Skip to content

Commit 85ed86e

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Security notifications - Add SAST and secret rule types (#3971)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent 722637c commit 85ed86e

6 files changed

Lines changed: 114 additions & 2 deletions

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57796,7 +57796,8 @@ components:
5779657796
Signal-based notification rules can filter signals based on rule types application_security, log_detection,
5779757797
workload_security, signal_correlation, cloud_configuration and infrastructure_configuration.
5779857798
Vulnerability-based notification rules can filter vulnerabilities based on rule types application_code_vulnerability,
57799-
application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration, api_security, host_vulnerability and iac_misconfiguration.
57799+
application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration,
57800+
api_security, host_vulnerability, iac_misconfiguration, sast_vulnerability and secret_vulnerability.
5780057801
enum:
5780157802
- application_security
5780257803
- log_detection
@@ -57813,6 +57814,8 @@ components:
5781357814
- api_security
5781457815
- host_vulnerability
5781557816
- iac_misconfiguration
57817+
- sast_vulnerability
57818+
- secret_vulnerability
5781657819
type: string
5781757820
x-enum-varnames:
5781857821
- APPLICATION_SECURITY
@@ -57830,6 +57833,8 @@ components:
5783057833
- API_SECURITY
5783157834
- HOST_VULNERABILITY
5783257835
- IAC_MISCONFIGURATION
57836+
- SAST_VULNERABILITY
57837+
- SECRET_VULNERABILITY
5783357838
RuleUser:
5783457839
description: User creating or modifying a rule.
5783557840
properties:

‎api/datadogV2/model_rule_types_items.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@ import (
1414
// Signal-based notification rules can filter signals based on rule types application_security, log_detection,
1515
// workload_security, signal_correlation, cloud_configuration and infrastructure_configuration.
1616
// Vulnerability-based notification rules can filter vulnerabilities based on rule types application_code_vulnerability,
17-
// application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration, api_security, host_vulnerability and iac_misconfiguration.
17+
// application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration,
18+
// api_security, host_vulnerability, iac_misconfiguration, sast_vulnerability and secret_vulnerability.
1819
type RuleTypesItems string
1920

2021
// List of RuleTypesItems.
@@ -34,6 +35,8 @@ const (
3435
RULETYPESITEMS_API_SECURITY RuleTypesItems = "api_security"
3536
RULETYPESITEMS_HOST_VULNERABILITY RuleTypesItems = "host_vulnerability"
3637
RULETYPESITEMS_IAC_MISCONFIGURATION RuleTypesItems = "iac_misconfiguration"
38+
RULETYPESITEMS_SAST_VULNERABILITY RuleTypesItems = "sast_vulnerability"
39+
RULETYPESITEMS_SECRET_VULNERABILITY RuleTypesItems = "secret_vulnerability"
3740
)
3841

3942
var allowedRuleTypesItemsEnumValues = []RuleTypesItems{
@@ -52,6 +55,8 @@ var allowedRuleTypesItemsEnumValues = []RuleTypesItems{
5255
RULETYPESITEMS_API_SECURITY,
5356
RULETYPESITEMS_HOST_VULNERABILITY,
5457
RULETYPESITEMS_IAC_MISCONFIGURATION,
58+
RULETYPESITEMS_SAST_VULNERABILITY,
59+
RULETYPESITEMS_SECRET_VULNERABILITY,
5560
}
5661

5762
// GetAllowedValues reeturns the list of possible values.

‎examples/v2/security-monitoring/CreateVulnerabilityNotificationRule_2417112739.go‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
// Create a new vulnerability-based notification rule with sast and secret rule types returns "Successfully created the
2+
// notification rule." response
3+
4+
package main
5+
6+
import (
7+
"context"
8+
"encoding/json"
9+
"fmt"
10+
"os"
11+
12+
"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
13+
"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
14+
)
15+
16+
func main() {
17+
body := datadogV2.CreateNotificationRuleParameters{
18+
Data: &datadogV2.CreateNotificationRuleParametersData{
19+
Attributes: datadogV2.CreateNotificationRuleParametersDataAttributes{
20+
Enabled: datadog.PtrBool(true),
21+
Name: "Example-Security-Monitoring",
22+
Selectors: datadogV2.Selectors{
23+
Query: datadog.PtrString("(source:production_service OR env:prod)"),
24+
RuleTypes: []datadogV2.RuleTypesItems{
25+
datadogV2.RULETYPESITEMS_SAST_VULNERABILITY,
26+
datadogV2.RULETYPESITEMS_SECRET_VULNERABILITY,
27+
},
28+
Severities: []datadogV2.RuleSeverity{
29+
datadogV2.RULESEVERITY_CRITICAL,
30+
},
31+
TriggerSource: datadogV2.TRIGGERSOURCE_SECURITY_FINDINGS,
32+
},
33+
Targets: []string{
34+
"@john.doe@email.com",
35+
},
36+
TimeAggregation: datadog.PtrInt64(86400),
37+
},
38+
Type: datadogV2.NOTIFICATIONRULESTYPE_NOTIFICATION_RULES,
39+
},
40+
}
41+
ctx := datadog.NewDefaultContext(context.Background())
42+
configuration := datadog.NewConfiguration()
43+
apiClient := datadog.NewAPIClient(configuration)
44+
api := datadogV2.NewSecurityMonitoringApi(apiClient)
45+
resp, r, err := api.CreateVulnerabilityNotificationRule(ctx, body)
46+
47+
if err != nil {
48+
fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.CreateVulnerabilityNotificationRule`: %v\n", err)
49+
fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
50+
}
51+
52+
responseContent, _ := json.MarshalIndent(resp, "", " ")
53+
fmt.Fprintf(os.Stdout, "Response from `SecurityMonitoringApi.CreateVulnerabilityNotificationRule`:\n%s\n", responseContent)
54+
}

