Skip to content

Commit 7d5725f

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Add sequence detection to security monitoring rules (#3132)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent 7289544 commit 7d5725f

14 files changed

+1025
-1
lines changed

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20470,6 +20470,8 @@ components:
2047020470
$ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
2047120471
newValueOptions:
2047220472
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
20473+
sequenceDetectionOptions:
20474+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions'
2047320475
thirdPartyRuleOptions:
2047420476
$ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
2047520477
type: object
@@ -40786,6 +40788,7 @@ components:
4078640788
- hardcoded
4078740789
- third_party
4078840790
- anomaly_threshold
40791+
- sequence_detection
4078940792
type: string
4079040793
x-enum-varnames:
4079140794
- THRESHOLD
@@ -40795,6 +40798,7 @@ components:
4079540798
- HARDCODED
4079640799
- THIRD_PARTY
4079740800
- ANOMALY_THRESHOLD
40801+
- SEQUENCE_DETECTION
4079840802
SecurityMonitoringRuleEvaluationWindow:
4079940803
description: 'A time window is specified to match when at least one of the cases
4080040804
matches true. This is a sliding window
@@ -41008,6 +41012,8 @@ components:
4100841012
$ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
4100941013
newValueOptions:
4101041014
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
41015+
sequenceDetectionOptions:
41016+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions'
4101141017
thirdPartyRuleOptions:
4101241018
$ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
4101341019
type: object
@@ -41083,6 +41089,47 @@ components:
4108341089
oneOf:
4108441090
- $ref: '#/components/schemas/SecurityMonitoringStandardRuleResponse'
4108541091
- $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponse'
41092+
SecurityMonitoringRuleSequenceDetectionOptions:
41093+
description: Options on sequence detection method.
41094+
properties:
41095+
stepTransitions:
41096+
description: Transitions defining the allowed order of steps and their evaluation
41097+
windows.
41098+
items:
41099+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionStepTransition'
41100+
type: array
41101+
steps:
41102+
description: Steps that define the conditions to be matched in sequence.
41103+
items:
41104+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionStep'
41105+
type: array
41106+
type: object
41107+
SecurityMonitoringRuleSequenceDetectionStep:
41108+
description: Step definition for sequence detection containing the step name,
41109+
condition, and evaluation window.
41110+
properties:
41111+
condition:
41112+
description: Condition referencing rule queries (e.g., `a > 0`).
41113+
type: string
41114+
evaluationWindow:
41115+
$ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
41116+
name:
41117+
description: Unique name identifying the step.
41118+
type: string
41119+
type: object
41120+
SecurityMonitoringRuleSequenceDetectionStepTransition:
41121+
description: Transition from a parent step to a child step within a sequence
41122+
detection rule.
41123+
properties:
41124+
child:
41125+
description: Name of the child step.
41126+
type: string
41127+
evaluationWindow:
41128+
$ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
41129+
parent:
41130+
description: Name of the parent step.
41131+
type: string
41132+
type: object
4108641133
SecurityMonitoringRuleSeverity:
4108741134
description: Severity of the Security Signal.
4108841135
enum:

