From 4ce8d1f578968c47731db7c6b885d7f2bf0c8883 Mon Sep 17 00:00:00 2001 From: "ci.datadog-api-spec" Date: Mon, 7 Sep 2026 11:54:45 +0000 Subject: [PATCH] Regenerate client from commit 7ef5189 of spec repo --- .generator/schemas/v2/openapi.yaml | 175 +++++++++++++++++- features/v2/security_monitoring.feature | 5 +- services/security_monitoring/src/v2/index.ts | 2 + .../src/v2/models/RuleVersions.ts | 2 +- ...tyMonitoringRuleImpossibleTravelOptions.ts | 8 + .../models/SecurityMonitoringRuleMetadata.ts | 52 ++++++ .../SecurityMonitoringRuleNewValueOptions.ts | 9 + .../models/SecurityMonitoringRuleOptions.ts | 16 ++ .../models/SecurityMonitoringRuleResponse.ts | 2 +- .../v2/models/SecurityMonitoringRuleUser.ts | 52 ++++++ .../SecurityMonitoringSignalRuleResponse.ts | 83 +++++++++ ...curityMonitoringSignalRuleResponseQuery.ts | 8 + .../SecurityMonitoringStandardRuleResponse.ts | 82 ++++++++ .../src/v2/models/TypingInfo.ts | 4 + 14 files changed, 495 insertions(+), 5 deletions(-) create mode 100644 services/security_monitoring/src/v2/models/SecurityMonitoringRuleMetadata.ts create mode 100644 services/security_monitoring/src/v2/models/SecurityMonitoringRuleUser.ts diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml index 682c9d1e9b3d..0cff0ec9bdb1 100644 --- a/.generator/schemas/v2/openapi.yaml +++ b/.generator/schemas/v2/openapi.yaml @@ -101484,6 +101484,9 @@ components: $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations' baselineUserLocationsDuration: $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocationsDuration' + detectIpTransition: + description: Whether to detect transitions between IP addresses. + type: boolean type: object SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations: description: "If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access." @@ -101564,6 +101567,22 @@ components: - SIX_HOURS - TWELVE_HOURS - ONE_DAY + SecurityMonitoringRuleMetadata: + description: Metadata associated with the rule. + properties: + entities: + description: Entities associated with the rule, or null when metadata is not requested. + items: {} + nullable: true + type: array + sources: + description: Sources associated with the rule, or null when metadata is not requested. + items: + description: A source. + type: string + nullable: true + type: array + type: object SecurityMonitoringRuleNewValueOptions: description: Options on new value detection method. properties: @@ -101571,6 +101590,11 @@ components: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter' instantaneousBaseline: $ref: '#/components/schemas/SecurityMonitoringRuleInstantaneousBaseline' + instantaneousBaselineTimeoutMinutes: + description: Timeout in minutes for constructing the instantaneous baseline. + format: int32 + maximum: 2147483647 + type: integer learningDuration: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration' learningMethod: @@ -101635,8 +101659,17 @@ components: $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration' newValueOptions: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions' + relatedSignalsFields: + description: Fields used to identify related signals. + items: + description: A field name. + type: string + type: array sequenceDetectionOptions: $ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions' + signalTitleTemplate: + description: A template for the signal title. + type: string thirdPartyRuleOptions: $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions' type: object @@ -101708,7 +101741,7 @@ components: type: string type: object SecurityMonitoringRuleResponse: - description: Create a new rule. + description: A security monitoring rule. oneOf: - $ref: '#/components/schemas/SecurityMonitoringStandardRuleResponse' - $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponse' @@ -101965,6 +101998,16 @@ components: maximum: 2147483647 type: integer type: object + SecurityMonitoringRuleUser: + description: The user who created or last updated the rule. + properties: + handle: + description: The user handle. Empty for a default rule with no user. + type: string + name: + description: The user name. Empty for a default rule with no user. + type: string + type: object SecurityMonitoringRuleValidatePayload: description: Validate a rule. oneOf: @@ -102424,6 +102467,9 @@ components: SecurityMonitoringSignalRuleResponse: description: Rule. properties: + blocking: + description: Whether the rule blocks attackers. + type: boolean cases: description: Cases for generating signals. items: @@ -102437,12 +102483,23 @@ components: description: User ID of the user who created the rule. format: int64 type: integer + creator: + $ref: '#/components/schemas/SecurityMonitoringRuleUser' customMessage: description: Custom/Overridden message for generated signals (used in case of Default rule update). type: string customName: description: Custom/Overridden name of the rule (used in case of Default rule update). type: string + defaultRuleId: + description: The ID of the corresponding default rule. + type: string + defaultTags: + description: Default tags for default rules, included in tags. + items: + description: A default tag. + type: string + type: array deprecationDate: description: When the rule will be deprecated, timestamp in milliseconds. format: int64 @@ -102458,18 +102515,29 @@ components: id: description: The ID of the rule. type: string + isBeta: + description: Whether the rule is in beta. + type: boolean isDefault: description: Whether the rule is included by default. type: boolean isDeleted: description: Whether the rule has been deleted. type: boolean + isDeprecated: + description: Whether the rule is deprecated. + type: boolean isEnabled: description: Whether the rule is enabled. type: boolean + isPartner: + description: Whether the rule is provided by a partner. + type: boolean message: description: Message for generated signals. type: string + metadata: + $ref: '#/components/schemas/SecurityMonitoringRuleMetadata' name: description: The name of the rule. type: string @@ -102492,6 +102560,12 @@ components: description: User ID of the user who updated the rule. format: int64 type: integer + updatedAt: + description: The date the rule was last updated, in milliseconds. + format: int64 + type: integer + updater: + $ref: '#/components/schemas/SecurityMonitoringRuleUser' version: description: The version of the rule. format: int64 @@ -102529,6 +102603,10 @@ components: description: Field. type: string type: array + hasOptionalGroupByFields: + description: Whether events with missing group-by fields are processed with a replacement value. + example: false + type: boolean metrics: description: Group of target fields to aggregate over. items: @@ -103241,6 +103319,9 @@ components: SecurityMonitoringStandardRuleResponse: description: Rule. properties: + blocking: + description: Whether the rule blocks attackers. + type: boolean calculatedFields: description: Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined. items: @@ -103261,12 +103342,17 @@ components: description: User ID of the user who created the rule. format: int64 type: integer + creator: + $ref: '#/components/schemas/SecurityMonitoringRuleUser' customMessage: description: Custom/Overridden message for generated signals (used in case of Default rule update). type: string customName: description: Custom/Overridden name of the rule (used in case of Default rule update). type: string + defaultRuleId: + description: The ID of the corresponding default rule. + type: string defaultTags: description: Default Tags for default rules (included in tags) example: @@ -103275,6 +103361,12 @@ components: description: Default Tag. type: string type: array + dependencies: + description: IDs of rules that this rule depends on. + items: + description: A rule ID. + type: string + type: array deprecationDate: description: When the rule will be deprecated, timestamp in milliseconds. format: int64 @@ -103284,6 +103376,9 @@ components: items: $ref: '#/components/schemas/SecurityMonitoringFilter' type: array + findingType: + description: The type of findings generated by the rule. + type: string groupSignalsBy: description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. example: @@ -103298,18 +103393,29 @@ components: id: description: The ID of the rule. type: string + isBeta: + description: Whether the rule is in beta. + type: boolean isDefault: description: Whether the rule is included by default. type: boolean isDeleted: description: Whether the rule has been deleted. type: boolean + isDeprecated: + description: Whether the rule is deprecated. + type: boolean isEnabled: description: Whether the rule is enabled. type: boolean + isPartner: + description: Whether the rule is provided by a partner. + type: boolean message: description: Message for generated signals. type: string + metadata: + $ref: '#/components/schemas/SecurityMonitoringRuleMetadata' name: description: The name of the rule. type: string @@ -103349,6 +103455,8 @@ components: description: The date the rule was last updated, in