Skip to content

Commit 592c75a

Browse files
committed
docs(appsec): clarify inferred schema noise reduction
Explain that the inferred schema filters fields by observation count and recency, reducing false-positive drift from one-off or attacker traffic.
1 parent d4b2bad commit 592c75a

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

  • content/en/security/application_security/api_posture/api_inventory

content/en/security/application_security/api_posture/api_inventory/api_endpoints.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,7 @@ When the endpoint is associated with an API in Datadog Software Catalog, the dis
141141
- **View Raw Schema**: view the raw OpenAPI schema as YAML
142142
- **View inferred schema**: view the inferred schema as a preview or YAML. This inferred schema can be exported as an OpenAPI file in YAML or JSON.
143143

144-
To reduce noise, the inferred schema includes fields that are observed reliably over time and leaves out one-off or rarely seen fields, so the differences reported reflect meaningful drift rather than transient traffic.
144+
To reduce noise, the inferred schema only includes fields that are observed enough times, and automatically drops fields that haven't been seen recently. This keeps one-off traffic, such as a single malformed request or an attacker probing an endpoint with an unexpected field, from polluting the inferred schema and appearing as drift when compared against the declared schema.
145145

146146
### Compare *declared* and *inferred* schemas
147147

0 commit comments

Comments
 (0)