Skip to content

Commit 6b7630c

Browse files
author
ci.datadog-api-spec
committed
Regenerate client from commit eb00cf1 of spec repo
1 parent c68aa36 commit 6b7630c

6 files changed

+138
-0
lines changed

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47194,6 +47194,8 @@ components:
4719447194
properties:
4719547195
forgetAfter:
4719647196
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter'
47197+
instantaneousBaseline:
47198+
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsInstantaneousBaseline'
4719747199
learningDuration:
4719847200
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration'
4719947201
learningMethod:
@@ -47219,6 +47221,15 @@ components:
4721947221
- TWO_WEEKS
4722047222
- THREE_WEEKS
4722147223
- FOUR_WEEKS
47224+
SecurityMonitoringRuleNewValueOptionsInstantaneousBaseline:
47225+
description: 'If true, every time Datadog learns a new group-by value, it takes
47226+
old matching values within the learning window and builds the baseline with
47227+
it.
47228+
47229+
Therefore, it attempts to build the baseline swiftly using existing values
47230+
instead of learning them over time.'
47231+
example: false
47232+
type: boolean
4722247233
SecurityMonitoringRuleNewValueOptionsLearningDuration:
4722347234
default: 0
4722447235
description: 'The duration in days during which values are learned, and after

‎examples/v2/security-monitoring/ValidateSecurityMonitoringRule_2609327779.py‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
"""
2+
Validate a detection rule with detection method 'new_value' with enabled feature 'instantaneousBaseline' returns "OK"
3+
response
4+
"""
5+
6+
from datadog_api_client import ApiClient, Configuration
7+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
8+
from datadog_api_client.v2.model.security_monitoring_rule_case_create import SecurityMonitoringRuleCaseCreate
9+
from datadog_api_client.v2.model.security_monitoring_rule_detection_method import SecurityMonitoringRuleDetectionMethod
10+
from datadog_api_client.v2.model.security_monitoring_rule_evaluation_window import (
11+
SecurityMonitoringRuleEvaluationWindow,
12+
)
13+
from datadog_api_client.v2.model.security_monitoring_rule_keep_alive import SecurityMonitoringRuleKeepAlive
14+
from datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration import (
15+
SecurityMonitoringRuleMaxSignalDuration,
16+
)
17+
from datadog_api_client.v2.model.security_monitoring_rule_new_value_options import SecurityMonitoringRuleNewValueOptions
18+
from datadog_api_client.v2.model.security_monitoring_rule_new_value_options_forget_after import (
19+
SecurityMonitoringRuleNewValueOptionsForgetAfter,
20+
)
21+
from datadog_api_client.v2.model.security_monitoring_rule_new_value_options_learning_duration import (
22+
SecurityMonitoringRuleNewValueOptionsLearningDuration,
23+
)
24+
from datadog_api_client.v2.model.security_monitoring_rule_new_value_options_learning_method import (
25+
SecurityMonitoringRuleNewValueOptionsLearningMethod,
26+
)
27+
from datadog_api_client.v2.model.security_monitoring_rule_new_value_options_learning_threshold import (
28+
SecurityMonitoringRuleNewValueOptionsLearningThreshold,
29+
)
30+
from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions
31+
from datadog_api_client.v2.model.security_monitoring_rule_query_aggregation import (
32+
SecurityMonitoringRuleQueryAggregation,
33+
)
34+
from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity
35+
from datadog_api_client.v2.model.security_monitoring_rule_type_create import SecurityMonitoringRuleTypeCreate
36+
from datadog_api_client.v2.model.security_monitoring_standard_data_source import SecurityMonitoringStandardDataSource
37+
from datadog_api_client.v2.model.security_monitoring_standard_rule_payload import SecurityMonitoringStandardRulePayload
38+
from datadog_api_client.v2.model.security_monitoring_standard_rule_query import SecurityMonitoringStandardRuleQuery
39+
40+
body = SecurityMonitoringStandardRulePayload(
41+
cases=[
42+
SecurityMonitoringRuleCaseCreate(
43+
name="",
44+
status=SecurityMonitoringRuleSeverity.INFO,
45+
notifications=[],
46+
),
47+
],
48+
has_extended_title=True,
49+
is_enabled=True,
50+
message="My security monitoring rule",
51+
name="My security monitoring rule",
52+
options=SecurityMonitoringRuleOptions(
53+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.ZERO_MINUTES,
54+
keep_alive=SecurityMonitoringRuleKeepAlive.FIVE_MINUTES,
55+
max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.TEN_MINUTES,
56+
detection_method=SecurityMonitoringRuleDetectionMethod.NEW_VALUE,
57+
new_value_options=SecurityMonitoringRuleNewValueOptions(
58+
forget_after=SecurityMonitoringRuleNewValueOptionsForgetAfter.ONE_WEEK,
59+
instantaneous_baseline=True,
60+
learning_duration=SecurityMonitoringRuleNewValueOptionsLearningDuration.ONE_DAY,
61+
learning_threshold=SecurityMonitoringRuleNewValueOptionsLearningThreshold.ZERO_OCCURRENCES,
62+
learning_method=SecurityMonitoringRuleNewValueOptionsLearningMethod.DURATION,
63+
),
64+
),
65+
queries=[
66+
SecurityMonitoringStandardRuleQuery(
67+
query="source:source_here",
68+
group_by_fields=[
69+
"@userIdentity.assumed_role",
70+
],
71+
distinct_fields=[],
72+
metric="name",
73+
metrics=[
74+
"name",
75+
],
76+
aggregation=SecurityMonitoringRuleQueryAggregation.NEW_VALUE,
77+
name="",
78+
data_source=SecurityMonitoringStandardDataSource.LOGS,
79+
),
80+
],
81+
tags=[
82+
"env:prod",
83+
"team:security",
84+
],
85+
type=SecurityMonitoringRuleTypeCreate.LOG_DETECTION,
86+
)
87+
88+
configuration = Configuration()
89+
with ApiClient(configuration) as api_client:
90+
api_instance = SecurityMonitoringApi(api_client)
91+
api_instance.validate_security_monitoring_rule(body=body)

