Skip to content

Commit 8c03982

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Flag IP case action (#798)
Co-authored-by: ci.datadog-api-spec <[email protected]>
1 parent 42deeaf commit 8c03982

10 files changed

+130
-21
lines changed

‎.generated-info‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
{
2-
"spec_repo_commit": "06ccc32",
3-
"generated": "2025-07-21 14:00:09.710"
2+
"spec_repo_commit": "8ca2883",
3+
"generated": "2025-07-22 07:19:53.580"
44
}

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34296,9 +34296,22 @@ components:
3429634296
format: int64
3429734297
minimum: 0
3429834298
type: integer
34299+
flaggedIPType:
34300+
$ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsFlaggedIPType'
3429934301
userBehaviorName:
3430034302
$ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsUserBehaviorName'
3430134303
type: object
34304+
SecurityMonitoringRuleCaseActionOptionsFlaggedIPType:
34305+
description: Used with the case action of type 'flag_ip'. The value specified
34306+
in this field is applied as a flag to the IP addresses.
34307+
enum:
34308+
- SUSPICIOUS
34309+
- FLAGGED
34310+
example: FLAGGED
34311+
type: string
34312+
x-enum-varnames:
34313+
- SUSPICIOUS
34314+
- FLAGGED
3430234315
SecurityMonitoringRuleCaseActionOptionsUserBehaviorName:
3430334316
description: Used with the case action of type 'user_behavior'. The value specified
3430434317
in this field is applied as a risk tag to all users affected by the rule.
@@ -34309,11 +34322,13 @@ components:
3430934322
- block_ip
3431034323
- block_user
3431134324
- user_behavior
34325+
- flag_ip
3431234326
type: string
3431334327
x-enum-varnames:
3431434328
- BLOCK_IP
3431534329
- BLOCK_USER
3431634330
- USER_BEHAVIOR
34331+
- FLAG_IP
3431734332
SecurityMonitoringRuleCaseCreate:
3431834333
description: Case when signal is generated.
3431934334
properties:

‎examples/v2_security-monitoring_CreateSecurityMonitoringRule_1965169892.rs‎

Lines changed: 18 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ use datadog_api_client::datadog;
33
use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;
44
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleCaseAction;
55
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleCaseActionOptions;
6+
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleCaseActionOptionsFlaggedIPType;
67
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleCaseActionType;
78
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleCaseCreate;
89
use datadog_api_client::datadogV2::model::SecurityMonitoringRuleCreatePayload;
@@ -25,18 +26,23 @@ async fn main() {
2526
vec![
2627
SecurityMonitoringRuleCaseCreate::new(SecurityMonitoringRuleSeverity::INFO)
2728
.actions(vec![
28-
SecurityMonitoringRuleCaseAction::new()
29-
.options(
30-
SecurityMonitoringRuleCaseActionOptions::new().duration(900),
31-
)
32-
.type_(SecurityMonitoringRuleCaseActionType::BLOCK_IP),
33-
SecurityMonitoringRuleCaseAction::new()
34-
.options(
35-
SecurityMonitoringRuleCaseActionOptions::new()
36-
.user_behavior_name("behavior".to_string()),
37-
)
38-
.type_(SecurityMonitoringRuleCaseActionType::USER_BEHAVIOR),
39-
])
29+
SecurityMonitoringRuleCaseAction::new()
30+
.options(SecurityMonitoringRuleCaseActionOptions::new().duration(900))
31+
.type_(SecurityMonitoringRuleCaseActionType::BLOCK_IP),
32+
SecurityMonitoringRuleCaseAction::new()
33+
.options(
34+
SecurityMonitoringRuleCaseActionOptions::new()
35+
.user_behavior_name("behavior".to_string()),
36+
)
37+
.type_(SecurityMonitoringRuleCaseActionType::USER_BEHAVIOR),
38+
SecurityMonitoringRuleCaseAction::new()
39+
.options(
40+
SecurityMonitoringRuleCaseActionOptions::new().flagged_ip_type(
41+
SecurityMonitoringRuleCaseActionOptionsFlaggedIPType::FLAGGED,
42+
),
43+
)
44+
.type_(SecurityMonitoringRuleCaseActionType::FLAG_IP),
45+
])
4046
.condition("a > 100000".to_string())
4147
.name("".to_string())
4248
.notifications(vec![]),

