Skip to content

Commit e17558a

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Improve the spec of Cloud SIEM historical jobs (#1927)
Co-authored-by: ci.datadog-api-spec <[email protected]>
1 parent 1403466 commit e17558a

28 files changed

+356
-92
lines changed

‎.apigentools-info

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
"spec_versions": {
55
"v1": {
66
"apigentools_version": "1.6.6",
7-
"regenerated": "2024-12-18 19:23:38.107841",
8-
"spec_repo_commit": "3f22290a"
7+
"regenerated": "2024-12-19 07:26:26.500720",
8+
"spec_repo_commit": "5dd2cbe4"
99
},
1010
"v2": {
1111
"apigentools_version": "1.6.6",
12-
"regenerated": "2024-12-18 19:23:38.122969",
13-
"spec_repo_commit": "3f22290a"
12+
"regenerated": "2024-12-19 07:26:26.515806",
13+
"spec_repo_commit": "5dd2cbe4"
1414
}
1515
}
1616
}

‎.generator/schemas/v2/openapi.yaml

Lines changed: 76 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -12250,6 +12250,65 @@ components:
1225012250
maximum: 2147483647
1225112251
type: integer
1225212252
type: object
12253+
HistoricalJobOptions:
12254+
description: Job options.
12255+
properties:
12256+
detectionMethod:
12257+
$ref: '#/components/schemas/SecurityMonitoringRuleDetectionMethod'
12258+
evaluationWindow:
12259+
$ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
12260+
impossibleTravelOptions:
12261+
$ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptions'
12262+
keepAlive:
12263+
$ref: '#/components/schemas/SecurityMonitoringRuleKeepAlive'
12264+
maxSignalDuration:
12265+
$ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
12266+
newValueOptions:
12267+
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
12268+
thirdPartyRuleOptions:
12269+
$ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
12270+
type: object
12271+
HistoricalJobQuery:
12272+
description: Query for selecting logs analyzed by the historical job.
12273+
properties:
12274+
aggregation:
12275+
$ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
12276+
distinctFields:
12277+
description: Field for which the cardinality is measured. Sent as an array.
12278+
items:
12279+
description: Field.
12280+
type: string
12281+
type: array
12282+
groupByFields:
12283+
description: Fields to group by.
12284+
items:
12285+
description: Field.
12286+
type: string
12287+
type: array
12288+
hasOptionalGroupByFields:
12289+
description: When false, events without a group-by value are ignored by
12290+
the query. When true, events with missing group-by fields are processed
12291+
with `N/A`, replacing the missing values.
12292+
example: false
12293+
readOnly: true
12294+
type: boolean
12295+
metrics:
12296+
description: Group of target fields to aggregate over when using the sum,
12297+
max, geo data, or new value aggregations. The sum, max, and geo data aggregations
12298+
only accept one value in this list, whereas the new value aggregation
12299+
accepts up to five values.
12300+
items:
12301+
description: Field.
12302+
type: string
12303+
type: array
12304+
name:
12305+
description: Name of the query.
12306+
type: string
12307+
query:
12308+
description: Query to run on logs.
12309+
example: a > 3
12310+
type: string
12311+
type: object
1225312312
HistoricalJobResponse:
1225412313
description: Historical job response.
1225512314
properties:
@@ -14824,13 +14883,6 @@ components:
1482414883
items:
1482514884
$ref: '#/components/schemas/SecurityMonitoringRuleCaseCreate'
1482614885
type: array
14827-
filters:
14828-
description: Additional queries to filter matched events before they are
14829-
processed. This field is deprecated for log detection, signal correlation,
14830-
and workload security rules.
14831-
items:
14832-
$ref: '#/components/schemas/SecurityMonitoringFilter'
14833-
type: array
1483414886
from:
1483514887
description: Starting time of data analyzed by the job.
1483614888
example: 1729843470000
@@ -14849,14 +14901,14 @@ components:
1484914901
example: Excessive number of failed attempts.
1485014902
type: string
1485114903
options:
14852-
$ref: '#/components/schemas/SecurityMonitoringRuleOptions'
14904+
$ref: '#/components/schemas/HistoricalJobOptions'
1485314905
queries:
1485414906
description: Queries for selecting logs analyzed by the job.
1485514907
items:
14856-
$ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
14908+
$ref: '#/components/schemas/HistoricalJobQuery'
1485714909
type: array
1485814910
referenceTables:
14859-
description: Reference tables for the rule.
14911+
description: Reference tables used in the queries.
1486014912
items:
1486114913
$ref: '#/components/schemas/SecurityMonitoringReferenceTable'
1486214914
type: array
@@ -14866,8 +14918,8 @@ components:
1486614918
type: string
1486714919
type: array
1486814920
thirdPartyCases:
14869-
description: Cases for generating results from third-party rules. Only available
14870-
for third-party rules.
14921+
description: Cases for generating results from third-party detection method.
14922+
Only available for third-party detection method.
1487114923
example: []
1487214924
items:
1487314925
$ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate'
@@ -22792,7 +22844,7 @@ components:
2279222844
$ref: '#/components/schemas/ResponseMetaAttributes'
2279322845
type: object
2279422846
SecurityMonitoringReferenceTable:
22795-
description: Reference table for the rule.
22847+
description: Reference tables used in the queries.
2279622848
properties:
2279722849
checkPresence:
2279822850
description: Whether to include or exclude the matched values.
@@ -22804,7 +22856,7 @@ components:
2280422856
description: The field in the log to match against the reference table.
2280522857
type: string
2280622858
ruleQueryName:
22807-
description: The name of the rule query to apply the reference table to.
22859+
description: The name of the query to apply the reference table to.
2280822860
type: string
2280922861
tableName:
2281022862
description: The name of the reference table.
@@ -22835,7 +22887,7 @@ components:
2283522887
description: Case when signal is generated.
2283622888
properties:
2283722889
condition:
22838-
description: 'A rule case contains logical operations (`>`,`>=`, `&&`, `||`)
22890+
description: 'A case contains logical operations (`>`,`>=`, `&&`, `||`)
2283922891
to determine if a signal should be generated
2284022892

