Skip to content

Commit 1c123ab

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Add referenceTables field to security monitoring endpoints (#1825)
Co-authored-by: ci.datadog-api-spec <[email protected]>
1 parent 889b87f commit 1c123ab

File tree

14 files changed

+204
-18
lines changed

14 files changed

+204
-18
lines changed

‎.apigentools-info

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
"spec_versions": {
55
"v1": {
66
"apigentools_version": "1.6.6",
7-
"regenerated": "2024-09-30 14:37:34.279249",
8-
"spec_repo_commit": "60bc9127"
7+
"regenerated": "2024-09-30 19:44:33.843136",
8+
"spec_repo_commit": "909e369c"
99
},
1010
"v2": {
1111
"apigentools_version": "1.6.6",
12-
"regenerated": "2024-09-30 14:37:34.293454",
13-
"spec_repo_commit": "60bc9127"
12+
"regenerated": "2024-09-30 19:44:33.857386",
13+
"spec_repo_commit": "909e369c"
1414
}
1515
}
1616
}

‎.generator/schemas/v2/openapi.yaml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19089,6 +19089,25 @@ components:
1908919089
meta:
1909019090
$ref: '#/components/schemas/ResponseMetaAttributes'
1909119091
type: object
19092+
SecurityMonitoringReferenceTable:
19093+
description: Reference table for the rule.
19094+
properties:
19095+
checkPresence:
19096+
description: Whether to include or exclude the matched values.
19097+
type: boolean
19098+
columnName:
19099+
description: The name of the column in the reference table.
19100+
type: string
19101+
logFieldPath:
19102+
description: The field in the log to match against the reference table.
19103+
type: string
19104+
ruleQueryName:
19105+
description: The name of the rule query to apply the reference table to.
19106+
type: string
19107+
tableName:
19108+
description: The name of the reference table.
19109+
type: string
19110+
type: object
1909219111
SecurityMonitoringRuleCase:
1909319112
description: Case when signal is generated.
1909419113
properties:
@@ -19594,6 +19613,11 @@ components:
1959419613
items:
1959519614
$ref: '#/components/schemas/SecurityMonitoringRuleQuery'
1959619615
type: array
19616+
referenceTables:
19617+
description: Reference tables for the rule.
19618+
items:
19619+
$ref: '#/components/schemas/SecurityMonitoringReferenceTable'
19620+
type: array
1959719621
tags:
1959819622
description: Tags for generated signals.
1959919623
items:
@@ -20298,6 +20322,11 @@ components:
2029820322
items:
2029920323
$ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
2030020324
type: array
20325+
referenceTables:
20326+
description: Reference tables for the rule.
20327+
items:
20328+
$ref: '#/components/schemas/SecurityMonitoringReferenceTable'
20329+
type: array
2030120330
tags:
2030220331
description: Tags for generated signals.
2030320332
example:
@@ -20365,6 +20394,11 @@ components:
2036520394
items:
2036620395
$ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
2036720396
type: array
20397+
referenceTables:
20398+
description: Reference tables for the rule.
20399+
items:
20400+
$ref: '#/components/schemas/SecurityMonitoringReferenceTable'
20401+
type: array
2036820402
tags:
2036920403
description: Tags for generated signals.
2037020404
example:
@@ -20505,6 +20539,11 @@ components:
2050520539
items:
2050620540
$ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
2050720541
type: array
20542+
referenceTables:
20543+
description: Reference tables for the rule.
20544+
items:
20545+
$ref: '#/components/schemas/SecurityMonitoringReferenceTable'
20546+
type: array
2050820547
tags:
2050920548
description: Tags for generated signals.
2051020549
items:
@@ -20569,6 +20608,11 @@ components:
2056920608
items:
2057020609
$ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
2057120610
type: array
20611+
referenceTables:
20612+
description: Reference tables for the rule.
20613+
items:
20614+
$ref: '#/components/schemas/SecurityMonitoringReferenceTable'
20615+
type: array
2057220616
tags:
2057320617
description: Tags for generated signals.
2057420618
example:

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-detection-rule-returns-OK-response_1993092739/frozen.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
"2024-05-10T16:34:28.650Z"
1+
"2024-09-11T18:14:46.491Z"

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-detection-rule-returns-OK-response_1993092739/recording.har

