Skip to content

Commit f1b9d81

Browse files
author
ci.datadog-api-spec
committed
Regenerate client from commit f93c9c2 of spec repo
1 parent 9010199 commit f1b9d81

16 files changed

+598
-1
lines changed

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19409,6 +19409,8 @@ components:
1940919409
$ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
1941019410
newValueOptions:
1941119411
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
19412+
sequenceDetectionOptions:
19413+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions'
1941219414
thirdPartyRuleOptions:
1941319415
$ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
1941419416
type: object
@@ -39042,6 +39044,7 @@ components:
3904239044
- hardcoded
3904339045
- third_party
3904439046
- anomaly_threshold
39047+
- sequence_detection
3904539048
type: string
3904639049
x-enum-varnames:
3904739050
- THRESHOLD
@@ -39051,6 +39054,7 @@ components:
3905139054
- HARDCODED
3905239055
- THIRD_PARTY
3905339056
- ANOMALY_THRESHOLD
39057+
- SEQUENCE_DETECTION
3905439058
SecurityMonitoringRuleEvaluationWindow:
3905539059
description: 'A time window is specified to match when at least one of the cases
3905639060
matches true. This is a sliding window
@@ -39264,6 +39268,8 @@ components:
3926439268
$ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
3926539269
newValueOptions:
3926639270
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
39271+
sequenceDetectionOptions:
39272+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions'
3926739273
thirdPartyRuleOptions:
3926839274
$ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
3926939275
type: object
@@ -39339,6 +39345,47 @@ components:
3933939345
oneOf:
3934039346
- $ref: '#/components/schemas/SecurityMonitoringStandardRuleResponse'
3934139347
- $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponse'
39348+
SecurityMonitoringRuleSequenceDetectionOptions:
39349+
description: Options on sequence detection method.
39350+
properties:
39351+
stepTransitions:
39352+
description: Transitions defining the allowed order of steps and their evaluation
39353+
windows.
39354+
items:
39355+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionStepTransition'
39356+
type: array
39357+
steps:
39358+
description: Steps that define the conditions to be matched in sequence.
39359+
items:
39360+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionStep'
39361+
type: array
39362+
type: object
39363+
SecurityMonitoringRuleSequenceDetectionStep:
39364+
description: Step definition for sequence detection containing the step name,
39365+
condition, and evaluation window.
39366+
properties:
39367+
condition:
39368+
description: Condition referencing rule queries (e.g., `a > 0`).
39369+
type: string
39370+
evaluationWindow:
39371+
$ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
39372+
name:
39373+
description: Unique name identifying the step.
39374+
type: string
39375+
type: object
39376+
SecurityMonitoringRuleSequenceDetectionStepTransition:
39377+
description: Transition from a parent step to a child step within a sequence
39378+
detection rule.
39379+
properties:
39380+
child:
39381+
description: Name of the child step.
39382+
type: string
39383+
evaluationWindow:
39384+
$ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
39385+
parent:
39386+
description: Name of the parent step.
39387+
type: string
39388+
type: object
3934239389
SecurityMonitoringRuleSeverity:
3934339390
description: Severity of the Security Signal.
3934439391
enum:

‎docs/datadog_api_client.v2.model.rst‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17609,6 +17609,27 @@ datadog\_api\_client.v2.model.security\_monitoring\_rule\_response module
1760917609
:members:
1761017610
:show-inheritance:
1761117611

17612+
datadog\_api\_client.v2.model.security\_monitoring\_rule\_sequence\_detection\_options module
17613+
---------------------------------------------------------------------------------------------
17614+
17615+
.. automodule:: datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_options
17616+
:members:
17617+
:show-inheritance:
17618+
17619+
datadog\_api\_client.v2.model.security\_monitoring\_rule\_sequence\_detection\_step module
17620+
------------------------------------------------------------------------------------------
17621+
17622+
.. automodule:: datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_step
17623+
:members:
17624+
:show-inheritance:
17625+
17626+
datadog\_api\_client.v2.model.security\_monitoring\_rule\_sequence\_detection\_step\_transition module
17627+
------------------------------------------------------------------------------------------------------
17628+
17629+
.. automodule:: datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_step_transition
17630+
:members:
17631+
:show-inheritance:
17632+
1761217633
datadog\_api\_client.v2.model.security\_monitoring\_rule\_severity module
1761317634
-------------------------------------------------------------------------
1761417635