milliseconds. format: int64 type: integer + updater: + $ref: '#/components/schemas/SecurityMonitoringRuleUser' version: description: The version of the rule. format: int64 @@ -203960,10 +204068,73 @@ paths: default: value: data: - - id: abc-123 + - blocking: false + creator: + handle: security@example.com + name: Security Team + id: abc-123 + isBeta: false + isDeprecated: false isEnabled: true + isPartner: false + metadata: + entities: + sources: name: My security monitoring rule. + options: + detectionMethod: threshold + relatedSignalsFields: ["service"] + signalTitleTemplate: Security signal type: log_detection + updater: + handle: security@example.com + name: Security Team + meta: {} + impossible_travel: + value: + data: + - id: jkl-012 + options: + detectionMethod: impossible_travel + impossibleTravelOptions: + detectIpTransition: true + type: log_detection + meta: {} + new_value: + value: + data: + - id: ghi-789 + options: + detectionMethod: new_value + newValueOptions: + instantaneousBaselineTimeoutMinutes: 0 + type: log_detection + meta: {} + signal_correlation: + value: + data: + - blocking: false + creator: + handle: "" + name: "" + defaultRuleId: def-000-abc + defaultTags: ["security:attack"] + id: def-456 + isBeta: false + isDeprecated: false + isPartner: false + metadata: + entities: + sources: + queries: + - aggregation: event_count + defaultRuleId: def-000-123 + hasOptionalGroupByFields: false + type: signal_correlation + updatedAt: 1750000000000 + updater: + handle: "" + name: "" meta: {} schema: $ref: '#/components/schemas/SecurityMonitoringListRulesResponse' diff --git a/features/v2/security_monitoring.feature b/features/v2/security_monitoring.feature index 12b40ab104a6..0cd95c1b0e4d 100644 --- a/features/v2/security_monitoring.feature +++ b/features/v2/security_monitoring.feature @@ -2669,11 +2669,14 @@ Feature: Security Monitoring When the request is sent Then the response status is 400 Bad Request - @skip-validation @team:DataDog/cloud-siem + @team:DataDog/cloud-siem Scenario: List rules returns "OK" response Given new "ListSecurityMonitoringRules" request When the request is sent Then the response status is 200 OK + And the response "data[0]" has field "isPartner" + And the response "data[0]" has field "isBeta" + And the response "data[0]" has field "isDeprecated" @team:DataDog/k9-cloud-vm Scenario: List scanned assets metadata returns "Bad request: Invalid Pagination Token" response diff --git a/services/security_monitoring/src/v2/index.ts b/services/security_monitoring/src/v2/index.ts index 3e7c73c67ca8..e893c3a5c661 100644 --- a/services/security_monitoring/src/v2/index.ts +++ b/services/security_monitoring/src/v2/index.ts @@ -718,6 +718,7 @@ export { SecurityMonitoringRuleHardcodedEvaluatorType } from "./models/SecurityM export { SecurityMonitoringRuleImpossibleTravelOptions } from "./models/SecurityMonitoringRuleImpossibleTravelOptions"; export { SecurityMonitoringRuleKeepAlive } from "./models/SecurityMonitoringRuleKeepAlive"; export { SecurityMonitoringRuleMaxSignalDuration } from "./models/SecurityMonitoringRuleMaxSignalDuration"; +export { SecurityMonitoringRuleMetadata } from "./models/SecurityMonitoringRuleMetadata"; export { SecurityMonitoringRuleNewValueOptions } from "./models/SecurityMonitoringRuleNewValueOptions"; export { SecurityMonitoringRuleNewValueOptionsLearningMethod } from "./models/SecurityMonitoringRuleNewValueOptionsLearningMethod"; export { SecurityMonitoringRuleNewValueOptionsLearningThreshold } from "./models/SecurityMonitoringRuleNewValueOptionsLearningThreshold"; @@ -740,6 +741,7 @@ export { SecurityMonitoringRuleTypeCreate } from "./models/SecurityMonitoringRul export { SecurityMonitoringRuleTypeRead } from "./models/SecurityMonitoringRuleTypeRead"; export { SecurityMonitoringRuleTypeTest } from "./models/SecurityMonitoringRuleTypeTest"; export { SecurityMonitoringRuleUpdatePayload } from "./models/SecurityMonitoringRuleUpdatePayload"; +export { SecurityMonitoringRuleUser } from "./models/SecurityMonitoringRuleUser"; export { SecurityMonitoringRuleValidatePayload } from "./models/SecurityMonitoringRuleValidatePayload"; export { SecurityMonitoringSchedulingOptions } from "./models/SecurityMonitoringSchedulingOptions"; export { SecurityMonitoringSentinelOneIntegrationConfigCreateAttributes } from "./models/SecurityMonitoringSentinelOneIntegrationConfigCreateAttributes"; diff --git a/services/security_monitoring/src/v2/models/RuleVersions.ts b/services/security_monitoring/src/v2/models/RuleVersions.ts