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,11 @@
88
},
99
"entries": [
1010
{
11-
"_id": "8974582a809bb984668170c6d78aa628",
11+
"_id": "f8352665e30f024490260f076be3c3ad",
1212
"_order": 0,
1313
"cache": {},
1414
"request": {
15-
"bodySize": 418,
15+
"bodySize": 585,
1616
"cookies": [],
1717
"headers": [
1818
{
@@ -32,17 +32,17 @@
3232
"postData": {
3333
"mimeType": "application/json",
3434
"params": [],
35-
"text": "{\"cases\":[{\"condition\":\"a > 0\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"isEnabled\":true,\"message\":\"Test rule\",\"name\":\"Test-Create_a_detection_rule_returns_OK_response-1715358868\",\"options\":{\"evaluationWindow\":900,\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[],\"metric\":\"\",\"query\":\"@test:true\"}],\"tags\":[],\"type\":\"log_detection\"}"
35+
"text": "{\"cases\":[{\"condition\":\"a > 0\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"isEnabled\":true,\"message\":\"Test rule\",\"name\":\"Test-Create_a_detection_rule_returns_OK_response-1726078486\",\"options\":{\"evaluationWindow\":900,\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[],\"metric\":\"\",\"query\":\"@test:true\"}],\"referenceTables\":[{\"checkPresence\":true,\"columnName\":\"value\",\"logFieldPath\":\"testtag\",\"ruleQueryName\":\"a\",\"tableName\":\"synthetics_test_reference_table_dont_delete\"}],\"tags\":[],\"type\":\"log_detection\"}"
3636
},
3737
"queryString": [],
3838
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules"
3939
},
4040
"response": {
41-
"bodySize": 664,
41+
"bodySize": 846,
4242
"content": {
4343
"mimeType": "application/json",
44-
"size": 664,
45-
"text": "{\"id\":\"oka-fqr-yqa\",\"version\":1,\"name\":\"Test-Create_a_detection_rule_returns_OK_response-1715358868\",\"createdAt\":1715358869030,\"creationAuthorId\":1445416,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"@test:true\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\"}],\"options\":{\"keepAlive\":3600,\"maxSignalDuration\":86400,\"detectionMethod\":\"threshold\",\"evaluationWindow\":900},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a > 0\"}],\"message\":\"Test rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"log_detection\",\"filters\":[]}\n"
44+
"size": 846,
45+
"text": "{\"id\":\"5br-mto-gse\",\"version\":1,\"name\":\"Test-Create_a_detection_rule_returns_OK_response-1726078486\",\"createdAt\":1726078486689,\"creationAuthorId\":1445416,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isBeta\":false,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"@test:true\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\"}],\"options\":{\"keepAlive\":3600,\"maxSignalDuration\":86400,\"detectionMethod\":\"threshold\",\"evaluationWindow\":900},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a > 0\"}],\"message\":\"Test rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"log_detection\",\"filters\":[],\"referenceTables\":[{\"tableName\":\"synthetics_test_reference_table_dont_delete\",\"columnName\":\"value\",\"logFieldPath\":\"testtag\",\"checkPresence\":true,\"ruleQueryName\":\"a\"}]}\n"
4646
},
4747
"cookies": [],
4848
"headers": [
@@ -57,11 +57,11 @@
5757
"status": 200,
5858
"statusText": "OK"
5959
},
60-
"startedDateTime": "2024-05-10T16:34:28.654Z",
61-
"time": 436
60+
"startedDateTime": "2024-09-11T18:14:46.492Z",
61+
"time": 212
6262
},
6363
{
64-
"_id": "d3f9139844fe094a07db3845650a283b",
64+
"_id": "6f7f32a6451f8497327978c8caa8ef34",
6565
"_order": 0,
6666
"cache": {},
6767
"request": {
@@ -78,7 +78,7 @@
7878
"httpVersion": "HTTP/1.1",
7979
"method": "DELETE",
8080
"queryString": [],
81-
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules/oka-fqr-yqa"
81+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules/5br-mto-gse"
8282
},
8383
"response": {
8484
"bodySize": 0,
@@ -94,8 +94,8 @@
9494
"status": 204,
9595
"statusText": "No Content"
9696
},
97-
"startedDateTime": "2024-05-10T16:34:29.099Z",
98-
"time": 374
97+
"startedDateTime": "2024-09-11T18:14:46.710Z",
98+
"time": 153
9999
}
100100
],
101101
"pages": [],

