Skip to content

Commit 63b8bee

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Security notifications - Add SAST and secret rule types (#3953)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent b839b22 commit 63b8bee

File tree

6 files changed

+126
-2
lines changed

6 files changed

+126
-2
lines changed

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57796,7 +57796,8 @@ components:
5779657796
Signal-based notification rules can filter signals based on rule types application_security, log_detection,
5779757797
workload_security, signal_correlation, cloud_configuration and infrastructure_configuration.
5779857798
Vulnerability-based notification rules can filter vulnerabilities based on rule types application_code_vulnerability,
57799-
application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration, api_security, host_vulnerability and iac_misconfiguration.
57799+
application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration,
57800+
api_security, host_vulnerability, iac_misconfiguration, sast_vulnerability and secret_vulnerability.
5780057801
enum:
5780157802
- application_security
5780257803
- log_detection
@@ -57813,6 +57814,8 @@ components:
5781357814
- api_security
5781457815
- host_vulnerability
5781557816
- iac_misconfiguration
57817+
- sast_vulnerability
57818+
- secret_vulnerability
5781657819
type: string
5781757820
x-enum-varnames:
5781857821
- APPLICATION_SECURITY
@@ -57830,6 +57833,8 @@ components:
5783057833
- API_SECURITY
5783157834
- HOST_VULNERABILITY
5783257835
- IAC_MISCONFIGURATION
57836+
- SAST_VULNERABILITY
57837+
- SECRET_VULNERABILITY
5783357838
RuleUser:
5783457839
description: User creating or modifying a rule.
5783557840
properties:

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-new-vulnerability-based-notification-rule-with-sast-and-secret-rule-types-return_1041700713/frozen.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2026-04-16T13:47:18.057Z"

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-new-vulnerability-based-notification-rule-with-sast-and-secret-rule-types-return_1041700713/recording.har‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Create a new vulnerability-based notification rule with sast and secret rule types returns \"Successfully created the notification rule.\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "c063ba4707a314ad0932fc744f457fd5",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 439,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 613,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"data\":{\"attributes\":{\"enabled\":true,\"name\":\"Test-Create_a_new_vulnerability_based_notification_rule_with_sast_and_secret_rule_types_returns_Successfu-1776347238\",\"selectors\":{\"query\":\"(source:production_service OR env:prod)\",\"rule_types\":[\"sast_vulnerability\",\"secret_vulnerability\"],\"severities\":[\"critical\"],\"trigger_source\":\"security_findings\"},\"targets\":[\"@john.doe@email.com\"],\"time_aggregation\":86400},\"type\":\"notification_rules\"}}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/security/vulnerabilities/notification_rules"
39+
},
40+
"response": {
41+
"bodySize": 692,
42+
"content": {
43+
"mimeType": "application/vnd.api+json",
44+
"size": 692,
45+
"text": "{\"data\":{\"id\":\"exz-ipg-n1m\",\"type\":\"notification_rules\",\"attributes\":{\"created_at\":1776347239287,\"created_by\":{\"name\":\"CI Account\",\"handle\":\"9919ec9b-ebc7-49ee-8dc8-03626e717cca\"},\"enabled\":true,\"modified_at\":1776347239287,\"modified_by\":{\"name\":\"CI Account\",\"handle\":\"9919ec9b-ebc7-49ee-8dc8-03626e717cca\"},\"name\":\"Test-Create_a_new_vulnerability_based_notification_rule_with_sast_and_secret_rule_types_returns_Successfu-1776347238\",\"selectors\":{\"severities\":[\"critical\"],\"rule_types\":[\"sast_vulnerability\",\"secret_vulnerability\"],\"query\":\"(source:production_service OR env:prod)\",\"trigger_source\":\"security_findings\"},\"targets\":[\"@john.doe@email.com\"],\"time_aggregation\":86400,\"version\":1}}}"
46+
},
47+
"cookies": [],
48+
"headers": [
49+
{
50+
"name": "content-type",
51+
"value": "application/vnd.api+json"
52+
}
53+
],
54+
"headersSize": 662,
55+
"httpVersion": "HTTP/1.1",
56+
"redirectURL": "",
57+
"status": 201,
58+
"statusText": "Created"
59+
},
60+
"startedDateTime": "2026-04-16T13:47:19.126Z",
61+
"time": 203
62+
},
63+
{
64+
"_id": "9dbd8db3f734efcbf0da5e234a383dd7",
65+
"_order": 0,
66+
"cache": {},
67+
"request": {
68+
"bodySize": 0,
69+
"cookies": [],
70+
"headers": [
71+
{
72+
"_fromType": "array",
73+
"name": "accept",
74+
"value": "*/*"
75+
}
76+
],
77+
"headersSize": 561,
78+
"httpVersion": "HTTP/1.1",
79+
"method": "DELETE",
80+
"queryString": [],
81+
"url": "https://api.datadoghq.com/api/v2/security/vulnerabilities/notification_rules/exz-ipg-n1m"
82+
},
83+
"response": {
84+
"bodySize": 0,
85+
"content": {
86+
"mimeType": "text/plain",
87+
"size": 0
88+
},
89+
"cookies": [],
90+
"headers": [],
91+
"headersSize": 601,
92+
"httpVersion": "HTTP/1.1",
93+
"redirectURL": "",
94+
"status": 204,
95+
"statusText": "No Content"
96+
},
97+
"startedDateTime": "2026-04-16T13:47:19.349Z",
98+
"time": 93
99+
}
100+
],
101+
"pages": [],
102+
"version": "1.2"
103+
}
104+
}

