@@ -59138,6 +59138,17 @@ components:
5913859138 required:
5913959139 - data
5914059140 type: object
59141+ SecurityMonitoringSignalInvestigationQueryTemplateVariables:
59142+ additionalProperties:
59143+ items:
59144+ description: A value for this template variable extracted from the signal.
59145+ type: string
59146+ type: array
59147+ description: Template variables applied to the investigation log query, mapping attribute paths to values extracted from the signal.
59148+ example:
59149+ "@userIdentity.arn":
59150+ - foo
59151+ type: object
5914159152 SecurityMonitoringSignalListRequest:
5914259153 description: The request for a security signal list.
5914359154 properties:
@@ -59523,6 +59534,82 @@ components:
5952359534 required:
5952459535 - data
5952559536 type: object
59537+ SecurityMonitoringSignalSuggestedAction:
59538+ description: A suggested action for a security signal.
59539+ properties:
59540+ attributes:
59541+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionAttributes"
59542+ id:
59543+ description: The unique ID of the suggested action.
59544+ example: w00-t10-992
59545+ type: string
59546+ type:
59547+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionType"
59548+ required:
59549+ - id
59550+ - type
59551+ - attributes
59552+ type: object
59553+ SecurityMonitoringSignalSuggestedActionAttributes:
59554+ description: Attributes of a suggested action for a security signal. The available fields depend on the action type.
59555+ properties:
59556+ name:
59557+ description: The name of the investigation log query.
59558+ example: Cloudtrail events for user ARN
59559+ type: string
59560+ query_filter:
59561+ description: The log query filter for the investigation.
59562+ example: 'source:cloudtrail @userIdentity.arn:"foo"'
59563+ type: string
59564+ template_variables:
59565+ $ref: "#/components/schemas/SecurityMonitoringSignalInvestigationQueryTemplateVariables"
59566+ title:
59567+ description: The title of the recommended blog post.
59568+ example: Monitor Okta logs to track system access and unusual activity
59569+ type: string
59570+ url:
59571+ description: The URL of the suggested action.
59572+ example: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
59573+ type: string
59574+ type: object
59575+ SecurityMonitoringSignalSuggestedActionList:
59576+ description: List of suggested actions for a security signal.
59577+ example:
59578+ - attributes:
59579+ name: Cloudtrail events for user ARN
59580+ query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
59581+ template_variables:
59582+ "@userIdentity.arn":
59583+ - foo
59584+ url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
59585+ id: w00-t10-992
59586+ type: investigation_log_queries
59587+ - attributes:
59588+ title: Monitor Okta logs to track system access and unusual activity
59589+ url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
59590+ id: bxy-o8v-i1a
59591+ type: recommended_blog_posts
59592+ items:
59593+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedAction"
59594+ type: array
59595+ SecurityMonitoringSignalSuggestedActionType:
59596+ description: The type of the suggested action resource.
59597+ enum:
59598+ - investigation_log_queries
59599+ - recommended_blog_posts
59600+ example: investigation_log_queries
59601+ type: string
59602+ x-enum-varnames:
59603+ - INVESTIGATION_LOG_QUERIES
59604+ - RECOMMENDED_BLOG_POSTS
59605+ SecurityMonitoringSignalSuggestedActionsResponse:
59606+ description: Response with suggested actions for a security signal.
59607+ properties:
59608+ data:
59609+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionList"
59610+ required:
59611+ - data
59612+ type: object
5952659613 SecurityMonitoringSignalTriageAttributes:
5952759614 description: Attributes describing a triage state update operation over a security signal.
5952859615 properties:
@@ -105894,6 +105981,54 @@ paths:
105894105981 operator: OR
105895105982 permissions:
105896105983 - security_monitoring_signals_write
105984+ /api/v2/security_monitoring/signals/{signal_id}/investigation_queries:
105985+ get:
105986+ description: Get the list of investigation log queries available for a given security signal.
105987+ operationId: GetInvestigationLogQueriesMatchingSignal
105988+ parameters:
105989+ - $ref: "#/components/parameters/SignalID"
105990+ responses:
105991+ "200":
105992+ content:
105993+ application/json:
105994+ example:
105995+ data:
105996+ - attributes:
105997+ name: Cloudtrail events for user ARN
105998+ query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
105999+ template_variables:
106000+ "@userIdentity.arn":
106001+ - foo
106002+ url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
106003+ id: w00-t10-992
106004+ type: investigation_log_queries
106005+ - attributes:
106006+ title: Monitor Okta logs to track system access and unusual activity
106007+ url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
106008+ id: bxy-o8v-i1a
106009+ type: recommended_blog_posts
106010+ schema:
106011+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionsResponse"
106012+ description: OK
106013+ "403":
106014+ $ref: "#/components/responses/NotAuthorizedResponse"
106015+ "404":
106016+ $ref: "#/components/responses/NotFoundResponse"
106017+ "429":
106018+ $ref: "#/components/responses/TooManyRequestsResponse"
106019+ security:
106020+ - apiKeyAuth: []
106021+ appKeyAuth: []
106022+ - AuthZ:
106023+ - security_monitoring_rules_read
106024+ - security_monitoring_signals_read
106025+ summary: Get investigation queries for a signal
106026+ tags: ["Security Monitoring"]
106027+ x-permission:
106028+ operator: AND
106029+ permissions:
106030+ - security_monitoring_rules_read
106031+ - security_monitoring_signals_read
105897106032 /api/v2/security_monitoring/signals/{signal_id}/state:
105898106033 patch:
105899106034 description: |-
@@ -105934,6 +106069,54 @@ paths:
105934106069 operator: OR
105935106070 permissions:
105936106071 - security_monitoring_signals_write
106072+ /api/v2/security_monitoring/signals/{signal_id}/suggested_actions:
106073+ get:
106074+ description: Get the list of suggested actions for a given security signal.
106075+ operationId: GetSuggestedActionsMatchingSignal
106076+ parameters:
106077+ - $ref: "#/components/parameters/SignalID"
106078+ responses:
106079+ "200":
106080+ content:
106081+ application/json:
106082+ example:
106083+ data:
106084+ - attributes:
106085+ name: Cloudtrail events for user ARN
106086+ query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
106087+ template_variables:
106088+ "@userIdentity.arn":
106089+ - foo
106090+ url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
106091+ id: w00-t10-992
106092+ type: investigation_log_queries
106093+ - attributes:
106094+ title: Monitor Okta logs to track system access and unusual activity
106095+ url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
106096+ id: bxy-o8v-i1a
106097+ type: recommended_blog_posts
106098+ schema:
106099+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionsResponse"
106100+ description: OK
106101+ "403":
106102+ $ref: "#/components/responses/NotAuthorizedResponse"
106103+ "404":
106104+ $ref: "#/components/responses/NotFoundResponse"
106105+ "429":
106106+ $ref: "#/components/responses/TooManyRequestsResponse"
106107+ security:
106108+ - apiKeyAuth: []
106109+ appKeyAuth: []
106110+ - AuthZ:
106111+ - security_monitoring_rules_read
106112+ - security_monitoring_signals_read
106113+ summary: Get suggested actions for a signal
106114+ tags: ["Security Monitoring"]
106115+ x-permission:
106116+ operator: AND
106117+ permissions:
106118+ - security_monitoring_rules_read
106119+ - security_monitoring_signals_read
105937106120 /api/v2/sensitive-data-scanner/config:
105938106121 get:
105939106122 description: List all the Scanning groups in your organization.
0 commit comments