Skip to content

Commit d3c9ff3

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Security Monitoring - Support custom third party rules (#1470)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com> Co-authored-by: api-clients-generation-pipeline[bot] <54105614+api-clients-generation-pipeline[bot]@users.noreply.github.com>
1 parent 8610d7f commit d3c9ff3

16 files changed

+576
-4
lines changed

‎.apigentools-info

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
"spec_versions": {
55
"v1": {
66
"apigentools_version": "1.6.6",
7-
"regenerated": "2024-01-03 19:28:29.514415",
8-
"spec_repo_commit": "b2d74fec"
7+
"regenerated": "2024-01-04 15:18:01.735783",
8+
"spec_repo_commit": "e7cfa56f"
99
},
1010
"v2": {
1111
"apigentools_version": "1.6.6",
12-
"regenerated": "2024-01-03 19:28:29.530568",
13-
"spec_repo_commit": "b2d74fec"
12+
"regenerated": "2024-01-04 15:18:01.751959",
13+
"spec_repo_commit": "e7cfa56f"
1414
}
1515
}
1616
}

‎.generator/schemas/v2/openapi.yaml

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15616,6 +15616,8 @@ components:
1561615616
$ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
1561715617
newValueOptions:
1561815618
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
15619+
thirdPartyRuleOptions:
15620+
$ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
1561915621
type: object
1562015622
SecurityMonitoringRuleQuery:
1562115623
description: Query for matching rule.
@@ -15664,6 +15666,30 @@ components:
1566415666
- MEDIUM
1566515667
- HIGH
1566615668
- CRITICAL
15669+
SecurityMonitoringRuleThirdPartyOptions:
15670+
description: Options on third party rules.
15671+
properties:
15672+
defaultNotifications:
15673+
description: Notification targets for the logs that do not correspond to
15674+
any of the cases.
15675+
items:
15676+
description: Notification.
15677+
type: string
15678+
type: array
15679+
defaultStatus:
15680+
$ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
15681+
rootQueries:
15682+
description: Queries to be combined with third party case queries. Each
15683+
of them can have different group by fields, to aggregate differently based
15684+
on the type of alert.
15685+
items:
15686+
$ref: '#/components/schemas/SecurityMonitoringThirdPartyRootQuery'
15687+
type: array
15688+
signalTitleTemplate:
15689+
description: A template for the signal title; if omitted, the title is generated
15690+
based on the case name.
15691+
type: string
15692+
type: object
1566715693
SecurityMonitoringRuleTypeCreate:
1566815694
description: The rule type.
1566915695
enum:
@@ -15733,6 +15759,13 @@ components:
1573315759
description: Tag.
1573415760
type: string
1573515761
type: array
15762+
thirdPartyCases:
15763+
description: Cases for generating signals from third party rules. Only available
15764+
for third party rules.
15765+
example: []
15766+
items:
15767+
$ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCase'
15768+
type: array
1573615769
version:
1573715770
description: The version of the rule being updated.
1573815771
example: 1
@@ -16362,6 +16395,13 @@ components:
1636216395
description: Tag.
1636316396
type: string
1636416397
type: array
16398+
thirdPartyCases:
16399+
description: Cases for generating signals from third party rules. Only available
16400+
for third party rules.
16401+
example: []
16402+
items:
16403+
$ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate'
16404+
type: array
1636516405
type:
1636616406
$ref: '#/components/schemas/SecurityMonitoringRuleTypeCreate'
1636716407
required:
@@ -16483,6 +16523,13 @@ components:
1648316523
description: Tag.
1648416524
type: string
1648516525
type: array
16526+
thirdPartyCases:
16527+
description: Cases for generating signals from third party rules. Only available
16528+
for third party rules.
16529+
example: []
16530+
items:
16531+
$ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCase'
16532+
type: array
1648616533
type:
1648716534
$ref: '#/components/schemas/SecurityMonitoringRuleTypeRead'
1648816535
updateAuthorId:
@@ -16493,6 +16540,58 @@ components:
1649316540
description: The version of the rule.
1649416541
format: int64
1649516542
type: integer
16543+
SecurityMonitoringThirdPartyRootQuery:
16544+
description: A query to be combined with the third party case query.
16545+
properties:
16546+
groupByFields:
16547+
description: Fields to group by.
16548+
items:
16549+
description: Field.
16550+
type: string
16551+
type: array
16552+
query:
16553+
description: Query to run on logs.
16554+
example: source:cloudtrail
16555+
type: string
16556+
type: object
16557+
SecurityMonitoringThirdPartyRuleCase:
16558+
description: Case when signal is generated by a third party rule.
16559+
properties:
16560+
name:
16561+
description: Name of the case.
16562+
type: string
16563+
notifications:
16564+
description: Notification targets for each rule case.
16565+
items:
16566+
description: Notification.
16567+
type: string
16568+
type: array
16569+
query:
16570+
description: A query to map a third party event to this case.
16571+
type: string
16572+
status:
16573+
$ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
16574+
type: object
16575+
SecurityMonitoringThirdPartyRuleCaseCreate:
16576+
description: Case when a signal is generated by a third party rule.
16577+
properties:
16578+
name:
16579+
description: Name of the case.
16580+
type: string
16581+
notifications:
16582+
description: Notification targets for each rule case.
16583+
items:
16584+
description: Notification.
16585+
type: string
16586+
type: array
16587+
query:
16588+
description: A query to map a third party event to this case.
16589+
type: string
16590+
status:
16591+
$ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
16592+
required:
16593+
- status
16594+
type: object
1649616595
SecurityMonitoringTriageUser:
1649716596
description: Object representing a given user entity.
1649816597
properties:

