From d095d40b725e9829778c4504cd474b7c8f7e0536 Mon Sep 17 00:00:00 2001 From: "ci.datadog-api-spec" Date: Fri, 16 Oct 2026 16:31:59 +0000 Subject: [PATCH] Regenerate client from commit d1ba91a of spec repo --- .generator/schemas/v2/openapi.yaml | 1572 +++++++++++++++++ .../CancelSecurityMonitoringBatchMigration.py | 17 + .../CreateSecurityMonitoringBatchMigration.py | 53 + ...curityMonitoringBatchMigrationResources.py | 54 + .../DeleteSecurityMonitoringBatchMigration.py | 19 + ...curityMonitoringBatchMigrationResources.py | 43 + ...curityMonitoringBatchMigrationResources.py | 21 + .../ListSecurityMonitoringBatchMigrations.py | 21 + ...PublishSecurityMonitoringBatchMigration.py | 42 + .../StartSecurityMonitoringBatchMigration.py | 17 + .../UpdateSecurityMonitoringBatchMigration.py | 42 + ...ecurityMonitoringBatchMigrationResource.py | 45 + src/datadog_api_client/configuration.py | 11 + .../v2/api/security_monitoring_api.py | 643 +++++++ ...y_monitoring_batch_migration_attributes.py | 146 ++ ...oring_batch_migration_create_attributes.py | 90 + ..._monitoring_batch_migration_create_data.py | 61 + ...nitoring_batch_migration_create_request.py | 44 + ...ecurity_monitoring_batch_migration_data.py | 69 + ...monitoring_batch_migration_input_source.py | 46 + ...ty_monitoring_batch_migration_list_meta.py | 33 + ...ring_batch_migration_publish_attributes.py | 44 + ...monitoring_batch_migration_publish_data.py | 61 + ...itoring_batch_migration_publish_request.py | 44 + ...toring_batch_migration_publish_response.py | 44 + ...monitoring_batch_migration_publish_type.py | 37 + ...migration_published_resource_attributes.py | 66 + ...batch_migration_published_resource_data.py | 69 + ...tch_migration_published_resource_status.py | 42 + ...batch_migration_published_resource_type.py | 37 + ...ing_batch_migration_resource_attributes.py | 161 ++ ...ng_batch_migration_resource_create_item.py | 88 + ...onitoring_batch_migration_resource_data.py | 69 + ...ing_batch_migration_resource_input_type.py | 45 + ...itoring_batch_migration_resource_output.py | 22 + ...oring_batch_migration_resource_response.py | 44 + ...itoring_batch_migration_resource_status.py | 60 + ..._batch_migration_resource_status_counts.py | 86 + ...onitoring_batch_migration_resource_type.py | 37 + ...ch_migration_resource_update_attributes.py | 93 + ...ng_batch_migration_resource_update_data.py | 61 + ...batch_migration_resource_update_request.py | 44 + ...h_migration_resources_create_attributes.py | 51 + ...g_batch_migration_resources_create_data.py | 61 + ...atch_migration_resources_create_request.py | 44 + ...tch_migration_resources_create_response.py | 44 + ...h_migration_resources_delete_attributes.py | 42 + ...g_batch_migration_resources_delete_data.py | 61 + ...atch_migration_resources_delete_request.py | 44 + ...batch_migration_resources_list_response.py | 61 + ...nitoring_batch_migration_resources_type.py | 37 + ...ity_monitoring_batch_migration_response.py | 44 + ...urity_monitoring_batch_migration_status.py | 46 + ...ecurity_monitoring_batch_migration_type.py | 35 + ...oring_batch_migration_update_attributes.py | 72 + ..._monitoring_batch_migration_update_data.py | 61 + ...nitoring_batch_migration_update_request.py | 44 + ...nitoring_batch_migrations_list_response.py | 61 + src/datadog_api_client/v2/models/__init__.py | 172 ++ .../test-runner-data/manifest.json | 56 + ...ch-migration-returns-created-response.json | 56 + ...ch-migration-returns-created-response.json | 45 + ...migration-returns-no-content-response.json | 35 + ...migration-returns-no-content-response.json | 52 + ...gration-resources-returns-ok-response.json | 35 + ...-batch-migrations-returns-ok-response.json | 35 + ...igration-resource-returns-ok-response.json | 66 + ...a-batch-migration-returns-ok-response.json | 54 + .../v2/security-monitoring.json | 850 ++++++++- tests/v2/features/given.json | 25 + tests/v2/features/security_monitoring.feature | 352 ++++ tests/v2/features/undo.json | 81 + 72 files changed, 7057 insertions(+), 8 deletions(-) create mode 100644 examples/v2/security-monitoring/CancelSecurityMonitoringBatchMigration.py create mode 100644 examples/v2/security-monitoring/CreateSecurityMonitoringBatchMigration.py create mode 100644 examples/v2/security-monitoring/CreateSecurityMonitoringBatchMigrationResources.py create mode 100644 examples/v2/security-monitoring/DeleteSecurityMonitoringBatchMigration.py create mode 100644 examples/v2/security-monitoring/DeleteSecurityMonitoringBatchMigrationResources.py create mode 100644 examples/v2/security-monitoring/ListSecurityMonitoringBatchMigrationResources.py create mode 100644 examples/v2/security-monitoring/ListSecurityMonitoringBatchMigrations.py create mode 100644 examples/v2/security-monitoring/PublishSecurityMonitoringBatchMigration.py create mode 100644 examples/v2/security-monitoring/StartSecurityMonitoringBatchMigration.py create mode 100644 examples/v2/security-monitoring/UpdateSecurityMonitoringBatchMigration.py create mode 100644 examples/v2/security-monitoring/UpdateSecurityMonitoringBatchMigrationResource.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_attributes.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_create_attributes.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_create_data.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_create_request.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_data.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_input_source.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_list_meta.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_attributes.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_data.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_request.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_response.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_type.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_published_resource_attributes.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_published_resource_data.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_published_resource_status.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_published_resource_type.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_attributes.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_create_item.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_data.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_input_type.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_output.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_response.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_status.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_status_counts.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_type.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_update_attributes.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_update_data.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_update_request.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_create_attributes.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_create_data.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_create_request.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_create_response.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_delete_attributes.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_delete_data.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_delete_request.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_list_response.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_type.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_response.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_status.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_type.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_update_attributes.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_update_data.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migration_update_request.py create mode 100644 src/datadog_api_client/v2/model/security_monitoring_batch_migrations_list_response.py create mode 100644 tests/generated-test/test-runner-data/v2/security-monitoring/add-resources-to-a-batch-migration-returns-created-response.json create mode 100644 tests/generated-test/test-runner-data/v2/security-monitoring/create-a-batch-migration-returns-created-response.json create mode 100644 tests/generated-test/test-runner-data/v2/security-monitoring/delete-a-batch-migration-returns-no-content-response.json create mode 100644 tests/generated-test/test-runner-data/v2/security-monitoring/delete-resources-from-a-batch-migration-returns-no-content-response.json create mode 100644 tests/generated-test/test-runner-data/v2/security-monitoring/list-batch-migration-resources-returns-ok-response.json create mode 100644 tests/generated-test/test-runner-data/v2/security-monitoring/list-batch-migrations-returns-ok-response.json create mode 100644 tests/generated-test/test-runner-data/v2/security-monitoring/update-a-batch-migration-resource-returns-ok-response.json create mode 100644 tests/generated-test/test-runner-data/v2/security-monitoring/update-a-batch-migration-returns-ok-response.json diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml index 8e540e2cff..f94599b971 100644 --- a/.generator/schemas/v2/openapi.yaml +++ b/.generator/schemas/v2/openapi.yaml @@ -1942,6 +1942,47 @@ components: required: true schema: type: string + SecurityMonitoringBatchMigrationID: + description: The UUID of the batch migration. + in: path + name: batch_id + required: true + schema: + example: 7cdb3a75-64fb-46ce-9445-41969e78fe8e + format: uuid + type: string + SecurityMonitoringBatchMigrationPageNumber: + description: Specific page number to return, starting at 1. + in: query + name: page[number] + required: false + schema: + default: 1 + example: 1 + format: int64 + minimum: 1 + type: integer + SecurityMonitoringBatchMigrationPageSize: + description: Size for a given page. The maximum allowed value is 500. + in: query + name: page[size] + required: false + schema: + default: 50 + example: 50 + format: int64 + maximum: 500 + minimum: 1 + type: integer + SecurityMonitoringBatchMigrationResourceID: + description: The UUID of the batch migration resource. + in: path + name: resource_id + required: true + schema: + example: c968cf83-56c2-4d54-a993-6c86dfb83527 + format: uuid + type: string SecurityMonitoringCriticalAssetID: description: The ID of the critical asset. in: path @@ -2370,6 +2411,42 @@ components: schema: $ref: "#/components/schemas/APIErrorResponse" description: Method Not Allowed + SecurityMonitoringBatchMigrationBadRequestResponse: + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Bad Request + SecurityMonitoringBatchMigrationConflictResponse: + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Conflict + SecurityMonitoringBatchMigrationForbiddenResponse: + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Forbidden + SecurityMonitoringBatchMigrationInternalServerErrorResponse: + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Internal Server Error + SecurityMonitoringBatchMigrationNotFoundResponse: + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Not Found + SecurityMonitoringBatchMigrationUnauthorizedResponse: + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Unauthorized SpansBadRequestResponse: content: application/json: @@ -112057,6 +112134,725 @@ components: - subscription_count - error_count type: object + SecurityMonitoringBatchMigrationAttributes: + description: Attributes of a batch migration. + properties: + createdAt: + description: The creation date of the batch migration, in RFC 3339 format. + example: "2026-09-21T12:00:00Z" + format: date-time + type: string + createdBy: + description: The UUID of the user or service account who created the batch migration. + example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d + type: string + description: + description: The description of the batch migration. + example: Rules imported from Splunk + type: string + inputSource: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationInputSource" + lastUpdatedAt: + description: The last update date of the batch migration, in RFC 3339 format. + example: "2026-09-21T12:00:00Z" + format: date-time + type: string + lastUpdatedBy: + description: |- + The UUID of the user or service account who last updated the batch migration, + or the name of a system actor. + example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d + type: string + name: + description: The name of the batch migration. + example: Splunk migration + type: string + orgId: + description: The ID of the organization that owns the batch migration. + example: 123456 + format: int64 + type: integer + resourceStatusCounts: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceStatusCounts" + status: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationStatus" + tags: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationTags" + required: + - orgId + - name + - inputSource + - status + - createdAt + - lastUpdatedAt + - tags + - resourceStatusCounts + type: object + SecurityMonitoringBatchMigrationCreateAttributes: + description: Attributes of the batch migration to create. + properties: + description: + description: The description of the batch migration. + example: Rules imported from Splunk + maxLength: 4096 + type: string + name: + description: The name of the batch migration. + example: Splunk migration + maxLength: 512 + type: string + resources: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationCreateResources" + tags: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationTags" + required: + - resources + type: object + SecurityMonitoringBatchMigrationCreateData: + description: Data of the batch migration to create. + properties: + attributes: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationCreateAttributes" + type: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationType" + required: + - type + - attributes + type: object + SecurityMonitoringBatchMigrationCreateRequest: + description: Request to create a batch migration. + properties: + data: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationCreateData" + required: + - data + type: object + SecurityMonitoringBatchMigrationCreateResources: + description: The initial resources of the batch migration. From 1 to 100 resources. + items: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceCreateItem" + maxItems: 100 + minItems: 1 + type: array + SecurityMonitoringBatchMigrationData: + description: A batch migration. + properties: + attributes: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationAttributes" + id: + description: The UUID of the batch migration. + example: 7cdb3a75-64fb-46ce-9445-41969e78fe8e + format: uuid + type: string + type: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationType" + required: + - id + - type + - attributes + type: object + SecurityMonitoringBatchMigrationInputSource: + description: |- + The origin of a batch migration. Always `batch_migration` for batch migrations + created through this API. + enum: + - batch_migration + - threat_hunting + - user + example: batch_migration + type: string + x-enum-varnames: + - BATCH_MIGRATION + - THREAT_HUNTING + - USER + SecurityMonitoringBatchMigrationListMeta: + description: Metadata of a list response. + properties: + totalCount: + description: Total number of items matching the request. + example: 1 + format: int64 + type: integer + required: + - totalCount + type: object + SecurityMonitoringBatchMigrationPublishAttributes: + description: Attributes of the batch migration publish request. + properties: + resourceIds: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishResourceIDs" + type: object + SecurityMonitoringBatchMigrationPublishData: + description: Data of the batch migration publish request. + properties: + attributes: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishAttributes" + type: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishType" + required: + - type + - attributes + type: object + SecurityMonitoringBatchMigrationPublishRequest: + description: Request to publish the resources of a batch migration. + properties: + data: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishData" + required: + - data + type: object + SecurityMonitoringBatchMigrationPublishResourceIDs: + description: |- + Unique UUIDs of the resources to publish. Up to 1000 IDs. When omitted or empty, + every `completed` resource of the batch migration is published. + example: + - c968cf83-56c2-4d54-a993-6c86dfb83527 + items: + format: uuid + type: string + maxItems: 1000 + type: array + uniqueItems: true + SecurityMonitoringBatchMigrationPublishResponse: + description: Response containing the publication outcome of each resource. + properties: + data: + description: The publication outcome of each resource. + items: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishedResourceData" + type: array + required: + - data + type: object + SecurityMonitoringBatchMigrationPublishType: + description: The type of resource for a batch migration publish request. + enum: + - batchMigrationPublish + example: batchMigrationPublish + type: string + x-enum-varnames: + - BATCH_MIGRATION_PUBLISH + SecurityMonitoringBatchMigrationPublishedResourceAttributes: + description: Attributes of the publication outcome of a batch migration resource. + properties: + error: + description: The reason why the resource could not be published. + example: failed to create rule + type: string + ruleId: + description: The ID of the created Cloud SIEM detection rule. + example: abc-def-ghi + type: string + status: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishedResourceStatus" + required: + - status + type: object + SecurityMonitoringBatchMigrationPublishedResourceData: + description: The publication outcome of a batch migration resource. + properties: + attributes: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishedResourceAttributes" + id: + description: The UUID of the batch migration resource. + example: c968cf83-56c2-4d54-a993-6c86dfb83527 + format: uuid + type: string + type: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishedResourceType" + required: + - id + - type + - attributes + type: object + SecurityMonitoringBatchMigrationPublishedResourceStatus: + description: The outcome of publishing a batch migration resource. + enum: + - published + - failed + example: published + type: string + x-enum-varnames: + - PUBLISHED + - FAILED + SecurityMonitoringBatchMigrationPublishedResourceType: + description: The type of resource for a published batch migration resource. + enum: + - batchMigrationPublishedResource + example: batchMigrationPublishedResource + type: string + x-enum-varnames: + - BATCH_MIGRATION_PUBLISHED_RESOURCE + SecurityMonitoringBatchMigrationResourceAttributes: + description: Attributes of a batch migration resource. + properties: + batchId: + description: The UUID of the batch migration that contains the resource. + example: 7cdb3a75-64fb-46ce-9445-41969e78fe8e + format: uuid + type: string + createdAt: + description: The creation date of the resource, in RFC 3339 format. + example: "2026-09-21T12:00:00Z" + format: date-time + type: string + createdBy: + description: The UUID of the user or service account who created the resource. + example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d + type: string + description: + description: The description of the resource. + example: Detects repeated failed Windows authentication attempts. + type: string + input: + description: The source query or natural language description to translate. + example: index=wineventlog EventCode=4625 + type: string + inputType: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceInputType" + lastUpdatedAt: + description: The last update date of the resource, in RFC 3339 format. + example: "2026-09-21T12:02:00Z" + format: date-time + type: string + lastUpdatedBy: + description: |- + The UUID of the user or service account who last updated the resource, + or the name of a system actor. + example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d + type: string + name: + description: The name of the resource. + example: Repeated Windows login failures + type: string + output: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceOutput" + outputType: + description: The type of the translation output. Currently always `siem_rule`. + example: siem_rule + type: string + ruleId: + description: The ID of the Cloud SIEM detection rule created when the resource was published. + example: abc-def-ghi + type: string + status: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceStatus" + required: + - batchId + - name + - inputType + - outputType + - status + - input + - output + - createdAt + - lastUpdatedAt + type: object + SecurityMonitoringBatchMigrationResourceCreateItem: + description: A source rule to translate into a Cloud SIEM detection rule. + properties: + description: + description: The description of the resource. + example: Detects repeated failed Windows authentication attempts. + maxLength: 4096 + type: string + input: + description: The source query or natural language description to translate. Must not be blank. + example: index=wineventlog EventCode=4625 + maxLength: 65536 + minLength: 1 + pattern: '^[\s\S]*\S[\s\S]*$' + type: string + inputType: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceInputType" + name: + description: The name of the resource. + example: Repeated Windows login failures + maxLength: 512 + type: string + required: + - inputType + - input + type: object + SecurityMonitoringBatchMigrationResourceCreateItems: + description: The resources to add. From 1 to 1000 resources. + items: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceCreateItem" + maxItems: 1000 + minItems: 1 + type: array + SecurityMonitoringBatchMigrationResourceData: + description: A batch migration resource. + properties: + attributes: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceAttributes" + id: + description: The UUID of the batch migration resource. + example: c968cf83-56c2-4d54-a993-6c86dfb83527 + format: uuid + type: string + type: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceType" + required: + - id + - type + - attributes + type: object + SecurityMonitoringBatchMigrationResourceIDs: + description: Unique UUIDs of batch migration resources. From 1 to 1000 IDs. + example: + - c968cf83-56c2-4d54-a993-6c86dfb83527 + items: + format: uuid + type: string + maxItems: 1000 + minItems: 1 + type: array + SecurityMonitoringBatchMigrationResourceInputType: + description: |- + The type of the source rule: `spl` for a Splunk SPL search or saved search definition, + `natural_language` for a plain-English description of the behavior to detect, or `kql` + for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded. + enum: + - natural_language + - spl + - kql + example: spl + type: string + x-enum-varnames: + - NATURAL_LANGUAGE + - SPL + - KQL + SecurityMonitoringBatchMigrationResourceOutput: + additionalProperties: {} + description: |- + The translation output. When the resource is `completed`, a Cloud SIEM detection rule + definition in the same format as the create detection rule API. When the resource is + `failed`, an object with an `error` describing the failure, with `kind` set to + `translation_error` or `internal_error`, and optional `type` and `message`. Otherwise, null. + example: + name: Repeated Windows login failures + type: log_detection + nullable: true + type: object + SecurityMonitoringBatchMigrationResourceResponse: + description: Response containing a batch migration resource. + properties: + data: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceData" + required: + - data + type: object + SecurityMonitoringBatchMigrationResourceStatus: + description: |- + The status of a batch migration resource. `completed` resources have a translation in + `output` that is ready to be published. `duplicate` is reserved for future duplicate rule + detection. + enum: + - pending + - in_progress + - completed + - canceled + - failed + - publishing + - published + - duplicate + example: completed + type: string + x-enum-varnames: + - PENDING + - IN_PROGRESS + - COMPLETED + - CANCELED + - FAILED + - PUBLISHING + - PUBLISHED + - DUPLICATE + SecurityMonitoringBatchMigrationResourceStatusCounts: + description: The number of resources of a batch migration in each status. + properties: + canceled: + description: Number of resources whose translation was canceled. + example: 0 + format: int64 + type: integer + completed: + description: Number of resources translated and ready to be published. + example: 0 + format: int64 + type: integer + duplicate: + description: Number of resources identified as duplicates of an existing rule. Reserved for future use. + example: 0 + format: int64 + type: integer + failed: + description: Number of resources whose translation failed. + example: 0 + format: int64 + type: integer + inProgress: + description: Number of resources being translated. + example: 0 + format: int64 + type: integer + pending: + description: Number of resources waiting to be translated. + example: 1 + format: int64 + type: integer + published: + description: Number of resources published as Cloud SIEM detection rules. + example: 0 + format: int64 + type: integer + publishing: + description: Number of resources being published. + example: 0 + format: int64 + type: integer + required: + - pending + - inProgress + - completed + - canceled + - failed + - publishing + - published + - duplicate + type: object + SecurityMonitoringBatchMigrationResourceType: + description: The type of resource for a batch migration resource. + enum: + - batchMigrationResource + example: batchMigrationResource + type: string + x-enum-varnames: + - BATCH_MIGRATION_RESOURCE + SecurityMonitoringBatchMigrationResourceUpdateAttributes: + additionalProperties: false + description: Attributes of the batch migration resource to update. At least one attribute is required. + minProperties: 1 + properties: + description: + description: The description of the resource. + example: Detects repeated failed Windows authentication attempts. + maxLength: 4096 + type: string + input: + description: The source query or natural language description to translate. Must not be blank. + example: index=wineventlog EventCode=4625 | stats count by user + maxLength: 65536 + minLength: 1 + pattern: '^[\s\S]*\S[\s\S]*$' + type: string + inputType: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceInputType" + name: + description: The name of the resource. + example: Repeated Windows login failures + maxLength: 512 + type: string + type: object + SecurityMonitoringBatchMigrationResourceUpdateData: + description: Data of the batch migration resource to update. + properties: + attributes: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceUpdateAttributes" + type: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceType" + required: + - type + - attributes + type: object + SecurityMonitoringBatchMigrationResourceUpdateRequest: + description: Request to update a batch migration resource. + properties: + data: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceUpdateData" + required: + - data + type: object + SecurityMonitoringBatchMigrationResourcesCreateAttributes: + description: Attributes of the resources to add to a batch migration. + properties: + resources: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceCreateItems" + required: + - resources + type: object + SecurityMonitoringBatchMigrationResourcesCreateData: + description: Data of the resources to add to a batch migration. + properties: + attributes: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesCreateAttributes" + type: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesType" + required: + - type + - attributes + type: object + SecurityMonitoringBatchMigrationResourcesCreateRequest: + description: Request to add resources to a batch migration. + properties: + data: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesCreateData" + required: + - data + type: object + SecurityMonitoringBatchMigrationResourcesCreateResponse: + description: Response containing the batch migration resources that were added. + properties: + data: + description: The added batch migration resources. + items: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceData" + type: array + required: + - data + type: object + SecurityMonitoringBatchMigrationResourcesDeleteAttributes: + description: Attributes of the resources to delete from a batch migration. + properties: + resourceIds: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceIDs" + required: + - resourceIds + type: object + SecurityMonitoringBatchMigrationResourcesDeleteData: + description: Data of the resources to delete from a batch migration. + properties: + attributes: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesDeleteAttributes" + type: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesType" + required: + - type + - attributes + type: object + SecurityMonitoringBatchMigrationResourcesDeleteRequest: + description: Request to delete resources from a batch migration. + properties: + data: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesDeleteData" + required: + - data + type: object + SecurityMonitoringBatchMigrationResourcesListResponse: + description: Response containing batch migration resources. + properties: + data: + description: The batch migration resources. + items: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceData" + type: array + meta: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationListMeta" + required: + - data + - meta + type: object + SecurityMonitoringBatchMigrationResourcesType: + description: The type of resource for a request on a set of batch migration resources. + enum: + - batchMigrationResources + example: batchMigrationResources + type: string + x-enum-varnames: + - BATCH_MIGRATION_RESOURCES + SecurityMonitoringBatchMigrationResponse: + description: Response containing a batch migration. + properties: + data: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationData" + required: + - data + type: object + SecurityMonitoringBatchMigrationStatus: + description: |- + The status of a batch migration. A batch migration is created as `draft` and moves to + `in_progress` when started. It moves to `completed` once no resource is `pending` or + `in_progress`, or to `canceled` when canceled. + enum: + - draft + - in_progress + - canceled + - completed + example: draft + type: string + x-enum-varnames: + - DRAFT + - IN_PROGRESS + - CANCELED + - COMPLETED + SecurityMonitoringBatchMigrationTags: + description: Tags of the batch migration. Up to 50 tags, each up to 256 characters. + example: + - source:splunk + items: + maxLength: 256 + type: string + maxItems: 50 + type: array + SecurityMonitoringBatchMigrationType: + description: The type of resource for a batch migration. + enum: + - batchMigration + example: batchMigration + type: string + x-enum-varnames: + - BATCH_MIGRATION + SecurityMonitoringBatchMigrationUpdateAttributes: + additionalProperties: false + description: Attributes of the batch migration to update. At least one attribute is required. + minProperties: 1 + properties: + description: + description: The description of the batch migration. + example: Rules imported from Splunk + maxLength: 4096 + type: string + name: + description: The name of the batch migration. + example: Splunk migration - Windows + maxLength: 512 + type: string + tags: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationTags" + type: object + SecurityMonitoringBatchMigrationUpdateData: + description: Data of the batch migration to update. + properties: + attributes: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationUpdateAttributes" + type: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationType" + required: + - type + - attributes + type: object + SecurityMonitoringBatchMigrationUpdateRequest: + description: Request to update a batch migration. + properties: + data: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationUpdateData" + required: + - data + type: object + SecurityMonitoringBatchMigrationsListResponse: + description: Response containing a page of batch migrations. + properties: + data: + description: The batch migrations. + items: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationData" + type: array + meta: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationListMeta" + required: + - data + - meta + type: object SecurityMonitoringContentPackActivation: description: The activation status of a content pack. enum: @@ -226113,6 +226909,782 @@ paths: x-unstable: |- **Note**: This endpoint is a private preview. If you are interested in accessing this API, [fill out this form](https://forms.gle/kMYC1sDr6WDUBDsx9). + /api/v2/security_monitoring/batch-migrations: + get: + description: |- + List the batch migrations of your organization. A batch migration groups detection + rules from another SIEM that the Datadog Detection Agent translates into Cloud SIEM + detection rules. To retrieve a single batch migration, filter by its ID with + `filter[query]=id:`. Poll this endpoint to follow the progress of a batch + migration through its `status` and `resourceStatusCounts`. + operationId: ListSecurityMonitoringBatchMigrations + parameters: + - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationPageSize" + - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationPageNumber" + - description: |- + A search query in Datadog search syntax to filter batch migrations, such as + `status:completed`. Filterable attributes are `id`, `name`, `description`, `status`, + `createdBy`, and `lastUpdatedBy`. Free text matches the batch migration name. + in: query + name: filter[query] + required: false + schema: + example: "status:draft" + type: string + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + - attributes: + createdAt: "2026-09-21T12:00:00Z" + createdBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d + description: Rules imported from Splunk + inputSource: batch_migration + lastUpdatedAt: "2026-09-21T12:00:00Z" + lastUpdatedBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d + name: Splunk migration + orgId: 123456 + resourceStatusCounts: + canceled: 0 + completed: 0 + duplicate: 0 + failed: 0 + inProgress: 0 + pending: 1 + published: 0 + publishing: 0 + status: draft + tags: + - source:splunk + id: 7cdb3a75-64fb-46ce-9445-41969e78fe8e + type: batchMigration + meta: + totalCount: 1 + schema: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationsListResponse" + description: OK + "400": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" + "401": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" + "403": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_rules_read + summary: List batch migrations + tags: + - Security Monitoring + "x-permission": + operator: OR + permissions: + - security_monitoring_rules_read + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. + post: + description: |- + Create a batch migration in the `draft` status, together with 1 to 100 initial + resources. Each resource holds one source rule to translate into a Cloud SIEM detection + rule. To load more rules, add them with the add resources endpoint before starting the + batch migration. A batch migration can hold up to 1000 resources. The response does not + include the created resources: list the resources of the batch migration to retrieve them. + operationId: CreateSecurityMonitoringBatchMigration + requestBody: + content: + application/json: + examples: + default: + value: + data: + attributes: + description: Rules imported from Splunk + name: Splunk migration + resources: + - description: Detects repeated failed Windows authentication attempts. + input: index=wineventlog EventCode=4625 + inputType: spl + name: Repeated Windows login failures + - input: >- + Alert when PowerShell is launched with a command line that downloads and executes a remote script, such as IEX with Net.WebClient or Invoke-WebRequest. + inputType: natural_language + name: Suspicious PowerShell download cradle + tags: + - source:splunk + type: batchMigration + schema: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationCreateRequest" + required: true + responses: + "201": + content: + application/json: + examples: + default: + value: + data: + attributes: + createdAt: "2026-09-21T12:00:00Z" + createdBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d + description: Rules imported from Splunk + inputSource: batch_migration + lastUpdatedAt: "2026-09-21T12:00:00Z" + lastUpdatedBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d + name: Splunk migration + orgId: 123456 + resourceStatusCounts: + canceled: 0 + completed: 0 + duplicate: 0 + failed: 0 + inProgress: 0 + pending: 2 + published: 0 + publishing: 0 + status: draft + tags: + - source:splunk + id: 7cdb3a75-64fb-46ce-9445-41969e78fe8e + type: batchMigration + schema: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResponse" + description: Created + "400": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" + "401": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" + "403": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_rules_write + summary: Create a batch migration + tags: + - Security Monitoring + x-codegen-request-body-name: body + "x-permission": + operator: OR + permissions: + - security_monitoring_rules_write + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. + /api/v2/security_monitoring/batch-migrations/{batch_id}: + delete: + description: |- + Delete a batch migration and its resources. Detection rules that were already + published are not deleted. Returns `409 Conflict` while any resource is `in_progress` + or `publishing`: cancel the batch migration, or wait for publishing to finish, and + then try again. + operationId: DeleteSecurityMonitoringBatchMigration + parameters: + - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" + responses: + "204": + description: No Content + "400": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" + "401": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" + "403": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" + "404": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" + "409": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationConflictResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_rules_write + summary: Delete a batch migration + tags: + - Security Monitoring + "x-permission": + operator: OR + permissions: + - security_monitoring_rules_write + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. + patch: + description: |- + Update the name, description, or tags of a batch migration, in any status. At least + one of these attributes must be provided. Omitted attributes are left unchanged, and + `tags` replaces the full list of tags. + operationId: UpdateSecurityMonitoringBatchMigration + parameters: + - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" + requestBody: + content: + application/json: + examples: + default: + value: + data: + attributes: + name: Splunk migration - Windows + tags: + - source:splunk + - team:secops + type: batchMigration + schema: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationUpdateRequest" + required: true + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + attributes: + createdAt: "2026-09-21T12:00:00Z" + createdBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d + description: Rules imported from Splunk + inputSource: batch_migration + lastUpdatedAt: "2026-09-21T12:05:00Z" + lastUpdatedBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d + name: Splunk migration - Windows + orgId: 123456 + resourceStatusCounts: + canceled: 0 + completed: 0 + duplicate: 0 + failed: 0 + inProgress: 0 + pending: 1 + published: 0 + publishing: 0 + status: draft + tags: + - source:splunk + - team:secops + id: 7cdb3a75-64fb-46ce-9445-41969e78fe8e + type: batchMigration + schema: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResponse" + description: OK + "400": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" + "401": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" + "403": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" + "404": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_rules_write + summary: Update a batch migration + tags: + - Security Monitoring + x-codegen-request-body-name: body + "x-permission": + operator: OR + permissions: + - security_monitoring_rules_write + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. + /api/v2/security_monitoring/batch-migrations/{batch_id}/cancel: + post: + description: |- + Cancel an `in_progress` batch migration. Resources that are `pending` or `in_progress` + become `canceled`. Resources that are already `completed` or `failed` keep their status + and output, so completed resources can still be published. Canceling a `canceled` batch + migration succeeds, so the request can be safely retried. Returns `409 Conflict` if the + batch migration is `draft` or `completed`. + operationId: CancelSecurityMonitoringBatchMigration + parameters: + - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" + responses: + "202": + description: Accepted + "400": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" + "401": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" + "403": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" + "404": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" + "409": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationConflictResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_rules_write + summary: Cancel a batch migration + tags: + - Security Monitoring + "x-permission": + operator: OR + permissions: + - security_monitoring_rules_write + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. + /api/v2/security_monitoring/batch-migrations/{batch_id}/publish: + post: + description: |- + Create a Cloud SIEM detection rule from the `output` of each selected `completed` + resource of a batch migration. Completed resources can be published while the rest of + the batch migration is still being translated. When `resourceIds` is omitted or empty, + every `completed` resource is published. Published rules are created disabled. + + Every requested resource must be publishable: `completed`, or left in `publishing` for + more than one minute after an uncertain result. Otherwise, the request returns + `409 Conflict` and nothing is published. Already published resources are not publishable. + + The response reports the outcome of each resource, and some resources can be published + while others fail. A `failed` result that contains a `ruleId` means the rule was created: + do not retry that resource. Publishing a rule with a `block_ip` or `block_user` action + requires the `appsec_protect_write` permission. + operationId: PublishSecurityMonitoringBatchMigration + parameters: + - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" + requestBody: + content: + application/json: + examples: + all_completed: + summary: Publish every completed resource + value: + data: + attributes: {} + type: batchMigrationPublish + default: + value: + data: + attributes: + resourceIds: + - c968cf83-56c2-4d54-a993-6c86dfb83527 + type: batchMigrationPublish + schema: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishRequest" + required: true + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + - attributes: + ruleId: abc-def-ghi + status: published + id: c968cf83-56c2-4d54-a993-6c86dfb83527 + type: batchMigrationPublishedResource + schema: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishResponse" + description: OK + "400": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" + "401": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" + "403": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" + "404": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" + "409": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationConflictResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_rules_write + summary: Publish a batch migration + tags: + - Security Monitoring + x-codegen-request-body-name: body + "x-permission": + operator: OR + permissions: + - security_monitoring_rules_write + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. + /api/v2/security_monitoring/batch-migrations/{batch_id}/resources: + delete: + description: |- + Delete resources from a batch migration. The request is all-or-nothing: it returns + `404 Not Found` if any resource does not exist, and `409 Conflict` if any resource is + `in_progress` or `publishing`. In both cases nothing is deleted. Duplicate resource IDs + are ignored. Detection rules already published from the deleted resources are not deleted. + operationId: DeleteSecurityMonitoringBatchMigrationResources + parameters: + - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" + requestBody: + content: + application/json: + examples: + default: + value: + data: + attributes: + resourceIds: + - c968cf83-56c2-4d54-a993-6c86dfb83527 + type: batchMigrationResources + schema: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesDeleteRequest" + required: true + responses: + "204": + description: No Content + "400": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" + "401": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" + "403": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" + "404": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" + "409": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationConflictResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_rules_write + summary: Delete resources from a batch migration + tags: + - Security Monitoring + x-codegen-request-body-name: body + "x-permission": + operator: OR + permissions: + - security_monitoring_rules_write + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. + get: + description: |- + List the resources of a batch migration, including the input of each source rule and, + once translated, the proposed Cloud SIEM detection rule in `output`. + operationId: ListSecurityMonitoringBatchMigrationResources + parameters: + - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" + - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationPageSize" + - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationPageNumber" + - description: |- + A search query in Datadog search syntax to filter resources, such as + `status:completed`. Filterable attributes are `id`, `name`, `description`, `inputType`, + `status`, `input`, `createdBy`, and `lastUpdatedBy`. Free text matches the resource name. + in: query + name: filter[query] + required: false + schema: + example: "status:completed inputType:spl" + type: string + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + - attributes: + batchId: 7cdb3a75-64fb-46ce-9445-41969e78fe8e + createdAt: "2026-09-21T12:00:00Z" + createdBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d + description: Detects repeated failed Windows authentication attempts. + input: index=wineventlog EventCode=4625 + inputType: spl + lastUpdatedAt: "2026-09-21T12:02:00Z" + lastUpdatedBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d + name: Repeated Windows login failures + output: + cases: + - condition: failed_logins >= 5 + name: Repeated failures + notifications: [] + status: medium + isEnabled: false + message: Repeated failed Windows login attempts were detected. + name: Repeated Windows login failures + options: + evaluationWindow: 300 + keepAlive: 3600 + maxSignalDuration: 86400 + queries: + - aggregation: count + groupByFields: + - "@usr.name" + - "@network.client.ip" + name: failed_logins + query: "source:windows @evt.id:4625" + tags: + - source:windows + - migration:splunk + type: log_detection + outputType: siem_rule + status: completed + id: c968cf83-56c2-4d54-a993-6c86dfb83527 + type: batchMigrationResource + meta: + totalCount: 1 + schema: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesListResponse" + description: OK + "400": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" + "401": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" + "403": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" + "404": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_rules_read + summary: List batch migration resources + tags: + - Security Monitoring + "x-permission": + operator: OR + permissions: + - security_monitoring_rules_read + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. + post: + description: |- + Add 1 to 1000 resources to a `draft` batch migration. Returns `409 Conflict` if the + batch migration is not `draft`, and `400 Bad Request` if the batch migration would + contain more than 1000 resources. + operationId: CreateSecurityMonitoringBatchMigrationResources + parameters: + - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" + requestBody: + content: + application/json: + examples: + default: + value: + data: + attributes: + resources: + - input: index=linux process=sudo "authentication failure" | stats count by user, host + inputType: spl + name: Linux sudo abuse + type: batchMigrationResources + schema: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesCreateRequest" + required: true + responses: + "201": + content: + application/json: + examples: + default: + value: + data: + - attributes: + batchId: 7cdb3a75-64fb-46ce-9445-41969e78fe8e + createdAt: "2026-09-21T12:10:00Z" + createdBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d + input: index=linux process=sudo "authentication failure" | stats count by user, host + inputType: spl + lastUpdatedAt: "2026-09-21T12:10:00Z" + lastUpdatedBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d + name: Linux sudo abuse + output: + outputType: siem_rule + status: pending + id: 0b3f5e5c-8a2b-4a8f-9f0e-3c1d2e4f5a6b + type: batchMigrationResource + schema: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesCreateResponse" + description: Created + "400": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" + "401": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" + "403": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" + "404": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" + "409": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationConflictResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_rules_write + summary: Add resources to a batch migration + tags: + - Security Monitoring + x-codegen-request-body-name: body + "x-permission": + operator: OR + permissions: + - security_monitoring_rules_write + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. + /api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id}: + patch: + description: |- + Update a resource of a batch migration. At least one of `name`, `description`, + `inputType`, or `input` must be provided. `name` and `description` can be updated at + any time. `inputType` and `input` can only be updated while the resource is `pending`; + otherwise, the request returns `409 Conflict`. The translated `output` cannot be edited. + operationId: UpdateSecurityMonitoringBatchMigrationResource + parameters: + - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" + - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationResourceID" + requestBody: + content: + application/json: + examples: + default: + value: + data: + attributes: + input: index=wineventlog EventCode=4625 | stats count by user + type: batchMigrationResource + schema: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceUpdateRequest" + required: true + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + attributes: + batchId: 7cdb3a75-64fb-46ce-9445-41969e78fe8e + createdAt: "2026-09-21T12:00:00Z" + createdBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d + input: index=wineventlog EventCode=4625 | stats count by user + inputType: spl + lastUpdatedAt: "2026-09-21T12:15:00Z" + lastUpdatedBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d + name: Repeated Windows login failures + output: + outputType: siem_rule + status: pending + id: c968cf83-56c2-4d54-a993-6c86dfb83527 + type: batchMigrationResource + schema: + $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceResponse" + description: OK + "400": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" + "401": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" + "403": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" + "404": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" + "409": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationConflictResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_rules_write + summary: Update a batch migration resource + tags: + - Security Monitoring + x-codegen-request-body-name: body + "x-permission": + operator: OR + permissions: + - security_monitoring_rules_write + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. + /api/v2/security_monitoring/batch-migrations/{batch_id}/start: + post: + description: |- + Start translating the `pending` resources of a `draft` batch migration into Cloud SIEM + detection rules. The batch migration moves to `in_progress`, and its resources are + translated asynchronously. Once no resource is `pending` or `in_progress`, the batch + migration moves to `completed`. Starting an `in_progress` batch migration again does not + queue duplicate work, so the request can be safely retried, including after a timeout or + a `5xx` error. Returns `409 Conflict` if the batch migration is `completed` or `canceled`. + + An organization can translate up to 2000 resources in total across all of its batch + migrations. Resources that were already processed count toward this limit even after + they are deleted, and `pending` resources of `in_progress` batch migrations reserve + capacity. Returns `409 Conflict` if starting the batch migration would exceed this limit. + To request a higher limit for your organization, contact + [Datadog support](https://docs.datadoghq.com/help/). + operationId: StartSecurityMonitoringBatchMigration + parameters: + - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" + responses: + "202": + description: Accepted + "400": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" + "401": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" + "403": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" + "404": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" + "409": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationConflictResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + "500": + $ref: "#/components/responses/SecurityMonitoringBatchMigrationInternalServerErrorResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_rules_write + summary: Start a batch migration + tags: + - Security Monitoring + "x-permission": + operator: OR + permissions: + - security_monitoring_rules_write + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. /api/v2/security_monitoring/cloud_workload_security/agent_rules: get: description: |- diff --git a/examples/v2/security-monitoring/CancelSecurityMonitoringBatchMigration.py b/examples/v2/security-monitoring/CancelSecurityMonitoringBatchMigration.py new file mode 100644 index 0000000000..ddcc10a884 --- /dev/null +++ b/examples/v2/security-monitoring/CancelSecurityMonitoringBatchMigration.py @@ -0,0 +1,17 @@ +""" +Cancel a batch migration returns "Accepted" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi +from uuid import UUID + +configuration = Configuration() +configuration.access_token = environ["DD_BEARER_TOKEN"] +configuration.unstable_operations["cancel_security_monitoring_batch_migration"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + api_instance.cancel_security_monitoring_batch_migration( + batch_id=UUID("7cdb3a75-64fb-46ce-9445-41969e78fe8e"), + ) diff --git a/examples/v2/security-monitoring/CreateSecurityMonitoringBatchMigration.py b/examples/v2/security-monitoring/CreateSecurityMonitoringBatchMigration.py new file mode 100644 index 0000000000..daefe0d53b --- /dev/null +++ b/examples/v2/security-monitoring/CreateSecurityMonitoringBatchMigration.py @@ -0,0 +1,53 @@ +""" +Create a batch migration returns "Created" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi +from datadog_api_client.v2.model.security_monitoring_batch_migration_create_attributes import ( + SecurityMonitoringBatchMigrationCreateAttributes, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_create_data import ( + SecurityMonitoringBatchMigrationCreateData, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_create_request import ( + SecurityMonitoringBatchMigrationCreateRequest, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_create_item import ( + SecurityMonitoringBatchMigrationResourceCreateItem, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_input_type import ( + SecurityMonitoringBatchMigrationResourceInputType, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_type import SecurityMonitoringBatchMigrationType + +body = SecurityMonitoringBatchMigrationCreateRequest( + data=SecurityMonitoringBatchMigrationCreateData( + type=SecurityMonitoringBatchMigrationType.BATCH_MIGRATION, + attributes=SecurityMonitoringBatchMigrationCreateAttributes( + name="Example-Security-Monitoring", + description="Rules imported from Splunk", + tags=[ + "source:splunk", + ], + resources=[ + SecurityMonitoringBatchMigrationResourceCreateItem( + name="Repeated Windows login failures", + description="Detects repeated failed Windows authentication attempts.", + input_type=SecurityMonitoringBatchMigrationResourceInputType.SPL, + input="index=wineventlog EventCode=4625", + ), + ], + ), + ), +) + +configuration = Configuration() +configuration.access_token = environ["DD_BEARER_TOKEN"] +configuration.unstable_operations["create_security_monitoring_batch_migration"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + response = api_instance.create_security_monitoring_batch_migration(body=body) + + print(response) diff --git a/examples/v2/security-monitoring/CreateSecurityMonitoringBatchMigrationResources.py b/examples/v2/security-monitoring/CreateSecurityMonitoringBatchMigrationResources.py new file mode 100644 index 0000000000..9b0a7790e8 --- /dev/null +++ b/examples/v2/security-monitoring/CreateSecurityMonitoringBatchMigrationResources.py @@ -0,0 +1,54 @@ +""" +Add resources to a batch migration returns "Created" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_create_item import ( + SecurityMonitoringBatchMigrationResourceCreateItem, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_input_type import ( + SecurityMonitoringBatchMigrationResourceInputType, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_create_attributes import ( + SecurityMonitoringBatchMigrationResourcesCreateAttributes, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_create_data import ( + SecurityMonitoringBatchMigrationResourcesCreateData, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_create_request import ( + SecurityMonitoringBatchMigrationResourcesCreateRequest, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_type import ( + SecurityMonitoringBatchMigrationResourcesType, +) + +# there is a valid "batch_migration" in the system +BATCH_MIGRATION_DATA_ID = environ["BATCH_MIGRATION_DATA_ID"] + +body = SecurityMonitoringBatchMigrationResourcesCreateRequest( + data=SecurityMonitoringBatchMigrationResourcesCreateData( + type=SecurityMonitoringBatchMigrationResourcesType.BATCH_MIGRATION_RESOURCES, + attributes=SecurityMonitoringBatchMigrationResourcesCreateAttributes( + resources=[ + SecurityMonitoringBatchMigrationResourceCreateItem( + name="Linux sudo abuse", + input_type=SecurityMonitoringBatchMigrationResourceInputType.SPL, + input='index=linux process=sudo "authentication failure" | stats count by user, host', + ), + ], + ), + ), +) + +configuration = Configuration() +configuration.access_token = environ["DD_BEARER_TOKEN"] +configuration.unstable_operations["create_security_monitoring_batch_migration_resources"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + response = api_instance.create_security_monitoring_batch_migration_resources( + batch_id=BATCH_MIGRATION_DATA_ID, body=body + ) + + print(response) diff --git a/examples/v2/security-monitoring/DeleteSecurityMonitoringBatchMigration.py b/examples/v2/security-monitoring/DeleteSecurityMonitoringBatchMigration.py new file mode 100644 index 0000000000..cf82f01879 --- /dev/null +++ b/examples/v2/security-monitoring/DeleteSecurityMonitoringBatchMigration.py @@ -0,0 +1,19 @@ +""" +Delete a batch migration returns "No Content" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi + +# there is a valid "batch_migration" in the system +BATCH_MIGRATION_DATA_ID = environ["BATCH_MIGRATION_DATA_ID"] + +configuration = Configuration() +configuration.access_token = environ["DD_BEARER_TOKEN"] +configuration.unstable_operations["delete_security_monitoring_batch_migration"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + api_instance.delete_security_monitoring_batch_migration( + batch_id=BATCH_MIGRATION_DATA_ID, + ) diff --git a/examples/v2/security-monitoring/DeleteSecurityMonitoringBatchMigrationResources.py b/examples/v2/security-monitoring/DeleteSecurityMonitoringBatchMigrationResources.py