‎examples/v2/security-monitoring/CreateSecurityMonitoringRule_2899714190.py‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
"""
2+
Create a detection rule with detection method 'sequence_detection' returns "OK" response
3+
"""
4+
5+
from datadog_api_client import ApiClient, Configuration
6+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
7+
from datadog_api_client.v2.model.security_monitoring_rule_case_create import SecurityMonitoringRuleCaseCreate
8+
from datadog_api_client.v2.model.security_monitoring_rule_detection_method import SecurityMonitoringRuleDetectionMethod
9+
from datadog_api_client.v2.model.security_monitoring_rule_evaluation_window import (
10+
SecurityMonitoringRuleEvaluationWindow,
11+
)
12+
from datadog_api_client.v2.model.security_monitoring_rule_keep_alive import SecurityMonitoringRuleKeepAlive
13+
from datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration import (
14+
SecurityMonitoringRuleMaxSignalDuration,
15+
)
16+
from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions
17+
from datadog_api_client.v2.model.security_monitoring_rule_query_aggregation import (
18+
SecurityMonitoringRuleQueryAggregation,
19+
)
20+
from datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_options import (
21+
SecurityMonitoringRuleSequenceDetectionOptions,
22+
)
23+
from datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_step import (
24+
SecurityMonitoringRuleSequenceDetectionStep,
25+
)
26+
from datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_step_transition import (
27+
SecurityMonitoringRuleSequenceDetectionStepTransition,
28+
)
29+
from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity
30+
from datadog_api_client.v2.model.security_monitoring_rule_type_create import SecurityMonitoringRuleTypeCreate
31+
from datadog_api_client.v2.model.security_monitoring_standard_data_source import SecurityMonitoringStandardDataSource
32+
from datadog_api_client.v2.model.security_monitoring_standard_rule_create_payload import (
33+
SecurityMonitoringStandardRuleCreatePayload,
34+
)
35+
from datadog_api_client.v2.model.security_monitoring_standard_rule_query import SecurityMonitoringStandardRuleQuery
36+
37+
body = SecurityMonitoringStandardRuleCreatePayload(
38+
name="Example-Security-Monitoring",
39+
type=SecurityMonitoringRuleTypeCreate.LOG_DETECTION,
40+
is_enabled=True,
41+
queries=[
42+
SecurityMonitoringStandardRuleQuery(
43+
aggregation=SecurityMonitoringRuleQueryAggregation.COUNT,
44+
data_source=SecurityMonitoringStandardDataSource.LOGS,
45+
distinct_fields=[],
46+
group_by_fields=[],
47+
has_optional_group_by_fields=False,
48+
name="",
49+
query="service:logs-rule-reducer source:paul test2",
50+
),
51+
SecurityMonitoringStandardRuleQuery(
52+
aggregation=SecurityMonitoringRuleQueryAggregation.COUNT,
53+
data_source=SecurityMonitoringStandardDataSource.LOGS,
54+
distinct_fields=[],
55+
group_by_fields=[],
56+
has_optional_group_by_fields=False,
57+
name="",
58+
query="service:logs-rule-reducer source:paul test1",
59+
),
60+
],
61+
cases=[
62+
SecurityMonitoringRuleCaseCreate(
63+
name="",
64+
status=SecurityMonitoringRuleSeverity.INFO,
65+
notifications=[],
66+
condition="step_b > 0",
67+
),
68+
],
69+
message="Logs and signals asdf",
70+
options=SecurityMonitoringRuleOptions(
71+
detection_method=SecurityMonitoringRuleDetectionMethod.SEQUENCE_DETECTION,
72+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.ZERO_MINUTES,
73+
keep_alive=SecurityMonitoringRuleKeepAlive.FIVE_MINUTES,
74+
max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.TEN_MINUTES,
75+
sequence_detection_options=SecurityMonitoringRuleSequenceDetectionOptions(
76+
step_transitions=[
77+
SecurityMonitoringRuleSequenceDetectionStepTransition(
78+
child="step_b",
79+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES,
80+
parent="step_a",
81+
),
82+
],
83+
steps=[
84+
SecurityMonitoringRuleSequenceDetectionStep(
85+
condition="a > 0",
86+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.ONE_MINUTE,
87+
name="step_a",
88+
),
89+
SecurityMonitoringRuleSequenceDetectionStep(
90+
condition="b > 0",
91+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.ONE_MINUTE,
92+
name="step_b",
93+
),
94+
],
95+
),
96+
),
97+
tags=[],
98+
)
99+
100+
configuration = Configuration()
101+
with ApiClient(configuration) as api_client:
102+
api_instance = SecurityMonitoringApi(api_client)
103+
response = api_instance.create_security_monitoring_rule(body=body)
104+
105+
print(response)

