Skip to content

Commit f6f28c8

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Add Security Monitoring rule test endpoint (#1634)
Co-authored-by: ci.datadog-api-spec <[email protected]> Co-authored-by: api-clients-generation-pipeline[bot] <54105614+api-clients-generation-pipeline[bot]@users.noreply.github.com>
1 parent c770599 commit f6f28c8

File tree

16 files changed

+972
-4
lines changed

16 files changed

+972
-4
lines changed

‎.apigentools-info‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
"spec_versions": {
55
"v1": {
66
"apigentools_version": "1.6.6",
7-
"regenerated": "2024-05-23 19:28:50.345540",
8-
"spec_repo_commit": "b9b11fda"
7+
"regenerated": "2024-05-28 16:29:26.460549",
8+
"spec_repo_commit": "9445af96"
99
},
1010
"v2": {
1111
"apigentools_version": "1.6.6",
12-
"regenerated": "2024-05-23 19:28:50.363667",
13-
"spec_repo_commit": "b9b11fda"
12+
"regenerated": "2024-05-28 16:29:26.478430",
13+
"spec_repo_commit": "9445af96"
1414
}
1515
}
1616
}

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17407,6 +17407,47 @@ components:
1740717407
- GEO_DATA
1740817408
- EVENT_COUNT
1740917409
- NONE
17410+
SecurityMonitoringRuleQueryPayload:
17411+
description: Payload to test a rule query with the expected result.
17412+
properties:
17413+
expectedResult:
17414+
description: Expected result of the test.
17415+
example: true
17416+
type: boolean
17417+
index:
17418+
description: Index of the query under test.
17419+
example: 0
17420+
format: int64
17421+
minimum: 0
17422+
type: integer
17423+
payload:
17424+
$ref: '#/components/schemas/SecurityMonitoringRuleQueryPayloadData'
17425+
type: object
17426+
SecurityMonitoringRuleQueryPayloadData:
17427+
additionalProperties: {}
17428+
description: Payload used to test the rule query.
17429+
properties:
17430+
ddsource:
17431+
description: Source of the payload.
17432+
example: nginx
17433+
type: string
17434+
ddtags:
17435+
description: Tags associated with your data.
17436+
example: env:staging,version:5.1
17437+
type: string
17438+
hostname:
17439+
description: The name of the originating host of the log.
17440+
example: i-012345678
17441+
type: string
17442+
message:
17443+
description: The message of the payload.
17444+
example: 2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World
17445+
type: string
17446+
service:
17447+
description: The name of the application or service generating the data.
17448+
example: payment
17449+
type: string
17450+
type: object
1741017451
SecurityMonitoringRuleResponse:
1741117452
description: Create a new rule.
1741217453
oneOf:
@@ -17428,6 +17469,31 @@ components:
1742817469
- MEDIUM
1742917470
- HIGH
1743017471
- CRITICAL
17472+
SecurityMonitoringRuleTestRequest:
17473+
description: Test the rule queries of a rule.
17474+
properties:
17475+
rule:
17476+
$ref: '#/components/schemas/SecurityMonitoringRuleCreatePayload'
17477+
ruleQueryPayloads:
17478+
description: Data payloads used to test rules query with the expected result.
17479+
items:
17480+
$ref: '#/components/schemas/SecurityMonitoringRuleQueryPayload'
17481+
type: array
17482+
type: object
17483+
SecurityMonitoringRuleTestResponse:
17484+
description: Result of the test of the rule queries.
17485+
properties:
17486+
results:
17487+
description: 'Assert results are returned in the same order as the rule
17488+
query payloads.
17489+
17490+
For each payload, it returns True if the result matched the expected result,
17491+
17492+
False otherwise.'
17493+
items:
17494+
type: boolean
17495+
type: array
17496+
type: object
1743117497
SecurityMonitoringRuleThirdPartyOptions:
1743217498
description: Options on third party rules.
1743317499
properties:
@@ -32551,6 +32617,42 @@ paths:
3255132617
tags:
3255232618
- Security Monitoring
3255332619
x-codegen-request-body-name: body
32620+
/api/v2/security_monitoring/rules/test:
32621+
post:
32622+
description: Test a rule.
32623+
operationId: TestSecurityMonitoringRule
32624+
requestBody:
32625+
content:
32626+
application/json:
32627+
schema:
32628+
$ref: '#/components/schemas/SecurityMonitoringRuleTestRequest'
32629+
required: true
32630+
responses:
32631+
'200':
32632+
content:
32633+
application/json:
32634+
schema:
32635+
$ref: '#/components/schemas/SecurityMonitoringRuleTestResponse'
32636+
description: OK
32637+
'400':
32638+
$ref: '#/components/responses/BadRequestResponse'
32639+
'401':
32640+
$ref: '#/components/responses/ConcurrentModificationResponse'
32641+
'403':
32642+
$ref: '#/components/responses/NotAuthorizedResponse'
32643+
'404':
32644+
$ref: '#/components/responses/NotFoundResponse'
32645+
'429':
32646+
$ref: '#/components/responses/TooManyRequestsResponse'
32647+
security:
32648+
- apiKeyAuth: []
32649+
appKeyAuth: []
32650+
- AuthZ:
32651+
- security_monitoring_rules_write
32652+
summary: Test a rule
32653+
tags:
32654+
- Security Monitoring
32655+
x-codegen-request-body-name: body
3255432656
/api/v2/security_monitoring/rules/validation:
3255532657
post:
3255632658
description: Validate a detection rule.
@@ -32672,6 +32774,44 @@ paths:
3267232774
tags:
3267332775
- Security Monitoring
3267432776
x-codegen-request-body-name: body
32777+
/api/v2/security_monitoring/rules/{rule_id}/test:
32778+
post:
32779+
description: Test an existing rule.
32780+
operationId: TestExistingSecurityMonitoringRule
32781+
parameters:
32782+
- $ref: '#/components/parameters/SecurityMonitoringRuleID'
32783+
requestBody:
32784+
content:
32785+
application/json:
32786+
schema:
32787+
$ref: '#/components/schemas/SecurityMonitoringRuleTestRequest'
32788+
required: true
32789+
responses:
32790+
'200':
32791+
content:
32792+
application/json:
32793+
schema:
32794+
$ref: '#/components/schemas/SecurityMonitoringRuleTestResponse'
32795+
description: OK
32796+
'400':
32797+
$ref: '#/components/responses/BadRequestResponse'
32798+
'401':
32799+
$ref: '#/components/responses/ConcurrentModificationResponse'
32800+
'403':
32801+
$ref: '#/components/responses/NotAuthorizedResponse'
32802+
'404':
32803+
$ref: '#/components/responses/NotFoundResponse'
32804+
'429':
32805+
$ref: '#/components/responses/TooManyRequestsResponse'
32806+
security:
32807+
- apiKeyAuth: []
32808+
appKeyAuth: []
32809+
- AuthZ:
32810+
- security_monitoring_rules_write
32811+
summary: Test an existing rule
32812+
tags:
32813+
- Security Monitoring
32814+
x-codegen-request-body-name: body
3267532815
/api/v2/security_monitoring/signals:
3267632816
get:
3267732817
description: 'The list endpoint returns security signals that match a search

