Skip to content

Commit 782e9b7

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Regenerate client from commit b980d49f of spec repo (#2045)
Co-authored-by: ci.datadog-api-spec <[email protected]>
1 parent 2207e3b commit 782e9b7

19 files changed

+484
-4
lines changed

Diff for: ‎.apigentools-info

+4-4
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
"spec_versions": {
55
"v1": {
66
"apigentools_version": "1.6.6",
7-
"regenerated": "2025-02-10 19:09:32.740537",
8-
"spec_repo_commit": "824f78a1"
7+
"regenerated": "2025-02-11 09:59:40.774900",
8+
"spec_repo_commit": "b980d49f"
99
},
1010
"v2": {
1111
"apigentools_version": "1.6.6",
12-
"regenerated": "2025-02-10 19:09:32.756088",
13-
"spec_repo_commit": "824f78a1"
12+
"regenerated": "2025-02-11 09:59:40.793035",
13+
"spec_repo_commit": "b980d49f"
1414
}
1515
}
1616
}

Diff for: ‎.generator/schemas/v2/openapi.yaml

+92
Original file line numberDiff line numberDiff line change
@@ -15657,6 +15657,15 @@ components:
1565715657
example: 1729843470000
1565815658
format: int64
1565915659
type: integer
15660+
groupSignalsBy:
15661+
description: Additional grouping to perform on top of the existing groups
15662+
in the query section. Must be a subset of the existing groups.
15663+
example:
15664+
- service
15665+
items:
15666+
description: Field to group by.
15667+
type: string
15668+
type: array
1566015669
index:
1566115670
description: Index used to load the data.
1566215671
example: cloud_siem
@@ -24242,6 +24251,11 @@ components:
2424224251
SecurityMonitoringRuleCase:
2424324252
description: Case when signal is generated.
2424424253
properties:
24254+
actions:
24255+
description: Action to perform for each rule case.
24256+
items:
24257+
$ref: '#/components/schemas/SecurityMonitoringRuleCaseAction'
24258+
type: array
2424524259
condition:
2424624260
description: 'A rule case contains logical operations (`>`,`>=`, `&&`, `||`)
2424724261
to determine if a signal should be generated
@@ -24260,9 +24274,42 @@ components:
2426024274
status:
2426124275
$ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
2426224276
type: object
24277+
SecurityMonitoringRuleCaseAction:
24278+
description: Action to perform when a signal is triggered. Only available for
24279+
Application Security rule type.
24280+
properties:
24281+
options:
24282+
$ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptions'
24283+
type:
24284+
$ref: '#/components/schemas/SecurityMonitoringRuleCaseActionType'
24285+
type: object
24286+
SecurityMonitoringRuleCaseActionOptions:
24287+
description: Options for the rule action
24288+
properties:
24289+
duration:
24290+
description: Duration of the action in seconds. 0 indicates no expiration.
24291+
example: 0
24292+
format: int64
24293+
minimum: 0
24294+
type: integer
24295+
type: object
24296+
SecurityMonitoringRuleCaseActionType:
24297+
description: The action type.
24298+
enum:
24299+
- block_ip
24300+
- block_user
24301+
type: string
24302+
x-enum-varnames:
24303+
- BLOCK_IP
24304+
- BLOCK_USER
2426324305
SecurityMonitoringRuleCaseCreate:
2426424306
description: Case when signal is generated.
2426524307
properties:
24308+
actions:
24309+
description: Action to perform for each rule case.
