diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml index 682c9d1e9b3d..0cff0ec9bdb1 100644 --- a/.generator/schemas/v2/openapi.yaml +++ b/.generator/schemas/v2/openapi.yaml @@ -101484,6 +101484,9 @@ components: $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations' baselineUserLocationsDuration: $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocationsDuration' + detectIpTransition: + description: Whether to detect transitions between IP addresses. + type: boolean type: object SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations: description: "If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access." @@ -101564,6 +101567,22 @@ components: - SIX_HOURS - TWELVE_HOURS - ONE_DAY + SecurityMonitoringRuleMetadata: + description: Metadata associated with the rule. + properties: + entities: + description: Entities associated with the rule, or null when metadata is not requested. + items: {} + nullable: true + type: array + sources: + description: Sources associated with the rule, or null when metadata is not requested. + items: + description: A source. + type: string + nullable: true + type: array + type: object SecurityMonitoringRuleNewValueOptions: description: Options on new value detection method. properties: @@ -101571,6 +101590,11 @@ components: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter' instantaneousBaseline: $ref: '#/components/schemas/SecurityMonitoringRuleInstantaneousBaseline' + instantaneousBaselineTimeoutMinutes: + description: Timeout in minutes for constructing the instantaneous baseline. + format: int32 + maximum: 2147483647 + type: integer learningDuration: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration' learningMethod: @@ -101635,8 +101659,17 @@ components: $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration' newValueOptions: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions' + relatedSignalsFields: + description: Fields used to identify related signals. + items: + description: A field name. + type: string + type: array sequenceDetectionOptions: $ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions' + signalTitleTemplate: + description: A template for the signal title. + type: string thirdPartyRuleOptions: $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions' type: object @@ -101708,7 +101741,7 @@ components: type: string type: object SecurityMonitoringRuleResponse: - description: Create a new rule. + description: A security monitoring rule. oneOf: - $ref: '#/components/schemas/SecurityMonitoringStandardRuleResponse' - $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponse' @@ -101965,6 +101998,16 @@ components: maximum: 2147483647 type: integer type: object + SecurityMonitoringRuleUser: + description: The user who created or last updated the rule. + properties: + handle: + description: The user handle. Empty for a default rule with no user. + type: string + name: + description: The user name. Empty for a default rule with no user. + type: string + type: object SecurityMonitoringRuleValidatePayload: description: Validate a rule. oneOf: @@ -102424,6 +102467,9 @@ components: SecurityMonitoringSignalRuleResponse: description: Rule. properties: + blocking: + description: Whether the rule blocks attackers. + type: boolean cases: description: Cases for generating signals. items: @@ -102437,12 +102483,23 @@ components: description: User ID of the user who created the rule. format: int64 type: integer + creator: + $ref: '#/components/schemas/SecurityMonitoringRuleUser' customMessage: description: Custom/Overridden message for generated signals (used in case of Default rule update). type: string customName: description: Custom/Overridden name of the rule (used in case of Default rule update). type: string + defaultRuleId: + description: The ID of the corresponding default rule. + type: string + defaultTags: + description: Default tags for default rules, included in tags. + items: + description: A default tag. + type: string + type: array deprecationDate: description: When the rule will be deprecated, timestamp in milliseconds. format: int64 @@ -102458,18 +102515,29 @@ components: id: description: The ID of the rule. type: string + isBeta: + description: Whether the rule is in beta. + type: boolean isDefault: description: Whether the rule is included by default. type: boolean isDeleted: description: Whether the rule has been deleted. type: boolean + isDeprecated: + description: Whether the rule is deprecated. + type: boolean isEnabled: description: Whether the rule is enabled. type: boolean + isPartner: + description: Whether the rule is provided by a partner. + type: boolean message: description: Message for generated signals. type: string + metadata: + $ref: '#/components/schemas/SecurityMonitoringRuleMetadata' name: description: The name of the rule. type: string @@ -102492,6 +102560,12 @@ components: description: User ID of the user who updated the rule. format: int64 type: integer + updatedAt: + description: The date the rule was last updated, in milliseconds. + format: int64 + type: integer + updater: + $ref: '#/components/schemas/SecurityMonitoringRuleUser' version: description: The version of the rule. format: int64 @@ -102529,6 +102603,10 @@ components: description: Field. type: string type: array + hasOptionalGroupByFields: + description: Whether events with missing group-by fields are processed with a replacement value. + example: false + type: boolean metrics: description: Group of target fields to aggregate over. items: @@ -103241,6 +103319,9 @@ components: SecurityMonitoringStandardRuleResponse: description: Rule. properties: + blocking: + description: Whether the rule blocks attackers. + type: boolean calculatedFields: description: Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined. items: @@ -103261,12 +103342,17 @@ components: description: User ID of the user who created the rule. format: int64 type: integer + creator: + $ref: '#/components/schemas/SecurityMonitoringRuleUser' customMessage: description: Custom/Overridden message for generated signals (used in case of Default rule update). type: string customName: description: Custom/Overridden name of the rule (used in case of Default rule update). type: string + defaultRuleId: + description: The ID of the corresponding default rule. + type: string defaultTags: description: Default Tags for default rules (included in tags) example: @@ -103275,6 +103361,12 @@ components: description: Default Tag. type: string type: array + dependencies: + description: IDs of rules that this rule depends on. + items: + description: A rule ID. + type: string + type: array deprecationDate: description: When the rule will be deprecated, timestamp in milliseconds. format: int64 @@ -103284,6 +103376,9 @@ components: items: $ref: '#/components/schemas/SecurityMonitoringFilter' type: array + findingType: + description: The type of findings generated by the rule. + type: string groupSignalsBy: description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. example: @@ -103298,18 +103393,29 @@ components: id: description: The ID of the rule. type: string + isBeta: + description: Whether the rule is in beta. + type: boolean isDefault: description: Whether the rule is included by default. type: boolean isDeleted: description: Whether the rule has been deleted. type: boolean + isDeprecated: + description: Whether the rule is deprecated. + type: boolean isEnabled: description: Whether the rule is enabled. type: boolean + isPartner: + description: Whether the rule is provided by a partner. + type: boolean message: description: Message for generated signals. type: string + metadata: + $ref: '#/components/schemas/SecurityMonitoringRuleMetadata' name: description: The name of the rule. type: string @@ -103349,6 +103455,8 @@ components: description: The date the rule was last updated, in milliseconds. format: int64 type: integer + updater: + $ref: '#/components/schemas/SecurityMonitoringRuleUser' version: description: The version of the rule. format: int64 @@ -203960,10 +204068,73 @@ paths: default: value: data: - - id: abc-123 + - blocking: false + creator: + handle: security@example.com + name: Security Team + id: abc-123 + isBeta: false + isDeprecated: false isEnabled: true + isPartner: false + metadata: + entities: + sources: name: My security monitoring rule. + options: + detectionMethod: threshold + relatedSignalsFields: ["service"] + signalTitleTemplate: Security signal type: log_detection + updater: + handle: security@example.com + name: Security Team + meta: {} + impossible_travel: + value: + data: + - id: jkl-012 + options: + detectionMethod: impossible_travel + impossibleTravelOptions: + detectIpTransition: true + type: log_detection + meta: {} + new_value: + value: + data: + - id: ghi-789 + options: + detectionMethod: new_value + newValueOptions: + instantaneousBaselineTimeoutMinutes: 0 + type: log_detection + meta: {} + signal_correlation: + value: + data: + - blocking: false + creator: + handle: "" + name: "" + defaultRuleId: def-000-abc + defaultTags: ["security:attack"] + id: def-456 + isBeta: false + isDeprecated: false + isPartner: false + metadata: + entities: + sources: + queries: + - aggregation: event_count + defaultRuleId: def-000-123 + hasOptionalGroupByFields: false + type: signal_correlation + updatedAt: 1750000000000 + updater: + handle: "" + name: "" meta: {} schema: $ref: '#/components/schemas/SecurityMonitoringListRulesResponse' diff --git a/features/v2/security_monitoring.feature b/features/v2/security_monitoring.feature index 12b40ab104a6..0cd95c1b0e4d 100644 --- a/features/v2/security_monitoring.feature +++ b/features/v2/security_monitoring.feature @@ -2669,11 +2669,14 @@ Feature: Security Monitoring When the request is sent Then the response status is 400 Bad Request - @skip-validation @team:DataDog/cloud-siem + @team:DataDog/cloud-siem Scenario: List rules returns "OK" response Given new "ListSecurityMonitoringRules" request When the request is sent Then the response status is 200 OK + And the response "data[0]" has field "isPartner" + And the response "data[0]" has field "isBeta" + And the response "data[0]" has field "isDeprecated" @team:DataDog/k9-cloud-vm Scenario: List scanned assets metadata returns "Bad request: Invalid Pagination Token" response diff --git a/packages/datadog-api-client-v2/index.ts b/packages/datadog-api-client-v2/index.ts index aca6c481e686..01f330a720f5 100644 --- a/packages/datadog-api-client-v2/index.ts +++ b/packages/datadog-api-client-v2/index.ts @@ -8193,6 +8193,7 @@ export { SecurityMonitoringRuleHardcodedEvaluatorType } from "./models/SecurityM export { SecurityMonitoringRuleImpossibleTravelOptions } from "./models/SecurityMonitoringRuleImpossibleTravelOptions"; export { SecurityMonitoringRuleKeepAlive } from "./models/SecurityMonitoringRuleKeepAlive"; export { SecurityMonitoringRuleMaxSignalDuration } from "./models/SecurityMonitoringRuleMaxSignalDuration"; +export { SecurityMonitoringRuleMetadata } from "./models/SecurityMonitoringRuleMetadata"; export { SecurityMonitoringRuleNewValueOptions } from "./models/SecurityMonitoringRuleNewValueOptions"; export { SecurityMonitoringRuleNewValueOptionsLearningMethod } from "./models/SecurityMonitoringRuleNewValueOptionsLearningMethod"; export { SecurityMonitoringRuleNewValueOptionsLearningThreshold } from "./models/SecurityMonitoringRuleNewValueOptionsLearningThreshold"; @@ -8215,6 +8216,7 @@ export { SecurityMonitoringRuleTypeCreate } from "./models/SecurityMonitoringRul export { SecurityMonitoringRuleTypeRead } from "./models/SecurityMonitoringRuleTypeRead"; export { SecurityMonitoringRuleTypeTest } from "./models/SecurityMonitoringRuleTypeTest"; export { SecurityMonitoringRuleUpdatePayload } from "./models/SecurityMonitoringRuleUpdatePayload"; +export { SecurityMonitoringRuleUser } from "./models/SecurityMonitoringRuleUser"; export { SecurityMonitoringRuleValidatePayload } from "./models/SecurityMonitoringRuleValidatePayload"; export { SecurityMonitoringSchedulingOptions } from "./models/SecurityMonitoringSchedulingOptions"; export { SecurityMonitoringSentinelOneIntegrationConfigCreateAttributes } from "./models/SecurityMonitoringSentinelOneIntegrationConfigCreateAttributes"; diff --git a/packages/datadog-api-client-v2/models/ObjectSerializer.ts b/packages/datadog-api-client-v2/models/ObjectSerializer.ts index ec5d9bf426db..4e9014de08bc 100644 --- a/packages/datadog-api-client-v2/models/ObjectSerializer.ts +++ b/packages/datadog-api-client-v2/models/ObjectSerializer.ts @@ -4782,6 +4782,7 @@ import { SecurityMonitoringRuleConvertBulkData } from "./SecurityMonitoringRuleC import { SecurityMonitoringRuleConvertBulkPayload } from "./SecurityMonitoringRuleConvertBulkPayload"; import { SecurityMonitoringRuleConvertResponse } from "./SecurityMonitoringRuleConvertResponse"; import { SecurityMonitoringRuleImpossibleTravelOptions } from "./SecurityMonitoringRuleImpossibleTravelOptions"; +import { SecurityMonitoringRuleMetadata } from "./SecurityMonitoringRuleMetadata"; import { SecurityMonitoringRuleNewValueOptions } from "./SecurityMonitoringRuleNewValueOptions"; import { SecurityMonitoringRuleOptions } from "./SecurityMonitoringRuleOptions"; import { SecurityMonitoringRuleQueryPayload } from "./SecurityMonitoringRuleQueryPayload"; @@ -4793,6 +4794,7 @@ import { SecurityMonitoringRuleTestRequest } from "./SecurityMonitoringRuleTestR import { SecurityMonitoringRuleTestResponse } from "./SecurityMonitoringRuleTestResponse"; import { SecurityMonitoringRuleThirdPartyOptions } from "./SecurityMonitoringRuleThirdPartyOptions"; import { SecurityMonitoringRuleUpdatePayload } from "./SecurityMonitoringRuleUpdatePayload"; +import { SecurityMonitoringRuleUser } from "./SecurityMonitoringRuleUser"; import { SecurityMonitoringSchedulingOptions } from "./SecurityMonitoringSchedulingOptions"; import { SecurityMonitoringSentinelOneIntegrationConfigCreateAttributes } from "./SecurityMonitoringSentinelOneIntegrationConfigCreateAttributes"; import { SecurityMonitoringSentinelOneIntegrationConfigUpdateAttributes } from "./SecurityMonitoringSentinelOneIntegrationConfigUpdateAttributes"; @@ -15089,6 +15091,7 @@ const typeMap: { [index: string]: any } = { SecurityMonitoringRuleConvertResponse: SecurityMonitoringRuleConvertResponse, SecurityMonitoringRuleImpossibleTravelOptions: SecurityMonitoringRuleImpossibleTravelOptions, + SecurityMonitoringRuleMetadata: SecurityMonitoringRuleMetadata, SecurityMonitoringRuleNewValueOptions: SecurityMonitoringRuleNewValueOptions, SecurityMonitoringRuleOptions: SecurityMonitoringRuleOptions, SecurityMonitoringRuleQueryPayload: SecurityMonitoringRuleQueryPayload, @@ -15105,6 +15108,7 @@ const typeMap: { [index: string]: any } = { SecurityMonitoringRuleThirdPartyOptions: SecurityMonitoringRuleThirdPartyOptions, SecurityMonitoringRuleUpdatePayload: SecurityMonitoringRuleUpdatePayload, + SecurityMonitoringRuleUser: SecurityMonitoringRuleUser, SecurityMonitoringSchedulingOptions: SecurityMonitoringSchedulingOptions, SecurityMonitoringSentinelOneIntegrationConfigCreateAttributes: SecurityMonitoringSentinelOneIntegrationConfigCreateAttributes, diff --git a/packages/datadog-api-client-v2/models/RuleVersions.ts b/packages/datadog-api-client-v2/models/RuleVersions.ts index 6b6ead39db8a..43fb28bbb79a 100644 --- a/packages/datadog-api-client-v2/models/RuleVersions.ts +++ b/packages/datadog-api-client-v2/models/RuleVersions.ts @@ -17,7 +17,7 @@ export class RuleVersions { */ "changes"?: Array; /** - * Create a new rule. + * A security monitoring rule. */ "rule"?: SecurityMonitoringRuleResponse; diff --git a/packages/datadog-api-client-v2/models/SecurityMonitoringRuleImpossibleTravelOptions.ts b/packages/datadog-api-client-v2/models/SecurityMonitoringRuleImpossibleTravelOptions.ts index e4e175174c59..f88e3136b4a2 100644 --- a/packages/datadog-api-client-v2/models/SecurityMonitoringRuleImpossibleTravelOptions.ts +++ b/packages/datadog-api-client-v2/models/SecurityMonitoringRuleImpossibleTravelOptions.ts @@ -19,6 +19,10 @@ export class SecurityMonitoringRuleImpossibleTravelOptions { * The duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations. */ "baselineUserLocationsDuration"?: number; + /** + * Whether to detect transitions between IP addresses. + */ + "detectIpTransition"?: boolean; /** * A container for additional, undeclared properties. @@ -44,6 +48,10 @@ export class SecurityMonitoringRuleImpossibleTravelOptions { baseName: "baselineUserLocationsDuration", type: "number", }, + detectIpTransition: { + baseName: "detectIpTransition", + type: "boolean", + }, additionalProperties: { baseName: "additionalProperties", type: "{ [key: string]: any; }", diff --git a/packages/datadog-api-client-v2/models/SecurityMonitoringRuleMetadata.ts b/packages/datadog-api-client-v2/models/SecurityMonitoringRuleMetadata.ts new file mode 100644 index 000000000000..d57f90d6623f --- /dev/null +++ b/packages/datadog-api-client-v2/models/SecurityMonitoringRuleMetadata.ts @@ -0,0 +1,60 @@ +/** + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2020-Present Datadog, Inc. + */ + +import { AttributeTypeMap } from "../../datadog-api-client-common/util"; + +/** + * Metadata associated with the rule. + */ +export class SecurityMonitoringRuleMetadata { + /** + * Entities associated with the rule, or null when metadata is not requested. + */ + "entities"?: Array; + /** + * Sources associated with the rule, or null when