Skip to content

Commit b839b22

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Add OpenAPI documentation for list and get indicators of compromise endpoints (#3943)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent 5b7219d commit b839b22

File tree

29 files changed

+2254
-0
lines changed

29 files changed

+2254
-0
lines changed

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 423 additions & 0 deletions
Large diffs are not rendered by default.

‎cassettes/v2/Security-Monitoring_1187227211/Get-an-indicator-of-compromise-returns-Not-Found-response_2981717965/frozen.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2026-04-14T18:22:17.027Z"

‎cassettes/v2/Security-Monitoring_1187227211/Get-an-indicator-of-compromise-returns-Not-Found-response_2981717965/recording.har‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Get an indicator of compromise returns \"Not Found\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "729cc78d9a0ee7c3573d0a0a57a4612f",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 0,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
}
23+
],
24+
"headersSize": 612,
25+
"httpVersion": "HTTP/1.1",
26+
"method": "GET",
27+
"queryString": [
28+
{
29+
"name": "indicator",
30+
"value": "this-indicator-does-not-exist.invalid"
31+
}
32+
],
33+
"url": "https://api.datadoghq.com/api/v2/security/siem/ioc-explorer/indicator?indicator=this-indicator-does-not-exist.invalid"
34+
},
35+
"response": {
36+
"bodySize": 69,
37+
"content": {
38+
"mimeType": "application/vnd.api+json",
39+
"size": 69,
40+
"text": "{\"errors\":[{\"title\":\"Generic Error\",\"detail\":\"indicator not found\"}]}"
41+
},
42+
"cookies": [],
43+
"headers": [
44+
{
45+
"name": "content-type",
46+
"value": "application/vnd.api+json"
47+
}
48+
],
49+
"headersSize": 524,
50+
"httpVersion": "HTTP/1.1",
51+
"redirectURL": "",
52+
"status": 404,
53+
"statusText": "Not Found"
54+
},
55+
"startedDateTime": "2026-04-14T18:22:17.037Z",
56+
"time": 999
57+
}
58+
],
59+
"pages": [],
60+
"version": "1.2"
61+
}
62+
}

‎cassettes/v2/Security-Monitoring_1187227211/Get-an-indicator-of-compromise-returns-OK-response_2670867212/frozen.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2026-04-14T18:22:29.733Z"

‎cassettes/v2/Security-Monitoring_1187227211/Get-an-indicator-of-compromise-returns-OK-response_2670867212/recording.har‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Get an indicator of compromise returns \"OK\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "46983f3852589614d88dbeb54245e244",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 0,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
}
23+
],
24+
"headersSize": 653,
25+
"httpVersion": "HTTP/1.1",
26+
"method": "GET",
27+
"queryString": [
28+
{
29+
"name": "indicator",
30+
"value": "masscan/1.3 (https://github.com/robertdavidgraham/masscan)"
31+
}
32+
],
33+
"url": "https://api.datadoghq.com/api/v2/security/siem/ioc-explorer/indicator?indicator=masscan%2F1.3%20%28https%3A%2F%2Fgithub.com%2Frobertdavidgraham%2Fmasscan%29"
34+
},
35+
"response": {
36+
"bodySize": 855,
37+
"content": {
38+
"mimeType": "application/vnd.api+json",
39+
"size": 855,
40+
"text": "{\"data\":{\"id\":\"65a31893-cc59-4125-9424-44f7ba083e53\",\"type\":\"get_indicator_response\",\"attributes\":{\"data\":{\"id\":\"masscan/1.3 (https://github.com/robertdavidgraham/masscan)\",\"indicator\":\"masscan/1.3 (https://github.com/robertdavidgraham/masscan)\",\"indicator_type\":\"User Agent\",\"score\":4,\"as_type\":\"hosting\",\"malicious_sources\":null,\"suspicious_sources\":[{\"name\":\"Datadog Threat Research\"}],\"benign_sources\":null,\"categories\":[\"scanner\"],\"tags\":[],\"signal_matches\":0,\"log_matches\":45,\"first_seen\":\"2025-01-08T23:24:45Z\",\"last_seen\":\"2026-04-10T14:36:20Z\",\"signal_tier\":0,\"max_trust_score\":\"RAISE_SCORE\",\"m_sources\":\"NO_EFFECT\",\"m_persistence\":\"RAISE_SCORE\",\"m_signal\":\"NO_EFFECT\",\"m_as_type\":\"NO_EFFECT\",\"log_sources\":[],\"services\":[],\"signal_severity\":[],\"users\":{},\"critical_assets\":[],\"hosts\":[],\"as_number\":\"\",\"as_organization\":\"\",\"as_cidr_block\":\"\"}}}}"
41+
},
42+
"cookies": [],
43+
"headers": [
44+
{
45+
"name": "content-type",
46+
"value": "application/vnd.api+json"
47+
}
48+
],
49+
"headersSize": 526,
50+
"httpVersion": "HTTP/1.1",
51+
"redirectURL": "",
52+
"status": 200,
53+
"statusText": "OK"
54+
},
55+
"startedDateTime": "2026-04-14T18:22:29.744Z",
56+
"time": 1461
57+
}
58+
],
59+
"pages": [],
60+
"version": "1.2"
61+
}
62+
}

