Skip to content

Commit 19d8b9d

Browse files
author
ci.datadog-api-spec
committed
Regenerate client from commit b598473 of spec repo
1 parent 364508a commit 19d8b9d

File tree

16 files changed

+627
-0
lines changed

16 files changed

+627
-0
lines changed

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19426,6 +19426,8 @@ components:
1942619426
$ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
1942719427
newValueOptions:
1942819428
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
19429+
sequenceDetectionOptions:
19430+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions'
1942919431
thirdPartyRuleOptions:
1943019432
$ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
1943119433
type: object
@@ -39268,6 +39270,7 @@ components:
3926839270
- hardcoded
3926939271
- third_party
3927039272
- anomaly_threshold
39273+
- sequence_detection
3927139274
type: string
3927239275
x-enum-varnames:
3927339276
- THRESHOLD
@@ -39277,6 +39280,7 @@ components:
3927739280
- HARDCODED
3927839281
- THIRD_PARTY
3927939282
- ANOMALY_THRESHOLD
39283+
- SEQUENCE_DETECTION
3928039284
SecurityMonitoringRuleEvaluationWindow:
3928139285
description: 'A time window is specified to match when at least one of the cases
3928239286
matches true. This is a sliding window
@@ -39490,6 +39494,8 @@ components:
3949039494
$ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
3949139495
newValueOptions:
3949239496
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
39497+
sequenceDetectionOptions:
39498+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions'
3949339499
thirdPartyRuleOptions:
3949439500
$ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
3949539501
type: object
@@ -39565,6 +39571,47 @@ components:
3956539571
oneOf:
3956639572
- $ref: '#/components/schemas/SecurityMonitoringStandardRuleResponse'
3956739573
- $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponse'
39574+
SecurityMonitoringRuleSequenceDetectionOptions:
39575+
description: Options on sequence detection method.
39576+
properties:
39577+
stepTransitions:
39578+
description: Transitions defining the allowed order of steps and their evaluation
39579+
windows.
39580+
items:
39581+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionStepTransition'
39582+
type: array
39583+
steps:
39584+
description: Steps that define the conditions to be matched in sequence.
39585+
items:
39586+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionStep'
39587+
type: array
39588+
type: object
39589+
SecurityMonitoringRuleSequenceDetectionStep:
39590+
description: Step definition for sequence detection containing the step name,
39591+
condition, and evaluation window.
39592+
properties:
39593+
condition:
39594+
description: Condition referencing rule queries (e.g., `a > 0`).
39595+
type: string
39596+
evaluationWindow:
39597+
$ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
39598+
name:
39599+
description: Unique name identifying the step.
39600+
type: string
39601+
type: object
39602+
SecurityMonitoringRuleSequenceDetectionStepTransition:
39603+
description: Transition from a parent step to a child step within a sequence
39604+
detection rule.
39605+
properties:
39606+
child:
39607+
description: Name of the child step.
39608+
type: string
39609+
evaluationWindow:
39610+
$ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
39611+
parent:
39612+
description: Name of the parent step.
39613+
type: string
39614+
type: object
3956839615
SecurityMonitoringRuleSeverity:
3956939616
description: Severity of the Security Signal.
3957039617
enum:

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-detection-rule-with-detection-method-sequence_detection-returns-OK-response_224770692/frozen.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2025-09-12T15:45:55.719Z"

