Skip to content

Commit f7457a0

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Add sequence detection to security monitoring rules (#2833)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent 75558ed commit f7457a0

16 files changed

Lines changed: 598 additions & 1 deletion

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20470,6 +20470,8 @@ components:
2047020470
$ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
2047120471
newValueOptions:
2047220472
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
20473+
sequenceDetectionOptions:
20474+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions'
2047320475
thirdPartyRuleOptions:
2047420476
$ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
2047520477
type: object
@@ -40786,6 +40788,7 @@ components:
4078640788
- hardcoded
4078740789
- third_party
4078840790
- anomaly_threshold
40791+
- sequence_detection
4078940792
type: string
4079040793
x-enum-varnames:
4079140794
- THRESHOLD
@@ -40795,6 +40798,7 @@ components:
4079540798
- HARDCODED
4079640799
- THIRD_PARTY
4079740800
- ANOMALY_THRESHOLD
40801+
- SEQUENCE_DETECTION
4079840802
SecurityMonitoringRuleEvaluationWindow:
4079940803
description: 'A time window is specified to match when at least one of the cases
4080040804
matches true. This is a sliding window
@@ -41008,6 +41012,8 @@ components:
4100841012
$ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
4100941013
newValueOptions:
4101041014
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
41015+
sequenceDetectionOptions:
41016+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions'
4101141017
thirdPartyRuleOptions:
4101241018
$ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
4101341019
type: object
@@ -41083,6 +41089,47 @@ components:
4108341089
oneOf:
4108441090
- $ref: '#/components/schemas/SecurityMonitoringStandardRuleResponse'
4108541091
- $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponse'
41092+
SecurityMonitoringRuleSequenceDetectionOptions:
41093+
description: Options on sequence detection method.
41094+
properties:
41095+
stepTransitions:
41096+
description: Transitions defining the allowed order of steps and their evaluation
41097+
windows.
41098+
items:
41099+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionStepTransition'
41100+
type: array
41101+
steps:
41102+
description: Steps that define the conditions to be matched in sequence.
41103+
items:
41104+
$ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionStep'
41105+
type: array
41106+
type: object
41107+
SecurityMonitoringRuleSequenceDetectionStep:
41108+
description: Step definition for sequence detection containing the step name,
41109+
condition, and evaluation window.
41110+
properties:
41111+
condition:
41112+
description: Condition referencing rule queries (e.g., `a > 0`).
41113+
type: string
41114+
evaluationWindow:
41115+
$ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
41116+
name:
41117+
description: Unique name identifying the step.
41118+
type: string
41119+
type: object
41120+
SecurityMonitoringRuleSequenceDetectionStepTransition:
41121+
description: Transition from a parent step to a child step within a sequence
41122+
detection rule.
41123+
properties:
41124+
child:
41125+
description: Name of the child step.
41126+
type: string
41127+
evaluationWindow:
41128+
$ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
41129+
parent:
41130+
description: Name of the parent step.
41131+
type: string
41132+
type: object
4108641133
SecurityMonitoringRuleSeverity:
4108741134
description: Severity of the Security Signal.
4108841135
enum:

‎docs/datadog_api_client.v2.model.rst‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18183,6 +18183,27 @@ datadog\_api\_client.v2.model.security\_monitoring\_rule\_response module
1818318183
:members:
1818418184
:show-inheritance:
1818518185

18186+
datadog\_api\_client.v2.model.security\_monitoring\_rule\_sequence\_detection\_options module
18187+
---------------------------------------------------------------------------------------------
18188+
18189+
.. automodule:: datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_options
18190+
:members:
18191+
:show-inheritance:
18192+
18193+
datadog\_api\_client.v2.model.security\_monitoring\_rule\_sequence\_detection\_step module
18194+
------------------------------------------------------------------------------------------
18195+
18196+
.. automodule:: datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_step
18197+
:members:
18198+
:show-inheritance:
18199+
18200+
datadog\_api\_client.v2.model.security\_monitoring\_rule\_sequence\_detection\_step\_transition module
18201+
------------------------------------------------------------------------------------------------------
18202+
18203+
.. automodule:: datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_step_transition
18204+
:members:
18205+
:show-inheritance:
18206+
1818618207
datadog\_api\_client.v2.model.security\_monitoring\_rule\_severity module
1818718208
-------------------------------------------------------------------------
1818818209

