Skip to content

Commit 9327cc5

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Cloud SIEM - Add instantaneousBaseline to anomaly detection options (#3458)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent d4e6cce commit 9327cc5

8 files changed

Lines changed: 216 additions & 8 deletions

File tree

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -40874,6 +40874,8 @@ components:
4087440874
type: integer
4087540875
type:
4087640876
$ref: '#/components/schemas/ObservabilityPipelineBufferOptionsMemoryType'
40877+
when_full:
40878+
$ref: '#/components/schemas/ObservabilityPipelineBufferOptionsWhenFull'
4087740879
type: object
4087840880
ObservabilityPipelineMemoryBufferSizeOptions:
4087940881
description: Options for configuring a memory buffer by queue length.
@@ -40885,6 +40887,8 @@ components:
4088540887
type: integer
4088640888
type:
4088740889
$ref: '#/components/schemas/ObservabilityPipelineBufferOptionsMemoryType'
40890+
when_full:
40891+
$ref: '#/components/schemas/ObservabilityPipelineBufferOptionsWhenFull'
4088840892
type: object
4088940893
ObservabilityPipelineMetadataEntry:
4089040894
description: A custom metadata entry.
@@ -53476,6 +53480,8 @@ components:
5347653480
$ref: '#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration'
5347753481
detectionTolerance:
5347853482
$ref: '#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance'
53483+
instantaneousBaseline:
53484+
$ref: '#/components/schemas/SecurityMonitoringRuleInstantaneousBaseline'
5347953485
learningDuration:
5348053486
$ref: '#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration'
5348153487
learningPeriodBaseline:
@@ -53813,6 +53819,13 @@ components:
5381353819
or credentialed API access.'
5381453820
example: true
5381553821
type: boolean
53822+
SecurityMonitoringRuleInstantaneousBaseline:
53823+
description: When set to true, Datadog uses previous values that fall within
53824+
the defined learning window to construct the baseline, enabling the system
53825+
to establish an accurate baseline more rapidly rather than relying solely
53826+
on gradual learning over time.
53827+
example: false
53828+
type: boolean
5381653829
SecurityMonitoringRuleKeepAlive:
5381753830
description: 'Once a signal is generated, the signal will remain "open" if a
5381853831
case is matched at least once within
@@ -53886,7 +53899,7 @@ components:
5388653899
forgetAfter:
5388753900
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter'
5388853901
instantaneousBaseline:
53889-
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsInstantaneousBaseline'
53902+
$ref: '#/components/schemas/SecurityMonitoringRuleInstantaneousBaseline'
5389053903
learningDuration:
5389153904
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration'
5389253905
learningMethod:
@@ -53912,13 +53925,6 @@ components:
5391253925
- TWO_WEEKS
5391353926
- THREE_WEEKS
5391453927
- FOUR_WEEKS
53915-
SecurityMonitoringRuleNewValueOptionsInstantaneousBaseline:
53916-
description: When set to true, Datadog uses previous values that fall within
53917-
the defined learning window to construct the baseline, enabling the system
53918-
to establish an accurate baseline more rapidly rather than relying solely
53919-
on gradual learning over time.
53920-
example: false
53921-
type: boolean
5392253928
SecurityMonitoringRuleNewValueOptionsLearningDuration:
5392353929
default: 0
5392453930
description: 'The duration in days during which values are learned, and after

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-detection-rule-with-detection-method-anomaly_detection-with-enabled-feature-inst_2022405684/frozen.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2026-02-10T14:48:33.727Z"