new file mode 100644 index 0000000000..1d5406d091 --- /dev/null +++ b/examples/v2/security-monitoring/DeleteSecurityMonitoringBatchMigrationResources.py @@ -0,0 +1,43 @@ +""" +Delete resources from a batch migration returns "No Content" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_delete_attributes import ( + SecurityMonitoringBatchMigrationResourcesDeleteAttributes, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_delete_data import ( + SecurityMonitoringBatchMigrationResourcesDeleteData, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_delete_request import ( + SecurityMonitoringBatchMigrationResourcesDeleteRequest, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_type import ( + SecurityMonitoringBatchMigrationResourcesType, +) + +# there is a valid "batch_migration" in the system +BATCH_MIGRATION_DATA_ID = environ["BATCH_MIGRATION_DATA_ID"] + +# there is a valid "batch_migration_resource" in the system +BATCH_MIGRATION_RESOURCE_ID = environ["BATCH_MIGRATION_RESOURCE_ID"] + +body = SecurityMonitoringBatchMigrationResourcesDeleteRequest( + data=SecurityMonitoringBatchMigrationResourcesDeleteData( + type=SecurityMonitoringBatchMigrationResourcesType.BATCH_MIGRATION_RESOURCES, + attributes=SecurityMonitoringBatchMigrationResourcesDeleteAttributes( + resource_ids=[ + BATCH_MIGRATION_RESOURCE_ID, + ], + ), + ), +) + +configuration = Configuration() +configuration.access_token = environ["DD_BEARER_TOKEN"] +configuration.unstable_operations["delete_security_monitoring_batch_migration_resources"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + api_instance.delete_security_monitoring_batch_migration_resources(batch_id=BATCH_MIGRATION_DATA_ID, body=body) diff --git a/examples/v2/security-monitoring/ListSecurityMonitoringBatchMigrationResources.py b/examples/v2/security-monitoring/ListSecurityMonitoringBatchMigrationResources.py new file mode 100644 index 0000000000..b7d0296ac0 --- /dev/null +++ b/examples/v2/security-monitoring/ListSecurityMonitoringBatchMigrationResources.py @@ -0,0 +1,21 @@ +""" +List batch migration resources returns "OK" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi + +# there is a valid "batch_migration" in the system +BATCH_MIGRATION_DATA_ID = environ["BATCH_MIGRATION_DATA_ID"] + +configuration = Configuration() +configuration.access_token = environ["DD_BEARER_TOKEN"] +configuration.unstable_operations["list_security_monitoring_batch_migration_resources"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + response = api_instance.list_security_monitoring_batch_migration_resources( + batch_id=BATCH_MIGRATION_DATA_ID, + ) + + print(response) diff --git a/examples/v2/security-monitoring/ListSecurityMonitoringBatchMigrations.py b/examples/v2/security-monitoring/ListSecurityMonitoringBatchMigrations.py new file mode 100644 index 0000000000..19000b6ac1 --- /dev/null +++ b/examples/v2/security-monitoring/ListSecurityMonitoringBatchMigrations.py @@ -0,0 +1,21 @@ +""" +List batch migrations returns "OK" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi + +# there is a valid "batch_migration" in the system +BATCH_MIGRATION_DATA_ID = environ["BATCH_MIGRATION_DATA_ID"] + +configuration = Configuration() +configuration.access_token = environ["DD_BEARER_TOKEN"] +configuration.unstable_operations["list_security_monitoring_batch_migrations"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + response = api_instance.list_security_monitoring_batch_migrations( + filter_query="id:7cdb3a75-64fb-46ce-9445-41969e78fe8e", + ) + + print(response) diff --git a/examples/v2/security-monitoring/PublishSecurityMonitoringBatchMigration.py b/examples/v2/security-monitoring/PublishSecurityMonitoringBatchMigration.py new file mode 100644 index 0000000000..f09ffc8c57 --- /dev/null +++ b/examples/v2/security-monitoring/PublishSecurityMonitoringBatchMigration.py @@ -0,0 +1,42 @@ +""" +Publish a batch migration returns "OK" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi +from datadog_api_client.v2.model.security_monitoring_batch_migration_publish_attributes import ( + SecurityMonitoringBatchMigrationPublishAttributes, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_publish_data import ( + SecurityMonitoringBatchMigrationPublishData, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_publish_request import ( + SecurityMonitoringBatchMigrationPublishRequest, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_publish_type import ( + SecurityMonitoringBatchMigrationPublishType, +) +from uuid import UUID + +body = SecurityMonitoringBatchMigrationPublishRequest( + data=SecurityMonitoringBatchMigrationPublishData( + attributes=SecurityMonitoringBatchMigrationPublishAttributes( + resource_ids=[ + UUID("c968cf83-56c2-4d54-a993-6c86dfb83527"), + ], + ), + type=SecurityMonitoringBatchMigrationPublishType.BATCH_MIGRATION_PUBLISH, + ), +) + +configuration = Configuration() +configuration.access_token = environ["DD_BEARER_TOKEN"] +configuration.unstable_operations["publish_security_monitoring_batch_migration"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + response = api_instance.publish_security_monitoring_batch_migration( + batch_id=UUID("7cdb3a75-64fb-46ce-9445-41969e78fe8e"), body=body + ) + + print(response) diff --git a/examples/v2/security-monitoring/StartSecurityMonitoringBatchMigration.py b/examples/v2/security-monitoring/StartSecurityMonitoringBatchMigration.py new file mode 100644 index 0000000000..d6594061ce --- /dev/null +++ b/examples/v2/security-monitoring/StartSecurityMonitoringBatchMigration.py @@ -0,0 +1,17 @@ +""" +Start a batch migration returns "Accepted" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi +from uuid import UUID + +configuration = Configuration() +configuration.access_token = environ["DD_BEARER_TOKEN"] +configuration.unstable_operations["start_security_monitoring_batch_migration"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + api_instance.start_security_monitoring_batch_migration( + batch_id=UUID("7cdb3a75-64fb-46ce-9445-41969e78fe8e"), + ) diff --git a/examples/v2/security-monitoring/UpdateSecurityMonitoringBatchMigration.py b/examples/v2/security-monitoring/UpdateSecurityMonitoringBatchMigration.py new file mode 100644 index 0000000000..647817e3fd --- /dev/null +++ b/examples/v2/security-monitoring/UpdateSecurityMonitoringBatchMigration.py @@ -0,0 +1,42 @@ +""" +Update a batch migration returns "OK" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi +from datadog_api_client.v2.model.security_monitoring_batch_migration_type import SecurityMonitoringBatchMigrationType +from datadog_api_client.v2.model.security_monitoring_batch_migration_update_attributes import ( + SecurityMonitoringBatchMigrationUpdateAttributes, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_update_data import ( + SecurityMonitoringBatchMigrationUpdateData, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_update_request import ( + SecurityMonitoringBatchMigrationUpdateRequest, +) + +# there is a valid "batch_migration" in the system +BATCH_MIGRATION_DATA_ID = environ["BATCH_MIGRATION_DATA_ID"] + +body = SecurityMonitoringBatchMigrationUpdateRequest( + data=SecurityMonitoringBatchMigrationUpdateData( + type=SecurityMonitoringBatchMigrationType.BATCH_MIGRATION, + attributes=SecurityMonitoringBatchMigrationUpdateAttributes( + name="Example-Security-Monitoring-updated", + tags=[ + "source:splunk", + "team:secops", + ], + ), + ), +) + +configuration = Configuration() +configuration.access_token = environ["DD_BEARER_TOKEN"] +configuration.unstable_operations["update_security_monitoring_batch_migration"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + response = api_instance.update_security_monitoring_batch_migration(batch_id=BATCH_MIGRATION_DATA_ID, body=body) + + print(response) diff --git a/examples/v2/security-monitoring/UpdateSecurityMonitoringBatchMigrationResource.py b/examples/v2/security-monitoring/UpdateSecurityMonitoringBatchMigrationResource.py new file mode 100644 index 0000000000..10e3e31777 --- /dev/null +++ b/examples/v2/security-monitoring/UpdateSecurityMonitoringBatchMigrationResource.py @@ -0,0 +1,45 @@ +""" +Update a batch migration resource returns "OK" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_type import ( + SecurityMonitoringBatchMigrationResourceType, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_update_attributes import ( + SecurityMonitoringBatchMigrationResourceUpdateAttributes, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_update_data import ( + SecurityMonitoringBatchMigrationResourceUpdateData, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_update_request import ( + SecurityMonitoringBatchMigrationResourceUpdateRequest, +) + +# there is a valid "batch_migration" in the system +BATCH_MIGRATION_DATA_ID = environ["BATCH_MIGRATION_DATA_ID"] + +# there is a valid "batch_migration_resource" in the system +BATCH_MIGRATION_RESOURCE_ID = environ["BATCH_MIGRATION_RESOURCE_ID"] + +body = SecurityMonitoringBatchMigrationResourceUpdateRequest( + data=SecurityMonitoringBatchMigrationResourceUpdateData( + type=SecurityMonitoringBatchMigrationResourceType.BATCH_MIGRATION_RESOURCE, + attributes=SecurityMonitoringBatchMigrationResourceUpdateAttributes( + input="index=wineventlog EventCode=4625 | stats count by user", + ), + ), +) + +configuration = Configuration() +configuration.access_token = environ["DD_BEARER_TOKEN"] +configuration.unstable_operations["update_security_monitoring_batch_migration_resource"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + response = api_instance.update_security_monitoring_batch_migration_resource( + batch_id=BATCH_MIGRATION_DATA_ID, resource_id=BATCH_MIGRATION_RESOURCE_ID, body=body + ) + + print(response) diff --git a/src/datadog_api_client/configuration.py b/src/datadog_api_client/configuration.py index 821497938d..3cffa31dd8 100644 --- a/src/datadog_api_client/configuration.py +++ b/src/datadog_api_client/configuration.py @@ -377,6 +377,7 @@ def __init__( "v2.bulk_create_sample_log_generation_subscriptions": False, "v2.bulk_export_security_monitoring_terraform_resources": False, "v2.cancel_historical_job": False, + "v2.cancel_security_monitoring_batch_migration": False, "v2.convert_job_result_to_signal": False, "v2.convert_security_monitoring_terraform_resource": False, "v2.create_io_c_triage_state": False, @@ -386,6 +387,8 @@ def __init__( "v2.create_security_findings_automation_mute_rule": False, "v2.create_security_findings_automation_severity_modifier_rule": False, "v2.create_security_findings_automation_ticket_creation_rule": False, + "v2.create_security_monitoring_batch_migration": False, + "v2.create_security_monitoring_batch_migration_resources": False, "v2.create_security_monitoring_dataset": False, "v2.create_security_monitoring_integration_config": False, "v2.create_static_analysis_ast": False, @@ -399,6 +402,8 @@ def __init__( "v2.delete_security_findings_automation_mute_rule": False, "v2.delete_security_findings_automation_severity_modifier_rule": False, "v2.delete_security_findings_automation_ticket_creation_rule": False, + "v2.delete_security_monitoring_batch_migration": False, + "v2.delete_security_monitoring_batch_migration_resources": False, "v2.delete_security_monitoring_dataset": False, "v2.delete_security_monitoring_integration_config": False, "v2.disable_security_findings_automation_default_inbox_rule": False, @@ -445,12 +450,15 @@ def __init__( "v2.list_security_findings_automation_mute_rules": False, "v2.list_security_findings_automation_severity_modifier_rules": False, "v2.list_security_findings_automation_ticket_creation_rules": False, + "v2.list_security_monitoring_batch_migration_resources": False, + "v2.list_security_monitoring_batch_migrations": False, "v2.list_security_monitoring_datasets": False, "v2.list_security_monitoring_histsignals": False, "v2.list_security_monitoring_integration_configs": False, "v2.list_static_analysis_codegen_rulesets": False, "v2.list_vulnerabilities": False, "v2.list_vulnerable_assets": False, + "v2.publish_security_monitoring_batch_migration": False, "v2.reorder_security_findings_automation_due_date_rules": False, "v2.reorder_security_findings_automation_inbox_rules": False, "v2.reorder_security_findings_automation_mute_rules": False, @@ -459,6 +467,7 @@ def __init__( "v2.restore_security_monitoring_rule": False, "v2.run_historical_job": False, "v2.search_security_monitoring_histsignals": False, + "v2.start_security_monitoring_batch_migration": False, "v2.update_findings_assignee": False, "v2.update_findings_severity": False, "v2.update_security_findings_automation_due_date_rule": False, @@ -466,6 +475,8 @@ def __init__( "v2.update_security_findings_automation_mute_rule": False, "v2.update_security_findings_automation_severity_modifier_rule": False, "v2.update_security_findings_automation_ticket_creation_rule": False, + "v2.update_security_monitoring_batch_migration": False, + "v2.update_security_monitoring_batch_migration_resource": False, "v2.update_security_monitoring_dataset": False, "v2.update_security_monitoring_integration_config": False, "v2.validate_security_monitoring_integration_config": False, diff --git a/src/datadog_api_client/v2/api/security_monitoring_api.py b/src/datadog_api_client/v2/api/security_monitoring_api.py index f6bc499f02..da742180c2 100644 --- a/src/datadog_api_client/v2/api/security_monitoring_api.py +++ b/src/datadog_api_client/v2/api/security_monitoring_api.py @@ -114,6 +114,42 @@ from datadog_api_client.v2.model.vulnerability_ecosystem import VulnerabilityEcosystem from datadog_api_client.v2.model.cyclone_dx_bom import CycloneDXBom from datadog_api_client.v2.model.list_vulnerable_assets_response import ListVulnerableAssetsResponse +from datadog_api_client.v2.model.security_monitoring_batch_migrations_list_response import ( + SecurityMonitoringBatchMigrationsListResponse, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_response import ( + SecurityMonitoringBatchMigrationResponse, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_create_request import ( + SecurityMonitoringBatchMigrationCreateRequest, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_update_request import ( + SecurityMonitoringBatchMigrationUpdateRequest, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_publish_response import ( + SecurityMonitoringBatchMigrationPublishResponse, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_publish_request import ( + SecurityMonitoringBatchMigrationPublishRequest, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_delete_request import ( + SecurityMonitoringBatchMigrationResourcesDeleteRequest, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_list_response import ( + SecurityMonitoringBatchMigrationResourcesListResponse, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_create_response import ( + SecurityMonitoringBatchMigrationResourcesCreateResponse, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_create_request import ( + SecurityMonitoringBatchMigrationResourcesCreateRequest, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_response import ( + SecurityMonitoringBatchMigrationResourceResponse, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_update_request import ( + SecurityMonitoringBatchMigrationResourceUpdateRequest, +) from datadog_api_client.v2.model.security_monitoring_critical_assets_response import ( SecurityMonitoringCriticalAssetsResponse, ) @@ -666,6 +702,29 @@ def __init__(self, api_client=None): api_client=api_client, ) + self._cancel_security_monitoring_batch_migration_endpoint = _Endpoint( + settings={ + "response_type": None, + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/batch-migrations/{batch_id}/cancel", + "operation_id": "cancel_security_monitoring_batch_migration", + "http_method": "POST", + "version": "v2", + }, + params_map={ + "batch_id": { + "required": True, + "openapi_types": (UUID,), + "attribute": "batch_id", + "location": "path", + }, + }, + headers_map={ + "accept": ["*/*"], + }, + api_client=api_client, + ) + self._convert_existing_security_monitoring_rule_endpoint = _Endpoint( settings={ "response_type": (SecurityMonitoringRuleConvertResponse,), @@ -995,6 +1054,52 @@ def __init__(self, api_client=None): api_client=api_client, ) + self._create_security_monitoring_batch_migration_endpoint = _Endpoint( + settings={ + "response_type": (SecurityMonitoringBatchMigrationResponse,), + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/batch-migrations", + "operation_id": "create_security_monitoring_batch_migration", + "http_method": "POST", + "version": "v2", + }, + params_map={ + "body": { + "required": True, + "openapi_types": (SecurityMonitoringBatchMigrationCreateRequest,), + "location": "body", + }, + }, + headers_map={"accept": ["application/json"], "content_type": ["application/json"]}, + api_client=api_client, + ) + + self._create_security_monitoring_batch_migration_resources_endpoint = _Endpoint( + settings={ + "response_type": (SecurityMonitoringBatchMigrationResourcesCreateResponse,), + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/batch-migrations/{batch_id}/resources", + "operation_id": "create_security_monitoring_batch_migration_resources", + "http_method": "POST", + "version": "v2", + }, + params_map={ + "batch_id": { + "required": True, + "openapi_types": (UUID,), + "attribute": "batch_id", + "location": "path", + }, + "body": { + "required": True, + "openapi_types": (SecurityMonitoringBatchMigrationResourcesCreateRequest,), + "location": "body", + }, + }, + headers_map={"accept": ["application/json"], "content_type": ["application/json"]}, + api_client=api_client, + ) + self._create_security_monitoring_critical_asset_endpoint = _Endpoint( settings={ "response_type": (SecurityMonitoringCriticalAssetResponse,), @@ -1454,6 +1559,55 @@ def __init__(self, api_client=None): api_client=api_client, ) + self._delete_security_monitoring_batch_migration_endpoint = _Endpoint( + settings={ + "response_type": None, + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/batch-migrations/{batch_id}", + "operation_id": "delete_security_monitoring_batch_migration", + "http_method": "DELETE", + "version": "v2", + }, + params_map={ + "batch_id": { + "required": True, + "openapi_types": (UUID,), + "attribute": "batch_id", + "location": "path", + }, + }, + headers_map={ + "accept": ["*/*"], + }, + api_client=api_client, + ) + + self._delete_security_monitoring_batch_migration_resources_endpoint = _Endpoint( + settings={ + "response_type": None, + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/batch-migrations/{batch_id}/resources", + "operation_id": "delete_security_monitoring_batch_migration_resources", + "http_method": "DELETE", + "version": "v2", + }, + params_map={ + "batch_id": { + "required": True, + "openapi_types": (UUID,), + "attribute": "batch_id", + "location": "path", + }, + "body": { + "required": True, + "openapi_types": (SecurityMonitoringBatchMigrationResourcesDeleteRequest,), + "location": "body", + }, + }, + headers_map={"accept": ["*/*"], "content_type": ["application/json"]}, + api_client=api_client, + ) + self._delete_security_monitoring_critical_asset_endpoint = _Endpoint( settings={ "response_type": None, @@ -3711,6 +3865,90 @@ def __init__(self, api_client=None): api_client=api_client, ) + self._list_security_monitoring_batch_migration_resources_endpoint = _Endpoint( + settings={ + "response_type": (SecurityMonitoringBatchMigrationResourcesListResponse,), + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/batch-migrations/{batch_id}/resources", + "operation_id": "list_security_monitoring_batch_migration_resources", + "http_method": "GET", + "version": "v2", + }, + params_map={ + "batch_id": { + "required": True, + "openapi_types": (UUID,), + "attribute": "batch_id", + "location": "path", + }, + "page_size": { + "validation": { + "inclusive_maximum": 500, + "inclusive_minimum": 1, + }, + "openapi_types": (int,), + "attribute": "page[size]", + "location": "query", + }, + "page_number": { + "validation": { + "inclusive_minimum": 1, + }, + "openapi_types": (int,), + "attribute": "page[number]", + "location": "query", + }, + "filter_query": { + "openapi_types": (str,), + "attribute": "filter[query]", + "location": "query", + }, + }, + headers_map={ + "accept": ["application/json"], + }, + api_client=api_client, + ) + + self._list_security_monitoring_batch_migrations_endpoint = _Endpoint( + settings={ + "response_type": (SecurityMonitoringBatchMigrationsListResponse,), + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/batch-migrations", + "operation_id": "list_security_monitoring_batch_migrations", + "http_method": "GET", + "version": "v2", + }, + params_map={ + "page_size": { + "validation": { + "inclusive_maximum": 500, + "inclusive_minimum": 1, + }, + "openapi_types": (int,), + "attribute": "page[size]", + "location": "query", + }, + "page_number": { + "validation": { + "inclusive_minimum": 1, + }, + "openapi_types": (int,), + "attribute": "page[number]", + "location": "query", + }, + "filter_query": { + "openapi_types": (str,), + "attribute": "filter[query]", + "location": "query", + }, + }, + headers_map={ + "accept": ["application/json"], + }, + api_client=api_client, + ) + self._list_security_monitoring_critical_assets_endpoint = _Endpoint( settings={ "response_type": (SecurityMonitoringCriticalAssetsResponse,), @@ -4400,6 +4638,32 @@ def __init__(self, api_client=None): api_client=api_client, ) + self._publish_security_monitoring_batch_migration_endpoint = _Endpoint( + settings={ + "response_type": (SecurityMonitoringBatchMigrationPublishResponse,), + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/batch-migrations/{batch_id}/publish", + "operation_id": "publish_security_monitoring_batch_migration", + "http_method": "POST", + "version": "v2", + }, + params_map={ + "batch_id": { + "required": True, + "openapi_types": (UUID,), + "attribute": "batch_id", + "location": "path", + }, + "body": { + "required": True, + "openapi_types": (SecurityMonitoringBatchMigrationPublishRequest,), + "location": "body", + }, + }, + headers_map={"accept": ["application/json"], "content_type": ["application/json"]}, + api_client=api_client, + ) + self._reorder_security_findings_automation_due_date_rules_endpoint = _Endpoint( settings={ "response_type": (DueDateRuleReorderResponse,), @@ -4627,6 +4891,29 @@ def __init__(self, api_client=None): api_client=api_client, ) + self._start_security_monitoring_batch_migration_endpoint = _Endpoint( + settings={ + "response_type": None, + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/batch-migrations/{batch_id}/start", + "operation_id": "start_security_monitoring_batch_migration", + "http_method": "POST", + "version": "v2", + }, + params_map={ + "batch_id": { + "required": True, + "openapi_types": (UUID,), + "attribute": "batch_id", + "location": "path", + }, + }, + headers_map={ + "accept": ["*/*"], + }, + api_client=api_client, + ) + self._test_existing_security_monitoring_rule_endpoint = _Endpoint( settings={ "response_type": (SecurityMonitoringRuleTestResponse,), @@ -4921,6 +5208,64 @@ def __init__(self, api_client=None): api_client=api_client, ) + self._update_security_monitoring_batch_migration_endpoint = _Endpoint( + settings={ + "response_type": (SecurityMonitoringBatchMigrationResponse,), + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/batch-migrations/{batch_id}", + "operation_id": "update_security_monitoring_batch_migration", + "http_method": "PATCH", + "version": "v2", + }, + params_map={ + "batch_id": { + "required": True, + "openapi_types": (UUID,), + "attribute": "batch_id", + "location": "path", + }, + "body": { + "required": True, + "openapi_types": (SecurityMonitoringBatchMigrationUpdateRequest,), + "location": "body", + }, + }, + headers_map={"accept": ["application/json"], "content_type": ["application/json"]}, + api_client=api_client, + ) + + self._update_security_monitoring_batch_migration_resource_endpoint = _Endpoint( + settings={ + "response_type": (SecurityMonitoringBatchMigrationResourceResponse,), + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id}", + "operation_id": "update_security_monitoring_batch_migration_resource", + "http_method": "PATCH", + "version": "v2", + }, + params_map={ + "batch_id": { + "required": True, + "openapi_types": (UUID,), + "attribute": "batch_id", + "location": "path", + }, + "resource_id": { + "required": True, + "openapi_types": (UUID,), + "attribute": "resource_id", + "location": "path", + }, + "body": { + "required": True, + "openapi_types": (SecurityMonitoringBatchMigrationResourceUpdateRequest,), + "location": "body", + }, + }, + headers_map={"accept": ["application/json"], "content_type": ["application/json"]}, + api_client=api_client, + ) + self._update_security_monitoring_critical_asset_endpoint = _Endpoint( settings={ "response_type": (SecurityMonitoringCriticalAssetResponse,), @@ -5445,6 +5790,27 @@ def cancel_historical_job( return self._cancel_historical_job_endpoint.call_with_http_info(**kwargs) + def cancel_security_monitoring_batch_migration( + self, + batch_id: UUID, + ) -> None: + """Cancel a batch migration. + + Cancel an ``in_progress`` batch migration. Resources that are ``pending`` or ``in_progress`` + become ``canceled``. Resources that are already ``completed`` or ``failed`` keep their status + and output, so completed resources can still be published. Canceling a ``canceled`` batch + migration succeeds, so the request can be safely retried. Returns ``409 Conflict`` if the + batch migration is ``draft`` or ``completed``. + + :param batch_id: The UUID of the batch migration. + :type batch_id: UUID + :rtype: None + """ + kwargs: Dict[str, Any] = {} + kwargs["batch_id"] = batch_id + + return self._cancel_security_monitoring_batch_migration_endpoint.call_with_http_info(**kwargs) + def convert_existing_security_monitoring_rule( self, rule_id: str, @@ -5744,6 +6110,49 @@ def create_security_findings_automation_ticket_creation_rule( return self._create_security_findings_automation_ticket_creation_rule_endpoint.call_with_http_info(**kwargs) + def create_security_monitoring_batch_migration( + self, + body: SecurityMonitoringBatchMigrationCreateRequest, + ) -> SecurityMonitoringBatchMigrationResponse: + """Create a batch migration. + + Create a batch migration in the ``draft`` status, together with 1 to 100 initial + resources. Each resource holds one source rule to translate into a Cloud SIEM detection + rule. To load more rules, add them with the add resources endpoint before starting the + batch migration. A batch migration can hold up to 1000 resources. The response does not + include the created resources: list the resources of the batch migration to retrieve them. + + :type body: SecurityMonitoringBatchMigrationCreateRequest + :rtype: SecurityMonitoringBatchMigrationResponse + """ + kwargs: Dict[str, Any] = {} + kwargs["body"] = body + + return self._create_security_monitoring_batch_migration_endpoint.call_with_http_info(**kwargs) + + def create_security_monitoring_batch_migration_resources( + self, + batch_id: UUID, + body: SecurityMonitoringBatchMigrationResourcesCreateRequest, + ) -> SecurityMonitoringBatchMigrationResourcesCreateResponse: + """Add resources to a batch migration. + + Add 1 to 1000 resources to a ``draft`` batch migration. Returns ``409 Conflict`` if the + batch migration is not ``draft`` , and ``400 Bad Request`` if the batch migration would + contain more than 1000 resources. + + :param batch_id: The UUID of the batch migration. + :type batch_id: UUID + :type body: SecurityMonitoringBatchMigrationResourcesCreateRequest + :rtype: SecurityMonitoringBatchMigrationResourcesCreateResponse + """ + kwargs: Dict[str, Any] = {} + kwargs["batch_id"] = batch_id + + kwargs["body"] = body + + return self._create_security_monitoring_batch_migration_resources_endpoint.call_with_http_info(**kwargs) + def create_security_monitoring_critical_asset( self, body: SecurityMonitoringCriticalAssetCreateRequest, @@ -6118,6 +6527,50 @@ def delete_security_findings_automation_ticket_creation_rule( return self._delete_security_findings_automation_ticket_creation_rule_endpoint.call_with_http_info(**kwargs) + def delete_security_monitoring_batch_migration( + self, + batch_id: UUID, + ) -> None: + """Delete a batch migration. + + Delete a batch migration and its resources. Detection rules that were already + published are not deleted. Returns ``409 Conflict`` while any resource is ``in_progress`` + or ``publishing`` : cancel the batch migration, or wait for publishing to finish, and + then try again. + + :param batch_id: The UUID of the batch migration. + :type batch_id: UUID + :rtype: None + """ + kwargs: Dict[str, Any] = {} + kwargs["batch_id"] = batch_id + + return self._delete_security_monitoring_batch_migration_endpoint.call_with_http_info(**kwargs) + + def delete_security_monitoring_batch_migration_resources( + self, + batch_id: UUID, + body: SecurityMonitoringBatchMigrationResourcesDeleteRequest, + ) -> None: + """Delete resources from a batch migration. + + Delete resources from a batch migration. The request is all-or-nothing: it returns + ``404 Not Found`` if any resource does not exist, and ``409 Conflict`` if any resource is + ``in_progress`` or ``publishing``. In both cases nothing is deleted. Duplicate resource IDs + are ignored. Detection rules already published from the deleted resources are not deleted. + + :param batch_id: The UUID of the batch migration. + :type batch_id: UUID + :type body: SecurityMonitoringBatchMigrationResourcesDeleteRequest + :rtype: None + """ + kwargs: Dict[str, Any] = {} + kwargs["batch_id"] = batch_id + + kwargs["body"] = body + + return self._delete_security_monitoring_batch_migration_resources_endpoint.call_with_http_info(**kwargs) + def delete_security_monitoring_critical_asset( self, critical_asset_id: str, @@ -8384,6 +8837,82 @@ def list_security_findings_automation_ticket_creation_rules( return self._list_security_findings_automation_ticket_creation_rules_endpoint.call_with_http_info(**kwargs) + def list_security_monitoring_batch_migration_resources( + self, + batch_id: UUID, + *, + page_size: Union[int, UnsetType] = unset, + page_number: Union[int, UnsetType] = unset, + filter_query: Union[str, UnsetType] = unset, + ) -> SecurityMonitoringBatchMigrationResourcesListResponse: + """List batch migration resources. + + List the resources of a batch migration, including the input of each source rule and, + once translated, the proposed Cloud SIEM detection rule in ``output``. + + :param batch_id: The UUID of the batch migration. + :type batch_id: UUID + :param page_size: Size for a given