Skip to content

Commit 2135f5e

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Flag IP case action (#2714)
Co-authored-by: ci.datadog-api-spec <[email protected]>
1 parent b46aa1c commit 2135f5e

11 files changed

+114
-13
lines changed

‎.generated-info

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
{
2-
"spec_repo_commit": "06ccc32",
3-
"generated": "2025-07-21 13:55:33.672"
2+
"spec_repo_commit": "8ca2883",
3+
"generated": "2025-07-22 07:15:04.416"
44
}

‎.generator/schemas/v2/openapi.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34296,9 +34296,22 @@ components:
3429634296
format: int64
3429734297
minimum: 0
3429834298
type: integer
34299+
flaggedIPType:
34300+
$ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsFlaggedIPType'
3429934301
userBehaviorName:
3430034302
$ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsUserBehaviorName'
3430134303
type: object
34304+
SecurityMonitoringRuleCaseActionOptionsFlaggedIPType:
34305+
description: Used with the case action of type 'flag_ip'. The value specified
34306+
in this field is applied as a flag to the IP addresses.
34307+
enum:
34308+
- SUSPICIOUS
34309+
- FLAGGED
34310+
example: FLAGGED
34311+
type: string
34312+
x-enum-varnames:
34313+
- SUSPICIOUS
34314+
- FLAGGED
3430234315
SecurityMonitoringRuleCaseActionOptionsUserBehaviorName:
3430334316
description: Used with the case action of type 'user_behavior'. The value specified
3430434317
in this field is applied as a risk tag to all users affected by the rule.
@@ -34309,11 +34322,13 @@ components:
3430934322
- block_ip
3431034323
- block_user
3431134324
- user_behavior
34325+
- flag_ip
3431234326
type: string
3431334327
x-enum-varnames:
3431434328
- BLOCK_IP
3431534329
- BLOCK_USER
3431634330
- USER_BEHAVIOR
34331+
- FLAG_IP
3431734332
SecurityMonitoringRuleCaseCreate:
3431834333
description: Case when signal is generated.
3431934334
properties:

‎docs/datadog_api_client.v2.model.rst

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14963,6 +14963,13 @@ datadog\_api\_client.v2.model.security\_monitoring\_rule\_case\_action\_options
1496314963
:members:
1496414964
:show-inheritance:
1496514965

14966+
datadog\_api\_client.v2.model.security\_monitoring\_rule\_case\_action\_options\_flagged\_ip\_type module
14967+
---------------------------------------------------------------------------------------------------------
14968+
14969+
.. automodule:: datadog_api_client.v2.model.security_monitoring_rule_case_action_options_flagged_ip_type
14970+
:members:
14971+
:show-inheritance:
14972+
1496614973
datadog\_api\_client.v2.model.security\_monitoring\_rule\_case\_action\_type module
1496714974
-----------------------------------------------------------------------------------
1496814975

‎examples/v2/security-monitoring/CreateSecurityMonitoringRule_1965169892.py

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@
88
from datadog_api_client.v2.model.security_monitoring_rule_case_action_options import (
99
SecurityMonitoringRuleCaseActionOptions,
1010
)
11+
from datadog_api_client.v2.model.security_monitoring_rule_case_action_options_flagged_ip_type import (
12+
SecurityMonitoringRuleCaseActionOptionsFlaggedIPType,
13+
)
1114
from datadog_api_client.v2.model.security_monitoring_rule_case_action_type import SecurityMonitoringRuleCaseActionType
1215
from datadog_api_client.v2.model.security_monitoring_rule_case_create import SecurityMonitoringRuleCaseCreate
1316
from datadog_api_client.v2.model.security_monitoring_rule_detection_method import SecurityMonitoringRuleDetectionMethod
@@ -63,6 +66,12 @@
6366
user_behavior_name="behavior",
6467
),
6568
),
69+
SecurityMonitoringRuleCaseAction(
70+
type=SecurityMonitoringRuleCaseActionType.FLAG_IP,
71+
options=SecurityMonitoringRuleCaseActionOptions(
72+
flagged_ip_type=SecurityMonitoringRuleCaseActionOptionsFlaggedIPType.FLAGGED,
73+
),
74+
),
6675
],
6776
),
6877
],

