diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml index 993e6653a1..ce141ae185 100644 --- a/.generator/schemas/v2/openapi.yaml +++ b/.generator/schemas/v2/openapi.yaml @@ -2060,6 +2060,15 @@ components: required: true schema: type: string + SecurityMonitoringRuleProposalID: + description: The ID of the rule proposal, returned by the start a rule proposal endpoint. + in: path + name: proposal_id + required: true + schema: + example: c968cf83-56c2-4d54-a993-6c86dfb83527 + format: uuid + type: string SecurityMonitoringRuleVersion: description: The historical version number of the rule. in: path @@ -2512,6 +2521,30 @@ components: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized + SecurityMonitoringRuleProposalBadRequestResponse: + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Bad Request + SecurityMonitoringRuleProposalForbiddenResponse: + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Forbidden + SecurityMonitoringRuleProposalNotFoundResponse: + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Not Found + SecurityMonitoringRuleProposalUnauthorizedResponse: + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Unauthorized SpansBadRequestResponse: content: application/json: @@ -117483,6 +117516,177 @@ components: thirdPartyRuleOptions: $ref: "#/components/schemas/SecurityMonitoringRuleThirdPartyOptions" type: object + SecurityMonitoringRuleProposalError: + description: The reason no rule could be generated. Only present when the status is `failed`. + properties: + kind: + description: |- + The kind of failure. + - `translation_error`: no rule could be generated from the input. Reword the input + or add details, then start a new rule proposal. + - `internal_error`: the proposal failed because of an internal error. Start a new + rule proposal to try again. + example: translation_error + type: string + message: + description: A human-readable explanation of why no rule could be generated, when available. + example: No log source matches the described activity. + type: string + type: + description: The type of failure within its kind, such as `NoRuleProduced`. + example: NoRuleProduced + type: string + required: + - kind + type: object + SecurityMonitoringRuleProposalInputType: + description: |- + The type of input to generate the proposed rule from: `natural_language` for a + plain-English description of the behavior to detect, `spl` for a Splunk SPL search or + saved search definition, or `kql` for a Microsoft KQL query. SPL inputs must be + self-contained, with search macros expanded. + enum: + - natural_language + - spl + - kql + example: natural_language + type: string + x-enum-varnames: + - NATURAL_LANGUAGE + - SPL + - KQL + SecurityMonitoringRuleProposalResponse: + description: Response containing a rule proposal. + properties: + data: + $ref: "#/components/schemas/SecurityMonitoringRuleProposalResponseData" + required: + - data + type: object + SecurityMonitoringRuleProposalResponseAttributes: + description: Attributes of the rule proposal. + properties: + error: + $ref: "#/components/schemas/SecurityMonitoringRuleProposalError" + rule: + additionalProperties: {} + description: |- + The proposed Cloud SIEM detection rule in the same format as the create a detection + rule endpoint. It is not saved in Cloud SIEM. Only present when the status is + `completed`. Review the rule, then create it with the [create a + detection rule](https://docs.datadoghq.com/api/latest/security-monitoring/#create-a-detection-rule) + endpoint. + type: object + status: + description: |- + The status of the rule proposal. `pending` and `in_progress` mean the proposed rule is + still being generated. Poll the endpoint again later. `completed` and `failed` are final: + `completed` proposals contain the proposed rule in `rule`, and `failed` proposals + contain the reason in `error`. + example: completed + type: string + required: + - status + type: object + SecurityMonitoringRuleProposalResponseData: + description: Data of the rule proposal. + properties: + attributes: + $ref: "#/components/schemas/SecurityMonitoringRuleProposalResponseAttributes" + id: + description: The ID of the rule proposal. + example: c968cf83-56c2-4d54-a993-6c86dfb83527 + format: uuid + type: string + type: + $ref: "#/components/schemas/SecurityMonitoringRuleProposalType" + required: + - id + - type + - attributes + type: object + SecurityMonitoringRuleProposalStartRequest: + description: Request to start a rule proposal. + properties: + data: + $ref: "#/components/schemas/SecurityMonitoringRuleProposalStartRequestData" + required: + - data + type: object + SecurityMonitoringRuleProposalStartRequestAttributes: + description: Attributes of the rule proposal to start. + properties: + input: + description: |- + The natural-language description or rule to generate the proposed rule from, in the + format given by `inputType`. + example: Detect repeated failed Okta logins followed by a successful login from the same IP. + maxLength: 65536 + type: string + inputType: + $ref: "#/components/schemas/SecurityMonitoringRuleProposalInputType" + required: + - inputType + - input + type: object + SecurityMonitoringRuleProposalStartRequestData: + description: Data of the rule proposal to start. + properties: + attributes: + $ref: "#/components/schemas/SecurityMonitoringRuleProposalStartRequestAttributes" + type: + $ref: "#/components/schemas/SecurityMonitoringRuleProposalType" + required: + - type + - attributes + type: object + SecurityMonitoringRuleProposalStartResponse: + description: Response to a started rule proposal. + properties: + data: + $ref: "#/components/schemas/SecurityMonitoringRuleProposalStartResponseData" + required: + - data + type: object + SecurityMonitoringRuleProposalStartResponseAttributes: + description: Attributes of the started rule proposal. + properties: + status: + description: |- + The status of the rule proposal, one of `pending`, `in_progress`, `completed`, or + `failed`. For a newly started rule proposal, the status is `pending`. + example: pending + type: string + required: + - status + type: object + SecurityMonitoringRuleProposalStartResponseData: + description: Data of the started rule proposal. + properties: + attributes: + $ref: "#/components/schemas/SecurityMonitoringRuleProposalStartResponseAttributes" + id: + description: |- + The ID of the rule proposal. Use it as `proposal_id` to check the proposal status and get the proposed rule. + example: c968cf83-56c2-4d54-a993-6c86dfb83527 + format: uuid + type: string + type: + $ref: "#/components/schemas/SecurityMonitoringRuleProposalType" + required: + - id + - type + - attributes + type: object + SecurityMonitoringRuleProposalType: + default: rule_proposals + description: The rule proposal resource type. The value is always `rule_proposals`. + enum: + - rule_proposals + example: rule_proposals + type: string + x-enum-varnames: + - RULE_PROPOSALS SecurityMonitoringRuleQuery: description: Query for matching rule. oneOf: @@ -231586,6 +231790,7 @@ paths: rule. To load more rules, add them with the add resources endpoint before starting the batch migration. A batch migration can hold up to 1000 resources. The response does not include the created resources: list the resources of the batch migration to retrieve them. + Alternatively, use the start-a-rule-proposal endpoint to get a single proposed rule. operationId: CreateSecurityMonitoringBatchMigration requestBody: content: @@ -235707,6 +235912,159 @@ paths: operator: OR permissions: - security_monitoring_rules_read + /api/v2/security_monitoring/rules/proposals: + post: + description: |- + Start generating a proposed Cloud SIEM detection rule from a natural-language + description, or from an SPL or KQL rule. The proposal is based on your organization's + log sources, log fields, and existing detection rules. When logs from the matching + source are available, the proposed query is tested against your recent logs. + + The proposed rule is generated asynchronously. This endpoint returns a proposal `id` + with the status `pending`. To get the proposed rule, pass this `id` to the get-a-rule-proposal + endpoint and poll the endpoint until the status is `completed` or `failed`. A proposal + usually takes a few minutes, and up to 10 minutes. + + This endpoint does not create or modify any detection rules in Cloud SIEM. To translate + many rules at once, use batch migrations instead. + operationId: StartSecurityMonitoringRuleProposal + requestBody: + content: + application/json: + schema: + $ref: "#/components/schemas/SecurityMonitoringRuleProposalStartRequest" + required: true + responses: + "202": + content: + application/json: + examples: + default: + value: + data: + attributes: + status: pending + id: c968cf83-56c2-4d54-a993-6c86dfb83527 + type: rule_proposals + schema: + $ref: "#/components/schemas/SecurityMonitoringRuleProposalStartResponse" + description: Accepted + "400": + $ref: "#/components/responses/SecurityMonitoringRuleProposalBadRequestResponse" + "401": + $ref: "#/components/responses/SecurityMonitoringRuleProposalUnauthorizedResponse" + "403": + $ref: "#/components/responses/SecurityMonitoringRuleProposalForbiddenResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_rules_write + summary: Start a rule proposal + tags: + - Security Monitoring + x-codegen-request-body-name: body + "x-permission": + operator: OR + permissions: + - security_monitoring_rules_write + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. + /api/v2/security_monitoring/rules/proposals/{proposal_id}: + get: + description: |- + Get the status of a rule proposal started with the start-a-rule-proposal endpoint. + While the status is `pending` or `in_progress`, the proposed rule is still being + generated. Poll this endpoint again later. If the status is `completed`, the response's `rule` field contains + the proposed Cloud SIEM detection rule. If the status is `failed`, the response's `error` field contains + the reason a rule could not be generated. + + This endpoint does not create or modify any detection rules in Cloud SIEM. To create the + proposed rule, use the create-a-detection-rule endpoint. + operationId: GetSecurityMonitoringRuleProposal + parameters: + - $ref: "#/components/parameters/SecurityMonitoringRuleProposalID" + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + attributes: + rule: + cases: + - condition: failed_login > 5 && successful_login > 0 + name: Successful login after repeated failures + status: medium + isEnabled: false + message: Repeated failed Okta logins were followed by a successful login from the same IP. + name: Successful Okta login after repeated failures + options: + detectionMethod: threshold + evaluationWindow: 900 + keepAlive: 3600 + maxSignalDuration: 86400 + queries: + - aggregation: count + groupByFields: + - "@network.client.ip" + name: failed_login + query: source:okta @evt.name:user.session.start @evt.outcome:FAILURE + - aggregation: count + groupByFields: + - "@network.client.ip" + name: successful_login + query: source:okta @evt.name:user.session.start @evt.outcome:SUCCESS + tags: + - source:okta + type: log_detection + status: completed + id: c968cf83-56c2-4d54-a993-6c86dfb83527 + type: rule_proposals + failed: + value: + data: + attributes: + error: + kind: translation_error + message: No log source matches the described activity. + type: NoRuleProduced + status: failed + id: c968cf83-56c2-4d54-a993-6c86dfb83527 + type: rule_proposals + schema: + $ref: "#/components/schemas/SecurityMonitoringRuleProposalResponse" + description: OK + "400": + $ref: "#/components/responses/SecurityMonitoringRuleProposalBadRequestResponse" + "401": + $ref: "#/components/responses/SecurityMonitoringRuleProposalUnauthorizedResponse" + "403": + $ref: "#/components/responses/SecurityMonitoringRuleProposalForbiddenResponse" + "404": + $ref: "#/components/responses/SecurityMonitoringRuleProposalNotFoundResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_rules_read + summary: Get a rule proposal + tags: + - Security Monitoring + "x-permission": + operator: OR + permissions: + - security_monitoring_rules_read + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. /api/v2/security_monitoring/rules/test: post: description: |- diff --git a/examples/v2/security-monitoring/GetSecurityMonitoringRuleProposal.py b/examples/v2/security-monitoring/GetSecurityMonitoringRuleProposal.py new file mode 100644 index 0000000000..4f3f667fdb --- /dev/null +++ b/examples/v2/security-monitoring/GetSecurityMonitoringRuleProposal.py @@ -0,0 +1,21 @@ +""" +Get a rule proposal returns "OK" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi + +# there is a valid "rule_proposal" in the system +RULE_PROPOSAL_DATA_ID = environ["RULE_PROPOSAL_DATA_ID"] + +configuration = Configuration() +configuration.access_token = environ["DD_BEARER_TOKEN"] +configuration.unstable_operations["get_security_monitoring_rule_proposal"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + response = api_instance.get_security_monitoring_rule_proposal( + proposal_id=RULE_PROPOSAL_DATA_ID, + ) + + print(response) diff --git a/examples/v2/security-monitoring/StartSecurityMonitoringRuleProposal.py b/examples/v2/security-monitoring/StartSecurityMonitoringRuleProposal.py