Skip to content

Commit 57a3a4c

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Support Cloud SIEM scheduled rules in API client (#2567)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent 9592959 commit 57a3a4c

File tree

16 files changed

+424
-2
lines changed

16 files changed

+424
-2
lines changed

‎.generated-info‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
{
2-
"spec_repo_commit": "c5cca50",
3-
"generated": "2025-08-07 18:03:20.696"
2+
"spec_repo_commit": "d02c8a3",
3+
"generated": "2025-08-08 12:07:03.564"
44
}

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36336,6 +36336,12 @@ components:
3633636336
SecurityMonitoringRuleUpdatePayload:
3633736337
description: Update an existing rule.
3633836338
properties:
36339+
calculatedFields:
36340+
description: Calculated fields. Only allowed for scheduled rules - in other
36341+
words, when schedulingOptions is also defined.
36342+
items:
36343+
$ref: '#/components/schemas/CalculatedField'
36344+
type: array
3633936345
cases:
3634036346
description: Cases for generating signals.
3634136347
items:
@@ -36392,6 +36398,8 @@ components:
3639236398
items:
3639336399
$ref: '#/components/schemas/SecurityMonitoringReferenceTable'
3639436400
type: array
36401+
schedulingOptions:
36402+
$ref: '#/components/schemas/SecurityMonitoringSchedulingOptions'
3639536403
tags:
3639636404
description: Tags for generated signals.
3639736405
items:
@@ -36418,6 +36426,27 @@ components:
3641836426
- $ref: '#/components/schemas/SecurityMonitoringStandardRulePayload'
3641936427
- $ref: '#/components/schemas/SecurityMonitoringSignalRulePayload'
3642036428
- $ref: '#/components/schemas/CloudConfigurationRulePayload'
36429+
SecurityMonitoringSchedulingOptions:
36430+
description: Options for scheduled rules. When this field is present, the rule
36431+
runs based on the schedule. When absent, it runs real-time on ingested logs.
36432+
nullable: true
36433+
properties:
36434+
rrule:
36435+
description: Schedule for the rule queries, written in RRULE syntax. See
36436+
[RFC](https://icalendar.org/iCalendar-RFC-5545/3-8-5-3-recurrence-rule.html)
36437+
for syntax reference.
36438+
example: FREQ=HOURLY;INTERVAL=1;
36439+
type: string
36440+
start:
36441+
description: Start date for the schedule, in ISO 8601 format without timezone.
36442+
example: '2025-07-14T12:00:00'
36443+
type: string
36444+
timezone:
36445+
description: Time zone of the start date, in the [tz database](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)
36446+
format.
36447+
example: America/New_York
36448+
type: string
36449+
type: object
3642136450
SecurityMonitoringSignal:
3642236451
description: Object description of a security signal.
3642336452
properties:
@@ -37096,6 +37125,12 @@ components:
3709637125
SecurityMonitoringStandardRuleCreatePayload:
3709737126
description: Create a new rule.
3709837127
properties:
37128+
calculatedFields:
37129+
description: Calculated fields. Only allowed for scheduled rules - in other
37130+
words, when schedulingOptions is also defined.
37131+
items:
37132+
$ref: '#/components/schemas/CalculatedField'
37133+
type: array
3709937134
cases:
3710037135
description: Cases for generating signals.
3710137136
example: []
@@ -37148,6 +37183,8 @@ components:
3714837183
items:
3714937184
$ref: '#/components/schemas/SecurityMonitoringReferenceTable'