‎cassettes/v2/Security-Monitoring_1187227211/Test-a-rule-returns-OK-response_150297886/frozen.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2024-05-28T11:40:33.484Z"

‎cassettes/v2/Security-Monitoring_1187227211/Test-a-rule-returns-OK-response_150297886/recording.har‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Test a rule returns \"OK\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "9e16bb521b2b35d5bb1c45bf6d266af0",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 853,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 591,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"rule\":{\"cases\":[{\"condition\":\"a > 0\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"hasExtendedTitle\":true,\"isEnabled\":true,\"message\":\"My security monitoring rule message.\",\"name\":\"My security monitoring rule.\",\"options\":{\"decreaseCriticalityBasedOnEnv\":false,\"detectionMethod\":\"threshold\",\"evaluationWindow\":0,\"keepAlive\":0,\"maxSignalDuration\":0},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[\"@userIdentity.assumed_role\"],\"name\":\"\",\"query\":\"source:source_here\"}],\"tags\":[\"env:prod\",\"team:security\"],\"type\":\"log_detection\"},\"ruleQueryPayloads\":[{\"expectedResult\":true,\"index\":0,\"payload\":{\"ddsource\":\"source_here\",\"ddtags\":\"env:staging,version:5.1\",\"hostname\":\"i-012345678\",\"message\":\"2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World\",\"service\":\"payment\",\"userIdentity\":{\"assumed_role\":\"fake assumed_role\"}}}]}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules/test"
39+
},
40+
"response": {
41+
"bodySize": 19,
42+
"content": {
43+
"mimeType": "application/json",
44+
"size": 19,
45+
"text": "{\"results\":[true]}\n"
46+
},
47+
"cookies": [],
48+
"headers": [
49+
{
50+
"name": "content-type",
51+
"value": "application/json"
52+
}
53+
],
54+
"headersSize": 630,
55+
"httpVersion": "HTTP/1.1",
56+
"redirectURL": "",
57+
"status": 200,
58+
"statusText": "OK"
59+
},
60+
"startedDateTime": "2024-05-28T11:40:33.493Z",
61+
"time": 544
62+
}
63+
],
64+
"pages": [],
65+
"version": "1.2"
66+
}
67+
}

