Skip to content

Commit 0487dcf

Browse files
author
ci.datadog-api-spec
committed
Regenerate client from commit 00a97ba of spec repo
1 parent d538076 commit 0487dcf

13 files changed

Lines changed: 811 additions & 0 deletions

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59138,6 +59138,17 @@ components:
5913859138
required:
5913959139
- data
5914059140
type: object
59141+
SecurityMonitoringSignalInvestigationQueryTemplateVariables:
59142+
additionalProperties:
59143+
items:
59144+
description: A value for this template variable extracted from the signal.
59145+
type: string
59146+
type: array
59147+
description: Template variables applied to the investigation log query, mapping attribute paths to values extracted from the signal.
59148+
example:
59149+
"@userIdentity.arn":
59150+
- foo
59151+
type: object
5914159152
SecurityMonitoringSignalListRequest:
5914259153
description: The request for a security signal list.
5914359154
properties:
@@ -59523,6 +59534,82 @@ components:
5952359534
required:
5952459535
- data
5952559536
type: object
59537+
SecurityMonitoringSignalSuggestedAction:
59538+
description: A suggested action for a security signal.
59539+
properties:
59540+
attributes:
59541+
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionAttributes"
59542+
id:
59543+
description: The unique ID of the suggested action.
59544+
example: w00-t10-992
59545+
type: string
59546+
type:
59547+
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionType"
59548+
required:
59549+
- id
59550+
- type
59551+
- attributes
59552+
type: object
59553+
SecurityMonitoringSignalSuggestedActionAttributes:
59554+
description: Attributes of a suggested action for a security signal. The available fields depend on the action type.
59555+
properties:
59556+
name:
59557+
description: The name of the investigation log query.
59558+
example: Cloudtrail events for user ARN
59559+
type: string
59560+
query_filter:
59561+
description: The log query filter for the investigation.
59562+
example: 'source:cloudtrail @userIdentity.arn:"foo"'
59563+
type: string
59564+
template_variables:
59565+
$ref: "#/components/schemas/SecurityMonitoringSignalInvestigationQueryTemplateVariables"
59566+
title:
59567+
description: The title of the recommended blog post.
59568+
example: Monitor Okta logs to track system access and unusual activity
59569+
type: string
59570+
url:
59571+
description: The URL of the suggested action.
59572+
example: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
59573+
type: string
59574+
type: object
59575+
SecurityMonitoringSignalSuggestedActionList:
59576+
description: List of suggested actions for a security signal.
59577+
example:
59578+
- attributes:
59579+
name: Cloudtrail events for user ARN
59580+
query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
59581+
template_variables:
59582+
"@userIdentity.arn":
59583+
- foo
59584+
url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
59585+
id: w00-t10-992
59586+
type: investigation_log_queries
59587+
- attributes:
59588+
title: Monitor Okta logs to track system access and unusual activity
59589+
url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
59590+
id: bxy-o8v-i1a
59591+
type: recommended_blog_posts
59592+
items:
59593+
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedAction"
59594+
type: array
59595+
SecurityMonitoringSignalSuggestedActionType:
59596+
description: The type of the suggested action resource.
59597+
enum:
59598+
- investigation_log_queries
59599+
- recommended_blog_posts
59600+
example: investigation_log_queries
59601+
type: string
59602+
x-enum-varnames:
59603+
- INVESTIGATION_LOG_QUERIES
59604+
- RECOMMENDED_BLOG_POSTS
59605+
SecurityMonitoringSignalSuggestedActionsResponse:
59606+
description: Response with suggested actions for a security signal.
59607+
properties:
59608+
data:
59609+
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionList"
59610+
required:
59611+
- data
59612+
type: object
5952659613
SecurityMonitoringSignalTriageAttributes:
5952759614
description: Attributes describing a triage state update operation over a security signal.
5952859615
properties:
@@ -105894,6 +105981,54 @@ paths:
105894105981
operator: OR
105895105982
permissions:
105896105983
- security_monitoring_signals_write
105984+
/api/v2/security_monitoring/signals/{signal_id}/investigation_queries:
105985+
get:
105986+
description: Get the list of investigation log queries available for a given security signal.
105987+
operationId: GetInvestigationLogQueriesMatchingSignal
105988+
parameters:
105989+
- $ref: "#/components/parameters/SignalID"
105990+
responses:
105991+
"200":
105992+
content:
105993+
application/json:
105994+
example:
105995+
data:
105996+
- attributes:
105997+
name: Cloudtrail events for user ARN
105998+
query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
105999+
template_variables:
106000+
"@userIdentity.arn":
106001+
- foo
106002+
url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
106003+
id: w00-t10-992
106004+
type: investigation_log_queries
106005+
- attributes:
106006+
title: Monitor Okta logs to track system access and unusual activity
106007+
url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
106008+
id: bxy-o8v-i1a
106009+
type: recommended_blog_posts
106010+
schema:
106011+
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionsResponse"
106012+
description: OK
106013+
"403":
106014+
$ref: "#/components/responses/NotAuthorizedResponse"
106015+
"404":
106016+
$ref: "#/components/responses/NotFoundResponse"
106017+
"429":
106018+
$ref: "#/components/responses/TooManyRequestsResponse"
106019+
security:
106020+
- apiKeyAuth: []
106021+
appKeyAuth: []
106022+
- AuthZ:
106023+
- security_monitoring_rules_read
106024+
- security_monitoring_signals_read
106025+
summary: Get investigation queries for a signal
106026+
tags: ["Security Monitoring"]
106027+
x-permission:
106028+
operator: AND
106029+
permissions:
106030+
- security_monitoring_rules_read
106031+
- security_monitoring_signals_read
105897106032
/api/v2/security_monitoring/signals/{signal_id}/state:
105898106033
patch:
105899106034
description: |-
@@ -105934,6 +106069,54 @@ paths:
105934106069
operator: OR
105935106070
permissions:
105936106071
- security_monitoring_signals_write
106072+
/api/v2/security_monitoring/signals/{signal_id}/suggested_actions:
106073+
get:
106074+
description: Get the list of suggested actions for a given security signal.
106075+
operationId: GetSuggestedActionsMatchingSignal
106076+
parameters:
106077+
- $ref: "#/components/parameters/SignalID"
106078+
responses:
106079+
"200":
106080+
content:
106081+
application/json:
106082+
example:
106083+
data:
106084+
- attributes:
106085+
name: Cloudtrail events for user ARN
106086+
query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
106087+
template_variables:
106088+
"@userIdentity.arn":
106089+
- foo
106090+
url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
106091+
id: w00-t10-992
106092+
type: investigation_log_queries
106093+
- attributes:
106094+
title: Monitor Okta logs to track system access and unusual activity
106095+
url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
106096+
id: bxy-o8v-i1a
106097+
type: recommended_blog_posts
106098+
schema:
106099+
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionsResponse"
106100+
description: OK
106101+
"403":
106102+
$ref: "#/components/responses/NotAuthorizedResponse"
106103+
"404":
106104+
$ref: "#/components/responses/NotFoundResponse"
106105+
"429":
106106+
$ref: "#/components/responses/TooManyRequestsResponse"
106107+
security:
106108+
- apiKeyAuth: []
106109+
appKeyAuth: []
106110+
- AuthZ:
106111+
- security_monitoring_rules_read
106112+
- security_monitoring_signals_read
106113+
summary: Get suggested actions for a signal
106114+
tags: ["Security Monitoring"]
106115+
x-permission:
106116+
operator: AND
106117+
permissions:
106118+
- security_monitoring_rules_read
106119+
- security_monitoring_signals_read
105937106120
/api/v2/sensitive-data-scanner/config:
105938106121
get:
105939106122
description: List all the Scanning groups in your organization.