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-detection-rule-with-detection-method-anomaly_detection-with-enabled-feature-inst_2022405684/recording.har‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Create a detection rule with detection method 'anomaly_detection' with enabled feature 'instantaneousBaseline' returns \"OK\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "0481e6824f9915d0d8b3bf9ea1f6d724",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 754,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 588,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"cases\":[{\"condition\":\"a > 0.995\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"isEnabled\":true,\"message\":\"An anomaly detection rule\",\"name\":\"Test-Create_a_detection_rule_with_detection_method_anomaly_detection_with_enabled_feature_instantaneousBa-1770734913\",\"options\":{\"anomalyDetectionOptions\":{\"bucketDuration\":300,\"detectionTolerance\":3,\"instantaneousBaseline\":true,\"learningDuration\":24},\"detectionMethod\":\"anomaly_detection\",\"evaluationWindow\":900,\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"count\",\"dataSource\":\"logs\",\"distinctFields\":[],\"groupByFields\":[\"@usr.email\",\"@network.client.ip\"],\"hasOptionalGroupByFields\":false,\"name\":\"\",\"query\":\"service:app status:error\"}],\"tags\":[],\"type\":\"log_detection\"}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules"
39+
},
40+
"response": {
41+
"bodySize": 1151,
42+
"content": {
43+
"mimeType": "application/json",
44+
"size": 1151,
45+
"text": "{\"name\":\"Test-Create_a_detection_rule_with_detection_method_anomaly_detection_with_enabled_feature_instantaneousBa-1770734913\",\"createdAt\":1770734914087,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isBeta\":false,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"service:app status:error\",\"groupByFields\":[\"@usr.email\",\"@network.client.ip\"],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\",\"dataSource\":\"logs\"}],\"options\":{\"evaluationWindow\":1800,\"detectionMethod\":\"anomaly_detection\",\"maxSignalDuration\":86400,\"keepAlive\":3600,\"anomalyDetectionOptions\":{\"bucketDuration\":300,\"learningDuration\":24,\"detectionTolerance\":3,\"instantaneousBaseline\":true,\"instantaneousBaselineTimeoutMinutes\":30}},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a \\u003e 0.995\"}],\"message\":\"An anomaly detection rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"log_detection\",\"filters\":[],\"version\":1,\"id\":\"mtt-vs9-dyl\",\"blocking\":false,\"metadata\":{\"entities\":null,\"sources\":null},\"creationAuthorId\":1445416,\"creator\":{\"handle\":\"frog@datadoghq.com\",\"name\":\"frog\"},\"updater\":{\"handle\":\"\",\"name\":\"\"}}"
46+
},
47+
"cookies": [],
48+
"headers": [
49+
{
50+
"name": "content-type",
51+
"value": "application/json"
52+
}
53+
],
54+
"headersSize": 655,
55+
"httpVersion": "HTTP/1.1",
56+
"redirectURL": "",
57+
"status": 200,
58+
"statusText": "OK"
59+
},
60+
"startedDateTime": "2026-02-10T14:48:33.729Z",
61+
"time": 419
62+
},
63+
{
64+
"_id": "558eee7fd626bf2770eec8e5ee4a3d7a",
65+
"_order": 0,
66+
"cache": {},
67+
"request": {
68+
"bodySize": 0,
69+
"cookies": [],
70+
"headers": [
71+
{
72+
"_fromType": "array",
73+
"name": "accept",
74+
"value": "*/*"
75+
}
76+
],
77+
"headersSize": 536,
78+
"httpVersion": "HTTP/1.1",
79+
"method": "DELETE",
80+
"queryString": [],
81+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules/mtt-vs9-dyl"
82+
},
83+
"response": {
84+
"bodySize": 0,
85+
"content": {
86+
"mimeType": "text/plain",
87+
"size": 0
88+
},
89+
"cookies": [],
90+
"headers": [],
91+
"headersSize": 601,
92+
"httpVersion": "HTTP/1.1",
93+
"redirectURL": "",
94+
"status": 204,
95+
"statusText": "No Content"
96+
},
97+
"startedDateTime": "2026-02-10T14:48:34.155Z",
98+
"time": 449
99+
}
100+
],
101+
"pages": [],
102+
"version": "1.2"
103+
}
104+
}