‎cassettes/v2/Security-Monitoring_1187227211/List-indicators-of-compromise-returns-Bad-Request-response_209392928/frozen.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2026-04-14T18:22:40.711Z"

‎cassettes/v2/Security-Monitoring_1187227211/List-indicators-of-compromise-returns-Bad-Request-response_209392928/recording.har‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/List indicators of compromise returns \"Bad Request\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "02b5fd499f5dcaf4c0c97eb95adecf70",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 0,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
}
23+
],
24+
"headersSize": 586,
25+
"httpVersion": "HTTP/1.1",
26+
"method": "GET",
27+
"queryString": [
28+
{
29+
"name": "query",
30+
"value": "invalid:::query"
31+
}
32+
],
33+
"url": "https://api.datadoghq.com/api/v2/security/siem/ioc-explorer?query=invalid%3A%3A%3Aquery"
34+
},
35+
"response": {
36+
"bodySize": 166,
37+
"content": {
38+
"mimeType": "application/vnd.api+json",
39+
"size": 166,
40+
"text": "{\"errors\":[{\"title\":\"Generic Error\",\"detail\":\"invalid query: invalid query: syntax error: no viable alternative at input 'invalid::' at line 1 and char position 8\"}]}"
41+
},
42+
"cookies": [],
43+
"headers": [
44+
{
45+
"name": "content-type",
46+
"value": "application/vnd.api+json"
47+
}
48+
],
49+
"headersSize": 525,
50+
"httpVersion": "HTTP/1.1",
51+
"redirectURL": "",
52+
"status": 400,
53+
"statusText": "Bad Request"
54+
},
55+
"startedDateTime": "2026-04-14T18:22:40.719Z",
56+
"time": 507
57+
}
58+
],
59+
"pages": [],
60+
"version": "1.2"
61+
}
62+
}

‎cassettes/v2/Security-Monitoring_1187227211/List-indicators-of-compromise-returns-OK-response_3833256302/frozen.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2026-04-14T18:22:48.392Z"

‎cassettes/v2/Security-Monitoring_1187227211/List-indicators-of-compromise-returns-OK-response_3833256302/recording.har‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/List indicators of compromise returns \"OK\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "6fab925a65ec0cad89aaa6c228f598ee",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 0,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
}
23+
],
24+
"headersSize": 566,
25+
"httpVersion": "HTTP/1.1",
26+
"method": "GET",
27+
"queryString": [
28+
{
29+
"name": "limit",
30+
"value": "1"
31+
}
32+
],
33+
"url": "https://api.datadoghq.com/api/v2/security/siem/ioc-explorer?limit=1"
34+
},
35+
"response": {
36+
"bodySize": 715,
37+
"content": {
38+
"mimeType": "application/vnd.api+json",
39+
"size": 715,
40+
"text": "{\"data\":{\"id\":\"a4e3b616-e180-4b47-a379-43da9c5b300e\",\"type\":\"ioc_explorer_response\",\"attributes\":{\"data\":[{\"id\":\"43.228.157.121\",\"indicator\":\"43.228.157.121\",\"indicator_type\":\"IP Address\",\"score\":8,\"as_type\":\"hosting\",\"malicious_sources\":[{\"name\":\"threatfox\"}],\"suspicious_sources\":[{\"name\":\"tor\"},{\"name\":\"SPUR\"}],\"benign_sources\":null,\"categories\":[\"malware\",\"tor\",\"hosting_proxy\"],\"tags\":[],\"signal_matches\":0,\"log_matches\":14,\"signal_tier\":0,\"max_trust_score\":\"RAISE_SCORE\",\"m_sources\":\"RAISE_SCORE\",\"m_persistence\":\"NO_EFFECT\",\"m_signal\":\"NO_EFFECT\",\"m_as_type\":\"NO_EFFECT\",\"as_geo\":{\"city\":\"Frankfurt am Main\",\"country_code\":\"DE\",\"country_name\":\"Germany\"}}],\"metadata\":{\"count\":25091},\"paging\":{\"offset\":1}}}}"
41+
},
42+
"cookies": [],
43+
"headers": [
44+
{
45+
"name": "content-type",
46+
"value": "application/vnd.api+json"
47+
}
48+
],
49+
"headersSize": 525,
50+
"httpVersion": "HTTP/1.1",
51+
"redirectURL": "",
52+
"status": 200,
53+
"statusText": "OK"
54+
},
55+
"startedDateTime": "2026-04-14T18:22:48.401Z",
56+
"time": 1221
57+
}
58+
],
59+
"pages": [],
60+
"version": "1.2"
61+
}
62+
}

