From 05311f31403597de6673e6435e19604e8b5814ac Mon Sep 17 00:00:00 2001 From: "ci.datadog-api-spec" Date: Mon, 7 Sep 2026 11:54:53 +0000 Subject: [PATCH] Regenerate client from commit 7ef5189 of spec repo --- .generator/schemas/v2/openapi.yaml | 175 +++++++++++++++++- .../v2/model/rule_versions.py | 2 +- ...nitoring_rule_impossible_travel_options.py | 8 + .../security_monitoring_rule_metadata.py | 52 ++++++ ...urity_monitoring_rule_new_value_options.py | 11 ++ .../model/security_monitoring_rule_options.py | 18 +- .../security_monitoring_rule_response.py | 32 +++- .../v2/model/security_monitoring_rule_user.py | 43 +++++ ...ecurity_monitoring_signal_rule_response.py | 84 +++++++++ ...y_monitoring_signal_rule_response_query.py | 8 + ...urity_monitoring_standard_rule_response.py | 84 +++++++++ src/datadog_api_client/v2/models/__init__.py | 4 + tests/v2/features/security_monitoring.feature | 5 +- 13 files changed, 520 insertions(+), 6 deletions(-) create mode 100644 src/datadog_api_client/v2/model/security_monitoring_rule_metadata.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_rule_user.py diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml index 682c9d1e9b..0cff0ec9bd 100644 --- a/.generator/schemas/v2/openapi.yaml +++ b/.generator/schemas/v2/openapi.yaml @@ -101484,6 +101484,9 @@ components: $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations' baselineUserLocationsDuration: $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocationsDuration' + detectIpTransition: + description: Whether to detect transitions between IP addresses. + type: boolean type: object SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations: description: "If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access." @@ -101564,6 +101567,22 @@ components: - SIX_HOURS - TWELVE_HOURS - ONE_DAY + SecurityMonitoringRuleMetadata: + description: Metadata associated with the rule. + properties: + entities: + description: Entities associated with the rule, or null when metadata is not requested. + items: {} + nullable: true + type: array + sources: + description: Sources associated with the rule, or null when metadata is not requested. + items: + description: A source. + type: string + nullable: true + type: array + type: object SecurityMonitoringRuleNewValueOptions: description: Options on new value detection method. properties: @@ -101571,6 +101590,11 @@ components: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter' instantaneousBaseline: $ref: '#/components/schemas/SecurityMonitoringRuleInstantaneousBaseline' + instantaneousBaselineTimeoutMinutes: + description: Timeout in minutes for constructing the instantaneous baseline. + format: int32 + maximum: 2147483647 + type: integer learningDuration: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration' learningMethod: @@ -101635,8 +101659,17 @@ components: $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration' newValueOptions: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions' + relatedSignalsFields: + description: Fields used to identify related signals. + items: + description: A field name. + type: string + type: array sequenceDetectionOptions: $ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions' + signalTitleTemplate: + description: A template for the signal title. + type: string thirdPartyRuleOptions: $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions' type: object @@ -101708,7 +101741,7 @@ components: type: string type: object SecurityMonitoringRuleResponse: - description: Create a new rule. + description: A security monitoring rule. oneOf: - $ref: '#/components/schemas/SecurityMonitoringStandardRuleResponse' - $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponse' @@ -101965,6 +101998,16 @@ components: maximum: 2147483647 type: integer type: object + SecurityMonitoringRuleUser: + description: The user who created or last updated the rule. + properties: + handle: + description: The user handle. Empty for a default rule with no user. + type: string + name: + description: The user name. Empty for a default rule with no user. + type: string + type: object SecurityMonitoringRuleValidatePayload: description: Validate a rule. oneOf: @@ -102424,6 +102467,9 @@ components: SecurityMonitoringSignalRuleResponse: description: Rule. properties: + blocking: + description: Whether the rule blocks attackers. + type: boolean cases: description: Cases for generating signals. items: @@ -102437,12 +102483,23 @@ components: description: User ID of the user who created the rule. format: int64 type: integer + creator: + $ref: '#/components/schemas/SecurityMonitoringRuleUser' customMessage: description: Custom/Overridden message for generated signals (used in case of Default rule update). type: string customName: description: Custom/Overridden name of the rule (used in case of Default rule update). type: string + defaultRuleId: + description: The ID of the corresponding default rule. + type: string + defaultTags: + description: Default tags for default rules, included in tags. + items: + description: A default tag. + type: string + type: array deprecationDate: description: When the rule will be deprecated, timestamp in milliseconds. format: int64 @@ -102458,18 +102515,29 @@ components: id: description: The ID of the rule. type: string + isBeta: + description: Whether the rule is in beta. + type: boolean isDefault: description: Whether the rule is included by default. type: boolean isDeleted: description: Whether the rule has been deleted. type: boolean + isDeprecated: + description: Whether the rule is deprecated. + type: boolean isEnabled: description: Whether the rule is enabled. type: boolean + isPartner: + description: Whether the rule is provided by a partner. + type: boolean message: description: Message for generated signals. type: string + metadata: + $ref: '#/components/schemas/SecurityMonitoringRuleMetadata' name: description: The name of the rule. type: string @@ -102492,6 +102560,12 @@ components: description: User ID of the user who updated the rule. format: int64 type: integer + updatedAt: + description: The date the rule was last updated, in milliseconds. + format: int64 + type: integer + updater: + $ref: '#/components/schemas/SecurityMonitoringRuleUser' version: description: The version of the rule. format: int64 @@ -102529,6 +102603,10 @@ components: description: Field. type: string type: array + hasOptionalGroupByFields: + description: Whether events with missing group-by fields are processed with a replacement value. + example: false + type: boolean metrics: description: Group of target fields to aggregate over. items: @@ -103241,6 +103319,9 @@ components: SecurityMonitoringStandardRuleResponse: description: Rule. properties: + blocking: + description: Whether the rule blocks attackers. + type: boolean calculatedFields: description: Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined. items: @@ -103261,12 +103342,17 @@ components: description: User ID of the user who created the rule. format: int64 type: integer + creator: + $ref: '#/components/schemas/SecurityMonitoringRuleUser' customMessage: description: Custom/Overridden message for generated signals (used in case of Default rule update). type: string customName: description: Custom/Overridden name of the rule (used in case of Default rule update). type: string + defaultRuleId: + description: The ID of the corresponding default rule. + type: string defaultTags: description: Default Tags for default rules (included in tags) example: @@ -103275,6 +103361,12 @@ components: description: Default Tag. type: string type: array + dependencies: + description: IDs of rules that this rule depends on. + items: + description: A rule ID. + type: string + type: array deprecationDate: description: When the rule will be deprecated, timestamp in milliseconds. format: int64 @@ -103284,6 +103376,9 @@ components: items: $ref: '#/components/schemas/SecurityMonitoringFilter' type: array + findingType: + description: The type of findings generated by the rule. + type: string groupSignalsBy: description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. example: @@ -103298,18 +103393,29 @@ components: id: description: The ID of the rule. type: string + isBeta: + description: Whether the rule is in beta. + type: boolean isDefault: description: Whether the rule is included by default. type: boolean isDeleted: description: Whether the rule has been deleted. type: boolean + isDeprecated: + description: Whether the rule is deprecated. + type: boolean isEnabled: description: Whether the rule is enabled. type: boolean + isPartner: + description: Whether the rule is provided by a partner. + type: boolean message: description: Message for generated signals. type: string + metadata: + $ref: '#/components/schemas/SecurityMonitoringRuleMetadata' name: description: The name of the rule. type: string @@ -103349,6 +103455,8 @@ components: description: The date the rule was last updated, in milliseconds. format: int64 type: integer + updater: + $ref: '#/components/schemas/SecurityMonitoringRuleUser' version: description: The version of the rule. format: int64 @@ -203960,10 +204068,73 @@ paths: default: value: data: - - id: abc-123 + - blocking: false + creator: + handle: security@example.com + name: Security Team + id: abc-123 + isBeta: false + isDeprecated: false isEnabled: true + isPartner: false + metadata: + entities: + sources: name: My security monitoring rule. + options: + detectionMethod: threshold + relatedSignalsFields: ["service"] + signalTitleTemplate: Security signal type: log_detection + updater: + handle: security@example.com + name: Security Team + meta: {} + impossible_travel: + value: + data: + - id: jkl-012 + options: + detectionMethod: impossible_travel + impossibleTravelOptions: + detectIpTransition: true + type: log_detection + meta: {} + new_value: + value: + data: + - id: ghi-789 + options: + detectionMethod: new_value + newValueOptions: + instantaneousBaselineTimeoutMinutes: 0 + type: log_detection + meta: {} + signal_correlation: + value: + data: + - blocking: false + creator: + handle: "" + name: "" + defaultRuleId: def-000-abc + defaultTags: ["security:attack"] + id: def-456 + isBeta: false + isDeprecated: false + isPartner: false + metadata: + entities: + sources: + queries: + - aggregation: event_count + defaultRuleId: def-000-123 + hasOptionalGroupByFields: false + type: signal_correlation + updatedAt: 1750000000000 + updater: + handle: "" + name: "" meta: {} schema: $ref: '#/components/schemas/SecurityMonitoringListRulesResponse' diff --git a/src/datadog_api_client/v2/model/rule_versions.py b/src/datadog_api_client/v2/model/rule_versions.py index 30b0839ba9..64ec106490 100644 --- a/src/datadog_api_client/v2/model/rule_versions.py +++ b/src/datadog_api_client/v2/model/rule_versions.py @@ -57,7 +57,7 @@ def __init__( :param changes: A list of changes. :type changes: [VersionHistoryUpdate], optional - :param rule: Create a new rule. + :param rule: A security monitoring rule. :type rule: SecurityMonitoringRuleResponse, optional """ if changes is not unset: diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_impossible_travel_options.py b/src/datadog_api_client/v2/model/security_monitoring_rule_impossible_travel_options.py index c0bb6b6e73..2cdd5b7cfb 100644 --- a/src/datadog_api_client/v2/model/security_monitoring_rule_impossible_travel_options.py +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_impossible_travel_options.py @@ -27,17 +27,20 @@ def openapi_types(_): return { "baseline_user_locations": (bool,), "baseline_user_locations_duration": (int,), + "detect_ip_transition": (bool,), } attribute_map = { "baseline_user_locations": "baselineUserLocations", "baseline_user_locations_duration": "baselineUserLocationsDuration", + "detect_ip_transition": "detectIpTransition", } def __init__( self_, baseline_user_locations: Union[bool, UnsetType] = unset, baseline_user_locations_duration: Union[int, none_type, UnsetType] = unset, + detect_ip_transition: Union[bool, UnsetType] = unset, **kwargs, ): """ @@ -49,9 +52,14 @@ def __init__( :param baseline_user_locations_duration: The duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations. :type baseline_user_locations_duration: int, none_type, optional + + :param detect_ip_transition: Whether to detect transitions between IP addresses. + :type detect_ip_transition: bool, optional """ if baseline_user_locations is not unset: kwargs["baseline_user_locations"] = baseline_user_locations if baseline_user_locations_duration is not unset: kwargs["baseline_user_locations_duration"] = baseline_user_locations_duration + if detect_ip_transition is not unset: + kwargs["detect_ip_transition"] = detect_ip_transition super().