@@ -7245,72 +7245,11 @@ components:
7245
7245
- GEO_DATA
7246
7246
- EVENT_COUNT
7247
7247
SecurityMonitoringRuleResponse :
7248
- description : Rule.
7249
- properties :
7250
- cases :
7251
- description : Cases for generating signals.
7252
- items :
7253
- $ref : ' #/components/schemas/SecurityMonitoringRuleCase'
7254
- type : array
7255
- createdAt :
7256
- description : When the rule was created, timestamp in milliseconds.
7257
- format : int64
7258
- type : integer
7259
- creationAuthorId :
7260
- description : User ID of the user who created the rule.
7261
- format : int64
7262
- type : integer
7263
- filters :
7264
- description : Additional queries to filter matched events before they are
7265
- processed.
7266
- items :
7267
- $ref : ' #/components/schemas/SecurityMonitoringFilter'
7268
- type : array
7269
- hasExtendedTitle :
7270
- description : Whether the notifications include the triggering group-by values
7271
- in their title.
7272
- type : boolean
7273
- id :
7274
- description : The ID of the rule.
7275
- type : string
7276
- isDefault :
7277
- description : Whether the rule is included by default.
7278
- type : boolean
7279
- isDeleted :
7280
- description : Whether the rule has been deleted.
7281
- type : boolean
7282
- isEnabled :
7283
- description : Whether the rule is enabled.
7284
- type : boolean
7285
- message :
7286
- description : Message for generated signals.
7287
- type : string
7288
- name :
7289
- description : The name of the rule.
7290
- type : string
7291
- options :
7292
- $ref : ' #/components/schemas/SecurityMonitoringRuleOptions'
7293
- queries :
7294
- description : Queries for selecting logs which are part of the rule.
7295
- items :
7296
- $ref : ' #/components/schemas/SecurityMonitoringRuleQuery'
7297
- type : array
7298
- tags :
7299
- description : Tags for generated signals.
7300
- items :
7301
- description : Tag.
7302
- type : string
7303
- type : array
7304
- type :
7305
- $ref : ' #/components/schemas/SecurityMonitoringRuleTypeRead'
7306
- updateAuthorId :
7307
- description : User ID of the user who updated the rule.
7308
- format : int64
7309
- type : integer
7310
- version :
7311
- description : The version of the rule.
7312
- format : int64
7313
- type : integer
7248
+ description : Create a new rule.
7249
+ oneOf :
7250
+ - $ref : ' #/components/schemas/SecurityMonitoringStandardRuleResponse'
7251
+ - $ref : ' #/components/schemas/SecurityMonitoringSignalRuleResponse'
7252
+ type : object
7314
7253
SecurityMonitoringRuleSeverity :
7315
7254
description : Severity of the Security Signal.
7316
7255
enum :
@@ -7340,14 +7279,12 @@ components:
7340
7279
description : The rule type.
7341
7280
enum :
7342
7281
- log_detection
7343
- - signal_correlation
7344
7282
- infrastructure_configuration
7345
7283
- workload_security
7346
7284
- cloud_configuration
7347
7285
type : string
7348
7286
x-enum-varnames :
7349
7287
- LOG_DETECTION
7350
- - SIGNAL_CORRELATION
7351
7288
- INFRASTRUCTURE_CONFIGURATION
7352
7289
- WORKLOAD_SECURITY
7353
7290
- CLOUD_CONFIGURATION
@@ -7611,7 +7548,7 @@ components:
7611
7548
description : Queries for selecting signals which are part of the rule.
7612
7549
example : []
7613
7550
items :
7614
- $ref : ' #/components/schemas/SecurityMonitoringSignalRuleQueryCreate '
7551
+ $ref : ' #/components/schemas/SecurityMonitoringSignalRuleQuery '
7615
7552
type : array
7616
7553
tags :
7617
7554
description : Tags for generated signals.
