Skip to content

Commit 57fb487

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Security notifications - Add SAST and secret rule types (#3954)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent 8175076 commit 57fb487

File tree

7 files changed

+165
-2
lines changed

7 files changed

+165
-2
lines changed

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57796,7 +57796,8 @@ components:
5779657796
Signal-based notification rules can filter signals based on rule types application_security, log_detection,
5779757797
workload_security, signal_correlation, cloud_configuration and infrastructure_configuration.
5779857798
Vulnerability-based notification rules can filter vulnerabilities based on rule types application_code_vulnerability,
57799-
application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration, api_security, host_vulnerability and iac_misconfiguration.
57799+
application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration,
57800+
api_security, host_vulnerability, iac_misconfiguration, sast_vulnerability and secret_vulnerability.
5780057801
enum:
5780157802
- application_security
5780257803
- log_detection
@@ -57813,6 +57814,8 @@ components:
5781357814
- api_security
5781457815
- host_vulnerability
5781557816
- iac_misconfiguration
57817+
- sast_vulnerability
57818+
- secret_vulnerability
5781657819
type: string
5781757820
x-enum-varnames:
5781857821
- APPLICATION_SECURITY
@@ -57830,6 +57833,8 @@ components:
5783057833
- API_SECURITY
5783157834
- HOST_VULNERABILITY
5783257835
- IAC_MISCONFIGURATION
57836+
- SAST_VULNERABILITY
57837+
- SECRET_VULNERABILITY
5783357838
RuleUser:
5783457839
description: User creating or modifying a rule.
5783557840
properties:

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-new-vulnerability-based-notification-rule-with-sast-and-secret-rule-types-return_1041700713/frozen.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2026-04-16T13:47:18.057Z"

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-new-vulnerability-based-notification-rule-with-sast-and-secret-rule-types-return_1041700713/recording.har‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Create a new vulnerability-based notification rule with sast and secret rule types returns \"Successfully created the notification rule.\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "c063ba4707a314ad0932fc744f457fd5",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 439,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 613,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"data\":{\"attributes\":{\"enabled\":true,\"name\":\"Test-Create_a_new_vulnerability_based_notification_rule_with_sast_and_secret_rule_types_returns_Successfu-1776347238\",\"selectors\":{\"query\":\"(source:production_service OR env:prod)\",\"rule_types\":[\"sast_vulnerability\",\"secret_vulnerability\"],\"severities\":[\"critical\"],\"trigger_source\":\"security_findings\"},\"targets\":[\"@john.doe@email.com\"],\"time_aggregation\":86400},\"type\":\"notification_rules\"}}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/security/vulnerabilities/notification_rules"
39+
},
40+
"response": {
41+
"bodySize": 692,
42+
"content": {
43+
"mimeType": "application/vnd.api+json",
44+
"size": 692,
45+
"text": "{\"data\":{\"id\":\"exz-ipg-n1m\",\"type\":\"notification_rules\",\"attributes\":{\"created_at\":1776347239287,\"created_by\":{\"name\":\"CI Account\",\"handle\":\"9919ec9b-ebc7-49ee-8dc8-03626e717cca\"},\"enabled\":true,\"modified_at\":1776347239287,\"modified_by\":{\"name\":\"CI Account\",\"handle\":\"9919ec9b-ebc7-49ee-8dc8-03626e717cca\"},\"name\":\"Test-Create_a_new_vulnerability_based_notification_rule_with_sast_and_secret_rule_types_returns_Successfu-1776347238\",\"selectors\":{\"severities\":[\"critical\"],\"rule_types\":[\"sast_vulnerability\",\"secret_vulnerability\"],\"query\":\"(source:production_service OR env:prod)\",\"trigger_source\":\"security_findings\"},\"targets\":[\"@john.doe@email.com\"],\"time_aggregation\":86400,\"version\":1}}}"
46+
},
47+
"cookies": [],
48+
"headers": [
49+
{
50+
"name": "content-type",
51+
"value": "application/vnd.api+json"
52+
}
53+
],
54+
"headersSize": 662,
55+
"httpVersion": "HTTP/1.1",
56+
"redirectURL": "",
57+
"status": 201,
58+
"statusText": "Created"
59+
},
60+
"startedDateTime": "2026-04-16T13:47:19.126Z",
61+
"time": 203
62+
},
63+
{
64+
"_id": "9dbd8db3f734efcbf0da5e234a383dd7",
65+
"_order": 0,
66+
"cache": {},
67+
"request": {
68+
"bodySize": 0,
69+
"cookies": [],
70+
"headers": [
71+
{
72+
"_fromType": "array",
73+
"name": "accept",
74+
"value": "*/*"
75+
}
76+
],
77+
"headersSize": 561,
78+
"httpVersion": "HTTP/1.1",
79+
"method": "DELETE",
80+
"queryString": [],
81+
"url": "https://api.datadoghq.com/api/v2/security/vulnerabilities/notification_rules/exz-ipg-n1m"
82+
},
83+
"response": {
84+
"bodySize": 0,
85+
"content": {
86+
"mimeType": "text/plain",
87+
"size": 0
88+
},
89+
"cookies": [],
90+
"headers": [],
91+
"headersSize": 601,
92+
"httpVersion": "HTTP/1.1",
93+
"redirectURL": "",
94+
"status": 204,
95+
"statusText": "No Content"
96+
},
97+
"startedDateTime": "2026-04-16T13:47:19.349Z",
98+
"time": 93
99+
}
100+
],
101+
"pages": [],
102+
"version": "1.2"
103+
}
104+
}

