Skip to content

Commit 113bb23

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Security Monitoring - Validation Endpoint for Suppressions (#2810)
Co-authored-by: ci.datadog-api-spec <[email protected]>
1 parent 44f95bb commit 113bb23

9 files changed

+166
-0
lines changed

‎.generator/schemas/v2/openapi.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64816,6 +64816,38 @@ paths:
6481664816
summary: Get suppressions affecting a specific rule
6481764817
tags:
6481864818
- Security Monitoring
64819+
/api/v2/security_monitoring/configuration/suppressions/validation:
64820+
post:
64821+
description: Validate a suppression rule.
64822+
operationId: ValidateSecurityMonitoringSuppression
64823+
requestBody:
64824+
content:
64825+
application/json:
64826+
schema:
64827+
$ref: '#/components/schemas/SecurityMonitoringSuppressionUpdateRequest'
64828+
required: true
64829+
responses:
64830+
'204':
64831+
description: OK
64832+
'400':
64833+
$ref: '#/components/responses/BadRequestResponse'
64834+
'403':
64835+
$ref: '#/components/responses/NotAuthorizedResponse'
64836+
'429':
64837+
$ref: '#/components/responses/TooManyRequestsResponse'
64838+
security:
64839+
- apiKeyAuth: []
64840+
appKeyAuth: []
64841+
- AuthZ:
64842+
- security_monitoring_suppressions_write
64843+
summary: Validate a suppression rule
64844+
tags:
64845+
- Security Monitoring
64846+
x-codegen-request-body-name: body
64847+
x-permission:
64848+
operator: OR
64849+
permissions:
64850+
- security_monitoring_suppressions_write
6481964851
/api/v2/security_monitoring/configuration/suppressions/{suppression_id}:
6482064852
delete:
6482164853
description: Delete a specific suppression rule.

‎examples/v2/security-monitoring/ValidateSecurityMonitoringSuppression.py

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
"""
2+
Validate a suppression rule returns "OK" response
3+
"""
4+
5+
from datadog_api_client import ApiClient, Configuration
6+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
7+
from datadog_api_client.v2.model.security_monitoring_suppression_type import SecurityMonitoringSuppressionType
8+
from datadog_api_client.v2.model.security_monitoring_suppression_update_attributes import (
9+
SecurityMonitoringSuppressionUpdateAttributes,
10+
)
11+
from datadog_api_client.v2.model.security_monitoring_suppression_update_data import (
12+
SecurityMonitoringSuppressionUpdateData,
13+
)
14+
from datadog_api_client.v2.model.security_monitoring_suppression_update_request import (
15+
SecurityMonitoringSuppressionUpdateRequest,
16+
)
17+
18+
body = SecurityMonitoringSuppressionUpdateRequest(
19+
data=SecurityMonitoringSuppressionUpdateData(
20+
attributes=SecurityMonitoringSuppressionUpdateAttributes(
21+
data_exclusion_query="source:cloudtrail account_id:12345",
22+
description="This rule suppresses low-severity signals in staging environments.",
23+
enabled=True,
24+
name="Custom suppression",
25+
rule_query="type:log_detection source:cloudtrail",
26+
),
27+
type=SecurityMonitoringSuppressionType.SUPPRESSIONS,
28+
),
29+
)
30+
31+
configuration = Configuration()
32+
with ApiClient(configuration) as api_client:
33+
api_instance = SecurityMonitoringApi(api_client)
34+
api_instance.validate_security_monitoring_suppression(body=body)

‎src/datadog_api_client/v2/api/security_monitoring_api.py

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1922,6 +1922,26 @@ def __init__(self, api_client=None):
19221922
api_client=api_client,
19231923
)
19241924

1925+
self._validate_security_monitoring_suppression_endpoint = _Endpoint(
1926+
settings={
1927+
"response_type": None,
1928+
"auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"],
1929+
"endpoint_path": "/api/v2/security_monitoring/configuration/suppressions/validation",
1930+
"operation_id": "validate_security_monitoring_suppression",
1931+
"http_method": "POST",
1932+
"version": "v2",
1933+
},
1934+
params_map={
1935+
"body": {
1936+
"required": True,
1937+
"openapi_types": (SecurityMonitoringSuppressionUpdateRequest,),
1938+
"location": "body",
1939+
},
1940+
},
1941+
headers_map={"accept": ["*/*"], "content_type": ["application/json"]},
1942+
api_client=api_client,
1943+
)
1944+
19251945
def cancel_historical_job(
19261946
self,
19271947
job_id: str,
@@ -3923,3 +3943,19 @@ def validate_security_monitoring_rule(
39233943
kwargs["body"] = body
39243944