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-detection-rule-with-detection-method-third_party-returns-OK-response_1476655317/frozen.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2024-01-03T15:07:54.290Z"

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-detection-rule-with-detection-method-third_party-returns-OK-response_1476655317/recording.har

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Create a detection rule with detection method 'third_party' returns \"OK\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "4a87db9d8ab6a6359a8738ed42c5f31b",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 613,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 588,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"cases\":[],\"isEnabled\":true,\"message\":\"This is a third party rule\",\"name\":\"Test-Create_a_detection_rule_with_detection_method_third_party_returns_OK_response-1704294474\",\"options\":{\"detectionMethod\":\"third_party\",\"keepAlive\":0,\"maxSignalDuration\":0,\"thirdPartyRuleOptions\":{\"defaultStatus\":\"info\",\"rootQueries\":[{\"groupByFields\":[\"instance-id\"],\"query\":\"source:guardduty @details.alertType:*EC2*\"},{\"groupByFields\":[],\"query\":\"source:guardduty\"}]}},\"queries\":[],\"thirdPartyCases\":[{\"name\":\"high\",\"query\":\"status:error\",\"status\":\"high\"},{\"name\":\"low\",\"query\":\"status:info\",\"status\":\"low\"}],\"type\":\"log_detection\"}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules"
39+
},
40+
"response": {
41+
"bodySize": 1259,
42+
"content": {
43+
"mimeType": "application/json",
44+
"size": 1259,
45+
"text": "{\"id\":\"ut1-s7a-0kn\",\"version\":1,\"name\":\"Test-Create_a_detection_rule_with_detection_method_third_party_returns_OK_response-1704294474\",\"createdAt\":1704294474748,\"creationAuthorId\":1445416,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"status:error\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"none\",\"name\":\"\"},{\"query\":\"status:info\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"none\",\"name\":\"\"}],\"options\":{\"keepAlive\":0,\"maxSignalDuration\":0,\"detectionMethod\":\"third_party\",\"evaluationWindow\":0,\"thirdPartyRuleOptions\":{\"defaultStatus\":\"info\",\"defaultNotifications\":[],\"rootQueries\":[{\"query\":\"source:guardduty @details.alertType:*EC2*\",\"groupByFields\":[\"instance-id\"]},{\"query\":\"source:guardduty\",\"groupByFields\":[]}]}},\"cases\":[{\"name\":\"high\",\"status\":\"high\",\"notifications\":[]},{\"name\":\"low\",\"status\":\"low\",\"notifications\":[]}],\"message\":\"This is a third party rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"log_detection\",\"filters\":[],\"thirdPartyCases\":[{\"name\":\"high\",\"status\":\"high\",\"notifications\":[],\"query\":\"status:error\"},{\"name\":\"low\",\"status\":\"low\",\"notifications\":[],\"query\":\"status:info\"}]}\n"