‎tests/scenarios/cassettes/TestScenarios/v2/Feature_Security_Monitoring/Scenario_Create_a_new_vulnerability-based_notification_rule_with_sast_and_secret_rule_types_returns_Successfully_created_the_notification_rule._response.freeze‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2026-04-16T13:47:18.057Z

‎tests/scenarios/cassettes/TestScenarios/v2/Feature_Security_Monitoring/Scenario_Create_a_new_vulnerability-based_notification_rule_with_sast_and_secret_rule_types_returns_Successfully_created_the_notification_rule._response.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
interactions:
2+
- request:
3+
body: |
4+
{"data":{"attributes":{"enabled":true,"name":"Test-Create_a_new_vulnerability_based_notification_rule_with_sast_and_secret_rule_types_returns_Successfu-1776347238","selectors":{"query":"(source:production_service OR env:prod)","rule_types":["sast_vulnerability","secret_vulnerability"],"severities":["critical"],"trigger_source":"security_findings"},"targets":["@john.doe@email.com"],"time_aggregation":86400},"type":"notification_rules"}}
5+
form: {}
6+
headers:
7+
Accept:
8+
- application/json
9+
Content-Type:
10+
- application/json
11+
id: 0
12+
method: POST
13+
url: https://api.datadoghq.com/api/v2/security/vulnerabilities/notification_rules
14+
response:
15+
body: '{"data":{"id":"exz-ipg-n1m","type":"notification_rules","attributes":{"created_at":1776347239287,"created_by":{"name":"CI
16+
Account","handle":"9919ec9b-ebc7-49ee-8dc8-03626e717cca"},"enabled":true,"modified_at":1776347239287,"modified_by":{"name":"CI
17+
Account","handle":"9919ec9b-ebc7-49ee-8dc8-03626e717cca"},"name":"Test-Create_a_new_vulnerability_based_notification_rule_with_sast_and_secret_rule_types_returns_Successfu-1776347238","selectors":{"severities":["critical"],"rule_types":["sast_vulnerability","secret_vulnerability"],"query":"(source:production_service
18+
OR env:prod)","trigger_source":"security_findings"},"targets":["@john.doe@email.com"],"time_aggregation":86400,"version":1}}}'
19+
code: 201
20+
duration: 0ms
21+
headers:
22+
Content-Type:
23+
- application/vnd.api+json
24+
status: 201 Created
25+
- request:
26+
body: ''
27+
form: {}
28+
headers:
29+
Accept:
30+
- '*/*'
31+
id: 1
32+
method: DELETE
33+
url: https://api.datadoghq.com/api/v2/security/vulnerabilities/notification_rules/exz-ipg-n1m
34+
response:
35+
body: ''
36+
code: 204
37+
duration: 0ms
38+
headers: {}
39+
status: 204 No Content
40+
version: 2

‎tests/scenarios/features/v2/security_monitoring.feature‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -591,6 +591,13 @@ Feature: Security Monitoring
591591
When the request is sent
592592
Then the response status is 201 Successfully created the notification rule.
593593

594+
@team:DataDog/cloud-security-posture-management
595+
Scenario: Create a new vulnerability-based notification rule with sast and secret rule types returns "Successfully created the notification rule." response
596+
Given new "CreateVulnerabilityNotificationRule" request
597+
And body with value {"data": {"attributes": {"enabled": true, "name": "{{ unique }}", "selectors": {"query": "(source:production_service OR env:prod)", "rule_types": ["sast_vulnerability", "secret_vulnerability"], "severities": ["critical"], "trigger_source": "security_findings"}, "targets": ["@john.doe@email.com"], "time_aggregation": 86400}, "type": "notification_rules"}}
598+
When the request is sent
599+
Then the response status is 201 Successfully created the notification rule.
600+
594601
@team:DataDog/k9-cloud-siem
595602
Scenario: Create a scheduled detection rule returns "OK" response
596603
Given new "CreateSecurityMonitoringRule" request

0 commit comments

Comments
 (0)