‎examples/v2/security-monitoring/ValidateSecurityMonitoringRule_4152369508.py‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
"""
2+
Validate a detection rule with detection method 'sequence_detection' returns "OK" response
3+
"""
4+
5+
from datadog_api_client import ApiClient, Configuration
6+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
7+
from datadog_api_client.v2.model.security_monitoring_rule_case_create import SecurityMonitoringRuleCaseCreate
8+
from datadog_api_client.v2.model.security_monitoring_rule_detection_method import SecurityMonitoringRuleDetectionMethod
9+
from datadog_api_client.v2.model.security_monitoring_rule_evaluation_window import (
10+
SecurityMonitoringRuleEvaluationWindow,
11+
)
12+
from datadog_api_client.v2.model.security_monitoring_rule_keep_alive import SecurityMonitoringRuleKeepAlive
13+
from datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration import (
14+
SecurityMonitoringRuleMaxSignalDuration,
15+
)
16+
from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions
17+
from datadog_api_client.v2.model.security_monitoring_rule_query_aggregation import (
18+
SecurityMonitoringRuleQueryAggregation,
19+
)
20+
from datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_options import (
21+
SecurityMonitoringRuleSequenceDetectionOptions,
22+
)
23+
from datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_step import (
24+
SecurityMonitoringRuleSequenceDetectionStep,
25+
)
26+
from datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_step_transition import (
27+
SecurityMonitoringRuleSequenceDetectionStepTransition,
28+
)
29+
from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity
30+
from datadog_api_client.v2.model.security_monitoring_rule_type_create import SecurityMonitoringRuleTypeCreate
31+
from datadog_api_client.v2.model.security_monitoring_standard_rule_payload import SecurityMonitoringStandardRulePayload
32+
from datadog_api_client.v2.model.security_monitoring_standard_rule_query import SecurityMonitoringStandardRuleQuery
33+
34+
body = SecurityMonitoringStandardRulePayload(
35+
cases=[
36+
SecurityMonitoringRuleCaseCreate(
37+
name="",
38+
status=SecurityMonitoringRuleSeverity.INFO,
39+
notifications=[],
40+
condition="step_b > 0",
41+
),
42+
],
43+
has_extended_title=True,
44+
is_enabled=True,
45+
message="My security monitoring rule",
46+
name="My security monitoring rule",
47+
options=SecurityMonitoringRuleOptions(
48+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.ZERO_MINUTES,
49+
keep_alive=SecurityMonitoringRuleKeepAlive.FIVE_MINUTES,
50+
max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.TEN_MINUTES,
51+
detection_method=SecurityMonitoringRuleDetectionMethod.SEQUENCE_DETECTION,
52+
sequence_detection_options=SecurityMonitoringRuleSequenceDetectionOptions(
53+
step_transitions=[
54+
SecurityMonitoringRuleSequenceDetectionStepTransition(
55+
child="step_b",
56+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES,
57+
parent="step_a",
58+
),
59+
],
60+
steps=[
61+
SecurityMonitoringRuleSequenceDetectionStep(
62+
condition="a > 0",
63+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.ONE_MINUTE,
64+
name="step_a",
65+
),
66+
SecurityMonitoringRuleSequenceDetectionStep(
67+
condition="b > 0",
68+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.ONE_MINUTE,
69+
name="step_b",
70+
),
71+
],
72+
),
73+
),
74+
queries=[
75+
SecurityMonitoringStandardRuleQuery(
76+
query="source:source_here",
77+
group_by_fields=[
78+
"@userIdentity.assumed_role",
79+
],
80+
distinct_fields=[],
81+
aggregation=SecurityMonitoringRuleQueryAggregation.COUNT,
82+
name="",
83+
),
84+
SecurityMonitoringStandardRuleQuery(
85+
query="source:source_here2",
86+
group_by_fields=[],
87+
distinct_fields=[],
88+
aggregation=SecurityMonitoringRuleQueryAggregation.COUNT,
89+
name="",
90+
),
91+
],
92+
tags=[
93+
"env:prod",
94+
"team:security",
95+
],
96+
type=SecurityMonitoringRuleTypeCreate.LOG_DETECTION,
97+
)
98+
99+
configuration = Configuration()
100+
with ApiClient(configuration) as api_client:
101+
api_instance = SecurityMonitoringApi(api_client)
102+
api_instance.validate_security_monitoring_rule(body=body)