39253945
return self._validate_security_monitoring_rule_endpoint.call_with_http_info(**kwargs)
3946+
3947+
def validate_security_monitoring_suppression(
3948+
self,
3949+
body: SecurityMonitoringSuppressionUpdateRequest,
3950+
) -> None:
3951+
"""Validate a suppression rule.
3952+
3953+
Validate a suppression rule.
3954+
3955+
:type body: SecurityMonitoringSuppressionUpdateRequest
3956+
:rtype: None
3957+
"""
3958+
kwargs: Dict[str, Any] = {}
3959+
kwargs["body"] = body
3960+
3961+
return self._validate_security_monitoring_suppression_endpoint.call_with_http_info(**kwargs)

‎tests/v2/cassettes/test_scenarios/test_validate_a_suppression_rule_returns_bad_request_response.frozen

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2025-09-01T21:36:42.334Z

‎tests/v2/cassettes/test_scenarios/test_validate_a_suppression_rule_returns_bad_request_response.yaml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
interactions:
2+
- request:
3+
body: '{"data":{"attributes":{"data_exclusion_query":"not enough attributes"},"type":"suppressions"}}'
4+
headers:
5+
accept:
6+
- '*/*'
7+
content-type:
8+
- application/json
9+
method: POST
10+
uri: https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/validation
11+
response:
12+
body:
13+
string: '{"errors":["input_validation_error(Field ''data.attributes.rule_query''
14+
is invalid: field ''rule_query'' is required)","input_validation_error(Field
15+
''data.attributes.name'' is invalid: name cannot be empty)"]}'
16+
headers:
17+
content-type:
18+
- application/json
19+
status:
20+
code: 400
21+
message: Bad Request
22+
version: 1

‎tests/v2/cassettes/test_scenarios/test_validate_a_suppression_rule_returns_ok_response.frozen

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2025-09-01T21:36:20.593Z

‎tests/v2/cassettes/test_scenarios/test_validate_a_suppression_rule_returns_ok_response.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
interactions:
2+
- request:
3+
body: '{"data":{"attributes":{"data_exclusion_query":"source:cloudtrail account_id:12345","description":"This
4+
rule suppresses low-severity signals in staging environments.","enabled":true,"name":"Custom
5+
suppression","rule_query":"type:log_detection source:cloudtrail"},"type":"suppressions"}}'
6+
headers:
7+
accept:
8+
- '*/*'
9+
content-type:
10+
- application/json
11+
method: POST
12+
uri: https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/validation
13+
response:
14+
body:
15+
string: ''
16+
headers: {}
17+
status:
18+
code: 204
19+
message: No Content
20+
version: 1

‎tests/v2/features/security_monitoring.feature

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1389,3 +1389,17 @@ Feature: Security Monitoring
13891389
And body with value {"cases":[{"name":"","status":"info","notifications":[],"condition":"a > 0"}],"hasExtendedTitle":true,"isEnabled":true,"message":"My security monitoring rule","name":"My security monitoring rule","options":{"evaluationWindow":1800,"keepAlive":1800,"maxSignalDuration":1800,"detectionMethod":"threshold"},"queries":[{"query":"source:source_here","groupByFields":["@userIdentity.assumed_role"],"distinctFields":[],"aggregation":"count","name":""}],"tags":["env:prod","team:security"],"type":"log_detection"}
13901390
When the request is sent
13911391
Then the response status is 204 OK
1392+
1393+
@team:DataDog/k9-cloud-security-platform
1394+
Scenario: Validate a suppression rule returns "Bad Request" response
1395+
Given new "ValidateSecurityMonitoringSuppression" request
1396+
And body with value {"data": {"attributes": {"data_exclusion_query": "not enough attributes"}, "type": "suppressions"}}
1397+
When the request is sent
1398+
Then the response status is 400 Bad Request
1399+
1400+
@team:DataDog/k9-cloud-security-platform
1401+
Scenario: Validate a suppression rule returns "OK" response
1402+
Given new "ValidateSecurityMonitoringSuppression" request
1403+
And body with value {"data": {"attributes": {"data_exclusion_query": "source:cloudtrail account_id:12345", "description": "This rule suppresses low-severity signals in staging environments.", "enabled": true, "name": "Custom suppression", "rule_query": "type:log_detection source:cloudtrail"}, "type": "suppressions"}}
1404+
When the request is sent
1405+
Then the response status is 204 OK

‎tests/v2/features/undo.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3024,6 +3024,12 @@
30243024
"type": "safe"
30253025
}
30263026
},
3027+
"ValidateSecurityMonitoringSuppression": {
3028+
"tag": "Security Monitoring",
3029+
"undo": {
3030+
"type": "idempotent"
3031+
}
3032+
},
30273033
"DeleteSecurityMonitoringSuppression": {
30283034
"tag": "Security Monitoring",
30293035
"undo": {

0 commit comments

Comments
 (0)