46+
},
47+
"cookies": [],
48+
"headers": [
49+
{
50+
"name": "content-type",
51+
"value": "application/json"
52+
}
53+
],
54+
"headersSize": 655,
55+
"httpVersion": "HTTP/1.1",
56+
"redirectURL": "",
57+
"status": 200,
58+
"statusText": "OK"
59+
},
60+
"startedDateTime": "2024-01-03T15:07:54.294Z",
61+
"time": 499
62+
},
63+
{
64+
"_id": "59d5aaa9367664c73c237fc46c3e36cc",
65+
"_order": 0,
66+
"cache": {},
67+
"request": {
68+
"bodySize": 0,
69+
"cookies": [],
70+
"headers": [
71+
{
72+
"_fromType": "array",
73+
"name": "accept",
74+
"value": "*/*"
75+
}
76+
],
77+
"headersSize": 536,
78+
"httpVersion": "HTTP/1.1",
79+
"method": "DELETE",
80+
"queryString": [],
81+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules/ut1-s7a-0kn"
82+
},
83+
"response": {
84+
"bodySize": 0,
85+
"content": {
86+
"mimeType": "text/plain",
87+
"size": 0
88+
},
89+
"cookies": [],
90+
"headers": [],
91+
"headersSize": 601,
92+
"httpVersion": "HTTP/1.1",
93+
"redirectURL": "",
94+
"status": 204,
95+
"statusText": "No Content"
96+
},
97+
"startedDateTime": "2024-01-03T15:07:54.802Z",
98+
"time": 533
99+
}
100+
],
101+
"pages": [],
102+
"version": "1.2"
103+
}
104+
}

‎examples/v2/security-monitoring/CreateSecurityMonitoringRule_3367706049.ts

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
/**
2+
* Create a detection rule with detection method 'third_party' returns "OK" response
3+
*/
4+
5+
import { client, v2 } from "@datadog/datadog-api-client";
6+
7+
const configuration = client.createConfiguration();
8+
const apiInstance = new v2.SecurityMonitoringApi(configuration);
9+
10+
const params: v2.SecurityMonitoringApiCreateSecurityMonitoringRuleRequest = {
11+
body: {
12+
name: "Example-Security-Monitoring",
13+
type: "log_detection",
14+
isEnabled: true,
15+
thirdPartyCases: [
16+
{
17+
query: "status:error",
18+
name: "high",
19+
status: "high",
20+
},
21+
{
22+
query: "status:info",
23+
name: "low",
24+
status: "low",
25+
},
26+
],
27+
queries: [],
28+
cases: [],
29+
message: "This is a third party rule",
30+
options: {
31+
detectionMethod: "third_party",
32+
keepAlive: 0,
33+
maxSignalDuration: 0,
34+
thirdPartyRuleOptions: {
35+
defaultStatus: "info",
36+
rootQueries: [
37+
{
38+
query: "source:guardduty @details.alertType:*EC2*",
39+
groupByFields: ["instance-id"],
40+
},
41+
{
42+
query: "source:guardduty",
43+
groupByFields: [],
44+
},
45+
],
46+
},
47+
},
48+
},
49+
};
50+
51+
apiInstance
52+
.createSecurityMonitoringRule(params)
53+
.then((data: v2.SecurityMonitoringRuleResponse) => {
54+
console.log(
55+
"API called successfully. Returned data: " + JSON.stringify(data)
56+
);
57+
})
58+
.catch((error: any) => console.error(error));