‎examples/v2/security-monitoring/CreateSecurityMonitoringRule_2899714190.java‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
// Create a detection rule with detection method 'sequence_detection' returns "OK" response
2+
3+
import com.datadog.api.client.ApiClient;
4+
import com.datadog.api.client.ApiException;
5+
import com.datadog.api.client.v2.api.SecurityMonitoringApi;
6+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleCaseCreate;
7+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleCreatePayload;
8+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleDetectionMethod;
9+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleEvaluationWindow;
10+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleKeepAlive;
11+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleMaxSignalDuration;
12+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleOptions;
13+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleQueryAggregation;
14+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleResponse;
15+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleSequenceDetectionOptions;
16+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleSequenceDetectionStep;
17+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleSequenceDetectionStepTransition;
18+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleSeverity;
19+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleTypeCreate;
20+
import com.datadog.api.client.v2.model.SecurityMonitoringStandardDataSource;
21+
import com.datadog.api.client.v2.model.SecurityMonitoringStandardRuleCreatePayload;
22+
import com.datadog.api.client.v2.model.SecurityMonitoringStandardRuleQuery;
23+
import java.util.Arrays;
24+
import java.util.Collections;
25+
26+
public class Example {
27+
public static void main(String[] args) {
28+
ApiClient defaultClient = ApiClient.getDefaultApiClient();
29+
SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient);
30+
31+
SecurityMonitoringRuleCreatePayload body =
32+
new SecurityMonitoringRuleCreatePayload(
33+
new SecurityMonitoringStandardRuleCreatePayload()
34+
.name("Example-Security-Monitoring")
35+
.type(SecurityMonitoringRuleTypeCreate.LOG_DETECTION)
36+
.isEnabled(true)
37+
.queries(
38+
Arrays.asList(
39+
new SecurityMonitoringStandardRuleQuery()
40+
.aggregation(SecurityMonitoringRuleQueryAggregation.COUNT)
41+
.dataSource(SecurityMonitoringStandardDataSource.LOGS)
42+
.hasOptionalGroupByFields(false)
43+
.name("")
44+
.query("service:logs-rule-reducer source:paul test2"),
45+
new SecurityMonitoringStandardRuleQuery()
46+
.aggregation(SecurityMonitoringRuleQueryAggregation.COUNT)
47+
.dataSource(SecurityMonitoringStandardDataSource.LOGS)
48+
.hasOptionalGroupByFields(false)
49+
.name("")
50+
.query("service:logs-rule-reducer source:paul test1")))
51+
.cases(
52+
Collections.singletonList(
53+
new SecurityMonitoringRuleCaseCreate()
54+
.name("")
55+
.status(SecurityMonitoringRuleSeverity.INFO)
56+
.condition("step_b > 0")))
57+
.message("Logs and signals asdf")
58+
.options(
59+
new SecurityMonitoringRuleOptions()
60+
.detectionMethod(SecurityMonitoringRuleDetectionMethod.SEQUENCE_DETECTION)
61+
.evaluationWindow(SecurityMonitoringRuleEvaluationWindow.ZERO_MINUTES)
62+
.keepAlive(SecurityMonitoringRuleKeepAlive.FIVE_MINUTES)
63+
.maxSignalDuration(SecurityMonitoringRuleMaxSignalDuration.TEN_MINUTES)
64+
.sequenceDetectionOptions(
65+
new SecurityMonitoringRuleSequenceDetectionOptions()
66+
.stepTransitions(
67+
Collections.singletonList(
68+
new SecurityMonitoringRuleSequenceDetectionStepTransition()
69+
.child("step_b")
70+
.evaluationWindow(
71+
SecurityMonitoringRuleEvaluationWindow
72+
.FIFTEEN_MINUTES)
73+
.parent("step_a")))
74+
.steps(
75+
Arrays.asList(
76+
new SecurityMonitoringRuleSequenceDetectionStep()
77+
.condition("a > 0")
78+
.evaluationWindow(
79+
SecurityMonitoringRuleEvaluationWindow.ONE_MINUTE)
80+
.name("step_a"),
81+
new SecurityMonitoringRuleSequenceDetectionStep()
82+
.condition("b > 0")
83+
.evaluationWindow(
84+
SecurityMonitoringRuleEvaluationWindow.ONE_MINUTE)
85+
.name("step_b"))))));
86+
87+
try {
88+
SecurityMonitoringRuleResponse result = apiInstance.createSecurityMonitoringRule(body);
89+
System.out.println(result);
90+
} catch (ApiException e) {
91+
System.err.println(
92+
"Exception when calling SecurityMonitoringApi#createSecurityMonitoringRule");
93+
System.err.println("Status code: " + e.getCode());
94+
System.err.println("Reason: " + e.getResponseBody());
95+
System.err.println("Response headers: " + e.getResponseHeaders());
96+
e.printStackTrace();
97+
}
98+
}
99+
}