‎features/v2/security_monitoring.feature‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -591,6 +591,13 @@ Feature: Security Monitoring
591591
When the request is sent
592592
Then the response status is 201 Successfully created the notification rule.
593593

594+
@team:DataDog/cloud-security-posture-management
595+
Scenario: Create a new vulnerability-based notification rule with sast and secret rule types returns "Successfully created the notification rule." response
596+
Given new "CreateVulnerabilityNotificationRule" request
597+
And body with value {"data": {"attributes": {"enabled": true, "name": "{{ unique }}", "selectors": {"query": "(source:production_service OR env:prod)", "rule_types": ["sast_vulnerability", "secret_vulnerability"], "severities": ["critical"], "trigger_source": "security_findings"}, "targets": ["@john.doe@email.com"], "time_aggregation": 86400}, "type": "notification_rules"}}
598+
When the request is sent
599+
Then the response status is 201 Successfully created the notification rule.
600+
594601
@team:DataDog/k9-cloud-siem
595602
Scenario: Create a scheduled detection rule returns "OK" response
596603
Given new "CreateSecurityMonitoringRule" request

‎services/security_monitoring/src/v2/models/RuleTypesItems.ts‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@ import { UnparsedObject } from "@datadog/datadog-api-client";
55
* Signal-based notification rules can filter signals based on rule types application_security, log_detection,
66
* workload_security, signal_correlation, cloud_configuration and infrastructure_configuration.
77
* Vulnerability-based notification rules can filter vulnerabilities based on rule types application_code_vulnerability,
8-
* application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration, api_security, host_vulnerability and iac_misconfiguration.
8+
* application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration,
9+
* api_security, host_vulnerability, iac_misconfiguration, sast_vulnerability and secret_vulnerability.
910
*/
1011
export type RuleTypesItems =
1112
| typeof APPLICATION_SECURITY
@@ -23,6 +24,8 @@ export type RuleTypesItems =
2324
| typeof API_SECURITY
2425
| typeof HOST_VULNERABILITY
2526
| typeof IAC_MISCONFIGURATION
27+
| typeof SAST_VULNERABILITY
28+
| typeof SECRET_VULNERABILITY
2629
| UnparsedObject;
2730
export const APPLICATION_SECURITY = "application_security";
2831
export const LOG_DETECTION = "log_detection";
@@ -40,3 +43,5 @@ export const MISCONFIGURATION = "misconfiguration";
4043
export const API_SECURITY = "api_security";
4144
export const HOST_VULNERABILITY = "host_vulnerability";
4245
export const IAC_MISCONFIGURATION = "iac_misconfiguration";
46+
export const SAST_VULNERABILITY = "sast_vulnerability";
47+
export const SECRET_VULNERABILITY = "secret_vulnerability";

‎services/security_monitoring/src/v2/models/TypingInfo.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -388,6 +388,8 @@ export const TypingInfo: ModelTypingInfo = {
388388
"api_security",
389389
"host_vulnerability",
390390
"iac_misconfiguration",
391+
"sast_vulnerability",
392+
"secret_vulnerability",
391393
],
392394
RunThreatHuntingJobRequestDataType: ["historicalDetectionsJobCreate"],
393395
SBOMComponentLicenseType: [

0 commit comments

Comments
 (0)