‎features/v2/security_monitoring.feature

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,17 @@ Feature: Security Monitoring
8383
And the response "type" is equal to "log_detection"
8484
And the response "message" is equal to "Test rule"
8585

86+
@team:DataDog/k9-cloud-security-platform
87+
Scenario: Create a detection rule with detection method 'third_party' returns "OK" response
88+
Given new "CreateSecurityMonitoringRule" request
89+
And body with value {"name":"{{ unique }}","type":"log_detection","isEnabled":true,"thirdPartyCases":[{"query":"status:error","name":"high","status":"high"},{"query":"status:info","name":"low","status":"low"}],"queries":[],"cases":[],"message":"This is a third party rule","options":{"detectionMethod":"third_party","keepAlive":0,"maxSignalDuration":0,"thirdPartyRuleOptions":{"defaultStatus":"info","rootQueries":[{"query":"source:guardduty @details.alertType:*EC2*", "groupByFields":["instance-id"]},{"query":"source:guardduty", "groupByFields":[]}]}}}
90+
When the request is sent
91+
Then the response status is 200 OK
92+
And the response "name" is equal to "{{ unique }}"
93+
And the response "type" is equal to "log_detection"
94+
And the response "options.detectionMethod" is equal to "third_party"
95+
And the response "thirdPartyCases[0].query" is equal to "status:error"
96+
8697
@skip-validation @team:DataDog/k9-cloud-security-platform
8798
Scenario: Create a detection rule with type 'impossible_travel' returns "OK" response
8899
Given new "CreateSecurityMonitoringRule" request

‎packages/datadog-api-client-v2/index.ts

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1443,6 +1443,7 @@ export { SecurityMonitoringRuleQuery } from "./models/SecurityMonitoringRuleQuer
14431443
export { SecurityMonitoringRuleQueryAggregation } from "./models/SecurityMonitoringRuleQueryAggregation";
14441444
export { SecurityMonitoringRuleResponse } from "./models/SecurityMonitoringRuleResponse";
14451445
export { SecurityMonitoringRuleSeverity } from "./models/SecurityMonitoringRuleSeverity";
1446+
export { SecurityMonitoringRuleThirdPartyOptions } from "./models/SecurityMonitoringRuleThirdPartyOptions";
14461447
export { SecurityMonitoringRuleTypeCreate } from "./models/SecurityMonitoringRuleTypeCreate";
14471448
export { SecurityMonitoringRuleTypeRead } from "./models/SecurityMonitoringRuleTypeRead";
14481449
export { SecurityMonitoringRuleUpdatePayload } from "./models/SecurityMonitoringRuleUpdatePayload";
@@ -1481,6 +1482,9 @@ export { SecurityMonitoringSignalType } from "./models/SecurityMonitoringSignalT
14811482
export { SecurityMonitoringStandardRuleCreatePayload } from "./models/SecurityMonitoringStandardRuleCreatePayload";
14821483
export { SecurityMonitoringStandardRuleQuery } from "./models/SecurityMonitoringStandardRuleQuery";
14831484
export { SecurityMonitoringStandardRuleResponse } from "./models/SecurityMonitoringStandardRuleResponse";
1485+
export { SecurityMonitoringThirdPartyRootQuery } from "./models/SecurityMonitoringThirdPartyRootQuery";
1486+
export { SecurityMonitoringThirdPartyRuleCase } from "./models/SecurityMonitoringThirdPartyRuleCase";
1487+
export { SecurityMonitoringThirdPartyRuleCaseCreate } from "./models/SecurityMonitoringThirdPartyRuleCaseCreate";
14841488
export { SecurityMonitoringTriageUser } from "./models/SecurityMonitoringTriageUser";
14851489
export { SensitiveDataScannerConfigRequest } from "./models/SensitiveDataScannerConfigRequest";
14861490
export { SensitiveDataScannerConfiguration } from "./models/SensitiveDataScannerConfiguration";