__init__(kwargs) diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_metadata.py b/src/datadog_api_client/v2/model/security_monitoring_rule_metadata.py new file mode 100644 index 0000000000..d5ffc1dbdd --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_metadata.py @@ -0,0 +1,52 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Any, List, Union + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + date, + datetime, + none_type, + unset, + UnsetType, + UUID, +) + + +class SecurityMonitoringRuleMetadata(ModelNormal): + @cached_property + def openapi_types(_): + return { + "entities": ([bool, date, datetime, dict, float, int, list, str, UUID, none_type], none_type), + "sources": ([str], none_type), + } + + attribute_map = { + "entities": "entities", + "sources": "sources", + } + + def __init__( + self_, + entities: Union[List[Any], none_type, UnsetType] = unset, + sources: Union[List[str], none_type, UnsetType] = unset, + **kwargs, + ): + """ + Metadata associated with the rule. + + :param entities: Entities associated with the rule, or null when metadata is not requested. + :type entities: [bool, date, datetime, dict, float, int, list, str, UUID, none_type], none_type, optional + + :param sources: Sources associated with the rule, or null when metadata is not requested. + :type sources: [str], none_type, optional + """ + if entities is not unset: + kwargs["entities"] = entities + if sources is not unset: + kwargs["sources"] = sources + super().__init__(kwargs) diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_new_value_options.py b/src/datadog_api_client/v2/model/security_monitoring_rule_new_value_options.py index 7abd129152..e92a04b5f4 100644 --- a/src/datadog_api_client/v2/model/security_monitoring_rule_new_value_options.py +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_new_value_options.py @@ -28,6 +28,9 @@ class SecurityMonitoringRuleNewValueOptions(ModelNormal): "inclusive_maximum": 30, "inclusive_minimum": 1, }, + "instantaneous_baseline_timeout_minutes": { + "inclusive_maximum": 2147483647, + }, "learning_duration": { "inclusive_maximum": 30, "inclusive_minimum": 0, @@ -46,6 +49,7 @@ def openapi_types(_): return { "forget_after": (int,), "instantaneous_baseline": (bool,), + "instantaneous_baseline_timeout_minutes": (int,), "learning_duration": (int,), "learning_method": (SecurityMonitoringRuleNewValueOptionsLearningMethod,), "learning_threshold": (SecurityMonitoringRuleNewValueOptionsLearningThreshold,), @@ -54,6 +58,7 @@ def openapi_types(_): attribute_map = { "forget_after": "forgetAfter", "instantaneous_baseline": "instantaneousBaseline", + "instantaneous_baseline_timeout_minutes": "instantaneousBaselineTimeoutMinutes", "learning_duration": "learningDuration", "learning_method": "learningMethod", "learning_threshold": "learningThreshold", @@ -63,6 +68,7 @@ def __init__( self_, forget_after: Union[int, UnsetType] = unset, instantaneous_baseline: Union[bool, UnsetType] = unset, + instantaneous_baseline_timeout_minutes: Union[int, UnsetType] = unset, learning_duration: Union[int, UnsetType] = unset, learning_method: Union[SecurityMonitoringRuleNewValueOptionsLearningMethod, UnsetType] = unset, learning_threshold: Union[SecurityMonitoringRuleNewValueOptionsLearningThreshold, UnsetType] = unset, @@ -77,6 +83,9 @@ def __init__( :param instantaneous_baseline: When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time. :type instantaneous_baseline: bool, optional + :param instantaneous_baseline_timeout_minutes: Timeout in minutes for constructing the instantaneous baseline. + :type instantaneous_baseline_timeout_minutes: int, optional + :param learning_duration: The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. :type learning_duration: int, optional @@ -91,6 +100,8 @@ def __init__( kwargs["forget_after"] = forget_after if instantaneous_baseline is not unset: kwargs["instantaneous_baseline"] = instantaneous_baseline + if instantaneous_baseline_timeout_minutes is not unset: + kwargs["instantaneous_baseline_timeout_minutes"] = instantaneous_baseline_timeout_minutes if learning_duration is not unset: kwargs["learning_duration"] = learning_duration if learning_method is not unset: diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_options.py b/src/datadog_api_client/v2/model/security_monitoring_rule_options.py index 2154617b33..af07fd47f0 100644 --- a/src/datadog_api_client/v2/model/security_monitoring_rule_options.py +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_options.py @@ -3,7 +3,7 @@ # Copyright 2019-Present Datadog, Inc. from __future__ import annotations -from typing import Union, TYPE_CHECKING +from typing import List, Union, TYPE_CHECKING from datadog_api_client.model_utils import ( ModelNormal, @@ -93,7 +93,9 @@ def openapi_types(_): "keep_alive": (SecurityMonitoringRuleKeepAlive,), "max_signal_duration": (SecurityMonitoringRuleMaxSignalDuration,), "new_value_options": (SecurityMonitoringRuleNewValueOptions,), + "related_signals_fields": ([str],), "sequence_detection_options": (SecurityMonitoringRuleSequenceDetectionOptions,), + "signal_title_template": (str,), "third_party_rule_options": (SecurityMonitoringRuleThirdPartyOptions,), } @@ -108,7 +110,9 @@ def openapi_types(_): "keep_alive": "keepAlive", "max_signal_duration": "maxSignalDuration", "new_value_options": "newValueOptions", + "related_signals_fields": "relatedSignalsFields", "sequence_detection_options": "sequenceDetectionOptions", + "signal_title_template": "signalTitleTemplate", "third_party_rule_options": "thirdPartyRuleOptions", } @@ -124,7 +128,9 @@ def __init__( keep_alive: Union[SecurityMonitoringRuleKeepAlive, UnsetType] = unset, max_signal_duration: Union[SecurityMonitoringRuleMaxSignalDuration, UnsetType] = unset, new_value_options: Union[SecurityMonitoringRuleNewValueOptions, UnsetType] = unset, + related_signals_fields: Union[List[str], UnsetType] = unset, sequence_detection_options: Union[SecurityMonitoringRuleSequenceDetectionOptions, UnsetType] = unset, + signal_title_template: Union[str, UnsetType] = unset, third_party_rule_options: Union[SecurityMonitoringRuleThirdPartyOptions, UnsetType] = unset, **kwargs, ): @@ -167,9 +173,15 @@ def __init__( :param new_value_options: Options on new value detection method. :type new_value_options: SecurityMonitoringRuleNewValueOptions, optional + :param related_signals_fields: Fields used to identify related signals. + :type related_signals_fields: [str], optional + :param sequence_detection_options: Options on sequence detection method. :type sequence_detection_options: SecurityMonitoringRuleSequenceDetectionOptions, optional + :param signal_title_template: A template for the signal title. + :type signal_title_template: str, optional + :param third_party_rule_options: Options on third party detection method. :type third_party_rule_options: SecurityMonitoringRuleThirdPartyOptions, optional """ @@ -193,8 +205,12 @@ def __init__( kwargs["max_signal_duration"] = max_signal_duration if new_value_options is not unset: kwargs["new_value_options"] = new_value_options + if related_signals_fields is not unset: + kwargs["related_signals_fields"] = related_signals_fields if sequence_detection_options is not unset: kwargs["sequence_detection_options"] = sequence_detection_options + if signal_title_template is not unset: + kwargs["signal_title_template"] = signal_title_template if third_party_rule_options is not unset: kwargs["third_party_rule_options"] = third_party_rule_options super().__init__(kwargs) diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_response.py b/src/datadog_api_client/v2/model/security_monitoring_rule_response.py index 0d42a1a061..6df88c0431 100644 --- a/src/datadog_api_client/v2/model/security_monitoring_rule_response.py +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_response.py @@ -13,7 +13,10 @@ class SecurityMonitoringRuleResponse(ModelComposed): def __init__(self, **kwargs): """ - Create a new rule. + A security monitoring rule. + + :param blocking: Whether the rule blocks attackers. + :type blocking: bool, optional :param calculated_fields: Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined. :type calculated_fields: [CalculatedField], optional @@ -30,21 +33,33 @@ def __init__(self, **kwargs): :param creation_author_id: User ID of the user who created the rule. :type creation_author_id: int, optional + :param creator: The user who created or last updated the rule. + :type creator: SecurityMonitoringRuleUser, optional + :param custom_message: Custom/Overridden message for generated signals (used in case of Default rule update). :type custom_message: str, optional :param custom_name: Custom/Overridden name of the rule (used in case of Default rule update). :type custom_name: str, optional + :param default_rule_id: The ID of the corresponding default rule. + :type default_rule_id: str, optional + :param default_tags: Default Tags for default rules (included in tags) :type default_tags: [str], optional + :param dependencies: IDs of rules that this rule depends on. + :type dependencies: [str], optional + :param deprecation_date: When the rule will be deprecated, timestamp in milliseconds. :type deprecation_date: int, optional :param filters: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. :type filters: [SecurityMonitoringFilter], optional + :param finding_type: The type of findings generated by the rule. + :type finding_type: str, optional + :param group_signals_by: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. :type group_signals_by: [str], optional @@ -54,18 +69,30 @@ def __init__(self, **kwargs): :param id: The ID of the rule. :type id: str, optional + :param is_beta: Whether the rule is in beta. + :type is_beta: bool, optional + :param is_default: Whether the rule is included by default. :type is_default: bool, optional :param is_deleted: Whether the rule has been deleted. :type is_deleted: bool, optional + :param is_deprecated: Whether the rule is deprecated. + :type is_deprecated: bool, optional + :param is_enabled: Whether the rule is enabled. :type is_enabled: bool, optional + :param is_partner: Whether the rule is provided by a partner. + :type is_partner: bool, optional + :param message: Message for generated signals. :type message: str, optional + :param metadata: Metadata associated with the rule. + :type metadata: SecurityMonitoringRuleMetadata, optional + :param name: The name of the rule. :type name: str, optional @@ -96,6 +123,9 @@ def __init__(self, **kwargs): :param updated_at: The date the rule was last updated, in milliseconds. :type updated_at: int, optional + :param updater: The user who created or last updated the rule. + :type updater: SecurityMonitoringRuleUser, optional + :param version: The version of the rule. :type version: int, optional """ diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_user.py b/src/datadog_api_client/v2/model/security_monitoring_rule_user.py new file mode 100644 index 0000000000..9aeab2f1f7 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_user.py @@ -0,0 +1,43 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Union + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, +) + + +class SecurityMonitoringRuleUser(ModelNormal): + @cached_property + def openapi_types(_): + return { + "handle": (str,), + "name": (str,), + } + + attribute_map = { + "handle": "handle", + "name": "name", + } + + def __init__(self_, handle: Union[str, UnsetType] = unset, name: Union[str, UnsetType] = unset, **kwargs): + """ + The user who created or last updated the rule. + + :param handle: The user handle. Empty for a default rule with no user. + :type handle: str, optional + + :param name: The user name. Empty for a default rule with no user. + :type name: str, optional + """ + if handle is not unset: + kwargs["handle"] = handle + if name is not unset: + kwargs["name"] = name + super().