page. The maximum allowed value is 500. + :type page_size: int, optional + :param page_number: Specific page number to return, starting at 1. + :type page_number: int, optional + :param filter_query: A search query in Datadog search syntax to filter resources, such as + ``status:completed``. Filterable attributes are ``id`` , ``name`` , ``description`` , ``inputType`` , + ``status`` , ``input`` , ``createdBy`` , and ``lastUpdatedBy``. Free text matches the resource name. + :type filter_query: str, optional + :rtype: SecurityMonitoringBatchMigrationResourcesListResponse + """ + kwargs: Dict[str, Any] = {} + kwargs["batch_id"] = batch_id + + if page_size is not unset: + kwargs["page_size"] = page_size + + if page_number is not unset: + kwargs["page_number"] = page_number + + if filter_query is not unset: + kwargs["filter_query"] = filter_query + + return self._list_security_monitoring_batch_migration_resources_endpoint.call_with_http_info(**kwargs) + + def list_security_monitoring_batch_migrations( + self, + *, + page_size: Union[int, UnsetType] = unset, + page_number: Union[int, UnsetType] = unset, + filter_query: Union[str, UnsetType] = unset, + ) -> SecurityMonitoringBatchMigrationsListResponse: + """List batch migrations. + + List the batch migrations of your organization. A batch migration groups detection + rules from another SIEM that the Datadog Detection Agent translates into Cloud SIEM + detection rules. To retrieve a single batch migration, filter by its ID with + ``filter[query]=id:``. Poll this endpoint to follow the progress of a batch + migration through its ``status`` and ``resourceStatusCounts``. + + :param page_size: Size for a given page. The maximum allowed value is 500. + :type page_size: int, optional + :param page_number: Specific page number to return, starting at 1. + :type page_number: int, optional + :param filter_query: A search query in Datadog search syntax to filter batch migrations, such as + ``status:completed``. Filterable attributes are ``id`` , ``name`` , ``description`` , ``status`` , + ``createdBy`` , and ``lastUpdatedBy``. Free text matches the batch migration name. + :type filter_query: str, optional + :rtype: SecurityMonitoringBatchMigrationsListResponse + """ + kwargs: Dict[str, Any] = {} + if page_size is not unset: + kwargs["page_size"] = page_size + + if page_number is not unset: + kwargs["page_number"] = page_number + + if filter_query is not unset: + kwargs["filter_query"] = filter_query + + return self._list_security_monitoring_batch_migrations_endpoint.call_with_http_info(**kwargs) + def list_security_monitoring_critical_assets( self, ) -> SecurityMonitoringCriticalAssetsResponse: @@ -9252,6 +9781,39 @@ def patch_vulnerability_notification_rule( return self._patch_vulnerability_notification_rule_endpoint.call_with_http_info(**kwargs) + def publish_security_monitoring_batch_migration( + self, + batch_id: UUID, + body: SecurityMonitoringBatchMigrationPublishRequest, + ) -> SecurityMonitoringBatchMigrationPublishResponse: + """Publish a batch migration. + + Create a Cloud SIEM detection rule from the ``output`` of each selected ``completed`` + resource of a batch migration. Completed resources can be published while the rest of + the batch migration is still being translated. When ``resourceIds`` is omitted or empty, + every ``completed`` resource is published. Published rules are created disabled. + + Every requested resource must be publishable: ``completed`` , or left in ``publishing`` for + more than one minute after an uncertain result. Otherwise, the request returns + ``409 Conflict`` and nothing is published. Already published resources are not publishable. + + The response reports the outcome of each resource, and some resources can be published + while others fail. A ``failed`` result that contains a ``ruleId`` means the rule was created: + do not retry that resource. Publishing a rule with a ``block_ip`` or ``block_user`` action + requires the ``appsec_protect_write`` permission. + + :param batch_id: The UUID of the batch migration. + :type batch_id: UUID + :type body: SecurityMonitoringBatchMigrationPublishRequest + :rtype: SecurityMonitoringBatchMigrationPublishResponse + """ + kwargs: Dict[str, Any] = {} + kwargs["batch_id"] = batch_id + + kwargs["body"] = body + + return self._publish_security_monitoring_batch_migration_endpoint.call_with_http_info(**kwargs) + def reorder_security_findings_automation_due_date_rules( self, body: DueDateRuleReorderRequest, @@ -9508,6 +10070,35 @@ def send_security_monitoring_notification_preview( return self._send_security_monitoring_notification_preview_endpoint.call_with_http_info(**kwargs) + def start_security_monitoring_batch_migration( + self, + batch_id: UUID, + ) -> None: + """Start a batch migration. + + Start translating the ``pending`` resources of a ``draft`` batch migration into Cloud SIEM + detection rules. The batch migration moves to ``in_progress`` , and its resources are + translated asynchronously. Once no resource is ``pending`` or ``in_progress`` , the batch + migration moves to ``completed``. Starting an ``in_progress`` batch migration again does not + queue duplicate work, so the request can be safely retried, including after a timeout or + a ``5xx`` error. Returns ``409 Conflict`` if the batch migration is ``completed`` or ``canceled``. + + An organization can translate up to 2000 resources in total across all of its batch + migrations. Resources that were already processed count toward this limit even after + they are deleted, and ``pending`` resources of ``in_progress`` batch migrations reserve + capacity. Returns ``409 Conflict`` if starting the batch migration would exceed this limit. + To request a higher limit for your organization, contact + `Datadog support `_. + + :param batch_id: The UUID of the batch migration. + :type batch_id: UUID + :rtype: None + """ + kwargs: Dict[str, Any] = {} + kwargs["batch_id"] = batch_id + + return self._start_security_monitoring_batch_migration_endpoint.call_with_http_info(**kwargs) + def test_existing_security_monitoring_rule( self, rule_id: str, @@ -9762,6 +10353,58 @@ def update_security_findings_automation_ticket_creation_rule( return self._update_security_findings_automation_ticket_creation_rule_endpoint.call_with_http_info(**kwargs) + def update_security_monitoring_batch_migration( + self, + batch_id: UUID, + body: SecurityMonitoringBatchMigrationUpdateRequest, + ) -> SecurityMonitoringBatchMigrationResponse: + """Update a batch migration. + + Update the name, description, or tags of a batch migration, in any status. At least + one of these attributes must be provided. Omitted attributes are left unchanged, and + ``tags`` replaces the full list of tags. + + :param batch_id: The UUID of the batch migration. + :type batch_id: UUID + :type body: SecurityMonitoringBatchMigrationUpdateRequest + :rtype: SecurityMonitoringBatchMigrationResponse + """ + kwargs: Dict[str, Any] = {} + kwargs["batch_id"] = batch_id + + kwargs["body"] = body + + return self._update_security_monitoring_batch_migration_endpoint.call_with_http_info(**kwargs) + + def update_security_monitoring_batch_migration_resource( + self, + batch_id: UUID, + resource_id: UUID, + body: SecurityMonitoringBatchMigrationResourceUpdateRequest, + ) -> SecurityMonitoringBatchMigrationResourceResponse: + """Update a batch migration resource. + + Update a resource of a batch migration. At least one of ``name`` , ``description`` , + ``inputType`` , or ``input`` must be provided. ``name`` and ``description`` can be updated at + any time. ``inputType`` and ``input`` can only be updated while the resource is ``pending`` ; + otherwise, the request returns ``409 Conflict``. The translated ``output`` cannot be edited. + + :param batch_id: The UUID of the batch migration. + :type batch_id: UUID + :param resource_id: The UUID of the batch migration resource. + :type resource_id: UUID + :type body: SecurityMonitoringBatchMigrationResourceUpdateRequest + :rtype: SecurityMonitoringBatchMigrationResourceResponse + """ + kwargs: Dict[str, Any] = {} + kwargs["batch_id"] = batch_id + + kwargs["resource_id"] = resource_id + + kwargs["body"] = body + + return self._update_security_monitoring_batch_migration_resource_endpoint.call_with_http_info(**kwargs) + def update_security_monitoring_critical_asset( self, critical_asset_id: str, diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_attributes.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_attributes.py new file mode 100644 index 0000000000..3879c26f5a --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_attributes.py @@ -0,0 +1,146 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import List, Union, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + datetime, + unset, + UnsetType, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_input_source import ( + SecurityMonitoringBatchMigrationInputSource, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_status_counts import ( + SecurityMonitoringBatchMigrationResourceStatusCounts, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_status import ( + SecurityMonitoringBatchMigrationStatus, + ) + + +class SecurityMonitoringBatchMigrationAttributes(ModelNormal): + validations = { + "tags": { + "max_items": 50, + }, + } + + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_input_source import ( + SecurityMonitoringBatchMigrationInputSource, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_status_counts import ( + SecurityMonitoringBatchMigrationResourceStatusCounts, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_status import ( + SecurityMonitoringBatchMigrationStatus, + ) + + return { + "created_at": (datetime,), + "created_by": (str,), + "description": (str,), + "input_source": (SecurityMonitoringBatchMigrationInputSource,), + "last_updated_at": (datetime,), + "last_updated_by": (str,), + "name": (str,), + "org_id": (int,), + "resource_status_counts": (SecurityMonitoringBatchMigrationResourceStatusCounts,), + "status": (SecurityMonitoringBatchMigrationStatus,), + "tags": ([str],), + } + + attribute_map = { + "created_at": "createdAt", + "created_by": "createdBy", + "description": "description", + "input_source": "inputSource", + "last_updated_at": "lastUpdatedAt", + "last_updated_by": "lastUpdatedBy", + "name": "name", + "org_id": "orgId", + "resource_status_counts": "resourceStatusCounts", + "status": "status", + "tags": "tags", + } + + def __init__( + self_, + created_at: datetime, + input_source: SecurityMonitoringBatchMigrationInputSource, + last_updated_at: datetime, + name: str, + org_id: int, + resource_status_counts: SecurityMonitoringBatchMigrationResourceStatusCounts, + status: SecurityMonitoringBatchMigrationStatus, + tags: List[str], + created_by: Union[str, UnsetType] = unset, + description: Union[str, UnsetType] = unset, + last_updated_by: Union[str, UnsetType] = unset, + **kwargs, + ): + """ + Attributes of a batch migration. + + :param created_at: The creation date of the batch migration, in RFC 3339 format. + :type created_at: datetime + + :param created_by: The UUID of the user or service account who created the batch migration. + :type created_by: str, optional + + :param description: The description of the batch migration. + :type description: str, optional + + :param input_source: The origin of a batch migration. Always ``batch_migration`` for batch migrations + created through this API. + :type input_source: SecurityMonitoringBatchMigrationInputSource + + :param last_updated_at: The last update date of the batch migration, in RFC 3339 format. + :type last_updated_at: datetime + + :param last_updated_by: The UUID of the user or service account who last updated the batch migration, + or the name of a system actor. + :type last_updated_by: str, optional + + :param name: The name of the batch migration. + :type name: str + + :param org_id: The ID of the organization that owns the batch migration. + :type org_id: int + + :param resource_status_counts: The number of resources of a batch migration in each status. + :type resource_status_counts: SecurityMonitoringBatchMigrationResourceStatusCounts + + :param status: The status of a batch migration. A batch migration is created as ``draft`` and moves to + ``in_progress`` when started. It moves to ``completed`` once no resource is ``pending`` or + ``in_progress`` , or to ``canceled`` when canceled. + :type status: SecurityMonitoringBatchMigrationStatus + + :param tags: Tags of the batch migration. Up to 50 tags, each up to 256 characters. + :type tags: [str] + """ + if created_by is not unset: + kwargs["created_by"] = created_by + if description is not unset: + kwargs["description"] = description + if last_updated_by is not unset: + kwargs["last_updated_by"] = last_updated_by + super().__init__(kwargs) + + self_.created_at = created_at + self_.input_source = input_source + self_.last_updated_at = last_updated_at + self_.name = name + self_.org_id = org_id + self_.resource_status_counts = resource_status_counts + self_.status = status + self_.tags = tags diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_create_attributes.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_create_attributes.py new file mode 100644 index 0000000000..18419193f5 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_create_attributes.py @@ -0,0 +1,90 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import List, Union, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_create_item import ( + SecurityMonitoringBatchMigrationResourceCreateItem, + ) + + +class SecurityMonitoringBatchMigrationCreateAttributes(ModelNormal): + validations = { + "description": { + "max_length": 4096, + }, + "name": { + "max_length": 512, + }, + "resources": { + "max_items": 100, + "min_items": 1, + }, + "tags": { + "max_items": 50, + }, + } + + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_create_item import ( + SecurityMonitoringBatchMigrationResourceCreateItem, + ) + + return { + "description": (str,), + "name": (str,), + "resources": ([SecurityMonitoringBatchMigrationResourceCreateItem],), + "tags": ([str],), + } + + attribute_map = { + "description": "description", + "name": "name", + "resources": "resources", + "tags": "tags", + } + + def __init__( + self_, + resources: List[SecurityMonitoringBatchMigrationResourceCreateItem], + description: Union[str, UnsetType] = unset, + name: Union[str, UnsetType] = unset, + tags: Union[List[str], UnsetType] = unset, + **kwargs, + ): + """ + Attributes of the batch migration to create. + + :param description: The description of the batch migration. + :type description: str, optional + + :param name: The name of the batch migration. + :type name: str, optional + + :param resources: The initial resources of the batch migration. From 1 to 100 resources. + :type resources: [SecurityMonitoringBatchMigrationResourceCreateItem] + + :param tags: Tags of the batch migration. Up to 50 tags, each up to 256 characters. + :type tags: [str], optional + """ + if description is not unset: + kwargs["description"] = description + if name is not unset: + kwargs["name"] = name + if tags is not unset: + kwargs["tags"] = tags + super().__init__(kwargs) + + self_.resources = resources diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_create_data.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_create_data.py new file mode 100644 index 0000000000..6d472635a8 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_create_data.py @@ -0,0 +1,61 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_create_attributes import ( + SecurityMonitoringBatchMigrationCreateAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_type import ( + SecurityMonitoringBatchMigrationType, + ) + + +class SecurityMonitoringBatchMigrationCreateData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_create_attributes import ( + SecurityMonitoringBatchMigrationCreateAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_type import ( + SecurityMonitoringBatchMigrationType, + ) + + return { + "attributes": (SecurityMonitoringBatchMigrationCreateAttributes,), + "type": (SecurityMonitoringBatchMigrationType,), + } + + attribute_map = { + "attributes": "attributes", + "type": "type", + } + + def __init__( + self_, + attributes: SecurityMonitoringBatchMigrationCreateAttributes, + type: SecurityMonitoringBatchMigrationType, + **kwargs, + ): + """ + Data of the batch migration to create. + + :param attributes: Attributes of the batch migration to create. + :type attributes: SecurityMonitoringBatchMigrationCreateAttributes + + :param type: The type of resource for a batch migration. + :type type: SecurityMonitoringBatchMigrationType + """ + super().__init__(kwargs) + + self_.attributes = attributes + self_.type = type diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_create_request.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_create_request.py new file mode 100644 index 0000000000..33066f815a --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_create_request.py @@ -0,0 +1,44 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_create_data import ( + SecurityMonitoringBatchMigrationCreateData, + ) + + +class SecurityMonitoringBatchMigrationCreateRequest(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_create_data import ( + SecurityMonitoringBatchMigrationCreateData, + ) + + return { + "data": (SecurityMonitoringBatchMigrationCreateData,), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: SecurityMonitoringBatchMigrationCreateData, **kwargs): + """ + Request to create a batch migration. + + :param data: Data of the batch migration to create. + :type data: SecurityMonitoringBatchMigrationCreateData + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_data.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_data.py new file mode 100644 index 0000000000..074486d050 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_data.py @@ -0,0 +1,69 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + UUID, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_attributes import ( + SecurityMonitoringBatchMigrationAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_type import ( + SecurityMonitoringBatchMigrationType, + ) + + +class SecurityMonitoringBatchMigrationData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_attributes import ( + SecurityMonitoringBatchMigrationAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_type import ( + SecurityMonitoringBatchMigrationType, + ) + + return { + "attributes": (SecurityMonitoringBatchMigrationAttributes,), + "id": (UUID,), + "type": (SecurityMonitoringBatchMigrationType,), + } + + attribute_map = { + "attributes": "attributes", + "id": "id", + "type": "type", + } + + def __init__( + self_, + attributes: SecurityMonitoringBatchMigrationAttributes, + id: UUID, + type: SecurityMonitoringBatchMigrationType, + **kwargs, + ): + """ + A batch migration. + + :param attributes: Attributes of a batch migration. + :type attributes: SecurityMonitoringBatchMigrationAttributes + + :param id: The UUID of the batch migration. + :type id: UUID + + :param type: The type of resource for a batch migration. + :type type: SecurityMonitoringBatchMigrationType + """ + super().__init__(kwargs) + + self_.attributes = attributes + self_.id = id + self_.type = type diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_input_source.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_input_source.py new file mode 100644 index 0000000000..3b5e9cf219 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_input_source.py @@ -0,0 +1,46 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelSimple, + cached_property, +) + +from typing import ClassVar + + +class SecurityMonitoringBatchMigrationInputSource(ModelSimple): + """ + The origin of a batch migration. Always `batch_migration` for batch migrations + created through this API. + + :param value: Must be one of ["batch_migration", "threat_hunting", "user"]. + :type value: str + """ + + allowed_values = { + "batch_migration", + "threat_hunting", + "user", + } + BATCH_MIGRATION: ClassVar["SecurityMonitoringBatchMigrationInputSource"] + THREAT_HUNTING: ClassVar["SecurityMonitoringBatchMigrationInputSource"] + USER: ClassVar["SecurityMonitoringBatchMigrationInputSource"] + + @cached_property + def openapi_types(_): + return { + "value": (str,), + } + + +SecurityMonitoringBatchMigrationInputSource.BATCH_MIGRATION = SecurityMonitoringBatchMigrationInputSource( + "batch_migration" +) +SecurityMonitoringBatchMigrationInputSource.THREAT_HUNTING = SecurityMonitoringBatchMigrationInputSource( + "threat_hunting" +) +SecurityMonitoringBatchMigrationInputSource.USER = SecurityMonitoringBatchMigrationInputSource("user") diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_list_meta.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_list_meta.py new file mode 100644 index 0000000000..ef34ee9ef7 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_list_meta.py @@ -0,0 +1,33 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +class SecurityMonitoringBatchMigrationListMeta(ModelNormal): + @cached_property + def openapi_types(_): + return { + "total_count": (int,), + } + + attribute_map = { + "total_count": "totalCount", + } + + def __init__(self_, total_count: int, **kwargs): + """ + Metadata of a list response. + + :param total_count: Total number of items matching the request. + :type total_count: int + """ + super().__init__(kwargs) + + self_.total_count = total_count diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_attributes.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_attributes.py new file mode 100644 index 0000000000..db294251aa --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_attributes.py @@ -0,0 +1,44 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import List, Union + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, + UUID, +) + + +class SecurityMonitoringBatchMigrationPublishAttributes(ModelNormal): + validations = { + "resource_ids": { + "max_items": 1000, + }, + } + + @cached_property + def openapi_types(_): + return { + "resource_ids": ([UUID],), + } + + attribute_map = { + "resource_ids": "resourceIds", + } + + def __init__(self_, resource_ids: Union[List[UUID], UnsetType] = unset, **kwargs): + """ + Attributes of the batch migration publish request. + + :param resource_ids: Unique UUIDs of the resources to publish. Up to 1000 IDs. When omitted or empty, + every ``completed`` resource of the batch migration is published. + :type resource_ids: [UUID], optional + """ + if resource_ids is not unset: + kwargs["resource_ids"] = resource_ids + super().__init__(kwargs) diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_data.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_data.py new file mode 100644 index 0000000000..cc8f6497a5 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_data.py @@ -0,0 +1,61 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_publish_attributes import ( + SecurityMonitoringBatchMigrationPublishAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_publish_type import ( + SecurityMonitoringBatchMigrationPublishType, + ) + + +class SecurityMonitoringBatchMigrationPublishData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_publish_attributes import ( + SecurityMonitoringBatchMigrationPublishAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_publish_type import ( + SecurityMonitoringBatchMigrationPublishType, + ) + + return { + "attributes": (SecurityMonitoringBatchMigrationPublishAttributes,), + "type": (SecurityMonitoringBatchMigrationPublishType,), + } + + attribute_map = { + "attributes": "attributes", + "type": "type", + } + + def __init__( + self_, + attributes: SecurityMonitoringBatchMigrationPublishAttributes, + type: SecurityMonitoringBatchMigrationPublishType, + **kwargs, + ): + """ + Data of the batch migration publish request. + + :param attributes: Attributes of the batch migration publish request. + :type attributes: SecurityMonitoringBatchMigrationPublishAttributes + + :param type: The type of resource for a batch migration publish request. + :type type: SecurityMonitoringBatchMigrationPublishType + """ + super().__init__(kwargs) + + self_.attributes = attributes + self_.type = type diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_request.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_request.py new file mode 100644 index 0000000000..a9ea800e3e --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_request.py @@ -0,0 +1,44 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_publish_data import ( + SecurityMonitoringBatchMigrationPublishData, + ) + + +class SecurityMonitoringBatchMigrationPublishRequest(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_publish_data import ( + SecurityMonitoringBatchMigrationPublishData, + ) + + return { + "data": (SecurityMonitoringBatchMigrationPublishData,), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: SecurityMonitoringBatchMigrationPublishData, **kwargs): + """ + Request to publish the resources of a batch migration. + + :param data: Data of the batch migration publish request. + :type data: SecurityMonitoringBatchMigrationPublishData + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_response.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_response.py new file mode 100644 index 0000000000..c3d20ea34d --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_response.py @@ -0,0 +1,44 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import List, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_published_resource_data import ( + SecurityMonitoringBatchMigrationPublishedResourceData, + ) + + +class SecurityMonitoringBatchMigrationPublishResponse(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_published_resource_data import ( + SecurityMonitoringBatchMigrationPublishedResourceData, + ) + + return { + "data": ([SecurityMonitoringBatchMigrationPublishedResourceData],), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: List[SecurityMonitoringBatchMigrationPublishedResourceData], **kwargs): + """ + Response containing the publication outcome of each resource. + + :param data: The publication outcome of each resource. + :type data: [SecurityMonitoringBatchMigrationPublishedResourceData] + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_type.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_type.py new file mode 100644 index 0000000000..a74d5576c9 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_publish_type.py @@ -0,0 +1,37 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelSimple, + cached_property, +) + +from typing import ClassVar + + +class SecurityMonitoringBatchMigrationPublishType(ModelSimple): + """ + The type of resource for a batch migration publish request. + + :param value: If omitted defaults to "batchMigrationPublish". Must be one of ["batchMigrationPublish"]. + :type value: str + """ + + allowed_values = { + "batchMigrationPublish", + } + BATCH_MIGRATION_PUBLISH: ClassVar["SecurityMonitoringBatchMigrationPublishType"] + + @cached_property + def openapi_types(_): + return { + "value": (str,), + } + + +SecurityMonitoringBatchMigrationPublishType.BATCH_MIGRATION_PUBLISH = SecurityMonitoringBatchMigrationPublishType( + "batchMigrationPublish" +) diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_published_resource_attributes.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_published_resource_attributes.py new file mode 100644 index 0000000000..f028892764 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_published_resource_attributes.py @@ -0,0 +1,66 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Union, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_published_resource_status import ( + SecurityMonitoringBatchMigrationPublishedResourceStatus, + ) + + +class SecurityMonitoringBatchMigrationPublishedResourceAttributes(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_published_resource_status import ( + SecurityMonitoringBatchMigrationPublishedResourceStatus, + ) + + return { + "error": (str,), + "rule_id": (str,), + "status": (SecurityMonitoringBatchMigrationPublishedResourceStatus,), + } + + attribute_map = { + "error": "error", + "rule_id": "ruleId", + "status": "status", + } + + def __init__( + self_, + status: SecurityMonitoringBatchMigrationPublishedResourceStatus, + error: Union[str, UnsetType] = unset, + rule_id: Union[str, UnsetType] = unset, + **kwargs, + ): + """ + Attributes of the publication outcome of a batch migration resource. + + :param error: The reason why the resource could not be published. + :type error: str, optional + + :param rule_id: The ID of the created Cloud SIEM detection rule. + :type rule_id: str, optional + + :param status: The outcome of publishing a batch migration resource. + :type status: SecurityMonitoringBatchMigrationPublishedResourceStatus + """ + if error is not unset: + kwargs["error"] = error + if rule_id is not unset: + kwargs["rule_id"] = rule_id + super().__init__(kwargs) + + self_.status = status diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_published_resource_data.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_published_resource_data.py new file mode 100644 index 0000000000..3d6fce4d37 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_published_resource_data.py @@ -0,0 +1,69 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + UUID, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_published_resource_attributes import ( + SecurityMonitoringBatchMigrationPublishedResourceAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_published_resource_type import ( + SecurityMonitoringBatchMigrationPublishedResourceType, + ) + + +class SecurityMonitoringBatchMigrationPublishedResourceData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_published_resource_attributes import ( + SecurityMonitoringBatchMigrationPublishedResourceAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_published_resource_type import ( + SecurityMonitoringBatchMigrationPublishedResourceType, + ) + + return { + "attributes": (SecurityMonitoringBatchMigrationPublishedResourceAttributes,), + "id": (UUID,), + "type": (SecurityMonitoringBatchMigrationPublishedResourceType,), + } + + attribute_map = { + "attributes": "attributes", + "id": "id", + "type": "type", + } + + def __init__( + self_, + attributes: SecurityMonitoringBatchMigrationPublishedResourceAttributes, + id: UUID, + type: SecurityMonitoringBatchMigrationPublishedResourceType, + **kwargs, + ): + """ + The publication outcome of a batch migration resource. + + :param attributes: Attributes of the publication outcome of a batch migration resource. + :type attributes: SecurityMonitoringBatchMigrationPublishedResourceAttributes + + :param id: The UUID of the batch migration resource. + :type id: UUID + + :param type: The type of resource for a published batch migration resource. + :type type: SecurityMonitoringBatchMigrationPublishedResourceType + """ + super().