new file mode 100644 index 0000000000..63e8dd3265 --- /dev/null +++ b/examples/v2/security-monitoring/StartSecurityMonitoringRuleProposal.py @@ -0,0 +1,39 @@ +""" +Start a rule proposal returns "Accepted" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi +from datadog_api_client.v2.model.security_monitoring_rule_proposal_input_type import ( + SecurityMonitoringRuleProposalInputType, +) +from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_request import ( + SecurityMonitoringRuleProposalStartRequest, +) +from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_request_attributes import ( + SecurityMonitoringRuleProposalStartRequestAttributes, +) +from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_request_data import ( + SecurityMonitoringRuleProposalStartRequestData, +) +from datadog_api_client.v2.model.security_monitoring_rule_proposal_type import SecurityMonitoringRuleProposalType + +body = SecurityMonitoringRuleProposalStartRequest( + data=SecurityMonitoringRuleProposalStartRequestData( + type=SecurityMonitoringRuleProposalType.RULE_PROPOSALS, + attributes=SecurityMonitoringRuleProposalStartRequestAttributes( + input_type=SecurityMonitoringRuleProposalInputType.NATURAL_LANGUAGE, + input="Detect repeated failed Okta logins followed by a successful login from the same IP.", + ), + ), +) + +configuration = Configuration() +configuration.access_token = environ["DD_BEARER_TOKEN"] +configuration.unstable_operations["start_security_monitoring_rule_proposal"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + response = api_instance.start_security_monitoring_rule_proposal(body=body) + + print(response) diff --git a/src/datadog_api_client/configuration.py b/src/datadog_api_client/configuration.py index 5feb04aeec..bb9894d1a4 100644 --- a/src/datadog_api_client/configuration.py +++ b/src/datadog_api_client/configuration.py @@ -431,6 +431,7 @@ def __init__( "v2.get_security_monitoring_histsignal": False, "v2.get_security_monitoring_histsignals_by_job_id": False, "v2.get_security_monitoring_integration_config": False, + "v2.get_security_monitoring_rule_proposal": False, "v2.get_signal_entities": False, "v2.get_single_entity_context": False, "v2.get_static_analysis_default_rulesets": False, @@ -468,6 +469,7 @@ def __init__( "v2.run_historical_job": False, "v2.search_security_monitoring_histsignals": False, "v2.start_security_monitoring_batch_migration": False, + "v2.start_security_monitoring_rule_proposal": False, "v2.update_findings_assignee": False, "v2.update_findings_severity": False, "v2.update_security_findings_automation_due_date_rule": False, diff --git a/src/datadog_api_client/v2/api/security_monitoring_api.py b/src/datadog_api_client/v2/api/security_monitoring_api.py index da742180c2..1020cf70de 100644 --- a/src/datadog_api_client/v2/api/security_monitoring_api.py +++ b/src/datadog_api_client/v2/api/security_monitoring_api.py @@ -261,6 +261,15 @@ from datadog_api_client.v2.model.security_monitoring_rule_convert_bulk_payload import ( SecurityMonitoringRuleConvertBulkPayload, ) +from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_response import ( + SecurityMonitoringRuleProposalStartResponse, +) +from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_request import ( + SecurityMonitoringRuleProposalStartRequest, +) +from datadog_api_client.v2.model.security_monitoring_rule_proposal_response import ( + SecurityMonitoringRuleProposalResponse, +) from datadog_api_client.v2.model.security_monitoring_rule_test_response import SecurityMonitoringRuleTestResponse from datadog_api_client.v2.model.security_monitoring_rule_test_request import SecurityMonitoringRuleTestRequest from datadog_api_client.v2.model.security_monitoring_rule_validate_payload import SecurityMonitoringRuleValidatePayload @@ -2825,6 +2834,29 @@ def __init__(self, api_client=None): api_client=api_client, ) + self._get_security_monitoring_rule_proposal_endpoint = _Endpoint( + settings={ + "response_type": (SecurityMonitoringRuleProposalResponse,), + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/rules/proposals/{proposal_id}", + "operation_id": "get_security_monitoring_rule_proposal", + "http_method": "GET", + "version": "v2", + }, + params_map={ + "proposal_id": { + "required": True, + "openapi_types": (UUID,), + "attribute": "proposal_id", + "location": "path", + }, + }, + headers_map={ + "accept": ["application/json"], + }, + api_client=api_client, + ) + self._get_security_monitoring_signal_endpoint = _Endpoint( settings={ "response_type": (SecurityMonitoringSignalResponse,), @@ -4914,6 +4946,26 @@ def __init__(self, api_client=None): api_client=api_client, ) + self._start_security_monitoring_rule_proposal_endpoint = _Endpoint( + settings={ + "response_type": (SecurityMonitoringRuleProposalStartResponse,), + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/rules/proposals", + "operation_id": "start_security_monitoring_rule_proposal", + "http_method": "POST", + "version": "v2", + }, + params_map={ + "body": { + "required": True, + "openapi_types": (SecurityMonitoringRuleProposalStartRequest,), + "location": "body", + }, + }, + headers_map={"accept": ["application/json"], "content_type": ["application/json"]}, + api_client=api_client, + ) + self._test_existing_security_monitoring_rule_endpoint = _Endpoint( settings={ "response_type": (SecurityMonitoringRuleTestResponse,), @@ -6121,6 +6173,7 @@ def create_security_monitoring_batch_migration( rule. To load more rules, add them with the add resources endpoint before starting the batch migration. A batch migration can hold up to 1000 resources. The response does not include the created resources: list the resources of the batch migration to retrieve them. + Alternatively, use the start-a-rule-proposal endpoint to get a single proposed rule. :type body: SecurityMonitoringBatchMigrationCreateRequest :rtype: SecurityMonitoringBatchMigrationResponse @@ -7602,6 +7655,30 @@ def get_security_monitoring_rule( return self._get_security_monitoring_rule_endpoint.call_with_http_info(**kwargs) + def get_security_monitoring_rule_proposal( + self, + proposal_id: UUID, + ) -> SecurityMonitoringRuleProposalResponse: + """Get a rule proposal. + + Get the status of a rule proposal started with the start-a-rule-proposal endpoint. + While the status is ``pending`` or ``in_progress`` , the proposed rule is still being + generated. Poll this endpoint again later. If the status is ``completed`` , the response's ``rule`` field contains + the proposed Cloud SIEM detection rule. If the status is ``failed`` , the response's ``error`` field contains + the reason a