‎packages/datadog-api-client-v2/models/ObjectSerializer.ts

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -760,6 +760,7 @@ import { SecurityMonitoringRuleCaseCreate } from "./SecurityMonitoringRuleCaseCr
760760
import { SecurityMonitoringRuleImpossibleTravelOptions } from "./SecurityMonitoringRuleImpossibleTravelOptions";
761761
import { SecurityMonitoringRuleNewValueOptions } from "./SecurityMonitoringRuleNewValueOptions";
762762
import { SecurityMonitoringRuleOptions } from "./SecurityMonitoringRuleOptions";
763+
import { SecurityMonitoringRuleThirdPartyOptions } from "./SecurityMonitoringRuleThirdPartyOptions";
763764
import { SecurityMonitoringRuleUpdatePayload } from "./SecurityMonitoringRuleUpdatePayload";
764765
import { SecurityMonitoringSignal } from "./SecurityMonitoringSignal";
765766
import { SecurityMonitoringSignalAssigneeUpdateAttributes } from "./SecurityMonitoringSignalAssigneeUpdateAttributes";
@@ -790,6 +791,9 @@ import { SecurityMonitoringSignalsListResponseMetaPage } from "./SecurityMonitor
790791
import { SecurityMonitoringStandardRuleCreatePayload } from "./SecurityMonitoringStandardRuleCreatePayload";
791792
import { SecurityMonitoringStandardRuleQuery } from "./SecurityMonitoringStandardRuleQuery";
792793
import { SecurityMonitoringStandardRuleResponse } from "./SecurityMonitoringStandardRuleResponse";
794+
import { SecurityMonitoringThirdPartyRootQuery } from "./SecurityMonitoringThirdPartyRootQuery";
795+
import { SecurityMonitoringThirdPartyRuleCase } from "./SecurityMonitoringThirdPartyRuleCase";
796+
import { SecurityMonitoringThirdPartyRuleCaseCreate } from "./SecurityMonitoringThirdPartyRuleCaseCreate";
793797
import { SecurityMonitoringTriageUser } from "./SecurityMonitoringTriageUser";
794798
import { SensitiveDataScannerConfigRequest } from "./SensitiveDataScannerConfigRequest";
795799
import { SensitiveDataScannerConfiguration } from "./SensitiveDataScannerConfiguration";
@@ -2384,6 +2388,8 @@ const typeMap: { [index: string]: any } = {
23842388
SecurityMonitoringRuleImpossibleTravelOptions,
23852389
SecurityMonitoringRuleNewValueOptions: SecurityMonitoringRuleNewValueOptions,
23862390
SecurityMonitoringRuleOptions: SecurityMonitoringRuleOptions,
2391+
SecurityMonitoringRuleThirdPartyOptions:
2392+
SecurityMonitoringRuleThirdPartyOptions,
23872393
SecurityMonitoringRuleUpdatePayload: SecurityMonitoringRuleUpdatePayload,
23882394
SecurityMonitoringSignal: SecurityMonitoringSignal,
23892395
SecurityMonitoringSignalAssigneeUpdateAttributes:
@@ -2435,6 +2441,10 @@ const typeMap: { [index: string]: any } = {
24352441
SecurityMonitoringStandardRuleQuery: SecurityMonitoringStandardRuleQuery,
24362442
SecurityMonitoringStandardRuleResponse:
24372443
SecurityMonitoringStandardRuleResponse,
2444+
SecurityMonitoringThirdPartyRootQuery: SecurityMonitoringThirdPartyRootQuery,
2445+
SecurityMonitoringThirdPartyRuleCase: SecurityMonitoringThirdPartyRuleCase,
2446+
SecurityMonitoringThirdPartyRuleCaseCreate:
2447+
SecurityMonitoringThirdPartyRuleCaseCreate,
24382448
SecurityMonitoringTriageUser: SecurityMonitoringTriageUser,
24392449
SensitiveDataScannerConfigRequest: SensitiveDataScannerConfigRequest,
24402450
SensitiveDataScannerConfiguration: SensitiveDataScannerConfiguration,

0 commit comments

Comments
 (0)