diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml index 7acea8a971..91955c670c 100644 --- a/.generator/schemas/v2/openapi.yaml +++ b/.generator/schemas/v2/openapi.yaml @@ -118490,6 +118490,193 @@ components: x-enum-varnames: - UP_ONE - DOWN_ONE + SeverityOverrideAttributes: + description: |- + Severity override to apply to the findings. + Set `action` to `set` to apply a manual severity override with the given `value`. + Set `action` to `clear` to remove a manual severity override. + oneOf: + - $ref: "#/components/schemas/SeverityOverrideSet" + - $ref: "#/components/schemas/SeverityOverrideClear" + SeverityOverrideClear: + description: |- + Removes the manual severity override of the findings. + This action does not remove a severity set by an automation rule. + properties: + action: + $ref: "#/components/schemas/SeverityOverrideClearActionType" + description: + description: Additional information about the severity change. This field has a limit of 280 characters. + example: "Severity override no longer needed." + maxLength: 280 + type: string + required: + - action + type: object + SeverityOverrideClearActionType: + default: clear + description: The action that removes a manual severity override. + enum: + - clear + example: clear + type: string + x-enum-varnames: + - CLEAR + SeverityOverrideDataType: + default: severity_override + description: Severity override resource type. + enum: + - severity_override + example: severity_override + type: string + x-enum-varnames: + - SEVERITY_OVERRIDE + SeverityOverrideRequest: + description: Request to set or clear the manual severity override of security findings. + properties: + data: + $ref: "#/components/schemas/SeverityOverrideRequestData" + required: + - data + type: object + SeverityOverrideRequestData: + description: Data of the severity override request. + properties: + attributes: + $ref: "#/components/schemas/SeverityOverrideRequestDataAttributes" + id: + description: Unique identifier of the severity override request. If not provided, an identifier is generated. + example: "00000000-0000-0000-0000-000000000001" + type: string + relationships: + $ref: "#/components/schemas/SeverityOverrideRequestDataRelationships" + type: + $ref: "#/components/schemas/SeverityOverrideDataType" + required: + - attributes + - relationships + - type + type: object + SeverityOverrideRequestDataAttributes: + description: Attributes of the severity override request. + properties: + severity: + $ref: "#/components/schemas/SeverityOverrideAttributes" + required: + - severity + type: object + SeverityOverrideRequestDataRelationships: + description: Relationships of the severity override request. + properties: + findings: + $ref: "#/components/schemas/Findings" + description: Security findings to override the severity of. + required: + - findings + type: object + SeverityOverrideResponse: + description: Response for the severity override request. + properties: + data: + $ref: "#/components/schemas/SeverityOverrideResponseData" + meta: + $ref: "#/components/schemas/SeverityOverrideResponseMeta" + required: + - data + type: object + SeverityOverrideResponseData: + description: Data of the severity override response. + properties: + id: + description: Unique identifier of the severity override request. + example: "00000000-0000-0000-0000-000000000001" + type: string + type: + $ref: "#/components/schemas/SeverityOverrideDataType" + required: + - id + - type + type: object + SeverityOverrideResponseMeta: + description: Security findings skipped while processing the severity override request. + properties: + warnings: + description: Findings skipped because an automation rule set their severity. + items: + $ref: "#/components/schemas/SeverityOverrideResult" + type: array + type: object + SeverityOverrideResult: + description: Per-finding outcome of a severity override operation. + properties: + detail: + description: Human-readable explanation of why the finding was skipped. + example: >- + cannot set severity on finding because it is overridden by an automation severity modifier rule; disable or update the automation rule first + type: string + finding_id: + description: Unique identifier of the security finding. + example: "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==" + type: string + status: + description: HTTP-like status code describing the outcome for this finding. + example: 400 + format: int32 + maximum: 599 + type: integer + title: + description: Short label describing the outcome for this finding. + example: "Bad Request" + type: string + required: + - finding_id + - status + - title + - detail + type: object + SeverityOverrideSet: + description: Applies a manual severity override to the findings. + properties: + action: + $ref: "#/components/schemas/SeverityOverrideSetActionType" + description: + description: Additional information about the severity change. This field has a limit of 280 characters. + example: "Database contains sensitive data." + maxLength: 280 + type: string + value: + $ref: "#/components/schemas/SeverityOverrideValue" + required: + - action + - value + type: object + SeverityOverrideSetActionType: + default: set + description: The action that applies a manual severity override. + enum: + - set + example: set + type: string + x-enum-varnames: + - SET + SeverityOverrideValue: + description: |- + Severity to apply to the findings. + `info` sets the lowest severity the finding type allows. + enum: + - critical + - high + - medium + - low + - info + example: high + type: string + x-enum-varnames: + - CRITICAL + - HIGH + - MEDIUM + - LOW + - INFO SharedDashboardGlobalTime: additionalProperties: {} description: Default time range configuration for the shared dashboard. @@ -221300,6 +221487,109 @@ paths: permissions: - security_monitoring_findings_write - appsec_vm_write + /api/v2/security/findings/severity: + patch: + description: |- + Set or clear the manual severity override of security findings. + + You can update up to 100 security findings per request. + Use the `set` action with a `value` to apply a manual severity override. + `value` is required for `set` and must be omitted for `clear`. + The `info` value sets the lowest severity the finding type allows. + Use the `clear` action to remove a manual severity override. + `clear` does not remove a severity set by an automation rule. + The optional `description` is accepted with both actions and has a limit of 280 characters. + + Auto-closed findings are excluded. + Findings whose severity was set by an automation rule are skipped and listed in the response `meta.warnings`. + If every finding is skipped this way, the request fails with a `400` error. + Findings that cannot be found are skipped without a warning. + The request fails with a `404` error only if none of the findings can be found. + operationId: UpdateFindingsSeverity + requestBody: + content: + application/json: + examples: + default: + value: + data: + attributes: + severity: + action: "set" + description: "Database contains sensitive data." + value: "high" + relationships: + findings: + data: + - id: "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==" + type: "findings" + - id: "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=" + type: "findings" + type: "severity_override" + schema: + $ref: "#/components/schemas/SeverityOverrideRequest" + required: true + responses: + "202": + content: + application/json: + examples: + default: + value: + data: + id: "00000000-0000-0000-0000-000000000001" + type: "severity_override" + meta: + warnings: + - detail: >- + cannot set severity on finding because it is overridden by an automation severity modifier rule; disable