rule could not be generated. + + This endpoint does not create or modify any detection rules in Cloud SIEM. To create the + proposed rule, use the create-a-detection-rule endpoint. + + :param proposal_id: The ID of the rule proposal, returned by the start a rule proposal endpoint. + :type proposal_id: UUID + :rtype: SecurityMonitoringRuleProposalResponse + """ + kwargs: Dict[str, Any] = {} + kwargs["proposal_id"] = proposal_id + + return self._get_security_monitoring_rule_proposal_endpoint.call_with_http_info(**kwargs) + def get_security_monitoring_signal( self, signal_id: str, @@ -10099,6 +10176,33 @@ def start_security_monitoring_batch_migration( return self._start_security_monitoring_batch_migration_endpoint.call_with_http_info(**kwargs) + def start_security_monitoring_rule_proposal( + self, + body: SecurityMonitoringRuleProposalStartRequest, + ) -> SecurityMonitoringRuleProposalStartResponse: + """Start a rule proposal. + + Start generating a proposed Cloud SIEM detection rule from a natural-language + description, or from an SPL or KQL rule. The proposal is based on your organization's + log sources, log fields, and existing detection rules. When logs from the matching + source are available, the proposed query is tested against your recent logs. + + The proposed rule is generated asynchronously. This endpoint returns a proposal ``id`` + with the status ``pending``. To get the proposed rule, pass this ``id`` to the get-a-rule-proposal + endpoint and poll the endpoint until the status is ``completed`` or ``failed``. A proposal + usually takes a few minutes, and up to 10 minutes. + + This endpoint does not create or modify any detection rules in Cloud SIEM. To translate + many rules at once, use batch migrations instead. + + :type body: SecurityMonitoringRuleProposalStartRequest + :rtype: SecurityMonitoringRuleProposalStartResponse + """ + kwargs: Dict[str, Any] = {} + kwargs["body"] = body + + return self._start_security_monitoring_rule_proposal_endpoint.call_with_http_info(**kwargs) + def test_existing_security_monitoring_rule( self, rule_id: str, diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_error.py b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_error.py new file mode 100644 index 0000000000..6e58b9a2a8 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_error.py @@ -0,0 +1,57 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Union + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, +) + + +class SecurityMonitoringRuleProposalError(ModelNormal): + @cached_property + def openapi_types(_): + return { + "kind": (str,), + "message": (str,), + "type": (str,), + } + + attribute_map = { + "kind": "kind", + "message": "message", + "type": "type", + } + + def __init__( + self_, kind: str, message: Union[str, UnsetType] = unset, type: Union[str, UnsetType] = unset, **kwargs + ): + """ + The reason no rule could be generated. Only present when the status is ``failed``. + + :param kind: The kind of failure. + + * ``translation_error`` : no rule could be generated from the input. Reword the input + or add details, then start a new rule proposal. + * ``internal_error`` : the proposal failed because of an internal error. Start a new + rule proposal to try again. + :type kind: str + + :param message: A human-readable explanation of why no rule could be generated, when available. + :type message: str, optional + + :param type: The type of failure within its kind, such as ``NoRuleProduced``. + :type type: str, optional + """ + if message is not unset: + kwargs["message"] = message + if type is not unset: + kwargs["type"] = type + super().__init__(kwargs) + + self_.kind = kind diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_input_type.py b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_input_type.py new file mode 100644 index 0000000000..56351f713d --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_input_type.py @@ -0,0 +1,44 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelSimple, + cached_property, +) + +from typing import ClassVar + + +class SecurityMonitoringRuleProposalInputType(ModelSimple): + """ + The type of input to generate the proposed rule from: `natural_language` for a + plain-English description of the behavior to detect, `spl` for a Splunk SPL search or + saved search definition, or `kql` for a Microsoft KQL query. SPL inputs must be + self-contained, with search macros expanded. + + :param value: Must be one of ["natural_language", "spl", "kql"]. + :type value: str + """ + + allowed_values = { + "natural_language", + "spl", + "kql", + } + NATURAL_LANGUAGE: ClassVar["SecurityMonitoringRuleProposalInputType"] + SPL: ClassVar["SecurityMonitoringRuleProposalInputType"] + KQL: ClassVar["SecurityMonitoringRuleProposalInputType"] + + @cached_property + def openapi_types(_): + return { + "value": (str,), + } + + +SecurityMonitoringRuleProposalInputType.NATURAL_LANGUAGE = SecurityMonitoringRuleProposalInputType("natural_language") +SecurityMonitoringRuleProposalInputType.SPL = SecurityMonitoringRuleProposalInputType("spl") +SecurityMonitoringRuleProposalInputType.KQL = SecurityMonitoringRuleProposalInputType("kql") diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_response.py b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_response.py new file mode 100644 index 0000000000..fd3666760a --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_response.py @@ -0,0 +1,44 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_rule_proposal_response_data import ( + SecurityMonitoringRuleProposalResponseData, + ) + + +class SecurityMonitoringRuleProposalResponse(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_rule_proposal_response_data import ( + SecurityMonitoringRuleProposalResponseData, + ) + + return { + "data": (SecurityMonitoringRuleProposalResponseData,), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: SecurityMonitoringRuleProposalResponseData, **kwargs): + """ + Response containing a rule proposal. + + :param data: Data of the rule proposal. + :type data: SecurityMonitoringRuleProposalResponseData + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_response_attributes.py b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_response_attributes.py new file mode 100644 index 0000000000..5ce6600726 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_response_attributes.py @@ -0,0 +1,90 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Any, Dict, Union, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + date, + datetime, + none_type, + unset, + UnsetType, + UUID, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_rule_proposal_error