2284122893
based on the event counts in the previously defined queries.'
@@ -22844,7 +22896,7 @@ components:
2284422896
description: Name of the case.
2284522897
type: string
2284622898
notifications:
22847-
description: Notification targets for each rule case.
22899+
description: Notification targets.
2284822900
items:
2284922901
description: Notification.
2285022902
type: string
@@ -22906,7 +22958,8 @@ components:
2290622958
description: 'A time window is specified to match when at least one of the cases
2290722959
matches true. This is a sliding window
2290822960

22909-
and evaluates in real time. For third party rules, this field is not used.'
22961+
and evaluates in real time. For third party detection method, this field is
22962+
not used.'
2291022963
enum:
2291122964
- 0
2291222965
- 60
@@ -22935,7 +22988,7 @@ components:
2293522988
x-enum-varnames:
2293622989
- LOG4SHELL
2293722990
SecurityMonitoringRuleImpossibleTravelOptions:
22938-
description: Options on impossible travel rules.
22991+
description: Options on impossible travel detection method.
2293922992
properties:
2294022993
baselineUserLocations:
2294122994
$ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations'
@@ -22951,7 +23004,7 @@ components:
2295123004
SecurityMonitoringRuleKeepAlive:
2295223005
description: "Once a signal is generated, the signal will remain \u201Copen\u201D
2295323006
if a case is matched at least once within\nthis keep alive window. For third
22954-
party rules, this field is not used."
23007+
party detection method, this field is not used."
2295523008
enum:
2295623009
- 0
2295723010
- 60
@@ -23009,7 +23062,7 @@ components:
2300923062
- TWELVE_HOURS
2301023063
- ONE_DAY
2301123064
SecurityMonitoringRuleNewValueOptions:
23012-
description: Options on new value rules.
23065+
description: Options on new value detection method.
2301323066
properties:
2301423067
forgetAfter:
2301523068
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter'
@@ -23079,7 +23132,7 @@ components:
2307923132
- ZERO_OCCURRENCES
2308023133
- ONE_OCCURRENCE
2308123134
SecurityMonitoringRuleOptions:
23082-
description: Options on rules.
23135+
description: Options.
2308323136
properties:
2308423137
complianceRuleOptions:
2308523138
$ref: '#/components/schemas/CloudConfigurationComplianceRuleOptions'
@@ -23221,7 +23274,7 @@ components:
2322123274
type: array
2322223275
type: object
2322323276
SecurityMonitoringRuleThirdPartyOptions:
23224-
description: Options on third party rules.
23277+
description: Options on third party detection method.
2322523278
properties:
2322623279
defaultNotifications:
2322723280
description: Notification targets for the logs that do not correspond to
@@ -24621,7 +24674,7 @@ components:
2462124674
description: Name of the case.
2462224675
type: string
2462324676
notifications:
24624-
description: Notification targets for each rule case.
24677+
description: Notification targets for each case.
2462524678
items:
2462624679
description: Notification.
2462724680
type: string