or update the automation rule first + finding_id: "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=" + status: 400 + title: "Bad Request" + schema: + $ref: "#/components/schemas/SeverityOverrideResponse" + description: Accepted + "400": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Bad Request + "401": + $ref: "#/components/responses/UnauthorizedResponse" + "403": + $ref: "#/components/responses/ForbiddenResponse" + "404": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Not Found + "422": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: "Unprocessable Entity" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: [] + summary: Override the severity of security findings + tags: + - "Security Monitoring" + x-codegen-request-body-name: body + "x-permission": + operator: OR + permissions: + - security_monitoring_findings_write + - appsec_vm_write + - data_scanner_write + x-unstable: |- + **Note**: This endpoint is in preview and is subject to change. + If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/sboms: get: description: |- diff --git a/examples/v2/security-monitoring/UpdateFindingsSeverity.py b/examples/v2/security-monitoring/UpdateFindingsSeverity.py new file mode 100644 index 0000000000..e7da9e0d6f --- /dev/null +++ b/examples/v2/security-monitoring/UpdateFindingsSeverity.py @@ -0,0 +1,53 @@ +""" +Override the severity of security findings returns "Accepted" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi +from datadog_api_client.v2.model.finding_data import FindingData +from datadog_api_client.v2.model.finding_data_type import FindingDataType +from datadog_api_client.v2.model.findings import Findings +from datadog_api_client.v2.model.severity_override_data_type import SeverityOverrideDataType +from datadog_api_client.v2.model.severity_override_request import SeverityOverrideRequest +from datadog_api_client.v2.model.severity_override_request_data import SeverityOverrideRequestData +from datadog_api_client.v2.model.severity_override_request_data_attributes import SeverityOverrideRequestDataAttributes +from datadog_api_client.v2.model.severity_override_request_data_relationships import ( + SeverityOverrideRequestDataRelationships, +) +from datadog_api_client.v2.model.severity_override_set import SeverityOverrideSet +from datadog_api_client.v2.model.severity_override_set_action_type import SeverityOverrideSetActionType +from datadog_api_client.v2.model.severity_override_value import SeverityOverrideValue + +body = SeverityOverrideRequest( + data=SeverityOverrideRequestData( + attributes=SeverityOverrideRequestDataAttributes( + severity=SeverityOverrideSet( + action=SeverityOverrideSetActionType.SET, + description="Database contains sensitive data.", + value=SeverityOverrideValue.HIGH, + ), + ), + id="00000000-0000-0000-0000-000000000001", + relationships=SeverityOverrideRequestDataRelationships( + findings=Findings( + data=[ + FindingData( + id="ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==", + type=FindingDataType.FINDINGS, + ), + ], + ), + ), + type=SeverityOverrideDataType.SEVERITY_OVERRIDE, + ), +) + +configuration = Configuration() +configuration.access_token = environ["DD_BEARER_TOKEN"] +configuration.unstable_operations["update_findings_severity"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + response = api_instance.update_findings_severity(body=body) + + print(response) diff --git a/examples/v2/security-monitoring/UpdateFindingsSeverity_1312693410.py b/examples/v2/security-monitoring/UpdateFindingsSeverity_1312693410.py new file mode 100644 index 0000000000..c80e173767 --- /dev/null +++ b/examples/v2/security-monitoring/UpdateFindingsSeverity_1312693410.py @@ -0,0 +1,49 @@ +""" +Clear the severity override of security findings returns "Accepted" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi +from datadog_api_client.v2.model.finding_data import FindingData +from datadog_api_client.v2.model.finding_data_type import FindingDataType +from datadog_api_client.v2.model.findings import Findings +from datadog_api_client.v2.model.severity_override_clear import SeverityOverrideClear +from datadog_api_client.v2.model.severity_override_clear_action_type import SeverityOverrideClearActionType +from datadog_api_client.v2.model.severity_override_data_type import SeverityOverrideDataType +from datadog_api_client.v2.model.severity_override_request import SeverityOverrideRequest +from datadog_api_client.v2.model.severity_override_request_data import SeverityOverrideRequestData +from datadog_api_client.v2.model.severity_override_request_data_attributes import SeverityOverrideRequestDataAttributes +from datadog_api_client.v2.model.severity_override_request_data_relationships import ( + SeverityOverrideRequestDataRelationships, +) + +body = SeverityOverrideRequest( + data=SeverityOverrideRequestData( + attributes=SeverityOverrideRequestDataAttributes( + severity=SeverityOverrideClear( + action=SeverityOverrideClearActionType.CLEAR, + ), + ), + relationships=SeverityOverrideRequestDataRelationships( + findings=Findings( + data=[ + FindingData( + id="ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=", + type=FindingDataType.FINDINGS, + ), + ], + ), + ), + type=SeverityOverrideDataType.SEVERITY_OVERRIDE, + ), +) + +configuration = Configuration() +configuration.access_token = environ["DD_BEARER_TOKEN"] +configuration.unstable_operations["update_findings_severity"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + response = api_instance.update_findings_severity(body=body) + + print(response) diff --git a/examples/v2/security-monitoring/UpdateFindingsSeverity_412359663.py b/examples/v2/security-monitoring/UpdateFindingsSeverity_412359663.py new file mode 100644 index 0000000000..1193da5c7e --- /dev/null +++ b/examples/v2/security-monitoring/UpdateFindingsSeverity_412359663.py @@ -0,0 +1,52 @@ +""" +Apply a severity override to security findings returns "Accepted" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi +from datadog_api_client.v2.model.finding_data import FindingData +from datadog_api_client.v2.model.finding_data_type import FindingDataType +from datadog_api_client.v2.model.findings import Findings +from datadog_api_client.v2.model.severity_override_data_type import SeverityOverrideDataType +from datadog_api_client.v2.model.severity_override_request import SeverityOverrideRequest +from datadog_api_client.v2.model.severity_override_request_data import SeverityOverrideRequestData +from datadog_api_client.v2.model.severity_override_request_data_attributes import SeverityOverrideRequestDataAttributes +from datadog_api_client.v2.model.severity_override_request_data_relationships import ( + SeverityOverrideRequestDataRelationships, +) +from datadog_api_client.v2.model.severity_override_set import SeverityOverrideSet +from datadog_api_client.v2.model.severity_override_set_action_type import SeverityOverrideSetActionType +from datadog_api_client.v2.model.severity_override_value import SeverityOverrideValue + +body = SeverityOverrideRequest( + data=SeverityOverrideRequestData( + attributes=SeverityOverrideRequestDataAttributes( + severity=SeverityOverrideSet( + action=SeverityOverrideSetActionType.SET, + description="Database contains sensitive data.", + value=SeverityOverrideValue.HIGH, + ), + ), + relationships=SeverityOverrideRequestDataRelationships( + findings=Findings( + data=[ + FindingData( + id="ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=", + type=FindingDataType.FINDINGS, + ), + ], + ), + ), + type=SeverityOverrideDataType.SEVERITY_OVERRIDE, + ), +) + +configuration = Configuration() +configuration.access_token = environ["DD_BEARER_TOKEN"] +configuration.unstable_operations["update_findings_severity"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + response = api_instance.update_findings_severity(body=body) + + print(response) diff --git a/src/datadog_api_client/configuration.py b/src/datadog_api_client/configuration.py index dcb0731661..621896f756 100644 --- a/src/datadog_api_client/configuration.py +++ b/src/datadog_api_client/configuration.py @@ -459,6 +459,7 @@ def __init__( "v2.run_historical_job": False, "v2.search_security_monitoring_histsignals": False, "v2.update_findings_assignee": False, + "v2.update_findings_severity": False, "v2.update_security_findings_automation_due_date_rule": False, "v2.update_security_findings_automation_inbox_rule": False, "v2.update_security_findings_automation_mute_rule": False, diff --git a/src/datadog_api_client/v2/api/security_monitoring_api.py b/src/datadog_api_client/v2/api/security_monitoring_api.py index 2240a4898b..f6bc499f02 100644 --- a/src/datadog_api_client/v2/api/security_monitoring_api.py +++ b/src/datadog_api_client/v2/api/security_monitoring_api.py @@ -88,6 +88,8 @@ from datadog_api_client.v2.model.security_findings_search_request import SecurityFindingsSearchRequest from datadog_api_client.v2.model.attach_service_now_ticket_request import AttachServiceNowTicketRequest from datadog_api_client.v2.model.create_service_now_ticket_request_array import CreateServiceNowTicketRequestArray +from datadog_api_client.v2.model.severity_override_response import SeverityOverrideResponse +from datadog_api_client.v2.model.severity_override_request import SeverityOverrideRequest from datadog_api_client.v2.model.list_assets_sbo_ms_response import ListAssetsSBOMsResponse from datadog_api_client.v2.model.asset_type import AssetType from datadog_api_client.v2.model.sbom_component_license_type import SBOMComponentLicenseType @@ -4723,6 +4725,26 @@ def __init__(self, api_client=None): api_client=api_client, ) + self._update_findings_severity_endpoint = _Endpoint( + settings={ + "response_type": (SeverityOverrideResponse,), + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security/findings/severity", + "operation_id": "update_findings_severity", + "http_method": "PATCH", + "version": "v2", + }, + params_map={ + "body": { + "required": True, + "openapi_types": (SeverityOverrideRequest,), + "location": "body", + }, + }, + headers_map={"accept": ["application/json"], "content_type": ["application/json"]}, + api_client=api_client, + ) + self._update_resource_evaluation_filters_endpoint = _Endpoint( settings={ "response_type": (UpdateResourceEvaluationFiltersResponse,), @@ -9566,6 +9588,36 @@ def update_findings_assignee( return self._update_findings_assignee_endpoint.call_with_http_info(**kwargs) + def update_findings_severity( + self, + body: SeverityOverrideRequest, + ) -> SeverityOverrideResponse: + """Override the severity of security findings. + + Set or clear the manual severity override of security findings. + + You can update up to 100 security findings per request. + Use the ``set`` action with a ``value`` to apply a manual severity override. + ``value`` is required for ``set`` and must be omitted for ``clear``. + The ``info`` value sets the lowest severity the finding type allows. + Use the ``clear`` action to remove a manual severity override. + ``clear`` does not remove a severity set by an automation rule. + The optional ``description`` is accepted with both actions and has a limit of 280 characters. + + Auto-closed findings are excluded. + Findings whose severity was set by an automation rule are skipped and listed in the response ``meta.warnings``. + If every finding is skipped this way, the request fails with a ``400`` error. + Findings that cannot be found are skipped without a warning. + The request fails with a ``404`` error only if none of the findings can be found. + + :type body: SeverityOverrideRequest + :rtype: SeverityOverrideResponse + """ + kwargs: Dict[str, Any] = {} + kwargs["body"] = body + + return self._update_findings_severity_endpoint.call_with_http_info(**kwargs) + def update_resource_evaluation_filters( self, body: UpdateResourceEvaluationFiltersRequest, diff --git a/src/datadog_api_client/v2/model/severity_override_attributes.py b/src/datadog_api_client/v2/model/severity_override_attributes.py new file mode 100644 index 0000000000..c42e240569 --- /dev/null +++ b/src/datadog_api_client/v2/model/severity_override_attributes.py @@ -0,0 +1,49 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelComposed, + cached_property, +) + + +class SeverityOverrideAttributes(ModelComposed): + def __init__(self, **kwargs): + """ + Severity override to apply to the findings. + Set ``action`` to ``set`` to apply a manual severity override with the given ``value``. + Set ``action`` to ``clear`` to remove a manual severity override. + + :param action: The action that applies a manual severity override. + :type action: SeverityOverrideSetActionType + + :param description: Additional information about the severity change. This field has a limit of 280 characters. + :type description: str, optional + + :param value: Severity to apply to the findings. + `info` sets the lowest severity the finding type allows. + :type value: SeverityOverrideValue + """ + super().__init__(kwargs) + + @cached_property + def _composed_schemas(_): + # we need this here to make our import statements work + # we must store _composed_schemas in here so the code is only run + # when we invoke this method. If we kept this at the class + # level we would get an error because the class level + # code would be run when this module is imported, and these composed + # classes don't exist yet because their module has not finished + # loading + from datadog_api_client.v2.model.severity_override_set import SeverityOverrideSet + from datadog_api_client.v2.model.severity_override_clear import SeverityOverrideClear + + return { + "oneOf": [ + SeverityOverrideSet, + SeverityOverrideClear, + ], + } diff --git a/src/datadog_api_client/v2/model/severity_override_clear.py b/src/datadog_api_client/v2/model/severity_override_clear.py new file mode 100644 index 0000000000..fa63c115f7 --- /dev/null +++ b/src/datadog_api_client/v2/model/severity_override_clear.py @@ -0,0 +1,56 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Union, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.severity_override_clear_action_type import SeverityOverrideClearActionType + + +class SeverityOverrideClear(ModelNormal): + validations = { + "description": { + "max_length": 280, + }, + } + + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.severity_override_clear_action_type import SeverityOverrideClearActionType + + return { + "action": (SeverityOverrideClearActionType,), + "description": (str,), + } + + attribute_map = { + "action": "action", + "description": "description", + } + + def __init__(self_, action: SeverityOverrideClearActionType, description: Union[str, UnsetType] = unset, **kwargs): + """ + Removes the manual severity override of the findings. + This action does not remove a severity set by an automation rule. + + :param action: The action that removes a manual severity override. + :type action: SeverityOverrideClearActionType + + :param description: Additional information about the severity change. This field has a limit of 280 characters. + :type description: str, optional + """ + if description is not unset: + kwargs["description"] = description + super().