__init__(kwargs) + + self_.attributes = attributes + self_.id = id + self_.type = type diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_published_resource_status.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_published_resource_status.py new file mode 100644 index 0000000000..1455f4e5e6 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_published_resource_status.py @@ -0,0 +1,42 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelSimple, + cached_property, +) + +from typing import ClassVar + + +class SecurityMonitoringBatchMigrationPublishedResourceStatus(ModelSimple): + """ + The outcome of publishing a batch migration resource. + + :param value: Must be one of ["published", "failed"]. + :type value: str + """ + + allowed_values = { + "published", + "failed", + } + PUBLISHED: ClassVar["SecurityMonitoringBatchMigrationPublishedResourceStatus"] + FAILED: ClassVar["SecurityMonitoringBatchMigrationPublishedResourceStatus"] + + @cached_property + def openapi_types(_): + return { + "value": (str,), + } + + +SecurityMonitoringBatchMigrationPublishedResourceStatus.PUBLISHED = ( + SecurityMonitoringBatchMigrationPublishedResourceStatus("published") +) +SecurityMonitoringBatchMigrationPublishedResourceStatus.FAILED = ( + SecurityMonitoringBatchMigrationPublishedResourceStatus("failed") +) diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_published_resource_type.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_published_resource_type.py new file mode 100644 index 0000000000..ce8852c06f --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_published_resource_type.py @@ -0,0 +1,37 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelSimple, + cached_property, +) + +from typing import ClassVar + + +class SecurityMonitoringBatchMigrationPublishedResourceType(ModelSimple): + """ + The type of resource for a published batch migration resource. + + :param value: If omitted defaults to "batchMigrationPublishedResource". Must be one of ["batchMigrationPublishedResource"]. + :type value: str + """ + + allowed_values = { + "batchMigrationPublishedResource", + } + BATCH_MIGRATION_PUBLISHED_RESOURCE: ClassVar["SecurityMonitoringBatchMigrationPublishedResourceType"] + + @cached_property + def openapi_types(_): + return { + "value": (str,), + } + + +SecurityMonitoringBatchMigrationPublishedResourceType.BATCH_MIGRATION_PUBLISHED_RESOURCE = ( + SecurityMonitoringBatchMigrationPublishedResourceType("batchMigrationPublishedResource") +) diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_attributes.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_attributes.py new file mode 100644 index 0000000000..6c721d572e --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_attributes.py @@ -0,0 +1,161 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Union, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + datetime, + none_type, + unset, + UnsetType, + UUID, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_input_type import ( + SecurityMonitoringBatchMigrationResourceInputType, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_output import ( + SecurityMonitoringBatchMigrationResourceOutput, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_status import ( + SecurityMonitoringBatchMigrationResourceStatus, + ) + + +class SecurityMonitoringBatchMigrationResourceAttributes(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_input_type import ( + SecurityMonitoringBatchMigrationResourceInputType, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_output import ( + SecurityMonitoringBatchMigrationResourceOutput, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_status import ( + SecurityMonitoringBatchMigrationResourceStatus, + ) + + return { + "batch_id": (UUID,), + "created_at": (datetime,), + "created_by": (str,), + "description": (str,), + "input": (str,), + "input_type": (SecurityMonitoringBatchMigrationResourceInputType,), + "last_updated_at": (datetime,), + "last_updated_by": (str,), + "name": (str,), + "output": (SecurityMonitoringBatchMigrationResourceOutput,), + "output_type": (str,), + "rule_id": (str,), + "status": (SecurityMonitoringBatchMigrationResourceStatus,), + } + + attribute_map = { + "batch_id": "batchId", + "created_at": "createdAt", + "created_by": "createdBy", + "description": "description", + "input": "input", + "input_type": "inputType", + "last_updated_at": "lastUpdatedAt", + "last_updated_by": "lastUpdatedBy", + "name": "name", + "output": "output", + "output_type": "outputType", + "rule_id": "ruleId", + "status": "status", + } + + def __init__( + self_, + batch_id: UUID, + created_at: datetime, + input: str, + input_type: SecurityMonitoringBatchMigrationResourceInputType, + last_updated_at: datetime, + name: str, + output: Union[SecurityMonitoringBatchMigrationResourceOutput, none_type], + output_type: str, + status: SecurityMonitoringBatchMigrationResourceStatus, + created_by: Union[str, UnsetType] = unset, + description: Union[str, UnsetType] = unset, + last_updated_by: Union[str, UnsetType] = unset, + rule_id: Union[str, UnsetType] = unset, + **kwargs, + ): + """ + Attributes of a batch migration resource. + + :param batch_id: The UUID of the batch migration that contains the resource. + :type batch_id: UUID + + :param created_at: The creation date of the resource, in RFC 3339 format. + :type created_at: datetime + + :param created_by: The UUID of the user or service account who created the resource. + :type created_by: str, optional + + :param description: The description of the resource. + :type description: str, optional + + :param input: The source query or natural language description to translate. + :type input: str + + :param input_type: The type of the source rule: ``spl`` for a Splunk SPL search or saved search definition, + ``natural_language`` for a plain-English description of the behavior to detect, or ``kql`` + for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded. + :type input_type: SecurityMonitoringBatchMigrationResourceInputType + + :param last_updated_at: The last update date of the resource, in RFC 3339 format. + :type last_updated_at: datetime + + :param last_updated_by: The UUID of the user or service account who last updated the resource, + or the name of a system actor. + :type last_updated_by: str, optional + + :param name: The name of the resource. + :type name: str + + :param output: The translation output. When the resource is ``completed`` , a Cloud SIEM detection rule + definition in the same format as the create detection rule API. When the resource is + ``failed`` , an object with an ``error`` describing the failure, with ``kind`` set to + ``translation_error`` or ``internal_error`` , and optional ``type`` and ``message``. Otherwise, null. + :type output: SecurityMonitoringBatchMigrationResourceOutput, none_type + + :param output_type: The type of the translation output. Currently always ``siem_rule``. + :type output_type: str + + :param rule_id: The ID of the Cloud SIEM detection rule created when the resource was published. + :type rule_id: str, optional + + :param status: The status of a batch migration resource. ``completed`` resources have a translation in + ``output`` that is ready to be published. ``duplicate`` is reserved for future duplicate rule + detection. + :type status: SecurityMonitoringBatchMigrationResourceStatus + """ + if created_by is not unset: + kwargs["created_by"] = created_by + if description is not unset: + kwargs["description"] = description + if last_updated_by is not unset: + kwargs["last_updated_by"] = last_updated_by + if rule_id is not unset: + kwargs["rule_id"] = rule_id + super().__init__(kwargs) + + self_.batch_id = batch_id + self_.created_at = created_at + self_.input = input + self_.input_type = input_type + self_.last_updated_at = last_updated_at + self_.name = name + self_.output = output + self_.output_type = output_type + self_.status = status diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_create_item.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_create_item.py new file mode 100644 index 0000000000..e8d0fea8a5 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_create_item.py @@ -0,0 +1,88 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Union, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_input_type import ( + SecurityMonitoringBatchMigrationResourceInputType, + ) + + +class SecurityMonitoringBatchMigrationResourceCreateItem(ModelNormal): + validations = { + "description": { + "max_length": 4096, + }, + "input": { + "max_length": 65536, + "min_length": 1, + }, + "name": { + "max_length": 512, + }, + } + + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_input_type import ( + SecurityMonitoringBatchMigrationResourceInputType, + ) + + return { + "description": (str,), + "input": (str,), + "input_type": (SecurityMonitoringBatchMigrationResourceInputType,), + "name": (str,), + } + + attribute_map = { + "description": "description", + "input": "input", + "input_type": "inputType", + "name": "name", + } + + def __init__( + self_, + input: str, + input_type: SecurityMonitoringBatchMigrationResourceInputType, + description: Union[str, UnsetType] = unset, + name: Union[str, UnsetType] = unset, + **kwargs, + ): + """ + A source rule to translate into a Cloud SIEM detection rule. + + :param description: The description of the resource. + :type description: str, optional + + :param input: The source query or natural language description to translate. Must not be blank. + :type input: str + + :param input_type: The type of the source rule: ``spl`` for a Splunk SPL search or saved search definition, + ``natural_language`` for a plain-English description of the behavior to detect, or ``kql`` + for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded. + :type input_type: SecurityMonitoringBatchMigrationResourceInputType + + :param name: The name of the resource. + :type name: str, optional + """ + if description is not unset: + kwargs["description"] = description + if name is not unset: + kwargs["name"] = name + super().__init__(kwargs) + + self_.input = input + self_.input_type = input_type diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_data.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_data.py new file mode 100644 index 0000000000..b5ba8dcf94 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_data.py @@ -0,0 +1,69 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + UUID, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_attributes import ( + SecurityMonitoringBatchMigrationResourceAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_type import ( + SecurityMonitoringBatchMigrationResourceType, + ) + + +class SecurityMonitoringBatchMigrationResourceData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_attributes import ( + SecurityMonitoringBatchMigrationResourceAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_type import ( + SecurityMonitoringBatchMigrationResourceType, + ) + + return { + "attributes": (SecurityMonitoringBatchMigrationResourceAttributes,), + "id": (UUID,), + "type": (SecurityMonitoringBatchMigrationResourceType,), + } + + attribute_map = { + "attributes": "attributes", + "id": "id", + "type": "type", + } + + def __init__( + self_, + attributes: SecurityMonitoringBatchMigrationResourceAttributes, + id: UUID, + type: SecurityMonitoringBatchMigrationResourceType, + **kwargs, + ): + """ + A batch migration resource. + + :param attributes: Attributes of a batch migration resource. + :type attributes: SecurityMonitoringBatchMigrationResourceAttributes + + :param id: The UUID of the batch migration resource. + :type id: UUID + + :param type: The type of resource for a batch migration resource. + :type type: SecurityMonitoringBatchMigrationResourceType + """ + super().__init__(kwargs) + + self_.attributes = attributes + self_.id = id + self_.type = type diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_input_type.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_input_type.py new file mode 100644 index 0000000000..efeeb7014e --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_input_type.py @@ -0,0 +1,45 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelSimple, + cached_property, +) + +from typing import ClassVar + + +class SecurityMonitoringBatchMigrationResourceInputType(ModelSimple): + """ + The type of the source rule: `spl` for a Splunk SPL search or saved search definition, + `natural_language` for a plain-English description of the behavior to detect, or `kql` + for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded. + + :param value: Must be one of ["natural_language", "spl", "kql"]. + :type value: str + """ + + allowed_values = { + "natural_language", + "spl", + "kql", + } + NATURAL_LANGUAGE: ClassVar["SecurityMonitoringBatchMigrationResourceInputType"] + SPL: ClassVar["SecurityMonitoringBatchMigrationResourceInputType"] + KQL: ClassVar["SecurityMonitoringBatchMigrationResourceInputType"] + + @cached_property + def openapi_types(_): + return { + "value": (str,), + } + + +SecurityMonitoringBatchMigrationResourceInputType.NATURAL_LANGUAGE = SecurityMonitoringBatchMigrationResourceInputType( + "natural_language" +) +SecurityMonitoringBatchMigrationResourceInputType.SPL = SecurityMonitoringBatchMigrationResourceInputType("spl") +SecurityMonitoringBatchMigrationResourceInputType.KQL = SecurityMonitoringBatchMigrationResourceInputType("kql") diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_output.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_output.py new file mode 100644 index 0000000000..f8ae11b298 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_output.py @@ -0,0 +1,22 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelNormal, +) + + +class SecurityMonitoringBatchMigrationResourceOutput(ModelNormal): + _nullable = True + + def __init__(self_, **kwargs): + """ + The translation output. When the resource is ``completed`` , a Cloud SIEM detection rule + definition in the same format as the create detection rule API. When the resource is + ``failed`` , an object with an ``error`` describing the failure, with ``kind`` set to + ``translation_error`` or ``internal_error`` , and optional ``type`` and ``message``. Otherwise, null. + """ + super().__init__(kwargs) diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_response.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_response.py new file mode 100644 index 0000000000..0629a923a0 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_response.py @@ -0,0 +1,44 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_data import ( + SecurityMonitoringBatchMigrationResourceData, + ) + + +class SecurityMonitoringBatchMigrationResourceResponse(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_data import ( + SecurityMonitoringBatchMigrationResourceData, + ) + + return { + "data": (SecurityMonitoringBatchMigrationResourceData,), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: SecurityMonitoringBatchMigrationResourceData, **kwargs): + """ + Response containing a batch migration resource. + + :param data: A batch migration resource. + :type data: SecurityMonitoringBatchMigrationResourceData + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_status.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_status.py new file mode 100644 index 0000000000..dec4166c5a --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_status.py @@ -0,0 +1,60 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelSimple, + cached_property, +) + +from typing import ClassVar + + +class SecurityMonitoringBatchMigrationResourceStatus(ModelSimple): + """ + The status of a batch migration resource. `completed` resources have a translation in + `output` that is ready to be published. `duplicate` is reserved for future duplicate rule + detection. + + :param value: Must be one of ["pending", "in_progress", "completed", "canceled", "failed", "publishing", "published", "duplicate"]. + :type value: str + """ + + allowed_values = { + "pending", + "in_progress", + "completed", + "canceled", + "failed", + "publishing", + "published", + "duplicate", + } + PENDING: ClassVar["SecurityMonitoringBatchMigrationResourceStatus"] + IN_PROGRESS: ClassVar["SecurityMonitoringBatchMigrationResourceStatus"] + COMPLETED: ClassVar["SecurityMonitoringBatchMigrationResourceStatus"] + CANCELED: ClassVar["SecurityMonitoringBatchMigrationResourceStatus"] + FAILED: ClassVar["SecurityMonitoringBatchMigrationResourceStatus"] + PUBLISHING: ClassVar["SecurityMonitoringBatchMigrationResourceStatus"] + PUBLISHED: ClassVar["SecurityMonitoringBatchMigrationResourceStatus"] + DUPLICATE: ClassVar["SecurityMonitoringBatchMigrationResourceStatus"] + + @cached_property + def openapi_types(_): + return { + "value": (str,), + } + + +SecurityMonitoringBatchMigrationResourceStatus.PENDING = SecurityMonitoringBatchMigrationResourceStatus("pending") +SecurityMonitoringBatchMigrationResourceStatus.IN_PROGRESS = SecurityMonitoringBatchMigrationResourceStatus( + "in_progress" +) +SecurityMonitoringBatchMigrationResourceStatus.COMPLETED = SecurityMonitoringBatchMigrationResourceStatus("completed") +SecurityMonitoringBatchMigrationResourceStatus.CANCELED = SecurityMonitoringBatchMigrationResourceStatus("canceled") +SecurityMonitoringBatchMigrationResourceStatus.FAILED = SecurityMonitoringBatchMigrationResourceStatus("failed") +SecurityMonitoringBatchMigrationResourceStatus.PUBLISHING = SecurityMonitoringBatchMigrationResourceStatus("publishing") +SecurityMonitoringBatchMigrationResourceStatus.PUBLISHED = SecurityMonitoringBatchMigrationResourceStatus("published") +SecurityMonitoringBatchMigrationResourceStatus.DUPLICATE = SecurityMonitoringBatchMigrationResourceStatus("duplicate") diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_status_counts.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_status_counts.py new file mode 100644 index 0000000000..d70fdceeff --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_status_counts.py @@ -0,0 +1,86 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +class SecurityMonitoringBatchMigrationResourceStatusCounts(ModelNormal): + @cached_property + def openapi_types(_): + return { + "canceled": (int,), + "completed": (int,), + "duplicate": (int,), + "failed": (int,), + "in_progress": (int,), + "pending": (int,), + "published": (int,), + "publishing": (int,), + } + + attribute_map = { + "canceled": "canceled", + "completed": "completed", + "duplicate": "duplicate", + "failed": "failed", + "in_progress": "inProgress", + "pending": "pending", + "published": "published", + "publishing": "publishing", + } + + def __init__( + self_, + canceled: int, + completed: int, + duplicate: int, + failed: int, + in_progress: int, + pending: int, + published: int, + publishing: int, + **kwargs, + ): + """ + The number of resources of a batch migration in each status. + + :param canceled: Number of resources whose translation was canceled. + :type canceled: int + + :param completed: Number of resources translated and ready to be published. + :type completed: int + + :param duplicate: Number of resources identified as duplicates of an existing rule. Reserved for future use. + :type duplicate: int + + :param failed: Number of resources whose translation failed. + :type failed: int + + :param in_progress: Number of resources being translated. + :type in_progress: int + + :param pending: Number of resources waiting to be translated. + :type pending: int + + :param published: Number of resources published as Cloud SIEM detection rules. + :type published: int + + :param publishing: Number of resources being published. + :type publishing: int + """ + super().__init__(kwargs) + + self_.canceled = canceled + self_.completed = completed + self_.duplicate = duplicate + self_.failed = failed + self_.in_progress = in_progress + self_.pending = pending + self_.published = published + self_.publishing = publishing diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_type.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_type.py new file mode 100644 index 0000000000..4f78facd1d --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_type.py @@ -0,0 +1,37 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelSimple, + cached_property, +) + +from typing import ClassVar + + +class SecurityMonitoringBatchMigrationResourceType(ModelSimple): + """ + The type of resource for a batch migration resource. + + :param value: If omitted defaults to "batchMigrationResource". Must be one of ["batchMigrationResource"]. + :type value: str + """ + + allowed_values = { + "batchMigrationResource", + } + BATCH_MIGRATION_RESOURCE: ClassVar["SecurityMonitoringBatchMigrationResourceType"] + + @cached_property + def openapi_types(_): + return { + "value": (str,), + } + + +SecurityMonitoringBatchMigrationResourceType.BATCH_MIGRATION_RESOURCE = SecurityMonitoringBatchMigrationResourceType( + "batchMigrationResource" +) diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_update_attributes.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_update_attributes.py new file mode 100644 index 0000000000..89efd9a04e --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_update_attributes.py @@ -0,0 +1,93 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Union, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_input_type import ( + SecurityMonitoringBatchMigrationResourceInputType, + ) + + +class SecurityMonitoringBatchMigrationResourceUpdateAttributes(ModelNormal): + validations = { + "description": { + "max_length": 4096, + }, + "input": { + "max_length": 65536, + "min_length": 1, + }, + "name": { + "max_length": 512, + }, + } + + @cached_property + def additional_properties_type(_): + return None + + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_input_type import ( + SecurityMonitoringBatchMigrationResourceInputType, + ) + + return { + "description": (str,), + "input": (str,), + "input_type": (SecurityMonitoringBatchMigrationResourceInputType,), + "name": (str,), + } + + attribute_map = { + "description": "description", + "input": "input", + "input_type": "inputType", + "name": "name", + } + + def __init__( + self_, + description: Union[str, UnsetType] = unset, + input: Union[str, UnsetType] = unset, + input_type: Union[SecurityMonitoringBatchMigrationResourceInputType, UnsetType] = unset, + name: Union[str, UnsetType] = unset, + **kwargs, + ): + """ + Attributes of the batch migration resource to update. At least one attribute is required. + + :param description: The description of the resource. + :type description: str, optional + + :param input: The source query or natural language description to translate. Must not be blank. + :type input: str, optional + + :param input_type: The type of the source rule: ``spl`` for a Splunk SPL search or saved search definition, + ``natural_language`` for a plain-English description of the behavior to detect, or ``kql`` + for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded. + :type input_type: SecurityMonitoringBatchMigrationResourceInputType, optional + + :param name: The name of the resource. + :type name: str, optional + """ + if description is not unset: + kwargs["description"] = description + if input is not unset: + kwargs["input"] = input + if input_type is not unset: + kwargs["input_type"] = input_type + if name is not unset: + kwargs["name"] = name + super().__init__(kwargs) diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_update_data.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_update_data.py new file mode 100644 index 0000000000..52595ecaa3 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_update_data.py @@ -0,0 +1,61 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_update_attributes import ( + SecurityMonitoringBatchMigrationResourceUpdateAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_type import ( + SecurityMonitoringBatchMigrationResourceType, + ) + + +class SecurityMonitoringBatchMigrationResourceUpdateData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_update_attributes import ( + SecurityMonitoringBatchMigrationResourceUpdateAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_type import ( + SecurityMonitoringBatchMigrationResourceType, + ) + + return { + "attributes": (SecurityMonitoringBatchMigrationResourceUpdateAttributes,), + "type": (SecurityMonitoringBatchMigrationResourceType,), + } + + attribute_map = { + "attributes": "attributes", + "type": "type", + } + + def __init__( + self_, + attributes: SecurityMonitoringBatchMigrationResourceUpdateAttributes, + type: SecurityMonitoringBatchMigrationResourceType, + **kwargs, + ): + """ + Data of the batch migration resource to update. + + :param attributes: Attributes of the batch migration resource to update. At least one attribute is required. + :type attributes: SecurityMonitoringBatchMigrationResourceUpdateAttributes + + :param type: The type of resource for a batch migration resource. + :type type: SecurityMonitoringBatchMigrationResourceType + """ + super().__init__(kwargs) + + self_.attributes = attributes + self_.type = type diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_update_request.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_update_request.py new file mode 100644 index 0000000000..151e51cb6f --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resource_update_request.py @@ -0,0 +1,44 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_update_data import ( + SecurityMonitoringBatchMigrationResourceUpdateData, + ) + + +class SecurityMonitoringBatchMigrationResourceUpdateRequest(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_update_data import ( + SecurityMonitoringBatchMigrationResourceUpdateData, + ) + + return { + "data": (SecurityMonitoringBatchMigrationResourceUpdateData,), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: SecurityMonitoringBatchMigrationResourceUpdateData, **kwargs): + """ + Request to update a batch migration resource. + + :param data: Data of the batch migration resource to update. + :type data: SecurityMonitoringBatchMigrationResourceUpdateData + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_create_attributes.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_create_attributes.py new file mode 100644 index 0000000000..b944b76b17 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_create_attributes.py @@ -0,0 +1,51 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import List, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_create_item import ( + SecurityMonitoringBatchMigrationResourceCreateItem, + ) + + +class SecurityMonitoringBatchMigrationResourcesCreateAttributes(ModelNormal): + validations = { + "resources": { + "max_items": 1000, + "min_items": 1, + }, + } + + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_create_item import ( + SecurityMonitoringBatchMigrationResourceCreateItem, + ) + + return { + "resources": ([SecurityMonitoringBatchMigrationResourceCreateItem],), + } + + attribute_map = { + "resources": "resources", + } + + def __init__(self_, resources: List[SecurityMonitoringBatchMigrationResourceCreateItem], **kwargs): + """ + Attributes of the resources to add to a batch migration. + + :param resources: The resources to add. From 1 to 1000 resources. + :type resources: [SecurityMonitoringBatchMigrationResourceCreateItem] + """ + super().__init__(kwargs) + + self_.resources = resources diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_create_data.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_create_data.py new file mode 100644 index 0000000000..4450ceacfa --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_create_data.py @@ -0,0 +1,61 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_create_attributes import ( + SecurityMonitoringBatchMigrationResourcesCreateAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_type import ( + SecurityMonitoringBatchMigrationResourcesType, + ) + + +class SecurityMonitoringBatchMigrationResourcesCreateData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_create_attributes import ( + SecurityMonitoringBatchMigrationResourcesCreateAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_type import ( + SecurityMonitoringBatchMigrationResourcesType, + ) + + return { + "attributes": (SecurityMonitoringBatchMigrationResourcesCreateAttributes,), + "type": (SecurityMonitoringBatchMigrationResourcesType,), + } + + attribute_map = { + "attributes": "attributes", + "type": "type", + } + + def __init__( + self_, + attributes: SecurityMonitoringBatchMigrationResourcesCreateAttributes, + type: SecurityMonitoringBatchMigrationResourcesType, + **kwargs, + ): + """ + Data of the resources to add to a batch migration. + + :param attributes: Attributes of the resources to add to a batch migration. + :type attributes: SecurityMonitoringBatchMigrationResourcesCreateAttributes + + :param type: The type of resource for a request on a set of batch migration resources. + :type type: SecurityMonitoringBatchMigrationResourcesType + """ + super().__init__(kwargs) + + self_.attributes = attributes + self_.type = type diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_create_request.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_create_request.py new file mode 100644 index 0000000000..5b6e2433e2 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_create_request.py @@ -0,0 +1,44 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_create_data import ( + SecurityMonitoringBatchMigrationResourcesCreateData, + ) + + +class SecurityMonitoringBatchMigrationResourcesCreateRequest(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_create_data import ( + SecurityMonitoringBatchMigrationResourcesCreateData, + ) + + return { + "data": (SecurityMonitoringBatchMigrationResourcesCreateData,), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: SecurityMonitoringBatchMigrationResourcesCreateData, **kwargs): + """ + Request to add resources to a batch migration. + + :param data: Data of the resources to add to a batch migration. + :type data: SecurityMonitoringBatchMigrationResourcesCreateData + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_create_response.