Skip to content

Commit cdff9e5

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Security Monitoring Suppression - Add data_exclusion_query field (#1593)
Co-authored-by: ci.datadog-api-spec <[email protected]>
1 parent 731296c commit cdff9e5

File tree

15 files changed

+271
-72
lines changed

15 files changed

+271
-72
lines changed

‎.apigentools-info

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
"spec_versions": {
55
"v1": {
66
"apigentools_version": "1.6.6",
7-
"regenerated": "2024-04-09 18:06:02.298382",
8-
"spec_repo_commit": "fc718bc2"
7+
"regenerated": "2024-04-10 15:00:54.233406",
8+
"spec_repo_commit": "7e61ac0f"
99
},
1010
"v2": {
1111
"apigentools_version": "1.6.6",
12-
"regenerated": "2024-04-09 18:06:02.315520",
13-
"spec_repo_commit": "fc718bc2"
12+
"regenerated": "2024-04-10 15:00:54.253458",
13+
"spec_repo_commit": "7e61ac0f"
1414
}
1515
}
1616
}

‎.generator/schemas/v2/openapi.yaml

Lines changed: 23 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18282,6 +18282,13 @@ components:
1828218282
type: integer
1828318283
creator:
1828418284
$ref: '#/components/schemas/SecurityMonitoringUser'
18285+
data_exclusion_query:
18286+
description: An exclusion query on the input data of the security rules,
18287+
which could be logs, Agent events, or other types of data based on the
18288+
security rule. Events matching this query are ignored by any detection
18289+
rules referenced in the suppression rule.
18290+
example: source:cloudtrail account_id:12345
18291+
type: string
1828518292
description:
1828618293
description: A description for the suppression rule.
1828718294
example: This rule suppresses low-severity signals in staging environments.
@@ -18330,6 +18337,13 @@ components:
1833018337
description: Object containing the attributes of the suppression rule to be
1833118338
created.
1833218339
properties:
18340+
data_exclusion_query:
18341+
description: An exclusion query on the input data of the security rules,
18342+
which could be logs, Agent events, or other types of data based on the
18343+
security rule. Events matching this query are ignored by any detection
18344+
rules referenced in the suppression rule.
18345+
example: source:cloudtrail account_id:12345
18346+
type: string
1833318347
description:
1833418348
description: A description for the suppression rule.
1833518349
example: This rule suppresses low-severity signals in staging environments.
@@ -18355,15 +18369,14 @@ components:
1835518369
type: string
1835618370
suppression_query:
1835718371
description: The suppression query of the suppression rule. If a signal
18358-
matches this query, it is suppressed and is not triggered . Same syntax
18359-
as the queries to search signals in the signal explorer.
18372+
matches this query, it is suppressed and is not triggered. It uses the
18373+
same syntax as the queries to search signals in the Signals Explorer.
1836018374
example: env:staging status:low
1836118375
type: string
1836218376
required:
1836318377
- name
1836418378
- enabled
1836518379
- rule_query
18366-
- suppression_query
1836718380
type: object
1836818381
SecurityMonitoringSuppressionCreateData:
1836918382
description: Object for a single suppression rule.
@@ -18407,6 +18420,13 @@ components:
1840718420
SecurityMonitoringSuppressionUpdateAttributes:
1840818421
description: The suppression rule properties to be updated.
1840918422
properties:
18423+
data_exclusion_query:
18424+
description: An exclusion query on the input data of the security rules,
18425+
which could be logs, Agent events, or other types of data based on the
18426+
security rule. Events matching this query are ignored by any detection
18427+
rules referenced in the suppression rule.
18428+
example: source:cloudtrail account_id:12345
18429+
type: string
1841018430
description:
1841118431
description: A description for the suppression rule.
1841218432
example: This rule suppresses low-severity signals in staging environments.