‎examples/v2/security-monitoring/TestExistingSecurityMonitoringRule.ts‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
/**
2+
* Test an existing rule returns "OK" response
3+
*/
4+
5+
import { client, v2 } from "@datadog/datadog-api-client";
6+
7+
const configuration = client.createConfiguration();
8+
const apiInstance = new v2.SecurityMonitoringApi(configuration);
9+
10+
const params: v2.SecurityMonitoringApiTestExistingSecurityMonitoringRuleRequest =
11+
{
12+
body: {
13+
ruleQueryPayloads: [
14+
{
15+
expectedResult: true,
16+
index: 0,
17+
payload: {
18+
ddsource: "nginx",
19+
ddtags: "env:staging,version:5.1",
20+
hostname: "i-012345678",
21+
message:
22+
"2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World",
23+
service: "payment",
24+
},
25+
},
26+
],
27+
},
28+
ruleId: "rule_id",
29+
};
30+
31+
apiInstance
32+
.testExistingSecurityMonitoringRule(params)
33+
.then((data: v2.SecurityMonitoringRuleTestResponse) => {
34+
console.log(
35+
"API called successfully. Returned data: " + JSON.stringify(data)
36+
);
37+
})
38+
.catch((error: any) => console.error(error));

‎examples/v2/security-monitoring/TestSecurityMonitoringRule.ts‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
/**
2+
* Test a rule returns "OK" response
3+
*/
4+
5+
import { client, v2 } from "@datadog/datadog-api-client";
6+
7+
const configuration = client.createConfiguration();
8+
const apiInstance = new v2.SecurityMonitoringApi(configuration);
9+
10+
const params: v2.SecurityMonitoringApiTestSecurityMonitoringRuleRequest = {
11+
body: {
12+
rule: {
13+
cases: [
14+
{
15+
name: "",
16+
status: "info",
17+
notifications: [],
18+
condition: "a > 0",
19+
},
20+
],
21+
hasExtendedTitle: true,
22+
isEnabled: true,
23+
message: "My security monitoring rule message.",
24+
name: "My security monitoring rule.",
25+
options: {
26+
decreaseCriticalityBasedOnEnv: false,
27+
detectionMethod: "threshold",
28+
evaluationWindow: 0,
29+
keepAlive: 0,
30+
maxSignalDuration: 0,
31+
},
32+
queries: [
33+
{
34+
query: "source:source_here",
35+
groupByFields: ["@userIdentity.assumed_role"],
36+
distinctFields: [],
37+
aggregation: "count",
38+
name: "",
39+
},
40+
],
41+
tags: ["env:prod", "team:security"],
42+
type: "log_detection",
43+
},
44+
ruleQueryPayloads: [
45+
{
46+
expectedResult: true,
47+
index: 0,
48+
payload: {
49+
ddsource: "source_here",
50+
ddtags: "env:staging,version:5.1",
51+
hostname: "i-012345678",
52+
message:
53+
"2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World",
54+
service: "payment",
55+
},
56+
},
57+
],
58+
},
59+
};
60+
61+
apiInstance
62+
.testSecurityMonitoringRule(params)
63+
.then((data: v2.SecurityMonitoringRuleTestResponse) => {
64+
console.log(
65+
"API called successfully. Returned data: " + JSON.stringify(data)
66+
);
67+
})
68+
.catch((error: any) => console.error(error));

‎features/support/scenarios_model_mapping.ts‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4573,6 +4573,13 @@ export const ScenariosModelMappings: {[key: string]: {[key: string]: any}} = {
45734573
},
45744574
"operationResponseType": "SecurityMonitoringRuleResponse",
45754575
},
4576+
"v2.TestSecurityMonitoringRule": {
4577+
"body": {
4578+
"type": "SecurityMonitoringRuleTestRequest",
4579+
"format": "",
4580+
},
4581+
"operationResponseType": "SecurityMonitoringRuleTestResponse",
4582+
},
45764583
"v2.ValidateSecurityMonitoringRule": {
45774584
"body": {
45784585
"type": "SecurityMonitoringRuleCreatePayload",
@@ -4605,6 +4612,17 @@ export const ScenariosModelMappings: {[key: string]: {[key: string]: any}} = {
46054612
},
46064613
"operationResponseType": "SecurityMonitoringRuleResponse",
46074614
},
4615+
"v2.TestExistingSecurityMonitoringRule": {
4616+
"ruleId": {
4617+
"type": "string",
4618+
"format": "",
4619+
},
4620+
"body": {
4621+
"type": "SecurityMonitoringRuleTestRequest",
4622+
"format": "",
4623+
},
4624+
"operationResponseType": "SecurityMonitoringRuleTestResponse",
4625+
},
46084626
"v2.ListSecurityMonitoringSignals": {
46094627
"filterQuery": {
46104628
"type": "string",

0 commit comments

Comments
 (0)