@@ -59499,6 +59499,17 @@ components:
5949959499 required:
5950059500 - data
5950159501 type: object
59502+ SecurityMonitoringSignalInvestigationQueryTemplateVariables:
59503+ additionalProperties:
59504+ items:
59505+ description: A value for this template variable extracted from the signal.
59506+ type: string
59507+ type: array
59508+ description: Template variables applied to the investigation log query, mapping attribute paths to values extracted from the signal.
59509+ example:
59510+ "@userIdentity.arn":
59511+ - foo
59512+ type: object
5950259513 SecurityMonitoringSignalListRequest:
5950359514 description: The request for a security signal list.
5950459515 properties:
@@ -59884,6 +59895,82 @@ components:
5988459895 required:
5988559896 - data
5988659897 type: object
59898+ SecurityMonitoringSignalSuggestedAction:
59899+ description: A suggested action for a security signal.
59900+ properties:
59901+ attributes:
59902+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionAttributes"
59903+ id:
59904+ description: The unique ID of the suggested action.
59905+ example: w00-t10-992
59906+ type: string
59907+ type:
59908+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionType"
59909+ required:
59910+ - id
59911+ - type
59912+ - attributes
59913+ type: object
59914+ SecurityMonitoringSignalSuggestedActionAttributes:
59915+ description: Attributes of a suggested action for a security signal. The available fields depend on the action type.
59916+ properties:
59917+ name:
59918+ description: The name of the investigation log query.
59919+ example: Cloudtrail events for user ARN
59920+ type: string
59921+ query_filter:
59922+ description: The log query filter for the investigation.
59923+ example: 'source:cloudtrail @userIdentity.arn:"foo"'
59924+ type: string
59925+ template_variables:
59926+ $ref: "#/components/schemas/SecurityMonitoringSignalInvestigationQueryTemplateVariables"
59927+ title:
59928+ description: The title of the recommended blog post.
59929+ example: Monitor Okta logs to track system access and unusual activity
59930+ type: string
59931+ url:
59932+ description: The URL of the suggested action.
59933+ example: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
59934+ type: string
59935+ type: object
59936+ SecurityMonitoringSignalSuggestedActionList:
59937+ description: List of suggested actions for a security signal.
59938+ example:
59939+ - attributes:
59940+ name: Cloudtrail events for user ARN
59941+ query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
59942+ template_variables:
59943+ "@userIdentity.arn":
59944+ - foo
59945+ url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
59946+ id: w00-t10-992
59947+ type: investigation_log_queries
59948+ - attributes:
59949+ title: Monitor Okta logs to track system access and unusual activity
59950+ url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
59951+ id: bxy-o8v-i1a
59952+ type: recommended_blog_posts
59953+ items:
59954+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedAction"
59955+ type: array
59956+ SecurityMonitoringSignalSuggestedActionType:
59957+ description: The type of the suggested action resource.
59958+ enum:
59959+ - investigation_log_queries
59960+ - recommended_blog_posts
59961+ example: investigation_log_queries
59962+ type: string
59963+ x-enum-varnames:
59964+ - INVESTIGATION_LOG_QUERIES
59965+ - RECOMMENDED_BLOG_POSTS
59966+ SecurityMonitoringSignalSuggestedActionsResponse:
59967+ description: Response with suggested actions for a security signal.
59968+ properties:
59969+ data:
59970+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionList"
59971+ required:
59972+ - data
59973+ type: object
5988759974 SecurityMonitoringSignalTriageAttributes:
5988859975 description: Attributes describing a triage state update operation over a security signal.
5988959976 properties:
@@ -106943,6 +107030,54 @@ paths:
106943107030 operator: OR
106944107031 permissions:
106945107032 - security_monitoring_signals_write
107033+ /api/v2/security_monitoring/signals/{signal_id}/investigation_queries:
107034+ get:
107035+ description: Get the list of investigation log queries available for a given security signal.
107036+ operationId: GetInvestigationLogQueriesMatchingSignal
107037+ parameters:
107038+ - $ref: "#/components/parameters/SignalID"
107039+ responses:
107040+ "200":
107041+ content:
107042+ application/json:
107043+ example:
107044+ data:
107045+ - attributes:
107046+ name: Cloudtrail events for user ARN
107047+ query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
107048+ template_variables:
107049+ "@userIdentity.arn":
107050+ - foo
107051+ url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
107052+ id: w00-t10-992
107053+ type: investigation_log_queries
107054+ - attributes:
107055+ title: Monitor Okta logs to track system access and unusual activity
107056+ url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
107057+ id: bxy-o8v-i1a
107058+ type: recommended_blog_posts
107059+ schema:
107060+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionsResponse"
107061+ description: OK
107062+ "403":
107063+ $ref: "#/components/responses/NotAuthorizedResponse"
107064+ "404":
107065+ $ref: "#/components/responses/NotFoundResponse"
107066+ "429":
107067+ $ref: "#/components/responses/TooManyRequestsResponse"
107068+ security:
107069+ - apiKeyAuth: []
107070+ appKeyAuth: []
107071+ - AuthZ:
107072+ - security_monitoring_rules_read
107073+ - security_monitoring_signals_read
107074+ summary: Get investigation queries for a signal
107075+ tags: ["Security Monitoring"]
107076+ x-permission:
107077+ operator: AND
107078+ permissions:
107079+ - security_monitoring_rules_read
107080+ - security_monitoring_signals_read
106946107081 /api/v2/security_monitoring/signals/{signal_id}/state:
106947107082 patch:
106948107083 description: |-
@@ -106983,6 +107118,54 @@ paths:
106983107118 operator: OR
106984107119 permissions:
106985107120 - security_monitoring_signals_write
107121+ /api/v2/security_monitoring/signals/{signal_id}/suggested_actions:
107122+ get:
107123+ description: Get the list of suggested actions for a given security signal.
107124+ operationId: GetSuggestedActionsMatchingSignal
107125+ parameters:
107126+ - $ref: "#/components/parameters/SignalID"
107127+ responses:
107128+ "200":
107129+ content:
107130+ application/json:
107131+ example:
107132+ data:
107133+ - attributes:
107134+ name: Cloudtrail events for user ARN
107135+ query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
107136+ template_variables:
107137+ "@userIdentity.arn":
107138+ - foo
107139+ url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
107140+ id: w00-t10-992
107141+ type: investigation_log_queries
107142+ - attributes:
107143+ title: Monitor Okta logs to track system access and unusual activity
107144+ url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
107145+ id: bxy-o8v-i1a
107146+ type: recommended_blog_posts
107147+ schema:
107148+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionsResponse"
107149+ description: OK
107150+ "403":
107151+ $ref: "#/components/responses/NotAuthorizedResponse"
107152+ "404":
107153+ $ref: "#/components/responses/NotFoundResponse"
107154+ "429":
107155+ $ref: "#/components/responses/TooManyRequestsResponse"
107156+ security:
107157+ - apiKeyAuth: []
107158+ appKeyAuth: []
107159+ - AuthZ:
107160+ - security_monitoring_rules_read
107161+ - security_monitoring_signals_read
107162+ summary: Get suggested actions for a signal
107163+ tags: ["Security Monitoring"]
107164+ x-permission:
107165+ operator: AND
107166+ permissions:
107167+ - security_monitoring_rules_read
107168+ - security_monitoring_signals_read
106986107169 /api/v2/sensitive-data-scanner/config:
106987107170 get:
106988107171 description: List all the Scanning groups in your organization.
0 commit comments