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-suppression-rule-returns-OK-response_1135731355/frozen.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
"2024-01-11T10:06:23.179Z"
1+
"2024-04-08T09:56:58.589Z"

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-suppression-rule-returns-OK-response_1135731355/recording.har

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
},
99
"entries": [
1010
{
11-
"_id": "06dec73058ad7ecc2764224c70dc8bb1",
11+
"_id": "a9dfe34962b8765226958539d321adc0",
1212
"_order": 0,
1313
"cache": {},
1414
"request": {
@@ -32,17 +32,17 @@
3232
"postData": {
3333
"mimeType": "application/json",
3434
"params": [],
35-
"text": "{\"data\":{\"attributes\":{\"description\":\"This rule suppresses low-severity signals in staging environments.\",\"enabled\":true,\"expiration_date\":1703187336000,\"name\":\"Test-Create_a_suppression_rule_returns_OK_response-1704967583\",\"rule_query\":\"type:log_detection source:cloudtrail\",\"suppression_query\":\"env:staging status:low\"},\"type\":\"suppressions\"}}"
35+
"text": "{\"data\":{\"attributes\":{\"description\":\"This rule suppresses low-severity signals in staging environments.\",\"enabled\":true,\"expiration_date\":1703187336000,\"name\":\"Test-Create_a_suppression_rule_returns_OK_response-1712570218\",\"rule_query\":\"type:log_detection source:cloudtrail\",\"suppression_query\":\"env:staging status:low\"},\"type\":\"suppressions\"}}"
3636
},
3737
"queryString": [],
3838
"url": "https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions"
3939
},
4040
"response": {
41-
"bodySize": 543,
41+
"bodySize": 594,
4242
"content": {
4343
"mimeType": "application/json",
44-
"size": 543,
45-
"text": "{\"data\":{\"id\":\"5sx-nhj-htc\",\"attributes\":{\"name\":\"Test-Create_a_suppression_rule_returns_OK_response-1704967583\",\"enabled\":true,\"description\":\"This rule suppresses low-severity signals in staging environments.\",\"rule_query\":\"type:log_detection source:cloudtrail\",\"suppression_query\":\"env:staging status:low\",\"expiration_date\":1703187336000,\"version\":1,\"creation_date\":1704967583506,\"update_date\":1704967583506,\"creator\":{\"name\":null,\"handle\":\"[email protected]\"},\"updater\":{\"name\":null,\"handle\":\"[email protected]\"}},\"type\":\"suppressions\"}}\n"
44+
"size": 594,
45+
"text": "{\"data\":{\"id\":\"mu8-qje-pys\",\"attributes\":{\"name\":\"Test-Create_a_suppression_rule_returns_OK_response-1712570218\",\"enabled\":true,\"description\":\"This rule suppresses low-severity signals in staging environments.\",\"rule_query\":\"type:log_detection source:cloudtrail\",\"suppression_query\":\"env:staging status:low\",\"log_exclusion_query\":\"\",\"data_exclusion_query\":\"\",\"expiration_date\":1703187336000,\"version\":1,\"creation_date\":1712570219298,\"update_date\":1712570219298,\"creator\":{\"name\":null,\"handle\":\"[email protected]\"},\"updater\":{\"name\":null,\"handle\":\"[email protected]\"}},\"type\":\"suppressions\"}}\n"
4646
},
4747
"cookies": [],
4848
"headers": [
@@ -57,11 +57,11 @@
5757
"status": 200,
5858
"statusText": "OK"
5959
},
60-
"startedDateTime": "2024-01-11T10:06:23.183Z",
61-
"time": 351
60+
"startedDateTime": "2024-04-08T09:56:58.592Z",
61+
"time": 832
6262
},
6363
{
64-
"_id": "2d5046a8e77bef3b254426e42b43a7aa",
64+
"_id": "4a92fd5ba337ac2347c574b1bfdf06e6",
6565
"_order": 0,
6666
"cache": {},
6767
"request": {
@@ -78,7 +78,7 @@
7878
"httpVersion": "HTTP/1.1",
7979
"method": "DELETE",
8080
"queryString": [],
81-
"url": "https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/5sx-nhj-htc"
81+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/mu8-qje-pys"
8282
},
8383
"response": {
8484
"bodySize": 0,
@@ -99,8 +99,8 @@
9999
"status": 204,
100100
"statusText": "No Content"
101101
},
102-
"startedDateTime": "2024-01-11T10:06:23.548Z",
103-
"time": 353
102+
"startedDateTime": "2024-04-08T09:56:59.431Z",
103+
"time": 2379
104104
}
105105
],
106106
"pages": [],