‎src/datadog_api_client/v2/model/security_monitoring_rule_case_action_options.py

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
# Copyright 2019-Present Datadog, Inc.
44
from __future__ import annotations
55

6-
from typing import Union
6+
from typing import Union, TYPE_CHECKING
77

88
from datadog_api_client.model_utils import (
99
ModelNormal,
@@ -13,6 +13,12 @@
1313
)
1414

1515

16+
if TYPE_CHECKING:
17+
from datadog_api_client.v2.model.security_monitoring_rule_case_action_options_flagged_ip_type import (
18+
SecurityMonitoringRuleCaseActionOptionsFlaggedIPType,
19+
)
20+
21+
1622
class SecurityMonitoringRuleCaseActionOptions(ModelNormal):
1723
validations = {
1824
"duration": {
@@ -22,30 +28,45 @@ class SecurityMonitoringRuleCaseActionOptions(ModelNormal):
2228

2329
@cached_property
2430
def openapi_types(_):
31+
from datadog_api_client.v2.model.security_monitoring_rule_case_action_options_flagged_ip_type import (
32+
SecurityMonitoringRuleCaseActionOptionsFlaggedIPType,
33+
)
34+
2535
return {
2636
"duration": (int,),
37+
"flagged_ip_type": (SecurityMonitoringRuleCaseActionOptionsFlaggedIPType,),
2738
"user_behavior_name": (str,),
2839
}
2940

3041
attribute_map = {
3142
"duration": "duration",
43+
"flagged_ip_type": "flaggedIPType",
3244
"user_behavior_name": "userBehaviorName",
3345
}
3446

3547
def __init__(
36-
self_, duration: Union[int, UnsetType] = unset, user_behavior_name: Union[str, UnsetType] = unset, **kwargs
48+
self_,
49+
duration: Union[int, UnsetType] = unset,
50+
flagged_ip_type: Union[SecurityMonitoringRuleCaseActionOptionsFlaggedIPType, UnsetType] = unset,
51+
user_behavior_name: Union[str, UnsetType] = unset,
52+
**kwargs,
3753
):
3854
"""
3955
Options for the rule action
4056
4157
:param duration: Duration of the action in seconds. 0 indicates no expiration.
4258
:type duration: int, optional
4359
60+
:param flagged_ip_type: Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses.
61+
:type flagged_ip_type: SecurityMonitoringRuleCaseActionOptionsFlaggedIPType, optional
62+
4463
:param user_behavior_name: Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
4564
:type user_behavior_name: str, optional
4665
"""
4766
if duration is not unset:
4867
kwargs["duration"] = duration
68+
if flagged_ip_type is not unset:
69+
kwargs["flagged_ip_type"] = flagged_ip_type
4970
if user_behavior_name is not unset:
5071
kwargs["user_behavior_name"] = user_behavior_name
5172
super().__init__(kwargs)

‎src/datadog_api_client/v2/model/security_monitoring_rule_case_action_options_flagged_ip_type.py

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
2+
# This product includes software developed at Datadog (https://www.datadoghq.com/).
3+
# Copyright 2019-Present Datadog, Inc.
4+
from __future__ import annotations
5+
6+
7+
from datadog_api_client.model_utils import (
8+
ModelSimple,
9+
cached_property,
10+
)
11+
12+
from typing import ClassVar
13+
14+
15+
class SecurityMonitoringRuleCaseActionOptionsFlaggedIPType(ModelSimple):
16+
"""
17+
Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses.
18+
19+
:param value: Must be one of ["SUSPICIOUS", "FLAGGED"].
20+
:type value: str
21+
"""
22+
23+
allowed_values = {
24+
"SUSPICIOUS",
25+
"FLAGGED",
26+
}
27+
SUSPICIOUS: ClassVar["SecurityMonitoringRuleCaseActionOptionsFlaggedIPType"]
28+
FLAGGED: ClassVar["SecurityMonitoringRuleCaseActionOptionsFlaggedIPType"]
29+
30+
@cached_property
31+
def openapi_types(_):
32+
return {
33+
"value": (str,),
34+
}
35+
36+
37+
SecurityMonitoringRuleCaseActionOptionsFlaggedIPType.SUSPICIOUS = SecurityMonitoringRuleCaseActionOptionsFlaggedIPType(
38+
"SUSPICIOUS"
39+
)
40+
SecurityMonitoringRuleCaseActionOptionsFlaggedIPType.FLAGGED = SecurityMonitoringRuleCaseActionOptionsFlaggedIPType(
41+
"FLAGGED"
42+
)