‎examples/v2/security-monitoring/CreateSecurityMonitoringRule_2899714190.py‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
"""
2+
Create a detection rule with detection method 'sequence_detection' returns "OK" response
3+
"""
4+
5+
from datadog_api_client import ApiClient, Configuration
6+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
7+
from datadog_api_client.v2.model.security_monitoring_rule_case_create import SecurityMonitoringRuleCaseCreate
8+
from datadog_api_client.v2.model.security_monitoring_rule_detection_method import SecurityMonitoringRuleDetectionMethod
9+
from datadog_api_client.v2.model.security_monitoring_rule_evaluation_window import (
10+
SecurityMonitoringRuleEvaluationWindow,
11+
)
12+
from datadog_api_client.v2.model.security_monitoring_rule_keep_alive import SecurityMonitoringRuleKeepAlive
13+
from datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration import (
14+
SecurityMonitoringRuleMaxSignalDuration,
15+
)
16+
from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions
17+
from datadog_api_client.v2.model.security_monitoring_rule_query_aggregation import (
18+
SecurityMonitoringRuleQueryAggregation,
19+
)
20+
from datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_options import (
21+
SecurityMonitoringRuleSequenceDetectionOptions,
22+
)
23+
from datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_step import (
24+
SecurityMonitoringRuleSequenceDetectionStep,
25+
)
26+
from datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_step_transition import (
27+
SecurityMonitoringRuleSequenceDetectionStepTransition,
28+
)
29+
from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity
30+
from datadog_api_client.v2.model.security_monitoring_rule_type_create import SecurityMonitoringRuleTypeCreate
31+
from datadog_api_client.v2.model.security_monitoring_standard_data_source import SecurityMonitoringStandardDataSource
32+
from datadog_api_client.v2.model.security_monitoring_standard_rule_create_payload import (
33+
SecurityMonitoringStandardRuleCreatePayload,
34+
)
35+
from datadog_api_client.v2.model.security_monitoring_standard_rule_query import SecurityMonitoringStandardRuleQuery
36+
37+
body = SecurityMonitoringStandardRuleCreatePayload(
38+
name="Example-Security-Monitoring",
39+
type=SecurityMonitoringRuleTypeCreate.LOG_DETECTION,
40+
is_enabled=True,
41+
queries=[
42+
SecurityMonitoringStandardRuleQuery(
43+
aggregation=SecurityMonitoringRuleQueryAggregation.COUNT,
44+
data_source=SecurityMonitoringStandardDataSource.LOGS,
45+
distinct_fields=[],
46+
group_by_fields=[],
47+
has_optional_group_by_fields=False,
48+
name="",
49+
query="service:logs-rule-reducer source:paul test2",
50+
),
51+
SecurityMonitoringStandardRuleQuery(
52+
aggregation=SecurityMonitoringRuleQueryAggregation.COUNT,
53+
data_source=SecurityMonitoringStandardDataSource.LOGS,
54+
distinct_fields=[],
55+
group_by_fields=[],
56+
has_optional_group_by_fields=False,
57+
name="",
58+
query="service:logs-rule-reducer source:paul test1",
59+
),
60+
],
61+
cases=[
62+
SecurityMonitoringRuleCaseCreate(
63+
name="",
64+
status=SecurityMonitoringRuleSeverity.INFO,
65+
notifications=[],
66+
condition="step_b > 0",
67+
),
68+
],
69+
message="Logs and signals asdf",
70+
options=SecurityMonitoringRuleOptions(
71+
detection_method=SecurityMonitoringRuleDetectionMethod.SEQUENCE_DETECTION,
72+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.ZERO_MINUTES,
73+
keep_alive=SecurityMonitoringRuleKeepAlive.FIVE_MINUTES,
74+
max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.TEN_MINUTES,
75+
sequence_detection_options=SecurityMonitoringRuleSequenceDetectionOptions(
76+
step_transitions=[
77+
SecurityMonitoringRuleSequenceDetectionStepTransition(
78+
child="step_b",
79+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES,
80+
parent="step_a",
81+
),
82+
],
83+
steps=[
84+
SecurityMonitoringRuleSequenceDetectionStep(
85+
condition="a > 0",
86+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.ONE_MINUTE,
87+
name="step_a",
88+
),
89+
SecurityMonitoringRuleSequenceDetectionStep(
90+
condition="b > 0",
91+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.ONE_MINUTE,
92+
name="step_b",
93+
),
94+
],
95+
),
96+
),
97+
tags=[],
98+
)
99+
100+
configuration = Configuration()
101+
with ApiClient(configuration) as api_client:
102+
api_instance = SecurityMonitoringApi(api_client)
103+
response = api_instance.create_security_monitoring_rule(body=body)
104+
105+
print(response)

