Skip to content

Commit 92e3758

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Add OpenAPI documentation for signal investigation queries and suggested actions endpoints (DataDog#3916)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent ff734c7 commit 92e3758

11 files changed

Lines changed: 1040 additions & 0 deletions

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59499,6 +59499,17 @@ components:
5949959499
required:
5950059500
- data
5950159501
type: object
59502+
SecurityMonitoringSignalInvestigationQueryTemplateVariables:
59503+
additionalProperties:
59504+
items:
59505+
description: A value for this template variable extracted from the signal.
59506+
type: string
59507+
type: array
59508+
description: Template variables applied to the investigation log query, mapping attribute paths to values extracted from the signal.
59509+
example:
59510+
"@userIdentity.arn":
59511+
- foo
59512+
type: object
5950259513
SecurityMonitoringSignalListRequest:
5950359514
description: The request for a security signal list.
5950459515
properties:
@@ -59884,6 +59895,82 @@ components:
5988459895
required:
5988559896
- data
5988659897
type: object
59898+
SecurityMonitoringSignalSuggestedAction:
59899+
description: A suggested action for a security signal.
59900+
properties:
59901+
attributes:
59902+
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionAttributes"
59903+
id:
59904+
description: The unique ID of the suggested action.
59905+
example: w00-t10-992
59906+
type: string
59907+
type:
59908+
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionType"
59909+
required:
59910+
- id
59911+
- type
59912+
- attributes
59913+
type: object
59914+
SecurityMonitoringSignalSuggestedActionAttributes:
59915+
description: Attributes of a suggested action for a security signal. The available fields depend on the action type.
59916+
properties:
59917+
name:
59918+
description: The name of the investigation log query.
59919+
example: Cloudtrail events for user ARN
59920+
type: string
59921+
query_filter:
59922+
description: The log query filter for the investigation.
59923+
example: 'source:cloudtrail @userIdentity.arn:"foo"'
59924+
type: string
59925+
template_variables:
59926+
$ref: "#/components/schemas/SecurityMonitoringSignalInvestigationQueryTemplateVariables"
59927+
title:
59928+
description: The title of the recommended blog post.
59929+
example: Monitor Okta logs to track system access and unusual activity
59930+
type: string
59931+
url:
59932+
description: The URL of the suggested action.
59933+
example: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
59934+
type: string
59935+
type: object
59936+
SecurityMonitoringSignalSuggestedActionList:
59937+
description: List of suggested actions for a security signal.
59938+
example:
59939+
- attributes:
59940+
name: Cloudtrail events for user ARN
59941+
query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
59942+
template_variables:
59943+
"@userIdentity.arn":
59944+
- foo
59945+
url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
59946+
id: w00-t10-992
59947+
type: investigation_log_queries
59948+
- attributes:
59949+
title: Monitor Okta logs to track system access and unusual activity
59950+
url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
59951+
id: bxy-o8v-i1a
59952+
type: recommended_blog_posts
59953+
items:
59954+
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedAction"
59955+
type: array
59956+
SecurityMonitoringSignalSuggestedActionType:
59957+
description: The type of the suggested action resource.
59958+
enum:
59959+
- investigation_log_queries
59960+
- recommended_blog_posts
59961+
example: investigation_log_queries
59962+
type: string
59963+
x-enum-varnames:
59964+
- INVESTIGATION_LOG_QUERIES
59965+
- RECOMMENDED_BLOG_POSTS
59966+
SecurityMonitoringSignalSuggestedActionsResponse:
59967+
description: Response with suggested actions for a security signal.
59968+
properties:
59969+
data:
59970+
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionList"
59971+
required:
59972+
- data
59973+
type: object
5988759974
SecurityMonitoringSignalTriageAttributes:
5988859975
description: Attributes describing a triage state update operation over a security signal.
5988959976
properties:
@@ -106943,6 +107030,54 @@ paths:
106943107030
operator: OR
106944107031
permissions:
106945107032
- security_monitoring_signals_write
107033+
/api/v2/security_monitoring/signals/{signal_id}/investigation_queries:
107034+
get:
107035+
description: Get the list of investigation log queries available for a given security signal.
107036+
operationId: GetInvestigationLogQueriesMatchingSignal
107037+
parameters:
107038+
- $ref: "#/components/parameters/SignalID"
107039+
responses:
107040+
"200":
107041+
content:
107042+
application/json:
107043+
example:
107044+
data:
107045+
- attributes:
107046+
name: Cloudtrail events for user ARN
107047+
query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
107048+
template_variables:
107049+
"@userIdentity.arn":
107050+
- foo
107051+
url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
107052+
id: w00-t10-992
107053+
type: investigation_log_queries
107054+
- attributes:
107055+
title: Monitor Okta logs to track system access and unusual activity
107056+
url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
107057+
id: bxy-o8v-i1a
107058+
type: recommended_blog_posts
107059+
schema:
107060+
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionsResponse"
107061+
description: OK
107062+
"403":
107063+
$ref: "#/components/responses/NotAuthorizedResponse"
107064+
"404":
107065+
$ref: "#/components/responses/NotFoundResponse"
107066+
"429":
107067+
$ref: "#/components/responses/TooManyRequestsResponse"
107068+
security:
107069+
- apiKeyAuth: []
107070+
appKeyAuth: []
107071+
- AuthZ:
107072+
- security_monitoring_rules_read
107073+
- security_monitoring_signals_read
107074+
summary: Get investigation queries for a signal
107075+
tags: ["Security Monitoring"]
107076+
x-permission:
107077+
operator: AND
107078+
permissions:
107079+
- security_monitoring_rules_read
107080+
- security_monitoring_signals_read
106946107081
/api/v2/security_monitoring/signals/{signal_id}/state:
106947107082
patch:
106948107083
description: |-
@@ -106983,6 +107118,54 @@ paths:
106983107118
operator: OR
106984107119
permissions:
106985107120
- security_monitoring_signals_write
107121+
/api/v2/security_monitoring/signals/{signal_id}/suggested_actions:
107122+
get:
107123+
description: Get the list of suggested actions for a given security signal.
107124+
operationId: GetSuggestedActionsMatchingSignal
107125+
parameters:
107126+
- $ref: "#/components/parameters/SignalID"
107127+
responses:
107128+
"200":
107129+
content:
107130+
application/json:
107131+
example:
107132+
data:
107133+
- attributes:
107134+
name: Cloudtrail events for user ARN
107135+
query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
107136+
template_variables:
107137+
"@userIdentity.arn":
107138+
- foo
107139+
url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
107140+
id: w00-t10-992
107141+
type: investigation_log_queries
107142+
- attributes:
107143+
title: Monitor Okta logs to track system access and unusual activity
107144+
url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
107145+
id: bxy-o8v-i1a
107146+
type: recommended_blog_posts
107147+
schema:
107148+
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionsResponse"
107149+
description: OK
107150+
"403":
107151+
$ref: "#/components/responses/NotAuthorizedResponse"
107152+
"404":
107153+
$ref: "#/components/responses/NotFoundResponse"
107154+
"429":
107155+
$ref: "#/components/responses/TooManyRequestsResponse"
107156+
security:
107157+
- apiKeyAuth: []
107158+
appKeyAuth: []
107159+
- AuthZ:
107160+
- security_monitoring_rules_read
107161+
- security_monitoring_signals_read
107162+
summary: Get suggested actions for a signal
107163+
tags: ["Security Monitoring"]
107164+
x-permission:
107165+
operator: AND
107166+
permissions:
107167+
- security_monitoring_rules_read
107168+
- security_monitoring_signals_read
106986107169
/api/v2/sensitive-data-scanner/config:
106987107170
get:
106988107171
description: List all the Scanning groups in your organization.