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-suppression-rule-with-an-exclusion-query-returns-OK-response_3158025700/frozen.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2024-04-08T09:57:01.815Z"

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-suppression-rule-with-an-exclusion-query-returns-OK-response_3158025700/recording.har

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Create a suppression rule with an exclusion query returns \"OK\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "f761e438cef476d0b59fe66684b8d331",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 366,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 616,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"data\":{\"attributes\":{\"data_exclusion_query\":\"account_id:12345\",\"description\":\"This rule suppresses low-severity signals in staging environments.\",\"enabled\":true,\"expiration_date\":1703187336000,\"name\":\"Test-Create_a_suppression_rule_with_an_exclusion_query_returns_OK_response-1712570221\",\"rule_query\":\"type:log_detection source:cloudtrail\"},\"type\":\"suppressions\"}}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions"
39+
},
40+
"response": {
41+
"bodySize": 628,
42+
"content": {
43+
"mimeType": "application/json",
44+
"size": 628,
45+
"text": "{\"data\":{\"id\":\"2dj-cxs-dg6\",\"attributes\":{\"name\":\"Test-Create_a_suppression_rule_with_an_exclusion_query_returns_OK_response-1712570221\",\"enabled\":true,\"description\":\"This rule suppresses low-severity signals in staging environments.\",\"rule_query\":\"type:log_detection source:cloudtrail\",\"suppression_query\":\"\",\"log_exclusion_query\":\"account_id:12345\",\"data_exclusion_query\":\"account_id:12345\",\"expiration_date\":1703187336000,\"version\":1,\"creation_date\":1712570222285,\"update_date\":1712570222285,\"creator\":{\"name\":null,\"handle\":\"[email protected]\"},\"updater\":{\"name\":null,\"handle\":\"[email protected]\"}},\"type\":\"suppressions\"}}\n"
46+
},
47+
"cookies": [],
48+
"headers": [
49+
{
50+
"name": "content-type",
51+
"value": "application/json"
52+
}
53+
],
54+
"headersSize": 654,
55+
"httpVersion": "HTTP/1.1",
56+
"redirectURL": "",
57+
"status": 200,
58+
"statusText": "OK"
59+
},
60+
"startedDateTime": "2024-04-08T09:57:01.818Z",
61+
"time": 494
62+
},
63+
{
64+
"_id": "c8824d37b2ff1bcd4ce75db594e55a3d",
65+
"_order": 0,
66+
"cache": {},
67+
"request": {
68+
"bodySize": 0,
69+
"cookies": [],
70+
"headers": [
71+
{
72+
"_fromType": "array",
73+
"name": "accept",
74+
"value": "*/*"
75+
}
76+
],
77+
"headersSize": 564,
78+
"httpVersion": "HTTP/1.1",
79+
"method": "DELETE",
80+
"queryString": [],
81+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/2dj-cxs-dg6"
82+
},
83+
"response": {
84+
"bodySize": 0,
85+
"content": {
86+
"mimeType": "text/html; charset=utf-8",
87+
"size": 0
88+
},
89+
"cookies": [],
90+
"headers": [
91+
{
92+
"name": "content-type",
93+
"value": "text/html; charset=utf-8"
94+
}
95+
],
96+
"headersSize": 641,
97+
"httpVersion": "HTTP/1.1",
98+
"redirectURL": "",
99+
"status": 204,
100+
"statusText": "No Content"
101+
},
102+
"startedDateTime": "2024-04-08T09:57:02.321Z",
103+
"time": 619
104+
}
105+
],
106+
"pages": [],
107+
"version": "1.2"
108+
}
109+
}