‎examples/v2/security-monitoring/ValidateSecurityMonitoringRule_4152369508.py‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
"""
2+
Validate a detection rule with detection method 'sequence_detection' returns "OK" response
3+
"""
4+
5+
from datadog_api_client import ApiClient, Configuration
6+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
7+
from datadog_api_client.v2.model.security_monitoring_rule_case_create import SecurityMonitoringRuleCaseCreate
8+
from datadog_api_client.v2.model.security_monitoring_rule_detection_method import SecurityMonitoringRuleDetectionMethod
9+
from datadog_api_client.v2.model.security_monitoring_rule_evaluation_window import (
10+
SecurityMonitoringRuleEvaluationWindow,
11+
)
12+
from datadog_api_client.v2.model.security_monitoring_rule_keep_alive import SecurityMonitoringRuleKeepAlive
13+
from datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration import (
14+
SecurityMonitoringRuleMaxSignalDuration,
15+
)
16+
from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions
17+
from datadog_api_client.v2.model.security_monitoring_rule_query_aggregation import (
18+
SecurityMonitoringRuleQueryAggregation,
19+
)
20+
from datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_options import (
21+
SecurityMonitoringRuleSequenceDetectionOptions,
22+
)
23+
from datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_step import (
24+
SecurityMonitoringRuleSequenceDetectionStep,
25+
)
26+
from datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_step_transition import (
27+
SecurityMonitoringRuleSequenceDetectionStepTransition,
28+
)
29+
from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity
30+
from datadog_api_client.v2.model.security_monitoring_rule_type_create import SecurityMonitoringRuleTypeCreate
31+
from datadog_api_client.v2.model.security_monitoring_standard_rule_payload import SecurityMonitoringStandardRulePayload
32+
from datadog_api_client.v2.model.security_monitoring_standard_rule_query import SecurityMonitoringStandardRuleQuery
33+
34+
body = SecurityMonitoringStandardRulePayload(
35+
cases=[
36+
SecurityMonitoringRuleCaseCreate(
37+
name="",
38+
status=SecurityMonitoringRuleSeverity.INFO,
39+
notifications=[],
40+
condition="step_b > 0",
41+
),
42+
],
43+
has_extended_title=True,
44+
is_enabled=True,
45+
message="My security monitoring rule",
46+
name="My security monitoring rule",
47+
options=SecurityMonitoringRuleOptions(
48+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.ZERO_MINUTES,
49+
keep_alive=SecurityMonitoringRuleKeepAlive.FIVE_MINUTES,
50+
max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.TEN_MINUTES,
51+
detection_method=SecurityMonitoringRuleDetectionMethod.SEQUENCE_DETECTION,
52+
sequence_detection_options=SecurityMonitoringRuleSequenceDetectionOptions(
53+
step_transitions=[
54+
SecurityMonitoringRuleSequenceDetectionStepTransition(
55+
child="step_b",
56+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES,
57+
parent="step_a",
58+
),
59+
],
60+
steps=[
61+
SecurityMonitoringRuleSequenceDetectionStep(
62+
condition="a > 0",
63+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.ONE_MINUTE,
64+
name="step_a",
65+
),
66+
SecurityMonitoringRuleSequenceDetectionStep(
67+
condition="b > 0",
68+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.ONE_MINUTE,
69+
name="step_b",
70+
),
71+
],
72+
),
73+
),
74+
queries=[
75+
SecurityMonitoringStandardRuleQuery(
76+
query="source:source_here",
77+
group_by_fields=[
78+
"@userIdentity.assumed_role",
79+
],
80+
distinct_fields=[],
81+
aggregation=SecurityMonitoringRuleQueryAggregation.COUNT,
82+
name="",
83+
),
84+
SecurityMonitoringStandardRuleQuery(
85+
query="source:source_here2",
86+
group_by_fields=[],
87+
distinct_fields=[],
88+
aggregation=SecurityMonitoringRuleQueryAggregation.COUNT,
89+
name="",
90+
),
91+
],
92+
tags=[
93+
"env:prod",
94+
"team:security",
95+
],
96+
type=SecurityMonitoringRuleTypeCreate.LOG_DETECTION,
97+
)
98+
99+
configuration = Configuration()
100+
with ApiClient(configuration) as api_client:
101+
api_instance = SecurityMonitoringApi(api_client)
102+
api_instance.validate_security_monitoring_rule(body=body)