__init__(kwargs) + + self_.action = action diff --git a/src/datadog_api_client/v2/model/severity_override_clear_action_type.py b/src/datadog_api_client/v2/model/severity_override_clear_action_type.py new file mode 100644 index 0000000000..6f6a0c2be5 --- /dev/null +++ b/src/datadog_api_client/v2/model/severity_override_clear_action_type.py @@ -0,0 +1,35 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelSimple, + cached_property, +) + +from typing import ClassVar + + +class SeverityOverrideClearActionType(ModelSimple): + """ + The action that removes a manual severity override. + + :param value: If omitted defaults to "clear". Must be one of ["clear"]. + :type value: str + """ + + allowed_values = { + "clear", + } + CLEAR: ClassVar["SeverityOverrideClearActionType"] + + @cached_property + def openapi_types(_): + return { + "value": (str,), + } + + +SeverityOverrideClearActionType.CLEAR = SeverityOverrideClearActionType("clear") diff --git a/src/datadog_api_client/v2/model/severity_override_data_type.py b/src/datadog_api_client/v2/model/severity_override_data_type.py new file mode 100644 index 0000000000..5225b51322 --- /dev/null +++ b/src/datadog_api_client/v2/model/severity_override_data_type.py @@ -0,0 +1,35 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelSimple, + cached_property, +) + +from typing import ClassVar + + +class SeverityOverrideDataType(ModelSimple): + """ + Severity override resource type. + + :param value: If omitted defaults to "severity_override". Must be one of ["severity_override"]. + :type value: str + """ + + allowed_values = { + "severity_override", + } + SEVERITY_OVERRIDE: ClassVar["SeverityOverrideDataType"] + + @cached_property + def openapi_types(_): + return { + "value": (str,), + } + + +SeverityOverrideDataType.SEVERITY_OVERRIDE = SeverityOverrideDataType("severity_override") diff --git a/src/datadog_api_client/v2/model/severity_override_request.py b/src/datadog_api_client/v2/model/severity_override_request.py new file mode 100644 index 0000000000..eec82f4877 --- /dev/null +++ b/src/datadog_api_client/v2/model/severity_override_request.py @@ -0,0 +1,40 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.severity_override_request_data import SeverityOverrideRequestData + + +class SeverityOverrideRequest(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.severity_override_request_data import SeverityOverrideRequestData + + return { + "data": (SeverityOverrideRequestData,), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: SeverityOverrideRequestData, **kwargs): + """ + Request to set or clear the manual severity override of security findings. + + :param data: Data of the severity override request. + :type data: SeverityOverrideRequestData + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/severity_override_request_data.py b/src/datadog_api_client/v2/model/severity_override_request_data.py new file mode 100644 index 0000000000..a1c9c3ed1a --- /dev/null +++ b/src/datadog_api_client/v2/model/severity_override_request_data.py @@ -0,0 +1,80 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Union, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.severity_override_request_data_attributes import ( + SeverityOverrideRequestDataAttributes, + ) + from datadog_api_client.v2.model.severity_override_request_data_relationships import ( + SeverityOverrideRequestDataRelationships, + ) + from datadog_api_client.v2.model.severity_override_data_type import SeverityOverrideDataType + + +class SeverityOverrideRequestData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.severity_override_request_data_attributes import ( + SeverityOverrideRequestDataAttributes, + ) + from datadog_api_client.v2.model.severity_override_request_data_relationships import ( + SeverityOverrideRequestDataRelationships, + ) + from datadog_api_client.v2.model.severity_override_data_type import SeverityOverrideDataType + + return { + "attributes": (SeverityOverrideRequestDataAttributes,), + "id": (str,), + "relationships": (SeverityOverrideRequestDataRelationships,), + "type": (SeverityOverrideDataType,), + } + + attribute_map = { + "attributes": "attributes", + "id": "id", + "relationships": "relationships", + "type": "type", + } + + def __init__( + self_, + attributes: SeverityOverrideRequestDataAttributes, + relationships: SeverityOverrideRequestDataRelationships, + type: SeverityOverrideDataType, + id: Union[str, UnsetType] = unset, + **kwargs, + ): + """ + Data of the severity override request. + + :param attributes: Attributes of the severity override request. + :type attributes: SeverityOverrideRequestDataAttributes + + :param id: Unique identifier of the severity override request. If not provided, an identifier is generated. + :type id: str, optional + + :param relationships: Relationships of the severity override request. + :type relationships: SeverityOverrideRequestDataRelationships + + :param type: Severity override resource type. + :type type: SeverityOverrideDataType + """ + if id is not unset: + kwargs["id"] = id + super().__init__(kwargs) + + self_.attributes = attributes + self_.relationships = relationships + self_.type = type diff --git a/src/datadog_api_client/v2/model/severity_override_request_data_attributes.py b/src/datadog_api_client/v2/model/severity_override_request_data_attributes.py new file mode 100644 index 0000000000..aef082dcae --- /dev/null +++ b/src/datadog_api_client/v2/model/severity_override_request_data_attributes.py @@ -0,0 +1,46 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Union, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.severity_override_attributes import SeverityOverrideAttributes + from datadog_api_client.v2.model.severity_override_set import SeverityOverrideSet + from datadog_api_client.v2.model.severity_override_clear import SeverityOverrideClear + + +class SeverityOverrideRequestDataAttributes(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.severity_override_attributes import SeverityOverrideAttributes + + return { + "severity": (SeverityOverrideAttributes,), + } + + attribute_map = { + "severity": "severity", + } + + def __init__( + self_, severity: Union[SeverityOverrideAttributes, SeverityOverrideSet, SeverityOverrideClear], **kwargs + ): + """ + Attributes of the severity override request. + + :param severity: Severity override to apply to the findings. + Set ``action`` to ``set`` to apply a manual severity override with the given ``value``. + Set ``action`` to ``clear`` to remove a manual severity override. + :type severity: SeverityOverrideAttributes + """ + super().__init__(kwargs) + + self_.severity = severity diff --git a/src/datadog_api_client/v2/model/severity_override_request_data_relationships.py b/src/datadog_api_client/v2/model/severity_override_request_data_relationships.py new file mode 100644 index 0000000000..f678a75251 --- /dev/null +++ b/src/datadog_api_client/v2/model/severity_override_request_data_relationships.py @@ -0,0 +1,40 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.findings import Findings + + +class SeverityOverrideRequestDataRelationships(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.findings import Findings + + return { + "findings": (Findings,), + } + + attribute_map = { + "findings": "findings", + } + + def __init__(self_, findings: Findings, **kwargs): + """ + Relationships of the severity override request. + + :param findings: A list of security findings. + :type findings: Findings + """ + super().