24310+
items:
24311+
$ref: '#/components/schemas/SecurityMonitoringRuleCaseAction'
24312+
type: array
2426624313
condition:
2426724314
description: 'A case contains logical operations (`>`,`>=`, `&&`, `||`)
2426824315
to determine if a signal should be generated
@@ -24724,6 +24771,15 @@ components:
2472424771
items:
2472524772
$ref: '#/components/schemas/SecurityMonitoringFilter'
2472624773
type: array
24774+
groupSignalsBy:
24775+
description: Additional grouping to perform on top of the existing groups
24776+
in the query section. Must be a subset of the existing groups.
24777+
example:
24778+
- service
24779+
items:
24780+
description: Field to group by.
24781+
type: string
24782+
type: array
2472724783
hasExtendedTitle:
2472824784
description: Whether the notifications include the triggering group-by values
2472924785
in their title.
@@ -25429,6 +25485,15 @@ components:
2542925485
items:
2543025486
$ref: '#/components/schemas/SecurityMonitoringFilter'
2543125487
type: array
25488+
groupSignalsBy:
25489+
description: Additional grouping to perform on top of the existing groups
25490+
in the query section. Must be a subset of the existing groups.
25491+
example:
25492+
- service
25493+
items:
25494+
description: Field to group by.
25495+
type: string
25496+
type: array
2543225497
hasExtendedTitle:
2543325498
description: Whether the notifications include the triggering group-by values
2543425499
in their title.
@@ -25501,6 +25566,15 @@ components:
2550125566
items:
2550225567
$ref: '#/components/schemas/SecurityMonitoringFilter'
2550325568
type: array
25569+
groupSignalsBy:
25570+
description: Additional grouping to perform on top of the existing groups
25571+
in the query section. Must be a subset of the existing groups.
25572+
example:
25573+
- service
25574+
items:
25575+
description: Field to group by.
25576+
type: string
25577+
type: array
2550425578
hasExtendedTitle:
2550525579
description: Whether the notifications include the triggering group-by values
2550625580
in their title.
@@ -25642,6 +25716,15 @@ components:
2564225716
items:
2564325717
$ref: '#/components/schemas/SecurityMonitoringFilter'
2564425718
type: array
25719+
groupSignalsBy:
25720+
description: Additional grouping to perform on top of the existing groups
25721+
in the query section. Must be a subset of the existing groups.
25722+
example:
25723+
- service
25724+
items:
25725+
description: Field to group by.
25726+
type: string
25727+
type: array
2564525728
hasExtendedTitle:
2564625729
description: Whether the notifications include the triggering group-by values
2564725730
in their title.
@@ -25719,6 +25802,15 @@ components:
2571925802
items:
2572025803
$ref: '#/components/schemas/SecurityMonitoringFilter'
2572125804
type: array
25805+
groupSignalsBy:
25806+
description: Additional grouping to perform on top of the existing groups
25807+
in the query section. Must be a subset of the existing groups.
25808+
example:
25809+
- service
25810+
items:
25811+
description: Field to group by.
25812+
type: string
25813+
type: array
2572225814
hasExtendedTitle:
2572325815
description: Whether the notifications include the triggering group-by values
2572425816
in their title.

