Skip to content

Commit b033c31

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Security Monitoring - Validation Endpoint for Suppressions (#2741)
Co-authored-by: ci.datadog-api-spec <[email protected]>
1 parent 5a7045b commit b033c31

File tree

11 files changed

+357
-0
lines changed

11 files changed

+357
-0
lines changed

‎.generator/schemas/v2/openapi.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64816,6 +64816,38 @@ paths:
6481664816
summary: Get suppressions affecting a specific rule
6481764817
tags:
6481864818
- Security Monitoring
64819+
/api/v2/security_monitoring/configuration/suppressions/validation:
64820+
post:
64821+
description: Validate a suppression rule.
64822+
operationId: ValidateSecurityMonitoringSuppression
64823+
requestBody:
64824+
content:
64825+
application/json:
64826+
schema:
64827+
$ref: '#/components/schemas/SecurityMonitoringSuppressionUpdateRequest'
64828+
required: true
64829+
responses:
64830+
'204':
64831+
description: OK
64832+
'400':
64833+
$ref: '#/components/responses/BadRequestResponse'
64834+
'403':
64835+
$ref: '#/components/responses/NotAuthorizedResponse'
64836+
'429':
64837+
$ref: '#/components/responses/TooManyRequestsResponse'
64838+
security:
64839+
- apiKeyAuth: []
64840+
appKeyAuth: []
64841+
- AuthZ:
64842+
- security_monitoring_suppressions_write
64843+
summary: Validate a suppression rule
64844+
tags:
64845+
- Security Monitoring
64846+
x-codegen-request-body-name: body
64847+
x-permission:
64848+
operator: OR
64849+
permissions:
64850+
- security_monitoring_suppressions_write
6481964851
/api/v2/security_monitoring/configuration/suppressions/{suppression_id}:
6482064852
delete:
6482164853
description: Delete a specific suppression rule.

‎cassettes/v2/Security-Monitoring_1187227211/Validate-a-suppression-rule-returns-Bad-Request-response_1037777113/frozen.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2025-09-01T21:36:42.334Z"

‎cassettes/v2/Security-Monitoring_1187227211/Validate-a-suppression-rule-returns-Bad-Request-response_1037777113/recording.har

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Validate a suppression rule returns \"Bad Request\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "703e6a45408a1cf4017d6f3d7e7b26c9",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 94,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "*/*"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 615,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"data\":{\"attributes\":{\"data_exclusion_query\":\"not enough attributes\"},\"type\":\"suppressions\"}}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/validation"
39+
},
40+
"response": {
41+
"bodySize": 204,
42+
"content": {
43+
"mimeType": "application/json",
44+
"size": 204,
45+
"text": "{\"errors\":[\"input_validation_error(Field 'data.attributes.rule_query' is invalid: field 'rule_query' is required)\",\"input_validation_error(Field 'data.attributes.name' is invalid: name cannot be empty)\"]}"
46+
},
47+
"cookies": [],
48+
"headers": [
49+
{
50+
"name": "content-type",
51+
"value": "application/json"
52+
}
53+
],
54+
"headersSize": 654,
55+
"httpVersion": "HTTP/1.1",
56+
"redirectURL": "",
57+
"status": 400,
58+
"statusText": "Bad Request"
59+
},
60+
"startedDateTime": "2025-09-01T21:36:42.339Z",
61+
"time": 423
62+
}
63+
],
64+
"pages": [],
65+
"version": "1.2"
66+
}
67+
}

‎cassettes/v2/Security-Monitoring_1187227211/Validate-a-suppression-rule-returns-OK-response_4063319893/frozen.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2025-09-01T21:36:20.593Z"

‎cassettes/v2/Security-Monitoring_1187227211/Validate-a-suppression-rule-returns-OK-response_4063319893/recording.har

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Validate a suppression rule returns \"OK\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "7fdeeb56d69b7809c8f48bdeffca83e0",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 285,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "*/*"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 616,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"data\":{\"attributes\":{\"data_exclusion_query\":\"source:cloudtrail account_id:12345\",\"description\":\"This rule suppresses low-severity signals in staging environments.\",\"enabled\":true,\"name\":\"Custom suppression\",\"rule_query\":\"type:log_detection source:cloudtrail\"},\"type\":\"suppressions\"}}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/validation"
39+
},
40+
"response": {
41+
"bodySize": 0,
42+
"content": {
43+
"mimeType": "text/plain",
44+
"size": 0
45+
},
46+
"cookies": [],
47+
"headers": [],
48+
"headersSize": 601,
49+
"httpVersion": "HTTP/1.1",
50+
"redirectURL": "",
51+
"status": 204,
52+
"statusText": "No Content"
53+
},
54+
"startedDateTime": "2025-09-01T21:36:20.597Z",
55+
"time": 501
56+
}
57+
],
58+
"pages": [],
59+
"version": "1.2"
60+
}
61+
}

