Skip to content

Commit 8d2cb93

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Add sequence detection to security monitoring rules (#3348)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent 2c84816 commit 8d2cb93

14 files changed

Lines changed: 916 additions & 26 deletions

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20470,6 +20470,8 @@ components:
2047020470
$ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
2047120471
newValueOptions:
2047220472
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
20473+
sequenceDetectionOptions:
20474+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions'
2047320475
thirdPartyRuleOptions:
2047420476
$ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
2047520477
type: object
@@ -40786,6 +40788,7 @@ components:
4078640788
- hardcoded
4078740789
- third_party
4078840790
- anomaly_threshold
40791+
- sequence_detection
4078940792
type: string
4079040793
x-enum-varnames:
4079140794
- THRESHOLD
@@ -40795,6 +40798,7 @@ components:
4079540798
- HARDCODED
4079640799
- THIRD_PARTY
4079740800
- ANOMALY_THRESHOLD
40801+
- SEQUENCE_DETECTION
4079840802
SecurityMonitoringRuleEvaluationWindow:
4079940803
description: 'A time window is specified to match when at least one of the cases
4080040804
matches true. This is a sliding window
@@ -41008,6 +41012,8 @@ components:
4100841012
$ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
4100941013
newValueOptions:
4101041014
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
41015+
sequenceDetectionOptions:
41016+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions'
4101141017
thirdPartyRuleOptions:
4101241018
$ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
4101341019
type: object
@@ -41083,6 +41089,47 @@ components:
4108341089
oneOf:
4108441090
- $ref: '#/components/schemas/SecurityMonitoringStandardRuleResponse'
4108541091
- $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponse'
41092+
SecurityMonitoringRuleSequenceDetectionOptions:
41093+
description: Options on sequence detection method.
41094+
properties:
41095+
stepTransitions:
41096+
description: Transitions defining the allowed order of steps and their evaluation
41097+
windows.
41098+
items:
41099+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionStepTransition'
41100+
type: array
41101+
steps:
41102+
description: Steps that define the conditions to be matched in sequence.
41103+
items:
41104+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionStep'
41105+
type: array
41106+
type: object
41107+
SecurityMonitoringRuleSequenceDetectionStep:
41108+
description: Step definition for sequence detection containing the step name,
41109+
condition, and evaluation window.
41110+
properties:
41111+
condition:
41112+
description: Condition referencing rule queries (e.g., `a > 0`).
41113+
type: string
41114+
evaluationWindow:
41115+
$ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
41116+
name:
41117+
description: Unique name identifying the step.
41118+
type: string
41119+
type: object
41120+
SecurityMonitoringRuleSequenceDetectionStepTransition:
41121+
description: Transition from a parent step to a child step within a sequence
41122+
detection rule.
41123+
properties:
41124+
child:
41125+
description: Name of the child step.
41126+
type: string
41127+
evaluationWindow:
41128+
$ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
41129+
parent:
41130+
description: Name of the parent step.
41131+
type: string
41132+
type: object
4108641133
SecurityMonitoringRuleSeverity:
4108741134
description: Severity of the Security Signal.
4108841135
enum:

‎api/datadogV2/model_historical_job_options.go‎

Lines changed: 46 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ type HistoricalJobOptions struct {
2525
MaxSignalDuration *SecurityMonitoringRuleMaxSignalDuration `json:"maxSignalDuration,omitempty"`
2626
// Options on new value detection method.
2727
NewValueOptions *SecurityMonitoringRuleNewValueOptions `json:"newValueOptions,omitempty"`
28+
// Options on sequence detection method.
29+
SequenceDetectionOptions *SecurityMonitoringRuleSequenceDetectionOptions `json:"sequenceDetectionOptions,omitempty"`
2830
// Options on third party detection method.
2931
ThirdPartyRuleOptions *SecurityMonitoringRuleThirdPartyOptions `json:"thirdPartyRuleOptions,omitempty"`
3032
// UnparsedObject contains the raw value of the object if there was an error when deserializing into the struct
@@ -217,6 +219,34 @@ func (o *HistoricalJobOptions) SetNewValueOptions(v SecurityMonitoringRuleNewVal
217219
o.NewValueOptions = &v
218220
}
219221