‎src/datadogV2/model/mod.rs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4290,6 +4290,8 @@ pub mod model_security_monitoring_rule_case_action;
42904290
pub use self::model_security_monitoring_rule_case_action::SecurityMonitoringRuleCaseAction;
42914291
pub mod model_security_monitoring_rule_case_action_options;
42924292
pub use self::model_security_monitoring_rule_case_action_options::SecurityMonitoringRuleCaseActionOptions;
4293+
pub mod model_security_monitoring_rule_case_action_options_flagged_ip_type;
4294+
pub use self::model_security_monitoring_rule_case_action_options_flagged_ip_type::SecurityMonitoringRuleCaseActionOptionsFlaggedIPType;
42934295
pub mod model_security_monitoring_rule_case_action_type;
42944296
pub use self::model_security_monitoring_rule_case_action_type::SecurityMonitoringRuleCaseActionType;
42954297
pub mod model_security_monitoring_rule_severity;

‎src/datadogV2/model/model_security_monitoring_rule_case_action_options.rs‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@ pub struct SecurityMonitoringRuleCaseActionOptions {
1414
/// Duration of the action in seconds. 0 indicates no expiration.
1515
#[serde(rename = "duration")]
1616
pub duration: Option<i64>,
17+
/// Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses.
18+
#[serde(rename = "flaggedIPType")]
19+
pub flagged_ip_type:
20+
Option<crate::datadogV2::model::SecurityMonitoringRuleCaseActionOptionsFlaggedIPType>,
1721
/// Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
1822
#[serde(rename = "userBehaviorName")]
1923
pub user_behavior_name: Option<String>,
@@ -28,6 +32,7 @@ impl SecurityMonitoringRuleCaseActionOptions {
2832
pub fn new() -> SecurityMonitoringRuleCaseActionOptions {
2933
SecurityMonitoringRuleCaseActionOptions {
3034
duration: None,
35+
flagged_ip_type: None,
3136
user_behavior_name: None,
3237
additional_properties: std::collections::BTreeMap::new(),
3338
_unparsed: false,
@@ -39,6 +44,14 @@ impl SecurityMonitoringRuleCaseActionOptions {
3944
self
4045
}
4146

47+
pub fn flagged_ip_type(
48+
mut self,
49+
value: crate::datadogV2::model::SecurityMonitoringRuleCaseActionOptionsFlaggedIPType,
50+
) -> Self {
51+
self.flagged_ip_type = Some(value);
52+
self
53+
}
54+
4255
pub fn user_behavior_name(mut self, value: String) -> Self {
4356
self.user_behavior_name = Some(value);
4457
self
@@ -77,6 +90,9 @@ impl<'de> Deserialize<'de> for SecurityMonitoringRuleCaseActionOptions {
7790
M: MapAccess<'a>,
7891
{
7992
let mut duration: Option<i64> = None;
93+
let mut flagged_ip_type: Option<
94+
crate::datadogV2::model::SecurityMonitoringRuleCaseActionOptionsFlaggedIPType,
95+
> = None;
8096
let mut user_behavior_name: Option<String> = None;
8197
let mut additional_properties: std::collections::BTreeMap<
8298
String,
@@ -92,6 +108,21 @@ impl<'de> Deserialize<'de> for SecurityMonitoringRuleCaseActionOptions {
92108
}
93109
duration = Some(serde_json::from_value(v).map_err(M::Error::custom)?);
94110
}
111+
"flaggedIPType" => {
112+
if v.is_null() {
113+
continue;
114+
}
115+
flagged_ip_type =
116+
Some(serde_json::from_value(v).map_err(M::Error::custom)?);
117+
if let Some(ref _flagged_ip_type) = flagged_ip_type {
118+
match _flagged_ip_type {
119+
crate::datadogV2::model::SecurityMonitoringRuleCaseActionOptionsFlaggedIPType::UnparsedObject(_flagged_ip_type) => {
120+
_unparsed = true;
121+
},
122+
_ => {}
123+
}
124+
}
125+
}
95126
"userBehaviorName" => {
96127
if v.is_null() {
97128
continue;
@@ -109,6 +140,7 @@ impl<'de> Deserialize<'de> for SecurityMonitoringRuleCaseActionOptions {
109140