Diff for: ‎cassettes/v2/Security-Monitoring_1187227211/Create-a-detection-rule-with-type-application_security-returns-OK-response_4179263030/frozen.json

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2025-02-06T16:50:39.787Z"

Diff for: ‎cassettes/v2/Security-Monitoring_1187227211/Create-a-detection-rule-with-type-application_security-returns-OK-response_4179263030/recording.har

+110
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Create a detection rule with type 'application_security 'returns \"OK\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "e25ba2dd2cd854ae985a97cf9b520975",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 656,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 588,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"cases\":[{\"actions\":[{\"options\":{\"duration\":900},\"type\":\"block_ip\"}],\"condition\":\"a > 100000\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"groupSignalsBy\":[\"service\"],\"isEnabled\":true,\"message\":\"Test rule\",\"name\":\"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1738860639_appsec_rule\",\"options\":{\"detectionMethod\":\"threshold\",\"evaluationWindow\":900,\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[\"service\",\"@http.client_ip\"],\"query\":\"@appsec.security_activity:business_logic.users.login.failure\"}],\"tags\":[],\"type\":\"application_security\"}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules"
39+
},
40+
"response": {
41+
"bodySize": 1153,
42+
"content": {
43+
"mimeType": "application/json",
44+
"size": 1153,
45+
"text": "{\"name\":\"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1738860639_appsec_rule\",\"createdAt\":1738860640426,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isBeta\":false,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"@appsec.security_activity:business_logic.users.login.failure\",\"groupByFields\":[\"service\",\"@http.client_ip\"],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\",\"dataSource\":\"app_sec_spans\"}],\"options\":{\"evaluationWindow\":900,\"detectionMethod\":\"threshold\",\"maxSignalDuration\":86400,\"keepAlive\":3600},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a \\u003e 100000\",\"actions\":[{\"type\":\"block_ip\",\"options\":{\"duration\":900}}]}],\"message\":\"Test rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"application_security\",\"filters\":[],\"version\":1,\"id\":\"rfn-h2v-udr\",\"blocking\":true,\"groupSignalsBy\":[\"service\"],\"casesActions\":[[{\"type\":\"block_ip\",\"options\":{\"duration\":900}}]],\"dependencies\":[\"business_logic.users.login.failure\"],\"metadata\":{\"entities\":null,\"sources\":null},\"creator\":{\"handle\":\"\",\"name\":\"\"},\"updater\":{\"handle\":\"\",\"name\":\"\"}}"
46+
},
47+
"cookies": [],
48+
"headers": [
49+
{
50+
"name": "content-type",
51+
"value": "application/json"
52+
}
53+
],
54+
"headersSize": 656,
55+
"httpVersion": "HTTP/1.1",
56+
"redirectURL": "",
57+
"status": 200,
58+
"statusText": "OK"
59+
},
60+
"startedDateTime": "2025-02-06T16:50:40.180Z",
61+
"time": 287
62+
},
63+
{
64+
"_id": "d0c7ee9e7178f2b7bb6ab84e899effed",
65+
"_order": 0,
66+
"cache": {},
67+
"request": {
68+
"bodySize": 0,
69+
"cookies": [],
70+
"headers": [
71+
{
72+
"_fromType": "array",
73+
"name": "accept",
74+
"value": "*/*"
75+
}
76+
],
77+
"headersSize": 536,
78+
"httpVersion": "HTTP/1.1",
79+
"method": "DELETE",
80+
"queryString": [],
81+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules/rfn-h2v-udr"
82+
},
83+
"response": {
84+
"bodySize": 36,
85+
"content": {
86+
"mimeType": "application/json",
87+
"size": 36,
88+
"text": "{\"status\":\"404\",\"title\":\"Not Found\"}"
89+
},
90+
"cookies": [],
91+
"headers": [
92+
{
93+
"name": "content-type",
94+
"value": "application/json"
95+
}
96+
],
97+
"headersSize": 654,
98+
"httpVersion": "HTTP/1.1",
99+
"redirectURL": "",
100+
"status": 404,
101+
"statusText": "Not Found"
102+
},
103+
"startedDateTime": "2025-02-06T16:50:40.475Z",
104+
"time": 127
105+
}
106+
],
107+
"pages": [],
108+
"version": "1.2"
109+
}
110+
}

Diff for: ‎examples/v2/security-monitoring/CreateSecurityMonitoringRule_1965169892.ts

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/**
2+
* Create a detection rule with type 'application_security 'returns "OK" response
3+
*/
4+
5+
import { client, v2 } from "@datadog/datadog-api-client";
6+
7+
const configuration = client.createConfiguration();
8+
const apiInstance = new v2.SecurityMonitoringApi(configuration);
9+
10+
const params: v2.SecurityMonitoringApiCreateSecurityMonitoringRuleRequest = {
11+
body: {
12+
type: "application_security",
13+
name: "Example-Security-Monitoring_appsec_rule",
14+
queries: [
15+
{
16+
query: "@appsec.security_activity:business_logic.users.login.failure",
17+
aggregation: "count",
18+
groupByFields: ["service", "@http.client_ip"],
19+
distinctFields: [],
20+
},
21+
],
22+
filters: [],
23+
cases: [
24+
{
25+
name: "",
26+
status: "info",
27+
notifications: [],
28+
condition: "a > 100000",
29+
actions: [
30+
{
31+
type: "block_ip",
32+
options: {
33+
duration: 900,
34+
},
35+
},
36+
],
37+
},
38+
],
39+
options: {
40+
keepAlive: 3600,
41+
maxSignalDuration: 86400,
42+
evaluationWindow: 900,
43+
detectionMethod: "threshold",
44+
},
45+
isEnabled: true,
46+
message: "Test rule",
47+
tags: [],
48+
groupSignalsBy: ["service"],
49+
},
50+
};
51+
52+
apiInstance
53+
.createSecurityMonitoringRule(params)
54+
.then((data: v2.SecurityMonitoringRuleResponse) => {
55+
console.log(
56+
"API called successfully. Returned data: " + JSON.stringify(data)
57+
);
58+
})
59+
.catch((error: any) => console.error(error));