‎src/datadog_api_client/v2/model/security_monitoring_rule_case_action_type.py

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,18 +16,20 @@ class SecurityMonitoringRuleCaseActionType(ModelSimple):
1616
"""
1717
The action type.
1818
19-
:param value: Must be one of ["block_ip", "block_user", "user_behavior"].
19+
:param value: Must be one of ["block_ip", "block_user", "user_behavior", "flag_ip"].
2020
:type value: str
2121
"""
2222

2323
allowed_values = {
2424
"block_ip",
2525
"block_user",
2626
"user_behavior",
27+
"flag_ip",
2728
}
2829
BLOCK_IP: ClassVar["SecurityMonitoringRuleCaseActionType"]
2930
BLOCK_USER: ClassVar["SecurityMonitoringRuleCaseActionType"]
3031
USER_BEHAVIOR: ClassVar["SecurityMonitoringRuleCaseActionType"]
32+
FLAG_IP: ClassVar["SecurityMonitoringRuleCaseActionType"]
3133

3234
@cached_property
3335
def openapi_types(_):
@@ -39,3 +41,4 @@ def openapi_types(_):
3941
SecurityMonitoringRuleCaseActionType.BLOCK_IP = SecurityMonitoringRuleCaseActionType("block_ip")
4042
SecurityMonitoringRuleCaseActionType.BLOCK_USER = SecurityMonitoringRuleCaseActionType("block_user")
4143
SecurityMonitoringRuleCaseActionType.USER_BEHAVIOR = SecurityMonitoringRuleCaseActionType("user_behavior")
44+
SecurityMonitoringRuleCaseActionType.FLAG_IP = SecurityMonitoringRuleCaseActionType("flag_ip")

‎src/datadog_api_client/v2/models/__init__.py

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2918,6 +2918,9 @@
29182918
from datadog_api_client.v2.model.security_monitoring_rule_case_action_options import (
29192919
SecurityMonitoringRuleCaseActionOptions,
29202920
)
2921+
from datadog_api_client.v2.model.security_monitoring_rule_case_action_options_flagged_ip_type import (
2922+
SecurityMonitoringRuleCaseActionOptionsFlaggedIPType,
2923+
)
29212924
from datadog_api_client.v2.model.security_monitoring_rule_case_action_type import SecurityMonitoringRuleCaseActionType
29222925
from datadog_api_client.v2.model.security_monitoring_rule_case_create import SecurityMonitoringRuleCaseCreate
29232926
from datadog_api_client.v2.model.security_monitoring_rule_convert_payload import SecurityMonitoringRuleConvertPayload
@@ -5768,6 +5771,7 @@
57685771
"SecurityMonitoringRuleCase",
57695772
"SecurityMonitoringRuleCaseAction",
57705773
"SecurityMonitoringRuleCaseActionOptions",
5774+
"SecurityMonitoringRuleCaseActionOptionsFlaggedIPType",
57715775
"SecurityMonitoringRuleCaseActionType",
57725776
"SecurityMonitoringRuleCaseCreate",
57735777
"SecurityMonitoringRuleConvertPayload",

‎tests/v2/cassettes/test_scenarios/test_create_a_detection_rule_with_type_application_security_returns_ok_response.frozen

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2025-04-09T15:02:05.047Z
1+
2025-07-17T10:35:24.061Z