__init__(kwargs) + + self_.findings = findings diff --git a/src/datadog_api_client/v2/model/severity_override_response.py b/src/datadog_api_client/v2/model/severity_override_response.py new file mode 100644 index 0000000000..9f0f83e3d8 --- /dev/null +++ b/src/datadog_api_client/v2/model/severity_override_response.py @@ -0,0 +1,56 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Union, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.severity_override_response_data import SeverityOverrideResponseData + from datadog_api_client.v2.model.severity_override_response_meta import SeverityOverrideResponseMeta + + +class SeverityOverrideResponse(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.severity_override_response_data import SeverityOverrideResponseData + from datadog_api_client.v2.model.severity_override_response_meta import SeverityOverrideResponseMeta + + return { + "data": (SeverityOverrideResponseData,), + "meta": (SeverityOverrideResponseMeta,), + } + + attribute_map = { + "data": "data", + "meta": "meta", + } + + def __init__( + self_, + data: SeverityOverrideResponseData, + meta: Union[SeverityOverrideResponseMeta, UnsetType] = unset, + **kwargs, + ): + """ + Response for the severity override request. + + :param data: Data of the severity override response. + :type data: SeverityOverrideResponseData + + :param meta: Security findings skipped while processing the severity override request. + :type meta: SeverityOverrideResponseMeta, optional + """ + if meta is not unset: + kwargs["meta"] = meta + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/severity_override_response_data.py b/src/datadog_api_client/v2/model/severity_override_response_data.py new file mode 100644 index 0000000000..e4c91d86c5 --- /dev/null +++ b/src/datadog_api_client/v2/model/severity_override_response_data.py @@ -0,0 +1,46 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.severity_override_data_type import SeverityOverrideDataType + + +class SeverityOverrideResponseData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.severity_override_data_type import SeverityOverrideDataType + + return { + "id": (str,), + "type": (SeverityOverrideDataType,), + } + + attribute_map = { + "id": "id", + "type": "type", + } + + def __init__(self_, id: str, type: SeverityOverrideDataType, **kwargs): + """ + Data of the severity override response. + + :param id: Unique identifier of the severity override request. + :type id: str + + :param type: Severity override resource type. + :type type: SeverityOverrideDataType + """ + super().__init__(kwargs) + + self_.id = id + self_.type = type diff --git a/src/datadog_api_client/v2/model/severity_override_response_meta.py b/src/datadog_api_client/v2/model/severity_override_response_meta.py new file mode 100644 index 0000000000..3c8628e3f0 --- /dev/null +++ b/src/datadog_api_client/v2/model/severity_override_response_meta.py @@ -0,0 +1,42 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import List, Union, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.severity_override_result import SeverityOverrideResult + + +class SeverityOverrideResponseMeta(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.severity_override_result import SeverityOverrideResult + + return { + "warnings": ([SeverityOverrideResult],), + } + + attribute_map = { + "warnings": "warnings", + } + + def __init__(self_, warnings: Union[List[SeverityOverrideResult], UnsetType] = unset, **kwargs): + """ + Security findings skipped while processing the severity override request. + + :param warnings: Findings skipped because an automation rule set their severity. + :type warnings: [SeverityOverrideResult], optional + """ + if warnings is not unset: + kwargs["warnings"] = warnings + super().__init__(kwargs) diff --git a/src/datadog_api_client/v2/model/severity_override_result.py b/src/datadog_api_client/v2/model/severity_override_result.py new file mode 100644 index 0000000000..cc01280555 --- /dev/null +++ b/src/datadog_api_client/v2/model/severity_override_result.py @@ -0,0 +1,57 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +class SeverityOverrideResult(ModelNormal): + validations = { + "status": { + "inclusive_maximum": 599, + }, + } + + @cached_property + def openapi_types(_): + return { + "detail": (str,), + "finding_id": (str,), + "status": (int,), + "title": (str,), + } + + attribute_map = { + "detail": "detail", + "finding_id": "finding_id", + "status": "status", + "title": "title", + } + + def __init__(self_, detail: str, finding_id: str, status: int, title: str, **kwargs): + """ + Per-finding outcome of a severity override operation. + + :param detail: Human-readable explanation of why the finding was skipped. + :type detail: str + + :param finding_id: Unique identifier of the security finding. + :type finding_id: str + + :param status: HTTP-like status code describing the outcome for this finding. + :type status: int + + :param title: Short label describing the outcome for this finding. + :type title: str + """ + super().__init__(kwargs) + + self_.detail = detail + self_.finding_id = finding_id + self_.status = status + self_.title = title diff --git a/src/datadog_api_client/v2/model/severity_override_set.py b/src/datadog_api_client/v2/model/severity_override_set.py new file mode 100644 index 0000000000..1cca2eb10b --- /dev/null +++ b/src/datadog_api_client/v2/model/severity_override_set.py @@ -0,0 +1,70 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Union, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.severity_override_set_action_type import SeverityOverrideSetActionType + from datadog_api_client.v2.model.severity_override_value import SeverityOverrideValue + + +class SeverityOverrideSet(ModelNormal): + validations = { + "description": { + "max_length": 280, + }, + } + + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.severity_override_set_action_type import SeverityOverrideSetActionType + from datadog_api_client.v2.model.severity_override_value import SeverityOverrideValue + + return { + "action": (SeverityOverrideSetActionType,), + "description": (str,), + "value": (SeverityOverrideValue,), + } + + attribute_map = { + "action": "action", + "description": "description", + "value": "value", + } + + def __init__( + self_, + action: SeverityOverrideSetActionType, + value: SeverityOverrideValue, + description: Union[str, UnsetType] = unset, + **kwargs, + ): + """ + Applies a manual severity override to the findings. + + :param action: The action that applies a manual severity override. + :type action: SeverityOverrideSetActionType + + :param description: Additional information about the severity change. This field has a limit of 280 characters. + :type description: str, optional + + :param value: Severity to apply to the findings. + ``info`` sets the lowest severity the finding type allows. + :type value: SeverityOverrideValue + """ + if description is not unset: + kwargs["description"] = description + super().__init__(kwargs) + + self_.action = action + self_.value = value diff --git a/src/datadog_api_client/v2/model/severity_override_set_action_type.py b/src/datadog_api_client/v2/model/severity_override_set_action_type.py new file mode 100644 index 0000000000..bf67a4629a --- /dev/null +++ b/src/datadog_api_client/v2/model/severity_override_set_action_type.py @@ -0,0 +1,35 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelSimple, + cached_property, +) + +from typing import ClassVar + + +class SeverityOverrideSetActionType(ModelSimple): + """ + The action that applies a manual severity override. + + :param value: If omitted defaults to "set". Must be one of ["set"]. + :type value: str + """ + + allowed_values = { + "set", + } + SET: ClassVar["SeverityOverrideSetActionType"] + + @cached_property + def openapi_types(_): + return { + "value": (str,), + } + + +SeverityOverrideSetActionType.SET = SeverityOverrideSetActionType("set") diff --git a/src/datadog_api_client/v2/model/severity_override_value.py b/src/datadog_api_client/v2/model/severity_override_value.py new file mode 100644 index 0000000000..de134a4cb0 --- /dev/null +++ b/src/datadog_api_client/v2/model/severity_override_value.py @@ -0,0 +1,48 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelSimple, + cached_property, +) + +from typing import ClassVar + + +class SeverityOverrideValue(ModelSimple): + """ + Severity to apply to the findings. + `info` sets the lowest severity the finding type allows. + + :param value: Must be one of ["critical", "high", "medium", "low", "info"]. + :type value: str + """ + + allowed_values = { + "critical", + "high", + "medium", + "low", + "info", + } + CRITICAL: ClassVar["SeverityOverrideValue"] + HIGH: ClassVar["SeverityOverrideValue"] + MEDIUM: ClassVar["SeverityOverrideValue"] + LOW: ClassVar["SeverityOverrideValue"] + INFO: ClassVar["SeverityOverrideValue"] + + @cached_property + def openapi_types(_): + return { + "value": (str,), + } + + +SeverityOverrideValue.CRITICAL = SeverityOverrideValue("critical") +SeverityOverrideValue.HIGH = SeverityOverrideValue("high") +SeverityOverrideValue.MEDIUM = SeverityOverrideValue("medium") +SeverityOverrideValue.LOW = SeverityOverrideValue("low") +SeverityOverrideValue.INFO = SeverityOverrideValue("info") diff --git a/src/datadog_api_client/v2/models/__init__.py b/src/datadog_api_client/v2/models/__init__.py index 6347854124..7f88beb832 100644 --- a/src/datadog_api_client/v2/models/__init__.py +++ b/src/datadog_api_client/v2/models/__init__.py @@ -10657,6 +10657,23 @@ from datadog_api_client.v2.model.severity_modifier_rules_response import SeverityModifierRulesResponse from datadog_api_client.v2.model.severity_modifier_severity import SeverityModifierSeverity from datadog_api_client.v2.model.severity_modifier_severity_delta import SeverityModifierSeverityDelta +from datadog_api_client.v2.model.severity_override_attributes import SeverityOverrideAttributes +from datadog_api_client.v2.model.severity_override_clear import SeverityOverrideClear +from datadog_api_client.v2.model.severity_override_clear_action_type import SeverityOverrideClearActionType +from datadog_api_client.v2.model.severity_override_data_type import SeverityOverrideDataType +from datadog_api_client.v2.model.severity_override_request import SeverityOverrideRequest +from datadog_api_client.v2.model.severity_override_request_data import SeverityOverrideRequestData +from datadog_api_client.v2.model.severity_override_request_data_attributes import SeverityOverrideRequestDataAttributes +from datadog_api_client.v2.model.severity_override_request_data_relationships import ( + SeverityOverrideRequestDataRelationships, +) +from datadog_api_client.v2.model.severity_override_response import SeverityOverrideResponse +from datadog_api_client.v2.model.severity_override_response_data import SeverityOverrideResponseData +from datadog_api_client.v2.model.severity_override_response_meta import SeverityOverrideResponseMeta +from datadog_api_client.v2.model.severity_override_result import SeverityOverrideResult +from datadog_api_client.v2.model.severity_override_set import SeverityOverrideSet +from datadog_api_client.v2.model.severity_override_set_action_type import SeverityOverrideSetActionType +from datadog_api_client.v2.model.severity_override_value import SeverityOverrideValue from datadog_api_client.v2.model.shared_dashboard_global_time import SharedDashboardGlobalTime from datadog_api_client.v2.model.shared_dashboard_included import SharedDashboardIncluded from datadog_api_client.v2.model.shared_dashboard_included_dashboard import SharedDashboardIncludedDashboard @@ -19655,6 +19672,21 @@ "SeverityModifierRulesResponse", "SeverityModifierSeverity", "SeverityModifierSeverityDelta", + "SeverityOverrideAttributes", + "SeverityOverrideClear", + "SeverityOverrideClearActionType", + "SeverityOverrideDataType", + "SeverityOverrideRequest", + "SeverityOverrideRequestData", + "SeverityOverrideRequestDataAttributes", + "SeverityOverrideRequestDataRelationships", + "SeverityOverrideResponse", + "SeverityOverrideResponseData", + "SeverityOverrideResponseMeta", + "SeverityOverrideResult", + "SeverityOverrideSet", + "SeverityOverrideSetActionType", + "SeverityOverrideValue", "SharedDashboardGlobalTime", "SharedDashboardIncluded", "SharedDashboardIncludedDashboard", diff --git a/tests/generated-test/test-runner-data/manifest.json b/tests/generated-test/test-runner-data/manifest.json index 9c9bacbbec..08eb2c46ea 100644 --- a/tests/generated-test/test-runner-data/manifest.json +++ b/tests/generated-test/test-runner-data/manifest.json @@ -9513,6 +9513,27 @@ "scenario": "Unassign seats from users returns \"Unprocessable Entity\" response when user_uuids is empty", "version": "v2" }, + { + "feature": "Security Monitoring", + "feature_file": "../../v2/features/security_monitoring.feature", + "file": "v2/security-monitoring/apply-a-severity-override-to-security-findings-returns-accepted-response.json", + "scenario": "Apply a severity override to security findings returns \"Accepted\" response", + "version": "v2" + }, + { + "feature": "Security Monitoring", + "feature_file": "../../v2/features/security_monitoring.feature", + "file": "v2/security-monitoring/apply-a-severity-override-to-security-findings-returns-not-found-response.json", + "scenario": "Apply a severity override to security findings returns \"Not Found\" response", + "version": "v2" + }, + { + "feature": "Security Monitoring", + "feature_file": "../../v2/features/security_monitoring.feature", + "file": "v2/security-monitoring/apply-a-severity-override-to-security-findings-returns-unprocessable-entity-response.json", + "scenario": "Apply a severity override to security findings returns \"Unprocessable Entity\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "feature_file": "../../v2/features/security_monitoring.feature", @@ -9611,6 +9632,13 @@ "scenario": "Change the triage state of a security signal returns \"OK\" response", "version": "v2" }, + { + "feature": "Security Monitoring", + "feature_file": "../../v2/features/security_monitoring.feature", + "file": "v2/security-monitoring/clear-the-severity-override-of-security-findings-returns-accepted-response.json", + "scenario": "Clear the severity override of security findings returns \"Accepted\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "feature_file": "../../v2/features/security_monitoring.feature", diff --git a/tests/generated-test/test-runner-data/v2/security-monitoring/apply-a-severity-override-to-security-findings-returns-accepted-response.json b/tests/generated-test/test-runner-data/v2/security-monitoring/apply-a-severity-override-to-security-findings-returns-accepted-response.json new file mode 100644 index 0000000000..15e7f6b659 --- /dev/null +++ b/tests/generated-test/test-runner-data/v2/security-monitoring/apply-a-severity-override-to-security-findings-returns-accepted-response.json @@ -0,0 +1,47 @@ +{ + "api": "SecurityMonitoring", + "expected_status": 202, + "feature": "Security Monitoring", + "id": "v2/Security Monitoring/Apply a severity override to security findings returns \"Accepted\" response", + "operation_id": "UpdateFindingsSeverity", + "request": { + "body": { + "schema": { + "format": null, + "ref": "SeverityOverrideRequest", + "type": "object" + }, + "source": "inline", + "value": { + "data": { + "attributes": { + "severity": { + "action": "set", + "description": "Database contains sensitive data.", + "value": "high" + } + }, + "relationships": { + "findings": { + "data": [ + { + "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=", + "type": "findings" + } + ] + } + }, + "type": "severity_override" + } + } + }, + "content_type": "application/json", + "method": "PATCH", + "pagination": false, + "parameters": [], + "path": "/api/v2/security/findings/severity" + }, + "scenario": "Apply a severity override to