‎examples/v2/security-monitoring/CreateSecurityMonitoringRule_3355193622.ts‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
/**
2+
* Create a detection rule with detection method 'anomaly_detection' with enabled feature 'instantaneousBaseline' returns
3+
* "OK" response
4+
*/
5+
6+
import { client, v2 } from "@datadog/datadog-api-client";
7+
8+
const configuration = client.createConfiguration();
9+
const apiInstance = new v2.SecurityMonitoringApi(configuration);
10+
11+
const params: v2.SecurityMonitoringApiCreateSecurityMonitoringRuleRequest = {
12+
body: {
13+
name: "Example-Security-Monitoring",
14+
type: "log_detection",
15+
isEnabled: true,
16+
queries: [
17+
{
18+
aggregation: "count",
19+
dataSource: "logs",
20+
distinctFields: [],
21+
groupByFields: ["@usr.email", "@network.client.ip"],
22+
hasOptionalGroupByFields: false,
23+
name: "",
24+
query: "service:app status:error",
25+
},
26+
],
27+
cases: [
28+
{
29+
name: "",
30+
status: "info",
31+
notifications: [],
32+
condition: "a > 0.995",
33+
},
34+
],
35+
message: "An anomaly detection rule",
36+
options: {
37+
detectionMethod: "anomaly_detection",
38+
evaluationWindow: 900,
39+
keepAlive: 3600,
40+
maxSignalDuration: 86400,
41+
anomalyDetectionOptions: {
42+
bucketDuration: 300,
43+
learningDuration: 24,
44+
detectionTolerance: 3,
45+
instantaneousBaseline: true,
46+
},
47+
},
48+
tags: [],
49+
filters: [],
50+
},
51+
};
52+
53+
apiInstance
54+
.createSecurityMonitoringRule(params)
55+
.then((data: v2.SecurityMonitoringRuleResponse) => {
56+
console.log(
57+
"API called successfully. Returned data: " + JSON.stringify(data)
58+
);
59+
})
60+
.catch((error: any) => console.error(error));

‎features/v2/security_monitoring.feature‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -456,6 +456,17 @@ Feature: Security Monitoring
456456
And the response "options.anomalyDetectionOptions.learningPeriodBaseline" is equal to 10
457457
And the response "options.anomalyDetectionOptions.detectionTolerance" is equal to 3
458458

459+
@team:DataDog/k9-cloud-security-platform
460+
Scenario: Create a detection rule with detection method 'anomaly_detection' with enabled feature 'instantaneousBaseline' returns "OK" response
461+
Given new "CreateSecurityMonitoringRule" request
462+
And body with value {"name":"{{ unique }}","type":"log_detection","isEnabled":true,"queries":[{"aggregation":"count","dataSource":"logs","distinctFields":[],"groupByFields":["@usr.email","@network.client.ip"],"hasOptionalGroupByFields":false,"name":"","query":"service:app status:error"}],"cases":[{"name":"","status":"info","notifications":[],"condition":"a > 0.995"}],"message":"An anomaly detection rule","options":{"detectionMethod":"anomaly_detection","evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400,"anomalyDetectionOptions":{"bucketDuration":300,"learningDuration":24,"detectionTolerance":3,"instantaneousBaseline":true}},"tags":[],"filters":[]}
463+
When the request is sent
464+
Then the response status is 200 OK
465+
And the response "name" is equal to "{{ unique }}"
466+
And the response "type" is equal to "log_detection"
467+
And the response "options.detectionMethod" is equal to "anomaly_detection"
468+
And the response "options.anomalyDetectionOptions.instantaneousBaseline" is equal to true
469+
459470
@team:DataDog/k9-cloud-security-platform
460471
Scenario: Create a detection rule with detection method 'sequence_detection' returns "OK" response
461472
Given new "CreateSecurityMonitoringRule" request

