Skip to content

Commit 4895fb3

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Support Cloud SIEM scheduled rules in API client (#2725)
Co-authored-by: ci.datadog-api-spec <[email protected]>
1 parent 529873d commit 4895fb3

23 files changed

+442
-2
lines changed

‎.generated-info‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
{
2-
"spec_repo_commit": "c5cca50",
3-
"generated": "2025-08-07 18:03:26.051"
2+
"spec_repo_commit": "d02c8a3",
3+
"generated": "2025-08-08 12:07:20.979"
44
}

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36336,6 +36336,12 @@ components:
3633636336
SecurityMonitoringRuleUpdatePayload:
3633736337
description: Update an existing rule.
3633836338
properties:
36339+
calculatedFields:
36340+
description: Calculated fields. Only allowed for scheduled rules - in other
36341+
words, when schedulingOptions is also defined.
36342+
items:
36343+
$ref: '#/components/schemas/CalculatedField'
36344+
type: array
3633936345
cases:
3634036346
description: Cases for generating signals.
3634136347
items:
@@ -36392,6 +36398,8 @@ components:
3639236398
items:
3639336399
$ref: '#/components/schemas/SecurityMonitoringReferenceTable'
3639436400
type: array
36401+
schedulingOptions:
36402+
$ref: '#/components/schemas/SecurityMonitoringSchedulingOptions'
3639536403
tags:
3639636404
description: Tags for generated signals.
3639736405
items:
@@ -36418,6 +36426,27 @@ components:
3641836426
- $ref: '#/components/schemas/SecurityMonitoringStandardRulePayload'
3641936427
- $ref: '#/components/schemas/SecurityMonitoringSignalRulePayload'
3642036428
- $ref: '#/components/schemas/CloudConfigurationRulePayload'
36429+
SecurityMonitoringSchedulingOptions:
36430+
description: Options for scheduled rules. When this field is present, the rule
36431+
runs based on the schedule. When absent, it runs real-time on ingested logs.
36432+
nullable: true
36433+
properties:
36434+
rrule:
36435+
description: Schedule for the rule queries, written in RRULE syntax. See
36436+
[RFC](https://icalendar.org/iCalendar-RFC-5545/3-8-5-3-recurrence-rule.html)
36437+
for syntax reference.
36438+
example: FREQ=HOURLY;INTERVAL=1;
36439+
type: string
36440+
start:
36441+
description: Start date for the schedule, in ISO 8601 format without timezone.
36442+
example: '2025-07-14T12:00:00'
36443+
type: string
36444+
timezone:
36445+
description: Time zone of the start date, in the [tz database](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)
36446+
format.
36447+
example: America/New_York
36448+
type: string
36449+
type: object
3642136450
SecurityMonitoringSignal:
3642236451
description: Object description of a security signal.
3642336452
properties:
@@ -37096,6 +37125,12 @@ components:
3709637125
SecurityMonitoringStandardRuleCreatePayload:
3709737126
description: Create a new rule.
3709837127
properties:
37128+
calculatedFields:
37129+
description: Calculated fields. Only allowed for scheduled rules - in other
37130+
words, when schedulingOptions is also defined.
37131+
items:
37132+
$ref: '#/components/schemas/CalculatedField'
37133+
type: array
3709937134
cases:
3710037135
description: Cases for generating signals.
3710137136
example: []
@@ -37148,6 +37183,8 @@ components:
3714837183
items:
3714937184
$ref: '#/components/schemas/SecurityMonitoringReferenceTable'
3715037185
type: array
37186+
schedulingOptions:
37187+
$ref: '#/components/schemas/SecurityMonitoringSchedulingOptions'
3715137188
tags:
3715237189
description: Tags for generated signals.
3715337190
example:
@@ -37177,6 +37214,12 @@ components:
3717737214
SecurityMonitoringStandardRulePayload:
3717837215
description: The payload of a rule.
3717937216
properties:
37217+
calculatedFields:
37218+
description: Calculated fields. Only allowed for scheduled rules - in other
37219+
words, when schedulingOptions is also defined.
37220+
items:
37221+
$ref: '#/components/schemas/CalculatedField'
37222+
type: array
3718037223
cases:
3718137224
description: Cases for generating signals.
3718237225
example: []
@@ -37237,6 +37280,8 @@ components:
3723737280
items:
3723837281
$ref: '#/components/schemas/SecurityMonitoringReferenceTable'
3723937282
type: array
37283+
schedulingOptions:
37284+
$ref: '#/components/schemas/SecurityMonitoringSchedulingOptions'
3724037285
tags:
3724137286
description: Tags for generated signals.
3724237287
example:
@@ -37293,6 +37338,14 @@ components:
3729337338
example: false
3729437339
readOnly: true
3729537340
type: boolean
37341+
index:
37342+
description: '**This field is currently unstable and might be removed in
37343+
a minor version upgrade.**
37344+
37345+
The index to run the query on, if the `dataSource` is `logs`. Only used
37346+
for scheduled rules - in other words, when the `schedulingOptions` field
37347+
is present in the rule payload.'
37348+
type: string
3729637349
metric:
3729737350
deprecated: true
3729837351
description: '(Deprecated) The target field to aggregate over when using
@@ -37320,6 +37373,12 @@ components:
3732037373
SecurityMonitoringStandardRuleResponse:
3732137374
description: Rule.
3732237375
properties:
37376+
calculatedFields:
37377+
description: Calculated fields. Only allowed for scheduled rules - in other
37378+
words, when schedulingOptions is also defined.
37379+
items:
37380+
$ref: '#/components/schemas/CalculatedField'
37381+
type: array
3732337382
cases:
3732437383
description: Cases for generating signals.
3732537384
items:
@@ -37405,6 +37464,8 @@ components:
3740537464
items:
3740637465
$ref: '#/components/schemas/SecurityMonitoringReferenceTable'
3740737466
type: array
37467+
schedulingOptions:
37468+
$ref: '#/components/schemas/SecurityMonitoringSchedulingOptions'
3740837469
tags:
3740937470
description: Tags for generated signals.
3741037471
items:
@@ -37436,6 +37497,12 @@ components:
3743637497
SecurityMonitoringStandardRuleTestPayload:
3743737498
description: The payload of a rule to test
3743837499
properties:
37500+
calculatedFields:
37501+
description: Calculated fields. Only allowed for scheduled rules - in other
37502+
words, when schedulingOptions is also defined.
37503+
items:
37504+
$ref: '#/components/schemas/CalculatedField'
37505+
type: array
3743937506
cases:
3744037507
description: Cases for generating signals.
3744137508
example: []
@@ -37488,6 +37555,8 @@ components:
3748837555
items:
3748937556
$ref: '#/components/schemas/SecurityMonitoringReferenceTable'
3749037557
type: array
37558+
schedulingOptions:
37559+
$ref: '#/components/schemas/SecurityMonitoringSchedulingOptions'
3749137560
tags:
3749237561
description: Tags for generated signals.
3749337562
example:

‎docs/datadog_api_client.v2.model.rst‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16237,6 +16237,13 @@ datadog\_api\_client.v2.model.security\_monitoring\_rule\_validate\_payload modu
1623716237
:members:
1623816238
:show-inheritance:
1623916239

16240+
datadog\_api\_client.v2.model.security\_monitoring\_scheduling\_options module
16241+
------------------------------------------------------------------------------
16242+
16243+
.. automodule:: datadog_api_client.v2.model.security_monitoring_scheduling_options
16244+
:members:
16245+
:show-inheritance:
16246+
1624016247
datadog\_api\_client.v2.model.security\_monitoring\_signal module
1624116248
-----------------------------------------------------------------
1624216249

‎examples/v2/security-monitoring/CreateSecurityMonitoringRule_868881438.py‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
"""
2+
Create a scheduled detection rule returns "OK" response
3+
"""
4+
5+
from datadog_api_client import ApiClient, Configuration
6+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
7+
from datadog_api_client.v2.model.security_monitoring_rule_case_create import SecurityMonitoringRuleCaseCreate
8+
from datadog_api_client.v2.model.security_monitoring_rule_evaluation_window import (
9+
SecurityMonitoringRuleEvaluationWindow,
10+
)
11+
from datadog_api_client.v2.model.security_monitoring_rule_keep_alive import SecurityMonitoringRuleKeepAlive
12+
from datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration import (
13+
SecurityMonitoringRuleMaxSignalDuration,
14+
)
15+
from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions
16+
from datadog_api_client.v2.model.security_monitoring_rule_query_aggregation import (
17+
SecurityMonitoringRuleQueryAggregation,
18+
)
19+
from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity
20+
from datadog_api_client.v2.model.security_monitoring_rule_type_create import SecurityMonitoringRuleTypeCreate
21+
from datadog_api_client.v2.model.security_monitoring_scheduling_options import SecurityMonitoringSchedulingOptions
22+
from datadog_api_client.v2.model.security_monitoring_standard_rule_create_payload import (
23+
SecurityMonitoringStandardRuleCreatePayload,
24+
)
25+
from datadog_api_client.v2.model.security_monitoring_standard_rule_query import SecurityMonitoringStandardRuleQuery
26+
27+
body = SecurityMonitoringStandardRuleCreatePayload(
28+
name="Example-Security-Monitoring",
29+
queries=[
30+
SecurityMonitoringStandardRuleQuery(
31+
query="@test:true",
32+
aggregation=SecurityMonitoringRuleQueryAggregation.COUNT,
33+
group_by_fields=[],
34+
distinct_fields=[],
35+
index="main",
36+
),
37+
],
38+
filters=[],
39+
cases=[
40+
SecurityMonitoringRuleCaseCreate(
41+
name="",
42+
status=SecurityMonitoringRuleSeverity.INFO,
43+
condition="a > 0",
44+
notifications=[],
45+
),
46+
],
47+
options=SecurityMonitoringRuleOptions(
48+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES,
49+
keep_alive=SecurityMonitoringRuleKeepAlive.ONE_HOUR,
50+
max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.ONE_DAY,
51+
),
52+
message="Test rule",
53+
tags=[],
54+
is_enabled=True,
55+
type=SecurityMonitoringRuleTypeCreate.LOG_DETECTION,
56+
scheduling_options=SecurityMonitoringSchedulingOptions(
57+
rrule="FREQ=HOURLY;INTERVAL=2;",
58+
start="2025-06-18T12:00:00",
59+
timezone="Europe/Paris",
60+
),
61+
)
62+
63+
configuration = Configuration()
64+
with ApiClient(configuration) as api_client:
65+
api_instance = SecurityMonitoringApi(api_client)
66+
response = api_instance.create_security_monitoring_rule(body=body)
67+
68+
print(response)