security findings returns \"Accepted\" response", + "schema_version": 1, + "version": "v2" +} diff --git a/tests/generated-test/test-runner-data/v2/security-monitoring/apply-a-severity-override-to-security-findings-returns-not-found-response.json b/tests/generated-test/test-runner-data/v2/security-monitoring/apply-a-severity-override-to-security-findings-returns-not-found-response.json new file mode 100644 index 0000000000..006a1972a7 --- /dev/null +++ b/tests/generated-test/test-runner-data/v2/security-monitoring/apply-a-severity-override-to-security-findings-returns-not-found-response.json @@ -0,0 +1,46 @@ +{ + "api": "SecurityMonitoring", + "expected_status": 404, + "feature": "Security Monitoring", + "id": "v2/Security Monitoring/Apply a severity override to security findings returns \"Not Found\" response", + "operation_id": "UpdateFindingsSeverity", + "request": { + "body": { + "schema": { + "format": null, + "ref": "SeverityOverrideRequest", + "type": "object" + }, + "source": "inline", + "value": { + "data": { + "attributes": { + "severity": { + "action": "set", + "value": "high" + } + }, + "relationships": { + "findings": { + "data": [ + { + "id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==", + "type": "findings" + } + ] + } + }, + "type": "severity_override" + } + } + }, + "content_type": "application/json", + "method": "PATCH", + "pagination": false, + "parameters": [], + "path": "/api/v2/security/findings/severity" + }, + "scenario": "Apply a severity override to security findings returns \"Not Found\" response", + "schema_version": 1, + "version": "v2" +} diff --git a/tests/generated-test/test-runner-data/v2/security-monitoring/apply-a-severity-override-to-security-findings-returns-unprocessable-entity-response.json b/tests/generated-test/test-runner-data/v2/security-monitoring/apply-a-severity-override-to-security-findings-returns-unprocessable-entity-response.json new file mode 100644 index 0000000000..4a7f61feb9 --- /dev/null +++ b/tests/generated-test/test-runner-data/v2/security-monitoring/apply-a-severity-override-to-security-findings-returns-unprocessable-entity-response.json @@ -0,0 +1,45 @@ +{ + "api": "SecurityMonitoring", + "expected_status": 422, + "feature": "Security Monitoring", + "id": "v2/Security Monitoring/Apply a severity override to security findings returns \"Unprocessable Entity\" response", + "operation_id": "UpdateFindingsSeverity", + "request": { + "body": { + "schema": { + "format": null, + "ref": "SeverityOverrideRequest", + "type": "object" + }, + "source": "inline", + "value": { + "data": { + "attributes": { + "severity": { + "action": "set" + } + }, + "relationships": { + "findings": { + "data": [ + { + "id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==", + "type": "findings" + } + ] + } + }, + "type": "severity_override" + } + } + }, + "content_type": "application/json", + "method": "PATCH", + "pagination": false, + "parameters": [], + "path": "/api/v2/security/findings/severity" + }, + "scenario": "Apply a severity override to security findings returns \"Unprocessable Entity\" response", + "schema_version": 1, + "version": "v2" +} diff --git a/tests/generated-test/test-runner-data/v2/security-monitoring/clear-the-severity-override-of-security-findings-returns-accepted-response.json b/tests/generated-test/test-runner-data/v2/security-monitoring/clear-the-severity-override-of-security-findings-returns-accepted-response.json new file mode 100644 index 0000000000..3eee9e3054 --- /dev/null +++ b/tests/generated-test/test-runner-data/v2/security-monitoring/clear-the-severity-override-of-security-findings-returns-accepted-response.json @@ -0,0 +1,45 @@ +{ + "api": "SecurityMonitoring", + "expected_status": 202, + "feature": "Security Monitoring", + "id": "v2/Security Monitoring/Clear the severity override of security findings returns \"Accepted\" response", + "operation_id": "UpdateFindingsSeverity", + "request": { + "body": { + "schema": { + "format": null, + "ref": "SeverityOverrideRequest", + "type": "object" + }, + "source": "inline", + "value": { + "data": { + "attributes": { + "severity": { + "action": "clear" + } + }, + "relationships": { + "findings": { + "data": [ + { + "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=", + "type": "findings" + } + ] + } + }, + "type": "severity_override" + } + } + }, + "content_type": "application/json", + "method": "PATCH", + "pagination": false, + "parameters": [], + "path": "/api/v2/security/findings/severity" + }, + "scenario": "Clear the severity override of security findings returns \"Accepted\" response", + "schema_version": 1, + "version": "v2" +} diff --git a/tests/generated-test/test-server-data/v2/security-monitoring.json b/tests/generated-test/test-server-data/v2/security-monitoring.json index 4aaa1af1cf..43e65f4bef 100644 --- a/tests/generated-test/test-server-data/v2/security-monitoring.json +++ b/tests/generated-test/test-server-data/v2/security-monitoring.json @@ -1,6 +1,159 @@ { "feature": "Security Monitoring", "recordings": [ + { + "feature": "Security Monitoring", + "frozen_at": "2026-10-08T12:23:32.869Z", + "interactions": [ + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "attributes": { + "severity": { + "action": "set", + "description": "Database contains sensitive data.", + "value": "high" + } + }, + "relationships": { + "findings": { + "data": [ + { + "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=", + "type": "findings" + } + ] + } + }, + "type": "severity_override" + } + } + }, + "content_type": "application/json", + "method": "PATCH", + "path": "/api/v2/security/findings/severity", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":{\"id\":\"ac66db29-c96f-45f2-bd4b-69f753400a9d\",\"type\":\"severity_override\"}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "Accepted", + "status": 202 + } + } + ], + "scenario": "Apply a severity override to security findings returns \"Accepted\" response", + "version": "v2" + }, + { + "feature": "Security Monitoring", + "frozen_at": "2026-10-08T12:23:35.263Z", + "interactions": [ + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "attributes": { + "severity": { + "action": "set", + "value": "high" + } + }, + "relationships": { + "findings": { + "data": [ + { + "id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==", + "type": "findings" + } + ] + } + }, + "type": "severity_override" + } + } + }, + "content_type": "application/json", + "method": "PATCH", + "path": "/api/v2/security/findings/severity", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"errors\":[{\"status\":\"404\",\"title\":\"Not Found\",\"detail\":\"finding not found\"}]}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "Not Found", + "status": 404 + } + } + ], + "scenario": "Apply a severity override to security findings returns \"Not Found\" response", + "version": "v2" + }, + { + "feature": "Security Monitoring", + "frozen_at": "2026-10-08T12:23:35.347Z", + "interactions": [ + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "attributes": { + "severity": { + "action": "set" + } + }, + "relationships": { + "findings": { + "data": [ + { + "id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==", + "type": "findings" + } + ] + } + }, + "type": "severity_override" + } + } + }, + "content_type": "application/json", + "method": "PATCH", + "path": "/api/v2/security/findings/severity", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"errors\":[{\"title\":\"Generic Error\",\"detail\":\"invalid severity value \\\"\\\" for action \\\"set\\\": must be one of info, low, medium, high, critical\"}]}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "Unprocessable Entity", + "status": 