‎cassettes/v2/Security-Monitoring_1187227211/Get-a-suppression-rule-returns-OK-response_1191933161/frozen.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
"2024-01-11T10:06:31.876Z"
1+
"2024-04-08T09:57:31.186Z"

‎cassettes/v2/Security-Monitoring_1187227211/Get-a-suppression-rule-returns-OK-response_1191933161/recording.har

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
},
99
"entries": [
1010
{
11-
"_id": "50e8bc48db893343e42b8cd91d6f7efd",
11+
"_id": "70e7f137fe190c5a29b70b2c57525341",
1212
"_order": 0,
1313
"cache": {},
1414
"request": {
@@ -32,17 +32,17 @@
3232
"postData": {
3333
"mimeType": "application/json",
3434
"params": [],
35-
"text": "{\"data\":{\"attributes\":{\"description\":\"Test-Get_a_suppression_rule_returns_OK_response-1704967591\",\"enabled\":true,\"name\":\"Test-Get_a_suppression_rule_returns_OK_response-1704967591\",\"rule_query\":\"source:cloudtrail\",\"suppression_query\":\"env:test\"},\"type\":\"suppressions\"}}"
35+
"text": "{\"data\":{\"attributes\":{\"description\":\"Test-Get_a_suppression_rule_returns_OK_response-1712570251\",\"enabled\":true,\"name\":\"Test-Get_a_suppression_rule_returns_OK_response-1712570251\",\"rule_query\":\"source:cloudtrail\",\"suppression_query\":\"env:test\"},\"type\":\"suppressions\"}}"
3636
},
3737
"queryString": [],
3838
"url": "https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions"
3939
},
4040
"response": {
41-
"bodySize": 467,
41+
"bodySize": 518,
4242
"content": {
4343
"mimeType": "application/json",
44-
"size": 467,
45-
"text": "{\"data\":{\"id\":\"vac-d9u-mmr\",\"attributes\":{\"name\":\"Test-Get_a_suppression_rule_returns_OK_response-1704967591\",\"enabled\":true,\"description\":\"Test-Get_a_suppression_rule_returns_OK_response-1704967591\",\"rule_query\":\"source:cloudtrail\",\"suppression_query\":\"env:test\",\"version\":1,\"creation_date\":1704967592204,\"update_date\":1704967592204,\"creator\":{\"name\":null,\"handle\":\"[email protected]\"},\"updater\":{\"name\":null,\"handle\":\"[email protected]\"}},\"type\":\"suppressions\"}}\n"
44+
"size": 518,
45+
"text": "{\"data\":{\"id\":\"zrh-zwa-bgu\",\"attributes\":{\"name\":\"Test-Get_a_suppression_rule_returns_OK_response-1712570251\",\"enabled\":true,\"description\":\"Test-Get_a_suppression_rule_returns_OK_response-1712570251\",\"rule_query\":\"source:cloudtrail\",\"suppression_query\":\"env:test\",\"log_exclusion_query\":\"\",\"data_exclusion_query\":\"\",\"version\":1,\"creation_date\":1712570252683,\"update_date\":1712570252683,\"creator\":{\"name\":null,\"handle\":\"[email protected]\"},\"updater\":{\"name\":null,\"handle\":\"[email protected]\"}},\"type\":\"suppressions\"}}\n"
4646
},
4747
"cookies": [],
4848
"headers": [
@@ -57,11 +57,11 @@
5757
"status": 200,
5858
"statusText": "OK"
5959
},
60-
"startedDateTime": "2024-01-11T10:06:31.882Z",
61-
"time": 351
60+
"startedDateTime": "2024-04-08T09:57:31.192Z",
61+
"time": 1504
6262
},
6363
{
64-