‎packages/datadog-api-client-v2/models/ObservabilityPipelineMemoryBufferOptions.ts‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
* Copyright 2020-Present Datadog, Inc.
55
*/
66
import { ObservabilityPipelineBufferOptionsMemoryType } from "./ObservabilityPipelineBufferOptionsMemoryType";
7+
import { ObservabilityPipelineBufferOptionsWhenFull } from "./ObservabilityPipelineBufferOptionsWhenFull";
78

89
import { AttributeTypeMap } from "../../datadog-api-client-common/util";
910

@@ -19,6 +20,10 @@ export class ObservabilityPipelineMemoryBufferOptions {
1920
* The type of the buffer that will be configured, a memory buffer.
2021
*/
2122
"type"?: ObservabilityPipelineBufferOptionsMemoryType;
23+
/**
24+
* Behavior when the buffer is full (block and stop accepting new events, or drop new events)
25+
*/
26+
"whenFull"?: ObservabilityPipelineBufferOptionsWhenFull;
2227

2328
/**
2429
* A container for additional, undeclared properties.
@@ -45,6 +50,10 @@ export class ObservabilityPipelineMemoryBufferOptions {
4550
baseName: "type",
4651
type: "ObservabilityPipelineBufferOptionsMemoryType",
4752
},
53+
whenFull: {
54+
baseName: "when_full",
55+
type: "ObservabilityPipelineBufferOptionsWhenFull",
56+
},
4857
additionalProperties: {
4958
baseName: "additionalProperties",
5059
type: "{ [key: string]: any; }",

‎packages/datadog-api-client-v2/models/ObservabilityPipelineMemoryBufferSizeOptions.ts‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
* Copyright 2020-Present Datadog, Inc.
55
*/
66
import { ObservabilityPipelineBufferOptionsMemoryType } from "./ObservabilityPipelineBufferOptionsMemoryType";
7+
import { ObservabilityPipelineBufferOptionsWhenFull } from "./ObservabilityPipelineBufferOptionsWhenFull";
78

89
import { AttributeTypeMap } from "../../datadog-api-client-common/util";
910

@@ -19,6 +20,10 @@ export class ObservabilityPipelineMemoryBufferSizeOptions {
1920
* The type of the buffer that will be configured, a memory buffer.
2021
*/
2122
"type"?: ObservabilityPipelineBufferOptionsMemoryType;
23+
/**
24+
* Behavior when the buffer is full (block and stop accepting new events, or drop new events)
25+
*/
26+
"whenFull"?: ObservabilityPipelineBufferOptionsWhenFull;
2227

2328
/**
2429
* A container for additional, undeclared properties.
@@ -45,6 +50,10 @@ export class ObservabilityPipelineMemoryBufferSizeOptions {
4550
baseName: "type",
4651
type: "ObservabilityPipelineBufferOptionsMemoryType",
4752
},
53+
whenFull: {
54+
baseName: "when_full",
55+
type: "ObservabilityPipelineBufferOptionsWhenFull",
56+
},
4857
additionalProperties: {
4958
baseName: "additionalProperties",
5059
type: "{ [key: string]: any; }",

‎packages/datadog-api-client-v2/models/SecurityMonitoringRuleAnomalyDetectionOptions.ts‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,10 @@ export class SecurityMonitoringRuleAnomalyDetectionOptions {
2323
* Higher values require higher deviations before triggering a signal.
2424
*/
2525
"detectionTolerance"?: SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance;
26+
/**
27+
* When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
28+
*/
29+
"instantaneousBaseline"?: boolean;
2630
/**
2731
* Learning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating.
2832
*/
@@ -56,6 +60,10 @@ export class SecurityMonitoringRuleAnomalyDetectionOptions {
5660
baseName: "detectionTolerance",
5761
type: "SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance",
5862
},
63+
instantaneousBaseline: {
64+
baseName: "instantaneousBaseline",
65+
type: "boolean",
66+
},
5967
learningDuration: {
6068
baseName: "learningDuration",
6169
type: "SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration",

0 commit comments

Comments
 (0)