‎src/datadog_api_client/v2/model/security_monitoring_rule_convert_payload.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ def __init__(self, **kwargs):
1515
"""
1616
Convert a rule from JSON to Terraform.
1717
18+
:param calculated_fields: Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.
19+
:type calculated_fields: [CalculatedField], optional
20+
1821
:param cases: Cases for generating signals.
1922
:type cases: [SecurityMonitoringRuleCaseCreate]
2023
@@ -51,6 +54,9 @@ def __init__(self, **kwargs):
5154
:param reference_tables: Reference tables for the rule.
5255
:type reference_tables: [SecurityMonitoringReferenceTable], optional
5356
57+
:param scheduling_options: Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
58+
:type scheduling_options: SecurityMonitoringSchedulingOptions, none_type, optional
59+
5460
:param tags: Tags for generated signals.
5561
:type tags: [str], optional
5662

‎src/datadog_api_client/v2/model/security_monitoring_rule_create_payload.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ def __init__(self, **kwargs):
1515
"""
1616
Create a new rule.
1717
18+
:param calculated_fields: Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.
19+
:type calculated_fields: [CalculatedField], optional
20+
1821
:param cases: Cases for generating signals.
1922
:type cases: [SecurityMonitoringRuleCaseCreate]
2023
@@ -45,6 +48,9 @@ def __init__(self, **kwargs):
4548
:param reference_tables: Reference tables for the rule.
4649
:type reference_tables: [SecurityMonitoringReferenceTable], optional
4750
51+
:param scheduling_options: Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
52+
:type scheduling_options: SecurityMonitoringSchedulingOptions, none_type, optional
53+
4854
:param tags: Tags for generated signals.
4955
:type tags: [str], optional
5056

‎src/datadog_api_client/v2/model/security_monitoring_rule_query.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@ def __init__(self, **kwargs):
3333
:param has_optional_group_by_fields: When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values.
3434
:type has_optional_group_by_fields: bool, optional
3535
36+
:param index: **This field is currently unstable and might be removed in a minor version upgrade.**
37+
The index to run the query on, if the `dataSource` is `logs`. Only used for scheduled rules - in other words, when the `schedulingOptions` field is present in the rule payload.
38+
:type index: str, optional
39+
3640
:param metric: (Deprecated) The target field to aggregate over when using the sum or max
3741
aggregations. `metrics` field should be used instead.
3842
:type metric: str, optional

‎src/datadog_api_client/v2/model/security_monitoring_rule_response.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ def __init__(self, **kwargs):
1515
"""
1616
Create a new rule.
1717
18+
:param calculated_fields: Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.
19+
:type calculated_fields: [CalculatedField], optional
20+
1821
:param cases: Cases for generating signals.
1922
:type cases: [SecurityMonitoringRuleCase], optional
2023
@@ -75,6 +78,9 @@ def __init__(self, **kwargs):
7578
:param reference_tables: Reference tables for the rule.
7679
:type reference_tables: [SecurityMonitoringReferenceTable], optional
7780
81+
:param scheduling_options: Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
82+
:type scheduling_options: SecurityMonitoringSchedulingOptions, none_type, optional
83+
7884
:param tags: Tags for generated signals.
7985
:type tags: [str], optional
8086

‎src/datadog_api_client/v2/model/security_monitoring_rule_test_payload.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ def __init__(self, **kwargs):
1515
"""
1616
Test a rule.
1717
18+
:param calculated_fields: Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.
19+
:type calculated_fields: [CalculatedField], optional
20+
1821
:param cases: Cases for generating signals.
1922
:type cases: [SecurityMonitoringRuleCaseCreate]
2023
@@ -45,6 +48,9 @@ def __init__(self, **kwargs):
4548
:param reference_tables: Reference tables for the rule.
4649
:type reference_tables: [SecurityMonitoringReferenceTable], optional
4750
51+
:param scheduling_options: Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
52+
:type scheduling_options: SecurityMonitoringSchedulingOptions, none_type, optional
53+
4854
:param tags: Tags for generated signals.
4955
:type tags: [str], optional
5056

0 commit comments

Comments
 (0)