‎examples/v2/security-monitoring/ValidateSecurityMonitoringRule_4152369508.java‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
// Validate a detection rule with detection method 'sequence_detection' returns "OK" response
2+
3+
import com.datadog.api.client.ApiClient;
4+
import com.datadog.api.client.ApiException;
5+
import com.datadog.api.client.v2.api.SecurityMonitoringApi;
6+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleCaseCreate;
7+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleDetectionMethod;
8+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleEvaluationWindow;
9+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleKeepAlive;
10+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleMaxSignalDuration;
11+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleOptions;
12+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleQueryAggregation;
13+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleSequenceDetectionOptions;
14+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleSequenceDetectionStep;
15+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleSequenceDetectionStepTransition;
16+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleSeverity;
17+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleTypeCreate;
18+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleValidatePayload;
19+
import com.datadog.api.client.v2.model.SecurityMonitoringStandardRulePayload;
20+
import com.datadog.api.client.v2.model.SecurityMonitoringStandardRuleQuery;
21+
import java.util.Arrays;
22+
import java.util.Collections;
23+
24+
public class Example {
25+
public static void main(String[] args) {
26+
ApiClient defaultClient = ApiClient.getDefaultApiClient();
27+
SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient);
28+
29+
SecurityMonitoringRuleValidatePayload body =
30+
new SecurityMonitoringRuleValidatePayload(
31+
new SecurityMonitoringStandardRulePayload()
32+
.cases(
33+
Collections.singletonList(
34+
new SecurityMonitoringRuleCaseCreate()
35+
.name("")
36+
.status(SecurityMonitoringRuleSeverity.INFO)
37+
.condition("step_b > 0")))
38+
.hasExtendedTitle(true)
39+
.isEnabled(true)
40+
.message("My security monitoring rule")
41+
.name("My security monitoring rule")
42+
.options(
43+
new SecurityMonitoringRuleOptions()
44+
.evaluationWindow(SecurityMonitoringRuleEvaluationWindow.ZERO_MINUTES)
45+
.keepAlive(SecurityMonitoringRuleKeepAlive.FIVE_MINUTES)
46+
.maxSignalDuration(SecurityMonitoringRuleMaxSignalDuration.TEN_MINUTES)
47+
.detectionMethod(SecurityMonitoringRuleDetectionMethod.SEQUENCE_DETECTION)
48+
.sequenceDetectionOptions(
49+
new SecurityMonitoringRuleSequenceDetectionOptions()
50+
.stepTransitions(
51+
Collections.singletonList(
52+
new SecurityMonitoringRuleSequenceDetectionStepTransition()
53+
.child("step_b")
54+
.evaluationWindow(
55+
SecurityMonitoringRuleEvaluationWindow
56+
.FIFTEEN_MINUTES)
57+
.parent("step_a")))
58+
.steps(
59+
Arrays.asList(
60+
new SecurityMonitoringRuleSequenceDetectionStep()
61+
.condition("a > 0")
62+
.evaluationWindow(
63+
SecurityMonitoringRuleEvaluationWindow.ONE_MINUTE)
64+
.name("step_a"),
65+
new SecurityMonitoringRuleSequenceDetectionStep()
66+
.condition("b > 0")
67+
.evaluationWindow(
68+
SecurityMonitoringRuleEvaluationWindow.ONE_MINUTE)
69+
.name("step_b")))))
70+
.queries(
71+
Arrays.asList(
72+
new SecurityMonitoringStandardRuleQuery()
73+
.query("source:source_here")
74+
.groupByFields(Collections.singletonList("@userIdentity.assumed_role"))
75+
.aggregation(SecurityMonitoringRuleQueryAggregation.COUNT)
76+
.name(""),
77+
new SecurityMonitoringStandardRuleQuery()
78+
.query("source:source_here2")
79+
.aggregation(SecurityMonitoringRuleQueryAggregation.COUNT)
80+
.name("")))
81+
.tags(Arrays.asList("env:prod", "team:security"))
82+
.type(SecurityMonitoringRuleTypeCreate.LOG_DETECTION));
83+
84+
try {
85+
apiInstance.validateSecurityMonitoringRule(body);
86+
} catch (ApiException e) {
87+
System.err.println(
88+
"Exception when calling SecurityMonitoringApi#validateSecurityMonitoringRule");
89+
System.err.println("Status code: " + e.getCode());
90+
System.err.println("Reason: " + e.getResponseBody());
91+
System.err.println("Response headers: " + e.getResponseHeaders());
92+
e.printStackTrace();
93+
}
94+
}
95+
}

‎src/main/java/com/datadog/api/client/v2/model/HistoricalJobOptions.java‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
HistoricalJobOptions.JSON_PROPERTY_KEEP_ALIVE,
2525
HistoricalJobOptions.JSON_PROPERTY_MAX_SIGNAL_DURATION,
2626
HistoricalJobOptions.JSON_PROPERTY_NEW_VALUE_OPTIONS,
27+
HistoricalJobOptions.JSON_PROPERTY_SEQUENCE_DETECTION_OPTIONS,
2728
HistoricalJobOptions.JSON_PROPERTY_THIRD_PARTY_RULE_OPTIONS
2829
})
2930
@jakarta.annotation.Generated(
@@ -48,6 +49,9 @@ public class HistoricalJobOptions {
4849
public static final String JSON_PROPERTY_NEW_VALUE_OPTIONS = "newValueOptions";
4950
private SecurityMonitoringRuleNewValueOptions newValueOptions;
5051

52+
public static final String JSON_PROPERTY_SEQUENCE_DETECTION_OPTIONS = "sequenceDetectionOptions";
53+
private SecurityMonitoringRuleSequenceDetectionOptions sequenceDetectionOptions;
54+
5155
public static final String JSON_PROPERTY_THIRD_PARTY_RULE_OPTIONS = "thirdPartyRuleOptions";
5256
private SecurityMonitoringRuleThirdPartyOptions thirdPartyRuleOptions;
5357