metadata is not requested. + */ + "sources"?: Array; + + /** + * A container for additional, undeclared properties. + * This is a holder for any undeclared properties as specified with + * the 'additionalProperties' keyword in the OAS document. + */ + "additionalProperties"?: { [key: string]: any }; + + /** + * @ignore + */ + "_unparsed"?: boolean; + + /** + * @ignore + */ + static readonly attributeTypeMap: AttributeTypeMap = { + entities: { + baseName: "entities", + type: "Array", + }, + sources: { + baseName: "sources", + type: "Array", + }, + additionalProperties: { + baseName: "additionalProperties", + type: "{ [key: string]: any; }", + }, + }; + + /** + * @ignore + */ + static getAttributeTypeMap(): AttributeTypeMap { + return SecurityMonitoringRuleMetadata.attributeTypeMap; + } + + public constructor() {} +} diff --git a/packages/datadog-api-client-v2/models/SecurityMonitoringRuleNewValueOptions.ts b/packages/datadog-api-client-v2/models/SecurityMonitoringRuleNewValueOptions.ts index f241a9ec85ec..d723099b406d 100644 --- a/packages/datadog-api-client-v2/models/SecurityMonitoringRuleNewValueOptions.ts +++ b/packages/datadog-api-client-v2/models/SecurityMonitoringRuleNewValueOptions.ts @@ -20,6 +20,10 @@ export class SecurityMonitoringRuleNewValueOptions { * When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time. */ "instantaneousBaseline"?: boolean; + /** + * Timeout in minutes for constructing the instantaneous baseline. + */ + "instantaneousBaselineTimeoutMinutes"?: number; /** * The duration in days during which values are learned, and after which signals will be generated for values that * weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. @@ -58,6 +62,11 @@ export class SecurityMonitoringRuleNewValueOptions { baseName: "instantaneousBaseline", type: "boolean", }, + instantaneousBaselineTimeoutMinutes: { + baseName: "instantaneousBaselineTimeoutMinutes", + type: "number", + format: "int32", + }, learningDuration: { baseName: "learningDuration", type: "number", diff --git a/packages/datadog-api-client-v2/models/SecurityMonitoringRuleOptions.ts b/packages/datadog-api-client-v2/models/SecurityMonitoringRuleOptions.ts index b9edd38cb6e7..4d36a885e33a 100644 --- a/packages/datadog-api-client-v2/models/SecurityMonitoringRuleOptions.ts +++ b/packages/datadog-api-client-v2/models/SecurityMonitoringRuleOptions.ts @@ -67,10 +67,18 @@ export class SecurityMonitoringRuleOptions { * Options on new value detection method. */ "newValueOptions"?: SecurityMonitoringRuleNewValueOptions; + /** + * Fields used to identify related signals. + */ + "relatedSignalsFields"?: Array; /** * Options on sequence detection method. */ "sequenceDetectionOptions"?: SecurityMonitoringRuleSequenceDetectionOptions; + /** + * A template for the signal title. + */ + "signalTitleTemplate"?: string; /** * Options on third party detection method. */ @@ -132,10 +140,18 @@ export class SecurityMonitoringRuleOptions { baseName: "newValueOptions", type: "SecurityMonitoringRuleNewValueOptions", }, + relatedSignalsFields: { + baseName: "relatedSignalsFields", + type: "Array", + }, sequenceDetectionOptions: { baseName: "sequenceDetectionOptions", type: "SecurityMonitoringRuleSequenceDetectionOptions", }, + signalTitleTemplate: { + baseName: "signalTitleTemplate", + type: "string", + }, thirdPartyRuleOptions: { baseName: "thirdPartyRuleOptions", type: "SecurityMonitoringRuleThirdPartyOptions", diff --git a/packages/datadog-api-client-v2/models/SecurityMonitoringRuleResponse.ts b/packages/datadog-api-client-v2/models/SecurityMonitoringRuleResponse.ts index 6350fa1e06b9..3b763576d74f 100644 --- a/packages/datadog-api-client-v2/models/SecurityMonitoringRuleResponse.ts +++ b/packages/datadog-api-client-v2/models/SecurityMonitoringRuleResponse.ts @@ -9,7 +9,7 @@ import { SecurityMonitoringStandardRuleResponse } from "./SecurityMonitoringStan import { UnparsedObject } from "../../datadog-api-client-common/util"; /** - * Create a new rule. + * A security monitoring rule. */ export type SecurityMonitoringRuleResponse = diff --git a/packages/datadog-api-client-v2/models/SecurityMonitoringRuleUser.ts b/packages/datadog-api-client-v2/models/SecurityMonitoringRuleUser.ts new file mode 100644 index 000000000000..dc6a5787501a --- /dev/null +++ b/packages/datadog-api-client-v2/models/SecurityMonitoringRuleUser.ts @@ -0,0 +1,60 @@ +/** + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2020-Present Datadog, Inc. + */ + +import { AttributeTypeMap } from "../../datadog-api-client-common/util"; + +/** + * The user who created or last updated the rule. + */ +export class SecurityMonitoringRuleUser { + /** + * The user handle. Empty for a default rule with no user. + */ + "handle"?: string; + /** + * The user name. Empty for a default rule with no user. + */ + "name"?: string; + + /** + * A container for additional, undeclared properties. + * This is a holder for any undeclared properties as specified with + * the 'additionalProperties' keyword in the OAS document. + */ + "additionalProperties"?: { [key: string]: any }; + + /** + * @ignore + */ + "_unparsed"?: boolean; + + /** + * @ignore + */ + static readonly attributeTypeMap: AttributeTypeMap = { + handle: { + baseName: "handle", + type: "string", + }, + name: { + baseName: "name", + type: "string", + }, + additionalProperties: { + baseName: "additionalProperties", + type: "{ [key: string]: any; }", + }, + }; + + /** + * @ignore + */ + static getAttributeTypeMap(): AttributeTypeMap { + return SecurityMonitoringRuleUser.attributeTypeMap; + } + + public constructor() {} +} diff --git a/packages/datadog-api-client-v2/models/SecurityMonitoringSignalRuleResponse.ts b/packages/datadog-api-client-v2/models/SecurityMonitoringSignalRuleResponse.ts index ea4940c184cc..a4183e2e5d12 100644 --- a/packages/datadog-api-client-v2/models/SecurityMonitoringSignalRuleResponse.ts +++ b/packages/datadog-api-client-v2/models/SecurityMonitoringSignalRuleResponse.ts @@ -5,7 +5,9 @@ */ import { SecurityMonitoringFilter } from "./SecurityMonitoringFilter"; import { SecurityMonitoringRuleCase } from "./SecurityMonitoringRuleCase"; +import { SecurityMonitoringRuleMetadata } from "./SecurityMonitoringRuleMetadata"; import { SecurityMonitoringRuleOptions } from "./SecurityMonitoringRuleOptions"; +import { SecurityMonitoringRuleUser } from "./SecurityMonitoringRuleUser"; import { SecurityMonitoringSignalRuleResponseQuery } from "./SecurityMonitoringSignalRuleResponseQuery"; import { SecurityMonitoringSignalRuleType } from "./SecurityMonitoringSignalRuleType"; @@ -15,6 +17,10 @@ import { AttributeTypeMap } from "../../datadog-api-client-common/util"; * Rule. */ export class SecurityMonitoringSignalRuleResponse { + /** + * Whether the rule blocks attackers. + */ + "blocking"?: boolean; /** * Cases for generating signals. */ @@ -27,6 +33,10 @@ export class SecurityMonitoringSignalRuleResponse { * User ID of the user who created the rule. */ "creationAuthorId"?: number; + /** + * The user who created or last updated the rule. + */ + "creator"?: SecurityMonitoringRuleUser; /** * Custom/Overridden message for generated signals (used in case of Default rule update). */ @@ -35,6 +45,14 @@ export class SecurityMonitoringSignalRuleResponse { * Custom/Overridden name of the rule (used in case of Default rule update). */ "customName"?: string; + /** + * The ID of the corresponding default rule. + */ + "defaultRuleId"?: string; + /** + * Default tags for default rules, included in tags. + */ + "defaultTags"?: Array; /** * When the rule will be deprecated, timestamp in milliseconds. */ @@ -51,6 +69,10 @@ export class SecurityMonitoringSignalRuleResponse { * The ID of the rule. */ "id"?: string; + /** + * Whether the rule is in beta. + */ + "isBeta"?: boolean; /** * Whether the rule is included by default. */ @@ -59,14 +81,26 @@ export class SecurityMonitoringSignalRuleResponse { * Whether the rule has been deleted. */ "isDeleted"?: boolean; + /** + * Whether the rule is deprecated. + */ + "isDeprecated"?: boolean; /** * Whether the rule is enabled. */ "isEnabled"?: boolean; + /** + * Whether the rule is provided by a partner. + */ + "isPartner"?: boolean; /** * Message for generated signals. */ "message"?: string; + /** + * Metadata associated with the rule. + */ + "metadata"?: SecurityMonitoringRuleMetadata; /** * The name of the rule. */ @@ -91,6 +125,14 @@ export class SecurityMonitoringSignalRuleResponse { * User ID of the user who updated the rule. */ "updateAuthorId"?: number; + /** + * The date the rule was last updated, in milliseconds. + */ + "updatedAt"?: number; + /** + * The user who created or last updated the rule. + */ + "updater"?: SecurityMonitoringRuleUser; /** * The version of the