‎examples/v2/security-monitoring/CreateSecurityMonitoringRule.ts

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,15 @@ const params: v2.SecurityMonitoringApiCreateSecurityMonitoringRuleRequest = {
3737
tags: [],
3838
isEnabled: true,
3939
type: "log_detection",
40+
referenceTables: [
41+
{
42+
tableName: "synthetics_test_reference_table_dont_delete",
43+
columnName: "value",
44+
logFieldPath: "testtag",
45+
checkPresence: true,
46+
ruleQueryName: "a",
47+
},
48+
],
4049
},
4150
};
4251

‎features/v2/security_monitoring.feature

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,12 +123,13 @@ Feature: Security Monitoring
123123
@skip-validation @team:DataDog/k9-cloud-security-platform
124124
Scenario: Create a detection rule returns "OK" response
125125
Given new "CreateSecurityMonitoringRule" request
126-
And body with value {"name":"{{ unique }}", "queries":[{"query":"@test:true","aggregation":"count","groupByFields":[],"distinctFields":[],"metric":""}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test rule","tags":[],"isEnabled":true, "type":"log_detection"}
126+
And body with value {"name":"{{ unique }}", "queries":[{"query":"@test:true","aggregation":"count","groupByFields":[],"distinctFields":[],"metric":""}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test rule","tags":[],"isEnabled":true, "type":"log_detection", "referenceTables":[{"tableName": "synthetics_test_reference_table_dont_delete", "columnName": "value", "logFieldPath":"testtag", "checkPresence":true, "ruleQueryName":"a"}]}
127127
When the request is sent
128128
Then the response status is 200 OK
129129
And the response "name" is equal to "{{ unique }}"
130130
And the response "type" is equal to "log_detection"
131131
And the response "message" is equal to "Test rule"
132+
And the response "referenceTables" is equal to [{"tableName": "synthetics_test_reference_table_dont_delete", "columnName": "value", "logFieldPath":"testtag", "checkPresence":true, "ruleQueryName":"a"}]
132133

133134
@team:DataDog/k9-cloud-security-platform
134135
Scenario: Create a detection rule with detection method 'third_party' returns "OK" response

‎packages/datadog-api-client-v2/index.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1732,6 +1732,7 @@ export { SecurityFilterUpdateRequest } from "./models/SecurityFilterUpdateReques
17321732
export { SecurityMonitoringFilter } from "./models/SecurityMonitoringFilter";
17331733
export { SecurityMonitoringFilterAction } from "./models/SecurityMonitoringFilterAction";
17341734
export { SecurityMonitoringListRulesResponse } from "./models/SecurityMonitoringListRulesResponse";
1735+
export { SecurityMonitoringReferenceTable } from "./models/SecurityMonitoringReferenceTable";
17351736
export { SecurityMonitoringRuleCase } from "./models/SecurityMonitoringRuleCase";
17361737
export { SecurityMonitoringRuleCaseCreate } from "./models/SecurityMonitoringRuleCaseCreate";
17371738
export { SecurityMonitoringRuleConvertPayload } from "./models/SecurityMonitoringRuleConvertPayload";

‎packages/datadog-api-client-v2/models/ObjectSerializer.ts

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -940,6 +940,7 @@ import { SecurityFilterUpdateRequest } from "./SecurityFilterUpdateRequest";
940940
import { SecurityFiltersResponse } from "./SecurityFiltersResponse";
941941
import { SecurityMonitoringFilter } from "./SecurityMonitoringFilter";
942942
import { SecurityMonitoringListRulesResponse } from "./SecurityMonitoringListRulesResponse";
943+
import { SecurityMonitoringReferenceTable } from "./SecurityMonitoringReferenceTable";
943944
import { SecurityMonitoringRuleCase } from "./SecurityMonitoringRuleCase";
944945
import { SecurityMonitoringRuleCaseCreate } from "./SecurityMonitoringRuleCaseCreate";
945946
import { SecurityMonitoringRuleConvertResponse } from "./SecurityMonitoringRuleConvertResponse";
@@ -2890,6 +2891,7 @@ const typeMap: { [index: string]: any } = {
28902891
SecurityFiltersResponse: SecurityFiltersResponse,
28912892
SecurityMonitoringFilter: SecurityMonitoringFilter,
28922893
SecurityMonitoringListRulesResponse: SecurityMonitoringListRulesResponse,
2894+
SecurityMonitoringReferenceTable: SecurityMonitoringReferenceTable,
28932895
SecurityMonitoringRuleCase: SecurityMonitoringRuleCase,
28942896
SecurityMonitoringRuleCaseCreate: SecurityMonitoringRuleCaseCreate,
28952897
SecurityMonitoringRuleConvertResponse: SecurityMonitoringRuleConvertResponse,

