Skip to content

Commit 935ce0c

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Cloud SIEM - Add instantaneousBaseline feature parameter. (#3503)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent 6e3ded7 commit 935ce0c

6 files changed

Lines changed: 151 additions & 5 deletions

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47596,6 +47596,8 @@ components:
4759647596
properties:
4759747597
forgetAfter:
4759847598
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter'
47599+
instantaneousBaseline:
47600+
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsInstantaneousBaseline'
4759947601
learningDuration:
4760047602
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration'
4760147603
learningMethod:
@@ -47621,6 +47623,13 @@ components:
4762147623
- TWO_WEEKS
4762247624
- THREE_WEEKS
4762347625
- FOUR_WEEKS
47626+
SecurityMonitoringRuleNewValueOptionsInstantaneousBaseline:
47627+
description: When set to true, Datadog uses previous values that fall within
47628+
the defined learning window to construct the baseline, enabling the system
47629+
to establish an accurate baseline more rapidly rather than relying solely
47630+
on gradual learning over time.
47631+
example: false
47632+
type: boolean
4762447633
SecurityMonitoringRuleNewValueOptionsLearningDuration:
4762547634
default: 0
4762647635
description: 'The duration in days during which values are learned, and after

‎api/datadogV2/model_security_monitoring_rule_new_value_options.go‎

Lines changed: 40 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ import (
1212
type SecurityMonitoringRuleNewValueOptions struct {
1313
// The duration in days after which a learned value is forgotten.
1414
ForgetAfter *SecurityMonitoringRuleNewValueOptionsForgetAfter `json:"forgetAfter,omitempty"`
15+
// When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
16+
InstantaneousBaseline *bool `json:"instantaneousBaseline,omitempty"`
1517
// The duration in days during which values are learned, and after which signals will be generated for values that
1618
// weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
1719
LearningDuration *SecurityMonitoringRuleNewValueOptionsLearningDuration `json:"learningDuration,omitempty"`
@@ -81,6 +83,34 @@ func (o *SecurityMonitoringRuleNewValueOptions) SetForgetAfter(v SecurityMonitor
8183
o.ForgetAfter = &v
8284
}
8385

86+
// GetInstantaneousBaseline returns the InstantaneousBaseline field value if set, zero value otherwise.
87+
func (o *SecurityMonitoringRuleNewValueOptions) GetInstantaneousBaseline() bool {
88+
if o == nil || o.InstantaneousBaseline == nil {
89+
var ret bool
90+
return ret
91+
}
92+
return *o.InstantaneousBaseline
93+
}
94+
95+
// GetInstantaneousBaselineOk returns a tuple with the InstantaneousBaseline field value if set, nil otherwise
96+
// and a boolean to check if the value has been set.
97+
func (o *SecurityMonitoringRuleNewValueOptions) GetInstantaneousBaselineOk() (*bool, bool) {
98+
if o == nil || o.InstantaneousBaseline == nil {
99+
return nil, false
100+
}
101+
return o.InstantaneousBaseline, true
102+
}
103+
104+
// HasInstantaneousBaseline returns a boolean if a field has been set.
105+
func (o *SecurityMonitoringRuleNewValueOptions) HasInstantaneousBaseline() bool {
106+
return o != nil && o.InstantaneousBaseline != nil
107+
}
108+
109+
// SetInstantaneousBaseline gets a reference to the given bool and assigns it to the InstantaneousBaseline field.
110+
func (o *SecurityMonitoringRuleNewValueOptions) SetInstantaneousBaseline(v bool) {
111+
o.InstantaneousBaseline = &v
112+
}
113+
84114
// GetLearningDuration returns the LearningDuration field value if set, zero value otherwise.
85115
func (o *SecurityMonitoringRuleNewValueOptions) GetLearningDuration() SecurityMonitoringRuleNewValueOptionsLearningDuration {
86116
if o == nil || o.LearningDuration == nil {
@@ -174,6 +204,9 @@ func (o SecurityMonitoringRuleNewValueOptions) MarshalJSON() ([]byte, error) {
174204
if o.ForgetAfter != nil {
175205
toSerialize["forgetAfter"] = o.ForgetAfter
176206
}
207+
if o.InstantaneousBaseline != nil {
208+
toSerialize["instantaneousBaseline"] = o.InstantaneousBaseline
209+
}
177210
if o.LearningDuration != nil {
178211
toSerialize["learningDuration"] = o.LearningDuration
179212
}
@@ -193,17 +226,18 @@ func (o SecurityMonitoringRuleNewValueOptions) MarshalJSON() ([]byte, error) {
193226
// UnmarshalJSON deserializes the given payload.
194227
func (o *SecurityMonitoringRuleNewValueOptions) UnmarshalJSON(bytes []byte) (err error) {
195228
all := struct {
196-
ForgetAfter *SecurityMonitoringRuleNewValueOptionsForgetAfter `json:"forgetAfter,omitempty"`
197-
LearningDuration *SecurityMonitoringRuleNewValueOptionsLearningDuration `json:"learningDuration,omitempty"`
198-
LearningMethod *SecurityMonitoringRuleNewValueOptionsLearningMethod `json:"learningMethod,omitempty"`
199-
LearningThreshold *SecurityMonitoringRuleNewValueOptionsLearningThreshold `json:"learningThreshold,omitempty"`
229+
ForgetAfter *SecurityMonitoringRuleNewValueOptionsForgetAfter `json:"forgetAfter,omitempty"`
230+
InstantaneousBaseline *bool `json:"instantaneousBaseline,omitempty"`
231+
LearningDuration *SecurityMonitoringRuleNewValueOptionsLearningDuration `json:"learningDuration,omitempty"`
232+
LearningMethod *SecurityMonitoringRuleNewValueOptionsLearningMethod `json:"learningMethod,omitempty"`
233+
LearningThreshold *SecurityMonitoringRuleNewValueOptionsLearningThreshold `json:"learningThreshold,omitempty"`
200234
}{}
201235
if err = datadog.Unmarshal(bytes, &all); err != nil {
202236
return datadog.Unmarshal(bytes, &o.UnparsedObject)
203237
}
204238
additionalProperties := make(map[string]interface{})
205239
if err = datadog.Unmarshal(bytes, &additionalProperties); err == nil {
206-
datadog.DeleteKeys(additionalProperties, &[]string{"forgetAfter", "learningDuration", "learningMethod", "learningThreshold"})
240+
datadog.DeleteKeys(additionalProperties, &[]string{"forgetAfter", "instantaneousBaseline", "learningDuration", "learningMethod", "learningThreshold"})
207241
} else {
208242
return err
209243
}
@@ -214,6 +248,7 @@ func (o *SecurityMonitoringRuleNewValueOptions) UnmarshalJSON(bytes []byte) (err
214248
} else {
215249
o.ForgetAfter = all.ForgetAfter
216250
}
251+
o.InstantaneousBaseline = all.InstantaneousBaseline
217252
if all.LearningDuration != nil && !all.LearningDuration.IsValid() {
218253
hasInvalidField = true
219254
} else {