index df48e930c195..fc2cd5dbfd25 100644 --- a/services/security_monitoring/src/v2/models/RuleVersions.ts +++ b/services/security_monitoring/src/v2/models/RuleVersions.ts @@ -12,7 +12,7 @@ export class RuleVersions { */ "changes"?: Array; /** - * Create a new rule. + * A security monitoring rule. */ "rule"?: SecurityMonitoringRuleResponse; /** diff --git a/services/security_monitoring/src/v2/models/SecurityMonitoringRuleImpossibleTravelOptions.ts b/services/security_monitoring/src/v2/models/SecurityMonitoringRuleImpossibleTravelOptions.ts index 92973c36c5f7..6b3ac8c0b840 100644 --- a/services/security_monitoring/src/v2/models/SecurityMonitoringRuleImpossibleTravelOptions.ts +++ b/services/security_monitoring/src/v2/models/SecurityMonitoringRuleImpossibleTravelOptions.ts @@ -13,6 +13,10 @@ export class SecurityMonitoringRuleImpossibleTravelOptions { * The duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations. */ "baselineUserLocationsDuration"?: number; + /** + * Whether to detect transitions between IP addresses. + */ + "detectIpTransition"?: boolean; /** * A container for additional, undeclared properties. * This is a holder for any undeclared properties as specified with @@ -37,6 +41,10 @@ export class SecurityMonitoringRuleImpossibleTravelOptions { type: "number", format: "int32", }, + detectIpTransition: { + baseName: "detectIpTransition", + type: "boolean", + }, additionalProperties: { baseName: "additionalProperties", type: "{ [key: string]: any; }", diff --git a/services/security_monitoring/src/v2/models/SecurityMonitoringRuleMetadata.ts b/services/security_monitoring/src/v2/models/SecurityMonitoringRuleMetadata.ts new file mode 100644 index 000000000000..a83a90e8a0a4 --- /dev/null +++ b/services/security_monitoring/src/v2/models/SecurityMonitoringRuleMetadata.ts @@ -0,0 +1,52 @@ +import { AttributeTypeMap } from "@datadog/datadog-api-client"; + +/** + * Metadata associated with the rule. + */ +export class SecurityMonitoringRuleMetadata { + /** + * Entities associated with the rule, or null when metadata is not requested. + */ + "entities"?: Array; + /** + * Sources associated with the rule, or null when metadata is not requested. + */ + "sources"?: Array; + /** + * A container for additional, undeclared properties. + * This is a holder for any undeclared properties as specified with + * the 'additionalProperties' keyword in the OAS document. + */ + "additionalProperties"?: { [key: string]: any }; + /** + * @ignore + */ + "_unparsed"?: boolean; + + /** + * @ignore + */ + static readonly attributeTypeMap: AttributeTypeMap = { + entities: { + baseName: "entities", + type: "Array", + }, + sources: { + baseName: "sources", + type: "Array", + }, + additionalProperties: { + baseName: "additionalProperties", + type: "{ [key: string]: any; }", + }, + }; + + /** + * @ignore + */ + static getAttributeTypeMap(): AttributeTypeMap { + return SecurityMonitoringRuleMetadata.attributeTypeMap; + } + + public constructor() {} +} diff --git a/services/security_monitoring/src/v2/models/SecurityMonitoringRuleNewValueOptions.ts b/services/security_monitoring/src/v2/models/SecurityMonitoringRuleNewValueOptions.ts index d78076cc6a60..8add71d2e5b9 100644 --- a/services/security_monitoring/src/v2/models/SecurityMonitoringRuleNewValueOptions.ts +++ b/services/security_monitoring/src/v2/models/SecurityMonitoringRuleNewValueOptions.ts @@ -15,6 +15,10 @@ export class SecurityMonitoringRuleNewValueOptions { * When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time. */ "instantaneousBaseline"?: boolean; + /** + * Timeout in minutes for constructing the instantaneous baseline. + */ + "instantaneousBaselineTimeoutMinutes"?: number; /** * The duration in days during which values are learned, and after which signals will be generated for values that * weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. @@ -52,6 +56,11 @@ export class SecurityMonitoringRuleNewValueOptions { baseName: "instantaneousBaseline", type: "boolean", }, + instantaneousBaselineTimeoutMinutes: { + baseName: "instantaneousBaselineTimeoutMinutes", + type: "number", + format: "int32", + }, learningDuration: { baseName: "learningDuration", type: "number", diff --git a/services/security_monitoring/src/v2/models/SecurityMonitoringRuleOptions.ts b/services/security_monitoring/src/v2/models/SecurityMonitoringRuleOptions.ts index 4c49ffec8e22..8b006bed8dde 100644 --- a/services/security_monitoring/src/v2/models/SecurityMonitoringRuleOptions.ts +++ b/services/security_monitoring/src/v2/models/SecurityMonitoringRuleOptions.ts @@ -62,10 +62,18 @@ export class SecurityMonitoringRuleOptions { * Options on new value detection method. */ "newValueOptions"?: SecurityMonitoringRuleNewValueOptions; + /** + * Fields used to identify related signals. + */ + "relatedSignalsFields"?: Array; /** * Options on sequence detection method. */ "sequenceDetectionOptions"?: SecurityMonitoringRuleSequenceDetectionOptions; + /** + * A template for the signal title. + */ + "signalTitleTemplate"?: string; /** * Options on third party detection method. */ @@ -128,10 +136,18 @@ export class SecurityMonitoringRuleOptions { baseName: "newValueOptions", type: "SecurityMonitoringRuleNewValueOptions", }, + relatedSignalsFields: { + baseName: "relatedSignalsFields", + type: "Array", + }, sequenceDetectionOptions: { baseName: "sequenceDetectionOptions", type: "SecurityMonitoringRuleSequenceDetectionOptions", }, + signalTitleTemplate: { + baseName: "signalTitleTemplate", + type: "string", + }, thirdPartyRuleOptions: { baseName: "thirdPartyRuleOptions", type: "SecurityMonitoringRuleThirdPartyOptions", diff --git a/services/security_monitoring/src/v2/models/SecurityMonitoringRuleResponse.ts b/services/security_monitoring/src/v2/models/SecurityMonitoringRuleResponse.ts index c49341e91632..e414fdf8acb5 100644 --- a/services/security_monitoring/src/v2/models/SecurityMonitoringRuleResponse.ts +++ b/services/security_monitoring/src/v2/models/SecurityMonitoringRuleResponse.ts @@ -4,7 +4,7 @@ import { SecurityMonitoringSignalRuleResponse } from "./SecurityMonitoringSignal import { SecurityMonitoringStandardRuleResponse } from "./SecurityMonitoringStandardRuleResponse"; /** - * Create a new rule. + * A security monitoring rule. */ export type SecurityMonitoringRuleResponse = | SecurityMonitoringStandardRuleResponse diff --git a/services/security_monitoring/src/v2/models/SecurityMonitoringRuleUser.ts b/services/security_monitoring/src/v2/models/SecurityMonitoringRuleUser.ts new file mode 100644 index 000000000000..42154ddeba74 --- /dev/null +++ b/services/security_monitoring/src/v2/models/SecurityMonitoringRuleUser.ts @@ -0,0 +1,52 @@ +import { AttributeTypeMap } from "@datadog/datadog-api-client"; + +/** + * The user who created or last updated the rule. + */ +export class SecurityMonitoringRuleUser { + /** + * The user handle. Empty for a default rule with no user. + */ + "handle"?: string; + /** + * The user name. Empty for a default rule with no user. + */ + "name"?: string; + /** + * A container for additional, undeclared properties. + * This is a holder for any undeclared properties as specified with + * the 'additionalProperties' keyword in the OAS document. + */ + "additionalProperties"?: { [key: string]: any }; + /** + * @ignore + */ + "_unparsed"?: boolean; + + /** + * @ignore + */ + static readonly attributeTypeMap: AttributeTypeMap = { + handle: { + baseName: "handle", + type: "string", + }, + name: { + baseName: "name", + type: "string", + }, + additionalProperties: { + baseName: "additionalProperties", + type: "{ [key: string]: any; }", + }, + }; + + /** + * @ignore + */ + static getAttributeTypeMap(): AttributeTypeMap { + return SecurityMonitoringRuleUser.attributeTypeMap; + } + + public constructor() {} +} diff --git a/services/security_monitoring/src/v2/models/SecurityMonitoringSignalRuleResponse.ts b/services/security_monitoring/src/v2/models/SecurityMonitoringSignalRuleResponse.ts index 0cde16f56213..747758aaca10 100644 --- a/services/security_monitoring/src/v2/models/SecurityMonitoringSignalRuleResponse.ts +++ b/services/security_monitoring/src/v2/models/SecurityMonitoringSignalRuleResponse.ts @@ -2,7 +2,9 @@ import { AttributeTypeMap } from "@datadog/datadog-api-client"; import { SecurityMonitoringFilter } from "./SecurityMonitoringFilter"; import { SecurityMonitoringRuleCase } from "./SecurityMonitoringRuleCase"; +import { SecurityMonitoringRuleMetadata } from "./SecurityMonitoringRuleMetadata"; import { SecurityMonitoringRuleOptions } from "./SecurityMonitoringRuleOptions"; +import { SecurityMonitoringRuleUser } from "./SecurityMonitoringRuleUser"; import { SecurityMonitoringSignalRuleResponseQuery } from "./SecurityMonitoringSignalRuleResponseQuery"; import { SecurityMonitoringSignalRuleType } from "./SecurityMonitoringSignalRuleType"; @@ -10,6 +12,10 @@ import { SecurityMonitoringSignalRuleType } from "./SecurityMonitoringSignalRule * Rule. */ export class SecurityMonitoringSignalRuleResponse { + /** + * Whether the rule blocks