‎packages/datadog-api-client-v2/models/SecurityMonitoringReferenceTable.ts

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
/**
2+
* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
3+
* This product includes software developed at Datadog (https://www.datadoghq.com/).
4+
* Copyright 2020-Present Datadog, Inc.
5+
*/
6+
7+
import { AttributeTypeMap } from "../../datadog-api-client-common/util";
8+
9+
/**
10+
* Reference table for the rule.
11+
*/
12+
export class SecurityMonitoringReferenceTable {
13+
/**
14+
* Whether to include or exclude the matched values.
15+
*/
16+
"checkPresence"?: boolean;
17+
/**
18+
* The name of the column in the reference table.
19+
*/
20+
"columnName"?: string;
21+
/**
22+
* The field in the log to match against the reference table.
23+
*/
24+
"logFieldPath"?: string;
25+
/**
26+
* The name of the rule query to apply the reference table to.
27+
*/
28+
"ruleQueryName"?: string;
29+
/**
30+
* The name of the reference table.
31+
*/
32+
"tableName"?: string;
33+
34+
/**
35+
* A container for additional, undeclared properties.
36+
* This is a holder for any undeclared properties as specified with
37+
* the 'additionalProperties' keyword in the OAS document.
38+
*/
39+
"additionalProperties"?: { [key: string]: any };
40+
41+
/**
42+
* @ignore
43+
*/
44+
"_unparsed"?: boolean;
45+
46+
/**
47+
* @ignore
48+
*/
49+
static readonly attributeTypeMap: AttributeTypeMap = {
50+
checkPresence: {
51+
baseName: "checkPresence",
52+
type: "boolean",
53+
},
54+
columnName: {
55+
baseName: "columnName",
56+
type: "string",
57+
},
58+
logFieldPath: {
59+
baseName: "logFieldPath",
60+
type: "string",
61+
},
62+
ruleQueryName: {
63+
baseName: "ruleQueryName",
64+
type: "string",
65+
},
66+
tableName: {
67+
baseName: "tableName",
68+
type: "string",
69+
},
70+
additionalProperties: {
71+
baseName: "additionalProperties",
72+
type: "any",
73+
},
74+
};
75+
76+
/**
77+
* @ignore
78+
*/
79+
static getAttributeTypeMap(): AttributeTypeMap {
80+
return SecurityMonitoringReferenceTable.attributeTypeMap;
81+
}
82+
83+
public constructor() {}
84+
}

‎packages/datadog-api-client-v2/models/SecurityMonitoringRuleUpdatePayload.ts

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
*/
66
import { CloudConfigurationRuleComplianceSignalOptions } from "./CloudConfigurationRuleComplianceSignalOptions";
77
import { SecurityMonitoringFilter } from "./SecurityMonitoringFilter";
8+
import { SecurityMonitoringReferenceTable } from "./SecurityMonitoringReferenceTable";
89
import { SecurityMonitoringRuleCase } from "./SecurityMonitoringRuleCase";
910
import { SecurityMonitoringRuleOptions } from "./SecurityMonitoringRuleOptions";
1011
import { SecurityMonitoringRuleQuery } from "./SecurityMonitoringRuleQuery";
@@ -52,6 +53,10 @@ export class SecurityMonitoringRuleUpdatePayload {
5253
* Queries for selecting logs which are part of the rule.
5354
*/
5455
"queries"?: Array<SecurityMonitoringRuleQuery>;
56+
/**
57+
* Reference tables for the rule.
58+
*/
59+
"referenceTables"?: Array<SecurityMonitoringReferenceTable>;
5560
/**
5661
* Tags for generated signals.
5762
*/
@@ -117,6 +122,10 @@ export class SecurityMonitoringRuleUpdatePayload {
117122
baseName: "queries",
118123
type: "Array<SecurityMonitoringRuleQuery>",
119124
},
125+
referenceTables: {
126+
baseName: "referenceTables",
127+
type: "Array<SecurityMonitoringReferenceTable>",
128+
},
120129
tags: {
121130
baseName: "tags",
122131
type: "Array<string>",

0 commit comments

Comments
 (0)