Add Cloud SIEM rule proposal endpoints as unstable

examples/v2/security-monitoring/GetSecurityMonitoringRuleProposal.rb

@@ -0,0 +1,12 @@
+# Get a rule proposal returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.access_token = ENV["DD_BEARER_TOKEN"]
+  config.unstable_operations["v2.get_security_monitoring_rule_proposal".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+# there is a valid "rule_proposal" in the system
+RULE_PROPOSAL_DATA_ID = ENV["RULE_PROPOSAL_DATA_ID"]
+p api_instance.get_security_monitoring_rule_proposal(RULE_PROPOSAL_DATA_ID)

examples/v2/security-monitoring/StartSecurityMonitoringRuleProposal.rb

@@ -0,0 +1,19 @@
+# Start a rule proposal returns "Accepted" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.access_token = ENV["DD_BEARER_TOKEN"]
+  config.unstable_operations["v2.start_security_monitoring_rule_proposal".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+body = DatadogAPIClient::V2::SecurityMonitoringRuleProposalStartRequest.new({
+  data: DatadogAPIClient::V2::SecurityMonitoringRuleProposalStartRequestData.new({
+    type: DatadogAPIClient::V2::SecurityMonitoringRuleProposalType::RULE_PROPOSALS,
+    attributes: DatadogAPIClient::V2::SecurityMonitoringRuleProposalStartRequestAttributes.new({
+      input_type: DatadogAPIClient::V2::SecurityMonitoringRuleProposalInputType::NATURAL_LANGUAGE,
+      input: "Detect repeated failed Okta logins followed by a successful login from the same IP.",
+    }),
+  }),
+})
+p api_instance.start_security_monitoring_rule_proposal(body)

features/scenarios_model_mapping.rb

@@ -2693,6 +2693,12 @@
     "v2.BulkConvertExistingSecurityMonitoringRules" => {
             "body" => "SecurityMonitoringRuleConvertBulkPayload",
     },
+    "v2.StartSecurityMonitoringRuleProposal" => {
+            "body" => "SecurityMonitoringRuleProposalStartRequest",
+    },
+    "v2.GetSecurityMonitoringRuleProposal" => {
+            "proposal_id" => "UUID",
+    },
     "v2.TestSecurityMonitoringRule" => {
             "body" => "SecurityMonitoringRuleTestRequest",
     },

features/v2/given.json

@@ -1815,6 +1815,18 @@
     "tag": "Security Monitoring",
     "operationId": "CreateSecurityMonitoringRule"
   },
+  {
+    "parameters": [
+      {
+        "name": "body",
+        "value": "{\n  \"data\": {\n    \"type\": \"rule_proposals\",\n    \"attributes\": {\n      \"inputType\": \"natural_language\",\n      \"input\": \"Detect repeated failed Okta logins followed by a successful login from the same IP.\"\n    }\n  }\n}"
+      }
+    ],
+    "step": "there is a valid \"rule_proposal\" in the system",
+    "key": "rule_proposal",
+    "tag": "Security Monitoring",
+    "operationId": "StartSecurityMonitoringRuleProposal"
+  },
   {
     "parameters": [
       {

features/v2/security_monitoring.feature

@@ -2173,6 +2173,33 @@ Feature: Security Monitoring
     Then the response status is 200 OK
     And the response has 3 items
 
+  @generated @skip @team:ddoghq/cloud-siem
+  Scenario: Get a rule proposal returns "Bad Request" response
+    Given operation "GetSecurityMonitoringRuleProposal" enabled
+    And new "GetSecurityMonitoringRuleProposal" request
+    And request contains "proposal_id" parameter from "REPLACE.ME"
+    When the request is sent
+    Then the response status is 400 Bad Request
+
+  @generated @skip @team:ddoghq/cloud-siem
+  Scenario: Get a rule proposal returns "Not Found" response
+    Given operation "GetSecurityMonitoringRuleProposal" enabled
+    And new "GetSecurityMonitoringRuleProposal" request
+    And request contains "proposal_id" parameter from "REPLACE.ME"
+    When the request is sent
+    Then the response status is 404 Not Found
+
+  @team:ddoghq/cloud-siem
+  Scenario: Get a rule proposal returns "OK" response
+    Given operation "GetSecurityMonitoringRuleProposal" enabled
+    And there is a valid "rule_proposal" in the system
+    And new "GetSecurityMonitoringRuleProposal" request
+    And request contains "proposal_id" parameter from "rule_proposal.data.id"
+    When the request is sent
+    Then the response status is 200 OK
+    And the response "data.id" has the same value as "rule_proposal.data.id"
+    And the response "data.type" is equal to "rule_proposals"
+
   @team:ddoghq/cloud-siem
   Scenario: Get a rule's details returns "Not Found" response
     Given new "GetSecurityMonitoringRule" request
@@ -3744,6 +3771,24 @@ Feature: Security Monitoring
     When the request is sent
     Then the response status is 404 Not Found
 
