@@ -58510,6 +58510,17 @@ components:
5851058510 required:
5851158511 - data
5851258512 type: object
58513+ SecurityMonitoringSignalInvestigationQueryTemplateVariables:
58514+ additionalProperties:
58515+ items:
58516+ description: A value for this template variable extracted from the signal.
58517+ type: string
58518+ type: array
58519+ description: Template variables applied to the investigation log query, mapping attribute paths to values extracted from the signal.
58520+ example:
58521+ "@userIdentity.arn":
58522+ - foo
58523+ type: object
5851358524 SecurityMonitoringSignalListRequest:
5851458525 description: The request for a security signal list.
5851558526 properties:
@@ -58895,6 +58906,82 @@ components:
5889558906 required:
5889658907 - data
5889758908 type: object
58909+ SecurityMonitoringSignalSuggestedAction:
58910+ description: A suggested action for a security signal.
58911+ properties:
58912+ attributes:
58913+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionAttributes"
58914+ id:
58915+ description: The unique ID of the suggested action.
58916+ example: w00-t10-992
58917+ type: string
58918+ type:
58919+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionType"
58920+ required:
58921+ - id
58922+ - type
58923+ - attributes
58924+ type: object
58925+ SecurityMonitoringSignalSuggestedActionAttributes:
58926+ description: Attributes of a suggested action for a security signal. The available fields depend on the action type.
58927+ properties:
58928+ name:
58929+ description: The name of the investigation log query.
58930+ example: Cloudtrail events for user ARN
58931+ type: string
58932+ query_filter:
58933+ description: The log query filter for the investigation.
58934+ example: 'source:cloudtrail @userIdentity.arn:"foo"'
58935+ type: string
58936+ template_variables:
58937+ $ref: "#/components/schemas/SecurityMonitoringSignalInvestigationQueryTemplateVariables"
58938+ title:
58939+ description: The title of the recommended blog post.
58940+ example: Monitor Okta logs to track system access and unusual activity
58941+ type: string
58942+ url:
58943+ description: The URL of the suggested action.
58944+ example: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
58945+ type: string
58946+ type: object
58947+ SecurityMonitoringSignalSuggestedActionList:
58948+ description: List of suggested actions for a security signal.
58949+ example:
58950+ - attributes:
58951+ name: Cloudtrail events for user ARN
58952+ query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
58953+ template_variables:
58954+ "@userIdentity.arn":
58955+ - foo
58956+ url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
58957+ id: w00-t10-992
58958+ type: investigation_log_queries
58959+ - attributes:
58960+ title: Monitor Okta logs to track system access and unusual activity
58961+ url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
58962+ id: bxy-o8v-i1a
58963+ type: recommended_blog_posts
58964+ items:
58965+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedAction"
58966+ type: array
58967+ SecurityMonitoringSignalSuggestedActionType:
58968+ description: The type of the suggested action resource.
58969+ enum:
58970+ - investigation_log_queries
58971+ - recommended_blog_posts
58972+ example: investigation_log_queries
58973+ type: string
58974+ x-enum-varnames:
58975+ - INVESTIGATION_LOG_QUERIES
58976+ - RECOMMENDED_BLOG_POSTS
58977+ SecurityMonitoringSignalSuggestedActionsResponse:
58978+ description: Response with suggested actions for a security signal.
58979+ properties:
58980+ data:
58981+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionList"
58982+ required:
58983+ - data
58984+ type: object
5889858985 SecurityMonitoringSignalTriageAttributes:
5889958986 description: Attributes describing a triage state update operation over a security signal.
5890058987 properties:
@@ -104670,6 +104757,56 @@ paths:
104670104757 operator: OR
104671104758 permissions:
104672104759 - security_monitoring_signals_write
104760+ /api/v2/security_monitoring/signals/{signal_id}/investigation_queries:
104761+ get:
104762+ description: Returns the list of investigation log queries available for a given security signal.
104763+ operationId: GetInvestigationLogQueriesMatchingSignal
104764+ parameters:
104765+ - $ref: "#/components/parameters/SignalID"
104766+ responses:
104767+ "200":
104768+ content:
104769+ application/json:
104770+ examples:
104771+ default:
104772+ value:
104773+ data:
104774+ - attributes:
104775+ name: Cloudtrail events for user ARN
104776+ query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
104777+ template_variables:
104778+ "@userIdentity.arn":
104779+ - foo
104780+ url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
104781+ id: w00-t10-992
104782+ type: investigation_log_queries
104783+ - attributes:
104784+ title: Monitor Okta logs to track system access and unusual activity
104785+ url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
104786+ id: bxy-o8v-i1a
104787+ type: recommended_blog_posts
104788+ schema:
104789+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionsResponse"
104790+ description: OK
104791+ "403":
104792+ $ref: "#/components/responses/NotAuthorizedResponse"
104793+ "404":
104794+ $ref: "#/components/responses/NotFoundResponse"
104795+ "429":
104796+ $ref: "#/components/responses/TooManyRequestsResponse"
104797+ security:
104798+ - apiKeyAuth: []
104799+ appKeyAuth: []
104800+ - AuthZ:
104801+ - security_monitoring_rules_read
104802+ - security_monitoring_signals_read
104803+ summary: Get investigation queries for a signal
104804+ tags: ["Security Monitoring"]
104805+ x-permission:
104806+ operator: AND
104807+ permissions:
104808+ - security_monitoring_rules_read
104809+ - security_monitoring_signals_read
104673104810 /api/v2/security_monitoring/signals/{signal_id}/state:
104674104811 patch:
104675104812 description: |-
@@ -104710,6 +104847,56 @@ paths:
104710104847 operator: OR
104711104848 permissions:
104712104849 - security_monitoring_signals_write
104850+ /api/v2/security_monitoring/signals/{signal_id}/suggested_actions:
104851+ get:
104852+ description: Returns the list of suggested actions for a given security signal.
104853+ operationId: GetSuggestedActionsMatchingSignal
104854+ parameters:
104855+ - $ref: "#/components/parameters/SignalID"
104856+ responses:
104857+ "200":
104858+ content:
104859+ application/json:
104860+ examples:
104861+ default:
104862+ value:
104863+ data:
104864+ - attributes:
104865+ name: Cloudtrail events for user ARN
104866+ query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
104867+ template_variables:
104868+ "@userIdentity.arn":
104869+ - foo
104870+ url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
104871+ id: w00-t10-992
104872+ type: investigation_log_queries
104873+ - attributes:
104874+ title: Monitor Okta logs to track system access and unusual activity
104875+ url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
104876+ id: bxy-o8v-i1a
104877+ type: recommended_blog_posts
104878+ schema:
104879+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionsResponse"
104880+ description: OK
104881+ "403":
104882+ $ref: "#/components/responses/NotAuthorizedResponse"
104883+ "404":
104884+ $ref: "#/components/responses/NotFoundResponse"
104885+ "429":
104886+ $ref: "#/components/responses/TooManyRequestsResponse"
104887+ security:
104888+ - apiKeyAuth: []
104889+ appKeyAuth: []
104890+ - AuthZ:
104891+ - security_monitoring_rules_read
104892+ - security_monitoring_signals_read
104893+ summary: Get suggested actions for a signal
104894+ tags: ["Security Monitoring"]
104895+ x-permission:
104896+ operator: AND
104897+ permissions:
104898+ - security_monitoring_rules_read
104899+ - security_monitoring_signals_read
104713104900 /api/v2/sensitive-data-scanner/config:
104714104901 get:
104715104902 description: List all the Scanning groups in your organization.
0 commit comments