‎src/datadog_api_client/v2/model/security_monitoring_rule_new_value_options.py‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,15 @@ def openapi_types(_):
4646

4747
return {
4848
"forget_after": (SecurityMonitoringRuleNewValueOptionsForgetAfter,),
49+
"instantaneous_baseline": (bool,),
4950
"learning_duration": (SecurityMonitoringRuleNewValueOptionsLearningDuration,),
5051
"learning_method": (SecurityMonitoringRuleNewValueOptionsLearningMethod,),
5152
"learning_threshold": (SecurityMonitoringRuleNewValueOptionsLearningThreshold,),
5253
}
5354

5455
attribute_map = {
5556
"forget_after": "forgetAfter",
57+
"instantaneous_baseline": "instantaneousBaseline",
5658
"learning_duration": "learningDuration",
5759
"learning_method": "learningMethod",
5860
"learning_threshold": "learningThreshold",
@@ -61,6 +63,7 @@ def openapi_types(_):
6163
def __init__(
6264
self_,
6365
forget_after: Union[SecurityMonitoringRuleNewValueOptionsForgetAfter, UnsetType] = unset,
66+
instantaneous_baseline: Union[bool, UnsetType] = unset,
6467
learning_duration: Union[SecurityMonitoringRuleNewValueOptionsLearningDuration, UnsetType] = unset,
6568
learning_method: Union[SecurityMonitoringRuleNewValueOptionsLearningMethod, UnsetType] = unset,
6669
learning_threshold: Union[SecurityMonitoringRuleNewValueOptionsLearningThreshold, UnsetType] = unset,
@@ -72,6 +75,10 @@ def __init__(
7275
:param forget_after: The duration in days after which a learned value is forgotten.
7376
:type forget_after: SecurityMonitoringRuleNewValueOptionsForgetAfter, optional
7477
78+
:param instantaneous_baseline: If true, every time Datadog learns a new group-by value, it takes old matching values within the learning window and builds the baseline with it.
79+
Therefore, it attempts to build the baseline swiftly using existing values instead of learning them over time.
80+
:type instantaneous_baseline: bool, optional
81+
7582
:param learning_duration: The duration in days during which values are learned, and after which signals will be generated for values that
7683
weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
7784
:type learning_duration: SecurityMonitoringRuleNewValueOptionsLearningDuration, optional
@@ -84,6 +91,8 @@ def __init__(
8491
"""
8592
if forget_after is not unset:
8693
kwargs["forget_after"] = forget_after
94+
if instantaneous_baseline is not unset:
95+
kwargs["instantaneous_baseline"] = instantaneous_baseline
8796
if learning_duration is not unset:
8897
kwargs["learning_duration"] = learning_duration
8998
if learning_method is not unset:

‎tests/v2/cassettes/test_scenarios/test_validate_a_detection_rule_with_detection_method_new_value_with_enabled_feature_instantaneousbaseline_returns_ok_response.frozen‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2025-12-10T08:37:17.537Z

‎tests/v2/cassettes/test_scenarios/test_validate_a_detection_rule_with_detection_method_new_value_with_enabled_feature_instantaneousbaseline_returns_ok_response.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
interactions:
2+
- request:
3+
body: '{"cases":[{"name":"","notifications":[],"status":"info"}],"hasExtendedTitle":true,"isEnabled":true,"message":"My
4+
security monitoring rule","name":"My security monitoring rule","options":{"detectionMethod":"new_value","evaluationWindow":0,"keepAlive":300,"maxSignalDuration":600,"newValueOptions":{"forgetAfter":7,"instantaneousBaseline":true,"learningDuration":1,"learningMethod":"duration","learningThreshold":0}},"queries":[{"aggregation":"new_value","dataSource":"logs","distinctFields":[],"groupByFields":["@userIdentity.assumed_role"],"metric":"name","metrics":["name"],"name":"","query":"source:source_here"}],"tags":["env:prod","team:security"],"type":"log_detection"}'
5+
headers:
6+
accept:
7+
- '*/*'
8+
content-type:
9+
- application/json
10+
method: POST
11+
uri: https://api.datadoghq.com/api/v2/security_monitoring/rules/validation
12+
response:
13+
body:
14+
string: ''
15+
headers: {}
16+
status:
17+
code: 204
18+
message: No Content
19+
version: 1

‎tests/v2/features/security_monitoring.feature‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1797,6 +1797,13 @@ Feature: Security Monitoring
17971797
When the request is sent
17981798
Then the response status is 204 OK
17991799

1800+
@team:DataDog/k9-cloud-security-platform
1801+
Scenario: Validate a detection rule with detection method 'new_value' with enabled feature 'instantaneousBaseline' returns "OK" response
1802+
Given new "ValidateSecurityMonitoringRule" request
1803+
And body with value {"cases":[{"name":"","status":"info","notifications":[]}],"hasExtendedTitle":true,"isEnabled":true,"message":"My security monitoring rule","name":"My security monitoring rule","options":{"evaluationWindow":0,"keepAlive":300,"maxSignalDuration":600,"detectionMethod":"new_value","newValueOptions":{"forgetAfter":7,"instantaneousBaseline":true,"learningDuration":1,"learningThreshold":0,"learningMethod":"duration"}},"queries":[{"query":"source:source_here","groupByFields":["@userIdentity.assumed_role"],"distinctFields":[],"metric":"name","metrics":["name"],"aggregation":"new_value","name":"","dataSource":"logs"}],"tags":["env:prod","team:security"],"type":"log_detection"}
1804+
When the request is sent
1805+
Then the response status is 204 OK
1806+
18001807
@team:DataDog/k9-cloud-security-platform
18011808
Scenario: Validate a detection rule with detection method 'sequence_detection' returns "OK" response
18021809
Given new "ValidateSecurityMonitoringRule" request

0 commit comments

Comments
 (0)