222+
// GetSequenceDetectionOptions returns the SequenceDetectionOptions field value if set, zero value otherwise.
223+
func (o *HistoricalJobOptions) GetSequenceDetectionOptions() SecurityMonitoringRuleSequenceDetectionOptions {
224+
if o == nil || o.SequenceDetectionOptions == nil {
225+
var ret SecurityMonitoringRuleSequenceDetectionOptions
226+
return ret
227+
}
228+
return *o.SequenceDetectionOptions
229+
}
230+
231+
// GetSequenceDetectionOptionsOk returns a tuple with the SequenceDetectionOptions field value if set, nil otherwise
232+
// and a boolean to check if the value has been set.
233+
func (o *HistoricalJobOptions) GetSequenceDetectionOptionsOk() (*SecurityMonitoringRuleSequenceDetectionOptions, bool) {
234+
if o == nil || o.SequenceDetectionOptions == nil {
235+
return nil, false
236+
}
237+
return o.SequenceDetectionOptions, true
238+
}
239+
240+
// HasSequenceDetectionOptions returns a boolean if a field has been set.
241+
func (o *HistoricalJobOptions) HasSequenceDetectionOptions() bool {
242+
return o != nil && o.SequenceDetectionOptions != nil
243+
}
244+
245+
// SetSequenceDetectionOptions gets a reference to the given SecurityMonitoringRuleSequenceDetectionOptions and assigns it to the SequenceDetectionOptions field.
246+
func (o *HistoricalJobOptions) SetSequenceDetectionOptions(v SecurityMonitoringRuleSequenceDetectionOptions) {
247+
o.SequenceDetectionOptions = &v
248+
}
249+
220250
// GetThirdPartyRuleOptions returns the ThirdPartyRuleOptions field value if set, zero value otherwise.
221251
func (o *HistoricalJobOptions) GetThirdPartyRuleOptions() SecurityMonitoringRuleThirdPartyOptions {
222252
if o == nil || o.ThirdPartyRuleOptions == nil {
@@ -269,6 +299,9 @@ func (o HistoricalJobOptions) MarshalJSON() ([]byte, error) {
269299
if o.NewValueOptions != nil {
270300
toSerialize["newValueOptions"] = o.NewValueOptions
271301
}
302+
if o.SequenceDetectionOptions != nil {
303+
toSerialize["sequenceDetectionOptions"] = o.SequenceDetectionOptions
304+
}
272305
if o.ThirdPartyRuleOptions != nil {
273306
toSerialize["thirdPartyRuleOptions"] = o.ThirdPartyRuleOptions
274307
}
@@ -282,20 +315,21 @@ func (o HistoricalJobOptions) MarshalJSON() ([]byte, error) {
282315
// UnmarshalJSON deserializes the given payload.
283316
func (o *HistoricalJobOptions) UnmarshalJSON(bytes []byte) (err error) {
284317
all := struct {
285-
DetectionMethod *SecurityMonitoringRuleDetectionMethod `json:"detectionMethod,omitempty"`
286-
EvaluationWindow *SecurityMonitoringRuleEvaluationWindow `json:"evaluationWindow,omitempty"`
287-
ImpossibleTravelOptions *SecurityMonitoringRuleImpossibleTravelOptions `json:"impossibleTravelOptions,omitempty"`
288-
KeepAlive *SecurityMonitoringRuleKeepAlive `json:"keepAlive,omitempty"`
289-
MaxSignalDuration *SecurityMonitoringRuleMaxSignalDuration `json:"maxSignalDuration,omitempty"`
290-
NewValueOptions *SecurityMonitoringRuleNewValueOptions `json:"newValueOptions,omitempty"`
291-
ThirdPartyRuleOptions *SecurityMonitoringRuleThirdPartyOptions `json:"thirdPartyRuleOptions,omitempty"`
318+
DetectionMethod *SecurityMonitoringRuleDetectionMethod `json:"detectionMethod,omitempty"`
319+
EvaluationWindow *SecurityMonitoringRuleEvaluationWindow `json:"evaluationWindow,omitempty"`
320+
ImpossibleTravelOptions *SecurityMonitoringRuleImpossibleTravelOptions `json:"impossibleTravelOptions,omitempty"`
321+
KeepAlive *SecurityMonitoringRuleKeepAlive `json:"keepAlive,omitempty"`
322+
MaxSignalDuration *SecurityMonitoringRuleMaxSignalDuration `json:"maxSignalDuration,omitempty"`
323+
NewValueOptions *SecurityMonitoringRuleNewValueOptions `json:"newValueOptions,omitempty"`
324+
SequenceDetectionOptions *SecurityMonitoringRuleSequenceDetectionOptions `json:"sequenceDetectionOptions,omitempty"`
325+
ThirdPartyRuleOptions *SecurityMonitoringRuleThirdPartyOptions `json:"thirdPartyRuleOptions,omitempty"`
292326
}{}
293327
if err = datadog.Unmarshal(bytes, &all); err != nil {
294328
return datadog.Unmarshal(bytes, &o.UnparsedObject)
295329
}
296330
additionalProperties := make(map[string]interface{})
297331
if err = datadog.Unmarshal(bytes, &additionalProperties); err == nil {
298-
datadog.DeleteKeys(additionalProperties, &[]string{"detectionMethod", "evaluationWindow", "impossibleTravelOptions", "keepAlive", "maxSignalDuration", "newValueOptions", "thirdPartyRuleOptions"})
332+
datadog.DeleteKeys(additionalProperties, &[]string{"detectionMethod", "evaluationWindow", "impossibleTravelOptions", "keepAlive", "maxSignalDuration", "newValueOptions", "sequenceDetectionOptions", "thirdPartyRuleOptions"})
299333
} else {
300334
return err
301335
}
@@ -329,6 +363,10 @@ func (o *HistoricalJobOptions) UnmarshalJSON(bytes []byte) (err error) {
329363
hasInvalidField = true
330364
}
331365
o.NewValueOptions = all.NewValueOptions
366+
if all.SequenceDetectionOptions != nil && all.SequenceDetectionOptions.UnparsedObject != nil && o.UnparsedObject == nil {
367+
hasInvalidField = true
368+
}
369+
o.SequenceDetectionOptions = all.SequenceDetectionOptions
332370
if all.ThirdPartyRuleOptions != nil && all.ThirdPartyRuleOptions.UnparsedObject != nil && o.UnparsedObject == nil {
333371
hasInvalidField = true
334372
}