‎api/datadogV2/api_security_monitoring.go‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2910,6 +2910,84 @@ func (a *SecurityMonitoringApi) GetFinding(ctx _context.Context, findingId strin
29102910
return localVarReturnValue, localVarHTTPResponse, nil
29112911
}
29122912

2913+
// GetInvestigationLogQueriesMatchingSignal Get investigation queries for a signal.
2914+
// Get the list of investigation log queries available for a given security signal.
2915+
func (a *SecurityMonitoringApi) GetInvestigationLogQueriesMatchingSignal(ctx _context.Context, signalId string) (SecurityMonitoringSignalSuggestedActionsResponse, *_nethttp.Response, error) {
2916+
var (
2917+
localVarHTTPMethod = _nethttp.MethodGet
2918+
localVarPostBody interface{}
2919+
localVarReturnValue SecurityMonitoringSignalSuggestedActionsResponse
2920+
)
2921+
2922+
localBasePath, err := a.Client.Cfg.ServerURLWithContext(ctx, "v2.SecurityMonitoringApi.GetInvestigationLogQueriesMatchingSignal")
2923+
if err != nil {
2924+
return localVarReturnValue, nil, datadog.GenericOpenAPIError{ErrorMessage: err.Error()}
2925+
}
2926+
2927+
localVarPath := localBasePath + "/api/v2/security_monitoring/signals/{signal_id}/investigation_queries"
2928+
localVarPath = datadog.ReplacePathParameter(localVarPath, "{signal_id}", _neturl.PathEscape(datadog.ParameterToString(signalId, "")))
2929+
2930+
localVarHeaderParams := make(map[string]string)
2931+
localVarQueryParams := _neturl.Values{}
2932+
localVarFormParams := _neturl.Values{}
2933+
localVarHeaderParams["Accept"] = "application/json"
2934+
2935+
if a.Client.Cfg.DelegatedTokenConfig != nil {
2936+
err = datadog.UseDelegatedTokenAuth(ctx, &localVarHeaderParams, a.Client.Cfg.DelegatedTokenConfig)
2937+
if err != nil {
2938+
return localVarReturnValue, nil, err
2939+
}
2940+
} else {
2941+
datadog.SetAuthKeys(
2942+
ctx,
2943+
&localVarHeaderParams,
2944+
[2]string{"apiKeyAuth", "DD-API-KEY"},
2945+
[2]string{"appKeyAuth", "DD-APPLICATION-KEY"},
2946+
)
2947+
}
2948+
req, err := a.Client.PrepareRequest(ctx, localVarPath, localVarHTTPMethod, localVarPostBody, localVarHeaderParams, localVarQueryParams, localVarFormParams, nil)
2949+
if err != nil {
2950+
return localVarReturnValue, nil, err
2951+
}
2952+
2953+
localVarHTTPResponse, err := a.Client.CallAPI(req)
2954+
if err != nil || localVarHTTPResponse == nil {
2955+
return localVarReturnValue, localVarHTTPResponse, err
2956+
}
2957+
2958+
localVarBody, err := datadog.ReadBody(localVarHTTPResponse)
2959+
if err != nil {
2960+
return localVarReturnValue, localVarHTTPResponse, err
2961+
}
2962+
2963+
if localVarHTTPResponse.StatusCode >= 300 {
2964+
newErr := datadog.GenericOpenAPIError{
2965+
ErrorBody: localVarBody,
2966+
ErrorMessage: localVarHTTPResponse.Status,
2967+
}
2968+
if localVarHTTPResponse.StatusCode == 403 || localVarHTTPResponse.StatusCode == 404 || localVarHTTPResponse.StatusCode == 429 {
2969+
var v APIErrorResponse
2970+
err = a.Client.Decode(&v, localVarBody, localVarHTTPResponse.Header.Get("Content-Type"))
2971+
if err != nil {
2972+
return localVarReturnValue, localVarHTTPResponse, newErr
2973+
}
2974+
newErr.ErrorModel = v
2975+
}
2976+
return localVarReturnValue, localVarHTTPResponse, newErr
2977+
}
2978+
2979+
err = a.Client.Decode(&localVarReturnValue, localVarBody, localVarHTTPResponse.Header.Get("Content-Type"))
2980+
if err != nil {
2981+
newErr := datadog.GenericOpenAPIError{
2982+
ErrorBody: localVarBody,
2983+
ErrorMessage: err.Error(),
2984+
}
2985+
return localVarReturnValue, localVarHTTPResponse, newErr
2986+
}
2987+
2988+
return localVarReturnValue, localVarHTTPResponse, nil
2989+
}
2990+
29132991
// GetResourceEvaluationFiltersOptionalParameters holds optional parameters for GetResourceEvaluationFilters.
29142992
type GetResourceEvaluationFiltersOptionalParameters struct {
29152993
CloudProvider *string
@@ -4172,6 +4250,84 @@ func (a *SecurityMonitoringApi) GetSignalNotificationRules(ctx _context.Context)
41724250
return localVarReturnValue, localVarHTTPResponse, nil
41734251
}
41744252

