Skip to content

Add OpenAPI documentation for signal investigation queries and suggested actions endpoints #3377

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
api-clients-generation-pipeline wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add OpenAPI documentation for signal investigation queries and suggested actions endpoints #3377

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
187 changes: 187 additions & 0 deletions .generator/schemas/v2/openapi.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58510,6 +58510,17 @@ components:
required:
- data
type: object
SecurityMonitoringSignalInvestigationQueryTemplateVariables:
additionalProperties:
items:
description: A value for this template variable extracted from the signal.
type: string
type: array
description: Template variables applied to the investigation log query, mapping attribute paths to values extracted from the signal.
example:
"@userIdentity.arn":
- foo
type: object
SecurityMonitoringSignalListRequest:
description: The request for a security signal list.
properties:
Expand Down Expand Up @@ -58895,6 +58906,82 @@ components:
required:
- data
type: object
SecurityMonitoringSignalSuggestedAction:
description: A suggested action for a security signal.
properties:
attributes:
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionAttributes"
id:
description: The unique ID of the suggested action.
example: w00-t10-992
type: string
type:
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionType"
required:
- id
- type
- attributes
type: object
SecurityMonitoringSignalSuggestedActionAttributes:
description: Attributes of a suggested action for a security signal. The available fields depend on the action type.
properties:
name:
description: The name of the investigation log query.
example: Cloudtrail events for user ARN
type: string
query_filter:
description: The log query filter for the investigation.
example: 'source:cloudtrail @userIdentity.arn:"foo"'
type: string
template_variables:
$ref: "#/components/schemas/SecurityMonitoringSignalInvestigationQueryTemplateVariables"
title:
description: The title of the recommended blog post.
example: Monitor Okta logs to track system access and unusual activity
type: string
url:
description: The URL of the suggested action.
example: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
type: string
type: object
SecurityMonitoringSignalSuggestedActionList:
description: List of suggested actions for a security signal.
example:
- attributes:
name: Cloudtrail events for user ARN
query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
template_variables:
"@userIdentity.arn":
- foo
url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
id: w00-t10-992
type: investigation_log_queries
- attributes:
title: Monitor Okta logs to track system access and unusual activity
url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
id: bxy-o8v-i1a
type: recommended_blog_posts
items:
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedAction"
type: array
SecurityMonitoringSignalSuggestedActionType:
description: The type of the suggested action resource.
enum:
- investigation_log_queries
- recommended_blog_posts
example: investigation_log_queries
type: string
x-enum-varnames:
- INVESTIGATION_LOG_QUERIES
- RECOMMENDED_BLOG_POSTS
SecurityMonitoringSignalSuggestedActionsResponse:
description: Response with suggested actions for a security signal.
properties:
data:
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionList"
required:
- data
type: object
SecurityMonitoringSignalTriageAttributes:
description: Attributes describing a triage state update operation over a security signal.
properties:
Expand Down Expand Up @@ -104670,6 +104757,56 @@ paths:
operator: OR
permissions:
- security_monitoring_signals_write
/api/v2/security_monitoring/signals/{signal_id}/investigation_queries:
get:
description: Get the list of investigation log queries available for a given security signal.
operationId: GetInvestigationLogQueriesMatchingSignal
parameters:
- $ref: "#/components/parameters/SignalID"
responses:
"200":
content:
application/json:
examples:
default:
value:
data:
- attributes:
name: Cloudtrail events for user ARN
query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
template_variables:
"@userIdentity.arn":
- foo
url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
id: w00-t10-992
type: investigation_log_queries
- attributes:
title: Monitor Okta logs to track system access and unusual activity
url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
id: bxy-o8v-i1a
type: recommended_blog_posts
schema:
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionsResponse"
description: OK
"403":
$ref: "#/components/responses/NotAuthorizedResponse"
"404":
$ref: "#/components/responses/NotFoundResponse"
"429":
$ref: "#/components/responses/TooManyRequestsResponse"
security:
- apiKeyAuth: []
appKeyAuth: []
- AuthZ:
- security_monitoring_rules_read
- security_monitoring_signals_read
summary: Get investigation queries for a signal
tags: ["Security Monitoring"]
x-permission:
operator: AND
permissions:
- security_monitoring_rules_read
- security_monitoring_signals_read
/api/v2/security_monitoring/signals/{signal_id}/state:
patch:
description: |-
Expand Down Expand Up @@ -104710,6 +104847,56 @@ paths:
operator: OR
permissions:
- security_monitoring_signals_write
/api/v2/security_monitoring/signals/{signal_id}/suggested_actions:
get:
description: Get the list of suggested actions for a given security signal.
operationId: GetSuggestedActionsMatchingSignal
parameters:
- $ref: "#/components/parameters/SignalID"
responses:
"200":
content:
application/json:
examples:
default:
value:
data:
- attributes:
name: Cloudtrail events for user ARN
query_filter: 'source:cloudtrail @userIdentity.arn:"foo"'
template_variables:
"@userIdentity.arn":
- foo
url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22
id: w00-t10-992
type: investigation_log_queries
- attributes:
title: Monitor Okta logs to track system access and unusual activity
url: https://www.datadoghq.com/blog/monitor-activity-with-okta/
id: bxy-o8v-i1a
type: recommended_blog_posts
schema:
$ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionsResponse"
description: OK
"403":
$ref: "#/components/responses/NotAuthorizedResponse"
"404":
$ref: "#/components/responses/NotFoundResponse"
"429":
$ref: "#/components/responses/TooManyRequestsResponse"
security:
- apiKeyAuth: []
appKeyAuth: []
- AuthZ:
- security_monitoring_rules_read
- security_monitoring_signals_read
summary: Get suggested actions for a signal
tags: ["Security Monitoring"]
x-permission:
operator: AND
permissions:
- security_monitoring_rules_read
- security_monitoring_signals_read
/api/v2/sensitive-data-scanner/config:
get:
description: List all the Scanning groups in your organization.
Expand Down
35 changes: 35 additions & 0 deletions docs/datadog_api_client.v2.model.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26520,6 +26520,13 @@ datadog\_api\_client.v2.model.security\_monitoring\_signal\_incidents\_update\_r
:members:
:show-inheritance:

datadog\_api\_client.v2.model.security\_monitoring\_signal\_investigation\_query\_template\_variables module
------------------------------------------------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.security_monitoring_signal_investigation_query_template_variables
:members:
:show-inheritance:

datadog\_api\_client.v2.model.security\_monitoring\_signal\_list\_request module
--------------------------------------------------------------------------------

Expand Down Expand Up @@ -26625,6 +26632,34 @@ datadog\_api\_client.v2.model.security\_monitoring\_signal\_state\_update\_reque
:members:
:show-inheritance:

datadog\_api\_client.v2.model.security\_monitoring\_signal\_suggested\_action module
------------------------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.security_monitoring_signal_suggested_action
:members:
:show-inheritance:

datadog\_api\_client.v2.model.security\_monitoring\_signal\_suggested\_action\_attributes module
------------------------------------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.security_monitoring_signal_suggested_action_attributes
:members:
:show-inheritance:

datadog\_api\_client.v2.model.security\_monitoring\_signal\_suggested\_action\_type module
------------------------------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.security_monitoring_signal_suggested_action_type
:members:
:show-inheritance:

datadog\_api\_client.v2.model.security\_monitoring\_signal\_suggested\_actions\_response module
-----------------------------------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.security_monitoring_signal_suggested_actions_response
:members:
:show-inheritance:

datadog\_api\_client.v2.model.security\_monitoring\_signal\_triage\_attributes module
-------------------------------------------------------------------------------------

Expand Down
15 changes: 15 additions & 0 deletions examples/v2/security-monitoring/GetInvestigationLogQueriesMatchingSignal.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
"""
Get investigation queries for a signal returns "OK" response
"""

from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi

configuration = Configuration()
with ApiClient(configuration) as api_client:
api_instance = SecurityMonitoringApi(api_client)
response = api_instance.get_investigation_log_queries_matching_signal(
signal_id="AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",
)

print(response)
15 changes: 15 additions & 0 deletions examples/v2/security-monitoring/GetSuggestedActionsMatchingSignal.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
"""
Get suggested actions for a signal returns "OK" response
"""

from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi

configuration = Configuration()
with ApiClient(configuration) as api_client:
api_instance = SecurityMonitoringApi(api_client)
response = api_instance.get_suggested_actions_matching_signal(
signal_id="AQAAAYG1bl5K4HuUewAAAABBWUcxYmw1S0FBQmt2RmhRN0V4ZUVnQUE",
)

print(response)
Loading
Loading