110141
let content = SecurityMonitoringRuleCaseActionOptions {
111142
duration,
143+
flagged_ip_type,
112144
user_behavior_name,
113145
additional_properties,
114146
_unparsed,

‎src/datadogV2/model/model_security_monitoring_rule_case_action_options_flagged_ip_type.rs‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
2+
// This product includes software developed at Datadog (https://www.datadoghq.com/).
3+
// Copyright 2019-Present Datadog, Inc.
4+
5+
use serde::{Deserialize, Deserializer, Serialize, Serializer};
6+
7+
#[non_exhaustive]
8+
#[derive(Clone, Debug, Eq, PartialEq)]
9+
pub enum SecurityMonitoringRuleCaseActionOptionsFlaggedIPType {
10+
SUSPICIOUS,
11+
FLAGGED,
12+
UnparsedObject(crate::datadog::UnparsedObject),
13+
}
14+
15+
impl ToString for SecurityMonitoringRuleCaseActionOptionsFlaggedIPType {
16+
fn to_string(&self) -> String {
17+
match self {
18+
Self::SUSPICIOUS => String::from("SUSPICIOUS"),
19+
Self::FLAGGED => String::from("FLAGGED"),
20+
Self::UnparsedObject(v) => v.value.to_string(),
21+
}
22+
}
23+
}
24+
25+
impl Serialize for SecurityMonitoringRuleCaseActionOptionsFlaggedIPType {
26+
fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
27+
where
28+
S: Serializer,
29+
{
30+
match self {
31+
Self::UnparsedObject(v) => v.serialize(serializer),
32+
_ => serializer.serialize_str(self.to_string().as_str()),
33+
}
34+
}
35+
}
36+
37+
impl<'de> Deserialize<'de> for SecurityMonitoringRuleCaseActionOptionsFlaggedIPType {
38+
fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
39+
where
40+
D: Deserializer<'de>,
41+
{
42+
let s: String = String::deserialize(deserializer)?;
43+
Ok(match s.as_str() {
44+
"SUSPICIOUS" => Self::SUSPICIOUS,
45+
"FLAGGED" => Self::FLAGGED,
46+
_ => Self::UnparsedObject(crate::datadog::UnparsedObject {
47+
value: serde_json::Value::String(s.into()),
48+
}),
49+
})
50+
}
51+
}

‎src/datadogV2/model/model_security_monitoring_rule_case_action_type.rs‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ pub enum SecurityMonitoringRuleCaseActionType {
1010
BLOCK_IP,
1111
BLOCK_USER,
1212
USER_BEHAVIOR,
13+
FLAG_IP,
1314
UnparsedObject(crate::datadog::UnparsedObject),
1415
}
1516

@@ -19,6 +20,7 @@ impl ToString for SecurityMonitoringRuleCaseActionType {
1920
Self::BLOCK_IP => String::from("block_ip"),
2021
Self::BLOCK_USER => String::from("block_user"),
2122
Self::USER_BEHAVIOR => String::from("user_behavior"),
23+
Self::FLAG_IP => String::from("flag_ip"),
2224
Self::UnparsedObject(v) => v.value.to_string(),
2325
}
2426
}
@@ -46,6 +48,7 @@ impl<'de> Deserialize<'de> for SecurityMonitoringRuleCaseActionType {
4648
"block_ip" => Self::BLOCK_IP,
4749
"block_user" => Self::BLOCK_USER,
4850
"user_behavior" => Self::USER_BEHAVIOR,
51+
"flag_ip" => Self::FLAG_IP,
4952
_ => Self::UnparsedObject(crate::datadog::UnparsedObject {
5053
value: serde_json::Value::String(s.into()),
5154
}),

