SecurityMonitoringRuleSeverity } from "./models/SecurityMonitoringRuleSeverity";
1446+
export { SecurityMonitoringRuleThirdPartyOptions } from "./models/SecurityMonitoringRuleThirdPartyOptions";
14461447
export { SecurityMonitoringRuleTypeCreate } from "./models/SecurityMonitoringRuleTypeCreate";
14471448
export { SecurityMonitoringRuleTypeRead } from "./models/SecurityMonitoringRuleTypeRead";
14481449
export { SecurityMonitoringRuleUpdatePayload } from "./models/SecurityMonitoringRuleUpdatePayload";
@@ -1481,6 +1482,9 @@ export { SecurityMonitoringSignalType } from "./models/SecurityMonitoringSignalT
14811482
export { SecurityMonitoringStandardRuleCreatePayload } from "./models/SecurityMonitoringStandardRuleCreatePayload";
14821483
export { SecurityMonitoringStandardRuleQuery } from "./models/SecurityMonitoringStandardRuleQuery";
14831484
export { SecurityMonitoringStandardRuleResponse } from "./models/SecurityMonitoringStandardRuleResponse";
1485+
export { SecurityMonitoringThirdPartyRootQuery } from "./models/SecurityMonitoringThirdPartyRootQuery";
1486+
export { SecurityMonitoringThirdPartyRuleCase } from "./models/SecurityMonitoringThirdPartyRuleCase";
1487+
export { SecurityMonitoringThirdPartyRuleCaseCreate } from "./models/SecurityMonitoringThirdPartyRuleCaseCreate";
14841488
export { SecurityMonitoringTriageUser } from "./models/SecurityMonitoringTriageUser";
14851489
export { SensitiveDataScannerConfigRequest } from "./models/SensitiveDataScannerConfigRequest";
14861490
export { SensitiveDataScannerConfiguration } from "./models/SensitiveDataScannerConfiguration";

‎packages/datadog-api-client-v2/models/ObjectSerializer.ts

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -760,6 +760,7 @@ import { SecurityMonitoringRuleCaseCreate } from "./SecurityMonitoringRuleCaseCr
760760
import { SecurityMonitoringRuleImpossibleTravelOptions } from "./SecurityMonitoringRuleImpossibleTravelOptions";
761761
import { SecurityMonitoringRuleNewValueOptions } from "./SecurityMonitoringRuleNewValueOptions";
762762
import { SecurityMonitoringRuleOptions } from "./SecurityMonitoringRuleOptions";
763+
import { SecurityMonitoringRuleThirdPartyOptions } from "./SecurityMonitoringRuleThirdPartyOptions";
763764
import { SecurityMonitoringRuleUpdatePayload } from "./SecurityMonitoringRuleUpdatePayload";
764765
import { SecurityMonitoringSignal } from "./SecurityMonitoringSignal";
765766
import { SecurityMonitoringSignalAssigneeUpdateAttributes } from "./SecurityMonitoringSignalAssigneeUpdateAttributes";
@@ -790,6 +791,9 @@ import { SecurityMonitoringSignalsListResponseMetaPage } from "./SecurityMonitor
790791
import { SecurityMonitoringStandardRuleCreatePayload } from "./SecurityMonitoringStandardRuleCreatePayload";
791792
import { SecurityMonitoringStandardRuleQuery } from "./SecurityMonitoringStandardRuleQuery";
792793
import { SecurityMonitoringStandardRuleResponse } from "./SecurityMonitoringStandardRuleResponse";
794+
import { SecurityMonitoringThirdPartyRootQuery } from "./SecurityMonitoringThirdPartyRootQuery";
795+
import { SecurityMonitoringThirdPartyRuleCase } from "./SecurityMonitoringThirdPartyRuleCase";
796+
import { SecurityMonitoringThirdPartyRuleCaseCreate } from "./SecurityMonitoringThirdPartyRuleCaseCreate";
793797
import { SecurityMonitoringTriageUser } from "./SecurityMonitoringTriageUser";
794798
import { SensitiveDataScannerConfigRequest } from "./SensitiveDataScannerConfigRequest";
795799
import { SensitiveDataScannerConfiguration } from "./SensitiveDataScannerConfiguration";
@@ -2384,6 +2388,8 @@ const typeMap: { [index: string]: any } = {
23842388
SecurityMonitoringRuleImpossibleTravelOptions,
23852389
SecurityMonitoringRuleNewValueOptions: SecurityMonitoringRuleNewValueOptions,
23862390
SecurityMonitoringRuleOptions: SecurityMonitoringRuleOptions,
2391+
SecurityMonitoringRuleThirdPartyOptions:
2392+
SecurityMonitoringRuleThirdPartyOptions,
23872393
SecurityMonitoringRuleUpdatePayload: SecurityMonitoringRuleUpdatePayload,
23882394
SecurityMonitoringSignal: SecurityMonitoringSignal,
23892395
SecurityMonitoringSignalAssigneeUpdateAttributes:
@@ -2435,6 +2441,10 @@ const typeMap: { [index: string]: any } = {
24352441
SecurityMonitoringStandardRuleQuery: SecurityMonitoringStandardRuleQuery,
24362442
SecurityMonitoringStandardRuleResponse:
24372443
SecurityMonitoringStandardRuleResponse,
2444+
SecurityMonitoringThirdPartyRootQuery: SecurityMonitoringThirdPartyRootQuery,
2445+
SecurityMonitoringThirdPartyRuleCase: SecurityMonitoringThirdPartyRuleCase,
2446+
SecurityMonitoringThirdPartyRuleCaseCreate:
2447+
SecurityMonitoringThirdPartyRuleCaseCreate,
24382448
SecurityMonitoringTriageUser: SecurityMonitoringTriageUser,
24392449
SensitiveDataScannerConfigRequest: SensitiveDataScannerConfigRequest,
24402450
SensitiveDataScannerConfiguration: SensitiveDataScannerConfiguration,

0 commit comments

Comments
 (0)