‎src/datadog_api_client/v2/model/historical_job_options.py‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@
3030
from datadog_api_client.v2.model.security_monitoring_rule_new_value_options import (
3131
SecurityMonitoringRuleNewValueOptions,
3232
)
33+
from datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_options import (
34+
SecurityMonitoringRuleSequenceDetectionOptions,
35+
)
3336
from datadog_api_client.v2.model.security_monitoring_rule_third_party_options import (
3437
SecurityMonitoringRuleThirdPartyOptions,
3538
)
@@ -54,6 +57,9 @@ def openapi_types(_):
5457
from datadog_api_client.v2.model.security_monitoring_rule_new_value_options import (
5558
SecurityMonitoringRuleNewValueOptions,
5659
)
60+
from datadog_api_client.v2.model.security_monitoring_rule_sequence_detection_options import (
61+
SecurityMonitoringRuleSequenceDetectionOptions,
62+
)
5763
from datadog_api_client.v2.model.security_monitoring_rule_third_party_options import (
5864
SecurityMonitoringRuleThirdPartyOptions,
5965
)
@@ -65,6 +71,7 @@ def openapi_types(_):
6571
"keep_alive": (SecurityMonitoringRuleKeepAlive,),
6672
"max_signal_duration": (SecurityMonitoringRuleMaxSignalDuration,),
6773
"new_value_options": (SecurityMonitoringRuleNewValueOptions,),
74+
"sequence_detection_options": (SecurityMonitoringRuleSequenceDetectionOptions,),
6875
"third_party_rule_options": (SecurityMonitoringRuleThirdPartyOptions,),
6976
}
7077

@@ -75,6 +82,7 @@ def openapi_types(_):
7582
"keep_alive": "keepAlive",
7683
"max_signal_duration": "maxSignalDuration",
7784
"new_value_options": "newValueOptions",
85+
"sequence_detection_options": "sequenceDetectionOptions",
7886
"third_party_rule_options": "thirdPartyRuleOptions",
7987
}
8088

@@ -86,6 +94,7 @@ def __init__(
8694
keep_alive: Union[SecurityMonitoringRuleKeepAlive, UnsetType] = unset,
8795
max_signal_duration: Union[SecurityMonitoringRuleMaxSignalDuration, UnsetType] = unset,
8896
new_value_options: Union[SecurityMonitoringRuleNewValueOptions, UnsetType] = unset,
97+
sequence_detection_options: Union[SecurityMonitoringRuleSequenceDetectionOptions, UnsetType] = unset,
8998
third_party_rule_options: Union[SecurityMonitoringRuleThirdPartyOptions, UnsetType] = unset,
9099
**kwargs,
91100
):
@@ -113,6 +122,9 @@ def __init__(
113122
:param new_value_options: Options on new value detection method.
114123
:type new_value_options: SecurityMonitoringRuleNewValueOptions, optional
115124
125+
:param sequence_detection_options: Options on sequence detection method.
126+
:type sequence_detection_options: SecurityMonitoringRuleSequenceDetectionOptions, optional
127+
116128
:param third_party_rule_options: Options on third party detection method.
117129
:type third_party_rule_options: SecurityMonitoringRuleThirdPartyOptions, optional
118130
"""
@@ -128,6 +140,8 @@ def __init__(
128140
kwargs["max_signal_duration"] = max_signal_duration
129141
if new_value_options is not unset:
130142
kwargs["new_value_options"] = new_value_options
143+
if sequence_detection_options is not unset:
144+
kwargs["sequence_detection_options"] = sequence_detection_options
131145
if third_party_rule_options is not unset:
132146
kwargs["third_party_rule_options"] = third_party_rule_options
133147
super().__init__(kwargs)

0 commit comments

Comments
 (0)