__init__(kwargs) diff --git a/src/datadog_api_client/v2/model/security_monitoring_signal_rule_response.py b/src/datadog_api_client/v2/model/security_monitoring_signal_rule_response.py index 892c24f3ec..ee8a732306 100644 --- a/src/datadog_api_client/v2/model/security_monitoring_signal_rule_response.py +++ b/src/datadog_api_client/v2/model/security_monitoring_signal_rule_response.py @@ -15,7 +15,9 @@ if TYPE_CHECKING: from datadog_api_client.v2.model.security_monitoring_rule_case import SecurityMonitoringRuleCase + from datadog_api_client.v2.model.security_monitoring_rule_user import SecurityMonitoringRuleUser from datadog_api_client.v2.model.security_monitoring_filter import SecurityMonitoringFilter + from datadog_api_client.v2.model.security_monitoring_rule_metadata import SecurityMonitoringRuleMetadata from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions from datadog_api_client.v2.model.security_monitoring_signal_rule_response_query import ( SecurityMonitoringSignalRuleResponseQuery, @@ -27,7 +29,9 @@ class SecurityMonitoringSignalRuleResponse(ModelNormal): @cached_property def openapi_types(_): from datadog_api_client.v2.model.security_monitoring_rule_case import SecurityMonitoringRuleCase + from datadog_api_client.v2.model.security_monitoring_rule_user import SecurityMonitoringRuleUser from datadog_api_client.v2.model.security_monitoring_filter import SecurityMonitoringFilter + from datadog_api_client.v2.model.security_monitoring_rule_metadata import SecurityMonitoringRuleMetadata from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions from datadog_api_client.v2.model.security_monitoring_signal_rule_response_query import ( SecurityMonitoringSignalRuleResponseQuery, @@ -35,78 +39,111 @@ def openapi_types(_): from datadog_api_client.v2.model.security_monitoring_signal_rule_type import SecurityMonitoringSignalRuleType return { + "blocking": (bool,), "cases": ([SecurityMonitoringRuleCase],), "created_at": (int,), "creation_author_id": (int,), + "creator": (SecurityMonitoringRuleUser,), "custom_message": (str,), "custom_name": (str,), + "default_rule_id": (str,), + "default_tags": ([str],), "deprecation_date": (int,), "filters": ([SecurityMonitoringFilter],), "has_extended_title": (bool,), "id": (str,), + "is_beta": (bool,), "is_default": (bool,), "is_deleted": (bool,), + "is_deprecated": (bool,), "is_enabled": (bool,), + "is_partner": (bool,), "message": (str,), + "metadata": (SecurityMonitoringRuleMetadata,), "name": (str,), "options": (SecurityMonitoringRuleOptions,), "queries": ([SecurityMonitoringSignalRuleResponseQuery],), "tags": ([str],), "type": (SecurityMonitoringSignalRuleType,), "update_author_id": (int,), + "updated_at": (int,), + "updater": (SecurityMonitoringRuleUser,), "version": (int,), } attribute_map = { + "blocking": "blocking", "cases": "cases", "created_at": "createdAt", "creation_author_id": "creationAuthorId", + "creator": "creator", "custom_message": "customMessage", "custom_name": "customName", + "default_rule_id": "defaultRuleId", + "default_tags": "defaultTags", "deprecation_date": "deprecationDate", "filters": "filters", "has_extended_title": "hasExtendedTitle", "id": "id", + "is_beta": "isBeta", "is_default": "isDefault", "is_deleted": "isDeleted", + "is_deprecated": "isDeprecated", "is_enabled": "isEnabled", + "is_partner": "isPartner", "message": "message", + "metadata": "metadata", "name": "name", "options": "options", "queries": "queries", "tags": "tags", "type": "type", "update_author_id": "updateAuthorId", + "updated_at": "updatedAt", + "updater": "updater", "version": "version", } def __init__( self_, + blocking: Union[bool, UnsetType] = unset, cases: Union[List[SecurityMonitoringRuleCase], UnsetType] = unset, created_at: Union[int, UnsetType] = unset, creation_author_id: Union[int, UnsetType] = unset, + creator: Union[SecurityMonitoringRuleUser, UnsetType] = unset, custom_message: Union[str, UnsetType] = unset, custom_name: Union[str, UnsetType] = unset, + default_rule_id: Union[str, UnsetType] = unset, + default_tags: Union[List[str], UnsetType] = unset, deprecation_date: Union[int, UnsetType] = unset, filters: Union[List[SecurityMonitoringFilter], UnsetType] = unset, has_extended_title: Union[bool, UnsetType] = unset, id: Union[str, UnsetType] = unset, + is_beta: Union[bool, UnsetType] = unset, is_default: Union[bool, UnsetType] = unset, is_deleted: Union[bool, UnsetType] = unset, + is_deprecated: Union[bool, UnsetType] = unset, is_enabled: Union[bool, UnsetType] = unset, + is_partner: Union[bool, UnsetType] = unset, message: Union[str, UnsetType] = unset, + metadata: Union[SecurityMonitoringRuleMetadata, UnsetType] = unset, name: Union[str, UnsetType] = unset, options: Union[SecurityMonitoringRuleOptions, UnsetType] = unset, queries: Union[List[SecurityMonitoringSignalRuleResponseQuery], UnsetType] = unset, tags: Union[List[str], UnsetType] = unset, type: Union[SecurityMonitoringSignalRuleType, UnsetType] = unset, update_author_id: Union[int, UnsetType] = unset, + updated_at: Union[int, UnsetType] = unset, + updater: Union[SecurityMonitoringRuleUser, UnsetType] = unset, version: Union[int, UnsetType] = unset, **kwargs, ): """ Rule. + :param blocking: Whether the rule blocks attackers. + :type blocking: bool, optional + :param cases: Cases for generating signals. :type cases: [SecurityMonitoringRuleCase], optional @@ -116,12 +153,21 @@ def __init__( :param creation_author_id: User ID of the user who created the rule. :type creation_author_id: int, optional + :param creator: The user who created or last updated the rule. + :type creator: SecurityMonitoringRuleUser, optional + :param custom_message: Custom/Overridden message for generated signals (used in case of Default rule update). :type custom_message: str, optional :param custom_name: Custom/Overridden name of the rule (used in case of Default rule update). :type custom_name: str, optional + :param default_rule_id: The ID of the corresponding default rule. + :type default_rule_id: str, optional + + :param default_tags: Default tags for default rules, included in tags. + :type default_tags: [str], optional + :param deprecation_date: When the rule will be deprecated, timestamp in milliseconds. :type deprecation_date: int, optional @@ -134,18 +180,30 @@ def __init__( :param id: The ID of the rule. :type id: str, optional + :param is_beta: Whether the rule is in beta. + :type is_beta: bool, optional + :param is_default: Whether the rule is included by default. :type is_default: bool, optional :param is_deleted: Whether the rule has been deleted. :type is_deleted: bool, optional + :param is_deprecated: Whether the rule is deprecated. + :type is_deprecated: bool, optional + :param is_enabled: Whether the rule is enabled. :type is_enabled: bool, optional + :param is_partner: Whether the rule is provided by a partner. + :type is_partner: bool, optional + :param message: Message for generated signals. :type message: str, optional + :param metadata: Metadata associated with the rule. + :type metadata: SecurityMonitoringRuleMetadata, optional + :param name: The name of the rule. :type name: str, optional @@ -164,19 +222,33 @@ def __init__( :param update_author_id: User ID of the user who updated the rule. :type update_author_id: int, optional + :param updated_at: The date the rule was last updated, in milliseconds. + :type updated_at: int, optional + + :param updater: The user who created or last updated the rule. + :type updater: SecurityMonitoringRuleUser, optional + :param version: The version of the rule. :type version: int, optional """ + if blocking is not unset: + kwargs["blocking"] = blocking if cases is not unset: kwargs["cases"] = cases if created_at is not unset: kwargs["created_at"] = created_at if creation_author_id is not unset: kwargs["creation_author_id"] = creation_author_id + if creator is not unset: + kwargs["creator"] = creator if custom_message is not unset: kwargs["custom_message"] = custom_message if custom_name is not unset: kwargs["custom_name"] = custom_name + if default_rule_id is not unset: + kwargs["default_rule_id"] = default_rule_id + if default_tags is not unset: + kwargs["default_tags"] = default_tags if deprecation_date is not unset: kwargs["deprecation_date"] = deprecation_date if filters is not unset: @@ -185,14 +257,22 @@ def __init__( kwargs["has_extended_title"] = has_extended_title if id is not unset: kwargs["id"] = id + if is_beta is not unset: + kwargs["is_beta"] = is_beta if is_default is not unset: kwargs["is_default"] = is_default if is_deleted is not unset: kwargs["is_deleted"] = is_deleted + if is_deprecated is not unset: + kwargs["is_deprecated"] = is_deprecated if is_enabled is not unset: kwargs["is_enabled"] = is_enabled + if is_partner is not unset: + kwargs["is_partner"] = is_partner if message is not unset: kwargs["message"] = message + if metadata is not unset: + kwargs["metadata"] = metadata if name is not unset: kwargs["name"] = name if options is not unset: @@ -205,6 +285,10 @@ def __init__( kwargs["type"] = type if update_author_id is not unset: kwargs["update_author_id"] = update_author_id + if updated_at is not unset: + kwargs["updated_at"] = updated_at + if updater is not unset: + kwargs["updater"] = updater if version is not unset: kwargs["version"] = version super().__init__(kwargs) diff --git a/src/datadog_api_client/v2/model/security_monitoring_signal_rule_response_query.py b/src/datadog_api_client/v2/model/security_monitoring_signal_rule_response_query.py index 45fbfcce33..050f0ef98b 100644 --- a/src/datadog_api_client/v2/model/security_monitoring_signal_rule_response_query.py +++ b/src/datadog_api_client/v2/model/security_monitoring_signal_rule_response_query.py @@ -39,6 +39,7 @@ def openapi_types(_): "default_rule_id": (str,), "distinct_fields": ([str],), "group_by_fields": ([str],), + "has_optional_group_by_fields": (bool,), "metrics": ([str],), "name": (str,), "rule_id": (str,), @@ -51,6 +52,7 @@ def openapi_types(_): "default_rule_id": "defaultRuleId", "distinct_fields": "distinctFields", "group_by_fields": "groupByFields", + "has_optional_group_by_fields": "hasOptionalGroupByFields", "metrics": "metrics", "name": "name", "rule_id": "ruleId", @@ -64,6 +66,7 @@ def __init__( default_rule_id: Union[str, UnsetType] = unset, distinct_fields: Union[List[str], UnsetType] = unset, group_by_fields: Union[List[str], UnsetType] = unset, + has_optional_group_by_fields: Union[bool, UnsetType] = unset, metrics: Union[List[str], UnsetType] = unset, name: Union[str, UnsetType] = unset, rule_id: Union[str, UnsetType] = unset, @@ -90,6 +93,9 @@ def __init__( :param group_by_fields: Fields to group by. :type group_by_fields: [str], optional + :param has_optional_group_by_fields: Whether events with missing group-by fields are processed with a replacement value. + :type has_optional_group_by_fields: bool, optional + :param metrics: Group of target fields to aggregate over. :type metrics: [str], optional @@ -111,6 +117,8 @@ def __init__( kwargs["distinct_fields"] = distinct_fields if group_by_fields is not unset: kwargs["group_by_fields"] = group_by_fields + if has_optional_group_by_fields is not unset: + kwargs["has_optional_group_by_fields"] = has_optional_group_by_fields if metrics is not unset: kwargs["metrics"] = metrics if name is not unset: diff --git a/src/datadog_api_client/v2/model/security_monitoring_standard_rule_response.py b/src/datadog_api_client/v2/model/security_monitoring_standard_rule_response.py index 24d922bd95..b3f6cbd64a 100644 --- a/src/datadog_api_client/v2/model/security_monitoring_standard_rule_response.py +++ b/src/datadog_api_client/v2/model/security_monitoring_standard_rule_response.py @@ -20,7 +20,9 @@ from datadog_api_client.v2.model.cloud_configuration_rule_compliance_signal_options import ( CloudConfigurationRuleComplianceSignalOptions, ) + from datadog_api_client.v2.model.security_monitoring_rule_user import SecurityMonitoringRuleUser from datadog_api_client.v2.model.security_monitoring_filter import SecurityMonitoringFilter + from datadog_api_client.v2.model.security_monitoring_rule_metadata import SecurityMonitoringRuleMetadata from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions from datadog_api_client.v2.model.security_monitoring_standard_rule_query import SecurityMonitoringStandardRuleQuery from datadog_api_client.v2.model.security_monitoring_reference_table import SecurityMonitoringReferenceTable @@ -39,7 +41,9 @@ def openapi_types(_): from datadog_api_client.v2.model.cloud_configuration_rule_compliance_signal_options import ( CloudConfigurationRuleComplianceSignalOptions, ) + from datadog_api_client.v2.model.security_monitoring_rule_user