import SecurityMonitoringRuleProposalError + + +class SecurityMonitoringRuleProposalResponseAttributes(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_rule_proposal_error import ( + SecurityMonitoringRuleProposalError, + ) + + return { + "error": (SecurityMonitoringRuleProposalError,), + "rule": ( + { + str: ( + bool, + date, + datetime, + dict, + float, + int, + list, + str, + UUID, + none_type, + ) + }, + ), + "status": (str,), + } + + attribute_map = { + "error": "error", + "rule": "rule", + "status": "status", + } + + def __init__( + self_, + status: str, + error: Union[SecurityMonitoringRuleProposalError, UnsetType] = unset, + rule: Union[Dict[str, Any], UnsetType] = unset, + **kwargs, + ): + """ + Attributes of the rule proposal. + + :param error: The reason no rule could be generated. Only present when the status is ``failed``. + :type error: SecurityMonitoringRuleProposalError, optional + + :param rule: The proposed Cloud SIEM detection rule in the same format as the create a detection + rule endpoint. It is not saved in Cloud SIEM. Only present when the status is + ``completed``. Review the rule, then create it with the `create a + detection rule `_ + endpoint. + :type rule: {str: (bool, date, datetime, dict, float, int, list, str, UUID, none_type,)}, optional + + :param status: The status of the rule proposal. ``pending`` and ``in_progress`` mean the proposed rule is + still being generated. Poll the endpoint again later. ``completed`` and ``failed`` are final: + ``completed`` proposals contain the proposed rule in ``rule`` , and ``failed`` proposals + contain the reason in ``error``. + :type status: str + """ + if error is not unset: + kwargs["error"] = error + if rule is not unset: + kwargs["rule"] = rule + super().__init__(kwargs) + + self_.status = status diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_response_data.py b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_response_data.py new file mode 100644 index 0000000000..4555f9413c --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_response_data.py @@ -0,0 +1,67 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + UUID, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_rule_proposal_response_attributes import ( + SecurityMonitoringRuleProposalResponseAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_rule_proposal_type import SecurityMonitoringRuleProposalType + + +class SecurityMonitoringRuleProposalResponseData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_rule_proposal_response_attributes import ( + SecurityMonitoringRuleProposalResponseAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_rule_proposal_type import ( + SecurityMonitoringRuleProposalType, + ) + + return { + "attributes": (SecurityMonitoringRuleProposalResponseAttributes,), + "id": (UUID,), + "type": (SecurityMonitoringRuleProposalType,), + } + + attribute_map = { + "attributes": "attributes", + "id": "id", + "type": "type", + } + + def __init__( + self_, + attributes: SecurityMonitoringRuleProposalResponseAttributes, + id: UUID, + type: SecurityMonitoringRuleProposalType, + **kwargs, + ): + """ + Data of the rule proposal. + + :param attributes: Attributes of the rule proposal. + :type attributes: SecurityMonitoringRuleProposalResponseAttributes + + :param id: The ID of the rule proposal. + :type id: UUID + + :param type: The rule proposal resource type. The value is always ``rule_proposals``. + :type type: SecurityMonitoringRuleProposalType + """ + super().__init__(kwargs) + + self_.attributes = attributes + self_.id = id + self_.type = type diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_request.py b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_request.py new file mode 100644 index 0000000000..1f66d56b38 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_request.py @@ -0,0 +1,44 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_request_data import ( + SecurityMonitoringRuleProposalStartRequestData, + ) + + +class SecurityMonitoringRuleProposalStartRequest(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_request_data import ( + SecurityMonitoringRuleProposalStartRequestData, + ) + + return { + "data": (SecurityMonitoringRuleProposalStartRequestData,), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: SecurityMonitoringRuleProposalStartRequestData, **kwargs): + """ + Request to start a rule proposal. + + :param data: Data of the rule proposal to start. + :type data: SecurityMonitoringRuleProposalStartRequestData + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_request_attributes.py b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_request_attributes.py new file mode 100644 index 0000000000..8787f38a44 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_request_attributes.py @@ -0,0 +1,60 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_rule_proposal_input_type import ( + SecurityMonitoringRuleProposalInputType, + ) + + +class SecurityMonitoringRuleProposalStartRequestAttributes(ModelNormal): + validations = { + "input": { + "max_length": 65536, + }, + } + + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_rule_proposal_input_type import ( + SecurityMonitoringRuleProposalInputType, + ) + + return { + "input": (str,), + "input_type": (SecurityMonitoringRuleProposalInputType,), + } + + attribute_map = { + "input": "input", + "input_type": "inputType", + } + + def __init__(self_, input: str, input_type: SecurityMonitoringRuleProposalInputType, **kwargs): + """ + Attributes of the rule proposal to start. + + :param input: The natural-language description or rule to generate the proposed rule from, in the + format given by ``inputType``. + :type input: str + + :param input_type: The type of input to generate the proposed rule from: ``natural_language`` for a + plain-English description of the behavior to detect, ``spl`` for a Splunk SPL search or + saved search definition, or ``kql`` for a Microsoft KQL query. SPL inputs must be + self-contained, with search macros expanded. + :type input_type: SecurityMonitoringRuleProposalInputType + """ + super().