+  @team:ddoghq/cloud-siem
+  Scenario: Start a rule proposal returns "Accepted" response
+    Given operation "StartSecurityMonitoringRuleProposal" enabled
+    And new "StartSecurityMonitoringRuleProposal" request
+    And body with value {"data": {"type": "rule_proposals", "attributes": {"inputType": "natural_language", "input": "Detect repeated failed Okta logins followed by a successful login from the same IP."}}}
+    When the request is sent
+    Then the response status is 202 Accepted
+    And the response "data.type" is equal to "rule_proposals"
+    And the response "data.attributes.status" is equal to "pending"
+
+  @generated @skip @team:ddoghq/cloud-siem
+  Scenario: Start a rule proposal returns "Bad Request" response
+    Given operation "StartSecurityMonitoringRuleProposal" enabled
+    And new "StartSecurityMonitoringRuleProposal" request
+    And body with value {"data": {"attributes": {"input": "Detect repeated failed Okta logins followed by a successful login from the same IP.", "inputType": "natural_language"}, "type": "rule_proposals"}}
+    When the request is sent
+    Then the response status is 400 Bad Request
+
   @generated @skip @team:ddoghq/cloud-siem
   Scenario: Subscribe to sample log generation returns "Bad Request" response
     Given operation "CreateSampleLogGenerationSubscription" enabled

features/v2/undo.json

@@ -9603,6 +9603,18 @@
       "type": "safe"
     }
   },
+  "StartSecurityMonitoringRuleProposal": {
+    "tag": "Security Monitoring",
+    "undo": {
+      "type": "safe"
+    }
+  },
+  "GetSecurityMonitoringRuleProposal": {
+    "tag": "Security Monitoring",
+    "undo": {
+      "type": "safe"
+    }
+  },
   "TestSecurityMonitoringRule": {
     "tag": "Security Monitoring",
     "undo": {

generated-test/test-runner-data/manifest.json

@@ -10794,6 +10794,13 @@
       "scenario": "Get a quick list of security signals returns \"OK\" response with pagination",
       "version": "v2"
     },
+    {
+      "feature": "Security Monitoring",
+      "feature_file": "../../features/v2/security_monitoring.feature",
+      "file": "v2/security-monitoring/get-a-rule-proposal-returns-ok-response.json",
+      "scenario": "Get a rule proposal returns \"OK\" response",
+      "version": "v2"
+    },
     {
       "feature": "Security Monitoring",
       "feature_file": "../../features/v2/security_monitoring.feature",
@@ -11368,6 +11375,13 @@
       "scenario": "Search security findings returns \"OK\" response with pagination",
       "version": "v2"
     },
+    {
+      "feature": "Security Monitoring",
+      "feature_file": "../../features/v2/security_monitoring.feature",
+      "file": "v2/security-monitoring/start-a-rule-proposal-returns-accepted-response.json",
+      "scenario": "Start a rule proposal returns \"Accepted\" response",
+      "version": "v2"
+    },
     {
       "feature": "Security Monitoring",
       "feature_file": "../../features/v2/security_monitoring.feature",

generated-test/test-runner-data/v2/security-monitoring/get-a-rule-proposal-returns-ok-response.json