‎examples/v2/security-monitoring/GetInvestigationLogQueriesMatchingSignal.ts‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/**
2+
* Get investigation queries for a signal returns "OK" response
3+
*/
4+
5+
import { client, v2 } from "@datadog/datadog-api-client";
6+
7+
const configuration = client.createConfiguration();
8+
const apiInstance = new v2.SecurityMonitoringApi(configuration);
9+
10+
const params: v2.SecurityMonitoringApiGetInvestigationLogQueriesMatchingSignalRequest =
11+
{
12+
signalId: "AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",
13+
};
14+
15+
apiInstance
16+
.getInvestigationLogQueriesMatchingSignal(params)
17+
.then((data: v2.SecurityMonitoringSignalSuggestedActionsResponse) => {
18+
console.log(
19+
"API called successfully. Returned data: " + JSON.stringify(data)
20+
);
21+
})
22+
.catch((error: any) => console.error(error));

‎examples/v2/security-monitoring/GetSuggestedActionsMatchingSignal.ts‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/**
2+
* Get suggested actions for a signal returns "OK" response
3+
*/
4+
5+
import { client, v2 } from "@datadog/datadog-api-client";
6+
7+
const configuration = client.createConfiguration();
8+
const apiInstance = new v2.SecurityMonitoringApi(configuration);
9+
10+
const params: v2.SecurityMonitoringApiGetSuggestedActionsMatchingSignalRequest =
11+
{
12+
signalId: "AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",
13+
};
14+
15+
apiInstance
16+
.getSuggestedActionsMatchingSignal(params)
17+
.then((data: v2.SecurityMonitoringSignalSuggestedActionsResponse) => {
18+
console.log(
19+
"API called successfully. Returned data: " + JSON.stringify(data)
20+
);
21+
})
22+
.catch((error: any) => console.error(error));