__init__(kwargs) + + self_.input = input + self_.input_type = input_type diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_request_data.py b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_request_data.py new file mode 100644 index 0000000000..e28ea2dc53 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_request_data.py @@ -0,0 +1,59 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_request_attributes import ( + SecurityMonitoringRuleProposalStartRequestAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_rule_proposal_type import SecurityMonitoringRuleProposalType + + +class SecurityMonitoringRuleProposalStartRequestData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_request_attributes import ( + SecurityMonitoringRuleProposalStartRequestAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_rule_proposal_type import ( + SecurityMonitoringRuleProposalType, + ) + + return { + "attributes": (SecurityMonitoringRuleProposalStartRequestAttributes,), + "type": (SecurityMonitoringRuleProposalType,), + } + + attribute_map = { + "attributes": "attributes", + "type": "type", + } + + def __init__( + self_, + attributes: SecurityMonitoringRuleProposalStartRequestAttributes, + type: SecurityMonitoringRuleProposalType, + **kwargs, + ): + """ + Data of the rule proposal to start. + + :param attributes: Attributes of the rule proposal to start. + :type attributes: SecurityMonitoringRuleProposalStartRequestAttributes + + :param type: The rule proposal resource type. The value is always ``rule_proposals``. + :type type: SecurityMonitoringRuleProposalType + """ + super().__init__(kwargs) + + self_.attributes = attributes + self_.type = type diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_response.py b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_response.py new file mode 100644 index 0000000000..2e7d4730a0 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_response.py @@ -0,0 +1,44 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_response_data import ( + SecurityMonitoringRuleProposalStartResponseData, + ) + + +class SecurityMonitoringRuleProposalStartResponse(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_response_data import ( + SecurityMonitoringRuleProposalStartResponseData, + ) + + return { + "data": (SecurityMonitoringRuleProposalStartResponseData,), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: SecurityMonitoringRuleProposalStartResponseData, **kwargs): + """ + Response to a started rule proposal. + + :param data: Data of the started rule proposal. + :type data: SecurityMonitoringRuleProposalStartResponseData + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_response_attributes.py b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_response_attributes.py new file mode 100644 index 0000000000..4d3b85aefb --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_response_attributes.py @@ -0,0 +1,34 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +class SecurityMonitoringRuleProposalStartResponseAttributes(ModelNormal): + @cached_property + def openapi_types(_): + return { + "status": (str,), + } + + attribute_map = { + "status": "status", + } + + def __init__(self_, status: str, **kwargs): + """ + Attributes of the started rule proposal. + + :param status: The status of the rule proposal, one of ``pending`` , ``in_progress`` , ``completed`` , or + ``failed``. For a newly started rule proposal, the status is ``pending``. + :type status: str + """ + super().__init__(kwargs) + + self_.status = status diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_response_data.py b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_response_data.py new file mode 100644 index 0000000000..97f0f07399 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_start_response_data.py @@ -0,0 +1,67 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + UUID, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_response_attributes import ( + SecurityMonitoringRuleProposalStartResponseAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_rule_proposal_type import SecurityMonitoringRuleProposalType + + +class SecurityMonitoringRuleProposalStartResponseData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_response_attributes import ( + SecurityMonitoringRuleProposalStartResponseAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_rule_proposal_type import ( + SecurityMonitoringRuleProposalType, + ) + + return { + "attributes": (SecurityMonitoringRuleProposalStartResponseAttributes,), + "id": (UUID,), + "type": (SecurityMonitoringRuleProposalType,), + } + + attribute_map = { + "attributes": "attributes", + "id": "id", + "type": "type", + } + + def __init__( + self_, + attributes: SecurityMonitoringRuleProposalStartResponseAttributes, + id: UUID, + type: SecurityMonitoringRuleProposalType, + **kwargs, + ): + """ + Data of the started rule proposal. + + :param attributes: Attributes of the started rule proposal. + :type attributes: SecurityMonitoringRuleProposalStartResponseAttributes + + :param id: The ID of the rule proposal. Use it as ``proposal_id`` to check the proposal status and get the proposed rule. + :type id: UUID + + :param type: The rule proposal resource type. The value is always ``rule_proposals``. + :type type: SecurityMonitoringRuleProposalType + """ + super().__init__(kwargs) + + self_.attributes = attributes + self_.id = id + self_.type = type diff --git a/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_type.py b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_type.py new file mode 100644 index 0000000000..828743e31f --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_rule_proposal_type.py @@ -0,0 +1,35 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelSimple, + cached_property, +) + +from typing import ClassVar + + +class SecurityMonitoringRuleProposalType(ModelSimple): + """ + The rule proposal resource type. The value is always `rule_proposals`. + + :param value: If omitted defaults to "rule_proposals". Must be one of ["rule_proposals"]. + :type value: str + """ + + allowed_values = { + "rule_proposals", + } + RULE_PROPOSALS: ClassVar["SecurityMonitoringRuleProposalType"] + + @cached_property + def openapi_types(_): + return { + "value": (str,), + } + + +SecurityMonitoringRuleProposalType.RULE_PROPOSALS = SecurityMonitoringRuleProposalType("rule_proposals") diff --git a/src/datadog_api_client/v2/models/__init__.py b/src/datadog_api_client/v2/models/__init__.py index 5ab9014f0b..7c90293fec 100644 --- a/src/datadog_api_client/v2/models/__init__.py +++ b/src/datadog_api_client/v2/models/__init__.py @@ -10536,6 +10536,38 @@ SecurityMonitoringRuleNewValueOptionsLearningThreshold, ) from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions +from datadog_api_client.v2.model.security_monitoring_rule_proposal_error import SecurityMonitoringRuleProposalError +from datadog_api_client.v2.model.security_monitoring_rule_proposal_input_type import ( + SecurityMonitoringRuleProposalInputType, +) +from datadog_api_client.v2.model.security_monitoring_rule_proposal_response import ( + SecurityMonitoringRuleProposalResponse, +) +from