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-detection-rule-with-detection-method-sequence_detection-returns-OK-response_224770692/recording.har‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Create a detection rule with detection method 'sequence_detection' returns \"OK\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "faa8ed427532bf09665284cdbb2daf9c",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 1000,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 589,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"cases\":[{\"condition\":\"step_b > 0\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"isEnabled\":true,\"message\":\"Logs and signals asdf\",\"name\":\"Test-Create_a_detection_rule_with_detection_method_sequence_detection_returns_OK_response-1757691955\",\"options\":{\"detectionMethod\":\"sequence_detection\",\"evaluationWindow\":0,\"keepAlive\":300,\"maxSignalDuration\":600,\"sequenceDetectionOptions\":{\"stepTransitions\":[{\"child\":\"step_b\",\"evaluationWindow\":900,\"parent\":\"step_a\"}],\"steps\":[{\"condition\":\"a > 0\",\"evaluationWindow\":60,\"name\":\"step_a\"},{\"condition\":\"b > 0\",\"evaluationWindow\":60,\"name\":\"step_b\"}]}},\"queries\":[{\"aggregation\":\"count\",\"dataSource\":\"logs\",\"distinctFields\":[],\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"name\":\"\",\"query\":\"service:logs-rule-reducer source:paul test2\"},{\"aggregation\":\"count\",\"dataSource\":\"logs\",\"distinctFields\":[],\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"name\":\"\",\"query\":\"service:logs-rule-reducer source:paul test1\"}],\"tags\":[],\"type\":\"log_detection\"}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules"
39+
},
40+
"response": {
41+
"bodySize": 1378,
42+
"content": {
43+
"mimeType": "application/json",
44+
"size": 1378,
45+
"text": "{\"name\":\"Test-Create_a_detection_rule_with_detection_method_sequence_detection_returns_OK_response-1757691955\",\"createdAt\":1757691955862,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isBeta\":false,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"service:logs-rule-reducer source:paul test2\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\",\"dataSource\":\"logs\"},{\"query\":\"service:logs-rule-reducer source:paul test1\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\",\"dataSource\":\"logs\"}],\"options\":{\"evaluationWindow\":0,\"detectionMethod\":\"sequence_detection\",\"maxSignalDuration\":600,\"keepAlive\":300,\"sequenceDetectionOptions\":{\"steps\":[{\"name\":\"step_a\",\"condition\":\"a \\u003e 0\",\"evaluationWindow\":60},{\"name\":\"step_b\",\"condition\":\"b \\u003e 0\",\"evaluationWindow\":60}],\"stepTransitions\":[{\"parent\":\"step_a\",\"child\":\"step_b\",\"evaluationWindow\":900}]}},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"step_b \\u003e 0\"}],\"message\":\"Logs and signals asdf\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"log_detection\",\"filters\":[],\"version\":1,\"id\":\"k0l-txb-xxx\",\"blocking\":false,\"metadata\":{\"entities\":null,\"sources\":null},\"creationAuthorId\":1445416,\"creator\":{\"handle\":\"[email protected]\",\"name\":\"frog\"},\"updater\":{\"handle\":\"\",\"name\":\"\"}}"
46+
},
47+
"cookies": [],
48+
"headers": [
49+
{
50+
"name": "content-type",
51+
"value": "application/json"
52+
}
53+
],
54+
"headersSize": 655,
55+
"httpVersion": "HTTP/1.1",
56+
"redirectURL": "",
57+
"status": 200,
58+
"statusText": "OK"
59+
},
60+
"startedDateTime": "2025-09-12T15:45:55.723Z",
61+
"time": 207
62+
},
63+
{
64+
"_id": "d7239dc51220cdcb7c3c9788a4feafa5",
65+
"_order": 0,
66+
"cache": {},
67+
"request": {
68+
"bodySize": 0,
69+
"cookies": [],
70+
"headers": [
71+
{
72+
"_fromType": "array",
73+
"name": "accept",
74+
"value": "*/*"
75+
}
76+
],
77+
"headersSize": 536,
78+
"httpVersion": "HTTP/1.1",
79+
"method": "DELETE",
80+
"queryString": [],
81+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules/k0l-txb-xxx"
82+
},
83+
"response": {
84+
"bodySize": 0,
85+
"content": {
86+
"mimeType": "text/plain",
87+
"size": 0
88+
},
89+
"cookies": [],
90+
"headers": [],
91+
"headersSize": 601,
92+
"httpVersion": "HTTP/1.1",
93+
"redirectURL": "",
94+
"status": 204,
95+
"statusText": "No Content"
96+
},
97+
"startedDateTime": "2025-09-12T15:45:55.938Z",
98+
"time": 232
99+
}
100+
],
101+
"pages": [],
102+
"version": "1.2"
103+
}
104+
}

‎cassettes/v2/Security-Monitoring_1187227211/Validate-a-detection-rule-with-detection-method-sequence_detection-returns-OK-response_4291746846/frozen.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2025-09-12T15:43:48.016Z"

