@@ -58468,6 +58468,155 @@ components:
5846858468 description: Version of the updated signal. If server side version is higher, update will be rejected.
5846958469 format: int64
5847058470 type: integer
58471+ SecurityMonitoringSignalsBulkAssigneeUpdateAttributes:
58472+ description: Attributes describing the new assignees for a bulk signal update.
58473+ properties:
58474+ assignee:
58475+ description: UUID of the user to assign to the signal. Use an empty string to unassign.
58476+ example: 773b045d-ccf8-4808-bd3b-955ef6a8c940
58477+ type: string
58478+ version:
58479+ $ref: "#/components/schemas/SecurityMonitoringSignalVersion"
58480+ required:
58481+ - assignee
58482+ type: object
58483+ SecurityMonitoringSignalsBulkAssigneeUpdateData:
58484+ description: Data for updating the assignees for multiple security signals.
58485+ properties:
58486+ attributes:
58487+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkAssigneeUpdateAttributes"
58488+ id:
58489+ description: The unique ID of the security signal.
58490+ example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
58491+ type: string
58492+ type:
58493+ $ref: "#/components/schemas/SecurityMonitoringSignalType"
58494+ required:
58495+ - id
58496+ - attributes
58497+ type: object
58498+ SecurityMonitoringSignalsBulkAssigneeUpdateRequest:
58499+ description: Request body for updating the assignee of multiple security signals.
58500+ properties:
58501+ data:
58502+ description: An array of signal assignee updates.
58503+ items:
58504+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkAssigneeUpdateData"
58505+ maxItems: 199
58506+ type: array
58507+ required:
58508+ - data
58509+ type: object
58510+ SecurityMonitoringSignalsBulkStateUpdateData:
58511+ description: Data for updating the state for multiple security signals.
58512+ properties:
58513+ attributes:
58514+ $ref: "#/components/schemas/SecurityMonitoringSignalStateUpdateAttributes"
58515+ id:
58516+ description: The unique ID of the security signal.
58517+ example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
58518+ type: string
58519+ type:
58520+ $ref: "#/components/schemas/SecurityMonitoringSignalType"
58521+ required:
58522+ - id
58523+ - attributes
58524+ type: object
58525+ SecurityMonitoringSignalsBulkStateUpdateRequest:
58526+ description: Request body for updating the triage states of multiple security signals.
58527+ properties:
58528+ data:
58529+ description: An array of signal state updates.
58530+ items:
58531+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkStateUpdateData"
58532+ maxItems: 199
58533+ type: array
58534+ required:
58535+ - data
58536+ type: object
58537+ SecurityMonitoringSignalsBulkTriageEvent:
58538+ description: A single signal event entry in a bulk triage update response.
58539+ properties:
58540+ event:
58541+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageEventAttributes"
58542+ id:
58543+ description: The unique ID of the security signal.
58544+ example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
58545+ type: string
58546+ required:
58547+ - id
58548+ - event
58549+ type: object
58550+ SecurityMonitoringSignalsBulkTriageEventAttributes:
58551+ description: Triage attributes of a security signal returned in a bulk update response.
58552+ properties:
58553+ archive_comment:
58554+ $ref: "#/components/schemas/SecurityMonitoringSignalArchiveComment"
58555+ archive_comment_timestamp:
58556+ description: Timestamp of the last edit to the archive comment.
58557+ format: int64
58558+ type: integer
58559+ archive_comment_user:
58560+ $ref: "#/components/schemas/SecurityMonitoringTriageUser"
58561+ archive_reason:
58562+ $ref: "#/components/schemas/SecurityMonitoringSignalArchiveReason"
58563+ assignee:
58564+ $ref: "#/components/schemas/SecurityMonitoringTriageUser"
58565+ id:
58566+ description: The unique ID of the security signal.
58567+ example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
58568+ type: string
58569+ incident_ids:
58570+ $ref: "#/components/schemas/SecurityMonitoringSignalIncidentIds"
58571+ state:
58572+ $ref: "#/components/schemas/SecurityMonitoringSignalState"
58573+ state_update_timestamp:
58574+ description: Timestamp of the last state update.
58575+ format: int64
58576+ type: integer
58577+ state_update_user:
58578+ $ref: "#/components/schemas/SecurityMonitoringTriageUser"
58579+ required:
58580+ - id
58581+ - state
58582+ - assignee
58583+ - incident_ids
58584+ type: object
58585+ SecurityMonitoringSignalsBulkTriageUpdateResponse:
58586+ description: Response for a bulk triage update of security signals.