‎tests/scenarios/cassettes/v2/security_monitoring/Create-a-detection-rule-with-type-application-security-returns-OK-response.frozen‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2025-04-09T15:02:05.047Z
1+
2025-07-17T10:35:24.061Z

‎tests/scenarios/cassettes/v2/security_monitoring/Create-a-detection-rule-with-type-application-security-returns-OK-response.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
{
44
"request": {
55
"body": {
6-
"string": "{\"cases\":[{\"actions\":[{\"options\":{\"duration\":900},\"type\":\"block_ip\"},{\"options\":{\"userBehaviorName\":\"behavior\"},\"type\":\"user_behavior\"}],\"condition\":\"a > 100000\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"groupSignalsBy\":[\"service\"],\"isEnabled\":true,\"message\":\"Test rule\",\"name\":\"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1744210925_appsec_rule\",\"options\":{\"detectionMethod\":\"threshold\",\"evaluationWindow\":900,\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[\"service\",\"@http.client_ip\"],\"query\":\"@appsec.security_activity:business_logic.users.login.failure\"}],\"tags\":[],\"type\":\"application_security\"}",
6+
"string": "{\"cases\":[{\"actions\":[{\"options\":{\"duration\":900},\"type\":\"block_ip\"},{\"options\":{\"userBehaviorName\":\"behavior\"},\"type\":\"user_behavior\"},{\"options\":{\"flaggedIPType\":\"FLAGGED\"},\"type\":\"flag_ip\"}],\"condition\":\"a > 100000\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"groupSignalsBy\":[\"service\"],\"isEnabled\":true,\"message\":\"Test rule\",\"name\":\"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1752748524_appsec_rule\",\"options\":{\"detectionMethod\":\"threshold\",\"evaluationWindow\":900,\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[\"service\",\"@http.client_ip\"],\"query\":\"@appsec.security_activity:business_logic.users.login.failure\"}],\"tags\":[],\"type\":\"application_security\"}",
77
"encoding": null
88
},
99
"headers": {
@@ -19,7 +19,7 @@
1919
},
2020
"response": {
2121
"body": {
22-
"string": "{\"name\":\"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1744210925_appsec_rule\",\"createdAt\":1744210925675,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isBeta\":false,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"@appsec.security_activity:business_logic.users.login.failure\",\"groupByFields\":[\"service\",\"@http.client_ip\"],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\",\"dataSource\":\"app_sec_spans\"}],\"options\":{\"evaluationWindow\":900,\"detectionMethod\":\"threshold\",\"maxSignalDuration\":86400,\"keepAlive\":3600},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a \\u003e 100000\",\"actions\":[{\"type\":\"block_ip\",\"options\":{\"duration\":900}},{\"type\":\"user_behavior\",\"options\":{\"userBehaviorName\":\"behavior\"}}]}],\"message\":\"Test rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"application_security\",\"filters\":[],\"version\":1,\"id\":\"lfr-zxg-fyc\",\"blocking\":true,\"groupSignalsBy\":[\"service\"],\"dependencies\":[\"business_logic.users.login.failure\"],\"metadata\":{\"entities\":null,\"sources\":null},\"creationAuthorId\":2320499,\"creator\":{\"handle\":\"9919ec9b-ebc7-49ee-8dc8-03626e717cca\",\"name\":\"CI Account\"},\"updater\":{\"handle\":\"\",\"name\":\"\"}}",
22+
"string": "{\"name\":\"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1752748524_appsec_rule\",\"createdAt\":1752748524806,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isBeta\":false,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"@appsec.security_activity:business_logic.users.login.failure\",\"groupByFields\":[\"service\",\"@http.client_ip\"],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\",\"dataSource\":\"app_sec_spans\"}],\"options\":{\"evaluationWindow\":900,\"detectionMethod\":\"threshold\",\"maxSignalDuration\":86400,\"keepAlive\":3600},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a \\u003e 100000\",\"actions\":[{\"type\":\"block_ip\",\"options\":{\"duration\":900}},{\"type\":\"user_behavior\",\"options\":{\"userBehaviorName\":\"behavior\"}},{\"type\":\"flag_ip\",\"options\":{\"flaggedIPType\":\"FLAGGED\"}}]}],\"message\":\"Test rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"application_security\",\"filters\":[],\"version\":1,\"id\":\"wgo-lgy-ajy\",\"blocking\":true,\"groupSignalsBy\":[\"service\"],\"dependencies\":[\"business_logic.users.login.failure\"],\"metadata\":{\"entities\":null,\"sources\":null},\"creationAuthorId\":2320499,\"creator\":{\"handle\":\"9919ec9b-ebc7-49ee-8dc8-03626e717cca\",\"name\":\"CI Account\"},\"updater\":{\"handle\":\"\",\"name\":\"\"}}",
2323
"encoding": null
2424
},
2525
"headers": {
@@ -32,7 +32,7 @@
3232
"message": "OK"
3333
}
3434
},
35-
"recorded_at": "Wed, 09 Apr 2025 15:02:05 GMT"
35+
"recorded_at": "Thu, 17 Jul 2025 10:35:24 GMT"
3636
},
3737
{
3838
"request": {
@@ -43,7 +43,7 @@
4343
]
4444
},
4545
"method": "delete",
46-
"uri": "https://api.datadoghq.com/api/v2/security_monitoring/rules/lfr-zxg-fyc"
46+
"uri": "https://api.datadoghq.com/api/v2/security_monitoring/rules/wgo-lgy-ajy"
4747
},
4848
"response": {
4949
"body": {
@@ -56,7 +56,7 @@
5656
"message": "No Content"
5757
}
5858
},
59-
"recorded_at": "Wed, 09 Apr 2025 15:02:05 GMT"
59+
"recorded_at": "Thu, 17 Jul 2025 10:35:24 GMT"
6060
}
6161
],
6262
"recorded_with": "VCR 6.0.0"

