Skip to content

Commit 5781a25

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Add baselineUserLocationsDuration to Impossible Travel rule options (#4215)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent 6a11072 commit 5781a25

5 files changed

Lines changed: 140 additions & 0 deletions

File tree

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70685,11 +70685,20 @@ components:
7068570685
properties:
7068670686
baselineUserLocations:
7068770687
$ref: "#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations"
70688+
baselineUserLocationsDuration:
70689+
$ref: "#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocationsDuration"
7068870690
type: object
7068970691
SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations:
7069070692
description: "If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access."
7069170693
example: true
7069270694
type: boolean
70695+
SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocationsDuration:
70696+
description: The duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations.
70697+
format: int32
70698+
maximum: 30
70699+
minimum: 1
70700+
nullable: true
70701+
type: integer
7069370702
SecurityMonitoringRuleInstantaneousBaseline:
7069470703
description: When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
7069570704
example: false
@@ -143305,6 +143314,7 @@ paths:
143305143314
hardcodedEvaluatorType: log4shell
143306143315
impossibleTravelOptions:
143307143316
baselineUserLocations: true
143317+
baselineUserLocationsDuration: 7
143308143318
newValueOptions:
143309143319
instantaneousBaseline: false
143310143320
learningMethod: duration
@@ -144061,6 +144071,7 @@ paths:
144061144071
hardcodedEvaluatorType: log4shell
144062144072
impossibleTravelOptions:
144063144073
baselineUserLocations: true
144074+
baselineUserLocationsDuration: 7
144064144075
keepAlive: 3600
144065144076
maxSignalDuration: 86400
144066144077
newValueOptions:
@@ -144162,6 +144173,7 @@ paths:
144162144173
hardcodedEvaluatorType: log4shell
144163144174
impossibleTravelOptions:
144164144175
baselineUserLocations: true
144176+
baselineUserLocationsDuration: 7
144165144177
keepAlive: 0
144166144178
maxSignalDuration: 0
144167144179
newValueOptions:
@@ -144275,6 +144287,7 @@ paths:
144275144287
hardcodedEvaluatorType: log4shell
144276144288
impossibleTravelOptions:
144277144289
baselineUserLocations: true
144290+
baselineUserLocationsDuration: 7
144278144291
keepAlive: 1800
144279144292
maxSignalDuration: 1800
144280144293
newValueOptions:

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-detection-rule-with-type-impossible_travel-and-baselineUserLocationsDuration-ret_1893385400/frozen.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2026-05-20T15:12:27.397Z"

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-detection-rule-with-type-impossible_travel-and-baselineUserLocationsDuration-ret_1893385400/recording.har‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Create a detection rule with type 'impossible_travel' and baselineUserLocationsDuration returns \"OK\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "da9347584baffca826004d9183d89974",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 627,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 588,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"cases\":[{\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"hasExtendedTitle\":true,\"isEnabled\":true,\"message\":\"test\",\"name\":\"Test-Create_a_detection_rule_with_type_impossible_travel_and_baselineUserLocationsDuration_returns_OK_res-1779289947\",\"options\":{\"detectionMethod\":\"impossible_travel\",\"evaluationWindow\":900,\"impossibleTravelOptions\":{\"baselineUserLocations\":true,\"baselineUserLocationsDuration\":7},\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"geo_data\",\"distinctFields\":[],\"groupByFields\":[\"@usr.id\"],\"metric\":\"@network.client.geoip\",\"query\":\"*\"}],\"tags\":[],\"type\":\"log_detection\"}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules"
39+
},
40+
"response": {
41+
"bodySize": 1102,
42+
"content": {
43+
"mimeType": "application/json",
44+
"size": 1102,
45+
"text": "{\"name\":\"Test-Create_a_detection_rule_with_type_impossible_travel_and_baselineUserLocationsDuration_returns_OK_res-1779289947\",\"createdAt\":1779289949181,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isBeta\":false,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"*\",\"groupByFields\":[\"@usr.id\"],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"metric\":\"@network.client.geoip\",\"metrics\":[\"@network.client.geoip\"],\"aggregation\":\"geo_data\",\"name\":\"\",\"dataSource\":\"logs\"}],\"options\":{\"evaluationWindow\":900,\"detectionMethod\":\"impossible_travel\",\"maxSignalDuration\":86400,\"keepAlive\":3600,\"impossibleTravelOptions\":{\"baselineUserLocations\":true,\"baselineUserLocationsDuration\":7,\"detectIpTransition\":false}},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[]}],\"message\":\"test\",\"tags\":[],\"hasExtendedTitle\":true,\"type\":\"log_detection\",\"filters\":[],\"version\":1,\"id\":\"v2k-viu-svz\",\"blocking\":false,\"metadata\":{\"entities\":null,\"sources\":null},\"creationAuthorId\":2320499,\"creator\":{\"handle\":\"9919ec9b-ebc7-49ee-8dc8-03626e717cca\",\"name\":\"CI Account\"},\"updater\":{\"handle\":\"\",\"name\":\"\"}}"
46+
},
47+
"cookies": [],
48+
"headers": [
49+
{
50+
"name": "content-type",
51+
"value": "application/json"
52+
}
53+
],
54+
"headersSize": 655,
55+
"httpVersion": "HTTP/1.1",
56+
"redirectURL": "",
57+
"status": 200,
58+
"statusText": "OK"
59+
},
60+
"startedDateTime": "2026-05-20T15:12:28.820Z",
61+
"time": 397
62+
},
63+
{
64+
"_id": "4e836004731a194003a96f0169bd0eed",
65+
"_order": 0,
66+
"cache": {},
67+
"request": {
68+
"bodySize": 0,
69+
"cookies": [],
70+
"headers": [
71+
{
72+
"_fromType": "array",
73+
"name": "accept",
74+
"value": "*/*"
75+
}
76+
],
77+
"headersSize": 536,
78+
"httpVersion": "HTTP/1.1",
79+
"method": "DELETE",
80+
"queryString": [],
81+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules/v2k-viu-svz"
82+
},
83+
"response": {
84+
"bodySize": 0,
85+
"content": {
86+
"mimeType": "text/plain",
87+
"size": 0
88+
},
89+
"cookies": [],
90+
"headers": [],
91+
"headersSize": 601,
92+
"httpVersion": "HTTP/1.1",
93+
"redirectURL": "",
94+
"status": 204,
95+
"statusText": "No Content"
96+
},
97+
"startedDateTime": "2026-05-20T15:12:29.228Z",
98+
"time": 462
99+
}
100+
],
101+
"pages": [],
102+
"version": "1.2"
103+
}
104+
}