‎examples/v2/security-monitoring/ValidateSecurityMonitoringSuppression.ts

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
/**
2+
* Validate a suppression rule returns "OK" response
3+
*/
4+
5+
import { client, v2 } from "@datadog/datadog-api-client";
6+
7+
const configuration = client.createConfiguration();
8+
const apiInstance = new v2.SecurityMonitoringApi(configuration);
9+
10+
const params: v2.SecurityMonitoringApiValidateSecurityMonitoringSuppressionRequest =
11+
{
12+
body: {
13+
data: {
14+
attributes: {
15+
dataExclusionQuery: "source:cloudtrail account_id:12345",
16+
description:
17+
"This rule suppresses low-severity signals in staging environments.",
18+
enabled: true,
19+
name: "Custom suppression",
20+
ruleQuery: "type:log_detection source:cloudtrail",
21+
},
22+
type: "suppressions",
23+
},
24+
},
25+
};
26+
27+
apiInstance
28+
.validateSecurityMonitoringSuppression(params)
29+
.then((data: any) => {
30+
console.log(
31+
"API called successfully. Returned data: " + JSON.stringify(data)
32+
);
33+
})
34+
.catch((error: any) => console.error(error));

‎features/support/scenarios_model_mapping.ts

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3895,6 +3895,13 @@ export const ScenariosModelMappings: {[key: string]: {[key: string]: any}} = {
38953895
},
38963896
"operationResponseType": "SecurityMonitoringSuppressionsResponse",
38973897
},
3898+
"v2.ValidateSecurityMonitoringSuppression": {
3899+
"body": {
3900+
"type": "SecurityMonitoringSuppressionUpdateRequest",
3901+
"format": "",
3902+
},
3903+
"operationResponseType": "{}",
3904+
},
38983905
"v2.GetSecurityMonitoringSuppression": {
38993906
"suppressionId": {
39003907
"type": "string",

‎features/v2/security_monitoring.feature

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1389,3 +1389,17 @@ Feature: Security Monitoring
13891389
And body with value {"cases":[{"name":"","status":"info","notifications":[],"condition":"a > 0"}],"hasExtendedTitle":true,"isEnabled":true,"message":"My security monitoring rule","name":"My security monitoring rule","options":{"evaluationWindow":1800,"keepAlive":1800,"maxSignalDuration":1800,"detectionMethod":"threshold"},"queries":[{"query":"source:source_here","groupByFields":["@userIdentity.assumed_role"],"distinctFields":[],"aggregation":"count","name":""}],"tags":["env:prod","team:security"],"type":"log_detection"}
13901390
When the request is sent
13911391
Then the response status is 204 OK
1392+
1393+
@team:DataDog/k9-cloud-security-platform
1394+
Scenario: Validate a suppression rule returns "Bad Request" response
1395+
Given new "ValidateSecurityMonitoringSuppression" request
1396+
And body with value {"data": {"attributes": {"data_exclusion_query": "not enough attributes"}, "type": "suppressions"}}
1397+
When the request is sent
1398+
Then the response status is 400 Bad Request
1399+
1400+
@team:DataDog/k9-cloud-security-platform
1401+
Scenario: Validate a suppression rule returns "OK" response
1402+
Given new "ValidateSecurityMonitoringSuppression" request
1403+
And body with value {"data": {"attributes": {"data_exclusion_query": "source:cloudtrail account_id:12345", "description": "This rule suppresses low-severity signals in staging environments.", "enabled": true, "name": "Custom suppression", "rule_query": "type:log_detection source:cloudtrail"}, "type": "suppressions"}}
1404+
When the request is sent
1405+
Then the response status is 204 OK

‎features/v2/undo.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3024,6 +3024,12 @@
30243024
"type": "safe"
30253025
}
30263026
},
3027+
"ValidateSecurityMonitoringSuppression": {
3028+
"tag": "Security Monitoring",
3029+
"undo": {
3030+
"type": "idempotent"
3031+
}
3032+
},
30273033
"DeleteSecurityMonitoringSuppression": {
30283034
"tag": "Security Monitoring",
30293035
"undo": {

0 commit comments

Comments
 (0)