4253+
// GetSuggestedActionsMatchingSignal Get suggested actions for a signal.
4254+
// Get the list of suggested actions for a given security signal.
4255+
func (a *SecurityMonitoringApi) GetSuggestedActionsMatchingSignal(ctx _context.Context, signalId string) (SecurityMonitoringSignalSuggestedActionsResponse, *_nethttp.Response, error) {
4256+
var (
4257+
localVarHTTPMethod = _nethttp.MethodGet
4258+
localVarPostBody interface{}
4259+
localVarReturnValue SecurityMonitoringSignalSuggestedActionsResponse
4260+
)
4261+
4262+
localBasePath, err := a.Client.Cfg.ServerURLWithContext(ctx, "v2.SecurityMonitoringApi.GetSuggestedActionsMatchingSignal")
4263+
if err != nil {
4264+
return localVarReturnValue, nil, datadog.GenericOpenAPIError{ErrorMessage: err.Error()}
4265+
}
4266+
4267+
localVarPath := localBasePath + "/api/v2/security_monitoring/signals/{signal_id}/suggested_actions"
4268+
localVarPath = datadog.ReplacePathParameter(localVarPath, "{signal_id}", _neturl.PathEscape(datadog.ParameterToString(signalId, "")))
4269+
4270+
localVarHeaderParams := make(map[string]string)
4271+
localVarQueryParams := _neturl.Values{}
4272+
localVarFormParams := _neturl.Values{}
4273+
localVarHeaderParams["Accept"] = "application/json"
4274+
4275+
if a.Client.Cfg.DelegatedTokenConfig != nil {
4276+
err = datadog.UseDelegatedTokenAuth(ctx, &localVarHeaderParams, a.Client.Cfg.DelegatedTokenConfig)
4277+
if err != nil {
4278+
return localVarReturnValue, nil, err
4279+
}
4280+
} else {
4281+
datadog.SetAuthKeys(
4282+
ctx,
4283+
&localVarHeaderParams,
4284+
[2]string{"apiKeyAuth", "DD-API-KEY"},
4285+
[2]string{"appKeyAuth", "DD-APPLICATION-KEY"},
4286+
)
4287+
}
4288+
req, err := a.Client.PrepareRequest(ctx, localVarPath, localVarHTTPMethod, localVarPostBody, localVarHeaderParams, localVarQueryParams, localVarFormParams, nil)
4289+
if err != nil {
4290+
return localVarReturnValue, nil, err
4291+
}
4292+
4293+
localVarHTTPResponse, err := a.Client.CallAPI(req)
4294+
if err != nil || localVarHTTPResponse == nil {
4295+
return localVarReturnValue, localVarHTTPResponse, err
4296+
}
4297+
4298+
localVarBody, err := datadog.ReadBody(localVarHTTPResponse)
4299+
if err != nil {
4300+
return localVarReturnValue, localVarHTTPResponse, err
4301+
}
4302+
4303+
if localVarHTTPResponse.StatusCode >= 300 {
4304+
newErr := datadog.GenericOpenAPIError{
4305+
ErrorBody: localVarBody,
4306+
ErrorMessage: localVarHTTPResponse.Status,
4307+
}
4308+
if localVarHTTPResponse.StatusCode == 403 || localVarHTTPResponse.StatusCode == 404 || localVarHTTPResponse.StatusCode == 429 {
4309+
var v APIErrorResponse
4310+
err = a.Client.Decode(&v, localVarBody, localVarHTTPResponse.Header.Get("Content-Type"))
4311+
if err != nil {
4312+
return localVarReturnValue, localVarHTTPResponse, newErr
4313+
}
4314+
newErr.ErrorModel = v
4315+
}
4316+
return localVarReturnValue, localVarHTTPResponse, newErr
4317+
}
4318+
4319+
err = a.Client.Decode(&localVarReturnValue, localVarBody, localVarHTTPResponse.Header.Get("Content-Type"))
4320+
if err != nil {
4321+
newErr := datadog.GenericOpenAPIError{
4322+
ErrorBody: localVarBody,
4323+
ErrorMessage: err.Error(),
4324+
}
4325+
return localVarReturnValue, localVarHTTPResponse, newErr
4326+
}
4327+
4328+
return localVarReturnValue, localVarHTTPResponse, nil
4329+
}
4330+
41754331
// GetSuppressionVersionHistoryOptionalParameters holds optional parameters for GetSuppressionVersionHistory.
41764332
type GetSuppressionVersionHistoryOptionalParameters struct {
41774333
PageSize *int64

‎api/datadogV2/doc.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -723,6 +723,7 @@
723723
// - [SecurityMonitoringApi.GetCriticalAssetsAffectingRule]
724724
// - [SecurityMonitoringApi.GetCustomFramework]
725725
// - [SecurityMonitoringApi.GetFinding]
726+
// - [SecurityMonitoringApi.GetInvestigationLogQueriesMatchingSignal]
726727
// - [SecurityMonitoringApi.GetResourceEvaluationFilters]
727728
// - [SecurityMonitoringApi.GetRuleVersionHistory]
728729
// - [SecurityMonitoringApi.GetSBOM]
@@ -736,6 +737,7 @@
736737
// - [SecurityMonitoringApi.GetSecurityMonitoringSuppression]
737738
// - [SecurityMonitoringApi.GetSignalNotificationRule]
738739
// - [SecurityMonitoringApi.GetSignalNotificationRules]
740+
// - [SecurityMonitoringApi.GetSuggestedActionsMatchingSignal]
739741
// - [SecurityMonitoringApi.GetSuppressionVersionHistory]
740742
// - [SecurityMonitoringApi.GetSuppressionsAffectingFutureRule]
741743
// - [SecurityMonitoringApi.GetSuppressionsAffectingRule]

0 commit comments

Comments
 (0)