@@ -7623,7 +7560,7 @@ components:
7623
7560
type : string
7624
7561
type : array
7625
7562
type :
7626
- $ref : ' #/components/schemas/SecurityMonitoringSignalRuleTypeCreate '
7563
+ $ref : ' #/components/schemas/SecurityMonitoringSignalRuleType '
7627
7564
required :
7628
7565
- name
7629
7566
- isEnabled
@@ -7660,42 +7597,79 @@ components:
7660
7597
type : string
7661
7598
ruleId :
7662
7599
description : Rule ID to match on signals.
7600
+ example : d3f-ru1-e1d
7663
7601
type : string
7602
+ required :
7603
+ - ruleId
7664
7604
type : object
7665
- SecurityMonitoringSignalRuleQueryCreate :
7666
- description : Query for matching rule on signals
7605
+ SecurityMonitoringSignalRuleResponse :
7606
+ description : Rule.
7667
7607
properties :
7668
- aggregation :
7669
- $ref : ' #/components/schemas/SecurityMonitoringRuleQueryAggregation'
7670
- correlatedByFields :
7671
- description : Fields to group by.
7608
+ cases :
7609
+ description : Cases for generating signals.
7672
7610
items :
7673
- description : Field.
7674
- type : string
7611
+ $ref : ' #/components/schemas/SecurityMonitoringRuleCase'
7675
7612
type : array
7676
- correlatedQueryIndex :
7677
- description : Index of the rule query used to retrieve the correlated field.
7678
- format : int32
7679
- maximum : 9
7613
+ createdAt :
7614
+ description : When the rule was created, timestamp in milliseconds.
7615
+ format : int64
7680
7616
type : integer
7681
- metrics :
7682
- description : Group of target fields to aggregate over when using the new
7683
- value aggregations.
7617
+ creationAuthorId :
7618
+ description : User ID of the user who created the rule.
7619
+ format : int64
7620
+ type : integer
7621
+ filters :
7622
+ description : Additional queries to filter matched events before they are
7623
+ processed.
7684
7624
items :
7685
- description : Field.
7686
- type : string
7625
+ $ref : ' #/components/schemas/SecurityMonitoringFilter'
7687
7626
type : array
7688
- name :
7689
- description : Name of the query.
7627
+ hasExtendedTitle :
7628
+ description : Whether the notifications include the triggering group-by values
7629
+ in their title.
7630
+ type : boolean
7631
+ id :
7632
+ description : The ID of the rule.
7690
7633
type : string
7691
- ruleId :
7692
- description : Rule ID to match on signals.
7693
- example : d3f-ru1-e1d
7634
+ isDefault :
7635
+ description : Whether the rule is included by default.
7636
+ type : boolean
7637
+ isDeleted :
7638
+ description : Whether the rule has been deleted.
7639
+ type : boolean
7640
+ isEnabled :
7641
+ description : Whether the rule is enabled.
7642
+ type : boolean
7643
+ message :
7644
+ description : Message for generated signals.
7694
7645
type : string
7695
- required :
7696
- - ruleId
7697
- type : object
7698
- SecurityMonitoringSignalRuleTypeCreate :
7646
+ name :
7647
+ description : The name of the rule.
7648
+ type : string
7649
+ options :
7650
+ $ref : ' #/components/schemas/SecurityMonitoringRuleOptions'
7651
+ queries :
7652
+ description : Queries for selecting logs which are part of the rule.
7653
+ items :
7654
+ $ref : ' #/components/schemas/SecurityMonitoringSignalRuleQuery'
7655
+ type : array
7656
+ tags :
7657
+ description : Tags for generated signals.
7658
+ items :
7659
+ description : Tag.
7660
+ type : string
7661
+ type : array
7662
+ type :
7663
+ $ref : ' #/components/schemas/SecurityMonitoringSignalRuleType'
7664
+ updateAuthorId :
7665
+ description : User ID of the user who updated the rule.
7666
+ format : int64
7667
+ type : integer
7668
+ version :
7669
+ description : The version of the rule.
7670
+ format : int64
7671
+ type : integer
7672
+ SecurityMonitoringSignalRuleType :
7699
7673
description : The rule type.
7700
7674
enum :
7701
7675
- signal_correlation
@@ -7896,7 +7870,7 @@ components:
7896
7870
description : Queries for selecting logs which are part of the rule.