‎features/v2/security_monitoring.feature‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -559,6 +559,19 @@ Feature: Security Monitoring
559559
And the response "type" is equal to "application_security"
560560
And the response "message" is equal to "Test rule"
561561

562+
@skip-validation @team:DataDog/k9-cloud-siem
563+
Scenario: Create a detection rule with type 'impossible_travel' and baselineUserLocationsDuration returns "OK" response
564+
Given new "CreateSecurityMonitoringRule" request
565+
And body with value {"queries":[{"aggregation":"geo_data","groupByFields":["@usr.id"],"distinctFields":[],"metric":"@network.client.geoip","query":"*"}],"cases":[{"name":"","status":"info","notifications":[]}],"hasExtendedTitle":true,"message":"test","isEnabled":true,"options":{"maxSignalDuration":86400,"evaluationWindow":900,"keepAlive":3600,"detectionMethod":"impossible_travel","impossibleTravelOptions":{"baselineUserLocations":true,"baselineUserLocationsDuration":7}},"name":"{{ unique }}","type":"log_detection","tags":[],"filters":[]}
566+
When the request is sent
567+
Then the response status is 200 OK
568+
And the response "name" is equal to "{{ unique }}"
569+
And the response "type" is equal to "log_detection"
570+
And the response "message" is equal to "test"
571+
And the response "options.detectionMethod" is equal to "impossible_travel"
572+
And the response "options.impossibleTravelOptions.baselineUserLocations" is equal to true
573+
And the response "options.impossibleTravelOptions.baselineUserLocationsDuration" is equal to 7
574+
562575
@skip-validation @team:DataDog/k9-cloud-siem
563576
Scenario: Create a detection rule with type 'impossible_travel' returns "OK" response
564577
Given new "CreateSecurityMonitoringRule" request

‎services/security_monitoring/src/v2/models/SecurityMonitoringRuleImpossibleTravelOptions.ts‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@ export class SecurityMonitoringRuleImpossibleTravelOptions {
99
* access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
1010
*/
1111
"baselineUserLocations"?: boolean;
12+
/**
13+
* The duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations.
14+
*/
15+
"baselineUserLocationsDuration"?: number;
1216
/**
1317
* A container for additional, undeclared properties.
1418
* This is a holder for any undeclared properties as specified with
@@ -28,6 +32,11 @@ export class SecurityMonitoringRuleImpossibleTravelOptions {
2832
baseName: "baselineUserLocations",
2933
type: "boolean",
3034
},
35+
baselineUserLocationsDuration: {
36+
baseName: "baselineUserLocationsDuration",
37+
type: "number",
38+
format: "int32",
39+
},
3140
additionalProperties: {
3241
baseName: "additionalProperties",
3342
type: "{ [key: string]: any; }",

0 commit comments

Comments
 (0)