@@ -59138,6 +59138,17 @@ components:
5913859138 required:
5913959139 - data
5914059140 type: object
59141+ SecurityMonitoringSignalInvestigationQueryTemplateVariables:
59142+ additionalProperties:
59143+ items:
59144+ description: A value for this template variable extracted from the signal.
59145+ type: string
59146+ type: array
59147+ description: Template variables applied to the investigation log query, mapping attribute paths to values extracted from the signal.
59148+ example:
59149+ "@userIdentity.arn":
59150+ - foo
59151+ type: object
5914159152 SecurityMonitoringSignalListRequest:
5914259153 description: The request for a security signal list.
5914359154 properties:
@@ -59523,6 +59534,82 @@ components:
5952359534 required:
5952459535 - data
5952559536 type: object
59537+ SecurityMonitoringSignalSuggestedAction:
59538+ description: A suggested action for a security signal.
59539+ properties:
59540+ attributes:
59541+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionAttributes"
59542+ id:
59543+ description: The unique ID of the suggested action.
59544+ example: w00-t10-992
59545+ type: string
59546+ type:
59547+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionType"
59548+ required:
59549+ - id
59550+ - type
59551+ - attributes
59552+ type: object
59553+ SecurityMonitoringSignalSuggestedActionAttributes:
59554+ description: Attributes of a suggested action for a security signal. The available fields depend on the action type.
59555+ properties:
59556+ name:
59557+ description: The name of the investigation log query.
59558+ example: Cloudtrail events for user ARN
59559+ type: string
59560+ query_filter:
59561+ description: The log query filter for the investigation.
59562+ example: 'source:cloudtrail @userIdentity.arn:"foo"'
59563+ type: string
59564+ template_variables:
59565+ $ref: "#/components/schemas/SecurityMonitoringSignalInvestigationQueryTemplateVariables"
59566+ title:
59567+ description: The title of the recommended blog post.
59568+ example: Monitor Okta logs to track system access and unusual activity
59569+ type: string
59570+ url:
59571+ description: The URL of the suggested action.
59572+ example: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
59573+ type: string
59574+ type: object
59575+ SecurityMonitoringSignalSuggestedActionList:
59576+ description: List of suggested actions for a security signal.
59577+ example:
59578+ - attributes:
59579+ name: Cloudtrail events for user ARN
59580+ query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
59581+ template_variables:
59582+ "@userIdentity.arn":
59583+ - foo
59584+ url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
59585+ id: w00-t10-992
59586+ type: investigation_log_queries
59587+ - attributes:
59588+ title: Monitor Okta logs to track system access and unusual activity
59589+ url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
59590+ id: bxy-o8v-i1a
59591+ type: recommended_blog_posts
59592+ items:
59593+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedAction"
59594+ type: array
59595+ SecurityMonitoringSignalSuggestedActionType:
59596+ description: The type of the suggested action resource.
59597+ enum:
59598+ - investigation_log_queries
59599+ - recommended_blog_posts
59600+ example: investigation_log_queries
59601+ type: string
59602+ x-enum-varnames:
59603+ - INVESTIGATION_LOG_QUERIES
59604+ - RECOMMENDED_BLOG_POSTS
59605+ SecurityMonitoringSignalSuggestedActionsResponse:
59606+ description: Response with suggested actions for a security signal.
59607+ properties:
59608+ data:
59609+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionList"
59610+ required:
59611+ - data
59612+ type: object
5952659613 SecurityMonitoringSignalTriageAttributes:
5952759614 description: Attributes describing a triage state update operation over a security signal.
5952859615 properties:
@@ -105894,6 +105981,56 @@ paths:
105894105981 operator: OR
105895105982 permissions:
105896105983 - security_monitoring_signals_write
105984+ /api/v2/security_monitoring/signals/{signal_id}/investigation_queries:
105985+ get:
105986+ description: Get the list of investigation log queries available for a given security signal.
105987+ operationId: GetInvestigationLogQueriesMatchingSignal
105988+ parameters:
105989+ - $ref: "#/components/parameters/SignalID"
105990+ responses:
105991+ "200":
105992+ content:
105993+ application/json:
105994+ examples:
105995+ default:
105996+ value:
105997+ data:
105998+ - attributes:
105999+ name: Cloudtrail events for user ARN
106000+ query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
106001+ template_variables:
106002+ "@userIdentity.arn":
106003+ - foo
106004+ url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
106005+ id: w00-t10-992
106006+ type: investigation_log_queries
106007+ - attributes:
106008+ title: Monitor Okta logs to track system access and unusual activity
106009+ url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
106010+ id: bxy-o8v-i1a
106011+ type: recommended_blog_posts
106012+ schema:
106013+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionsResponse"
106014+ description: OK
106015+ "403":
106016+ $ref: "#/components/responses/NotAuthorizedResponse"
106017+ "404":
106018+ $ref: "#/components/responses/NotFoundResponse"
106019+ "429":
106020+ $ref: "#/components/responses/TooManyRequestsResponse"
106021+ security:
106022+ - apiKeyAuth: []
106023+ appKeyAuth: []
106024+ - AuthZ:
106025+ - security_monitoring_rules_read
106026+ - security_monitoring_signals_read
106027+ summary: Get investigation queries for a signal
106028+ tags: ["Security Monitoring"]
106029+ x-permission:
106030+ operator: AND
106031+ permissions:
106032+ - security_monitoring_rules_read
106033+ - security_monitoring_signals_read
105897106034 /api/v2/security_monitoring/signals/{signal_id}/state:
105898106035 patch:
105899106036 description: |-
@@ -105934,6 +106071,56 @@ paths:
105934106071 operator: OR
105935106072 permissions:
105936106073 - security_monitoring_signals_write
106074+ /api/v2/security_monitoring/signals/{signal_id}/suggested_actions:
106075+ get:
106076+ description: Get the list of suggested actions for a given security signal.
106077+ operationId: GetSuggestedActionsMatchingSignal
106078+ parameters:
106079+ - $ref: "#/components/parameters/SignalID"
106080+ responses:
106081+ "200":
106082+ content:
106083+ application/json:
106084+ examples:
106085+ default:
106086+ value:
106087+ data:
106088+ - attributes:
106089+ name: Cloudtrail events for user ARN
106090+ query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
106091+ template_variables:
106092+ "@userIdentity.arn":
106093+ - foo
106094+ url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
106095+ id: w00-t10-992
106096+ type: investigation_log_queries
106097+ - attributes:
106098+ title: Monitor Okta logs to track system access and unusual activity
106099+ url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
106100+ id: bxy-o8v-i1a
106101+ type: recommended_blog_posts
106102+ schema:
106103+ $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionsResponse"
106104+ description: OK
106105+ "403":
106106+ $ref: "#/components/responses/NotAuthorizedResponse"
106107+ "404":
106108+ $ref: "#/components/responses/NotFoundResponse"
106109+ "429":
106110+ $ref: "#/components/responses/TooManyRequestsResponse"
106111+ security:
106112+ - apiKeyAuth: []
106113+ appKeyAuth: []
106114+ - AuthZ:
106115+ - security_monitoring_rules_read
106116+ - security_monitoring_signals_read
106117+ summary: Get suggested actions for a signal
106118+ tags: ["Security Monitoring"]
106119+ x-permission:
106120+ operator: AND
106121+ permissions:
106122+ - security_monitoring_rules_read
106123+ - security_monitoring_signals_read
105937106124 /api/v2/sensitive-data-scanner/config:
105938106125 get:
105939106126 description: List all the Scanning groups in your organization.
0 commit comments