Skip to content

Commit 660dabc

Browse files
author
ci.datadog-api-spec
committed
Regenerate client from commit e7cfa56f of spec repo
1 parent 5e18246 commit 660dabc

18 files changed

+589
-4
lines changed

‎.apigentools-info

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
"spec_versions": {
55
"v1": {
66
"apigentools_version": "1.6.6",
7-
"regenerated": "2024-01-03 19:28:41.267857",
8-
"spec_repo_commit": "b2d74fec"
7+
"regenerated": "2024-01-04 15:18:08.876360",
8+
"spec_repo_commit": "e7cfa56f"
99
},
1010
"v2": {
1111
"apigentools_version": "1.6.6",
12-
"regenerated": "2024-01-03 19:28:41.286788",
13-
"spec_repo_commit": "b2d74fec"
12+
"regenerated": "2024-01-04 15:18:08.899971",
13+
"spec_repo_commit": "e7cfa56f"
1414
}
1515
}
1616
}

‎.generator/schemas/v2/openapi.yaml

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15616,6 +15616,8 @@ components:
1561615616
$ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
1561715617
newValueOptions:
1561815618
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
15619+
thirdPartyRuleOptions:
15620+
$ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
1561915621
type: object
1562015622
SecurityMonitoringRuleQuery:
1562115623
description: Query for matching rule.
@@ -15664,6 +15666,30 @@ components:
1566415666
- MEDIUM
1566515667
- HIGH
1566615668
- CRITICAL
15669+
SecurityMonitoringRuleThirdPartyOptions:
15670+
description: Options on third party rules.
15671+
properties:
15672+
defaultNotifications:
15673+
description: Notification targets for the logs that do not correspond to
15674+
any of the cases.
15675+
items:
15676+
description: Notification.
15677+
type: string
15678+
type: array
15679+
defaultStatus:
15680+
$ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
15681+
rootQueries:
15682+
description: Queries to be combined with third party case queries. Each
15683+
of them can have different group by fields, to aggregate differently based
15684+
on the type of alert.
15685+
items:
15686+
$ref: '#/components/schemas/SecurityMonitoringThirdPartyRootQuery'
15687+
type: array
15688+
signalTitleTemplate:
15689+
description: A template for the signal title; if omitted, the title is generated
15690+
based on the case name.
15691+
type: string
15692+
type: object
1566715693
SecurityMonitoringRuleTypeCreate:
1566815694
description: The rule type.
1566915695
enum:
@@ -15733,6 +15759,13 @@ components:
1573315759
description: Tag.
1573415760
type: string
1573515761
type: array
15762+
thirdPartyCases:
15763+
description: Cases for generating signals from third party rules. Only available
15764+
for third party rules.
15765+
example: []
15766+
items:
15767+
$ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCase'
15768+
type: array
1573615769
version:
1573715770
description: The version of the rule being updated.
1573815771
example: 1
@@ -16362,6 +16395,13 @@ components:
1636216395
description: Tag.
1636316396
type: string
1636416397
type: array
16398+
thirdPartyCases:
16399+
description: Cases for generating signals from third party rules. Only available
16400+
for third party rules.
16401+
example: []
16402+
items:
16403+
$ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate'
16404+
type: array
1636516405
type:
1636616406
$ref: '#/components/schemas/SecurityMonitoringRuleTypeCreate'
1636716407
required:
@@ -16483,6 +16523,13 @@ components:
1648316523
description: Tag.
1648416524
type: string
1648516525
type: array
16526+
thirdPartyCases:
16527+
description: Cases for generating signals from third party rules. Only available
16528+
for third party rules.
16529+
example: []
16530+
items:
16531+
$ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCase'
16532+
type: array
1648616533
type:
1648716534
$ref: '#/components/schemas/SecurityMonitoringRuleTypeRead'
1648816535
updateAuthorId:
@@ -16493,6 +16540,58 @@ components:
1649316540
description: The version of the rule.
1649416541
format: int64
1649516542
type: integer
16543+
SecurityMonitoringThirdPartyRootQuery:
16544+
description: A query to be combined with the third party case query.
16545+
properties:
16546+
groupByFields:
16547+
description: Fields to group by.
16548+
items:
16549+
description: Field.
16550+
type: string
16551+
type: array
16552+
query:
16553+
description: Query to run on logs.
16554+
example: source:cloudtrail
16555+
type: string
16556+
type: object
16557+
SecurityMonitoringThirdPartyRuleCase:
16558+
description: Case when signal is generated by a third party rule.
16559+
properties:
16560+
name:
16561+
description: Name of the case.
16562+
type: string
16563+
notifications:
16564+
description: Notification targets for each rule case.
16565+
items:
16566+
description: Notification.
16567+
type: string
16568+
type: array
16569+
query:
16570+
description: A query to map a third party event to this case.
16571+
type: string
16572+
status:
16573+
$ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
16574+
type: object
16575+
SecurityMonitoringThirdPartyRuleCaseCreate:
16576+
description: Case when a signal is generated by a third party rule.
16577+
properties:
16578+
name:
16579+
description: Name of the case.
16580+
type: string
16581+
notifications:
16582+
description: Notification targets for each rule case.
16583+
items:
16584+
description: Notification.
16585+
type: string
16586+
type: array
16587+
query:
16588+
description: A query to map a third party event to this case.
16589+
type: string
16590+
status:
16591+
$ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
16592+
required:
16593+
- status
16594+
type: object
1649616595
SecurityMonitoringTriageUser:
1649716596
description: Object representing a given user entity.
1649816597
properties:

‎docs/datadog_api_client.v2.model.rst

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7050,6 +7050,13 @@ security\_monitoring\_rule\_severity
70507050
:members:
70517051
:show-inheritance:
70527052

7053+
security\_monitoring\_rule\_third\_party\_options
7054+
-------------------------------------------------
7055+
7056+
.. automodule:: datadog_api_client.v2.model.security_monitoring_rule_third_party_options
7057+
:members:
7058+
:show-inheritance:
7059+
70537060
security\_monitoring\_rule\_type\_create
70547061
----------------------------------------
70557062

@@ -7323,6 +7330,27 @@ security\_monitoring\_standard\_rule\_response
73237330
:members:
73247331
:show-inheritance:
73257332

7333+
security\_monitoring\_third\_party\_root\_query
7334+
-----------------------------------------------
7335+
7336+
.. automodule:: datadog_api_client.v2.model.security_monitoring_third_party_root_query
7337+
:members:
7338+
:show-inheritance:
7339+
7340+
security\_monitoring\_third\_party\_rule\_case
7341+
----------------------------------------------
7342+
7343+
.. automodule:: datadog_api_client.v2.model.security_monitoring_third_party_rule_case
7344+
:members:
7345+
:show-inheritance:
7346+
7347+
security\_monitoring\_third\_party\_rule\_case\_create
7348+
------------------------------------------------------
7349+
7350+
.. automodule:: datadog_api_client.v2.model.security_monitoring_third_party_rule_case_create
7351+
:members:
7352+
:show-inheritance:
7353+
73267354
security\_monitoring\_triage\_user
73277355
----------------------------------
73287356

‎examples/v2/security-monitoring/CreateSecurityMonitoringRule_3367706049.py

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
"""
2+
Create a detection rule with detection method 'third_party' returns "OK" response
3+
"""
4+
5+
from datadog_api_client import ApiClient, Configuration
6+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
7+
from datadog_api_client.v2.model.security_monitoring_rule_detection_method import SecurityMonitoringRuleDetectionMethod
8+
from datadog_api_client.v2.model.security_monitoring_rule_keep_alive import SecurityMonitoringRuleKeepAlive
9+
from datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration import (
10+
SecurityMonitoringRuleMaxSignalDuration,
11+
)
12+
from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions
13+
from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity
14+
from datadog_api_client.v2.model.security_monitoring_rule_third_party_options import (
15+
SecurityMonitoringRuleThirdPartyOptions,
16+
)
17+
from datadog_api_client.v2.model.security_monitoring_rule_type_create import SecurityMonitoringRuleTypeCreate
18+
from datadog_api_client.v2.model.security_monitoring_standard_rule_create_payload import (
19+
SecurityMonitoringStandardRuleCreatePayload,
20+
)
21+
from datadog_api_client.v2.model.security_monitoring_third_party_root_query import SecurityMonitoringThirdPartyRootQuery
22+
from datadog_api_client.v2.model.security_monitoring_third_party_rule_case_create import (
23+
SecurityMonitoringThirdPartyRuleCaseCreate,
24+
)
25+
26+
body = SecurityMonitoringStandardRuleCreatePayload(
27+
name="Example-Security-Monitoring",
28+
type=SecurityMonitoringRuleTypeCreate.LOG_DETECTION,
29+
is_enabled=True,
30+
third_party_cases=[
31+
SecurityMonitoringThirdPartyRuleCaseCreate(
32+
query="status:error",
33+
name="high",
34+
status=SecurityMonitoringRuleSeverity.HIGH,
35+
),
36+
SecurityMonitoringThirdPartyRuleCaseCreate(
37+
query="status:info",
38+
name="low",
39+
status=SecurityMonitoringRuleSeverity.LOW,
40+
),
41+
],
42+
queries=[],
43+
cases=[],
44+
message="This is a third party rule",
45+
options=SecurityMonitoringRuleOptions(
46+
detection_method=SecurityMonitoringRuleDetectionMethod.THIRD_PARTY,
47+
keep_alive=SecurityMonitoringRuleKeepAlive.ZERO_MINUTES,
48+
max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.ZERO_MINUTES,
49+
third_party_rule_options=SecurityMonitoringRuleThirdPartyOptions(
50+
default_status=SecurityMonitoringRuleSeverity.INFO,
51+
root_queries=[
52+
SecurityMonitoringThirdPartyRootQuery(
53+
query="source:guardduty @details.alertType:*EC2*",
54+
group_by_fields=[
55+
"instance-id",
56+
],
57+
),
58+
SecurityMonitoringThirdPartyRootQuery(
59+
query="source:guardduty",
60+
group_by_fields=[],
61+
),
62+
],
63+
),
64+
),
65+
)
66+
67+
configuration = Configuration()
68+
with ApiClient(configuration) as api_client:
69+
api_instance = SecurityMonitoringApi(api_client)
70+
response = api_instance.create_security_monitoring_rule(body=body)
71+
72+
print(response)