‎cassettes/v2/Security-Monitoring_1187227211/Get-a-job-s-details-returns-OK-response_1805717789/frozen.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
"2024-11-08T09:54:39.695Z"
1+
"2024-12-18T17:02:38.823Z"

‎cassettes/v2/Security-Monitoring_1187227211/Get-a-job-s-details-returns-OK-response_1805717789/recording.har

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242
"content": {
4343
"mimeType": "application/vnd.api+json",
4444
"size": 87,
45-
"text": "{\"data\":{\"id\":\"f1753ed6-8c47-4168-9d6b-d11b9612fb3c\",\"type\":\"historicalDetectionsJob\"}}"
45+
"text": "{\"data\":{\"id\":\"fa90e7ac-998d-4bf4-9d32-2e831a1e9479\",\"type\":\"historicalDetectionsJob\"}}"
4646
},
4747
"cookies": [],
4848
"headers": [
@@ -57,11 +57,11 @@
5757
"status": 201,
5858
"statusText": "Created"
5959
},
60-
"startedDateTime": "2024-11-08T09:54:39.697Z",
61-
"time": 146
60+
"startedDateTime": "2024-12-18T17:02:39.209Z",
61+
"time": 474
6262
},
6363
{
64-
"_id": "fd2565a2df2009def41ec75cf6591662",
64+
"_id": "7b01960b436d672769de5d7f5dd093c1",
6565
"_order": 0,
6666
"cache": {},
6767
"request": {
@@ -78,14 +78,14 @@
7878
"httpVersion": "HTTP/1.1",
7979
"method": "GET",
8080
"queryString": [],
81-
"url": "https://api.datadoghq.com/api/v2/siem-historical-detections/jobs/f1753ed6-8c47-4168-9d6b-d11b9612fb3c"
81+
"url": "https://api.datadoghq.com/api/v2/siem-historical-detections/jobs/fa90e7ac-998d-4bf4-9d32-2e831a1e9479"
8282
},
8383
"response": {
84-
"bodySize": 927,
84+
"bodySize": 914,
8585
"content": {
8686
"mimeType": "application/vnd.api+json",
87-
"size": 927,
88-
"text": "{\"data\":{\"id\":\"f1753ed6-8c47-4168-9d6b-d11b9612fb3c\",\"type\":\"historicalDetectionsJob\",\"attributes\":{\"createdAt\":\"2024-11-08 09:54:39.761792+00\",\"createdByHandle\":\"9919ec9b-ebc7-49ee-8dc8-03626e717cca\",\"createdByName\":\"CI Account\",\"jobDefinition\":{\"from\":1730387522611,\"to\":1730387532611,\"index\":\"main\",\"name\":\"Excessive number of failed attempts.\",\"cases\":[{\"name\":\"Condition 1\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a \\u003e 1\"}],\"queries\":[{\"query\":\"source:non_existing_src_weekend\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\"}],\"options\":{\"evaluationWindow\":900,\"detectionMethod\":\"threshold\",\"maxSignalDuration\":86400,\"keepAlive\":3600},\"message\":\"A large number of failed login attempts.\",\"tags\":[],\"type\":\"log_detection\",\"filters\":[]},\"jobName\":\"Excessive number of failed attempts.\",\"jobStatus\":\"pending\",\"modifiedAt\":\"2024-11-08 09:54:39.761792+00\"}}}"
87+
"size": 914,
88+
"text": "{\"data\":{\"id\":\"fa90e7ac-998d-4bf4-9d32-2e831a1e9479\",\"type\":\"historicalDetectionsJob\",\"attributes\":{\"createdAt\":\"2024-12-18 17:02:39.551791+00\",\"createdByHandle\":\"9919ec9b-ebc7-49ee-8dc8-03626e717cca\",\"createdByName\":\"CI Account\",\"jobDefinition\":{\"from\":1730387522611,\"to\":1730387532611,\"index\":\"main\",\"name\":\"Excessive number of failed attempts.\",\"cases\":[{\"name\":\"Condition 1\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a \\u003e 1\"}],\"queries\":[{\"query\":\"source:non_existing_src_weekend\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\"}],\"options\":{\"evaluationWindow\":900,\"detectionMethod\":\"threshold\",\"maxSignalDuration\":86400,\"keepAlive\":3600},\"message\":\"A large number of failed login attempts.\",\"tags\":[],\"type\":\"log_detection\"},\"jobName\":\"Excessive number of failed attempts.\",\"jobStatus\":\"pending\",\"modifiedAt\":\"2024-12-18 17:02:39.551791+00\"}}}"
8989
},
9090
"cookies": [],
9191
"headers": [
@@ -100,8 +100,8 @@
100100
"status": 200,
101101
"statusText": "OK"
102102
},
103-
"startedDateTime": "2024-11-08T09:54:39.848Z",
104-
"time": 69
103+
"startedDateTime": "2024-12-18T17:02:39.691Z",
104+
"time": 171
105105
}
106106
],
107107
"pages": [],

