Skip to content

Commit 05e6e8d

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Add validation endpoint for Security Monitoring Rules (#1581)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com> Co-authored-by: api-clients-generation-pipeline[bot] <54105614+api-clients-generation-pipeline[bot]@users.noreply.github.com>
1 parent ae0c357 commit 05e6e8d

File tree

12 files changed

+378
-4
lines changed

12 files changed

+378
-4
lines changed

‎.apigentools-info

+4-4
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
"spec_versions": {
55
"v1": {
66
"apigentools_version": "1.6.6",
7-
"regenerated": "2024-03-26 15:17:45.583561",
8-
"spec_repo_commit": "46383d02"
7+
"regenerated": "2024-03-27 22:12:46.457964",
8+
"spec_repo_commit": "85625198"
99
},
1010
"v2": {
1111
"apigentools_version": "1.6.6",
12-
"regenerated": "2024-03-26 15:17:45.602729",
13-
"spec_repo_commit": "46383d02"
12+
"regenerated": "2024-03-27 22:12:46.486191",
13+
"spec_repo_commit": "85625198"
1414
}
1515
}
1616
}

‎.generator/schemas/v2/openapi.yaml

+28
Original file line numberDiff line numberDiff line change
@@ -32287,6 +32287,34 @@ paths:
3228732287
tags:
3228832288
- Security Monitoring
3228932289
x-codegen-request-body-name: body
32290+
/api/v2/security_monitoring/rules/validation:
32291+
post:
32292+
description: Validate a detection rule.
32293+
operationId: ValidateSecurityMonitoringRule
32294+
requestBody:
32295+
content:
32296+
application/json:
32297+
schema:
32298+
$ref: '#/components/schemas/SecurityMonitoringRuleCreatePayload'
32299+
required: true
32300+
responses:
32301+
'204':
32302+
description: OK
32303+
'400':
32304+
$ref: '#/components/responses/BadRequestResponse'
32305+
'403':
32306+
$ref: '#/components/responses/NotAuthorizedResponse'
32307+
'429':
32308+
$ref: '#/components/responses/TooManyRequestsResponse'
32309+
security:
32310+
- apiKeyAuth: []
32311+
appKeyAuth: []
32312+
- AuthZ:
32313+
- security_monitoring_rules_write
32314+
summary: Validate a detection rule
32315+
tags:
32316+
- Security Monitoring
32317+
x-codegen-request-body-name: body
3229032318
/api/v2/security_monitoring/rules/{rule_id}:
3229132319
delete:
3229232320
description: Delete an existing rule. Default rules cannot be deleted.

‎cassettes/v2/Security-Monitoring_1187227211/Validate-a-detection-rule-returns-Bad-Request-response_1975779485/frozen.json

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2024-03-27T16:23:09.814Z"

‎cassettes/v2/Security-Monitoring_1187227211/Validate-a-detection-rule-returns-Bad-Request-response_1975779485/recording.har

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Validate a detection rule returns \"Bad Request\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "195f214fcab0861b1336ce2aa07b9cf5",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 507,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "*/*"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 588,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"cases\":[{\"condition\":\"a > 0\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"hasExtendedTitle\":true,\"isEnabled\":true,\"message\":\"My security monitoring rule\",\"name\":\"My security monitoring rule\",\"options\":{\"detectionMethod\":\"threshold\",\"evaluationWindow\":1800,\"keepAlive\":999999,\"maxSignalDuration\":1800},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[\"@userIdentity.assumed_role\"],\"name\":\"\",\"query\":\"source:source_here\"}],\"tags\":[\"env:prod\",\"team:security\"],\"type\":\"log_detection\"}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules/validation"
39+
},
40+
"response": {
41+
"bodySize": 372,
42+
"content": {
43+
"mimeType": "application/json",
44+
"size": 372,
45+
"text": "{\"error\":{\"code\":\"InvalidArgument\",\"message\":\"Invalid rule configuration\",\"details\":[{\"code\":\"InvalidArgument\",\"message\":\"Max signal duration must be greater than or equal to keep alive\",\"target\":\"maxSignalDuration\"},{\"code\":\"InvalidArgument\",\"message\":\"Keep alive is not in allowed durations: 0, 1, 5, 10, 15, 30, 60, 120, 180, 360 (in minutes)\",\"target\":\"keepAlive\"}]}}\n"
46+
},
47+
"cookies": [],
48+
"headers": [
49+
{
50+
"name": "content-type",
51+
"value": "application/json"
52+
}
53+
],
54+
"headersSize": 655,
55+
"httpVersion": "HTTP/1.1",
56+
"redirectURL": "",
57+
"status": 400,
58+
"statusText": "Bad Request"
59+
},
60+
"startedDateTime": "2024-03-27T16:23:09.817Z",
61+
"time": 334
62+
}
63+
],
64+
"pages": [],
65+
"version": "1.2"
66+
}
67+
}