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_create_response.py new file mode 100644 index 0000000000..6c700939de --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_create_response.py @@ -0,0 +1,44 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import List, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_data import ( + SecurityMonitoringBatchMigrationResourceData, + ) + + +class SecurityMonitoringBatchMigrationResourcesCreateResponse(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_data import ( + SecurityMonitoringBatchMigrationResourceData, + ) + + return { + "data": ([SecurityMonitoringBatchMigrationResourceData],), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: List[SecurityMonitoringBatchMigrationResourceData], **kwargs): + """ + Response containing the batch migration resources that were added. + + :param data: The added batch migration resources. + :type data: [SecurityMonitoringBatchMigrationResourceData] + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_delete_attributes.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_delete_attributes.py new file mode 100644 index 0000000000..6d508f5343 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_delete_attributes.py @@ -0,0 +1,42 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import List + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + UUID, +) + + +class SecurityMonitoringBatchMigrationResourcesDeleteAttributes(ModelNormal): + validations = { + "resource_ids": { + "max_items": 1000, + "min_items": 1, + }, + } + + @cached_property + def openapi_types(_): + return { + "resource_ids": ([UUID],), + } + + attribute_map = { + "resource_ids": "resourceIds", + } + + def __init__(self_, resource_ids: List[UUID], **kwargs): + """ + Attributes of the resources to delete from a batch migration. + + :param resource_ids: Unique UUIDs of batch migration resources. From 1 to 1000 IDs. + :type resource_ids: [UUID] + """ + super().__init__(kwargs) + + self_.resource_ids = resource_ids diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_delete_data.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_delete_data.py new file mode 100644 index 0000000000..a91b1193ff --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_delete_data.py @@ -0,0 +1,61 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_delete_attributes import ( + SecurityMonitoringBatchMigrationResourcesDeleteAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_type import ( + SecurityMonitoringBatchMigrationResourcesType, + ) + + +class SecurityMonitoringBatchMigrationResourcesDeleteData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_delete_attributes import ( + SecurityMonitoringBatchMigrationResourcesDeleteAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_type import ( + SecurityMonitoringBatchMigrationResourcesType, + ) + + return { + "attributes": (SecurityMonitoringBatchMigrationResourcesDeleteAttributes,), + "type": (SecurityMonitoringBatchMigrationResourcesType,), + } + + attribute_map = { + "attributes": "attributes", + "type": "type", + } + + def __init__( + self_, + attributes: SecurityMonitoringBatchMigrationResourcesDeleteAttributes, + type: SecurityMonitoringBatchMigrationResourcesType, + **kwargs, + ): + """ + Data of the resources to delete from a batch migration. + + :param attributes: Attributes of the resources to delete from a batch migration. + :type attributes: SecurityMonitoringBatchMigrationResourcesDeleteAttributes + + :param type: The type of resource for a request on a set of batch migration resources. + :type type: SecurityMonitoringBatchMigrationResourcesType + """ + super().__init__(kwargs) + + self_.attributes = attributes + self_.type = type diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_delete_request.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_delete_request.py new file mode 100644 index 0000000000..846f7b23ac --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_delete_request.py @@ -0,0 +1,44 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_delete_data import ( + SecurityMonitoringBatchMigrationResourcesDeleteData, + ) + + +class SecurityMonitoringBatchMigrationResourcesDeleteRequest(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_delete_data import ( + SecurityMonitoringBatchMigrationResourcesDeleteData, + ) + + return { + "data": (SecurityMonitoringBatchMigrationResourcesDeleteData,), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: SecurityMonitoringBatchMigrationResourcesDeleteData, **kwargs): + """ + Request to delete resources from a batch migration. + + :param data: Data of the resources to delete from a batch migration. + :type data: SecurityMonitoringBatchMigrationResourcesDeleteData + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_list_response.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_list_response.py new file mode 100644 index 0000000000..47e86eed7a --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_list_response.py @@ -0,0 +1,61 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import List, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_data import ( + SecurityMonitoringBatchMigrationResourceData, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_list_meta import ( + SecurityMonitoringBatchMigrationListMeta, + ) + + +class SecurityMonitoringBatchMigrationResourcesListResponse(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_data import ( + SecurityMonitoringBatchMigrationResourceData, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_list_meta import ( + SecurityMonitoringBatchMigrationListMeta, + ) + + return { + "data": ([SecurityMonitoringBatchMigrationResourceData],), + "meta": (SecurityMonitoringBatchMigrationListMeta,), + } + + attribute_map = { + "data": "data", + "meta": "meta", + } + + def __init__( + self_, + data: List[SecurityMonitoringBatchMigrationResourceData], + meta: SecurityMonitoringBatchMigrationListMeta, + **kwargs, + ): + """ + Response containing batch migration resources. + + :param data: The batch migration resources. + :type data: [SecurityMonitoringBatchMigrationResourceData] + + :param meta: Metadata of a list response. + :type meta: SecurityMonitoringBatchMigrationListMeta + """ + super().__init__(kwargs) + + self_.data = data + self_.meta = meta diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_type.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_type.py new file mode 100644 index 0000000000..9962d7a6ef --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_resources_type.py @@ -0,0 +1,37 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelSimple, + cached_property, +) + +from typing import ClassVar + + +class SecurityMonitoringBatchMigrationResourcesType(ModelSimple): + """ + The type of resource for a request on a set of batch migration resources. + + :param value: If omitted defaults to "batchMigrationResources". Must be one of ["batchMigrationResources"]. + :type value: str + """ + + allowed_values = { + "batchMigrationResources", + } + BATCH_MIGRATION_RESOURCES: ClassVar["SecurityMonitoringBatchMigrationResourcesType"] + + @cached_property + def openapi_types(_): + return { + "value": (str,), + } + + +SecurityMonitoringBatchMigrationResourcesType.BATCH_MIGRATION_RESOURCES = SecurityMonitoringBatchMigrationResourcesType( + "batchMigrationResources" +) diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_response.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_response.py new file mode 100644 index 0000000000..86ea922305 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_response.py @@ -0,0 +1,44 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_data import ( + SecurityMonitoringBatchMigrationData, + ) + + +class SecurityMonitoringBatchMigrationResponse(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_data import ( + SecurityMonitoringBatchMigrationData, + ) + + return { + "data": (SecurityMonitoringBatchMigrationData,), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: SecurityMonitoringBatchMigrationData, **kwargs): + """ + Response containing a batch migration. + + :param data: A batch migration. + :type data: SecurityMonitoringBatchMigrationData + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_status.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_status.py new file mode 100644 index 0000000000..e0bc2103af --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_status.py @@ -0,0 +1,46 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelSimple, + cached_property, +) + +from typing import ClassVar + + +class SecurityMonitoringBatchMigrationStatus(ModelSimple): + """ + The status of a batch migration. A batch migration is created as `draft` and moves to + `in_progress` when started. It moves to `completed` once no resource is `pending` or + `in_progress`, or to `canceled` when canceled. + + :param value: Must be one of ["draft", "in_progress", "canceled", "completed"]. + :type value: str + """ + + allowed_values = { + "draft", + "in_progress", + "canceled", + "completed", + } + DRAFT: ClassVar["SecurityMonitoringBatchMigrationStatus"] + IN_PROGRESS: ClassVar["SecurityMonitoringBatchMigrationStatus"] + CANCELED: ClassVar["SecurityMonitoringBatchMigrationStatus"] + COMPLETED: ClassVar["SecurityMonitoringBatchMigrationStatus"] + + @cached_property + def openapi_types(_): + return { + "value": (str,), + } + + +SecurityMonitoringBatchMigrationStatus.DRAFT = SecurityMonitoringBatchMigrationStatus("draft") +SecurityMonitoringBatchMigrationStatus.IN_PROGRESS = SecurityMonitoringBatchMigrationStatus("in_progress") +SecurityMonitoringBatchMigrationStatus.CANCELED = SecurityMonitoringBatchMigrationStatus("canceled") +SecurityMonitoringBatchMigrationStatus.COMPLETED = SecurityMonitoringBatchMigrationStatus("completed") diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_type.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_type.py new file mode 100644 index 0000000000..d424e209d0 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_type.py @@ -0,0 +1,35 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelSimple, + cached_property, +) + +from typing import ClassVar + + +class SecurityMonitoringBatchMigrationType(ModelSimple): + """ + The type of resource for a batch migration. + + :param value: If omitted defaults to "batchMigration". Must be one of ["batchMigration"]. + :type value: str + """ + + allowed_values = { + "batchMigration", + } + BATCH_MIGRATION: ClassVar["SecurityMonitoringBatchMigrationType"] + + @cached_property + def openapi_types(_): + return { + "value": (str,), + } + + +SecurityMonitoringBatchMigrationType.BATCH_MIGRATION = SecurityMonitoringBatchMigrationType("batchMigration") diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_update_attributes.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_update_attributes.py new file mode 100644 index 0000000000..5e25266fe0 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_update_attributes.py @@ -0,0 +1,72 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import List, Union + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, +) + + +class SecurityMonitoringBatchMigrationUpdateAttributes(ModelNormal): + validations = { + "description": { + "max_length": 4096, + }, + "name": { + "max_length": 512, + }, + "tags": { + "max_items": 50, + }, + } + + @cached_property + def additional_properties_type(_): + return None + + @cached_property + def openapi_types(_): + return { + "description": (str,), + "name": (str,), + "tags": ([str],), + } + + attribute_map = { + "description": "description", + "name": "name", + "tags": "tags", + } + + def __init__( + self_, + description: Union[str, UnsetType] = unset, + name: Union[str, UnsetType] = unset, + tags: Union[List[str], UnsetType] = unset, + **kwargs, + ): + """ + Attributes of the batch migration to update. At least one attribute is required. + + :param description: The description of the batch migration. + :type description: str, optional + + :param name: The name of the batch migration. + :type name: str, optional + + :param tags: Tags of the batch migration. Up to 50 tags, each up to 256 characters. + :type tags: [str], optional + """ + if description is not unset: + kwargs["description"] = description + if name is not unset: + kwargs["name"] = name + if tags is not unset: + kwargs["tags"] = tags + super().__init__(kwargs) diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_update_data.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_update_data.py new file mode 100644 index 0000000000..d209c0d332 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_update_data.py @@ -0,0 +1,61 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_update_attributes import ( + SecurityMonitoringBatchMigrationUpdateAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_type import ( + SecurityMonitoringBatchMigrationType, + ) + + +class SecurityMonitoringBatchMigrationUpdateData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_update_attributes import ( + SecurityMonitoringBatchMigrationUpdateAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_type import ( + SecurityMonitoringBatchMigrationType, + ) + + return { + "attributes": (SecurityMonitoringBatchMigrationUpdateAttributes,), + "type": (SecurityMonitoringBatchMigrationType,), + } + + attribute_map = { + "attributes": "attributes", + "type": "type", + } + + def __init__( + self_, + attributes: SecurityMonitoringBatchMigrationUpdateAttributes, + type: SecurityMonitoringBatchMigrationType, + **kwargs, + ): + """ + Data of the batch migration to update. + + :param attributes: Attributes of the batch migration to update. At least one attribute is required. + :type attributes: SecurityMonitoringBatchMigrationUpdateAttributes + + :param type: The type of resource for a batch migration. + :type type: SecurityMonitoringBatchMigrationType + """ + super().__init__(kwargs) + + self_.attributes = attributes + self_.type = type diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migration_update_request.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_update_request.py new file mode 100644 index 0000000000..fefe576de7 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migration_update_request.py @@ -0,0 +1,44 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_update_data import ( + SecurityMonitoringBatchMigrationUpdateData, + ) + + +class SecurityMonitoringBatchMigrationUpdateRequest(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_update_data import ( + SecurityMonitoringBatchMigrationUpdateData, + ) + + return { + "data": (SecurityMonitoringBatchMigrationUpdateData,), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: SecurityMonitoringBatchMigrationUpdateData, **kwargs): + """ + Request to update a batch migration. + + :param data: Data of the batch migration to update. + :type data: SecurityMonitoringBatchMigrationUpdateData + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/security_monitoring_batch_migrations_list_response.py b/src/datadog_api_client/v2/model/security_monitoring_batch_migrations_list_response.py new file mode 100644 index 0000000000..37ad6ee33a --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_batch_migrations_list_response.py @@ -0,0 +1,61 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import List, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_batch_migration_data import ( + SecurityMonitoringBatchMigrationData, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_list_meta import ( + SecurityMonitoringBatchMigrationListMeta, + ) + + +class SecurityMonitoringBatchMigrationsListResponse(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_batch_migration_data import ( + SecurityMonitoringBatchMigrationData, + ) + from datadog_api_client.v2.model.security_monitoring_batch_migration_list_meta import ( + SecurityMonitoringBatchMigrationListMeta, + ) + + return { + "data": ([SecurityMonitoringBatchMigrationData],), + "meta": (SecurityMonitoringBatchMigrationListMeta,), + } + + attribute_map = { + "data": "data", + "meta": "meta", + } + + def __init__( + self_, + data: List[SecurityMonitoringBatchMigrationData], + meta: SecurityMonitoringBatchMigrationListMeta, + **kwargs, + ): + """ + Response containing a page of batch migrations. + + :param data: The batch migrations. + :type data: [SecurityMonitoringBatchMigrationData] + + :param meta: Metadata of a list response. + :type meta: SecurityMonitoringBatchMigrationListMeta + """ + super().__init__(kwargs) + + self_.data = data + self_.meta = meta diff --git a/src/datadog_api_client/v2/models/__init__.py b/src/datadog_api_client/v2/models/__init__.py index a2e4ddb291..489700a6a2 100644 --- a/src/datadog_api_client/v2/models/__init__.py +++ b/src/datadog_api_client/v2/models/__init__.py @@ -9826,6 +9826,134 @@ from datadog_api_client.v2.model.security_monitoring_azure_app_registration import ( SecurityMonitoringAzureAppRegistration, ) +from datadog_api_client.v2.model.security_monitoring_batch_migration_attributes import ( + SecurityMonitoringBatchMigrationAttributes, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_create_attributes import ( + SecurityMonitoringBatchMigrationCreateAttributes, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_create_data import ( + SecurityMonitoringBatchMigrationCreateData, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_create_request import ( + SecurityMonitoringBatchMigrationCreateRequest, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_data import SecurityMonitoringBatchMigrationData +from datadog_api_client.v2.model.security_monitoring_batch_migration_input_source import ( + SecurityMonitoringBatchMigrationInputSource, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_list_meta import ( + SecurityMonitoringBatchMigrationListMeta, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_publish_attributes import ( + SecurityMonitoringBatchMigrationPublishAttributes, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_publish_data import ( + SecurityMonitoringBatchMigrationPublishData, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_publish_request import ( + SecurityMonitoringBatchMigrationPublishRequest, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_publish_response import ( + SecurityMonitoringBatchMigrationPublishResponse, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_publish_type import ( + SecurityMonitoringBatchMigrationPublishType, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_published_resource_attributes import ( + SecurityMonitoringBatchMigrationPublishedResourceAttributes, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_published_resource_data import ( + SecurityMonitoringBatchMigrationPublishedResourceData, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_published_resource_status import ( + SecurityMonitoringBatchMigrationPublishedResourceStatus, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_published_resource_type import ( + SecurityMonitoringBatchMigrationPublishedResourceType, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_attributes import ( + SecurityMonitoringBatchMigrationResourceAttributes, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_create_item import ( + SecurityMonitoringBatchMigrationResourceCreateItem, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_data import ( + SecurityMonitoringBatchMigrationResourceData, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_input_type import ( + SecurityMonitoringBatchMigrationResourceInputType, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_output import ( + SecurityMonitoringBatchMigrationResourceOutput, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_response import ( + SecurityMonitoringBatchMigrationResourceResponse, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_status import ( + SecurityMonitoringBatchMigrationResourceStatus, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_status_counts import ( + SecurityMonitoringBatchMigrationResourceStatusCounts, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_type import ( + SecurityMonitoringBatchMigrationResourceType, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_update_attributes import ( + SecurityMonitoringBatchMigrationResourceUpdateAttributes, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_update_data import ( + SecurityMonitoringBatchMigrationResourceUpdateData, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resource_update_request import ( + SecurityMonitoringBatchMigrationResourceUpdateRequest, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_create_attributes import ( + SecurityMonitoringBatchMigrationResourcesCreateAttributes, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_create_data import ( + SecurityMonitoringBatchMigrationResourcesCreateData, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_create_request import ( + SecurityMonitoringBatchMigrationResourcesCreateRequest, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_create_response import ( + SecurityMonitoringBatchMigrationResourcesCreateResponse, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_delete_attributes import ( + SecurityMonitoringBatchMigrationResourcesDeleteAttributes, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_delete_data import ( + SecurityMonitoringBatchMigrationResourcesDeleteData, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_delete_request import ( + SecurityMonitoringBatchMigrationResourcesDeleteRequest, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_list_response import ( + SecurityMonitoringBatchMigrationResourcesListResponse, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_resources_type import ( + SecurityMonitoringBatchMigrationResourcesType, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_response import ( + SecurityMonitoringBatchMigrationResponse, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_status import ( + SecurityMonitoringBatchMigrationStatus, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_type import SecurityMonitoringBatchMigrationType +from datadog_api_client.v2.model.security_monitoring_batch_migration_update_attributes import ( + SecurityMonitoringBatchMigrationUpdateAttributes, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_update_data import ( + SecurityMonitoringBatchMigrationUpdateData, +) +from datadog_api_client.v2.model.security_monitoring_batch_migration_update_request import ( + SecurityMonitoringBatchMigrationUpdateRequest, +) +from datadog_api_client.v2.model.security_monitoring_batch_migrations_list_response import ( + SecurityMonitoringBatchMigrationsListResponse, +) from datadog_api_client.v2.model.security_monitoring_content_pack_activation import ( SecurityMonitoringContentPackActivation, ) @@ -19358,6 +19486,50 @@ "SecurityFindingsSort", "SecurityFindingsStatus", "SecurityMonitoringAzureAppRegistration", + "SecurityMonitoringBatchMigrationAttributes", + "SecurityMonitoringBatchMigrationCreateAttributes", + "SecurityMonitoringBatchMigrationCreateData", + "SecurityMonitoringBatchMigrationCreateRequest", + "SecurityMonitoringBatchMigrationData", + "SecurityMonitoringBatchMigrationInputSource", + "SecurityMonitoringBatchMigrationListMeta", + "SecurityMonitoringBatchMigrationPublishAttributes", + "SecurityMonitoringBatchMigrationPublishData", + "SecurityMonitoringBatchMigrationPublishRequest", + "SecurityMonitoringBatchMigrationPublishResponse", + "SecurityMonitoringBatchMigrationPublishType", + "SecurityMonitoringBatchMigrationPublishedResourceAttributes", + "SecurityMonitoringBatchMigrationPublishedResourceData", + "SecurityMonitoringBatchMigrationPublishedResourceStatus", + "SecurityMonitoringBatchMigrationPublishedResourceType", + "SecurityMonitoringBatchMigrationResourceAttributes", + "SecurityMonitoringBatchMigrationResourceCreateItem", + "SecurityMonitoringBatchMigrationResourceData", + "SecurityMonitoringBatchMigrationResourceInputType", + "SecurityMonitoringBatchMigrationResourceOutput", + "SecurityMonitoringBatchMigrationResourceResponse", + "SecurityMonitoringBatchMigrationResourceStatus", + "SecurityMonitoringBatchMigrationResourceStatusCounts", + "SecurityMonitoringBatchMigrationResourceType", + "SecurityMonitoringBatchMigrationResourceUpdateAttributes", + "SecurityMonitoringBatchMigrationResourceUpdateData", + "SecurityMonitoringBatchMigrationResourceUpdateRequest", + "SecurityMonitoringBatchMigrationResourcesCreateAttributes", + "SecurityMonitoringBatchMigrationResourcesCreateData", + "SecurityMonitoringBatchMigrationResourcesCreateRequest", + "SecurityMonitoringBatchMigrationResourcesCreateResponse", + "SecurityMonitoringBatchMigrationResourcesDeleteAttributes", + "SecurityMonitoringBatchMigrationResourcesDeleteData", + "SecurityMonitoringBatchMigrationResourcesDeleteRequest", + "SecurityMonitoringBatchMigrationResourcesListResponse", + "SecurityMonitoringBatchMigrationResourcesType", + "SecurityMonitoringBatchMigrationResponse", + "SecurityMonitoringBatchMigrationStatus", + "SecurityMonitoringBatchMigrationType", + "SecurityMonitoringBatchMigrationUpdateAttributes", + "SecurityMonitoringBatchMigrationUpdateData", + "SecurityMonitoringBatchMigrationUpdateRequest", + "SecurityMonitoringBatchMigrationsListResponse", "SecurityMonitoringContentPackActivation", "SecurityMonitoringContentPackAppSecDetails", "SecurityMonitoringContentPackAppSecDetailsType", diff --git a/tests/generated-test/test-runner-data/manifest.json b/tests/generated-test/test-runner-data/manifest.json index ae6bce3fe3..06c714fef0 100644 --- a/tests/generated-test/test-runner-data/manifest.json +++ b/tests/generated-test/test-runner-data/manifest.json @@ -9723,6 +9723,13 @@ "scenario": "Unassign seats from users returns \"Unprocessable Entity\" response when user_uuids is empty", "version": "v2" }, + { + "feature": "Security Monitoring", + "feature_file": "../../v2/features/security_monitoring.feature", + "file": "v2/security-monitoring/add-resources-to-a-batch-migration-returns-created-response.json", + "scenario": "Add resources to a batch migration returns \"Created\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "feature_file": "../../v2/features/security_monitoring.feature", @@ -9912,6 +9919,13 @@ "scenario": "Create Jira issues for security findings returns \"Not Found\" response", "version": "v2" }, + { + "feature": "Security Monitoring", + "feature_file": "../../v2/features/security_monitoring.feature", + "file": "v2/security-monitoring/create-a-batch-migration-returns-created-response.json", + "scenario": "Create a batch migration returns \"Created\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "feature_file": "../../v2/features/security_monitoring.feature", @@ -10150,6 +10164,13 @@ "scenario": "Create or update an indicator triage state returns \"Created\" response", "version": "v2" }, + { + "feature": "Security Monitoring", + "feature_file": "../../v2/features/security_monitoring.feature", + "file": "v2/security-monitoring/delete-a-batch-migration-returns-no-content-response.json", + "scenario": "Delete a batch migration returns \"No Content\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "feature_file": "../../v2/features/security_monitoring.feature", @@ -10276,6 +10297,13 @@ "scenario": "Delete an inbox rule returns \"Successfully deleted the inbox rule\" response", "version": "v2" }, + { + "feature": "Security Monitoring", + "feature_file": "../../v2/features/security_monitoring.feature", + "file": "v2/security-monitoring/delete-resources-from-a-batch-migration-returns-no-content-response.json", + "scenario": "Delete resources from a batch migration returns \"No Content\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "feature_file": "../../v2/features/security_monitoring.feature", @@ -10710,6 +10738,20 @@ "scenario": "List assets SBOMs returns \"OK\" response", "version": "v2" }, + { + "feature": "Security Monitoring", + "feature_file": "../../v2/features/security_monitoring.feature", + "file": "v2/security-monitoring/list-batch-migration-resources-returns-ok-response.json", + "scenario": "List batch migration resources returns \"OK\" response", + "version": "v2" + }, + { + "feature": "Security Monitoring", + "feature_file": "../../v2/features/security_monitoring.feature", + "file": "v2/security-monitoring/list-batch-migrations-returns-ok-response.json", + "scenario": "List batch migrations returns \"OK\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "feature_file": "../../v2/features/security_monitoring.feature", @@ -11032,6 +11074,20 @@ "scenario": "Unmute security findings returns \"Unprocessable Entity\" response", "version": "v2" }, + { + "feature": "Security Monitoring", + "feature_file": "../../v2/features/security_monitoring.feature", + "file": "v2/security-monitoring/update-a-batch-migration-resource-returns-ok-response.json", + "scenario": "Update a batch migration resource returns \"OK\" response", + "version": "v2" + }, + { + "feature": "Security Monitoring", + "feature_file": "../../v2/features/security_monitoring.feature", + "file": "v2/security-monitoring/update-a-batch-migration-returns-ok-response.json", + "scenario": "Update a batch migration returns \"OK\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "feature_file": "../../v2/features/security_monitoring.feature", diff --git a/tests/generated-test/test-runner-data/v2/security-monitoring/add-resources-to-a-batch-migration-returns-created-response.json b/tests/generated-test/test-runner-data/v2/security-monitoring/add-resources-to-a-batch-migration-returns-created-response.json new file mode 100644 index 0000000000..c704e45d85 --- /dev/null +++ b/tests/generated-test/test-runner-data/v2/security-monitoring/add-resources-to-a-batch-migration-returns-created-response.json @@ -0,0 +1,56 @@ +{ + "api": "SecurityMonitoring", + "expected_status": 201, + "feature": "Security Monitoring", + "id": "v2/Security Monitoring/Add resources to a batch migration returns \"Created\" response", + "operation_id": "CreateSecurityMonitoringBatchMigrationResources", + "request": { + "body": { + "schema": { + "format": null, + "ref": "SecurityMonitoringBatchMigrationResourcesCreateRequest", + "type": "object" + }, + "source": "inline", + "value": { + "data": { + "attributes": { + "resources": [ + { + "input": "index=linux process=sudo \"authentication failure\" | stats count by user, host", + "inputType": "spl", + "name": "Linux sudo abuse" + } + ] + }, + "type": "batchMigrationResources" + } + } + }, + "content_type": "application/json", + "method": "POST", + "pagination": false, + "parameters": [ + { + "explode": null, + "in": "path", + "name": "batch_id", + "required": true, + "schema": { + "format": "uuid", + "ref": null, + "type": "string" + }, + "source": { + "path": "batch_migration.data.id", + "type": "fixture" + }, + "style": null + } + ], + "path": "/api/v2/security_monitoring/batch-migrations/{batch_id}/resources" + }, + "scenario": "Add resources to a batch migration returns \"Created\" response", + "schema_version": 1, + "version": "v2" +} diff --git a/tests/generated-test/test-runner-data/v2/security-monitoring/create-a-batch-migration-returns-created-response.json b/tests/generated-test/test-runner-data/v2/security-monitoring/create-a-batch-migration-returns-created-response.json new file mode 100644 index 0000000000..f400718abd --- /dev/null +++ b/tests/generated-test/test-runner-data/v2/security-monitoring/create-a-batch-migration-returns-created-response.json @@ -0,0 +1,45 @@ +{ + "api": "SecurityMonitoring", + "expected_status": 201, + "feature": "Security Monitoring", + "id": "v2/Security Monitoring/Create a batch migration returns \"Created\" response", + "operation_id": "CreateSecurityMonitoringBatchMigration", + "request": { + "body": { + "schema": { + "format": null, + "ref": "SecurityMonitoringBatchMigrationCreateRequest", + "type": "object" + }, + "source": "inline", + "value": { + "data": { + "attributes": { + "description": "Rules imported from Splunk", + "name": "{{ unique }}", + "resources": [ + { + "description": "Detects repeated failed Windows authentication attempts.", + "input": "index=wineventlog EventCode=4625", + "inputType": "spl", + "name": "Repeated Windows login failures" + } + ], + "tags": [ + "source:splunk" + ] + }, + "type": "batchMigration" + } + } + }, + "content_type": "application/json", + "method": "POST", + "pagination": false, + "parameters": [], + "path": "/api/v2/security_monitoring/batch-migrations" + }, + "scenario": "Create a batch migration returns \"Created\" response", + "schema_version": 1, + "version": "v2" +} diff --git a/tests/generated-test/test-runner-data/v2/security-monitoring/delete-a-batch-migration-returns-no-content-response.json b/tests/generated-test/test-runner-data/v2/security-monitoring/delete-a-batch-migration-returns-no-content-response.json new file mode 100644 index 0000000000..2ee775a52e --- /dev/null +++ b/tests/generated-test/test-runner-data/v2/security-monitoring/delete-a-batch-migration-returns-no-content-response.json @@ -0,0 +1,35 @@ +{ + "api": "SecurityMonitoring", + "expected_status": 204, + "feature": "Security Monitoring", + "id": "v2/Security Monitoring/Delete a batch migration returns \"No Content\" response", + "operation_id": "DeleteSecurityMonitoringBatchMigration", + "request": { + "body": null, + "content_type": null, + "method": "DELETE", + "pagination": false, + "parameters": [ + { + "explode": null, + "in": "path", + "name": "batch_id", + "required": true, + "schema": { + "format": "uuid", + "ref": null, + "type": "string" + }, + "source": { + "path": "batch_migration.data.id", + "type": "fixture" + }, + "style": null + } + ], + "path": "/api/v2/security_monitoring/batch-migrations/{batch_id}" + }, + "scenario": "Delete a batch migration returns \"No Content\" response", + "schema_version": 1, + "version": "v2" +} diff --git a/tests/generated-test/test-runner-data/v2/security-monitoring/delete-resources-from-a-batch-migration-returns-no-content-response.json b/tests/generated-test/test-runner-data/v2/security-monitoring/delete-resources-from-a-batch-migration-returns-no-content-response.json new file mode 100644 index 0000000000..96f23357f9 --- /dev/null +++ b/tests/generated-test/test-runner-data/v2/security-monitoring/delete-resources-from-a-batch-migration-returns-no-content-response.json @@ -0,0 +1,52 @@ +{ + "api": "SecurityMonitoring", + "expected_status": 204, + "feature": "Security Monitoring", + "id": "v2/Security Monitoring/Delete resources from a batch migration returns \"No Content\" response", + "operation_id": "DeleteSecurityMonitoringBatchMigrationResources", + "request": { + "body": { + "schema": { + "format": null, + "ref": "SecurityMonitoringBatchMigrationResourcesDeleteRequest", + "type": "object" + }, + "source": "inline", + "value": { + "data": { + "attributes": { + "resourceIds": [ + "{{ batch_migration_resource.id }}" + ] + }, + "type": "batchMigrationResources" + } + } + }, + "content_type": "application/json", + "method": "DELETE", + "pagination": false, + "parameters": [ + { + "explode": null, + "in": "path", + "name": "batch_id", + "required": true, + "schema": { + "format": "uuid", + "ref": null, + "type": "string" + }, + "source": { + "path": "batch_migration.data.id", + "type": "fixture" + }, + "style": null + } + ], + "path": "/api/v2/security_monitoring/batch-migrations/{batch_id}/resources" + }, + "scenario": "Delete resources from a batch migration returns \"No Content\" response", + "schema_version": 1, + "version": "v2" +} diff --git a/tests/generated-test/test-runner-data/v2/security-monitoring/list-batch-migration-resources-returns-ok-response.json b/tests/generated-test/test-runner-data/v2/security-monitoring/list-batch-migration-resources-returns-ok-response.json new file mode 100644 index 0000000000..bb3a1ea432 --- /dev/null +++ b/tests/generated-test/test-runner-data/v2/security-monitoring/list-batch-migration-resources-returns-ok-response.json @@ -0,0 +1,35 @@ +{ + "api": "SecurityMonitoring", + "expected_status": 200, + "feature": "Security Monitoring", + "id": "v2/Security Monitoring/List batch migration resources returns \"OK\" response", + "operation_id": "ListSecurityMonitoringBatchMigrationResources", + "request": { + "body": null, + "content_type": null, + "method": "GET", + "pagination": false, + "parameters": [ + { + "explode": null, + "in": "path", + "name": "batch_id", + "required": true, + "schema": { + "format": "uuid", + "ref": null, + "type": "string" + }, + "source": { + "path": "batch_migration.data.id", + "type": "fixture" + }, + "style": null + } + ], + "path": "/api/v2/security_monitoring/batch-migrations/{batch_id}/resources" + }, + "scenario": "List batch migration resources returns \"OK\" response", + "schema_version": 1, + "version": "v2" +} diff --git a/tests/generated-test/test-runner-data/v2/security-monitoring/list-batch-migrations-returns-ok-response.json b/tests/generated-test/test-runner-data/v2/security-monitoring/list-batch-migrations-returns-ok-response.json new file mode 100644 index 0000000000..a92497acb9 --- /dev/null +++ b/tests/generated-test/test-runner-data/v2/security-monitoring/list-batch-migrations-returns-ok-response.json @@ -0,0 +1,35 @@ +{ + "api": "SecurityMonitoring", + "expected_status": 200, + "feature": "Security Monitoring", + "id": "v2/Security Monitoring/List batch migrations returns \"OK\" response", + "operation_id": "ListSecurityMonitoringBatchMigrations", + "request": { + "body": null, + "content_type": null, + "method": "GET", + "pagination": false, + "parameters": [ + { + "explode": null, + "in": "query", + "name": "filter[query]", + "required": false, + "schema": { + "format": null, + "ref": null, + "type": "string" + }, + "source": { + "type": "literal", + "value": "id:{{ batch_migration.data.id }}" + }, + "style": null + } + ], + "path": "/api/v2/security_monitoring/batch-migrations" + }, + "scenario": "List batch migrations returns \"OK\" response", + "schema_version": 1, + "version": "v2" +} diff --git a/tests/generated-test/test-runner-data/v2/security-monitoring/update-a-batch-migration-resource-returns-ok-response.json b/tests/generated-test/test-runner-data/v2/security-monitoring/update-a-batch-migration-resource-returns-ok-response.json new file mode 100644 index 0000000000..38916579d0 --- /dev/null +++ b/tests/generated-test/test-runner-data/v2/security-monitoring/update-a-batch-migration-resource-returns-ok-response.json @@ -0,0 +1,66 @@ +{ + "api": "SecurityMonitoring", + "expected_status": 200, + "feature": "Security Monitoring", + "id": "v2/Security Monitoring/Update a batch migration resource returns \"OK\" response", + "operation_id": "UpdateSecurityMonitoringBatchMigrationResource", + "request": { + "body": { + "schema": { + "format": null, + "ref": "SecurityMonitoringBatchMigrationResourceUpdateRequest", + "type": "object" + }, + "source": "inline", + "value": { + "data": { + "attributes": { + "input": "index=wineventlog EventCode=4625 | stats count by user" + }, + "type": "batchMigrationResource" + } + } + }, + "content_type": "application/json", + "method": "PATCH", + "pagination": false, + "parameters": [ + { + "explode": null, + "in": "path", + "name": "batch_id", + "required": true, + "schema": { + "format": "uuid", + "ref": null, + "type": "string" + }, + "source": { + "path": "batch_migration.data.id", + "type": "fixture" + }, + "style": null + }, + { + "explode": null, + "in": "path", + "name": "resource_id", + "required": true, + "schema": { + "format": "uuid", + "ref": null, + "type": "string" + }, + "source": { + "path": "batch_migration_resource.id", + "type": "fixture" + }, + "style": null + } + ], + "path": "/api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id}" + }, + "scenario": "Update a batch migration resource returns \"OK\" response", + "schema_version": 1, + "version": "v2" +} diff --git a/tests/generated-test/test-runner-data/v2/security-monitoring/update-a-batch-migration-returns-ok-response.json b/tests/generated-test/test-runner-data/v2/security-monitoring/update-a-batch-migration-returns-ok-response.json new file mode 100644 index 0000000000..8b8c8a4526 --- /dev/null +++ b/tests/generated-test/test-runner-data/v2/security-monitoring/update-a-batch-migration-returns-ok-response.json @@ -0,0 +1,54 @@ +{ + "api": "SecurityMonitoring", + "expected_status": 200, + "feature": "Security Monitoring", + "id": "v2/Security Monitoring/Update a batch migration returns \"OK\" response", + "operation_id": "UpdateSecurityMonitoringBatchMigration", + "request": { + "body": { + "schema": { + "format": null, + "ref": "SecurityMonitoringBatchMigrationUpdateRequest", + "type": "object" + }, + "source": "inline", + "value": { + "data": { + "attributes": { + "name": "{{ unique }}-updated", + "tags": [ + "source:splunk", + "team:secops" + ] + }, + "type": "batchMigration" + } + } + }, + "content_type": "application/json", + "method": "PATCH", + "pagination": false, + "parameters": [ + { + "explode": null, + "in": "path", + "name": "batch_id", + "required": true, + "schema": { + "format": "uuid", + "ref": null, + "type": "string" + }, + "source": { + "path": "batch_migration.data.id", + "type": "fixture" + }, + "style": null + } + ], + "path": "/api/v2/security_monitoring/batch-migrations/{batch_id}" + }, + "scenario": "Update a batch migration returns \"OK\" response", + "schema_version": 1, + "version": "v2" +} diff --git a/tests/generated-test/test-server-data/v2/security-monitoring.json b/tests/generated-test/test-server-data/v2/security-monitoring.json index 43e65f4bef..a1d8f896f0 100644 --- a/tests/generated-test/test-server-data/v2/security-monitoring.json +++ b/tests/generated-test/test-server-data/v2/security-monitoring.json @@ -1,6 +1,135 @@ { "feature": "Security Monitoring", "recordings": [ + { + "feature": "Security Monitoring", + "frozen_at": "2026-10-16T11:40:25.719Z", + "interactions": [ + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "attributes": { + "description": "Rules imported from Splunk", + "name": "Test-Add_resources_to_a_batch_migration_returns_Created_response-1792150825", + "resources": [ + { + "input": "index=wineventlog EventCode=4625", + "inputType": "spl", + "name": "Repeated Windows login failures" + } + ], + "tags": [ + "source:splunk" + ] + }, + "type": "batchMigration" + } + } + }, + "content_type": "application/json", + "method": "POST", + "path": "/api/v2/security_monitoring/batch-migrations", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":{\"id\":\"c8acb77f-ab3f-4d81-ba8c-7a63ce5ad84e\",\"type\":\"batchMigration\",\"attributes\":{\"createdAt\":\"2026-10-16T11:40:27.371898Z\",\"createdBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"description\":\"Rules imported from Splunk\",\"inputSource\":\"batch_migration\",\"lastUpdatedAt\":\"2026-10-16T11:40:27.371898Z\",\"lastUpdatedBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"name\":\"Test-Add_resources_to_a_batch_migration_returns_Created_response-1792150825\",\"orgId\":321813,\"resourceStatusCounts\":{\"pending\":1,\"inProgress\":0,\"completed\":0,\"canceled\":0,\"failed\":0,\"publishing\":0,\"published\":0,\"duplicate\":0},\"status\":\"draft\",\"tags\":[\"source:splunk\"]}}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "Created", + "status": 201 + } + }, + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "attributes": { + "resources": [ + { + "input": "index=linux process=sudo \"authentication failure\" | stats count by user, host", + "inputType": "spl", + "name": "Linux sudo abuse" + } + ] + }, + "type": "batchMigrationResources" + } + } + }, + "content_type": "application/json", + "method": "POST", + "path": "/api/v2/security_monitoring/batch-migrations/c8acb77f-ab3f-4d81-ba8c-7a63ce5ad84e/resources", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":[{\"id\":\"ed73ea28-42dc-4313-8340-a62ccddff61b\",\"type\":\"batchMigrationResource\",\"attributes\":{\"batchId\":\"c8acb77f-ab3f-4d81-ba8c-7a63ce5ad84e\",\"createdAt\":\"2026-10-16T11:40:27.543286Z\",\"createdBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"input\":\"index=linux process=sudo \\\"authentication failure\\\" | stats count by user, host\",\"inputType\":\"spl\",\"lastUpdatedAt\":\"2026-10-16T11:40:27.543286Z\",\"lastUpdatedBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"name\":\"Linux sudo abuse\",\"output\":null,\"outputType\":\"siem_rule\",\"status\":\"pending\"}}]}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "Created", + "status": 201 + } + }, + { + "request": { + "body": { + "type": "empty", + "value": null + }, + "content_type": "", + "method": "DELETE", + "path": "/api/v2/security_monitoring/batch-migrations/c8acb77f-ab3f-4d81-ba8c-7a63ce5ad84e", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "" + }, + "headers": {}, + "reason": "No Content", + "status": 204 + } + }, + { + "request": { + "body": { + "type": "empty", + "value": null + }, + "content_type": "", + "method": "DELETE", + "path": "/api/v2/security_monitoring/batch-migrations/c8acb77f-ab3f-4d81-ba8c-7a63ce5ad84e", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"errors\":[{\"status\":\"404\",\"detail\":\"batch migration not found\"}]}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "Not Found", + "status": 404 + } + } + ], + "scenario": "Add resources to a batch migration returns \"Created\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "frozen_at": "2026-10-08T12:23:32.869Z", @@ -1601,6 +1730,77 @@ "scenario": "Create Jira issues for security findings returns \"Not Found\" response", "version": "v2" }, + { + "feature": "Security Monitoring", + "frozen_at": "2026-10-16T11:40:27.944Z", + "interactions": [ + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "attributes": { + "description": "Rules imported from Splunk", + "name": "Test-Create_a_batch_migration_returns_Created_response-1792150827", + "resources": [ + { + "description": "Detects repeated failed Windows authentication attempts.", + "input": "index=wineventlog EventCode=4625", + "inputType": "spl", + "name": "Repeated Windows login failures" + } + ], + "tags": [ + "source:splunk" + ] + }, + "type": "batchMigration" + } + } + }, + "content_type": "application/json", + "method": "POST", + "path": "/api/v2/security_monitoring/batch-migrations", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":{\"id\":\"1d186fc0-0dee-47c1-8a42-6f1626b46253\",\"type\":\"batchMigration\",\"attributes\":{\"createdAt\":\"2026-10-16T11:40:28.064962Z\",\"createdBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"description\":\"Rules imported from Splunk\",\"inputSource\":\"batch_migration\",\"lastUpdatedAt\":\"2026-10-16T11:40:28.064962Z\",\"lastUpdatedBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"name\":\"Test-Create_a_batch_migration_returns_Created_response-1792150827\",\"orgId\":321813,\"resourceStatusCounts\":{\"pending\":1,\"inProgress\":0,\"completed\":0,\"canceled\":0,\"failed\":0,\"publishing\":0,\"published\":0,\"duplicate\":0},\"status\":\"draft\",\"tags\":[\"source:splunk\"]}}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "Created", + "status": 201 + } + }, + { + "request": { + "body": { + "type": "empty", + "value": null + }, + "content_type": "", + "method": "DELETE", + "path": "/api/v2/security_monitoring/batch-migrations/1d186fc0-0dee-47c1-8a42-6f1626b46253", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "" + }, + "headers": {}, + "reason": "No Content", + "status": 204 + } + } + ], + "scenario": "Create a batch migration returns \"Created\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "frozen_at": "2024-05-10T16:34:27.362Z", @@ -4328,6 +4528,99 @@ "scenario": "Create or update an indicator triage state returns \"Created\" response", "version": "v2" }, + { + "feature": "Security Monitoring", + "frozen_at": "2026-10-16T11:40:28.297Z", + "interactions": [ + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "attributes": { + "description": "Rules imported from Splunk", + "name": "Test-Delete_a_batch_migration_returns_No_Content_response-1792150828", + "resources": [ + { + "input": "index=wineventlog EventCode=4625", + "inputType": "spl", + "name": "Repeated Windows login failures" + } + ], + "tags": [ + "source:splunk" + ] + }, + "type": "batchMigration" + } + } + }, + "content_type": "application/json", + "method": "POST", + "path": "/api/v2/security_monitoring/batch-migrations", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":{\"id\":\"5e372cc3-56e1-48e0-9628-8f94c8486483\",\"type\":\"batchMigration\",\"attributes\":{\"createdAt\":\"2026-10-16T11:40:28.408635Z\",\"createdBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"description\":\"Rules imported from Splunk\",\"inputSource\":\"batch_migration\",\"lastUpdatedAt\":\"2026-10-16T11:40:28.408635Z\",\"lastUpdatedBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"name\":\"Test-Delete_a_batch_migration_returns_No_Content_response-1792150828\",\"orgId\":321813,\"resourceStatusCounts\":{\"pending\":1,\"inProgress\":0,\"completed\":0,\"canceled\":0,\"failed\":0,\"publishing\":0,\"published\":0,\"duplicate\":0},\"status\":\"draft\",\"tags\":[\"source:splunk\"]}}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "Created", + "status": 201 + } + }, + { + "request": { + "body": { + "type": "empty", + "value": null + }, + "content_type": "", + "method": "DELETE", + "path": "/api/v2/security_monitoring/batch-migrations/5e372cc3-56e1-48e0-9628-8f94c8486483", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "" + }, + "headers": {}, + "reason": "No Content", + "status": 204 + } + }, + { + "request": { + "body": { + "type": "empty", + "value": null + }, + "content_type": "", + "method": "DELETE", + "path": "/api/v2/security_monitoring/batch-migrations/5e372cc3-56e1-48e0-9628-8f94c8486483", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"errors\":[{\"status\":\"404\",\"detail\":\"batch migration not found\"}]}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "Not Found", + "status": 404 + } + } + ], + "scenario": "Delete a batch migration returns \"No Content\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "frozen_at": "2026-01-02T19:09:07.983Z", @@ -5653,7 +5946,7 @@ }, { "feature": "Security Monitoring", - "frozen_at": "2025-11-20T16:07:27.292Z", + "frozen_at": "2026-10-16T11:40:28.793Z", "interactions": [ { "request": { @@ -5661,18 +5954,141 @@ "type": "json", "value": { "data": { - "relationships": { - "findings": { - "data": [] - } + "attributes": { + "description": "Rules imported from Splunk", + "name": "Test-Delete_resources_from_a_batch_migration_returns_No_Content_response-1792150828", + "resources": [ + { + "input": "index=wineventlog EventCode=4625", + "inputType": "spl", + "name": "Repeated Windows login failures" + } + ], + "tags": [ + "source:splunk" + ] }, - "type": "cases" + "type": "batchMigration" } } }, "content_type": "application/json", - "method": "DELETE", - "path": "/api/v2/security/findings/cases", + "method": "POST", + "path": "/api/v2/security_monitoring/batch-migrations", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":{\"id\":\"41c9062b-cc72-4892-9edd-e12d063e1b3e\",\"type\":\"batchMigration\",\"attributes\":{\"createdAt\":\"2026-10-16T11:40:28.894065Z\",\"createdBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"description\":\"Rules imported from Splunk\",\"inputSource\":\"batch_migration\",\"lastUpdatedAt\":\"2026-10-16T11:40:28.894065Z\",\"lastUpdatedBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"name\":\"Test-Delete_resources_from_a_batch_migration_returns_No_Content_response-1792150828\",\"orgId\":321813,\"resourceStatusCounts\":{\"pending\":1,\"inProgress\":0,\"completed\":0,\"canceled\":0,\"failed\":0,\"publishing\":0,\"published\":0,\"duplicate\":0},\"status\":\"draft\",\"tags\":[\"source:splunk\"]}}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "Created", + "status": 201 + } + }, + { + "request": { + "body": { + "type": "empty", + "value": null + }, + "content_type": "", + "method": "GET", + "path": "/api/v2/security_monitoring/batch-migrations/41c9062b-cc72-4892-9edd-e12d063e1b3e/resources", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":[{\"id\":\"3ac8ef63-32f5-421a-ba9c-5e13cf538aab\",\"type\":\"batchMigrationResource\",\"attributes\":{\"batchId\":\"41c9062b-cc72-4892-9edd-e12d063e1b3e\",\"createdAt\":\"2026-10-16T11:40:28.894065Z\",\"createdBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"input\":\"index=wineventlog EventCode=4625\",\"inputType\":\"spl\",\"lastUpdatedAt\":\"2026-10-16T11:40:28.894065Z\",\"lastUpdatedBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"name\":\"Repeated Windows login failures\",\"output\":null,\"outputType\":\"siem_rule\",\"status\":\"pending\"}}],\"meta\":{\"totalCount\":1}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "OK", + "status": 200 + } + }, + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "attributes": { + "resourceIds": [ + "3ac8ef63-32f5-421a-ba9c-5e13cf538aab" + ] + }, + "type": "batchMigrationResources" + } + } + }, + "content_type": "application/json", + "method": "DELETE", + "path": "/api/v2/security_monitoring/batch-migrations/41c9062b-cc72-4892-9edd-e12d063e1b3e/resources", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "" + }, + "headers": {}, + "reason": "No Content", + "status": 204 + } + }, + { + "request": { + "body": { + "type": "empty", + "value": null + }, + "content_type": "", + "method": "DELETE", + "path": "/api/v2/security_monitoring/batch-migrations/41c9062b-cc72-4892-9edd-e12d063e1b3e", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "" + }, + "headers": {}, + "reason": "No Content", + "status": 204 + } + } + ], + "scenario": "Delete resources from a batch migration returns \"No Content\" response", + "version": "v2" + }, + { + "feature": "Security Monitoring", + "frozen_at": "2025-11-20T16:07:27.292Z", + "interactions": [ + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "relationships": { + "findings": { + "data": [] + } + }, + "type": "cases" + } + } + }, + "content_type": "application/json", + "method": "DELETE", + "path": "/api/v2/security/findings/cases", "query": [] }, "response": { @@ -10038,6 +10454,197 @@ "scenario": "List assets SBOMs returns \"OK\" response", "version": "v2" }, + { + "feature": "Security Monitoring", + "frozen_at": "2026-10-16T11:40:29.430Z", + "interactions": [ + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "attributes": { + "description": "Rules imported from Splunk", + "name": "Test-List_batch_migration_resources_returns_OK_response-1792150829", + "resources": [ + { + "input": "index=wineventlog EventCode=4625", + "inputType": "spl", + "name": "Repeated Windows login failures" + } + ], + "tags": [ + "source:splunk" + ] + }, + "type": "batchMigration" + } + } + }, + "content_type": "application/json", + "method": "POST", + "path": "/api/v2/security_monitoring/batch-migrations", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":{\"id\":\"98125ff6-2691-4222-b62d-01a146ca7314\",\"type\":\"batchMigration\",\"attributes\":{\"createdAt\":\"2026-10-16T11:40:29.536705Z\",\"createdBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"description\":\"Rules imported from Splunk\",\"inputSource\":\"batch_migration\",\"lastUpdatedAt\":\"2026-10-16T11:40:29.536705Z\",\"lastUpdatedBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"name\":\"Test-List_batch_migration_resources_returns_OK_response-1792150829\",\"orgId\":321813,\"resourceStatusCounts\":{\"pending\":1,\"inProgress\":0,\"completed\":0,\"canceled\":0,\"failed\":0,\"publishing\":0,\"published\":0,\"duplicate\":0},\"status\":\"draft\",\"tags\":[\"source:splunk\"]}}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "Created", + "status": 201 + } + }, + { + "request": { + "body": { + "type": "empty", + "value": null + }, + "content_type": "", + "method": "GET", + "path": "/api/v2/security_monitoring/batch-migrations/98125ff6-2691-4222-b62d-01a146ca7314/resources", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":[{\"id\":\"b34397f1-e95a-486c-8960-409bfa6989db\",\"type\":\"batchMigrationResource\",\"attributes\":{\"batchId\":\"98125ff6-2691-4222-b62d-01a146ca7314\",\"createdAt\":\"2026-10-16T11:40:29.536705Z\",\"createdBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"input\":\"index=wineventlog EventCode=4625\",\"inputType\":\"spl\",\"lastUpdatedAt\":\"2026-10-16T11:40:29.536705Z\",\"lastUpdatedBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"name\":\"Repeated Windows login failures\",\"output\":null,\"outputType\":\"siem_rule\",\"status\":\"pending\"}}],\"meta\":{\"totalCount\":1}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "OK", + "status": 200 + } + }, + { + "request": { + "body": { + "type": "empty", + "value": null + }, + "content_type": "", + "method": "DELETE", + "path": "/api/v2/security_monitoring/batch-migrations/98125ff6-2691-4222-b62d-01a146ca7314", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "" + }, + "headers": {}, + "reason": "No Content", + "status": 204 + } + } + ], + "scenario": "List batch migration resources returns \"OK\" response", + "version": "v2" + }, + { + "feature": "Security Monitoring", + "frozen_at": "2026-10-16T11:40:29.908Z", + "interactions": [ + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "attributes": { + "description": "Rules imported from Splunk", + "name": "Test-List_batch_migrations_returns_OK_response-1792150829", + "resources": [ + { + "input": "index=wineventlog EventCode=4625", + "inputType": "spl", + "name": "Repeated Windows login failures" + } + ], + "tags": [ + "source:splunk" + ] + }, + "type": "batchMigration" + } + } + }, + "content_type": "application/json", + "method": "POST", + "path": "/api/v2/security_monitoring/batch-migrations", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":{\"id\":\"80b4557e-efc6-45ce-84b9-2ce4d2b8bd58\",\"type\":\"batchMigration\",\"attributes\":{\"createdAt\":\"2026-10-16T11:40:30.025529Z\",\"createdBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"description\":\"Rules imported from Splunk\",\"inputSource\":\"batch_migration\",\"lastUpdatedAt\":\"2026-10-16T11:40:30.025529Z\",\"lastUpdatedBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"name\":\"Test-List_batch_migrations_returns_OK_response-1792150829\",\"orgId\":321813,\"resourceStatusCounts\":{\"pending\":1,\"inProgress\":0,\"completed\":0,\"canceled\":0,\"failed\":0,\"publishing\":0,\"published\":0,\"duplicate\":0},\"status\":\"draft\",\"tags\":[\"source:splunk\"]}}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "Created", + "status": 201 + } + }, + { + "request": { + "body": { + "type": "empty", + "value": null + }, + "content_type": "", + "method": "GET", + "path": "/api/v2/security_monitoring/batch-migrations", + "query": [ + [ + "filter[query]", + "id:80b4557e-efc6-45ce-84b9-2ce4d2b8bd58" + ] + ] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":[{\"id\":\"80b4557e-efc6-45ce-84b9-2ce4d2b8bd58\",\"type\":\"batchMigration\",\"attributes\":{\"createdAt\":\"2026-10-16T11:40:30.025529Z\",\"createdBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"description\":\"Rules imported from Splunk\",\"inputSource\":\"batch_migration\",\"lastUpdatedAt\":\"2026-10-16T11:40:30.025529Z\",\"lastUpdatedBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"name\":\"Test-List_batch_migrations_returns_OK_response-1792150829\",\"orgId\":321813,\"resourceStatusCounts\":{\"pending\":1,\"inProgress\":0,\"completed\":0,\"canceled\":0,\"failed\":0,\"publishing\":0,\"published\":0,\"duplicate\":0},\"status\":\"draft\",\"tags\":[\"source:splunk\"]}}],\"meta\":{\"totalCount\":1}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "OK", + "status": 200 + } + }, + { + "request": { + "body": { + "type": "empty", + "value": null + }, + "content_type": "", + "method": "DELETE", + "path": "/api/v2/security_monitoring/batch-migrations/80b4557e-efc6-45ce-84b9-2ce4d2b8bd58", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "" + }, + "headers": {}, + "reason": "No Content", + "status": 204 + } + } + ], + "scenario": "List batch migrations returns \"OK\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "frozen_at": "2023-04-13T12:26:02.750Z", @@ -13058,6 +13665,233 @@ "scenario": "Unmute security findings returns \"Unprocessable Entity\" response", "version": "v2" }, + { + "feature": "Security Monitoring", + "frozen_at": "2026-10-16T11:40:30.425Z", + "interactions": [ + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "attributes": { + "description": "Rules imported from Splunk", + "name": "Test-Update_a_batch_migration_resource_returns_OK_response-1792150830", + "resources": [ + { + "input": "index=wineventlog EventCode=4625", + "inputType": "spl", + "name": "Repeated Windows login failures" + } + ], + "tags": [ + "source:splunk" + ] + }, + "type": "batchMigration" + } + } + }, + "content_type": "application/json", + "method": "POST", + "path": "/api/v2/security_monitoring/batch-migrations", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":{\"id\":\"e0d9aff4-46cb-4ffd-8e72-7752878e09ec\",\"type\":\"batchMigration\",\"attributes\":{\"createdAt\":\"2026-10-16T11:40:30.529101Z\",\"createdBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"description\":\"Rules imported from