Skip to content

Commit c1fc906

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Create Cloud SIEM histsignals endpoints (#2813)
Co-authored-by: ci.datadog-api-spec <[email protected]>
1 parent 113bb23 commit c1fc906

File tree

9 files changed

+714
-46
lines changed

9 files changed

+714
-46
lines changed

‎.generator/schemas/v2/openapi.yaml

Lines changed: 224 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -433,6 +433,13 @@ components:
433433
required: true
434434
schema:
435435
type: string
436+
HistoricalSignalID:
437+
description: The ID of the historical signal.
438+
in: path
439+
name: histsignal_id
440+
required: true
441+
schema:
442+
type: string
436443
IncidentAttachmentFilterQueryParameter:
437444
description: Specifies which types of attachments are included in the response.
438445
explode: false
@@ -745,6 +752,58 @@ components:
745752
required: true
746753
schema:
747754
type: string
755+
QueryFilterFrom:
756+
description: The minimum timestamp for requested security signals.
757+
example: '2019-01-02T09:42:36.320Z'
758+
in: query
759+
name: filter[from]
760+
required: false
761+
schema:
762+
format: date-time
763+
type: string
764+
QueryFilterSearch:
765+
description: The search query for security signals.
766+
example: security:attack status:high
767+
in: query
768+
name: filter[query]
769+
required: false
770+
schema:
771+
type: string
772+
QueryFilterTo:
773+
description: The maximum timestamp for requested security signals.
774+
example: '2019-01-03T09:42:36.320Z'
775+
in: query
776+
name: filter[to]
777+
required: false
778+
schema:
779+
format: date-time
780+
type: string
781+
QueryPageCursor:
782+
description: A list of results using the cursor provided in the previous query.
783+
example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
784+
in: query
785+
name: page[cursor]
786+
required: false
787+
schema:
788+
type: string
789+
QueryPageLimit:
790+
description: The maximum number of security signals in the response.
791+
example: 25
792+
in: query
793+
name: page[limit]
794+
required: false
795+
schema:
796+
default: 10
797+
format: int32
798+
maximum: 1000
799+
type: integer
800+
QuerySort:
801+
description: The order of the security signals in results.
802+
in: query
803+
name: sort
804+
required: false
805+
schema:
806+
$ref: '#/components/schemas/SecurityMonitoringSignalsSort'
748807
RelationInclude:
749808
description: Include relationship data.
750809
explode: true
@@ -65338,52 +65397,12 @@ paths:
6533865397
security signals.'
6533965398
operationId: ListSecurityMonitoringSignals
6534065399
parameters:
65341-
- description: The search query for security signals.
65342-
example: security:attack status:high
65343-
in: query
65344-
name: filter[query]
65345-
required: false
65346-
schema:
65347-
type: string
65348-
- description: The minimum timestamp for requested security signals.
65349-
example: '2019-01-02T09:42:36.320Z'
65350-
in: query
65351-
name: filter[from]
65352-
required: false
65353-
schema:
65354-
format: date-time
65355-
type: string
65356-
- description: The maximum timestamp for requested security signals.
65357-
example: '2019-01-03T09:42:36.320Z'
65358-
in: query
65359-
name: filter[to]
65360-
required: false
65361-
schema:
65362-
format: date-time
65363-
type: string
65364-
- description: The order of the security signals in results.
65365-
in: query
65366-
name: sort
65367-
required: false
65368-
schema:
65369-
$ref: '#/components/schemas/SecurityMonitoringSignalsSort'
65370-
- description: A list of results using the cursor provided in the previous query.
65371-
example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
65372-
in: query
65373-
name: page[cursor]
65374-
required: false
65375-
schema:
65376-
type: string
65377-
- description: The maximum number of security signals in the response.
65378-
example: 25
65379-
in: query
65380-
name: page[limit]
65381-
required: false
65382-
schema:
65383-
default: 10
65384-
format: int32
65385-
maximum: 1000
65386-
type: integer
65400+
- $ref: '#/components/parameters/QueryFilterSearch'
65401+
- $ref: '#/components/parameters/QueryFilterFrom'
65402+
- $ref: '#/components/parameters/QueryFilterTo'
65403+
- $ref: '#/components/parameters/QuerySort'
65404+
- $ref: '#/components/parameters/QueryPageCursor'
65405+
- $ref: '#/components/parameters/QueryPageLimit'
6538765406
responses:
6538865407
'200':
6538965408
content:
@@ -66664,6 +66683,123 @@ paths:
6666466683
permissions:
6666566684
- incident_settings_write
6666666685
x-unstable: '**Note**: This endpoint is deprecated.'
66686+
/api/v2/siem-historical-detections/histsignals:
66687+
get:
66688+
description: List hist signals.
66689+
operationId: ListSecurityMonitoringHistsignals
66690+
parameters:
66691+
- $ref: '#/components/parameters/QueryFilterSearch'
66692+
- $ref: '#/components/parameters/QueryFilterFrom'
66693+
- $ref: '#/components/parameters/QueryFilterTo'
66694+
- $ref: '#/components/parameters/QuerySort'
66695+
- $ref: '#/components/parameters/QueryPageCursor'
66696+
- $ref: '#/components/parameters/QueryPageLimit'
66697+
responses:
66698+
'200':
66699+
content:
66700+
application/json:
66701+
schema:
66702+
$ref: '#/components/schemas/SecurityMonitoringSignalsListResponse'
66703+
description: OK
66704+
'400':
66705+
$ref: '#/components/responses/BadRequestResponse'
66706+
'403':
66707+
$ref: '#/components/responses/NotAuthorizedResponse'
66708+
'404':
66709+
$ref: '#/components/responses/NotFoundResponse'
66710+
'429':
66711+
$ref: '#/components/responses/TooManyRequestsResponse'
66712+
security:
66713+
- apiKeyAuth: []
66714+
appKeyAuth: []
66715+
- AuthZ:
66716+
- security_monitoring_signals_read
66717+
summary: List hist signals
66718+
tags:
66719+
- Security Monitoring
66720+
x-permission:
66721+
operator: OR
66722+
permissions:
66723+
- security_monitoring_signals_read
66724+
x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
66725+
66726+
Please check the documentation regularly for updates.'
66727+
/api/v2/siem-historical-detections/histsignals/search:
66728+
get:
66729+
description: Search hist signals.
66730+
operationId: SearchSecurityMonitoringHistsignals
66731+
requestBody:
66732+
content:
66733+
application/json:
66734+
schema:
66735+
$ref: '#/components/schemas/SecurityMonitoringSignalListRequest'
66736+
required: false
66737+
responses:
66738+
'200':
66739+
content:
66740+
application/json:
66741+
schema:
66742+
$ref: '#/components/schemas/SecurityMonitoringSignalsListResponse'
66743+
description: OK
66744+
'400':
66745+
$ref: '#/components/responses/BadRequestResponse'
66746+
'403':
66747+
$ref: '#/components/responses/NotAuthorizedResponse'
66748+
'404':
66749+
$ref: '#/components/responses/NotFoundResponse'
66750+
'429':
66751+
$ref: '#/components/responses/TooManyRequestsResponse'
66752+
security:
66753+
- apiKeyAuth: []
66754+
appKeyAuth: []
66755+
- AuthZ:
66756+
- security_monitoring_signals_read
66757+
summary: Search hist signals
66758+
tags:
66759+
- Security Monitoring
66760+
x-permission:
66761+
operator: OR
66762+
permissions:
66763+
- security_monitoring_signals_read
66764+
x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
66765+
66766+
Please check the documentation regularly for updates.'
66767+
/api/v2/siem-historical-detections/histsignals/{histsignal_id}:
66768+
get:
66769+
description: Get a hist signal's details.
66770+
operationId: GetSecurityMonitoringHistsignal
66771+
parameters:
66772+
- $ref: '#/components/parameters/HistoricalSignalID'
66773+
responses:
66774+
'200':
66775+
content:
66776+
application/json:
66777+
schema:
66778+
$ref: '#/components/schemas/SecurityMonitoringSignalResponse'
66779+
description: OK
66780+
'400':
66781+
$ref: '#/components/responses/BadRequestResponse'
66782+
'403':
66783+
$ref: '#/components/responses/NotAuthorizedResponse'
66784+
'404':
66785+
$ref: '#/components/responses/NotFoundResponse'
66786+
'429':
66787+
$ref: '#/components/responses/TooManyRequestsResponse'
66788+
security:
66789+
- apiKeyAuth: []
66790+
appKeyAuth: []
66791+
- AuthZ:
66792+
- security_monitoring_signals_read
66793+
summary: Get a hist signal's details
66794+
tags:
66795+
- Security Monitoring
66796+
x-permission:
66797+
operator: OR
66798+
permissions:
66799+
- security_monitoring_signals_read
66800+
x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
66801+
66802+
Please check the documentation regularly for updates.'
6666766803
/api/v2/siem-historical-detections/jobs:
6666866804
get:
6666966805
description: List historical jobs.
@@ -66885,6 +67021,48 @@ paths:
6688567021
- security_monitoring_rules_write
6688667022
x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
6688767023