‎tests/scenarios/features/v2/security_monitoring.feature‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,7 +225,7 @@ Feature: Security Monitoring
225225
@skip-validation @team:DataDog/k9-cloud-security-platform
226226
Scenario: Create a detection rule with type 'application_security 'returns "OK" response
227227
Given new "CreateSecurityMonitoringRule" request
228-
And body with value {"type":"application_security","name":"{{unique}}_appsec_rule","queries":[{"query":"@appsec.security_activity:business_logic.users.login.failure","aggregation":"count","groupByFields":["service","@http.client_ip"],"distinctFields":[]}],"filters":[],"cases":[{"name":"","status":"info","notifications":[],"condition":"a > 100000","actions":[{"type":"block_ip","options":{"duration":900}}, {"type":"user_behavior","options":{"userBehaviorName":"behavior"}}]}],"options":{"keepAlive":3600,"maxSignalDuration":86400,"evaluationWindow":900,"detectionMethod":"threshold"},"isEnabled":true,"message":"Test rule","tags":[],"groupSignalsBy":["service"]}
228+
And body with value {"type":"application_security","name":"{{unique}}_appsec_rule","queries":[{"query":"@appsec.security_activity:business_logic.users.login.failure","aggregation":"count","groupByFields":["service","@http.client_ip"],"distinctFields":[]}],"filters":[],"cases":[{"name":"","status":"info","notifications":[],"condition":"a > 100000","actions":[{"type":"block_ip","options":{"duration":900}}, {"type":"user_behavior","options":{"userBehaviorName":"behavior"}}, {"type":"flag_ip","options":{"flaggedIPType":"FLAGGED"}}]}],"options":{"keepAlive":3600,"maxSignalDuration":86400,"evaluationWindow":900,"detectionMethod":"threshold"},"isEnabled":true,"message":"Test rule","tags":[],"groupSignalsBy":["service"]}
229229
When the request is sent
230230
Then the response status is 200 OK
231231
And the response "name" is equal to "{{ unique }}_appsec_rule"

0 commit comments

Comments
 (0)