@@ -205,6 +209,30 @@ public void setNewValueOptions(SecurityMonitoringRuleNewValueOptions newValueOpt
205209
this.newValueOptions = newValueOptions;
206210
}
207211

212+
public HistoricalJobOptions sequenceDetectionOptions(
213+
SecurityMonitoringRuleSequenceDetectionOptions sequenceDetectionOptions) {
214+
this.sequenceDetectionOptions = sequenceDetectionOptions;
215+
this.unparsed |= sequenceDetectionOptions.unparsed;
216+
return this;
217+
}
218+
219+
/**
220+
* Options on sequence detection method.
221+
*
222+
* @return sequenceDetectionOptions
223+
*/
224+
@jakarta.annotation.Nullable
225+
@JsonProperty(JSON_PROPERTY_SEQUENCE_DETECTION_OPTIONS)
226+
@JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
227+
public SecurityMonitoringRuleSequenceDetectionOptions getSequenceDetectionOptions() {
228+
return sequenceDetectionOptions;
229+
}
230+
231+
public void setSequenceDetectionOptions(
232+
SecurityMonitoringRuleSequenceDetectionOptions sequenceDetectionOptions) {
233+
this.sequenceDetectionOptions = sequenceDetectionOptions;
234+
}
235+
208236
public HistoricalJobOptions thirdPartyRuleOptions(
209237
SecurityMonitoringRuleThirdPartyOptions thirdPartyRuleOptions) {
210238
this.thirdPartyRuleOptions = thirdPartyRuleOptions;
@@ -292,6 +320,8 @@ public boolean equals(Object o) {
292320
&& Objects.equals(this.keepAlive, historicalJobOptions.keepAlive)
293321
&& Objects.equals(this.maxSignalDuration, historicalJobOptions.maxSignalDuration)
294322
&& Objects.equals(this.newValueOptions, historicalJobOptions.newValueOptions)
323+
&& Objects.equals(
324+
this.sequenceDetectionOptions, historicalJobOptions.sequenceDetectionOptions)
295325
&& Objects.equals(this.thirdPartyRuleOptions, historicalJobOptions.thirdPartyRuleOptions)
296326
&& Objects.equals(this.additionalProperties, historicalJobOptions.additionalProperties);
297327
}
@@ -305,6 +335,7 @@ public int hashCode() {
305335
keepAlive,
306336
maxSignalDuration,
307337
newValueOptions,
338+
sequenceDetectionOptions,
308339
thirdPartyRuleOptions,
309340
additionalProperties);
310341
}
@@ -321,6 +352,9 @@ public String toString() {
321352
sb.append(" keepAlive: ").append(toIndentedString(keepAlive)).append("\n");
322353
sb.append(" maxSignalDuration: ").append(toIndentedString(maxSignalDuration)).append("\n");
323354
sb.append(" newValueOptions: ").append(toIndentedString(newValueOptions)).append("\n");
355+
sb.append(" sequenceDetectionOptions: ")
356+
.append(toIndentedString(sequenceDetectionOptions))
357+
.append("\n");
324358
sb.append(" thirdPartyRuleOptions: ")
325359
.append(toIndentedString(thirdPartyRuleOptions))
326360
.append("\n");

‎src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleDetectionMethod.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,8 @@ public class SecurityMonitoringRuleDetectionMethod extends ModelEnum<String> {
3333
"impossible_travel",
3434
"hardcoded",
3535
"third_party",
36-
"anomaly_threshold"));
36+
"anomaly_threshold",
37+
"sequence_detection"));
3738

3839
public static final SecurityMonitoringRuleDetectionMethod THRESHOLD =
3940
new SecurityMonitoringRuleDetectionMethod("threshold");
@@ -49,6 +50,8 @@ public class SecurityMonitoringRuleDetectionMethod extends ModelEnum<String> {
4950
new SecurityMonitoringRuleDetectionMethod("third_party");
5051
public static final SecurityMonitoringRuleDetectionMethod ANOMALY_THRESHOLD =
5152
new SecurityMonitoringRuleDetectionMethod("anomaly_threshold");
53+
public static final SecurityMonitoringRuleDetectionMethod SEQUENCE_DETECTION =
54+
new SecurityMonitoringRuleDetectionMethod("sequence_detection");
5255

5356
SecurityMonitoringRuleDetectionMethod(String value) {
5457
super(value, allowedValues);

0 commit comments

Comments
 (0)