7897
7871
example : []
7898
7872
items :
7899
- $ref : ' #/components/schemas/SecurityMonitoringStandardRuleQueryCreate '
7873
+ $ref : ' #/components/schemas/SecurityMonitoringStandardRuleQuery '
7900
7874
type : array
7901
7875
tags :
7902
7876
description : Tags for generated signals.
@@ -7951,47 +7925,78 @@ components:
7951
7925
type : string
7952
7926
query :
7953
7927
description : Query to run on logs.
7928
+ example : a > 3
7954
7929
type : string
7930
+ required :
7931
+ - query
7955
7932
type : object
7956
- SecurityMonitoringStandardRuleQueryCreate :
7957
- description : Query for matching rule .
7933
+ SecurityMonitoringStandardRuleResponse :
7934
+ description : Rule .
7958
7935
properties :
7959
- aggregation :
7960
- $ref : ' #/components/schemas/SecurityMonitoringRuleQueryAggregation'
7961
- distinctFields :
7962
- description : Field for which the cardinality is measured. Sent as an array.
7936
+ cases :
7937
+ description : Cases for generating signals.
7963
7938
items :
7964
- description : Field.
7965
- type : string
7939
+ $ref : ' #/components/schemas/SecurityMonitoringRuleCase'
7966
7940
type : array
7967
- groupByFields :
7968
- description : Fields to group by.
7941
+ createdAt :
7942
+ description : When the rule was created, timestamp in milliseconds.
7943
+ format : int64
7944
+ type : integer
7945
+ creationAuthorId :
7946
+ description : User ID of the user who created the rule.
7947
+ format : int64
7948
+ type : integer
7949
+ filters :
7950
+ description : Additional queries to filter matched events before they are
7951
+ processed.
7969
7952
items :
7970
- description : Field.
7971
- type : string
7953
+ $ref : ' #/components/schemas/SecurityMonitoringFilter'
7972
7954
type : array
7973
- metric :
7974
- description : ' The target field to aggregate over when using the sum or max
7975
-
7976
- aggregations.'
7955
+ hasExtendedTitle :
7956
+ description : Whether the notifications include the triggering group-by values
7957
+ in their title.
7958
+ type : boolean
7959
+ id :
7960
+ description : The ID of the rule.
7977
7961
type : string
7978
- metrics :
7979
- description : Group of target fields to aggregate over when using the new
7980
- value aggregations.
7962
+ isDefault :
7963
+ description : Whether the rule is included by default.
7964
+ type : boolean
7965
+ isDeleted :
7966
+ description : Whether the rule has been deleted.
7967
+ type : boolean
7968
+ isEnabled :
7969
+ description : Whether the rule is enabled.
7970
+ type : boolean
7971
+ message :
7972
+ description : Message for generated signals.
7973
+ type : string
7974
+ name :
7975
+ description : The name of the rule.
7976
+ type : string
7977
+ options :
7978
+ $ref : ' #/components/schemas/SecurityMonitoringRuleOptions'
7979
+ queries :
7980
+ description : Queries for selecting logs which are part of the rule.
7981
7981
items :
7982
- description : Field.
7982
+ $ref : ' #/components/schemas/SecurityMonitoringStandardRuleQuery'
7983
+ type : array
7984
+ tags :
7985
+ description : Tags for generated signals.
7986
+ items :
7987
+ description : Tag.
7983
7988
type : string
7984
7989
type : array
7985
- name :
7986
- description : Name of the query.
7987
- type : string
7988
- query :
7989
- description : Query to run on logs.
7990
- example : a > 3
7991
- type : string
7992
- required :
7993
- - query
7994
- type : object
7990
+ type :
7991
+ $ref : ' #/components/schemas/SecurityMonitoringRuleTypeRead '
7992
+ updateAuthorId :
7993
+ description : User ID of the user who updated the rule.
7994
+ format : int64
7995
+ type : integer
7996
+ version :
7997
+ description : The version of the rule.
7998
+ format : int64
7999
+ type : integer
7995
8000
SecurityMonitoringTriageUser :
7996
8001
description : Object representing a given user entity.
7997
8002
properties :
0 commit comments