‎src/datadog_api_client/v2/model/historical_job_options.py‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@
3030
from datadog_api_client.v2.model.security_monitoring_rule_new_value_options import (
3131
SecurityMonitoringRuleNewValueOptions,
3232
)
33+
from datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_options import (
34+
SecurityMonitoringRuleSequenceDetectionOptions,
35+
)
3336
from datadog_api_client.v2.model.security_monitoring_rule_third_party_options import (
3437
SecurityMonitoringRuleThirdPartyOptions,
3538
)
@@ -54,6 +57,9 @@ def openapi_types(_):
5457
from datadog_api_client.v2.model.security_monitoring_rule_new_value_options import (
5558
SecurityMonitoringRuleNewValueOptions,
5659
)
60+
from datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_options import (
61+
SecurityMonitoringRuleSequenceDetectionOptions,
62+
)
5763
from datadog_api_client.v2.model.security_monitoring_rule_third_party_options import (
5864
SecurityMonitoringRuleThirdPartyOptions,
5965
)
@@ -65,6 +71,7 @@ def openapi_types(_):
6571
"keep_alive": (SecurityMonitoringRuleKeepAlive,),
6672
"max_signal_duration": (SecurityMonitoringRuleMaxSignalDuration,),
6773
"new_value_options": (SecurityMonitoringRuleNewValueOptions,),
74+
"sequence_detection_options": (SecurityMonitoringRuleSequenceDetectionOptions,),
6875
"third_party_rule_options": (SecurityMonitoringRuleThirdPartyOptions,),
6976
}
7077

@@ -75,6 +82,7 @@ def openapi_types(_):
7582
"keep_alive": "keepAlive",
7683
"max_signal_duration": "maxSignalDuration",
7784
"new_value_options": "newValueOptions",
85+
"sequence_detection_options": "sequenceDetectionOptions",
7886
"third_party_rule_options": "thirdPartyRuleOptions",
7987
}
8088

@@ -86,6 +94,7 @@ def __init__(
8694
keep_alive: Union[SecurityMonitoringRuleKeepAlive, UnsetType] = unset,
8795
max_signal_duration: Union[SecurityMonitoringRuleMaxSignalDuration, UnsetType] = unset,
8896
new_value_options: Union[SecurityMonitoringRuleNewValueOptions, UnsetType] = unset,
97+
sequence_detection_options: Union[SecurityMonitoringRuleSequenceDetectionOptions, UnsetType] = unset,
8998
third_party_rule_options: Union[SecurityMonitoringRuleThirdPartyOptions, UnsetType] = unset,
9099
**kwargs,
91100
):
@@ -113,6 +122,9 @@ def __init__(
113122
:param new_value_options: Options on new value detection method.
114123
:type new_value_options: SecurityMonitoringRuleNewValueOptions, optional
115124
125+
:param sequence_detection_options: Options on sequence detection method.
126+
:type sequence_detection_options: SecurityMonitoringRuleSequenceDetectionOptions, optional
127+
116128
:param third_party_rule_options: Options on third party detection method.
117129
:type third_party_rule_options: SecurityMonitoringRuleThirdPartyOptions, optional
118130
"""
@@ -128,6 +140,8 @@ def __init__(
128140
kwargs["max_signal_duration"] = max_signal_duration
129141
if new_value_options is not unset:
130142
kwargs["new_value_options"] = new_value_options
143+
if sequence_detection_options is not unset:
144+
kwargs["sequence_detection_options"] = sequence_detection_options
131145
if third_party_rule_options is not unset:
132146
kwargs["third_party_rule_options"] = third_party_rule_options
133147
super().__init__(kwargs)

0 commit comments

Comments
 (0)