‎api/datadogV2/model_security_monitoring_rule_detection_method.go‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,14 @@ type SecurityMonitoringRuleDetectionMethod string
1515

1616
// List of SecurityMonitoringRuleDetectionMethod.
1717
const (
18-
SECURITYMONITORINGRULEDETECTIONMETHOD_THRESHOLD SecurityMonitoringRuleDetectionMethod = "threshold"
19-
SECURITYMONITORINGRULEDETECTIONMETHOD_NEW_VALUE SecurityMonitoringRuleDetectionMethod = "new_value"
20-
SECURITYMONITORINGRULEDETECTIONMETHOD_ANOMALY_DETECTION SecurityMonitoringRuleDetectionMethod = "anomaly_detection"
21-
SECURITYMONITORINGRULEDETECTIONMETHOD_IMPOSSIBLE_TRAVEL SecurityMonitoringRuleDetectionMethod = "impossible_travel"
22-
SECURITYMONITORINGRULEDETECTIONMETHOD_HARDCODED SecurityMonitoringRuleDetectionMethod = "hardcoded"
23-
SECURITYMONITORINGRULEDETECTIONMETHOD_THIRD_PARTY SecurityMonitoringRuleDetectionMethod = "third_party"
24-
SECURITYMONITORINGRULEDETECTIONMETHOD_ANOMALY_THRESHOLD SecurityMonitoringRuleDetectionMethod = "anomaly_threshold"
18+
SECURITYMONITORINGRULEDETECTIONMETHOD_THRESHOLD SecurityMonitoringRuleDetectionMethod = "threshold"
19+
SECURITYMONITORINGRULEDETECTIONMETHOD_NEW_VALUE SecurityMonitoringRuleDetectionMethod = "new_value"
20+
SECURITYMONITORINGRULEDETECTIONMETHOD_ANOMALY_DETECTION SecurityMonitoringRuleDetectionMethod = "anomaly_detection"
21+
SECURITYMONITORINGRULEDETECTIONMETHOD_IMPOSSIBLE_TRAVEL SecurityMonitoringRuleDetectionMethod = "impossible_travel"
22+
SECURITYMONITORINGRULEDETECTIONMETHOD_HARDCODED SecurityMonitoringRuleDetectionMethod = "hardcoded"
23+
SECURITYMONITORINGRULEDETECTIONMETHOD_THIRD_PARTY SecurityMonitoringRuleDetectionMethod = "third_party"
24+
SECURITYMONITORINGRULEDETECTIONMETHOD_ANOMALY_THRESHOLD SecurityMonitoringRuleDetectionMethod = "anomaly_threshold"
25+
SECURITYMONITORINGRULEDETECTIONMETHOD_SEQUENCE_DETECTION SecurityMonitoringRuleDetectionMethod = "sequence_detection"
2526
)
2627

2728
var allowedSecurityMonitoringRuleDetectionMethodEnumValues = []SecurityMonitoringRuleDetectionMethod{
@@ -32,6 +33,7 @@ var allowedSecurityMonitoringRuleDetectionMethodEnumValues = []SecurityMonitorin
3233
SECURITYMONITORINGRULEDETECTIONMETHOD_HARDCODED,
3334
SECURITYMONITORINGRULEDETECTIONMETHOD_THIRD_PARTY,
3435
SECURITYMONITORINGRULEDETECTIONMETHOD_ANOMALY_THRESHOLD,
36+
SECURITYMONITORINGRULEDETECTIONMETHOD_SEQUENCE_DETECTION,
3537
}
3638

3739
// GetAllowedValues reeturns the list of possible values.

