Add bulk triage endpoints for security monitoring signals (#3772)

Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>

Author: api-clients-generation-pipeline[bot]

.generator/schemas/v1/openapi.yaml

@@ -4579,7 +4579,6 @@ components:
         - sca_fargate_usage
         - sds_scanned_bytes_usage
         - serverless_apps_usage
-        - serverless_apps_apm_usage
         - siem_analyzed_logs_add_on_usage
         - siem_ingested_bytes_usage
         - snmp_usage
@@ -4667,7 +4666,6 @@ components:
         - SCA_FARGATE_USAGE
         - SDS_SCANNED_BYTES_USAGE
         - SERVERLESS_APPS_USAGE
-        - SERVERLESS_APPS_APM_USAGE
         - SIEM_ANALYZED_LOGS_ADD_ON_USAGE
         - SIEM_INGESTED_BYTES_USAGE
         - SNMP_USAGE
@@ -9158,8 +9156,6 @@ components:
         - published_app_percentage
         - serverless_apps_usage
         - serverless_apps_percentage
-        - serverless_apps_apm_usage
-        - serverless_apps_apm_percentage
         - snmp_usage
         - snmp_percentage
         - universal_service_monitoring_usage
@@ -9325,8 +9321,6 @@ components:
         - PUBLISHED_APP_PERCENTAGE
         - SERVERLESS_APPS_USAGE
         - SERVERLESS_APPS_PERCENTAGE
-        - SERVERLESS_APPS_APM_USAGE
-        - SERVERLESS_APPS_APM_PERCENTAGE
         - SNMP_USAGE
         - SNMP_PERCENTAGE
         - UNIVERSAL_SERVICE_MONITORING_USAGE
@@ -9984,14 +9978,6 @@ components:
           description: The total Sensitive Data Scanner usage by tag(s).
           format: double
           type: number
-        serverless_apps_apm_percentage:
-          description: The percentage of Serverless Apps APM usage by tag(s).
-          format: double
-          type: number
-        serverless_apps_apm_usage:
-          description: The total Serverless Apps APM usage by tag(s).
-          format: double
-          type: number
         serverless_apps_percentage:
           description: The percentage of Serverless Apps usage by tag(s).
           format: double