import SecurityMonitoringRuleUser from datadog_api_client.v2.model.security_monitoring_filter import SecurityMonitoringFilter + from datadog_api_client.v2.model.security_monitoring_rule_metadata import SecurityMonitoringRuleMetadata from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions from datadog_api_client.v2.model.security_monitoring_standard_rule_query import ( SecurityMonitoringStandardRuleQuery, @@ -54,23 +58,32 @@ def openapi_types(_): from datadog_api_client.v2.model.security_monitoring_rule_type_read import SecurityMonitoringRuleTypeRead return { + "blocking": (bool,), "calculated_fields": ([CalculatedField],), "cases": ([SecurityMonitoringRuleCase],), "compliance_signal_options": (CloudConfigurationRuleComplianceSignalOptions,), "created_at": (int,), "creation_author_id": (int,), + "creator": (SecurityMonitoringRuleUser,), "custom_message": (str,), "custom_name": (str,), + "default_rule_id": (str,), "default_tags": ([str],), + "dependencies": ([str],), "deprecation_date": (int,), "filters": ([SecurityMonitoringFilter],), + "finding_type": (str,), "group_signals_by": ([str],), "has_extended_title": (bool,), "id": (str,), + "is_beta": (bool,), "is_default": (bool,), "is_deleted": (bool,), + "is_deprecated": (bool,), "is_enabled": (bool,), + "is_partner": (bool,), "message": (str,), + "metadata": (SecurityMonitoringRuleMetadata,), "name": (str,), "options": (SecurityMonitoringRuleOptions,), "queries": ([SecurityMonitoringStandardRuleQuery],), @@ -81,27 +94,37 @@ def openapi_types(_): "type": (SecurityMonitoringRuleTypeRead,), "update_author_id": (int,), "updated_at": (int,), + "updater": (SecurityMonitoringRuleUser,), "version": (int,), } attribute_map = { + "blocking": "blocking", "calculated_fields": "calculatedFields", "cases": "cases", "compliance_signal_options": "complianceSignalOptions", "created_at": "createdAt", "creation_author_id": "creationAuthorId", + "creator": "creator", "custom_message": "customMessage", "custom_name": "customName", + "default_rule_id": "defaultRuleId", "default_tags": "defaultTags", + "dependencies": "dependencies", "deprecation_date": "deprecationDate", "filters": "filters", + "finding_type": "findingType", "group_signals_by": "groupSignalsBy", "has_extended_title": "hasExtendedTitle", "id": "id", + "is_beta": "isBeta", "is_default": "isDefault", "is_deleted": "isDeleted", + "is_deprecated": "isDeprecated", "is_enabled": "isEnabled", + "is_partner": "isPartner", "message": "message", + "metadata": "metadata", "name": "name", "options": "options", "queries": "queries", @@ -112,28 +135,38 @@ def openapi_types(_): "type": "type", "update_author_id": "updateAuthorId", "updated_at": "updatedAt", + "updater": "updater", "version": "version", } def __init__( self_, + blocking: Union[bool, UnsetType] = unset, calculated_fields: Union[List[CalculatedField], UnsetType] = unset, cases: Union[List[SecurityMonitoringRuleCase], UnsetType] = unset, compliance_signal_options: Union[CloudConfigurationRuleComplianceSignalOptions, UnsetType] = unset, created_at: Union[int, UnsetType] = unset, creation_author_id: Union[int, UnsetType] = unset, + creator: Union[SecurityMonitoringRuleUser, UnsetType] = unset, custom_message: Union[str, UnsetType] = unset, custom_name: Union[str, UnsetType] = unset, + default_rule_id: Union[str, UnsetType] = unset, default_tags: Union[List[str], UnsetType] = unset, + dependencies: Union[List[str], UnsetType] = unset, deprecation_date: Union[int, UnsetType] = unset, filters: Union[List[SecurityMonitoringFilter], UnsetType] = unset, + finding_type: Union[str, UnsetType] = unset, group_signals_by: Union[List[str], UnsetType] = unset, has_extended_title: Union[bool, UnsetType] = unset, id: Union[str, UnsetType] = unset, + is_beta: Union[bool, UnsetType] = unset, is_default: Union[bool, UnsetType] = unset, is_deleted: Union[bool, UnsetType] = unset, + is_deprecated: Union[bool, UnsetType] = unset, is_enabled: Union[bool, UnsetType] = unset, + is_partner: Union[bool, UnsetType] = unset, message: Union[str, UnsetType] = unset, + metadata: Union[SecurityMonitoringRuleMetadata, UnsetType] = unset, name: Union[str, UnsetType] = unset, options: Union[SecurityMonitoringRuleOptions, UnsetType] = unset, queries: Union[List[SecurityMonitoringStandardRuleQuery], UnsetType] = unset, @@ -144,12 +177,16 @@ def __init__( type: Union[SecurityMonitoringRuleTypeRead, UnsetType] = unset, update_author_id: Union[int, UnsetType] = unset, updated_at: Union[int, UnsetType] = unset, + updater: Union[SecurityMonitoringRuleUser, UnsetType] = unset, version: Union[int, UnsetType] = unset, **kwargs, ): """ Rule. + :param blocking: Whether the rule blocks attackers. + :type blocking: bool, optional + :param calculated_fields: Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined. :type calculated_fields: [CalculatedField], optional @@ -165,21 +202,33 @@ def __init__( :param creation_author_id: User ID of the user who created the rule. :type creation_author_id: int, optional + :param creator: The user who created or last updated the rule. + :type creator: SecurityMonitoringRuleUser, optional + :param custom_message: Custom/Overridden message for generated signals (used in case of Default rule update). :type custom_message: str, optional :param custom_name: Custom/Overridden name of the rule (used in case of Default rule update). :type custom_name: str, optional + :param default_rule_id: The ID of the corresponding default rule. + :type default_rule_id: str, optional + :param default_tags: Default Tags for default rules (included in tags) :type default_tags: [str], optional + :param dependencies: IDs of rules that this rule depends on. + :type dependencies: [str], optional + :param deprecation_date: When the rule will be deprecated, timestamp in milliseconds. :type deprecation_date: int, optional :param filters: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. :type filters: [SecurityMonitoringFilter], optional + :param finding_type: The type of findings generated by the rule. + :type finding_type: str, optional + :param group_signals_by: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. :type group_signals_by: [str], optional @@ -189,18 +238,30 @@ def __init__( :param id: The ID of the rule. :type id: str, optional + :param is_beta: Whether the rule is in beta. + :type is_beta: bool, optional + :param is_default: Whether the rule is included by default. :type is_default: bool, optional :param is_deleted: Whether the rule has been deleted. :type is_deleted: bool, optional + :param is_deprecated: Whether the rule is deprecated. + :type is_deprecated: bool, optional + :param is_enabled: Whether the rule is enabled. :type is_enabled: bool, optional + :param is_partner: Whether the rule is provided by a partner. + :type is_partner: bool, optional + :param message: Message for generated signals. :type message: str, optional + :param metadata: Metadata associated with the rule. + :type metadata: SecurityMonitoringRuleMetadata, optional + :param name: The name of the rule. :type name: str, optional @@ -231,9 +292,14 @@ def __init__( :param updated_at: The date the rule was last updated, in milliseconds. :type updated_at: int, optional + :param updater: The user who created or last updated the rule. + :type updater: SecurityMonitoringRuleUser, optional + :param version: The version of the rule. :type version: int, optional """ + if blocking is not unset: + kwargs["blocking"] = blocking if calculated_fields is not unset: kwargs["calculated_fields"] = calculated_fields if cases is not unset: @@ -244,30 +310,46 @@ def __init__( kwargs["created_at"] = created_at if creation_author_id is not unset: kwargs["creation_author_id"] = creation_author_id + if creator is not unset: + kwargs["creator"] = creator if custom_message is not unset: kwargs["custom_message"] = custom_message if custom_name is not unset: kwargs["custom_name"] = custom_name + if default_rule_id is not unset: + kwargs["default_rule_id"] = default_rule_id if default_tags is not unset: kwargs["default_tags"] = default_tags + if dependencies is not unset: + kwargs["dependencies"] = dependencies if deprecation_date is not unset: kwargs["deprecation_date"] = deprecation_date if filters is not unset: kwargs["filters"] = filters + if finding_type is not unset: + kwargs["finding_type"] = finding_type if group_signals_by is not unset: kwargs["group_signals_by"] = group_signals_by if has_extended_title is not unset: kwargs["has_extended_title"] = has_extended_title if id is not unset: kwargs["id"] = id + if is_beta is not unset: + kwargs["is_beta"] = is_beta if is_default is not unset: kwargs["is_default"] = is_default if is_deleted is not unset: kwargs["is_deleted"] = is_deleted + if is_deprecated is not unset: + kwargs["is_deprecated"] = is_deprecated if is_enabled is not unset: kwargs["is_enabled"] = is_enabled + if is_partner is not unset: + kwargs["is_partner"] = is_partner if message is not unset: kwargs["message"] = message + if metadata is not unset: + kwargs["metadata"] = metadata if name is not unset: kwargs["name"] = name if options is not unset: @@ -288,6 +370,8 @@ def __init__( kwargs["update_author_id"] = update_author_id if updated_at is not unset: kwargs["updated_at"] = updated_at + if updater is not unset: + kwargs["updater"] = updater if version is not unset: kwargs["version"] = version super().__init__(kwargs) diff --git a/src/datadog_api_client/v2/models/__init__.py b/src/datadog_api_client/v2/models/__init__.py index 6e882ce1c4..0d5a177efd 100644 --- a/src/datadog_api_client/v2/models/__init__.py +++ b/src/datadog_api_client/v2/models/__init__.py @@ -9136,6 +9136,7 @@ from datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration import ( SecurityMonitoringRuleMaxSignalDuration, ) +from datadog_api_client.v2.model.security_monitoring_rule_metadata import SecurityMonitoringRuleMetadata from datadog_api_client.v2.model.security_monitoring_rule_new_value_options import SecurityMonitoringRuleNewValueOptions from datadog_api_client.v2.model.security_monitoring_rule_new_value_options_learning_method import ( SecurityMonitoringRuleNewValueOptionsLearningMethod, @@ -9174,6 +9175,7 @@ from datadog_api_client.v2.model.security_monitoring_rule_type_read import SecurityMonitoringRuleTypeRead from datadog_api_client.v2.model.security_monitoring_rule_type_test import SecurityMonitoringRuleTypeTest from datadog_api_client.v2.model.security_monitoring_rule_update_payload import SecurityMonitoringRuleUpdatePayload +from datadog_api_client.v2.model.security_monitoring_rule_user import SecurityMonitoringRuleUser from datadog_api_client.v2.model.security_monitoring_rule_validate_payload import SecurityMonitoringRuleValidatePayload from datadog_api_client.v2.model.security_monitoring_sku import SecurityMonitoringSKU from datadog_api_client.v2.model.security_monitoring_scheduling_options import SecurityMonitoringSchedulingOptions @@ -17585,6 +17587,7 @@ "SecurityMonitoringRuleImpossibleTravelOptions", "SecurityMonitoringRuleKeepAlive", "SecurityMonitoringRuleMaxSignalDuration", + "SecurityMonitoringRuleMetadata", "SecurityMonitoringRuleNewValueOptions", "SecurityMonitoringRuleNewValueOptionsLearningMethod", "SecurityMonitoringRuleNewValueOptionsLearningThreshold", @@ -17607,6 +17610,7 @@ "SecurityMonitoringRuleTypeRead", "SecurityMonitoringRuleTypeTest", "SecurityMonitoringRuleUpdatePayload", + "SecurityMonitoringRuleUser", "SecurityMonitoringRuleValidatePayload", "SecurityMonitoringSKU", "SecurityMonitoringSchedulingOptions", diff --git a/tests/v2/features/security_monitoring.feature b/tests/v2/features/security_monitoring.feature index 12b40ab104..0cd95c1b0e 100644 --- a/tests/v2/features/security_monitoring.feature +++ b/tests/v2/features/security_monitoring.feature @@ -2669,11 +2669,14 @@ Feature: Security Monitoring When the request is sent Then the response status is 400 Bad Request - @skip-validation @team:DataDog/cloud-siem + @team:DataDog/cloud-siem Scenario: List rules returns "OK" response Given new "ListSecurityMonitoringRules" request When the request is sent Then the response status is 200 OK + And the response "data[0]" has field "isPartner" + And the response "data[0]" has field "isBeta" + And the response "data[0]" has field "isDeprecated" @team:DataDog/k9-cloud-vm Scenario: List scanned assets metadata returns "Bad request: Invalid Pagination Token" response