‎features/v2/security_monitoring.feature‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1298,6 +1298,30 @@ Feature: Security Monitoring
12981298
Then the response status is 200 OK
12991299
And the response "data[0].attributes.name" is equal to "suppression2 {{ unique_hash }}"
13001300

1301+
@generated @skip @team:DataDog/k9-cloud-siem
1302+
Scenario: Get an indicator of compromise returns "Bad Request" response
1303+
Given operation "GetIndicatorOfCompromise" enabled
1304+
And new "GetIndicatorOfCompromise" request
1305+
And request contains "indicator" parameter from "REPLACE.ME"
1306+
When the request is sent
1307+
Then the response status is 400 Bad Request
1308+
1309+
@replay-only @skip-terraform-config @team:DataDog/k9-cloud-siem
1310+
Scenario: Get an indicator of compromise returns "Not Found" response
1311+
Given operation "GetIndicatorOfCompromise" enabled
1312+
And new "GetIndicatorOfCompromise" request
1313+
And request contains "indicator" parameter with value "this-indicator-does-not-exist.invalid"
1314+
When the request is sent
1315+
Then the response status is 404 Not Found
1316+
1317+
@replay-only @skip-terraform-config @team:DataDog/k9-cloud-siem
1318+
Scenario: Get an indicator of compromise returns "OK" response
1319+
Given operation "GetIndicatorOfCompromise" enabled
1320+
And new "GetIndicatorOfCompromise" request
1321+
And request contains "indicator" parameter with value "masscan/1.3 (https://github.com/robertdavidgraham/masscan)"
1322+
When the request is sent
1323+
Then the response status is 200 OK
1324+
13011325
@generated @skip @team:DataDog/k9-cloud-siem
13021326
Scenario: Get content pack states returns "Not Found" response
13031327
Given operation "GetContentPacksStates" enabled
@@ -1573,6 +1597,22 @@ Feature: Security Monitoring
15731597
When the request is sent
15741598
Then the response status is 200 OK
15751599

1600+
@replay-only @skip-terraform-config @team:DataDog/k9-cloud-siem
1601+
Scenario: List indicators of compromise returns "Bad Request" response
1602+
Given operation "ListIndicatorsOfCompromise" enabled
1603+
And new "ListIndicatorsOfCompromise" request
1604+
And request contains "query" parameter with value "invalid:::query"
1605+
When the request is sent
1606+
Then the response status is 400 Bad Request
1607+
1608+
@replay-only @skip-terraform-config @team:DataDog/k9-cloud-siem
1609+
Scenario: List indicators of compromise returns "OK" response
1610+
Given operation "ListIndicatorsOfCompromise" enabled
1611+
And new "ListIndicatorsOfCompromise" request
1612+
And request contains "limit" parameter with value 1
1613+
When the request is sent
1614+
Then the response status is 200 OK
1615+
15761616
@team:DataDog/k9-cloud-siem
15771617
Scenario: List resource filters returns "Bad Request" response
15781618
Given new "GetResourceEvaluationFilters" request

0 commit comments

Comments
 (0)