3715037185
type: array
37186+
schedulingOptions:
37187+
$ref: '#/components/schemas/SecurityMonitoringSchedulingOptions'
3715137188
tags:
3715237189
description: Tags for generated signals.
3715337190
example:
@@ -37177,6 +37214,12 @@ components:
3717737214
SecurityMonitoringStandardRulePayload:
3717837215
description: The payload of a rule.
3717937216
properties:
37217+
calculatedFields:
37218+
description: Calculated fields. Only allowed for scheduled rules - in other
37219+
words, when schedulingOptions is also defined.
37220+
items:
37221+
$ref: '#/components/schemas/CalculatedField'
37222+
type: array
3718037223
cases:
3718137224
description: Cases for generating signals.
3718237225
example: []
@@ -37237,6 +37280,8 @@ components:
3723737280
items:
3723837281
$ref: '#/components/schemas/SecurityMonitoringReferenceTable'
3723937282
type: array
37283+
schedulingOptions:
37284+
$ref: '#/components/schemas/SecurityMonitoringSchedulingOptions'
3724037285
tags:
3724137286
description: Tags for generated signals.
3724237287
example:
@@ -37293,6 +37338,14 @@ components:
3729337338
example: false
3729437339
readOnly: true
3729537340
type: boolean
37341+
index:
37342+
description: '**This field is currently unstable and might be removed in
37343+
a minor version upgrade.**
37344+
37345+
The index to run the query on, if the `dataSource` is `logs`. Only used
37346+
for scheduled rules - in other words, when the `schedulingOptions` field
37347+
is present in the rule payload.'
37348+
type: string
3729637349
metric:
3729737350
deprecated: true
3729837351
description: '(Deprecated) The target field to aggregate over when using
@@ -37320,6 +37373,12 @@ components:
3732037373
SecurityMonitoringStandardRuleResponse:
3732137374
description: Rule.
3732237375
properties:
37376+
calculatedFields:
37377+
description: Calculated fields. Only allowed for scheduled rules - in other
37378+
words, when schedulingOptions is also defined.
37379+
items:
37380+
$ref: '#/components/schemas/CalculatedField'
37381+
type: array
3732337382
cases:
3732437383
description: Cases for generating signals.
3732537384
items:
@@ -37405,6 +37464,8 @@ components:
3740537464
items:
3740637465
$ref: '#/components/schemas/SecurityMonitoringReferenceTable'
3740737466
type: array
37467+
schedulingOptions:
37468+
$ref: '#/components/schemas/SecurityMonitoringSchedulingOptions'
3740837469
tags:
3740937470
description: Tags for generated signals.
3741037471
items:
@@ -37436,6 +37497,12 @@ components:
3743637497
SecurityMonitoringStandardRuleTestPayload:
3743737498
description: The payload of a rule to test
3743837499
properties:
37500+
calculatedFields:
37501+
description: Calculated fields. Only allowed for scheduled rules - in other
37502+
words, when schedulingOptions is also defined.
37503+
items:
37504+
$ref: '#/components/schemas/CalculatedField'
37505+
type: array
3743937506
cases:
3744037507
description: Cases for generating signals.
3744137508
example: []
@@ -37488,6 +37555,8 @@ components:
3748837555
items:
3748937556
$ref: '#/components/schemas/SecurityMonitoringReferenceTable'
3749037557
type: array
37558+
schedulingOptions:
37559+
$ref: '#/components/schemas/SecurityMonitoringSchedulingOptions'
3749137560
tags:
3749237561
description: Tags for generated signals.
3749337562
example:

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-scheduled-detection-rule-returns-OK-response_4086716458/frozen.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2025-07-31T07:48:27.113Z"

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-scheduled-detection-rule-returns-OK-response_4086716458/recording.har‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Create a scheduled detection rule returns \"OK\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "65e5fd9cf3ead6c42b6c2fecaf3465a1",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 543,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 588,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"cases\":[{\"condition\":\"a > 0\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"isEnabled\":true,\"message\":\"Test rule\",\"name\":\"Test-Create_a_scheduled_detection_rule_returns_OK_response-1753948107\",\"options\":{\"evaluationWindow\":900,\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[],\"index\":\"main\",\"query\":\"@test:true\"}],\"schedulingOptions\":{\"rrule\":\"FREQ=HOURLY;INTERVAL=2;\",\"start\":\"2025-06-18T12:00:00\",\"timezone\":\"Europe/Paris\"},\"tags\":[],\"type\":\"log_detection\"}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules"
39+
},
40+
"response": {
41+
"bodySize": 991,
42+
"content": {
43+
"mimeType": "application/json",
44+
"size": 991,
45+
"text": "{\"name\":\"Test-Create_a_scheduled_detection_rule_returns_OK_response-1753948107\",\"createdAt\":1753948107557,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isBeta\":false,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"@test:true\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\",\"dataSource\":\"logs\",\"index\":\"main\"}],\"options\":{\"evaluationWindow\":900,\"detectionMethod\":\"threshold\",\"maxSignalDuration\":86400,\"keepAlive\":3600},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a \\u003e 0\"}],\"message\":\"Test rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"log_detection\",\"filters\":[],\"version\":1,\"id\":\"8dd-els-oyn\",\"blocking\":false,\"metadata\":{\"entities\":null,\"sources\":null},\"creationAuthorId\":1445416,\"creator\":{\"handle\":\"frog@datadoghq.com\",\"name\":\"frog\"},\"updater\":{\"handle\":\"\",\"name\":\"\"},\"schedulingOptions\":{\"rrule\":\"FREQ=HOURLY;INTERVAL=2;\",\"start\":\"2025-06-18T12:00:00\",\"timezone\":\"Europe/Paris\"}}"
46+
},
47+
"cookies": [],
48+
"headers": [
49+
{
50+
"name": "content-type",
51+
"value": "application/json"
52+
}
53+
],
54+
"headersSize": 654,
55+
"httpVersion": "HTTP/1.1",
56+
"redirectURL": "",
57+
"status": 200,
58+
"statusText": "OK"
59+
},
60+
"startedDateTime": "2025-07-31T07:48:27.118Z",
61+
"time": 469
62+
},
63+
{
64+
"_id": "9ba28a921a04dada8d9d8beaa90e5bf7",
65+
"_order": 0,
66+
"cache": {},
67+
"request": {
68+
"bodySize": 0,
69+
"cookies": [],
70+
"headers": [
71+
{
72+
"_fromType": "array",
73+
"name": "accept",
74+
"value": "*/*"
75+
}
76+
],
77+
"headersSize": 536,
78+
"httpVersion": "HTTP/1.1",
79+
"method": "DELETE",
80+
"queryString": [],
81+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules/8dd-els-oyn"
82+
},
83+
"response": {
84+
"bodySize": 0,
85+
"content": {
86+
"mimeType": "text/plain",
87+
"size": 0
88+
},
89+
"cookies": [],
90+
"headers": [],
91+
"headersSize": 601,
92+
"httpVersion": "HTTP/1.1",
93+
"redirectURL": "",
94+
"status": 204,
95+
"statusText": "No Content"
96+
},
97+
"startedDateTime": "2025-07-31T07:48:27.600Z",
98+
"time": 436
99+
}
100+
],
101+
"pages": [],
102+
"version": "1.2"
103+
}
104+
}

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-scheduled-rule-without-rrule-returns-Bad-Request-response_2911847931/frozen.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2025-07-31T07:49:14.474Z"

‎cassettes/v2/Security-Monitoring_1187227211/Create-a-scheduled-rule-without-rrule-returns-Bad-Request-response_2911847931/recording.har‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Create a scheduled rule without rrule returns \"Bad Request\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "d9e00af4d10673adb787bc97f2c88023",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 522,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "application/json"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 588,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"cases\":[{\"condition\":\"a > 0\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"isEnabled\":true,\"message\":\"Test rule\",\"name\":\"Test-Create_a_scheduled_rule_without_rrule_returns_Bad_Request_response-1753948154\",\"options\":{\"evaluationWindow\":900,\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[],\"index\":\"main\",\"query\":\"@test:true\"}],\"schedulingOptions\":{\"start\":\"2025-06-18T12:00:00\",\"timezone\":\"Europe/Paris\"},\"tags\":[],\"type\":\"log_detection\"}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules"
39+
},
40+
"response": {
41+
"bodySize": 211,
42+
"content": {
43+
"mimeType": "application/json",
44+
"size": 211,
45+
"text": "{\"error\":{\"code\":\"InvalidArgument\",\"message\":\"Invalid rule configuration\",\"details\":[{\"code\":\"InvalidArgument\",\"message\":\"The RRULE schedule is invalid for scheduled rules\",\"target\":\"schedulingOptions.rrule\"}]}}"
46+
},
47+
"cookies": [],
48+
"headers": [
49+
{
50+
"name": "content-type",
51+
"value": "application/json"
52+
}
53+
],
54+
"headersSize": 654,
55+
"httpVersion": "HTTP/1.1",
56+
"redirectURL": "",
57+
"status": 400,
58+
"statusText": "Bad Request"
59+
},
60+
"startedDateTime": "2025-07-31T07:49:14.479Z",
61+
"time": 421
62+
}
63+
],
64+
"pages": [],
65+
"version": "1.2"
66+
}
67+
}