Splunk\",\"inputSource\":\"batch_migration\",\"lastUpdatedAt\":\"2026-10-16T11:40:30.529101Z\",\"lastUpdatedBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"name\":\"Test-Update_a_batch_migration_resource_returns_OK_response-1792150830\",\"orgId\":321813,\"resourceStatusCounts\":{\"pending\":1,\"inProgress\":0,\"completed\":0,\"canceled\":0,\"failed\":0,\"publishing\":0,\"published\":0,\"duplicate\":0},\"status\":\"draft\",\"tags\":[\"source:splunk\"]}}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "Created", + "status": 201 + } + }, + { + "request": { + "body": { + "type": "empty", + "value": null + }, + "content_type": "", + "method": "GET", + "path": "/api/v2/security_monitoring/batch-migrations/e0d9aff4-46cb-4ffd-8e72-7752878e09ec/resources", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":[{\"id\":\"968512c2-fbbe-43ed-8ec1-c718cf97b19b\",\"type\":\"batchMigrationResource\",\"attributes\":{\"batchId\":\"e0d9aff4-46cb-4ffd-8e72-7752878e09ec\",\"createdAt\":\"2026-10-16T11:40:30.529101Z\",\"createdBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"input\":\"index=wineventlog EventCode=4625\",\"inputType\":\"spl\",\"lastUpdatedAt\":\"2026-10-16T11:40:30.529101Z\",\"lastUpdatedBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"name\":\"Repeated Windows login failures\",\"output\":null,\"outputType\":\"siem_rule\",\"status\":\"pending\"}}],\"meta\":{\"totalCount\":1}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "OK", + "status": 200 + } + }, + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "attributes": { + "input": "index=wineventlog EventCode=4625 | stats count by user" + }, + "type": "batchMigrationResource" + } + } + }, + "content_type": "application/json", + "method": "PATCH", + "path": "/api/v2/security_monitoring/batch-migrations/e0d9aff4-46cb-4ffd-8e72-7752878e09ec/resources/968512c2-fbbe-43ed-8ec1-c718cf97b19b", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":{\"id\":\"968512c2-fbbe-43ed-8ec1-c718cf97b19b\",\"type\":\"batchMigrationResource\",\"attributes\":{\"batchId\":\"e0d9aff4-46cb-4ffd-8e72-7752878e09ec\",\"createdAt\":\"2026-10-16T11:40:30.529101Z\",\"createdBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"input\":\"index=wineventlog EventCode=4625 | stats count by user\",\"inputType\":\"spl\",\"lastUpdatedAt\":\"2026-10-16T11:40:30.854488Z\",\"lastUpdatedBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"name\":\"Repeated Windows login failures\",\"output\":null,\"outputType\":\"siem_rule\",\"status\":\"pending\"}}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "OK", + "status": 200 + } + }, + { + "request": { + "body": { + "type": "empty", + "value": null + }, + "content_type": "", + "method": "DELETE", + "path": "/api/v2/security_monitoring/batch-migrations/e0d9aff4-46cb-4ffd-8e72-7752878e09ec", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "" + }, + "headers": {}, + "reason": "No Content", + "status": 204 + } + } + ], + "scenario": "Update a batch migration resource returns \"OK\" response", + "version": "v2" + }, + { + "feature": "Security Monitoring", + "frozen_at": "2026-10-16T11:40:31.062Z", + "interactions": [ + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "attributes": { + "description": "Rules imported from Splunk", + "name": "Test-Update_a_batch_migration_returns_OK_response-1792150831", + "resources": [ + { + "input": "index=wineventlog EventCode=4625", + "inputType": "spl", + "name": "Repeated Windows login failures" + } + ], + "tags": [ + "source:splunk" + ] + }, + "type": "batchMigration" + } + } + }, + "content_type": "application/json", + "method": "POST", + "path": "/api/v2/security_monitoring/batch-migrations", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":{\"id\":\"6ec704f1-29d6-47a3-b0ed-1a68ae58ee8b\",\"type\":\"batchMigration\",\"attributes\":{\"createdAt\":\"2026-10-16T11:40:31.174851Z\",\"createdBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"description\":\"Rules imported from Splunk\",\"inputSource\":\"batch_migration\",\"lastUpdatedAt\":\"2026-10-16T11:40:31.174851Z\",\"lastUpdatedBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"name\":\"Test-Update_a_batch_migration_returns_OK_response-1792150831\",\"orgId\":321813,\"resourceStatusCounts\":{\"pending\":1,\"inProgress\":0,\"completed\":0,\"canceled\":0,\"failed\":0,\"publishing\":0,\"published\":0,\"duplicate\":0},\"status\":\"draft\",\"tags\":[\"source:splunk\"]}}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "Created", + "status": 201 + } + }, + { + "request": { + "body": { + "type": "json", + "value": { + "data": { + "attributes": { + "name": "Test-Update_a_batch_migration_returns_OK_response-1792150831-updated", + "tags": [ + "source:splunk", + "team:secops" + ] + }, + "type": "batchMigration" + } + } + }, + "content_type": "application/json", + "method": "PATCH", + "path": "/api/v2/security_monitoring/batch-migrations/6ec704f1-29d6-47a3-b0ed-1a68ae58ee8b", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "{\"data\":{\"id\":\"6ec704f1-29d6-47a3-b0ed-1a68ae58ee8b\",\"type\":\"batchMigration\",\"attributes\":{\"createdAt\":\"2026-10-16T11:40:31.174851Z\",\"createdBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"description\":\"Rules imported from Splunk\",\"inputSource\":\"batch_migration\",\"lastUpdatedAt\":\"2026-10-16T11:40:31.344792Z\",\"lastUpdatedBy\":\"028000b7-d90f-4d20-b4a9-6ff4a83b7950\",\"name\":\"Test-Update_a_batch_migration_returns_OK_response-1792150831-updated\",\"orgId\":321813,\"resourceStatusCounts\":{\"pending\":1,\"inProgress\":0,\"completed\":0,\"canceled\":0,\"failed\":0,\"publishing\":0,\"published\":0,\"duplicate\":0},\"status\":\"draft\",\"tags\":[\"source:splunk\",\"team:secops\"]}}}" + }, + "headers": { + "content-type": "application/vnd.api+json" + }, + "reason": "OK", + "status": 200 + } + }, + { + "request": { + "body": { + "type": "empty", + "value": null + }, + "content_type": "", + "method": "DELETE", + "path": "/api/v2/security_monitoring/batch-migrations/6ec704f1-29d6-47a3-b0ed-1a68ae58ee8b", + "query": [] + }, + "response": { + "body": { + "encoding": "text", + "value": "" + }, + "headers": {}, + "reason": "No Content", + "status": 204 + } + } + ], + "scenario": "Update a batch migration returns \"OK\" response", + "version": "v2" + }, { "feature": "Security Monitoring", "frozen_at": "2024-11-22T13:52:07.331Z", diff --git a/tests/v2/features/given.json b/tests/v2/features/given.json index b307445fc2..e20aaeae64 100644 --- a/tests/v2/features/given.json +++ b/tests/v2/features/given.json @@ -1618,6 +1618,31 @@ "tag": "Security Monitoring", "operationId": "CreateVulnerabilityNotificationRule" }, + { + "parameters": [ + { + "name": "body", + "value": "{\n \"data\": {\n \"type\": \"batchMigration\",\n \"attributes\": {\n \"name\": \"{{ unique }}\",\n \"description\": \"Rules imported from Splunk\",\n \"tags\": [\"source:splunk\"],\n \"resources\": [\n {\n \"name\": \"Repeated Windows login failures\",\n \"inputType\": \"spl\",\n \"input\": \"index=wineventlog EventCode=4625\"\n }\n ]\n }\n }\n}" + } + ], + "step": "there is a valid \"batch_migration\" in the system", + "key": "batch_migration", + "tag": "Security Monitoring", + "operationId": "CreateSecurityMonitoringBatchMigration" + }, + { + "parameters": [ + { + "name": "batch_id", + "value": "\"{{ batch_migration.data.id }}\"" + } + ], + "source": "data[0]", + "step": "there is a valid \"batch_migration_resource\" in the system", + "key": "batch_migration_resource", + "tag": "Security Monitoring", + "operationId": "ListSecurityMonitoringBatchMigrationResources" + }, { "parameters": [ { diff --git a/tests/v2/features/security_monitoring.feature b/tests/v2/features/security_monitoring.feature index 3a2ac120f4..49b1f7aeec 100644 --- a/tests/v2/features/security_monitoring.feature +++ b/tests/v2/features/security_monitoring.feature @@ -52,6 +52,46 @@ Feature: Security Monitoring When the request is sent Then the response status is 404 Not Found + @generated @skip @team:ddoghq/cloud-siem + Scenario: Add resources to a batch migration returns "Bad Request" response + Given operation "CreateSecurityMonitoringBatchMigrationResources" enabled + And new "CreateSecurityMonitoringBatchMigrationResources" request + And request contains "batch_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"resources": [{"description": "Detects repeated failed Windows authentication attempts.", "input": "index=wineventlog EventCode=4625", "inputType": "spl", "name": "Repeated Windows login failures"}]}, "type": "batchMigrationResources"}} + When the request is sent + Then the response status is 400 Bad Request + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Add resources to a batch migration returns "Conflict" response + Given operation "CreateSecurityMonitoringBatchMigrationResources" enabled + And new "CreateSecurityMonitoringBatchMigrationResources" request + And request contains "batch_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"resources": [{"description": "Detects repeated failed Windows authentication attempts.", "input": "index=wineventlog EventCode=4625", "inputType": "spl", "name": "Repeated Windows login failures"}]}, "type": "batchMigrationResources"}} + When the request is sent + Then the response status is 409 Conflict + + @team:ddoghq/cloud-siem + Scenario: Add resources to a batch migration returns "Created" response + Given operation "CreateSecurityMonitoringBatchMigrationResources" enabled + And there is a valid "batch_migration" in the system + And new "CreateSecurityMonitoringBatchMigrationResources" request + And request contains "batch_id" parameter from "batch_migration.data.id" + And body with value {"data": {"type": "batchMigrationResources", "attributes": {"resources": [{"name": "Linux sudo abuse", "inputType": "spl", "input": "index=linux process=sudo \"authentication failure\" | stats count by user, host"}]}}} + When the request is sent + Then the response status is 201 Created + And the response "data" has length 1 + And the response "data[0].attributes.name" is equal to "Linux sudo abuse" + And the response "data[0].attributes.status" is equal to "pending" + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Add resources to a batch migration returns "Not Found" response + Given operation "CreateSecurityMonitoringBatchMigrationResources" enabled + And new "CreateSecurityMonitoringBatchMigrationResources" request + And request contains "batch_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"resources": [{"description": "Detects repeated failed Windows authentication attempts.", "input": "index=wineventlog EventCode=4625", "inputType": "spl", "name": "Repeated Windows login failures"}]}, "type": "batchMigrationResources"}} + When the request is sent + Then the response status is 404 Not Found + @generated @skip @team:ddoghq/k9-vm-ast Scenario: Analyze code returns "Bad Request" response Given operation "CreateStaticAnalysisServerAnalysis" enabled @@ -357,6 +397,38 @@ Feature: Security Monitoring When the request is sent Then the response status is 200 OK + @generated @skip @team:ddoghq/cloud-siem + Scenario: Cancel a batch migration returns "Accepted" response + Given operation "CancelSecurityMonitoringBatchMigration" enabled + And new "CancelSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 202 Accepted + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Cancel a batch migration returns "Bad Request" response + Given operation "CancelSecurityMonitoringBatchMigration" enabled + And new "CancelSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 400 Bad Request + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Cancel a batch migration returns "Conflict" response + Given operation "CancelSecurityMonitoringBatchMigration" enabled + And new "CancelSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 409 Conflict + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Cancel a batch migration returns "Not Found" response + Given operation "CancelSecurityMonitoringBatchMigration" enabled + And new "CancelSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 404 Not Found + @team:ddoghq/cloud-siem Scenario: Cancel a historical job returns "Bad Request" response Given operation "CancelHistoricalJob" enabled @@ -651,6 +723,26 @@ Feature: Security Monitoring When the request is sent Then the response status is 404 Not Found + @generated @skip @team:ddoghq/cloud-siem + Scenario: Create a batch migration returns "Bad Request" response + Given operation "CreateSecurityMonitoringBatchMigration" enabled + And new "CreateSecurityMonitoringBatchMigration" request + And body with value {"data": {"attributes": {"description": "Rules imported from Splunk", "name": "Splunk migration", "resources": [{"description": "Detects repeated failed Windows authentication attempts.", "input": "index=wineventlog EventCode=4625", "inputType": "spl", "name": "Repeated Windows login failures"}], "tags": ["source:splunk"]}, "type": "batchMigration"}} + When the request is sent + Then the response status is 400 Bad Request + + @team:ddoghq/cloud-siem + Scenario: Create a batch migration returns "Created" response + Given operation "CreateSecurityMonitoringBatchMigration" enabled + And new "CreateSecurityMonitoringBatchMigration" request + And body with value {"data": {"type": "batchMigration", "attributes": {"name": "{{ unique }}", "description": "Rules imported from Splunk", "tags": ["source:splunk"], "resources": [{"name": "Repeated Windows login failures", "description": "Detects repeated failed Windows authentication attempts.", "inputType": "spl", "input": "index=wineventlog EventCode=4625"}]}}} + When the request is sent + Then the response status is 201 Created + And the response "data.type" is equal to "batchMigration" + And the response "data.attributes.name" is equal to "{{ unique }}" + And the response "data.attributes.status" is equal to "draft" + And the response "data.attributes.resourceStatusCounts.pending" is equal to 1 + @skip-validation @team:ddoghq/cloud-siem Scenario: Create a cloud_configuration rule returns "OK" response Given new "CreateSecurityMonitoringRule" request @@ -1218,6 +1310,39 @@ Feature: Security Monitoring When the request is sent Then the response status is 404 Not Found + @generated @skip @team:ddoghq/cloud-siem + Scenario: Delete a batch migration returns "Bad Request" response + Given operation "DeleteSecurityMonitoringBatchMigration" enabled + And new "DeleteSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 400 Bad Request + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Delete a batch migration returns "Conflict" response + Given operation "DeleteSecurityMonitoringBatchMigration" enabled + And new "DeleteSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 409 Conflict + + @team:ddoghq/cloud-siem + Scenario: Delete a batch migration returns "No Content" response + Given operation "DeleteSecurityMonitoringBatchMigration" enabled + And there is a valid "batch_migration" in the system + And new "DeleteSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "batch_migration.data.id" + When the request is sent + Then the response status is 204 No Content + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Delete a batch migration returns "Not Found" response + Given operation "DeleteSecurityMonitoringBatchMigration" enabled + And new "DeleteSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 404 Not Found + @team:ddoghq/cloud-siem Scenario: Delete a critical asset returns "Not Found" response Given new "DeleteSecurityMonitoringCriticalAsset" request @@ -1536,6 +1661,44 @@ Feature: Security Monitoring When the request is sent Then the response status is 204 Successfully deleted the inbox rule + @generated @skip @team:ddoghq/cloud-siem + Scenario: Delete resources from a batch migration returns "Bad Request" response + Given operation "DeleteSecurityMonitoringBatchMigrationResources" enabled + And new "DeleteSecurityMonitoringBatchMigrationResources" request + And request contains "batch_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"resourceIds": ["c968cf83-56c2-4d54-a993-6c86dfb83527"]}, "type": "batchMigrationResources"}} + When the request is sent + Then the response status is 400 Bad Request + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Delete resources from a batch migration returns "Conflict" response + Given operation "DeleteSecurityMonitoringBatchMigrationResources" enabled + And new "DeleteSecurityMonitoringBatchMigrationResources" request + And request contains "batch_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"resourceIds": ["c968cf83-56c2-4d54-a993-6c86dfb83527"]}, "type": "batchMigrationResources"}} + When the request is sent + Then the response status is 409 Conflict + + @team:ddoghq/cloud-siem + Scenario: Delete resources from a batch migration returns "No Content" response + Given operation "DeleteSecurityMonitoringBatchMigrationResources" enabled + And there is a valid "batch_migration" in the system + And there is a valid "batch_migration_resource" in the system + And new "DeleteSecurityMonitoringBatchMigrationResources" request + And request contains "batch_id" parameter from "batch_migration.data.id" + And body with value {"data": {"type": "batchMigrationResources", "attributes": {"resourceIds": ["{{ batch_migration_resource.id }}"]}}} + When the request is sent + Then the response status is 204 No Content + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Delete resources from a batch migration returns "Not Found" response + Given operation "DeleteSecurityMonitoringBatchMigrationResources" enabled + And new "DeleteSecurityMonitoringBatchMigrationResources" request + And request contains "batch_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"resourceIds": ["c968cf83-56c2-4d54-a993-6c86dfb83527"]}, "type": "batchMigrationResources"}} + When the request is sent + Then the response status is 404 Not Found + @team:ddoghq/k9-investigation Scenario: Detach security findings from their case returns "Bad Request" response Given new "DetachCase" request @@ -2763,6 +2926,52 @@ Feature: Security Monitoring When the request is sent Then the response status is 200 OK + @generated @skip @team:ddoghq/cloud-siem + Scenario: List batch migration resources returns "Bad Request" response + Given operation "ListSecurityMonitoringBatchMigrationResources" enabled + And new "ListSecurityMonitoringBatchMigrationResources" request + And request contains "batch_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 400 Bad Request + + @generated @skip @team:ddoghq/cloud-siem + Scenario: List batch migration resources returns "Not Found" response + Given operation "ListSecurityMonitoringBatchMigrationResources" enabled + And new "ListSecurityMonitoringBatchMigrationResources" request + And request contains "batch_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 404 Not Found + + @team:ddoghq/cloud-siem + Scenario: List batch migration resources returns "OK" response + Given operation "ListSecurityMonitoringBatchMigrationResources" enabled + And there is a valid "batch_migration" in the system + And new "ListSecurityMonitoringBatchMigrationResources" request + And request contains "batch_id" parameter from "batch_migration.data.id" + When the request is sent + Then the response status is 200 OK + And the response "data" has length 1 + And the response "data[0].attributes.batchId" has the same value as "batch_migration.data.id" + And the response "data[0].attributes.status" is equal to "pending" + + @generated @skip @team:ddoghq/cloud-siem + Scenario: List batch migrations returns "Bad Request" response + Given operation "ListSecurityMonitoringBatchMigrations" enabled + And new "ListSecurityMonitoringBatchMigrations" request + When the request is sent + Then the response status is 400 Bad Request + + @team:ddoghq/cloud-siem + Scenario: List batch migrations returns "OK" response + Given operation "ListSecurityMonitoringBatchMigrations" enabled + And there is a valid "batch_migration" in the system + And new "ListSecurityMonitoringBatchMigrations" request + And request contains "filter[query]" parameter with value "id:{{ batch_migration.data.id }}" + When the request is sent + Then the response status is 200 OK + And the response "data" has length 1 + And the response "data[0].id" has the same value as "batch_migration.data.id" + @generated @skip @team:ddoghq/k9-vm-ast Scenario: List codegen rulesets returns "Bad Request" response Given operation "ListStaticAnalysisCodegenRulesets" enabled @@ -3213,6 +3422,42 @@ Feature: Security Monitoring When the request is sent Then the response status is 422 The server cannot process the request because it contains invalid data. + @generated @skip @team:ddoghq/cloud-siem + Scenario: Publish a batch migration returns "Bad Request" response + Given operation "PublishSecurityMonitoringBatchMigration" enabled + And new "PublishSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"resourceIds": ["c968cf83-56c2-4d54-a993-6c86dfb83527"]}, "type": "batchMigrationPublish"}} + When the request is sent + Then the response status is 400 Bad Request + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Publish a batch migration returns "Conflict" response + Given operation "PublishSecurityMonitoringBatchMigration" enabled + And new "PublishSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"resourceIds": ["c968cf83-56c2-4d54-a993-6c86dfb83527"]}, "type": "batchMigrationPublish"}} + When the request is sent + Then the response status is 409 Conflict + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Publish a batch migration returns "Not Found" response + Given operation "PublishSecurityMonitoringBatchMigration" enabled + And new "PublishSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"resourceIds": ["c968cf83-56c2-4d54-a993-6c86dfb83527"]}, "type": "batchMigrationPublish"}} + When the request is sent + Then the response status is 404 Not Found + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Publish a batch migration returns "OK" response + Given operation "PublishSecurityMonitoringBatchMigration" enabled + And new "PublishSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"resourceIds": ["c968cf83-56c2-4d54-a993-6c86dfb83527"]}, "type": "batchMigrationPublish"}} + When the request is sent + Then the response status is 200 OK + @generated @skip @team:ddoghq/k9-automation Scenario: Reorder due date rules returns "Bad Request" response Given operation "ReorderSecurityFindingsAutomationDueDateRules" enabled @@ -3467,6 +3712,38 @@ Feature: Security Monitoring And the response "meta.page" has field "after" And the response "links" has field "next" + @generated @skip @team:ddoghq/cloud-siem + Scenario: Start a batch migration returns "Accepted" response + Given operation "StartSecurityMonitoringBatchMigration" enabled + And new "StartSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 202 Accepted + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Start a batch migration returns "Bad Request" response + Given operation "StartSecurityMonitoringBatchMigration" enabled + And new "StartSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 400 Bad Request + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Start a batch migration returns "Conflict" response + Given operation "StartSecurityMonitoringBatchMigration" enabled + And new "StartSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 409 Conflict + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Start a batch migration returns "Not Found" response + Given operation "StartSecurityMonitoringBatchMigration" enabled + And new "StartSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 404 Not Found + @generated @skip @team:ddoghq/cloud-siem Scenario: Subscribe to sample log generation returns "Bad Request" response Given operation "CreateSampleLogGenerationSubscription" enabled @@ -3580,6 +3857,81 @@ Feature: Security Monitoring When the request is sent Then the response status is 200 OK + @generated @skip @team:ddoghq/cloud-siem + Scenario: Update a batch migration resource returns "Bad Request" response + Given operation "UpdateSecurityMonitoringBatchMigrationResource" enabled + And new "UpdateSecurityMonitoringBatchMigrationResource" request + And request contains "batch_id" parameter from "REPLACE.ME" + And request contains "resource_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"description": "Detects repeated failed Windows authentication attempts.", "input": "index=wineventlog EventCode=4625 | stats count by user", "inputType": "spl", "name": "Repeated Windows login failures"}, "type": "batchMigrationResource"}} + When the request is sent + Then the response status is 400 Bad Request + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Update a batch migration resource returns "Conflict" response + Given operation "UpdateSecurityMonitoringBatchMigrationResource" enabled + And new "UpdateSecurityMonitoringBatchMigrationResource" request + And request contains "batch_id" parameter from "REPLACE.ME" + And request contains "resource_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"description": "Detects repeated failed Windows authentication attempts.", "input": "index=wineventlog EventCode=4625 | stats count by user", "inputType": "spl", "name": "Repeated Windows login failures"}, "type": "batchMigrationResource"}} + When the request is sent + Then the response status is 409 Conflict + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Update a batch migration resource returns "Not Found" response + Given operation "UpdateSecurityMonitoringBatchMigrationResource" enabled + And new "UpdateSecurityMonitoringBatchMigrationResource" request + And request contains "batch_id" parameter from "REPLACE.ME" + And request contains "resource_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"description": "Detects repeated failed Windows authentication attempts.", "input": "index=wineventlog EventCode=4625 | stats count by user", "inputType": "spl", "name": "Repeated Windows login failures"}, "type": "batchMigrationResource"}} + When the request is sent + Then the response status is 404 Not Found + + @team:ddoghq/cloud-siem + Scenario: Update a batch migration resource returns "OK" response + Given operation "UpdateSecurityMonitoringBatchMigrationResource" enabled + And there is a valid "batch_migration" in the system + And there is a valid "batch_migration_resource" in the system + And new "UpdateSecurityMonitoringBatchMigrationResource" request + And request contains "batch_id" parameter from "batch_migration.data.id" + And request contains "resource_id" parameter from "batch_migration_resource.id" + And body with value {"data": {"type": "batchMigrationResource", "attributes": {"input": "index=wineventlog EventCode=4625 | stats count by user"}}} + When the request is sent + Then the response status is 200 OK + And the response "data.id" has the same value as "batch_migration_resource.id" + And the response "data.attributes.input" is equal to "index=wineventlog EventCode=4625 | stats count by user" + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Update a batch migration returns "Bad Request" response + Given operation "UpdateSecurityMonitoringBatchMigration" enabled + And new "UpdateSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"description": "Rules imported from Splunk", "name": "Splunk migration - Windows", "tags": ["source:splunk"]}, "type": "batchMigration"}} + When the request is sent + Then the response status is 400 Bad Request + + @generated @skip @team:ddoghq/cloud-siem + Scenario: Update a batch migration returns "Not Found" response + Given operation "UpdateSecurityMonitoringBatchMigration" enabled + And new "UpdateSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"description": "Rules imported from Splunk", "name": "Splunk migration - Windows", "tags": ["source:splunk"]}, "type": "batchMigration"}} + When the request is sent + Then the response status is 404 Not Found + + @team:ddoghq/cloud-siem + Scenario: Update a batch migration returns "OK" response + Given operation "UpdateSecurityMonitoringBatchMigration" enabled + And there is a valid "batch_migration" in the system + And new "UpdateSecurityMonitoringBatchMigration" request + And request contains "batch_id" parameter from "batch_migration.data.id" + And body with value {"data": {"type": "batchMigration", "attributes": {"name": "{{ unique }}-updated", "tags": ["source:splunk", "team:secops"]}}} + When the request is sent + Then the response status is 200 OK + And the response "data.attributes.name" is equal to "{{ unique }}-updated" + And the response "data.attributes.tags" is equal to ["source:splunk", "team:secops"] + And the response "data.attributes.description" has the same value as "batch_migration.data.attributes.description" + @skip-validation @team:ddoghq/cloud-siem Scenario: Update a cloud configuration rule's details returns "OK" response Given new "UpdateSecurityMonitoringRule" request diff --git a/tests/v2/features/undo.json b/tests/v2/features/undo.json index 8b44c94157..b467adbbf5 100644 --- a/tests/v2/features/undo.json +++ b/tests/v2/features/undo.json @@ -8960,6 +8960,87 @@ "type": "safe" } }, + "ListSecurityMonitoringBatchMigrations": { + "tag": "Security Monitoring", + "undo": { + "type": "safe" + } + }, + "CreateSecurityMonitoringBatchMigration": { + "tag": "Security Monitoring", + "undo": { + "operationId": "DeleteSecurityMonitoringBatchMigration", + "parameters": [ + { + "name": "batch_id", + "source": "data.id" + } + ], + "type": "unsafe" + } + }, + "DeleteSecurityMonitoringBatchMigration": { + "tag": "Security Monitoring", + "undo": { + "type": "idempotent" + } + }, + "UpdateSecurityMonitoringBatchMigration": { + "tag": "Security Monitoring", + "undo": { + "type": "idempotent" + } + }, + "CancelSecurityMonitoringBatchMigration": { + "tag": "Security Monitoring", + "undo": { + "type": "idempotent" + } + }, + "PublishSecurityMonitoringBatchMigration": { + "tag": "Security Monitoring", + "undo": { + "type": "unsafe" + } + }, + "DeleteSecurityMonitoringBatchMigrationResources": { + "tag": "Security Monitoring", + "undo": { + "type": "idempotent" + } + }, + "ListSecurityMonitoringBatchMigrationResources": { + "tag": "Security Monitoring", + "undo": { + "type": "safe" + } + }, + "CreateSecurityMonitoringBatchMigrationResources": { + "tag": "Security Monitoring", + "undo": { + "operationId": "DeleteSecurityMonitoringBatchMigration", + "parameters": [ + { + "name": "batch_id", + "origin": "path", + "source": "batch_id" + } + ], + "type": "unsafe" + } + }, + "UpdateSecurityMonitoringBatchMigrationResource": { + "tag": "Security Monitoring", + "undo": { + "type": "idempotent" + } + }, + "StartSecurityMonitoringBatchMigration": { + "tag": "Security Monitoring", + "undo": { + "type": "idempotent" + } + }, "ListCloudWorkloadSecurityAgentRules": { "tag": "CSM Threats", "undo": {