67024+
Please check the documentation regularly for updates.'
67025+
/api/v2/siem-historical-detections/jobs/{job_id}/histsignals:
67026+
get:
67027+
description: Get a job's hist signals.
67028+
operationId: GetSecurityMonitoringHistsignalsByJobId
67029+
parameters:
67030+
- $ref: '#/components/parameters/HistoricalJobID'
67031+
- $ref: '#/components/parameters/QueryFilterSearch'
67032+
- $ref: '#/components/parameters/QueryFilterFrom'
67033+
- $ref: '#/components/parameters/QueryFilterTo'
67034+
- $ref: '#/components/parameters/QuerySort'
67035+
- $ref: '#/components/parameters/QueryPageCursor'
67036+
- $ref: '#/components/parameters/QueryPageLimit'
67037+
responses:
67038+
'200':
67039+
content:
67040+
application/json:
67041+
schema:
67042+
$ref: '#/components/schemas/SecurityMonitoringSignalsListResponse'
67043+
description: OK
67044+
'400':
67045+
$ref: '#/components/responses/BadRequestResponse'
67046+
'403':
67047+
$ref: '#/components/responses/NotAuthorizedResponse'
67048+
'404':
67049+
$ref: '#/components/responses/NotFoundResponse'
67050+
'429':
67051+
$ref: '#/components/responses/TooManyRequestsResponse'
67052+
security:
67053+
- apiKeyAuth: []
67054+
appKeyAuth: []
67055+
- AuthZ:
67056+
- security_monitoring_signals_read
67057+
summary: Get a job's hist signals
67058+
tags:
67059+
- Security Monitoring
67060+
x-permission:
67061+
operator: OR
67062+
permissions:
67063+
- security_monitoring_signals_read
67064+
x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
67065+
6688867066
Please check the documentation regularly for updates.'
6688967067
/api/v2/slo/report:
6689067068
post:

‎examples/v2/security-monitoring/GetSecurityMonitoringHistsignal.py

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
"""
2+
Get a hist signal's details returns "OK" response
3+
"""
4+
5+
from datadog_api_client import ApiClient, Configuration
6+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
7+
8+
configuration = Configuration()
9+
configuration.unstable_operations["get_security_monitoring_histsignal"] = True
10+
with ApiClient(configuration) as api_client:
11+
api_instance = SecurityMonitoringApi(api_client)
12+
response = api_instance.get_security_monitoring_histsignal(
13+
histsignal_id="histsignal_id",
14+
)
15+
16+
print(response)

‎examples/v2/security-monitoring/GetSecurityMonitoringHistsignalsByJobId.py

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
"""
2+
Get a job's hist signals returns "OK" response
3+
"""
4+
5+
from datadog_api_client import ApiClient, Configuration
6+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
7+
8+
configuration = Configuration()
9+
configuration.unstable_operations["get_security_monitoring_histsignals_by_job_id"] = True
10+
with ApiClient(configuration) as api_client:
11+
api_instance = SecurityMonitoringApi(api_client)
12+
response = api_instance.get_security_monitoring_histsignals_by_job_id(
13+
job_id="job_id",
14+
)
15+
16+
print(response)

‎examples/v2/security-monitoring/ListSecurityMonitoringHistsignals.py

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
"""
2+
List hist signals returns "OK" response
3+
"""
4+
5+
from datadog_api_client import ApiClient, Configuration
6+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
7+
8+
configuration = Configuration()
9+
configuration.unstable_operations["list_security_monitoring_histsignals"] = True
10+
with ApiClient(configuration) as api_client:
11+
api_instance = SecurityMonitoringApi(api_client)
12+
response = api_instance.list_security_monitoring_histsignals()
13+
14+
print(response)

‎examples/v2/security-monitoring/SearchSecurityMonitoringHistsignals.py

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
"""
2+
Search hist signals returns "OK" response
3+
"""
4+
5+
from datadog_api_client import ApiClient, Configuration
6+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
7+
from datadog_api_client.v2.model.security_monitoring_signal_list_request import SecurityMonitoringSignalListRequest
8+
from datadog_api_client.v2.model.security_monitoring_signal_list_request_filter import (
9+
SecurityMonitoringSignalListRequestFilter,
10+
)
11+
from datadog_api_client.v2.model.security_monitoring_signal_list_request_page import (
12+
SecurityMonitoringSignalListRequestPage,
13+
)
14+
from datadog_api_client.v2.model.security_monitoring_signals_sort import SecurityMonitoringSignalsSort
15+
from datetime import datetime
16+
from dateutil.tz import tzutc
17+
18+
body = SecurityMonitoringSignalListRequest(
19+
filter=SecurityMonitoringSignalListRequestFilter(
20+
_from=datetime(2019, 1, 2, 9, 42, 36, 320000, tzinfo=tzutc()),
21+
query="security:attack status:high",
22+
to=datetime(2019, 1, 3, 9, 42, 36, 320000, tzinfo=tzutc()),
23+
),
24+
page=SecurityMonitoringSignalListRequestPage(
25+
cursor="eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==",
26+
limit=25,
27+
),
28+
sort=SecurityMonitoringSignalsSort.TIMESTAMP_ASCENDING,
29+
)
30+
31+
configuration = Configuration()
32+
configuration.unstable_operations["search_security_monitoring_histsignals"] = True
33+
with ApiClient(configuration) as api_client:
34+
api_instance = SecurityMonitoringApi(api_client)
35+
response = api_instance.search_security_monitoring_histsignals(body=body)
36+
37+
print(response)

0 commit comments

Comments
 (0)