‎examples/v2/security-monitoring/CreateVulnerabilityNotificationRule_2417112739.ts‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/**
2+
* Create a new vulnerability-based notification rule with sast and secret rule types returns "Successfully created the
3+
* notification rule." response
4+
*/
5+
6+
import { client, v2 } from "@datadog/datadog-api-client";
7+
8+
const configuration = client.createConfiguration();
9+
const apiInstance = new v2.SecurityMonitoringApi(configuration);
10+
11+
const params: v2.SecurityMonitoringApiCreateVulnerabilityNotificationRuleRequest =
12+
{
13+
body: {
14+
data: {
15+
attributes: {
16+
enabled: true,
17+
name: "Example-Security-Monitoring",
18+
selectors: {
19+
query: "(source:production_service OR env:prod)",
20+
ruleTypes: ["sast_vulnerability", "secret_vulnerability"],
21+
severities: ["critical"],
22+
triggerSource: "security_findings",
23+
},
24+
targets: ["@john.doe@email.com"],
25+
timeAggregation: 86400,
26+
},
27+
type: "notification_rules",
28+
},
29+
},
30+
};
31+
32+
apiInstance
33+
.createVulnerabilityNotificationRule(params)
34+
.then((data: v2.NotificationRuleResponse) => {
35+
console.log(
36+
"API called successfully. Returned data: " + JSON.stringify(data)
37+
);
38+
})
39+
.catch((error: any) => console.error(error));

‎features/v2/security_monitoring.feature‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -591,6 +591,13 @@ Feature: Security Monitoring
591591
When the request is sent
592592
Then the response status is 201 Successfully created the notification rule.
593593

594+
@team:DataDog/cloud-security-posture-management
595+
Scenario: Create a new vulnerability-based notification rule with sast and secret rule types returns "Successfully created the notification rule." response
596+
Given new "CreateVulnerabilityNotificationRule" request
597+
And body with value {"data": {"attributes": {"enabled": true, "name": "{{ unique }}", "selectors": {"query": "(source:production_service OR env:prod)", "rule_types": ["sast_vulnerability", "secret_vulnerability"], "severities": ["critical"], "trigger_source": "security_findings"}, "targets": ["@john.doe@email.com"], "time_aggregation": 86400}, "type": "notification_rules"}}
598+
When the request is sent
599+
Then the response status is 201 Successfully created the notification rule.
600+
594601
@team:DataDog/k9-cloud-siem
595602
Scenario: Create a scheduled detection rule returns "OK" response
596603
Given new "CreateSecurityMonitoringRule" request

‎packages/datadog-api-client-v2/models/ObjectSerializer.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5328,6 +5328,8 @@ const enumsMap: { [key: string]: any[] } = {
53285328
"api_security",
53295329
"host_vulnerability",
53305330
"iac_misconfiguration",
5331+
"sast_vulnerability",
5332+
"secret_vulnerability",
53315333
],
53325334
RulesValidateQueryRequestDataType: ["validate_query"],
53335335
RulesValidateQueryResponseDataType: ["validate_response"],

‎packages/datadog-api-client-v2/models/RuleTypesItems.ts‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,8 @@ import { UnparsedObject } from "../../datadog-api-client-common/util";
1111
* Signal-based notification rules can filter signals based on rule types application_security, log_detection,
1212
* workload_security, signal_correlation, cloud_configuration and infrastructure_configuration.
1313
* Vulnerability-based notification rules can filter vulnerabilities based on rule types application_code_vulnerability,
14-
* application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration, api_security, host_vulnerability and iac_misconfiguration.
14+
* application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration,
15+
* api_security, host_vulnerability, iac_misconfiguration, sast_vulnerability and secret_vulnerability.
1516
*/
1617

1718
export type RuleTypesItems =
@@ -30,6 +31,8 @@ export type RuleTypesItems =
3031
| typeof API_SECURITY
3132
| typeof HOST_VULNERABILITY
3233
| typeof IAC_MISCONFIGURATION
34+
| typeof SAST_VULNERABILITY
35+
| typeof SECRET_VULNERABILITY
3336
| UnparsedObject;
3437
export const APPLICATION_SECURITY = "application_security";
3538
export const LOG_DETECTION = "log_detection";
@@ -47,3 +50,5 @@ export const MISCONFIGURATION = "misconfiguration";
4750
export const API_SECURITY = "api_security";
4851
export const HOST_VULNERABILITY = "host_vulnerability";
4952
export const IAC_MISCONFIGURATION = "iac_misconfiguration";
53+
export const SAST_VULNERABILITY = "sast_vulnerability";
54+
export const SECRET_VULNERABILITY = "secret_vulnerability";

0 commit comments

Comments
 (0)