‎examples/v2/security-monitoring/ValidateSecurityMonitoringRule_2609327779.go‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
// Validate a detection rule with detection method 'new_value' with enabled feature 'instantaneousBaseline' returns "OK"
2+
// response
3+
4+
package main
5+
6+
import (
7+
"context"
8+
"fmt"
9+
"os"
10+
11+
"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
12+
"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
13+
)
14+
15+
func main() {
16+
body := datadogV2.SecurityMonitoringRuleValidatePayload{
17+
SecurityMonitoringStandardRulePayload: &datadogV2.SecurityMonitoringStandardRulePayload{
18+
Cases: []datadogV2.SecurityMonitoringRuleCaseCreate{
19+
{
20+
Name: datadog.PtrString(""),
21+
Status: datadogV2.SECURITYMONITORINGRULESEVERITY_INFO,
22+
Notifications: []string{},
23+
},
24+
},
25+
HasExtendedTitle: datadog.PtrBool(true),
26+
IsEnabled: true,
27+
Message: "My security monitoring rule",
28+
Name: "My security monitoring rule",
29+
Options: datadogV2.SecurityMonitoringRuleOptions{
30+
EvaluationWindow: datadogV2.SECURITYMONITORINGRULEEVALUATIONWINDOW_ZERO_MINUTES.Ptr(),
31+
KeepAlive: datadogV2.SECURITYMONITORINGRULEKEEPALIVE_FIVE_MINUTES.Ptr(),
32+
MaxSignalDuration: datadogV2.SECURITYMONITORINGRULEMAXSIGNALDURATION_TEN_MINUTES.Ptr(),
33+
DetectionMethod: datadogV2.SECURITYMONITORINGRULEDETECTIONMETHOD_NEW_VALUE.Ptr(),
34+
NewValueOptions: &datadogV2.SecurityMonitoringRuleNewValueOptions{
35+
ForgetAfter: datadogV2.SECURITYMONITORINGRULENEWVALUEOPTIONSFORGETAFTER_ONE_WEEK.Ptr(),
36+
InstantaneousBaseline: datadog.PtrBool(true),
37+
LearningDuration: datadogV2.SECURITYMONITORINGRULENEWVALUEOPTIONSLEARNINGDURATION_ONE_DAY.Ptr(),
38+
LearningThreshold: datadogV2.SECURITYMONITORINGRULENEWVALUEOPTIONSLEARNINGTHRESHOLD_ZERO_OCCURRENCES.Ptr(),
39+
LearningMethod: datadogV2.SECURITYMONITORINGRULENEWVALUEOPTIONSLEARNINGMETHOD_DURATION.Ptr(),
40+
},
41+
},
42+
Queries: []datadogV2.SecurityMonitoringStandardRuleQuery{
43+
{
44+
Query: datadog.PtrString("source:source_here"),
45+
GroupByFields: []string{
46+
"@userIdentity.assumed_role",
47+
},
48+
DistinctFields: []string{},
49+
Metric: datadog.PtrString("name"),
50+
Metrics: []string{
51+
"name",
52+
},
53+
Aggregation: datadogV2.SECURITYMONITORINGRULEQUERYAGGREGATION_NEW_VALUE.Ptr(),
54+
Name: datadog.PtrString(""),
55+
DataSource: datadogV2.SECURITYMONITORINGSTANDARDDATASOURCE_LOGS.Ptr(),
56+
},
57+
},
58+
Tags: []string{
59+
"env:prod",
60+
"team:security",
61+
},
62+
Type: datadogV2.SECURITYMONITORINGRULETYPECREATE_LOG_DETECTION.Ptr(),
63+
}}
64+
ctx := datadog.NewDefaultContext(context.Background())
65+
configuration := datadog.NewConfiguration()
66+
apiClient := datadog.NewAPIClient(configuration)
67+
api := datadogV2.NewSecurityMonitoringApi(apiClient)
68+
r, err := api.ValidateSecurityMonitoringRule(ctx, body)
69+
70+
if err != nil {
71+
fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.ValidateSecurityMonitoringRule`: %v\n", err)
72+
fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
73+
}
74+
}