datadog_api_client.v2.model.security_monitoring_rule_proposal_response_attributes import ( + SecurityMonitoringRuleProposalResponseAttributes, +) +from datadog_api_client.v2.model.security_monitoring_rule_proposal_response_data import ( + SecurityMonitoringRuleProposalResponseData, +) +from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_request import ( + SecurityMonitoringRuleProposalStartRequest, +) +from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_request_attributes import ( + SecurityMonitoringRuleProposalStartRequestAttributes, +) +from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_request_data import ( + SecurityMonitoringRuleProposalStartRequestData, +) +from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_response import ( + SecurityMonitoringRuleProposalStartResponse, +) +from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_response_attributes import ( + SecurityMonitoringRuleProposalStartResponseAttributes, +) +from datadog_api_client.v2.model.security_monitoring_rule_proposal_start_response_data import ( + SecurityMonitoringRuleProposalStartResponseData, +) +from datadog_api_client.v2.model.security_monitoring_rule_proposal_type import SecurityMonitoringRuleProposalType from datadog_api_client.v2.model.security_monitoring_rule_query import SecurityMonitoringRuleQuery from datadog_api_client.v2.model.security_monitoring_rule_query_aggregation import ( SecurityMonitoringRuleQueryAggregation, @@ -20004,6 +20036,18 @@ "SecurityMonitoringRuleNewValueOptionsLearningMethod", "SecurityMonitoringRuleNewValueOptionsLearningThreshold", "SecurityMonitoringRuleOptions", + "SecurityMonitoringRuleProposalError", + "SecurityMonitoringRuleProposalInputType", + "SecurityMonitoringRuleProposalResponse", + "SecurityMonitoringRuleProposalResponseAttributes", + "SecurityMonitoringRuleProposalResponseData", + "SecurityMonitoringRuleProposalStartRequest", + "SecurityMonitoringRuleProposalStartRequestAttributes", + "SecurityMonitoringRuleProposalStartRequestData", + "SecurityMonitoringRuleProposalStartResponse", + "SecurityMonitoringRuleProposalStartResponseAttributes", + "SecurityMonitoringRuleProposalStartResponseData", + "SecurityMonitoringRuleProposalType", "SecurityMonitoringRuleQuery", "SecurityMonitoringRuleQueryAggregation", "SecurityMonitoringRuleQueryPayload", diff --git a/tests/generated-test/test-runner-data/manifest.json b/tests/generated-test/test-runner-data/manifest.json index ce115e1632..998b93d6d5 100644 --- a/tests/generated-test/test-runner-data/manifest.json +++ b/tests/generated-test/test-runner-data/manifest.json @@ -10794,6 +10794,13 @@ "scenario": "Get a quick list of security signals returns \"OK\" response with pagination", "version": "v2" }, + { + "feature": "Security Monitoring", + "feature_file": "../../v2/features/security_monitoring.feature", + "file": "v2/security-monitoring/get-a-rule-proposal-returns-ok-response.json", + "scenario": "Get a rule proposal returns \"OK\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "feature_file": "../../v2/features/security_monitoring.feature", @@ -11368,6 +11375,13 @@ "scenario": "Search security findings returns \"OK\" response with pagination", "version": "v2" }, + { + "feature": "Security Monitoring", + "feature_file": "../../v2/features/security_monitoring.feature", + "file": "v2/security-monitoring/start-a-rule-proposal-returns-accepted-response.json", + "scenario": "Start a rule proposal returns \"Accepted\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "feature_file": "../../v2/features/security_monitoring.feature", diff --git a/tests/generated-test/test-runner-data/v2/security-monitoring/get-a-rule-proposal-returns-ok-response.json b/tests/generated-test/test-runner-data/v2/security-monitoring/get-a-rule-proposal-returns-ok-response.json new file mode 100644 index 0000000000..9970e3c223 --- /dev/null +++ b/tests/generated-test/test-runner-data/v2/security-monitoring/get-a-rule-proposal-returns-ok-response.json @@ -0,0 +1,35 @@ +{ + "api": "SecurityMonitoring", + "expected_status": 200, + "feature": "Security Monitoring", + "id": "v2/Security Monitoring/Get a rule proposal returns \"OK\" response", + "operation_id": "GetSecurityMonitoringRuleProposal", + "request": { + "body": null, + "content_type": null, + "method": "GET", + "pagination": false, + "parameters": [ + { + "explode": null, + "in": "path", + "name": "proposal_id", + "required": true, + "schema": { + "format": "uuid", + "ref": null, + "type": "string" + }, + "source": { + "path": "rule_proposal.data.id", + "type": "fixture" + }, + "style": null + } + ], + "path": "/api/v2/security_monitoring/rules/proposals/{proposal_id}" + }, + "scenario": "Get a rule proposal returns \"OK\" response", + "schema_version": 1, + "version": "v2" +} diff --git a/tests/generated-test/test-runner-data/v2/security-monitoring/start-a-rule-proposal-returns-accepted-response.json b/tests/generated-test/test-runner-data/v2/security-monitoring/start-a-rule-proposal-returns-accepted-response.json new file mode 100644 index 0000000000..6dc5b33488 --- /dev/null +++ b/tests/generated-test/test-runner-data/v2/security-monitoring/start-a-rule-proposal-returns-accepted-response.json @@ -0,0 +1,34 @@ +{ + "api": "SecurityMonitoring", + "expected_status": 202, + "feature": "Security Monitoring", + "id": "v2/Security Monitoring/Start a rule proposal returns \"Accepted\" response", + "operation_id": "StartSecurityMonitoringRuleProposal", + "request": { + "body": { + "schema": { + "format": null, + "ref": "SecurityMonitoringRuleProposalStartRequest", + "type": "object" + }, + "source": "inline", + "value": { + "data": { + "attributes": { + "input": "Detect repeated failed Okta logins followed by a successful login from the same IP.", + "inputType": "natural_language" + }, + "type": "rule_proposals" + } + } + }, + "content_type": "application/json", + "method": "POST", + "pagination": false, + "parameters": [], + "path": "/api/v2/security_monitoring/rules/proposals" + }, + "scenario": "Start a rule proposal returns \"Accepted\" response", + "schema_version": 1, + "version": "v2" +} diff --git a/tests/generated-test/test-server-data/v2/security-monitoring.json b/tests/generated-test/test-server-data/v2/security-monitoring.json index a1d8f896f0..db5fdfa56f 100644 --- a/tests/generated-test/test-server-data/v2/security-monitoring.json +++ b/tests/generated-test/test-server-data/v2/security-monitoring.json @@ -7530,6 +7530,68 @@ "scenario": "Get a quick list of security signals returns \"OK\" response with pagination", "version": "v2" }, + { + "feature": "Security Monitoring", + "frozen_at": "2026-10-28T09:56:29.502Z", + "interactions": [ + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "attributes": { + "input": "Detect repeated failed Okta logins followed by a successful login from the same IP.", + "inputType": "natural_language" + }, + "type": "rule_proposals" + } + } + }, + "content_type": "application/json", + "method": "POST", + "path": "/api/v2/security_monitoring/rules/proposals", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":{\"id\":\"f4e95a96-51e3-4914-b68b-ef9a82044cb2\",\"type\":\"rule_proposals\",\"attributes\":{\"status\":\"pending\"}}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "Accepted", + "status": 202 + } + }, + { + "request": { + "body": { + "type": "empty", + "value": null + }, + "content_type": "", + "method": "GET", + "path": "/api/v2/security_monitoring/rules/proposals/f4e95a96-51e3-4914-b68b-ef9a82044cb2", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":{\"id\":\"f4e95a96-51e3-4914-b68b-ef9a82044cb2\",\"type\":\"rule_proposals\",\"attributes\":{\"status\":\"pending\"}}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "OK", + "status": 200 + } + } + ], + "scenario": "Get a rule proposal returns \"OK\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "frozen_at": "2024-05-10T16:34:43.147Z", @@ -13372,6 +13434,45 @@ "scenario": "Search security findings returns \"OK\" response with pagination", "version": "v2" }, + { + "feature": "Security Monitoring", + "frozen_at": "2026-10-28T09:56:32.110Z", + "interactions": [ + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "attributes": { + "input": "Detect repeated failed Okta logins followed by a successful login from the same IP.", + "inputType": "natural_language" + }, + "type": "rule_proposals" + } + } + }, + "content_type": "application/json", + "method": "POST", + "path": "/api/v2/security_monitoring/rules/proposals", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":{\"id\":\"05761b35-c9c1-4503-9071-dccb12cdf3fd\",\"type\":\"rule_proposals\",\"attributes\":{\"status\":\"pending\"}}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "Accepted", + "status": 202 + } + } + ], + "scenario": "Start a rule proposal returns \"Accepted\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "frozen_at": "2026-06-10T09:27:59.116Z", diff --git a/tests/v2/features/given.json b/tests/v2/features/given.json index 84ca5af22e..133777e08d 100644 --- a/tests/v2/features/given.json +++ b/tests/v2/features/given.json @@ -1815,6 +1815,18 @@ "tag": "Security Monitoring", "operationId": "CreateSecurityMonitoringRule" }, + { + "parameters": [ + { + "name": "body", + "value": "{\n \"data\": {\n \"type\": \"rule_proposals\",\n \"attributes\": {\n \"inputType\": \"natural_language\",\n \"input\": \"Detect repeated failed Okta logins followed by a successful login from the same IP.\"\n }\n }\n}" + } + ], + "step": "there is a valid \"rule_proposal\" in the system", + "key": "rule_proposal", + "tag": "Security Monitoring", + "operationId": "StartSecurityMonitoringRuleProposal" + }, { "parameters": [ { diff --git a/tests/v2/features/security_monitoring.feature b/tests/v2/features/security_monitoring.feature index 76da45be8a..97a3aab55c 100644 --- a/tests/v2/features/security_monitoring.feature +++ b/tests/v2/features/security_monitoring.feature @@ -2173,6 +2173,33 @@ Feature: Security Monitoring Then the response status is 200 OK And the response has 3 items + @generated @skip @team:ddoghq/cloud-siem + Scenario: Get a rule proposal returns "Bad Request" response + Given operation "GetSecurityMonitoringRuleProposal" enabled + And new "GetSecurityMonitoringRuleProposal" request + And request contains "proposal_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 400 Bad Request + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Get a rule proposal returns "Not Found" response + Given operation "GetSecurityMonitoringRuleProposal" enabled + And new "GetSecurityMonitoringRuleProposal" request + And request contains "proposal_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 404 Not Found + + @team:ddoghq/cloud-siem + Scenario: Get a rule proposal returns "OK" response + Given operation "GetSecurityMonitoringRuleProposal" enabled + And there is a valid "rule_proposal" in the system + And new "GetSecurityMonitoringRuleProposal" request + And request contains "proposal_id" parameter from "rule_proposal.data.id" + When the request is sent + Then the response status is 200 OK + And the response "data.id" has the same value as "rule_proposal.data.id" + And the response "data.type" is equal to "rule_proposals" + @team:ddoghq/cloud-siem Scenario: Get a rule's details returns "Not Found" response Given new "GetSecurityMonitoringRule" request @@ -3744,6 +3771,24 @@ Feature: Security Monitoring When the request is sent Then the response status is 404 Not Found + @team:ddoghq/cloud-siem + Scenario: Start a rule proposal returns "Accepted" response + Given operation "StartSecurityMonitoringRuleProposal" enabled + And new "StartSecurityMonitoringRuleProposal" request + And body with value {"data": {"type": "rule_proposals", "attributes": {"inputType": "natural_language", "input": "Detect repeated failed Okta logins followed by a successful login from the same IP."}}} + When the request is sent + Then the response status is 202 Accepted + And the response "data.type" is equal to "rule_proposals" + And the response "data.attributes.status" is equal to "pending" + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Start a rule proposal returns "Bad Request" response + Given operation "StartSecurityMonitoringRuleProposal" enabled + And new "StartSecurityMonitoringRuleProposal" request + And body with value {"data": {"attributes": {"input": "Detect repeated failed Okta logins followed by a successful login from the same IP.", "inputType": "natural_language"}, "type": "rule_proposals"}} + When the request is sent + Then the response status is 400 Bad Request + @generated @skip @team:ddoghq/cloud-siem Scenario: Subscribe to sample log generation returns "Bad Request" response Given operation "CreateSampleLogGenerationSubscription" enabled diff --git a/tests/v2/features/undo.json b/tests/v2/features/undo.json index 2b20834efc..6942b8c8a9 100644 --- a/tests/v2/features/undo.json +++ b/tests/v2/features/undo.json @@ -9603,6 +9603,18 @@ "type": "safe" } }, + "StartSecurityMonitoringRuleProposal": { + "tag": "Security Monitoring", + "undo": { + "type": "safe" + } + }, + "GetSecurityMonitoringRuleProposal": { + "tag": "Security Monitoring", + "undo": { + "type": "safe" + } + }, "TestSecurityMonitoringRule": { "tag": "Security Monitoring", "undo": {