‎cassettes/v2/Security-Monitoring_1187227211/Validate-a-detection-rule-returns-OK-response_1946162529/frozen.json

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"2024-03-27T16:23:10.157Z"

‎cassettes/v2/Security-Monitoring_1187227211/Validate-a-detection-rule-returns-OK-response_1946162529/recording.har

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"log": {
3+
"_recordingName": "Security Monitoring/Validate a detection rule returns \"OK\" response",
4+
"creator": {
5+
"comment": "persister:fs",
6+
"name": "Polly.JS",
7+
"version": "6.0.5"
8+
},
9+
"entries": [
10+
{
11+
"_id": "eff24aa1fc7cd68e58156e52bbac0e73",
12+
"_order": 0,
13+
"cache": {},
14+
"request": {
15+
"bodySize": 505,
16+
"cookies": [],
17+
"headers": [
18+
{
19+
"_fromType": "array",
20+
"name": "accept",
21+
"value": "*/*"
22+
},
23+
{
24+
"_fromType": "array",
25+
"name": "content-type",
26+
"value": "application/json"
27+
}
28+
],
29+
"headersSize": 588,
30+
"httpVersion": "HTTP/1.1",
31+
"method": "POST",
32+
"postData": {
33+
"mimeType": "application/json",
34+
"params": [],
35+
"text": "{\"cases\":[{\"condition\":\"a > 0\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"hasExtendedTitle\":true,\"isEnabled\":true,\"message\":\"My security monitoring rule\",\"name\":\"My security monitoring rule\",\"options\":{\"detectionMethod\":\"threshold\",\"evaluationWindow\":1800,\"keepAlive\":1800,\"maxSignalDuration\":1800},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[\"@userIdentity.assumed_role\"],\"name\":\"\",\"query\":\"source:source_here\"}],\"tags\":[\"env:prod\",\"team:security\"],\"type\":\"log_detection\"}"
36+
},
37+
"queryString": [],
38+
"url": "https://api.datadoghq.com/api/v2/security_monitoring/rules/validation"
39+
},
40+
"response": {
41+
"bodySize": 0,
42+
"content": {
43+
"mimeType": "text/html; charset=utf-8",
44+
"size": 0
45+
},
46+
"cookies": [],
47+
"headers": [
48+
{
49+
"name": "content-type",
50+
"value": "text/html; charset=utf-8"
51+
}
52+
],
53+
"headersSize": 642,
54+
"httpVersion": "HTTP/1.1",
55+
"redirectURL": "",
56+
"status": 204,
57+
"statusText": "No Content"
58+
},
59+
"startedDateTime": "2024-03-27T16:23:10.159Z",
60+
"time": 335
61+
}
62+
],
63+
"pages": [],
64+
"version": "1.2"
65+
}
66+
}