‎api/datadogV2/model_security_monitoring_rule_options.go‎

Lines changed: 49 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@ type SecurityMonitoringRuleOptions struct {
3535
MaxSignalDuration *SecurityMonitoringRuleMaxSignalDuration `json:"maxSignalDuration,omitempty"`
3636
// Options on new value detection method.
3737
NewValueOptions *SecurityMonitoringRuleNewValueOptions `json:"newValueOptions,omitempty"`
38+
// Options on sequence detection method.
39+
SequenceDetectionOptions *SecurityMonitoringRuleSequenceDetectionOptions `json:"sequenceDetectionOptions,omitempty"`
3840
// Options on third party detection method.
3941
ThirdPartyRuleOptions *SecurityMonitoringRuleThirdPartyOptions `json:"thirdPartyRuleOptions,omitempty"`
4042
// UnparsedObject contains the raw value of the object if there was an error when deserializing into the struct
@@ -311,6 +313,34 @@ func (o *SecurityMonitoringRuleOptions) SetNewValueOptions(v SecurityMonitoringR
311313
o.NewValueOptions = &v
312314
}
313315

316+
// GetSequenceDetectionOptions returns the SequenceDetectionOptions field value if set, zero value otherwise.
317+
func (o *SecurityMonitoringRuleOptions) GetSequenceDetectionOptions() SecurityMonitoringRuleSequenceDetectionOptions {
318+
if o == nil || o.SequenceDetectionOptions == nil {
319+
var ret SecurityMonitoringRuleSequenceDetectionOptions
320+
return ret
321+
}
322+
return *o.SequenceDetectionOptions
323+
}
324+
325+
// GetSequenceDetectionOptionsOk returns a tuple with the SequenceDetectionOptions field value if set, nil otherwise
326+
// and a boolean to check if the value has been set.
327+
func (o *SecurityMonitoringRuleOptions) GetSequenceDetectionOptionsOk() (*SecurityMonitoringRuleSequenceDetectionOptions, bool) {
328+
if o == nil || o.SequenceDetectionOptions == nil {
329+
return nil, false
330+
}
331+
return o.SequenceDetectionOptions, true
332+
}
333+
334+
// HasSequenceDetectionOptions returns a boolean if a field has been set.
335+
func (o *SecurityMonitoringRuleOptions) HasSequenceDetectionOptions() bool {
336+
return o != nil && o.SequenceDetectionOptions != nil
337+
}
338+
339+
// SetSequenceDetectionOptions gets a reference to the given SecurityMonitoringRuleSequenceDetectionOptions and assigns it to the SequenceDetectionOptions field.
340+
func (o *SecurityMonitoringRuleOptions) SetSequenceDetectionOptions(v SecurityMonitoringRuleSequenceDetectionOptions) {
341+
o.SequenceDetectionOptions = &v
342+
}
343+
314344
// GetThirdPartyRuleOptions returns the ThirdPartyRuleOptions field value if set, zero value otherwise.
315345
func (o *SecurityMonitoringRuleOptions) GetThirdPartyRuleOptions() SecurityMonitoringRuleThirdPartyOptions {
316346
if o == nil || o.ThirdPartyRuleOptions == nil {
@@ -372,6 +402,9 @@ func (o SecurityMonitoringRuleOptions) MarshalJSON() ([]byte, error) {
372402
if o.NewValueOptions != nil {
373403
toSerialize["newValueOptions"] = o.NewValueOptions
374404
}
405+
if o.SequenceDetectionOptions != nil {
406+
toSerialize["sequenceDetectionOptions"] = o.SequenceDetectionOptions
407+
}
375408
if o.ThirdPartyRuleOptions != nil {
376409
toSerialize["thirdPartyRuleOptions"] = o.ThirdPartyRuleOptions
377410
}
@@ -385,23 +418,24 @@ func (o SecurityMonitoringRuleOptions) MarshalJSON() ([]byte, error) {
385418
// UnmarshalJSON deserializes the given payload.
386419
func (o *SecurityMonitoringRuleOptions) UnmarshalJSON(bytes []byte) (err error) {
387420
all := struct {
388-
ComplianceRuleOptions *CloudConfigurationComplianceRuleOptions `json:"complianceRuleOptions,omitempty"`