58587+ properties:
58588+ result:
58589+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageUpdateResult"
58590+ status:
58591+ description: The status of the bulk operation.
58592+ example: done
58593+ type: string
58594+ type:
58595+ description: The type of the response.
58596+ example: status
58597+ type: string
58598+ required:
58599+ - type
58600+ - status
58601+ - result
58602+ type: object
58603+ SecurityMonitoringSignalsBulkTriageUpdateResult:
58604+ description: The result payload of a bulk signal triage update.
58605+ properties:
58606+ count:
58607+ description: The number of signals updated.
58608+ example: 2
58609+ format: int64
58610+ type: integer
58611+ events:
58612+ description: The list of updated signals.
58613+ items:
58614+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageEvent"
58615+ type: array
58616+ required:
58617+ - count
58618+ - events
58619+ type: object
5847158620 SecurityMonitoringSignalsListResponse:
5847258621 description: "The response object with all security signals matching the request\nand pagination information."
5847358622 properties:
@@ -102391,6 +102540,94 @@ paths:
102391102540 operator: OR
102392102541 permissions:
102393102542 - security_monitoring_signals_read
102543+ /api/v2/security_monitoring/signals/bulk/assignee:
102544+ patch:
102545+ description: |-
102546+ Change the triage assignees of multiple security signals at once.
102547+ The maximum number of signals that can be updated in a single request is 199.
102548+ operationId: BulkEditSecurityMonitoringSignalsAssignee
102549+ requestBody:
102550+ content:
102551+ application/json:
102552+ schema:
102553+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkAssigneeUpdateRequest"
102554+ description: Attributes describing the signal assignee updates.
102555+ required: true
102556+ responses:
102557+ "200":
102558+ content:
102559+ application/json:
102560+ schema:
102561+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageUpdateResponse"
102562+ description: OK
102563+ "400":
102564+ content:
102565+ application/json:
102566+ schema:
102567+ $ref: "#/components/schemas/JSONAPIErrorResponse"
102568+ description: Bad Request
102569+ "403":
102570+ content:
102571+ application/json:
102572+ schema:
102573+ $ref: "#/components/schemas/JSONAPIErrorResponse"
102574+ description: Forbidden
102575+ "429":
102576+ $ref: "#/components/responses/TooManyRequestsResponse"
102577+ summary: Bulk update triage assignee of security signals
102578+ tags: ["Security Monitoring"]
102579+ x-codegen-request-body-name: body
102580+ "x-permission":
102581+ operator: OR
102582+ permissions:
102583+ - security_monitoring_signals_write
102584+ x-unstable: |-
102585+ **Note**: This endpoint is in preview and is subject to change.
102586+ If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
102587+ /api/v2/security_monitoring/signals/bulk/state:
102588+ patch:
102589+ description: |-
102590+ Change the triage states of multiple security signals at once.
102591+ The maximum number of signals that can be updated in a single request is 199.
102592+ operationId: BulkEditSecurityMonitoringSignalsState
102593+ requestBody:
102594+ content:
102595+ application/json:
102596+ schema:
102597+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkStateUpdateRequest"
102598+ description: Attributes describing the signal state updates.
102599+ required: true
102600+ responses:
102601+ "200":
102602+ content:
102603+ application/json:
102604+ schema:
102605+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageUpdateResponse"
102606+ description: OK
102607+ "400":
102608+ content:
102609+ application/json:
102610+ schema:
102611+ $ref: "#/components/schemas/JSONAPIErrorResponse"
102612+ description: Bad Request
102613+ "403":
102614+ content:
102615+ application/json:
102616+ schema:
102617+ $ref: "#/components/schemas/JSONAPIErrorResponse"
102618+ description: Forbidden
102619+ "429":
102620+ $ref: "#/components/responses/TooManyRequestsResponse"
102621+ summary: Bulk update triage state of security signals
102622+ tags: ["Security Monitoring"]
102623+ x-codegen-request-body-name: body
102624+ "x-permission":
102625+ operator: OR
102626+ permissions:
102627+ - security_monitoring_signals_write
102628+ x-unstable: |-
102629+ **Note**: This endpoint is in preview and is subject to change.
102630+ If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
102394102631 /api/v2/security_monitoring/signals/search:
102395102632 post:
102396102633 description: |-
0 commit comments