.generator/schemas/v2/openapi.yaml

@@ -58530,6 +58530,155 @@ components:
       description: Version of the updated signal. If server side version is higher, update will be rejected.
       format: int64
       type: integer
+    SecurityMonitoringSignalsBulkAssigneeUpdateAttributes:
+      description: Attributes describing the new assignees for a bulk signal update.
+      properties:
+        assignee:
+          description: UUID of the user to assign to the signal. Use an empty string to unassign.
+          example: 773b045d-ccf8-4808-bd3b-955ef6a8c940
+          type: string
+        version:
+          $ref: "#/components/schemas/SecurityMonitoringSignalVersion"
+      required:
+        - assignee
+      type: object
+    SecurityMonitoringSignalsBulkAssigneeUpdateData:
+      description: Data for updating the assignees for multiple security signals.
+      properties:
+        attributes:
+          $ref: "#/components/schemas/SecurityMonitoringSignalsBulkAssigneeUpdateAttributes"
+        id:
+          description: The unique ID of the security signal.
+          example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
+          type: string
+        type:
+          $ref: "#/components/schemas/SecurityMonitoringSignalType"
+      required:
+        - id
+        - attributes
+      type: object
+    SecurityMonitoringSignalsBulkAssigneeUpdateRequest:
+      description: Request body for updating the assignee of multiple security signals.
+      properties:
+        data:
+          description: An array of signal assignee updates.
+          items:
+            $ref: "#/components/schemas/SecurityMonitoringSignalsBulkAssigneeUpdateData"
+          maxItems: 199
+          type: array
+      required:
+        - data
+      type: object
+    SecurityMonitoringSignalsBulkStateUpdateData:
+      description: Data for updating the state for multiple security signals.
+      properties:
+        attributes:
+          $ref: "#/components/schemas/SecurityMonitoringSignalStateUpdateAttributes"
+        id:
+          description: The unique ID of the security signal.
+          example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
+          type: string
+        type:
+          $ref: "#/components/schemas/SecurityMonitoringSignalType"
+      required:
+        - id
+        - attributes
+      type: object
+    SecurityMonitoringSignalsBulkStateUpdateRequest:
+      description: Request body for updating the triage states of multiple security signals.
+      properties:
+        data:
+          description: An array of signal state updates.
+          items:
+            $ref: "#/components/schemas/SecurityMonitoringSignalsBulkStateUpdateData"
+          maxItems: 199
+          type: array
+      required:
+        - data
+      type: object
+    SecurityMonitoringSignalsBulkTriageEvent:
+      description: A single signal event entry in a bulk triage update response.
+      properties:
+        event:
+          $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageEventAttributes"
+        id:
+          description: The unique ID of the security signal.
+          example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
+          type: string
+      required:
+        - id
+        - event
+      type: object
+    SecurityMonitoringSignalsBulkTriageEventAttributes:
+      description: Triage attributes of a security signal returned in a bulk update response.
+      properties:
+        archive_comment:
+          $ref: "#/components/schemas/SecurityMonitoringSignalArchiveComment"
+        archive_comment_timestamp:
+          description: Timestamp of the last edit to the archive comment.
+          format: int64
+          type: integer
+        archive_comment_user:
+          $ref: "#/components/schemas/SecurityMonitoringTriageUser"
+        archive_reason:
+          $ref: "#/components/schemas/SecurityMonitoringSignalArchiveReason"
+        assignee:
+          $ref: "#/components/schemas/SecurityMonitoringTriageUser"
+        id:
+          description: The unique ID of the security signal.
+          example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
+          type: string
+        incident_ids:
+          $ref: "#/components/schemas/SecurityMonitoringSignalIncidentIds"
+        state:
+          $ref: "#/components/schemas/SecurityMonitoringSignalState"
+        state_update_timestamp:
+          description: Timestamp of the last state update.
+          format: int64
+          type: integer
+        state_update_user:
+          $ref: "#/components/schemas/SecurityMonitoringTriageUser"
+      required:
+        - id
+        - state
+        - assignee
+        - incident_ids
+      type: object
+    SecurityMonitoringSignalsBulkTriageUpdateResponse:
+      description: Response for a bulk triage update of security signals.
+      properties:
+        result:
+          $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageUpdateResult"
+        status:
+          description: The status of the bulk operation.
+          example: done
+          type: string
+        type:
+          description: The type of the response.
+          example: status
+          type: string
+      required:
+        - type
+        - status
+        - result
+      type: object
+    SecurityMonitoringSignalsBulkTriageUpdateResult:
+      description: The result payload of a bulk signal triage update.
+      properties:
+        count:
+          description: The number of signals updated.
+          example: 2
+          format: int64
+          type: integer
+        events:
+          description: The list of updated signals.
+          items:
+            $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageEvent"
+          type: array
+      required:
+        - count
+        - events
+      type: object
     SecurityMonitoringSignalsListResponse:
       description: "The response object with all security signals matching the request\nand pagination information."
       properties:
@@ -103421,6 +103570,88 @@ paths:
         operator: OR
         permissions:
           - security_monitoring_signals_read
+  /api/v2/security_monitoring/signals/bulk/assignee:
+    patch:
+      description: |-
+        Change the triage assignees of multiple security signals at once.
+        The maximum number of signals that can be updated in a single request is 199.
+      operationId: BulkEditSecurityMonitoringSignalsAssignee
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/SecurityMonitoringSignalsBulkAssigneeUpdateRequest"
+        description: Attributes describing the signal assignee updates.
+        required: true
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageUpdateResponse"
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/JSONAPIErrorResponse"
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/JSONAPIErrorResponse"
+          description: Forbidden
+        "429":
+          $ref: "#/components/responses/TooManyRequestsResponse"
+      summary: Bulk update triage assignee of security signals
+      tags: ["Security Monitoring"]
+      x-codegen-request-body-name: body
+      "x-permission":
+        operator: OR
+        permissions:
+          - security_monitoring_signals_write
+  /api/v2/security_monitoring/signals/bulk/state:
+    patch:
+      description: |-
+        Change the triage states of multiple security signals at once.
+        The maximum number of signals that can be updated in a single request is 199.
+      operationId: BulkEditSecurityMonitoringSignalsState
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/SecurityMonitoringSignalsBulkStateUpdateRequest"
+        description: Attributes describing the signal state updates.
+        required: true
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageUpdateResponse"
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/JSONAPIErrorResponse"
+          description: Bad Request
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/JSONAPIErrorResponse"
+          description: Forbidden
+        "429":
+          $ref: "#/components/responses/TooManyRequestsResponse"
+      summary: Bulk update triage state of security signals
+      tags: ["Security Monitoring"]
+      x-codegen-request-body-name: body
+      "x-permission":
+        operator: OR
+        permissions:
+          - security_monitoring_signals_write
   /api/v2/security_monitoring/signals/search:
     post:
       description: |-