"_id": "c6a4d879042823d3f1738d8ea1756d4d",
64+
"_id": "c16b2d816d76c171a4df4c49a64dffa0",
6565
"_order": 0,
6666
"cache": {},
6767
"request": {
@@ -78,14 +78,14 @@
7878
"httpVersion": "HTTP/1.1",
7979
"method": "GET",
8080
"queryString": [],
81-
"url": "https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/vac-d9u-mmr"
81+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/zrh-zwa-bgu"
8282
},
8383
"response": {
84-
"bodySize": 467,
84+
"bodySize": 518,
8585
"content": {
8686
"mimeType": "application/json",
87-
"size": 467,
88-
"text": "{\"data\":{\"id\":\"vac-d9u-mmr\",\"attributes\":{\"name\":\"Test-Get_a_suppression_rule_returns_OK_response-1704967591\",\"enabled\":true,\"description\":\"Test-Get_a_suppression_rule_returns_OK_response-1704967591\",\"rule_query\":\"source:cloudtrail\",\"suppression_query\":\"env:test\",\"version\":1,\"creation_date\":1704967592204,\"update_date\":1704967592204,\"creator\":{\"name\":null,\"handle\":\"[email protected]\"},\"updater\":{\"name\":null,\"handle\":\"[email protected]\"}},\"type\":\"suppressions\"}}\n"
87+
"size": 518,
88+
"text": "{\"data\":{\"id\":\"zrh-zwa-bgu\",\"attributes\":{\"name\":\"Test-Get_a_suppression_rule_returns_OK_response-1712570251\",\"enabled\":true,\"description\":\"Test-Get_a_suppression_rule_returns_OK_response-1712570251\",\"rule_query\":\"source:cloudtrail\",\"suppression_query\":\"env:test\",\"log_exclusion_query\":\"\",\"data_exclusion_query\":\"\",\"version\":1,\"creation_date\":1712570252683,\"update_date\":1712570252683,\"creator\":{\"name\":null,\"handle\":\"[email protected]\"},\"updater\":{\"name\":null,\"handle\":\"[email protected]\"}},\"type\":\"suppressions\"}}\n"
8989
},
9090
"cookies": [],
9191
"headers": [
@@ -100,11 +100,11 @@
100100
"status": 200,
101101
"statusText": "OK"
102102
},
103-
"startedDateTime": "2024-01-11T10:06:32.242Z",
104-
"time": 335
103+
"startedDateTime": "2024-04-08T09:57:32.705Z",
104+
"time": 499
105105
},
106106
{
107-
"_id": "e4715e193992be164df30b501939f0a5",
107+
"_id": "3146ff65246e3b67bf0cc41e1d553817",
108108
"_order": 0,
109109
"cache": {},
110110
"request": {
@@ -121,7 +121,7 @@
121121
"httpVersion": "HTTP/1.1",
122122
"method": "DELETE",
123123
"queryString": [],
124-
"url": "https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/vac-d9u-mmr"
124+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/zrh-zwa-bgu"
125125
},
126126
"response": {
127127
"bodySize": 0,
@@ -142,8 +142,8 @@
142142
"status": 204,
143143
"statusText": "No Content"
144144
},
145-
"startedDateTime": "2024-01-11T10:06:32.585Z",
146-
"time": 361
145+
"startedDateTime": "2024-04-08T09:57:33.213Z",
146+
"time": 508
147147
}
148148
],
149149
"pages": [],

‎cassettes/v2/Security-Monitoring_1187227211/Update-a-suppression-rule-returns-OK-response_550028888/frozen.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
"2024-01-11T10:06:37.000Z"
1+
"2024-04-08T09:57:43.431Z"

0 commit comments

Comments
 (0)