‎examples/v2/security-monitoring/ValidateSecurityMonitoringRule.ts

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
/**
2+
* Validate a detection rule returns "OK" response
3+
*/
4+
5+
import { client, v2 } from "@datadog/datadog-api-client";
6+
7+
const configuration = client.createConfiguration();
8+
const apiInstance = new v2.SecurityMonitoringApi(configuration);
9+
10+
const params: v2.SecurityMonitoringApiValidateSecurityMonitoringRuleRequest = {
11+
body: {
12+
cases: [
13+
{
14+
name: "",
15+
status: "info",
16+
notifications: [],
17+
condition: "a > 0",
18+
},
19+
],
20+
hasExtendedTitle: true,
21+
isEnabled: true,
22+
message: "My security monitoring rule",
23+
name: "My security monitoring rule",
24+
options: {
25+
evaluationWindow: 1800,
26+
keepAlive: 1800,
27+
maxSignalDuration: 1800,
28+
detectionMethod: "threshold",
29+
},
30+
queries: [
31+
{
32+
query: "source:source_here",
33+
groupByFields: ["@userIdentity.assumed_role"],
34+
distinctFields: [],
35+
aggregation: "count",
36+
name: "",
37+
},
38+
],
39+
tags: ["env:prod", "team:security"],
40+
type: "log_detection",
41+
},
42+
};
43+
44+
apiInstance
45+
.validateSecurityMonitoringRule(params)
46+
.then((data: any) => {
47+
console.log(
48+
"API called successfully. Returned data: " + JSON.stringify(data)
49+
);
50+
})
51+
.catch((error: any) => console.error(error));

‎features/support/scenarios_model_mapping.ts

+7
Original file line numberDiff line numberDiff line change
@@ -4573,6 +4573,13 @@ export const ScenariosModelMappings: {[key: string]: {[key: string]: any}} = {
45734573
},
45744574
"operationResponseType": "SecurityMonitoringRuleResponse",
45754575
},
4576+
"v2.ValidateSecurityMonitoringRule": {
4577+
"body": {
4578+
"type": "SecurityMonitoringRuleCreatePayload",
4579+
"format": "",
4580+
},
4581+
"operationResponseType": "void",
4582+
},
45764583
"v2.DeleteSecurityMonitoringRule": {
45774584
"ruleId": {
45784585
"type": "string",

‎features/v2/security_monitoring.feature

+14
Original file line numberDiff line numberDiff line change
@@ -606,3 +606,17 @@ Feature: Security Monitoring
606606
Then the response status is 200 OK
607607
And the response "name" is equal to "{{ unique }}-Updated"
608608
And the response "id" has the same value as "security_rule.id"
609+
610+
@skip-go @skip-java @skip-python @skip-ruby @skip-rust @skip-typescript @skip-validation @team:DataDog/k9-cloud-security-platform
611+
Scenario: Validate a detection rule returns "Bad Request" response
612+
Given new "ValidateSecurityMonitoringRule" request
613+
And body with value {"cases":[{"name":"","status":"info","notifications":[],"condition":"a > 0"}],"hasExtendedTitle":true,"isEnabled":true,"message":"My security monitoring rule","name":"My security monitoring rule","options":{"evaluationWindow":1800,"keepAlive":999999,"maxSignalDuration":1800,"detectionMethod":"threshold"},"queries":[{"query":"source:source_here","groupByFields":["@userIdentity.assumed_role"],"distinctFields":[],"aggregation":"count","name":""}],"tags":["env:prod","team:security"],"type":"log_detection"}
614+
When the request is sent
615+
Then the response status is 400 Bad Request
616+
617+
@team:DataDog/k9-cloud-security-platform
618+
Scenario: Validate a detection rule returns "OK" response
619+
Given new "ValidateSecurityMonitoringRule" request
620+
And body with value {"cases":[{"name":"","status":"info","notifications":[],"condition":"a > 0"}],"hasExtendedTitle":true,"isEnabled":true,"message":"My security monitoring rule","name":"My security monitoring rule","options":{"evaluationWindow":1800,"keepAlive":1800,"maxSignalDuration":1800,"detectionMethod":"threshold"},"queries":[{"query":"source:source_here","groupByFields":["@userIdentity.assumed_role"],"distinctFields":[],"aggregation":"count","name":""}],"tags":["env:prod","team:security"],"type":"log_detection"}
621+
When the request is sent
622+
Then the response status is 204 OK

‎features/v2/undo.json

+6
Original file line numberDiff line numberDiff line change
@@ -1751,6 +1751,12 @@
17511751
"type": "unsafe"
17521752
}
17531753
},
1754+
"ValidateSecurityMonitoringRule": {
1755+
"tag": "Security Monitoring",
1756+
"undo": {
1757+
"type": "idempotent"
1758+
}
1759+
},
17541760
"DeleteSecurityMonitoringRule": {
17551761
"tag": "Security Monitoring",
17561762
"undo": {

0 commit comments

Comments
 (0)