attackers. + */ + "blocking"?: boolean; /** * Cases for generating signals. */ @@ -22,6 +28,10 @@ export class SecurityMonitoringSignalRuleResponse { * User ID of the user who created the rule. */ "creationAuthorId"?: number; + /** + * The user who created or last updated the rule. + */ + "creator"?: SecurityMonitoringRuleUser; /** * Custom/Overridden message for generated signals (used in case of Default rule update). */ @@ -30,6 +40,14 @@ export class SecurityMonitoringSignalRuleResponse { * Custom/Overridden name of the rule (used in case of Default rule update). */ "customName"?: string; + /** + * The ID of the corresponding default rule. + */ + "defaultRuleId"?: string; + /** + * Default tags for default rules, included in tags. + */ + "defaultTags"?: Array; /** * When the rule will be deprecated, timestamp in milliseconds. */ @@ -46,6 +64,10 @@ export class SecurityMonitoringSignalRuleResponse { * The ID of the rule. */ "id"?: string; + /** + * Whether the rule is in beta. + */ + "isBeta"?: boolean; /** * Whether the rule is included by default. */ @@ -54,14 +76,26 @@ export class SecurityMonitoringSignalRuleResponse { * Whether the rule has been deleted. */ "isDeleted"?: boolean; + /** + * Whether the rule is deprecated. + */ + "isDeprecated"?: boolean; /** * Whether the rule is enabled. */ "isEnabled"?: boolean; + /** + * Whether the rule is provided by a partner. + */ + "isPartner"?: boolean; /** * Message for generated signals. */ "message"?: string; + /** + * Metadata associated with the rule. + */ + "metadata"?: SecurityMonitoringRuleMetadata; /** * The name of the rule. */ @@ -86,6 +120,14 @@ export class SecurityMonitoringSignalRuleResponse { * User ID of the user who updated the rule. */ "updateAuthorId"?: number; + /** + * The date the rule was last updated, in milliseconds. + */ + "updatedAt"?: number; + /** + * The user who created or last updated the rule. + */ + "updater"?: SecurityMonitoringRuleUser; /** * The version of the rule. */ @@ -105,6 +147,10 @@ export class SecurityMonitoringSignalRuleResponse { * @ignore */ static readonly attributeTypeMap: AttributeTypeMap = { + blocking: { + baseName: "blocking", + type: "boolean", + }, cases: { baseName: "cases", type: "Array", @@ -119,6 +165,10 @@ export class SecurityMonitoringSignalRuleResponse { type: "number", format: "int64", }, + creator: { + baseName: "creator", + type: "SecurityMonitoringRuleUser", + }, customMessage: { baseName: "customMessage", type: "string", @@ -127,6 +177,14 @@ export class SecurityMonitoringSignalRuleResponse { baseName: "customName", type: "string", }, + defaultRuleId: { + baseName: "defaultRuleId", + type: "string", + }, + defaultTags: { + baseName: "defaultTags", + type: "Array", + }, deprecationDate: { baseName: "deprecationDate", type: "number", @@ -144,6 +202,10 @@ export class SecurityMonitoringSignalRuleResponse { baseName: "id", type: "string", }, + isBeta: { + baseName: "isBeta", + type: "boolean", + }, isDefault: { baseName: "isDefault", type: "boolean", @@ -152,14 +214,26 @@ export class SecurityMonitoringSignalRuleResponse { baseName: "isDeleted", type: "boolean", }, + isDeprecated: { + baseName: "isDeprecated", + type: "boolean", + }, isEnabled: { baseName: "isEnabled", type: "boolean", }, + isPartner: { + baseName: "isPartner", + type: "boolean", + }, message: { baseName: "message", type: "string", }, + metadata: { + baseName: "metadata", + type: "SecurityMonitoringRuleMetadata", + }, name: { baseName: "name", type: "string", @@ -185,6 +259,15 @@ export class SecurityMonitoringSignalRuleResponse { type: "number", format: "int64", }, + updatedAt: { + baseName: "updatedAt", + type: "number", + format: "int64", + }, + updater: { + baseName: "updater", + type: "SecurityMonitoringRuleUser", + }, version: { baseName: "version", type: "number", diff --git a/services/security_monitoring/src/v2/models/SecurityMonitoringSignalRuleResponseQuery.ts b/services/security_monitoring/src/v2/models/SecurityMonitoringSignalRuleResponseQuery.ts index 791f10eb45c8..2da8b8124fbe 100644 --- a/services/security_monitoring/src/v2/models/SecurityMonitoringSignalRuleResponseQuery.ts +++ b/services/security_monitoring/src/v2/models/SecurityMonitoringSignalRuleResponseQuery.ts @@ -30,6 +30,10 @@ export class SecurityMonitoringSignalRuleResponseQuery { * Fields to group by. */ "groupByFields"?: Array; + /** + * Whether events with missing group-by fields are processed with a replacement value. + */ + "hasOptionalGroupByFields"?: boolean; /** * Group of