‎cassettes/v2/Security-Monitoring_1187227211/List-historical-jobs-returns-OK-response_1213227315/frozen.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
"2024-11-08T09:54:39.932Z"
1+
"2024-12-18T17:02:39.880Z"

‎cassettes/v2/Security-Monitoring_1187227211/List-historical-jobs-returns-OK-response_1213227315/recording.har

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242
"content": {
4343
"mimeType": "application/vnd.api+json",
4444
"size": 87,
45-
"text": "{\"data\":{\"id\":\"34df4a54-9d84-4b4c-bc7e-0464d374ee19\",\"type\":\"historicalDetectionsJob\"}}"
45+
"text": "{\"data\":{\"id\":\"7b16f110-0ce9-46cd-9dad-b658ced2ac50\",\"type\":\"historicalDetectionsJob\"}}"
4646
},
4747
"cookies": [],
4848
"headers": [
@@ -57,11 +57,11 @@
5757
"status": 201,
5858
"statusText": "Created"
5959
},
60-
"startedDateTime": "2024-11-08T09:54:39.935Z",
61-
"time": 98
60+
"startedDateTime": "2024-12-18T17:02:39.882Z",
61+
"time": 402
6262
},
6363
{
64-
"_id": "3de0815b9a4e5dcb86f2d0ef4a3c963f",
64+
"_id": "0728d69cabf496956f86d405f93de5cf",
6565
"_order": 0,
6666
"cache": {},
6767
"request": {
@@ -81,18 +81,18 @@
8181
{
8282
"name": "filter",
8383
"value": {
84-
"query": "id:34df4a54-9d84-4b4c-bc7e-0464d374ee19"
84+
"query": "id:7b16f110-0ce9-46cd-9dad-b658ced2ac50"
8585
}
8686
}
8787
],
88-
"url": "https://api.datadoghq.com/api/v2/siem-historical-detections/jobs?filter%5Bquery%5D=id%3A34df4a54-9d84-4b4c-bc7e-0464d374ee19"
88+
"url": "https://api.datadoghq.com/api/v2/siem-historical-detections/jobs?filter%5Bquery%5D=id%3A7b16f110-0ce9-46cd-9dad-b658ced2ac50"
8989
},
9090
"response": {
91-
"bodySize": 953,
91+
"bodySize": 940,
9292
"content": {
9393
"mimeType": "application/vnd.api+json",
94-
"size": 953,
95-
"text": "{\"data\":[{\"id\":\"34df4a54-9d84-4b4c-bc7e-0464d374ee19\",\"type\":\"historicalDetectionsJob\",\"attributes\":{\"createdAt\":\"2024-11-08 09:54:40.000915+00\",\"createdByHandle\":\"9919ec9b-ebc7-49ee-8dc8-03626e717cca\",\"createdByName\":\"CI Account\",\"jobDefinition\":{\"from\":1730387522611,\"to\":1730387532611,\"index\":\"main\",\"name\":\"Excessive number of failed attempts.\",\"cases\":[{\"name\":\"Condition 1\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a \\u003e 1\"}],\"queries\":[{\"query\":\"source:non_existing_src_weekend\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\"}],\"options\":{\"evaluationWindow\":900,\"detectionMethod\":\"threshold\",\"maxSignalDuration\":86400,\"keepAlive\":3600},\"message\":\"A large number of failed login attempts.\",\"tags\":[],\"type\":\"log_detection\",\"filters\":[]},\"jobName\":\"Excessive number of failed attempts.\",\"jobStatus\":\"pending\",\"modifiedAt\":\"2024-11-08 09:54:40.000915+00\"}}],\"meta\":{\"totalCount\":1}}"