‎tests/scenarios/cassettes/TestScenarios/v2/Feature_Security_Monitoring/Scenario_Validate_a_detection_rule_with_detection_method_new_value_with_enabled_feature_instantaneousBaseline_returns_OK_response.freeze‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2025-12-10T08:37:17.537Z

‎tests/scenarios/cassettes/TestScenarios/v2/Feature_Security_Monitoring/Scenario_Validate_a_detection_rule_with_detection_method_new_value_with_enabled_feature_instantaneousBaseline_returns_OK_response.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
interactions:
2+
- request:
3+
body: |
4+
{"cases":[{"name":"","notifications":[],"status":"info"}],"hasExtendedTitle":true,"isEnabled":true,"message":"My security monitoring rule","name":"My security monitoring rule","options":{"detectionMethod":"new_value","evaluationWindow":0,"keepAlive":300,"maxSignalDuration":600,"newValueOptions":{"forgetAfter":7,"instantaneousBaseline":true,"learningDuration":1,"learningMethod":"duration","learningThreshold":0}},"queries":[{"aggregation":"new_value","dataSource":"logs","distinctFields":[],"groupByFields":["@userIdentity.assumed_role"],"metric":"name","metrics":["name"],"name":"","query":"source:source_here"}],"tags":["env:prod","team:security"],"type":"log_detection"}
5+
form: {}
6+
headers:
7+
Accept:
8+
- '*/*'
9+
Content-Type:
10+
- application/json
11+
id: 0
12+
method: POST
13+
url: https://api.datadoghq.com/api/v2/security_monitoring/rules/validation
14+
response:
15+
body: ''
16+
code: 204
17+
duration: 0ms
18+
headers: {}
19+
status: 204 No Content
20+
version: 2

‎tests/scenarios/features/v2/security_monitoring.feature‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1764,6 +1764,13 @@ Feature: Security Monitoring
17641764
When the request is sent
17651765
Then the response status is 204 OK
17661766

1767+
@team:DataDog/k9-cloud-security-platform
1768+
Scenario: Validate a detection rule with detection method 'new_value' with enabled feature 'instantaneousBaseline' returns "OK" response
1769+
Given new "ValidateSecurityMonitoringRule" request
1770+
And body with value {"cases":[{"name":"","status":"info","notifications":[]}],"hasExtendedTitle":true,"isEnabled":true,"message":"My security monitoring rule","name":"My security monitoring rule","options":{"evaluationWindow":0,"keepAlive":300,"maxSignalDuration":600,"detectionMethod":"new_value","newValueOptions":{"forgetAfter":7,"instantaneousBaseline":true,"learningDuration":1,"learningThreshold":0,"learningMethod":"duration"}},"queries":[{"query":"source:source_here","groupByFields":["@userIdentity.assumed_role"],"distinctFields":[],"metric":"name","metrics":["name"],"aggregation":"new_value","name":"","dataSource":"logs"}],"tags":["env:prod","team:security"],"type":"log_detection"}
1771+
When the request is sent
1772+
Then the response status is 204 OK
1773+
17671774
@team:DataDog/k9-cloud-security-platform
17681775
Scenario: Validate a detection rule with detection method 'sequence_detection' returns "OK" response
17691776
Given new "ValidateSecurityMonitoringRule" request

0 commit comments

Comments
 (0)