@@ -0,0 +1,35 @@
+{
+  "api": "SecurityMonitoring",
+  "expected_status": 200,
+  "feature": "Security Monitoring",
+  "id": "v2/Security Monitoring/Get a rule proposal returns \"OK\" response",
+  "operation_id": "GetSecurityMonitoringRuleProposal",
+  "request": {
+    "body": null,
+    "content_type": null,
+    "method": "GET",
+    "pagination": false,
+    "parameters": [
+      {
+        "explode": null,
+        "in": "path",
+        "name": "proposal_id",
+        "required": true,
+        "schema": {
+          "format": "uuid",
+          "ref": null,
+          "type": "string"
+        },
+        "source": {
+          "path": "rule_proposal.data.id",
+          "type": "fixture"
+        },
+        "style": null
+      }
+    ],
+    "path": "/api/v2/security_monitoring/rules/proposals/{proposal_id}"
+  },
+  "scenario": "Get a rule proposal returns \"OK\" response",
+  "schema_version": 1,
+  "version": "v2"
+}

generated-test/test-runner-data/v2/security-monitoring/start-a-rule-proposal-returns-accepted-response.json

@@ -0,0 +1,34 @@
+{
+  "api": "SecurityMonitoring",
+  "expected_status": 202,
+  "feature": "Security Monitoring",
+  "id": "v2/Security Monitoring/Start a rule proposal returns \"Accepted\" response",
+  "operation_id": "StartSecurityMonitoringRuleProposal",
+  "request": {
+    "body": {
+      "schema": {
+        "format": null,
+        "ref": "SecurityMonitoringRuleProposalStartRequest",
+        "type": "object"
+      },
+      "source": "inline",
+      "value": {
+        "data": {
+          "attributes": {
+            "input": "Detect repeated failed Okta logins followed by a successful login from the same IP.",
+            "inputType": "natural_language"
+          },
+          "type": "rule_proposals"
+        }
+      }
+    },
+    "content_type": "application/json",
+    "method": "POST",
+    "pagination": false,
+    "parameters": [],
+    "path": "/api/v2/security_monitoring/rules/proposals"
+  },
+  "scenario": "Start a rule proposal returns \"Accepted\" response",
+  "schema_version": 1,
+  "version": "v2"
+}

generated-test/test-server-data/v2/security-monitoring.json

@@ -7530,6 +7530,68 @@
       "scenario": "Get a quick list of security signals returns \"OK\" response with pagination",
       "version": "v2"
     },
+    {
+      "feature": "Security Monitoring",
+      "frozen_at": "2026-10-28T09:56:29.502Z",
+      "interactions": [
+        {
+          "request": {
+            "body": {
+              "type": "json",
+              "value": {
+                "data": {
+                  "attributes": {
+                    "input": "Detect repeated failed Okta logins followed by a successful login from the same IP.",
+                    "inputType": "natural_language"
+                  },
+                  "type": "rule_proposals"
+                }
+              }
+            },
+            "content_type": "application/json",
+            "method": "POST",
+            "path": "/api/v2/security_monitoring/rules/proposals",
+            "query": []
+          },
+          "response": {
+            "body": {
+              "encoding": "text",
+              "value": "{\"data\":{\"id\":\"f4e95a96-51e3-4914-b68b-ef9a82044cb2\",\"type\":\"rule_proposals\",\"attributes\":{\"status\":\"pending\"}}}"
+            },
+            "headers": {
+              "content-type": "application/vnd.api+json"
+            },
+            "reason": "Accepted",
+            "status": 202
+          }
+        },
+        {
+          "request": {
+            "body": {
+              "type": "empty",
+              "value": null
+            },
+            "content_type": "",
+            "method": "GET",
+            "path": "/api/v2/security_monitoring/rules/proposals/f4e95a96-51e3-4914-b68b-ef9a82044cb2",
+            "query": []
+          },
+          "response": {
+            "body": {
+              "encoding": "text",
+              "value": "{\"data\":{\"id\":\"f4e95a96-51e3-4914-b68b-ef9a82044cb2\",\"type\":\"rule_proposals\",\"attributes\":{\"status\":\"pending\"}}}"
+            },
+            "headers": {
+              "content-type": "application/vnd.api+json"
+            },
+            "reason": "OK",
+            "status": 200
+          }
+        }
+      ],
+      "scenario": "Get a rule proposal returns \"OK\" response",
+      "version": "v2"
+    },
     {
       "feature": "Security Monitoring",
       "frozen_at": "2024-05-10T16:34:43.147Z",
@@ -13372,6 +13434,45 @@
       "scenario": "Search security findings returns \"OK\" response with pagination",
       "version": "v2"
     },
+    {
+      "feature": "Security Monitoring",
+      "frozen_at": "2026-10-28T09:56:32.110Z",
+      "interactions": [
+        {
+          "request": {
+            "body": {
+              "type": "json",
+              "value": {
+                "data": {
+                  "attributes": {
+                    "input": "Detect repeated failed Okta logins followed by a successful login from the same IP.",
+                    "inputType": "natural_language"
+                  },
+                  "type": "rule_proposals"
+                }
+              }
+            },
+            "content_type": "application/json",
+            "method": "POST",
+            "path": "/api/v2/security_monitoring/rules/proposals",
+            "query": []
+          },
+          "response": {
+            "body": {
+              "encoding": "text",
+              "value": "{\"data\":{\"id\":\"05761b35-c9c1-4503-9071-dccb12cdf3fd\",\"type\":\"rule_proposals\",\"attributes\":{\"status\":\"pending\"}}}"
+            },
+            "headers": {
+              "content-type": "application/vnd.api+json"
+            },
+            "reason": "Accepted",
+            "status": 202
+          }
+        }
+      ],
+      "scenario": "Start a rule proposal returns \"Accepted\" response",
+      "version": "v2"
+    },
     {
       "feature": "Security Monitoring",
       "frozen_at": "2026-06-10T09:27:59.116Z",