422 + } + } + ], + "scenario": "Apply a severity override to security findings returns \"Unprocessable Entity\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "frozen_at": "2025-11-20T15:49:48.969Z", @@ -739,6 +892,56 @@ "scenario": "Change the triage state of a security signal returns \"OK\" response", "version": "v2" }, + { + "feature": "Security Monitoring", + "frozen_at": "2026-10-08T12:23:35.440Z", + "interactions": [ + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "attributes": { + "severity": { + "action": "clear" + } + }, + "relationships": { + "findings": { + "data": [ + { + "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=", + "type": "findings" + } + ] + } + }, + "type": "severity_override" + } + } + }, + "content_type": "application/json", + "method": "PATCH", + "path": "/api/v2/security/findings/severity", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":{\"id\":\"a1cea0d7-e53b-4e44-a914-c90343617a70\",\"type\":\"severity_override\"}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "Accepted", + "status": 202 + } + } + ], + "scenario": "Clear the severity override of security findings returns \"Accepted\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "frozen_at": "2026-05-26T20:46:00.730Z", diff --git a/tests/v2/features/security_monitoring.feature b/tests/v2/features/security_monitoring.feature index 58e774ce38..3a2ac120f4 100644 --- a/tests/v2/features/security_monitoring.feature +++ b/tests/v2/features/security_monitoring.feature @@ -68,6 +68,31 @@ Feature: Security Monitoring When the request is sent Then the response status is 200 OK + @team:ddoghq/k9-investigation + Scenario: Apply a severity override to security findings returns "Accepted" response + Given operation "UpdateFindingsSeverity" enabled + And new "UpdateFindingsSeverity" request + And body with value {"data": {"attributes": {"severity": {"action": "set", "description": "Database contains sensitive data.", "value": "high"}}, "relationships": {"findings": {"data": [{"id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=", "type": "findings"}]}}, "type": "severity_override"}} + When the request is sent + Then the response status is 202 Accepted + And the response "data.type" is equal to "severity_override" + + @team:ddoghq/k9-investigation + Scenario: Apply a severity override to security findings returns "Not Found" response + Given operation "UpdateFindingsSeverity" enabled + And new "UpdateFindingsSeverity" request + And body with value {"data": {"attributes": {"severity": {"action": "set", "value": "high"}}, "relationships": {"findings": {"data": [{"id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==", "type": "findings"}]}}, "type": "severity_override"}} + When the request is sent + Then the response status is 404 Not Found + + @skip-validation @team:ddoghq/k9-investigation + Scenario: Apply a severity override to security findings returns "Unprocessable Entity" response + Given operation "UpdateFindingsSeverity" enabled + And new "UpdateFindingsSeverity" request + And body with value {"data": {"attributes": {"severity": {"action": "set"}}, "relationships": {"findings": {"data": [{"id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==", "type": "findings"}]}}, "type": "severity_override"}} + When the request is sent + Then the response status is 422 Unprocessable Entity + @generated @skip @team:ddoghq/k9-investigation Scenario: Assign or unassign security findings returns "Accepted" response Given operation "UpdateFindingsAssignee" enabled @@ -414,6 +439,15 @@ Feature: Security Monitoring When the request is sent Then the response status is 200 OK + @team:ddoghq/k9-investigation + Scenario: Clear the severity override of security findings returns "Accepted" response + Given operation "UpdateFindingsSeverity" enabled + And new "UpdateFindingsSeverity" request + And body with value {"data": {"attributes": {"severity": {"action": "clear"}}, "relationships": {"findings": {"data": [{"id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=", "type": "findings"}]}}, "type": "severity_override"}} + When the request is sent + Then the response status is 202 Accepted + And the response "data.type" is equal to "severity_override" + @team:ddoghq/cloud-siem Scenario: Convert a job result to a signal returns "Bad Request" response Given operation "ConvertJobResultToSignal" enabled @@ -3079,6 +3113,38 @@ Feature: Security Monitoring When the request is sent Then the response status is 422 Unprocessable Entity + @generated @skip @team:ddoghq/k9-investigation + Scenario: Override the severity of security findings returns "Accepted" response + Given operation "UpdateFindingsSeverity" enabled + And new "UpdateFindingsSeverity" request + And body with value {"data": {"attributes": {"severity": {"action": "set", "description": "Database contains sensitive data.", "value": "high"}}, "id": "00000000-0000-0000-0000-000000000001", "relationships": {"findings": {"data": [{"id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==", "type": "findings"}]}}, "type": "severity_override"}} + When the request is sent + Then the response status is 202 Accepted + + @generated @skip @team:ddoghq/k9-investigation + Scenario: Override the severity of security findings returns "Bad Request" response + Given operation "UpdateFindingsSeverity" enabled + And new "UpdateFindingsSeverity" request + And body with value {"data": {"attributes": {"severity": {"action": "set", "description": "Database contains sensitive data.", "value": "high"}}, "id": "00000000-0000-0000-0000-000000000001", "relationships": {"findings": {"data": [{"id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==", "type": "findings"}]}}, "type": "severity_override"}} + When the request is sent + Then the response status is 400 Bad Request + + @generated @skip @team:ddoghq/k9-investigation + Scenario: Override the severity of security findings returns "Not Found" response + Given operation "UpdateFindingsSeverity" enabled + And new "UpdateFindingsSeverity" request + And body with value {"data": {"attributes": {"severity": {"action": "set", "description": "Database contains sensitive data.", "value": "high"}}, "id": "00000000-0000-0000-0000-000000000001", "relationships": {"findings": {"data": [{"id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==", "type": "findings"}]}}, "type": "severity_override"}} + When the request is sent + Then the response status is 404 Not Found + + @generated @skip @team:ddoghq/k9-investigation + Scenario: Override the severity of security findings returns "Unprocessable Entity" response + Given operation "UpdateFindingsSeverity" enabled + And new "UpdateFindingsSeverity" request + And body with value {"data": {"attributes": {"severity": {"action": "set", "description": "Database contains sensitive data.", "value": "high"}}, "id": "00000000-0000-0000-0000-000000000001", "relationships": {"findings": {"data": [{"id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==", "type": "findings"}]}}, "type": "severity_override"}} + When the request is sent + Then the response status is 422 Unprocessable Entity + @team:ddoghq/cloud-security-posture-management Scenario: Patch a signal-based notification rule returns "Bad Request" response Given new "PatchSignalNotificationRule" request diff --git a/tests/v2/features/undo.json b/tests/v2/features/undo.json index 3c60ae2cd5..8c110cf9e5 100644 --- a/tests/v2/features/undo.json +++ b/tests/v2/features/undo.json @@ -8748,6 +8748,12 @@ "type": "unsafe" } }, + "UpdateFindingsSeverity": { + "tag": "Security Monitoring", + "undo": { + "type": "idempotent" + } + }, "ListAssetsSBOMs": { "tag": "Security Monitoring", "undo": {