‎src/datadog_api_client/v2/model/security_monitoring_rule_create_payload.py

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,9 @@ def __init__(self, **kwargs):
4242
:param tags: Tags for generated signals.
4343
:type tags: [str], optional
4444
45+
:param third_party_cases: Cases for generating signals from third party rules. Only available for third party rules.
46+
:type third_party_cases: [SecurityMonitoringThirdPartyRuleCaseCreate], optional
47+
4548
:param type: The rule type.
4649
:type type: SecurityMonitoringRuleTypeCreate, optional
4750

‎src/datadog_api_client/v2/model/security_monitoring_rule_options.py

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@
3636
from datadog_api_client.v2.model.security_monitoring_rule_new_value_options import (
3737
SecurityMonitoringRuleNewValueOptions,
3838
)
39+
from datadog_api_client.v2.model.security_monitoring_rule_third_party_options import (
40+
SecurityMonitoringRuleThirdPartyOptions,
41+
)
3942

4043

4144
class SecurityMonitoringRuleOptions(ModelNormal):
@@ -63,6 +66,9 @@ def openapi_types(_):
6366
from datadog_api_client.v2.model.security_monitoring_rule_new_value_options import (
6467
SecurityMonitoringRuleNewValueOptions,
6568
)
69+
from datadog_api_client.v2.model.security_monitoring_rule_third_party_options import (
70+
SecurityMonitoringRuleThirdPartyOptions,
71+
)
6672

6773
return {
6874
"compliance_rule_options": (CloudConfigurationComplianceRuleOptions,),
@@ -74,6 +80,7 @@ def openapi_types(_):
7480
"keep_alive": (SecurityMonitoringRuleKeepAlive,),
7581
"max_signal_duration": (SecurityMonitoringRuleMaxSignalDuration,),
7682
"new_value_options": (SecurityMonitoringRuleNewValueOptions,),
83+
"third_party_rule_options": (SecurityMonitoringRuleThirdPartyOptions,),
7784
}
7885

7986
attribute_map = {
@@ -86,6 +93,7 @@ def openapi_types(_):
8693
"keep_alive": "keepAlive",
8794
"max_signal_duration": "maxSignalDuration",
8895
"new_value_options": "newValueOptions",
96+
"third_party_rule_options": "thirdPartyRuleOptions",
8997
}
9098

9199
def __init__(
@@ -99,6 +107,7 @@ def __init__(
99107
keep_alive: Union[SecurityMonitoringRuleKeepAlive, UnsetType] = unset,
100108
max_signal_duration: Union[SecurityMonitoringRuleMaxSignalDuration, UnsetType] = unset,
101109
new_value_options: Union[SecurityMonitoringRuleNewValueOptions, UnsetType] = unset,
110+
third_party_rule_options: Union[SecurityMonitoringRuleThirdPartyOptions, UnsetType] = unset,
102111
**kwargs,
103112
):
104113
"""
@@ -136,6 +145,9 @@ def __init__(
136145
137146
:param new_value_options: Options on new value rules.
138147
:type new_value_options: SecurityMonitoringRuleNewValueOptions, optional
148+
149+
:param third_party_rule_options: Options on third party rules.
150+
:type third_party_rule_options: SecurityMonitoringRuleThirdPartyOptions, optional
139151
"""
140152
if compliance_rule_options is not unset:
141153
kwargs["compliance_rule_options"] = compliance_rule_options
@@ -155,4 +167,6 @@ def __init__(
155167
kwargs["max_signal_duration"] = max_signal_duration
156168
if new_value_options is not unset:
157169
kwargs["new_value_options"] = new_value_options
170+
if third_party_rule_options is not unset:
171+
kwargs["third_party_rule_options"] = third_party_rule_options
158172
super().__init__(kwargs)

‎src/datadog_api_client/v2/model/security_monitoring_rule_response.py

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,9 @@ def __init__(self, **kwargs):
6363
:param tags: Tags for generated signals.
6464
:type tags: [str], optional
6565
66+
:param third_party_cases: Cases for generating signals from third party rules. Only available for third party rules.
67+
:type third_party_cases: [SecurityMonitoringThirdPartyRuleCase], optional
68+
6669
:param type: The rule type.
6770
:type type: SecurityMonitoringRuleTypeRead, optional
6871

0 commit comments

Comments
 (0)