‎cassettes/v2/Security-Monitoring_1187227211/Validate-a-detection-rule-with-detection-method-sequence_detection-returns-OK-response_4291746846/recording.har‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Validate a detection rule with detection method 'sequence_detection' returns \"OK\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "7c3af95d617e9512f01309e2f2ec4f07",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 856,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "*/*"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 588,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"cases\":[{\"condition\":\"step_b > 0\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"hasExtendedTitle\":true,\"isEnabled\":true,\"message\":\"My security monitoring rule\",\"name\":\"My security monitoring rule\",\"options\":{\"detectionMethod\":\"sequence_detection\",\"evaluationWindow\":0,\"keepAlive\":300,\"maxSignalDuration\":600,\"sequenceDetectionOptions\":{\"stepTransitions\":[{\"child\":\"step_b\",\"evaluationWindow\":900,\"parent\":\"step_a\"}],\"steps\":[{\"condition\":\"a > 0\",\"evaluationWindow\":60,\"name\":\"step_a\"},{\"condition\":\"b > 0\",\"evaluationWindow\":60,\"name\":\"step_b\"}]}},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[\"@userIdentity.assumed_role\"],\"name\":\"\",\"query\":\"source:source_here\"},{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[],\"name\":\"\",\"query\":\"source:source_here2\"}],\"tags\":[\"env:prod\",\"team:security\"],\"type\":\"log_detection\"}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules/validation"
39+
},
40+
"response": {
41+
"bodySize": 0,
42+
"content": {
43+
"mimeType": "text/plain",
44+
"size": 0
45+
},
46+
"cookies": [],
47+
"headers": [],
48+
"headersSize": 601,
49+
"httpVersion": "HTTP/1.1",
50+
"redirectURL": "",
51+
"status": 204,
52+
"statusText": "No Content"
53+
},
54+
"startedDateTime": "2025-09-12T15:43:48.019Z",
55+
"time": 114
56+
}
57+
],
58+
"pages": [],
59+
"version": "1.2"
60+
}
61+
}

‎examples/v2/security-monitoring/CreateSecurityMonitoringRule_2899714190.ts‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
/**
2+
* Create a detection rule with detection method 'sequence_detection' returns "OK" response
3+
*/
4+
5+
import { client, v2 } from "@datadog/datadog-api-client";
6+
7+
const configuration = client.createConfiguration();
8+
const apiInstance = new v2.SecurityMonitoringApi(configuration);
9+
10+
const params: v2.SecurityMonitoringApiCreateSecurityMonitoringRuleRequest = {
11+
body: {
12+
name: "Example-Security-Monitoring",
13+
type: "log_detection",
14+
isEnabled: true,
15+
queries: [
16+
{
17+
aggregation: "count",
18+
dataSource: "logs",
19+
distinctFields: [],
20+
groupByFields: [],
21+
hasOptionalGroupByFields: false,
22+
name: "",
23+
query: "service:logs-rule-reducer source:paul test2",
24+
},
25+
{
26+
aggregation: "count",
27+
dataSource: "logs",
28+
distinctFields: [],
29+
groupByFields: [],
30+
hasOptionalGroupByFields: false,
31+
name: "",
32+
query: "service:logs-rule-reducer source:paul test1",
33+
},
34+
],
35+
cases: [
36+
{
37+
name: "",
38+
status: "info",
39+
notifications: [],
40+
condition: "step_b > 0",
41+
},
42+
],
43+
message: "Logs and signals asdf",
44+
options: {
45+
detectionMethod: "sequence_detection",
46+
evaluationWindow: 0,
47+
keepAlive: 300,
48+
maxSignalDuration: 600,
49+
sequenceDetectionOptions: {
50+
stepTransitions: [
51+
{
52+
child: "step_b",
53+
evaluationWindow: 900,
54+
parent: "step_a",
55+
},
56+
],
57+
steps: [
58+
{
59+
condition: "a > 0",
60+
evaluationWindow: 60,
61+
name: "step_a",
62+
},
63+
{
64+
condition: "b > 0",
65+
evaluationWindow: 60,
66+
name: "step_b",
67+
},
68+
],
69+
},
70+
},
71+
tags: [],
72+
},
73+
};
74+
75+
apiInstance
76+
.createSecurityMonitoringRule(params)
77+
.then((data: v2.SecurityMonitoringRuleResponse) => {
78+
console.log(
79+
"API called successfully. Returned data: " + JSON.stringify(data)
80+
);
81+
})
82+
.catch((error: any) => console.error(error));

0 commit comments

Comments
 (0)