features/v2/security_monitoring.feature

@@ -121,6 +121,36 @@ Feature: Security Monitoring
     When the request is sent
     Then the response status is 200 OK
 
+  @skip @team:DataDog/k9-cloud-security-platform
+  Scenario: Bulk update triage assignee of security signals returns "Bad Request" response
+    Given operation "BulkEditSecurityMonitoringSignalsAssignee" enabled
+    And new "BulkEditSecurityMonitoringSignalsAssignee" request
+    And body with value {"data": [{"attributes": {}, "id": "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA", "type": "signal"}]}
+    When the request is sent
+    Then the response status is 400 Bad Request
+
+  @generated @skip @team:DataDog/k9-cloud-security-platform
+  Scenario: Bulk update triage assignee of security signals returns "OK" response
+    Given new "BulkEditSecurityMonitoringSignalsAssignee" request
+    And body with value {"data": [{"attributes": {"assignee": "773b045d-ccf8-4808-bd3b-955ef6a8c940"}, "id": "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA", "type": "signal"}]}
+    When the request is sent
+    Then the response status is 200 OK
+
+  @skip @team:DataDog/k9-cloud-security-platform
+  Scenario: Bulk update triage state of security signals returns "Bad Request" response
+    Given operation "BulkEditSecurityMonitoringSignalsState" enabled
+    And new "BulkEditSecurityMonitoringSignalsState" request
+    And body with value {"data": [{"attributes": {}, "id": "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA", "type": "signal"}]}
+    When the request is sent
+    Then the response status is 400 Bad Request
+
+  @generated @skip @team:DataDog/k9-cloud-security-platform
+  Scenario: Bulk update triage state of security signals returns "OK" response
+    Given new "BulkEditSecurityMonitoringSignalsState" request
+    And body with value {"data": [{"attributes": {"archive_reason": "none", "state": "open"}, "id": "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA", "type": "signal"}]}
+    When the request is sent
+    Then the response status is 200 OK
+
   @team:DataDog/k9-cloud-security-platform
   Scenario: Cancel a historical job returns "Bad Request" response
     Given operation "CancelThreatHuntingJob" enabled

features/v2/undo.json

@@ -5229,6 +5229,18 @@
       "type": "safe"
     }
   },
+  "BulkEditSecurityMonitoringSignalsAssignee": {
+    "tag": "Security Monitoring",
+    "undo": {
+      "type": "idempotent"
+    }
+  },
+  "BulkEditSecurityMonitoringSignalsState": {
+    "tag": "Security Monitoring",
+    "undo": {
+      "type": "idempotent"
+    }
+  },
   "SearchSecurityMonitoringSignals": {
     "tag": "Security Monitoring",
     "undo": {

private/bdd_runner/src/support/scenarios_model_mapping.ts

@@ -4954,6 +4954,20 @@ export const ScenariosModelMappings: { [key: string]: OperationMapping } = {
     },
     operationResponseType: "SecurityMonitoringSignalsListResponse",
   },
+  "SecurityMonitoringApi.V2.BulkEditSecurityMonitoringSignalsAssignee": {
+    body: {
+      type: "SecurityMonitoringSignalsBulkAssigneeUpdateRequest",
+      format: "",
+    },
+    operationResponseType: "SecurityMonitoringSignalsBulkTriageUpdateResponse",
+  },
+  "SecurityMonitoringApi.V2.BulkEditSecurityMonitoringSignalsState": {
+    body: {
+      type: "SecurityMonitoringSignalsBulkStateUpdateRequest",
+      format: "",
+    },
+    operationResponseType: "SecurityMonitoringSignalsBulkTriageUpdateResponse",
+  },
   "SecurityMonitoringApi.V2.SearchSecurityMonitoringSignals": {
     body: {
       type: "SecurityMonitoringSignalListRequest",