lib/datadog_api_client/configuration.rb

@@ -372,6 +372,7 @@ def initialize
             "v2.get_security_monitoring_histsignal": false,
             "v2.get_security_monitoring_histsignals_by_job_id": false,
             "v2.get_security_monitoring_integration_config": false,
+            "v2.get_security_monitoring_rule_proposal": false,
             "v2.get_signal_entities": false,
             "v2.get_single_entity_context": false,
             "v2.get_static_analysis_default_rulesets": false,
@@ -409,6 +410,7 @@ def initialize
             "v2.run_historical_job": false,
             "v2.search_security_monitoring_histsignals": false,
             "v2.start_security_monitoring_batch_migration": false,
+            "v2.start_security_monitoring_rule_proposal": false,
             "v2.update_findings_assignee": false,
             "v2.update_findings_severity": false,
             "v2.update_security_findings_automation_due_date_rule": false,

lib/datadog_api_client/inflector.rb

@@ -8094,6 +8094,18 @@ def overrides
           "v2.security_monitoring_rule_new_value_options_learning_method" => "SecurityMonitoringRuleNewValueOptionsLearningMethod",
           "v2.security_monitoring_rule_new_value_options_learning_threshold" => "SecurityMonitoringRuleNewValueOptionsLearningThreshold",
           "v2.security_monitoring_rule_options" => "SecurityMonitoringRuleOptions",
+          "v2.security_monitoring_rule_proposal_error" => "SecurityMonitoringRuleProposalError",
+          "v2.security_monitoring_rule_proposal_input_type" => "SecurityMonitoringRuleProposalInputType",
+          "v2.security_monitoring_rule_proposal_response" => "SecurityMonitoringRuleProposalResponse",
+          "v2.security_monitoring_rule_proposal_response_attributes" => "SecurityMonitoringRuleProposalResponseAttributes",
+          "v2.security_monitoring_rule_proposal_response_data" => "SecurityMonitoringRuleProposalResponseData",
+          "v2.security_monitoring_rule_proposal_start_request" => "SecurityMonitoringRuleProposalStartRequest",
+          "v2.security_monitoring_rule_proposal_start_request_attributes" => "SecurityMonitoringRuleProposalStartRequestAttributes",
+          "v2.security_monitoring_rule_proposal_start_request_data" => "SecurityMonitoringRuleProposalStartRequestData",
+          "v2.security_monitoring_rule_proposal_start_response" => "SecurityMonitoringRuleProposalStartResponse",
+          "v2.security_monitoring_rule_proposal_start_response_attributes" => "SecurityMonitoringRuleProposalStartResponseAttributes",
+          "v2.security_monitoring_rule_proposal_start_response_data" => "SecurityMonitoringRuleProposalStartResponseData",
+          "v2.security_monitoring_rule_proposal_type" => "SecurityMonitoringRuleProposalType",
           "v2.security_monitoring_rule_query" => "SecurityMonitoringRuleQuery",
           "v2.security_monitoring_rule_query_aggregation" => "SecurityMonitoringRuleQueryAggregation",
           "v2.security_monitoring_rule_query_payload" => "SecurityMonitoringRuleQueryPayload",