‎tests/v2/cassettes/test_scenarios/test_create_a_detection_rule_with_type_application_security_returns_ok_response.yaml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
interactions:
22
- request:
3-
body: '{"cases":[{"actions":[{"options":{"duration":900},"type":"block_ip"},{"options":{"userBehaviorName":"behavior"},"type":"user_behavior"}],"condition":"a
3+
body: '{"cases":[{"actions":[{"options":{"duration":900},"type":"block_ip"},{"options":{"userBehaviorName":"behavior"},"type":"user_behavior"},{"options":{"flaggedIPType":"FLAGGED"},"type":"flag_ip"}],"condition":"a
44
> 100000","name":"","notifications":[],"status":"info"}],"filters":[],"groupSignalsBy":["service"],"isEnabled":true,"message":"Test
5-
rule","name":"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1744210925_appsec_rule","options":{"detectionMethod":"threshold","evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"queries":[{"aggregation":"count","distinctFields":[],"groupByFields":["service","@http.client_ip"],"query":"@appsec.security_activity:business_logic.users.login.failure"}],"tags":[],"type":"application_security"}'
5+
rule","name":"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1752748524_appsec_rule","options":{"detectionMethod":"threshold","evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"queries":[{"aggregation":"count","distinctFields":[],"groupByFields":["service","@http.client_ip"],"query":"@appsec.security_activity:business_logic.users.login.failure"}],"tags":[],"type":"application_security"}'
66
headers:
77
accept:
88
- application/json
@@ -12,9 +12,9 @@ interactions:
1212
uri: https://api.datadoghq.com/api/v2/security_monitoring/rules
1313
response:
1414
body:
15-
string: '{"name":"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1744210925_appsec_rule","createdAt":1744210925675,"isDefault":false,"isPartner":false,"isEnabled":true,"isBeta":false,"isDeleted":false,"isDeprecated":false,"queries":[{"query":"@appsec.security_activity:business_logic.users.login.failure","groupByFields":["service","@http.client_ip"],"hasOptionalGroupByFields":false,"distinctFields":[],"aggregation":"count","name":"","dataSource":"app_sec_spans"}],"options":{"evaluationWindow":900,"detectionMethod":"threshold","maxSignalDuration":86400,"keepAlive":3600},"cases":[{"name":"","status":"info","notifications":[],"condition":"a
16-
\u003e 100000","actions":[{"type":"block_ip","options":{"duration":900}},{"type":"user_behavior","options":{"userBehaviorName":"behavior"}}]}],"message":"Test
17-
rule","tags":[],"hasExtendedTitle":false,"type":"application_security","filters":[],"version":1,"id":"lfr-zxg-fyc","blocking":true,"groupSignalsBy":["service"],"dependencies":["business_logic.users.login.failure"],"metadata":{"entities":null,"sources":null},"creationAuthorId":2320499,"creator":{"handle":"9919ec9b-ebc7-49ee-8dc8-03626e717cca","name":"CI
15+
string: '{"name":"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1752748524_appsec_rule","createdAt":1752748524806,"isDefault":false,"isPartner":false,"isEnabled":true,"isBeta":false,"isDeleted":false,"isDeprecated":false,"queries":[{"query":"@appsec.security_activity:business_logic.users.login.failure","groupByFields":["service","@http.client_ip"],"hasOptionalGroupByFields":false,"distinctFields":[],"aggregation":"count","name":"","dataSource":"app_sec_spans"}],"options":{"evaluationWindow":900,"detectionMethod":"threshold","maxSignalDuration":86400,"keepAlive":3600},"cases":[{"name":"","status":"info","notifications":[],"condition":"a
16+
\u003e 100000","actions":[{"type":"block_ip","options":{"duration":900}},{"type":"user_behavior","options":{"userBehaviorName":"behavior"}},{"type":"flag_ip","options":{"flaggedIPType":"FLAGGED"}}]}],"message":"Test
17+
rule","tags":[],"hasExtendedTitle":false,"type":"application_security","filters":[],"version":1,"id":"wgo-lgy-ajy","blocking":true,"groupSignalsBy":["service"],"dependencies":["business_logic.users.login.failure"],"metadata":{"entities":null,"sources":null},"creationAuthorId":2320499,"creator":{"handle":"9919ec9b-ebc7-49ee-8dc8-03626e717cca","name":"CI
1818
Account"},"updater":{"handle":"","name":""}}'
1919
headers:
2020
content-type:
@@ -28,7 +28,7 @@ interactions:
2828
accept:
2929
- '*/*'
3030
method: DELETE
31-
uri: https://api.datadoghq.com/api/v2/security_monitoring/rules/lfr-zxg-fyc
31+
uri: https://api.datadoghq.com/api/v2/security_monitoring/rules/wgo-lgy-ajy
3232
response:
3333
body:
3434
string: ''

0 commit comments

Comments
 (0)