‎features/v2/security_monitoring.feature‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -295,6 +295,24 @@ Feature: Security Monitoring
295295
When the request is sent
296296
Then the response status is 201 Successfully created the notification rule.
297297

298+
@team:DataDog/k9-cloud-security-platform
299+
Scenario: Create a scheduled detection rule returns "OK" response
300+
Given new "CreateSecurityMonitoringRule" request
301+
And body with value {"name":"{{ unique }}", "queries":[{"query":"@test:true","aggregation":"count","groupByFields":[],"distinctFields":[],"index":"main"}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test rule","tags":[],"isEnabled":true, "type":"log_detection", "schedulingOptions": {"rrule": "FREQ=HOURLY;INTERVAL=2;", "start": "2025-06-18T12:00:00", "timezone": "Europe/Paris"}}
302+
When the request is sent
303+
Then the response status is 200 OK
304+
And the response "name" is equal to "{{ unique }}"
305+
And the response "type" is equal to "log_detection"
306+
And the response "message" is equal to "Test rule"
307+
And the response "schedulingOptions" is equal to {"rrule": "FREQ=HOURLY;INTERVAL=2;", "start": "2025-06-18T12:00:00", "timezone": "Europe/Paris"}
308+
309+
@team:DataDog/k9-cloud-security-platform
310+
Scenario: Create a scheduled rule without rrule returns "Bad Request" response
311+
Given new "CreateSecurityMonitoringRule" request
312+
And body with value {"name":"{{ unique }}", "queries":[{"query":"@test:true","aggregation":"count","groupByFields":[],"distinctFields":[],"index":"main"}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test rule","tags":[],"isEnabled":true, "type":"log_detection", "schedulingOptions": {"start": "2025-06-18T12:00:00", "timezone": "Europe/Paris"}}
313+
When the request is sent
314+
Then the response status is 400 Bad Request
315+
298316
@generated @skip @team:DataDog/k9-cloud-security-platform
299317
Scenario: Create a security filter returns "Bad Request" response
300318
Given new "CreateSecurityFilter" request

‎services/security_monitoring/src/v2/index.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -242,6 +242,7 @@ export { SecurityMonitoringRuleTypeRead } from "./models/SecurityMonitoringRuleT
242242
export { SecurityMonitoringRuleTypeTest } from "./models/SecurityMonitoringRuleTypeTest";
243243
export { SecurityMonitoringRuleUpdatePayload } from "./models/SecurityMonitoringRuleUpdatePayload";
244244
export { SecurityMonitoringRuleValidatePayload } from "./models/SecurityMonitoringRuleValidatePayload";
245+
export { SecurityMonitoringSchedulingOptions } from "./models/SecurityMonitoringSchedulingOptions";
245246
export { SecurityMonitoringSignal } from "./models/SecurityMonitoringSignal";
246247
export { SecurityMonitoringSignalArchiveReason } from "./models/SecurityMonitoringSignalArchiveReason";
247248
export { SecurityMonitoringSignalAssigneeUpdateAttributes } from "./models/SecurityMonitoringSignalAssigneeUpdateAttributes";

0 commit comments

Comments
 (0)