|
2 | 2 | Update an existing rule returns "OK" response
|
3 | 3 | """
|
4 | 4 |
|
| 5 | +from os import environ |
5 | 6 | from datadog_api_client import ApiClient, Configuration
|
6 | 7 | from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
|
7 |
| -from datadog_api_client.v2.model.security_monitoring_filter import SecurityMonitoringFilter |
8 |
| -from datadog_api_client.v2.model.security_monitoring_filter_action import SecurityMonitoringFilterAction |
9 | 8 | from datadog_api_client.v2.model.security_monitoring_rule_case import SecurityMonitoringRuleCase
|
10 |
| -from datadog_api_client.v2.model.security_monitoring_rule_detection_method import SecurityMonitoringRuleDetectionMethod |
11 | 9 | from datadog_api_client.v2.model.security_monitoring_rule_evaluation_window import (
|
12 | 10 | SecurityMonitoringRuleEvaluationWindow,
|
13 | 11 | )
|
14 |
| -from datadog_api_client.v2.model.security_monitoring_rule_hardcoded_evaluator_type import ( |
15 |
| - SecurityMonitoringRuleHardcodedEvaluatorType, |
16 |
| -) |
17 |
| -from datadog_api_client.v2.model.security_monitoring_rule_impossible_travel_options import ( |
18 |
| - SecurityMonitoringRuleImpossibleTravelOptions, |
19 |
| -) |
20 | 12 | from datadog_api_client.v2.model.security_monitoring_rule_keep_alive import SecurityMonitoringRuleKeepAlive
|
21 | 13 | from datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration import (
|
22 | 14 | SecurityMonitoringRuleMaxSignalDuration,
|
23 | 15 | )
|
24 |
| -from datadog_api_client.v2.model.security_monitoring_rule_new_value_options import SecurityMonitoringRuleNewValueOptions |
25 |
| -from datadog_api_client.v2.model.security_monitoring_rule_new_value_options_forget_after import ( |
26 |
| - SecurityMonitoringRuleNewValueOptionsForgetAfter, |
27 |
| -) |
28 |
| -from datadog_api_client.v2.model.security_monitoring_rule_new_value_options_learning_duration import ( |
29 |
| - SecurityMonitoringRuleNewValueOptionsLearningDuration, |
30 |
| -) |
31 |
| -from datadog_api_client.v2.model.security_monitoring_rule_new_value_options_learning_method import ( |
32 |
| - SecurityMonitoringRuleNewValueOptionsLearningMethod, |
33 |
| -) |
34 |
| -from datadog_api_client.v2.model.security_monitoring_rule_new_value_options_learning_threshold import ( |
35 |
| - SecurityMonitoringRuleNewValueOptionsLearningThreshold, |
36 |
| -) |
37 | 16 | from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions
|
38 | 17 | from datadog_api_client.v2.model.security_monitoring_rule_query_aggregation import (
|
39 | 18 | SecurityMonitoringRuleQueryAggregation,
|
|
42 | 21 | from datadog_api_client.v2.model.security_monitoring_rule_update_payload import SecurityMonitoringRuleUpdatePayload
|
43 | 22 | from datadog_api_client.v2.model.security_monitoring_standard_rule_query import SecurityMonitoringStandardRuleQuery
|
44 | 23 |
|
| 24 | +# there is a valid "security_rule" in the system |
| 25 | +SECURITY_RULE_ID = environ["SECURITY_RULE_ID"] |
| 26 | + |
45 | 27 | body = SecurityMonitoringRuleUpdatePayload(
|
46 |
| - cases=[ |
47 |
| - SecurityMonitoringRuleCase( |
48 |
| - notifications=[], |
49 |
| - status=SecurityMonitoringRuleSeverity.CRITICAL, |
50 |
| - ), |
51 |
| - ], |
52 |
| - filters=[ |
53 |
| - SecurityMonitoringFilter( |
54 |
| - action=SecurityMonitoringFilterAction.REQUIRE, |
55 |
| - ), |
56 |
| - ], |
57 |
| - has_extended_title=True, |
58 |
| - options=SecurityMonitoringRuleOptions( |
59 |
| - decrease_criticality_based_on_env=False, |
60 |
| - detection_method=SecurityMonitoringRuleDetectionMethod.THRESHOLD, |
61 |
| - evaluation_window=SecurityMonitoringRuleEvaluationWindow.ZERO_MINUTES, |
62 |
| - hardcoded_evaluator_type=SecurityMonitoringRuleHardcodedEvaluatorType.LOG4SHELL, |
63 |
| - impossible_travel_options=SecurityMonitoringRuleImpossibleTravelOptions( |
64 |
| - baseline_user_locations=True, |
65 |
| - ), |
66 |
| - keep_alive=SecurityMonitoringRuleKeepAlive.ZERO_MINUTES, |
67 |
| - max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.ZERO_MINUTES, |
68 |
| - new_value_options=SecurityMonitoringRuleNewValueOptions( |
69 |
| - forget_after=SecurityMonitoringRuleNewValueOptionsForgetAfter.ONE_DAY, |
70 |
| - learning_duration=SecurityMonitoringRuleNewValueOptionsLearningDuration.ZERO_DAYS, |
71 |
| - learning_method=SecurityMonitoringRuleNewValueOptionsLearningMethod.DURATION, |
72 |
| - learning_threshold=SecurityMonitoringRuleNewValueOptionsLearningThreshold.ZERO_OCCURRENCES, |
73 |
| - ), |
74 |
| - ), |
| 28 | + name="Example-Update_an_existing_rule_returns_OK_response-Updated", |
75 | 29 | queries=[
|
76 | 30 | SecurityMonitoringStandardRuleQuery(
|
| 31 | + query="@test:true", |
77 | 32 | aggregation=SecurityMonitoringRuleQueryAggregation.COUNT,
|
78 |
| - distinct_fields=[], |
79 | 33 | group_by_fields=[],
|
| 34 | + distinct_fields=[], |
80 | 35 | metrics=[],
|
81 |
| - query="a > 3", |
82 | 36 | ),
|
83 | 37 | ],
|
| 38 | + filters=[], |
| 39 | + cases=[ |
| 40 | + SecurityMonitoringRuleCase( |
| 41 | + name="", |
| 42 | + status=SecurityMonitoringRuleSeverity.INFO, |
| 43 | + condition="a > 0", |
| 44 | + notifications=[], |
| 45 | + ), |
| 46 | + ], |
| 47 | + options=SecurityMonitoringRuleOptions( |
| 48 | + evaluation_window=SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES, |
| 49 | + keep_alive=SecurityMonitoringRuleKeepAlive.ONE_HOUR, |
| 50 | + max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.ONE_DAY, |
| 51 | + ), |
| 52 | + message="Test rule", |
84 | 53 | tags=[],
|
85 |
| - version=1, |
| 54 | + is_enabled=True, |
86 | 55 | )
|
87 | 56 |
|
88 | 57 | configuration = Configuration()
|
89 | 58 | with ApiClient(configuration) as api_client:
|
90 | 59 | api_instance = SecurityMonitoringApi(api_client)
|
91 |
| - response = api_instance.update_security_monitoring_rule(rule_id="rule_id", body=body) |
| 60 | + response = api_instance.update_security_monitoring_rule(rule_id=SECURITY_RULE_ID, body=body) |
92 | 61 |
|
93 | 62 | print(response)
|
0 commit comments