94+
"size": 940,
95+
"text": "{\"data\":[{\"id\":\"7b16f110-0ce9-46cd-9dad-b658ced2ac50\",\"type\":\"historicalDetectionsJob\",\"attributes\":{\"createdAt\":\"2024-12-18 17:02:40.144396+00\",\"createdByHandle\":\"9919ec9b-ebc7-49ee-8dc8-03626e717cca\",\"createdByName\":\"CI Account\",\"jobDefinition\":{\"from\":1730387522611,\"to\":1730387532611,\"index\":\"main\",\"name\":\"Excessive number of failed attempts.\",\"cases\":[{\"name\":\"Condition 1\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a \\u003e 1\"}],\"queries\":[{\"query\":\"source:non_existing_src_weekend\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\"}],\"options\":{\"evaluationWindow\":900,\"detectionMethod\":\"threshold\",\"maxSignalDuration\":86400,\"keepAlive\":3600},\"message\":\"A large number of failed login attempts.\",\"tags\":[],\"type\":\"log_detection\"},\"jobName\":\"Excessive number of failed attempts.\",\"jobStatus\":\"pending\",\"modifiedAt\":\"2024-12-18 17:02:40.144396+00\"}}],\"meta\":{\"totalCount\":1}}"
9696
},
9797
"cookies": [],
9898
"headers": [
@@ -107,8 +107,8 @@
107107
"status": 200,
108108
"statusText": "OK"
109109
},
110-
"startedDateTime": "2024-11-08T09:54:40.040Z",
111-
"time": 62
110+
"startedDateTime": "2024-12-18T17:02:40.290Z",
111+
"time": 189
112112
}
113113
],
114114
"pages": [],

‎packages/datadog-api-client-v2/index.ts

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1315,6 +1315,8 @@ export { GetTeamMembershipsSort } from "./models/GetTeamMembershipsSort";
13151315
export { GroupScalarColumn } from "./models/GroupScalarColumn";
13161316
export { HistoricalJobDataType } from "./models/HistoricalJobDataType";
13171317
export { HistoricalJobListMeta } from "./models/HistoricalJobListMeta";
1318+
export { HistoricalJobOptions } from "./models/HistoricalJobOptions";
1319+
export { HistoricalJobQuery } from "./models/HistoricalJobQuery";
13181320
export { HistoricalJobResponse } from "./models/HistoricalJobResponse";
13191321
export { HistoricalJobResponseAttributes } from "./models/HistoricalJobResponseAttributes";
13201322
export { HistoricalJobResponseData } from "./models/HistoricalJobResponseData";

0 commit comments

Comments
 (0)