Diff for: ‎features/v2/security_monitoring.feature

+10
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,16 @@ Feature: Security Monitoring
200200
And the response "options.detectionMethod" is equal to "third_party"
201201
And the response "thirdPartyCases[0].query" is equal to "status:error"
202202

203+
@skip-validation @team:DataDog/k9-cloud-security-platform
204+
Scenario: Create a detection rule with type 'application_security 'returns "OK" response
205+
Given new "CreateSecurityMonitoringRule" request
206+
And body with value {"type":"application_security","name":"{{unique}}_appsec_rule","queries":[{"query":"@appsec.security_activity:business_logic.users.login.failure","aggregation":"count","groupByFields":["service","@http.client_ip"],"distinctFields":[]}],"filters":[],"cases":[{"name":"","status":"info","notifications":[],"condition":"a > 100000","actions":[{"type":"block_ip","options":{"duration":900}}]}],"options":{"keepAlive":3600,"maxSignalDuration":86400,"evaluationWindow":900,"detectionMethod":"threshold"},"isEnabled":true,"message":"Test rule","tags":[],"groupSignalsBy":["service"]}
207+
When the request is sent
208+
Then the response status is 200 OK
209+
And the response "name" is equal to "{{ unique }}_appsec_rule"
210+
And the response "type" is equal to "application_security"
211+
And the response "message" is equal to "Test rule"
212+
203213
@skip-validation @team:DataDog/k9-cloud-security-platform
204214
Scenario: Create a detection rule with type 'impossible_travel' returns "OK" response
205215
Given new "CreateSecurityMonitoringRule" request

Diff for: ‎packages/datadog-api-client-v2/index.ts

+3
Original file line numberDiff line numberDiff line change
@@ -2146,6 +2146,9 @@ export { SecurityMonitoringFilterAction } from "./models/SecurityMonitoringFilte
21462146
export { SecurityMonitoringListRulesResponse } from "./models/SecurityMonitoringListRulesResponse";
21472147
export { SecurityMonitoringReferenceTable } from "./models/SecurityMonitoringReferenceTable";
21482148
export { SecurityMonitoringRuleCase } from "./models/SecurityMonitoringRuleCase";
2149+
export { SecurityMonitoringRuleCaseAction } from "./models/SecurityMonitoringRuleCaseAction";
2150+
export { SecurityMonitoringRuleCaseActionOptions } from "./models/SecurityMonitoringRuleCaseActionOptions";
2151+
export { SecurityMonitoringRuleCaseActionType } from "./models/SecurityMonitoringRuleCaseActionType";
21492152
export { SecurityMonitoringRuleCaseCreate } from "./models/SecurityMonitoringRuleCaseCreate";
21502153
export { SecurityMonitoringRuleConvertPayload } from "./models/SecurityMonitoringRuleConvertPayload";
21512154
export { SecurityMonitoringRuleConvertResponse } from "./models/SecurityMonitoringRuleConvertResponse";

Diff for: ‎packages/datadog-api-client-v2/models/JobDefinition.ts

+8
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,10 @@ export class JobDefinition {
2828
* Starting time of data analyzed by the job.
2929
*/
3030
"from": number;
31+
/**
32+
* Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
33+
*/
34+
"groupSignalsBy"?: Array<string>;
3135
/**
3236
* Index used to load the data.
3337
*/
@@ -100,6 +104,10 @@ export class JobDefinition {
100104
required: true,
101105
format: "int64",
102106
},
107+
groupSignalsBy: {
108+
baseName: "groupSignalsBy",
109+
type: "Array<string>",
110+
},
103111
index: {
104112
baseName: "index",
105113
type: "string",

0 commit comments

Comments
 (0)