target fields to aggregate over. */ @@ -82,6 +86,10 @@ export class SecurityMonitoringSignalRuleResponseQuery { baseName: "groupByFields", type: "Array", }, + hasOptionalGroupByFields: { + baseName: "hasOptionalGroupByFields", + type: "boolean", + }, metrics: { baseName: "metrics", type: "Array", diff --git a/services/security_monitoring/src/v2/models/SecurityMonitoringStandardRuleResponse.ts b/services/security_monitoring/src/v2/models/SecurityMonitoringStandardRuleResponse.ts index 1286824e8721..73a301f8a478 100644 --- a/services/security_monitoring/src/v2/models/SecurityMonitoringStandardRuleResponse.ts +++ b/services/security_monitoring/src/v2/models/SecurityMonitoringStandardRuleResponse.ts @@ -5,8 +5,10 @@ import { CloudConfigurationRuleComplianceSignalOptions } from "./CloudConfigurat import { SecurityMonitoringFilter } from "./SecurityMonitoringFilter"; import { SecurityMonitoringReferenceTable } from "./SecurityMonitoringReferenceTable"; import { SecurityMonitoringRuleCase } from "./SecurityMonitoringRuleCase"; +import { SecurityMonitoringRuleMetadata } from "./SecurityMonitoringRuleMetadata"; import { SecurityMonitoringRuleOptions } from "./SecurityMonitoringRuleOptions"; import { SecurityMonitoringRuleTypeRead } from "./SecurityMonitoringRuleTypeRead"; +import { SecurityMonitoringRuleUser } from "./SecurityMonitoringRuleUser"; import { SecurityMonitoringSchedulingOptions } from "./SecurityMonitoringSchedulingOptions"; import { SecurityMonitoringStandardRuleQuery } from "./SecurityMonitoringStandardRuleQuery"; import { SecurityMonitoringThirdPartyRuleCase } from "./SecurityMonitoringThirdPartyRuleCase"; @@ -15,6 +17,10 @@ import { SecurityMonitoringThirdPartyRuleCase } from "./SecurityMonitoringThirdP * Rule. */ export class SecurityMonitoringStandardRuleResponse { + /** + * Whether the rule blocks attackers. + */ + "blocking"?: boolean; /** * Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined. */ @@ -35,6 +41,10 @@ export class SecurityMonitoringStandardRuleResponse { * User ID of the user who created the rule. */ "creationAuthorId"?: number; + /** + * The user who created or last updated the rule. + */ + "creator"?: SecurityMonitoringRuleUser; /** * Custom/Overridden message for generated signals (used in case of Default rule update). */ @@ -43,10 +53,18 @@ export class SecurityMonitoringStandardRuleResponse { * Custom/Overridden name of the rule (used in case of Default rule update). */ "customName"?: string; + /** + * The ID of the corresponding default rule. + */ + "defaultRuleId"?: string; /** * Default Tags for default rules (included in tags) */ "defaultTags"?: Array; + /** + * IDs of rules that this rule depends on. + */ + "dependencies"?: Array; /** * When the rule will be deprecated, timestamp in milliseconds. */ @@ -55,6 +73,10 @@ export class SecurityMonitoringStandardRuleResponse { * Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. */ "filters"?: Array; + /** + * The type of findings generated by the rule. + */ + "findingType"?: string; /** * Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. */ @@ -67,6 +89,10 @@ export class SecurityMonitoringStandardRuleResponse { * The ID of the rule. */ "id"?: string; + /** + * Whether the rule is in beta. + */ + "isBeta"?: boolean; /** * Whether the rule is included by default. */ @@ -75,14 +101,26 @@ export class SecurityMonitoringStandardRuleResponse { * Whether the rule has been deleted. */ "isDeleted"?: boolean; + /** + * Whether the rule is deprecated. + */ + "isDeprecated"?: boolean; /** * Whether the rule is enabled. */ "isEnabled"?: boolean; + /** + * Whether the rule is provided by a partner. + */ + "isPartner"?: boolean; /** * Message for generated signals. */ "message"?: string; + /** + * Metadata associated with the rule. + */ + "metadata"?: SecurityMonitoringRuleMetadata; /** * The name of the rule. */ @@ -123,6 +161,10 @@ export class SecurityMonitoringStandardRuleResponse { * The date the rule was last updated, in milliseconds. */ "updatedAt"?: number; + /** + * The user who created or last updated the rule. + */ + "updater"?: SecurityMonitoringRuleUser; /** * The version of the rule. */ @@ -142,6 +184,10 @@ export class SecurityMonitoringStandardRuleResponse { * @ignore */ static readonly attributeTypeMap: AttributeTypeMap = { + blocking: { + baseName: "blocking", + type: "boolean", + }, calculatedFields: { baseName: "calculatedFields", type: "Array", @@ -164,6 +210,10 @@ export class SecurityMonitoringStandardRuleResponse { type: "number", format: "int64", }, + creator: { + baseName: "creator", + type: "SecurityMonitoringRuleUser", + }, customMessage: { baseName: "customMessage", type: "string", @@ -172,10 +222,18 @@ export class SecurityMonitoringStandardRuleResponse { baseName: "customName", type: "string", }, + defaultRuleId: { + baseName: "defaultRuleId", + type: "string", + }, defaultTags: { baseName: "defaultTags", type: "Array", }, + dependencies: { + baseName: "dependencies", + type: "Array", + }, deprecationDate: { baseName: "deprecationDate", type: "number", @@ -185,6 +243,10 @@ export class SecurityMonitoringStandardRuleResponse { baseName: "filters", type: "Array", }, + findingType: { + baseName: "findingType", + type: "string", + }, groupSignalsBy: { baseName: "groupSignalsBy", type: "Array", @@ -197,6 +259,10 @@ export class SecurityMonitoringStandardRuleResponse { baseName: "id", type: "string", }, + isBeta: { + baseName: "isBeta", + type: "boolean", + }, isDefault: { baseName: "isDefault", type: "boolean", @@ -205,14 +271,26 @@ export class SecurityMonitoringStandardRuleResponse { baseName: "isDeleted", type: "boolean", }, + isDeprecated: { + baseName: "isDeprecated", + type: "boolean", + }, isEnabled: { baseName: "isEnabled", type: "boolean", }, + isPartner: { + baseName: "isPartner", + type: "boolean", + }, message: { baseName: "message", type: "string", }, + metadata: { + baseName: "metadata", + type: "SecurityMonitoringRuleMetadata", + }, name: { baseName: "name", type: "string", @@ -255,6 +333,10 @@ export class SecurityMonitoringStandardRuleResponse { type: "number", format: "int64", }, + updater: { + baseName: "updater", + type: "SecurityMonitoringRuleUser", + }, version: { baseName: "version", type: "number", diff --git a/services/security_monitoring/src/v2/models/TypingInfo.ts b/services/security_monitoring/src/v2/models/TypingInfo.ts index 820c7f980500..0fb8a4b5f080 100644 --- a/services/security_monitoring/src/v2/models/TypingInfo.ts +++ b/services/security_monitoring/src/v2/models/TypingInfo.ts @@ -442,6 +442,7 @@ import { SecurityMonitoringRuleConvertBulkData } from "./SecurityMonitoringRuleC import { SecurityMonitoringRuleConvertBulkPayload } from "./SecurityMonitoringRuleConvertBulkPayload"; import { SecurityMonitoringRuleConvertResponse } from "./SecurityMonitoringRuleConvertResponse"; import { SecurityMonitoringRuleImpossibleTravelOptions } from "./SecurityMonitoringRuleImpossibleTravelOptions"; +import { SecurityMonitoringRuleMetadata } from "./SecurityMonitoringRuleMetadata"; import { SecurityMonitoringRuleNewValueOptions } from "./SecurityMonitoringRuleNewValueOptions"; import { SecurityMonitoringRuleOptions } from "./SecurityMonitoringRuleOptions"; import { SecurityMonitoringRuleQueryPayload } from "./SecurityMonitoringRuleQueryPayload"; @@ -453,6 +454,7 @@ import { SecurityMonitoringRuleTestRequest } from "./SecurityMonitoringRuleTestR import { SecurityMonitoringRuleTestResponse } from "./SecurityMonitoringRuleTestResponse"; import { SecurityMonitoringRuleThirdPartyOptions } from "./SecurityMonitoringRuleThirdPartyOptions"; import { SecurityMonitoringRuleUpdatePayload } from "./SecurityMonitoringRuleUpdatePayload"; +import { SecurityMonitoringRuleUser } from "./SecurityMonitoringRuleUser"; import { SecurityMonitoringSchedulingOptions } from "./SecurityMonitoringSchedulingOptions"; import { SecurityMonitoringSentinelOneIntegrationConfigCreateAttributes } from "./SecurityMonitoringSentinelOneIntegrationConfigCreateAttributes"; import { SecurityMonitoringSentinelOneIntegrationConfigUpdateAttributes } from "./SecurityMonitoringSentinelOneIntegrationConfigUpdateAttributes"; @@ -1741,6 +1743,7 @@ export const TypingInfo: ModelTypingInfo = { SecurityMonitoringRuleConvertResponse, SecurityMonitoringRuleImpossibleTravelOptions: SecurityMonitoringRuleImpossibleTravelOptions, + SecurityMonitoringRuleMetadata: SecurityMonitoringRuleMetadata, SecurityMonitoringRuleNewValueOptions: SecurityMonitoringRuleNewValueOptions, SecurityMonitoringRuleOptions: SecurityMonitoringRuleOptions, @@ -1758,6 +1761,7 @@ export const TypingInfo: ModelTypingInfo = { SecurityMonitoringRuleThirdPartyOptions: SecurityMonitoringRuleThirdPartyOptions, SecurityMonitoringRuleUpdatePayload: SecurityMonitoringRuleUpdatePayload, + SecurityMonitoringRuleUser: SecurityMonitoringRuleUser, SecurityMonitoringSchedulingOptions: SecurityMonitoringSchedulingOptions, SecurityMonitoringSentinelOneIntegrationConfigCreateAttributes: SecurityMonitoringSentinelOneIntegrationConfigCreateAttributes,