389-
DecreaseCriticalityBasedOnEnv *bool `json:"decreaseCriticalityBasedOnEnv,omitempty"`
390-
DetectionMethod *SecurityMonitoringRuleDetectionMethod `json:"detectionMethod,omitempty"`
391-
EvaluationWindow *SecurityMonitoringRuleEvaluationWindow `json:"evaluationWindow,omitempty"`
392-
HardcodedEvaluatorType *SecurityMonitoringRuleHardcodedEvaluatorType `json:"hardcodedEvaluatorType,omitempty"`
393-
ImpossibleTravelOptions *SecurityMonitoringRuleImpossibleTravelOptions `json:"impossibleTravelOptions,omitempty"`
394-
KeepAlive *SecurityMonitoringRuleKeepAlive `json:"keepAlive,omitempty"`
395-
MaxSignalDuration *SecurityMonitoringRuleMaxSignalDuration `json:"maxSignalDuration,omitempty"`
396-
NewValueOptions *SecurityMonitoringRuleNewValueOptions `json:"newValueOptions,omitempty"`
397-
ThirdPartyRuleOptions *SecurityMonitoringRuleThirdPartyOptions `json:"thirdPartyRuleOptions,omitempty"`
421+
ComplianceRuleOptions *CloudConfigurationComplianceRuleOptions `json:"complianceRuleOptions,omitempty"`
422+
DecreaseCriticalityBasedOnEnv *bool `json:"decreaseCriticalityBasedOnEnv,omitempty"`
423+
DetectionMethod *SecurityMonitoringRuleDetectionMethod `json:"detectionMethod,omitempty"`
424+
EvaluationWindow *SecurityMonitoringRuleEvaluationWindow `json:"evaluationWindow,omitempty"`
425+
HardcodedEvaluatorType *SecurityMonitoringRuleHardcodedEvaluatorType `json:"hardcodedEvaluatorType,omitempty"`
426+
ImpossibleTravelOptions *SecurityMonitoringRuleImpossibleTravelOptions `json:"impossibleTravelOptions,omitempty"`
427+
KeepAlive *SecurityMonitoringRuleKeepAlive `json:"keepAlive,omitempty"`
428+
MaxSignalDuration *SecurityMonitoringRuleMaxSignalDuration `json:"maxSignalDuration,omitempty"`
429+
NewValueOptions *SecurityMonitoringRuleNewValueOptions `json:"newValueOptions,omitempty"`
430+
SequenceDetectionOptions *SecurityMonitoringRuleSequenceDetectionOptions `json:"sequenceDetectionOptions,omitempty"`
431+
ThirdPartyRuleOptions *SecurityMonitoringRuleThirdPartyOptions `json:"thirdPartyRuleOptions,omitempty"`
398432
}{}
399433
if err = datadog.Unmarshal(bytes, &all); err != nil {
400434
return datadog.Unmarshal(bytes, &o.UnparsedObject)
401435
}
402436
additionalProperties := make(map[string]interface{})
403437
if err = datadog.Unmarshal(bytes, &additionalProperties); err == nil {
404-
datadog.DeleteKeys(additionalProperties, &[]string{"complianceRuleOptions", "decreaseCriticalityBasedOnEnv", "detectionMethod", "evaluationWindow", "hardcodedEvaluatorType", "impossibleTravelOptions", "keepAlive", "maxSignalDuration", "newValueOptions", "thirdPartyRuleOptions"})
438+
datadog.DeleteKeys(additionalProperties, &[]string{"complianceRuleOptions", "decreaseCriticalityBasedOnEnv", "detectionMethod", "evaluationWindow", "hardcodedEvaluatorType", "impossibleTravelOptions", "keepAlive", "maxSignalDuration", "newValueOptions", "sequenceDetectionOptions", "thirdPartyRuleOptions"})
405439
} else {
406440
return err
407441
}
@@ -445,6 +479,10 @@ func (o *SecurityMonitoringRuleOptions) UnmarshalJSON(bytes []byte) (err error)
445479
hasInvalidField = true
446480
}
447481
o.NewValueOptions = all.NewValueOptions
482+
if all.SequenceDetectionOptions != nil && all.SequenceDetectionOptions.UnparsedObject != nil && o.UnparsedObject == nil {
483+
hasInvalidField = true
484+
}
485+
o.SequenceDetectionOptions = all.SequenceDetectionOptions
448486
if all.ThirdPartyRuleOptions != nil && all.ThirdPartyRuleOptions.UnparsedObject != nil && o.UnparsedObject == nil {
449487
hasInvalidField = true
450488
}

0 commit comments

Comments
 (0)