rule. */ @@ -112,6 +154,10 @@ export class SecurityMonitoringSignalRuleResponse { * @ignore */ static readonly attributeTypeMap: AttributeTypeMap = { + blocking: { + baseName: "blocking", + type: "boolean", + }, cases: { baseName: "cases", type: "Array", @@ -126,6 +172,10 @@ export class SecurityMonitoringSignalRuleResponse { type: "number", format: "int64", }, + creator: { + baseName: "creator", + type: "SecurityMonitoringRuleUser", + }, customMessage: { baseName: "customMessage", type: "string", @@ -134,6 +184,14 @@ export class SecurityMonitoringSignalRuleResponse { baseName: "customName", type: "string", }, + defaultRuleId: { + baseName: "defaultRuleId", + type: "string", + }, + defaultTags: { + baseName: "defaultTags", + type: "Array", + }, deprecationDate: { baseName: "deprecationDate", type: "number", @@ -151,6 +209,10 @@ export class SecurityMonitoringSignalRuleResponse { baseName: "id", type: "string", }, + isBeta: { + baseName: "isBeta", + type: "boolean", + }, isDefault: { baseName: "isDefault", type: "boolean", @@ -159,14 +221,26 @@ export class SecurityMonitoringSignalRuleResponse { baseName: "isDeleted", type: "boolean", }, + isDeprecated: { + baseName: "isDeprecated", + type: "boolean", + }, isEnabled: { baseName: "isEnabled", type: "boolean", }, + isPartner: { + baseName: "isPartner", + type: "boolean", + }, message: { baseName: "message", type: "string", }, + metadata: { + baseName: "metadata", + type: "SecurityMonitoringRuleMetadata", + }, name: { baseName: "name", type: "string", @@ -192,6 +266,15 @@ export class SecurityMonitoringSignalRuleResponse { type: "number", format: "int64", }, + updatedAt: { + baseName: "updatedAt", + type: "number", + format: "int64", + }, + updater: { + baseName: "updater", + type: "SecurityMonitoringRuleUser", + }, version: { baseName: "version", type: "number", diff --git a/packages/datadog-api-client-v2/models/SecurityMonitoringSignalRuleResponseQuery.ts b/packages/datadog-api-client-v2/models/SecurityMonitoringSignalRuleResponseQuery.ts index 4c20adadc2b9..81a59a23b485 100644 --- a/packages/datadog-api-client-v2/models/SecurityMonitoringSignalRuleResponseQuery.ts +++ b/packages/datadog-api-client-v2/models/SecurityMonitoringSignalRuleResponseQuery.ts @@ -35,6 +35,10 @@ export class SecurityMonitoringSignalRuleResponseQuery { * Fields to group by. */ "groupByFields"?: Array; + /** + * Whether events with missing group-by fields are processed with a replacement value. + */ + "hasOptionalGroupByFields"?: boolean; /** * Group of target fields to aggregate over. */ @@ -89,6 +93,10 @@ export class SecurityMonitoringSignalRuleResponseQuery { baseName: "groupByFields", type: "Array", }, + hasOptionalGroupByFields: { + baseName: "hasOptionalGroupByFields", + type: "boolean", + }, metrics: { baseName: "metrics", type: "Array", diff --git a/packages/datadog-api-client-v2/models/SecurityMonitoringStandardRuleResponse.ts b/packages/datadog-api-client-v2/models/SecurityMonitoringStandardRuleResponse.ts index 1bd244f052d3..489c45c92d80 100644 --- a/packages/datadog-api-client-v2/models/SecurityMonitoringStandardRuleResponse.ts +++ b/packages/datadog-api-client-v2/models/SecurityMonitoringStandardRuleResponse.ts @@ -8,8 +8,10 @@ import { CloudConfigurationRuleComplianceSignalOptions } from "./CloudConfigurat import { SecurityMonitoringFilter } from "./SecurityMonitoringFilter"; import { SecurityMonitoringReferenceTable } from "./SecurityMonitoringReferenceTable"; import { SecurityMonitoringRuleCase } from "./SecurityMonitoringRuleCase"; +import { SecurityMonitoringRuleMetadata } from "./SecurityMonitoringRuleMetadata"; import { SecurityMonitoringRuleOptions } from "./SecurityMonitoringRuleOptions"; import { SecurityMonitoringRuleTypeRead } from "./SecurityMonitoringRuleTypeRead"; +import { SecurityMonitoringRuleUser } from "./SecurityMonitoringRuleUser"; import { SecurityMonitoringSchedulingOptions } from "./SecurityMonitoringSchedulingOptions"; import { SecurityMonitoringStandardRuleQuery } from "./SecurityMonitoringStandardRuleQuery"; import { SecurityMonitoringThirdPartyRuleCase } from "./SecurityMonitoringThirdPartyRuleCase"; @@ -20,6 +22,10 @@ import { AttributeTypeMap } from "../../datadog-api-client-common/util"; * Rule. */ export class SecurityMonitoringStandardRuleResponse { + /** + * Whether the rule blocks attackers. + */ + "blocking"?: boolean; /** * Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined. */ @@ -40,6 +46,10 @@ export class SecurityMonitoringStandardRuleResponse { * User ID of the user who created the rule. */ "creationAuthorId"?: number; + /** + * The user who created or last updated the rule. + */ + "creator"?: SecurityMonitoringRuleUser; /** * Custom/Overridden message for generated signals (used in case of Default rule update). */ @@ -48,10 +58,18 @@ export class SecurityMonitoringStandardRuleResponse { * Custom/Overridden name of the rule (used in case of Default rule update). */ "customName"?: string; + /** + * The ID of the corresponding default rule. + */ + "defaultRuleId"?: string; /** * Default Tags for default rules (included in tags) */ "defaultTags"?: Array; + /** + * IDs of rules that this rule depends on. + */ + "dependencies"?: Array; /** * When the rule will be deprecated, timestamp in milliseconds. */ @@ -60,6 +78,10 @@ export class SecurityMonitoringStandardRuleResponse { * Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. */ "filters"?: Array; + /** + * The type of findings generated by the rule. + */ + "findingType"?: string; /** * Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. */ @@ -72,6 +94,10 @@ export class SecurityMonitoringStandardRuleResponse { * The ID of the rule. */ "id"?: string; + /** + * Whether the rule is in beta. + */ + "isBeta"?: boolean; /** * Whether the rule is included by default. */ @@ -80,14 +106,26 @@ export class SecurityMonitoringStandardRuleResponse { * Whether the rule has been deleted. */ "isDeleted"?: boolean; + /** + * Whether the rule is deprecated. + */ + "isDeprecated"?: boolean; /** * Whether the rule is enabled. */ "isEnabled"?: boolean; + /** + * Whether the rule is provided by a partner. + */ + "isPartner"?: boolean; /** * Message for generated signals. */ "message"?: string; + /** + * Metadata associated with the rule. + */ + "metadata"?: SecurityMonitoringRuleMetadata; /** * The name of the rule. */ @@ -128,6 +166,10 @@ export class SecurityMonitoringStandardRuleResponse { * The date the rule was last updated, in milliseconds. */ "updatedAt"?: number; + /** + * The user who created or last updated the rule. + */ + "updater"?: SecurityMonitoringRuleUser; /** * The version of the rule. */ @@ -149,6 +191,10 @@ export class SecurityMonitoringStandardRuleResponse { * @ignore */ static readonly attributeTypeMap: AttributeTypeMap = { + blocking: { + baseName: "blocking", + type: "boolean", + }, calculatedFields: { baseName: "calculatedFields", type: "Array", @@ -171,6 +217,10 @@ export class SecurityMonitoringStandardRuleResponse { type: "number", format: "int64", }, + creator: { + baseName: "creator", + type: "SecurityMonitoringRuleUser", + }, customMessage: { baseName: "customMessage", type: "string", @@ -179,10 +229,18 @@ export class SecurityMonitoringStandardRuleResponse { baseName: "customName", type: "string", }, + defaultRuleId: { + baseName: "defaultRuleId", + type: "string", + }, defaultTags: { baseName: "defaultTags", type: "Array", }, + dependencies: { + baseName: "dependencies", + type: "Array", + }, deprecationDate: { baseName: "deprecationDate", type: "number", @@ -192,6 +250,10 @@ export class SecurityMonitoringStandardRuleResponse { baseName: "filters", type: "Array", }, + findingType: { + baseName: "findingType", + type: "string", + }, groupSignalsBy: { baseName: "groupSignalsBy", type: "Array", @@ -204,6 +266,10 @@ export class SecurityMonitoringStandardRuleResponse { baseName: "id", type: "string", }, + isBeta: { + baseName: "isBeta", + type: "boolean", + }, isDefault: { baseName: "isDefault", type: "boolean", @@ -212,14 +278,26 @@ export class SecurityMonitoringStandardRuleResponse { baseName: "isDeleted", type: "boolean", }, + isDeprecated: { + baseName: "isDeprecated", + type: "boolean", + }, isEnabled: { baseName: "isEnabled", type: "boolean", }, + isPartner: { + baseName: "isPartner", + type: "boolean", + }, message: { baseName: "message", type: "string", }, + metadata: { + baseName: "metadata", + type: "SecurityMonitoringRuleMetadata", + }, name: { baseName: "name", type: "string", @@ -262,6 +340,10 @@ export class SecurityMonitoringStandardRuleResponse { type: "number", format: "int64", }, + updater: { + baseName: "updater", + type: "SecurityMonitoringRuleUser", + }, version: { baseName: "version", type: "number",