‎features/support/scenarios_model_mapping.ts‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4994,6 +4994,13 @@ export const ScenariosModelMappings: {[key: string]: {[key: string]: any}} = {
49944994
},
49954995
"operationResponseType": "SecurityMonitoringSignalTriageUpdateResponse",
49964996
},
4997+
"v2.GetInvestigationLogQueriesMatchingSignal": {
4998+
"signalId": {
4999+
"type": "string",
5000+
"format": "",
5001+
},
5002+
"operationResponseType": "SecurityMonitoringSignalSuggestedActionsResponse",
5003+
},
49975004
"v2.EditSecurityMonitoringSignalState": {
49985005
"signalId": {
49995006
"type": "string",
@@ -5005,6 +5012,13 @@ export const ScenariosModelMappings: {[key: string]: {[key: string]: any}} = {
50055012
},
50065013
"operationResponseType": "SecurityMonitoringSignalTriageUpdateResponse",
50075014
},
5015+
"v2.GetSuggestedActionsMatchingSignal": {
5016+
"signalId": {
5017+
"type": "string",
5018+
"format": "",
5019+
},
5020+
"operationResponseType": "SecurityMonitoringSignalSuggestedActionsResponse",
5021+
},
50085022
"v2.ListSecurityMonitoringHistsignals": {
50095023
"filterQuery": {
50105024
"type": "string",

‎features/v2/security_monitoring.feature‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1371,6 +1371,25 @@ Feature: Security Monitoring
13711371
When the request is sent
13721372
Then the response status is 200 Notification rule details.
13731373

1374+
@generated @skip @team:DataDog/k9-cloud-siem
1375+
Scenario: Get investigation queries for a signal returns "Not Found" response
1376+
Given new "GetInvestigationLogQueriesMatchingSignal" request
1377+
And request contains "signal_id" parameter from "REPLACE.ME"
1378+
When the request is sent
1379+
Then the response status is 404 Not Found
1380+
1381+
@skip @team:DataDog/k9-cloud-siem
1382+
Scenario: Get investigation queries for a signal returns "OK" response
1383+
Given new "GetInvestigationLogQueriesMatchingSignal" request
1384+
And request contains "signal_id" parameter with value "AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE"
1385+
When the request is sent
1386+
Then the response status is 200 OK
1387+
And the response "data[0].type" is equal to "investigation_log_queries"
1388+
And the response "data[0]" has field "id"
1389+
And the response "data[0].attributes" has field "name"
1390+
And the response "data[0].attributes" has field "query_filter"
1391+
And the response "data[0].attributes" has field "url"
1392+
13741393
@skip-go @skip-java @skip-ruby @team:DataDog/k9-cloud-siem
13751394
Scenario: Get rule version history returns "OK" response
13761395
Given operation "GetRuleVersionHistory" enabled
@@ -1384,6 +1403,29 @@ Feature: Security Monitoring
13841403
And the response "data.attributes.count" is equal to 1
13851404
And the response "data.attributes.data[1].rule.name" has the same value as "security_rule.name"
13861405

1406+
@generated @skip @team:DataDog/k9-cloud-siem
1407+
Scenario: Get suggested actions for a signal returns "Not Found" response
1408+
Given new "GetSuggestedActionsMatchingSignal" request
1409+
And request contains "signal_id" parameter from "REPLACE.ME"
1410+
When the request is sent
1411+
Then the response status is 404 Not Found
1412+
1413+
@skip @team:DataDog/k9-cloud-siem
1414+
Scenario: Get suggested actions for a signal returns "OK" response
1415+
Given new "GetSuggestedActionsMatchingSignal" request
1416+
And request contains "signal_id" parameter with value "AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE"
1417+
When the request is sent
1418+
Then the response status is 200 OK
1419+
And the response "data[0].type" is equal to "investigation_log_queries"
1420+
And the response "data[0]" has field "id"
1421+
And the response "data[0].attributes" has field "name"
1422+
And the response "data[0].attributes" has field "query_filter"
1423+
And the response "data[0].attributes" has field "url"
1424+
And the response "data[1].type" is equal to "recommended_blog_posts"
1425+
And the response "data[1]" has field "id"
1426+
And the response "data[1].attributes" has field "title"
1427+
And the response "data[1].attributes" has field "url"
1428+
13871429
@team:DataDog/k9-cloud-siem
13881430
Scenario: Get suppressions affecting a specific rule returns "Not Found" response
13891431
Given new "GetSuppressionsAffectingRule" request

‎features/v2/undo.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5338,12 +5338,24 @@
53385338
"type": "idempotent"
53395339
}
53405340
},
5341+
"GetInvestigationLogQueriesMatchingSignal": {
5342+
"tag": "Security Monitoring",
5343+
"undo": {
5344+
"type": "safe"
5345+
}
5346+
},
53415347
"EditSecurityMonitoringSignalState": {
53425348
"tag": "Security Monitoring",
53435349
"undo": {
53445350
"type": "idempotent"
53455351
}
53465352
},
5353+
"GetSuggestedActionsMatchingSignal": {
5354+
"tag": "Security Monitoring",
5355+
"undo": {
5356+
"type": "safe"
5357+
}
5358+
},
53475359
"ListScanningGroups": {
53485360
"tag": "Sensitive Data Scanner",
53495361
"undo": {

0 commit comments

Comments
 (0)