Add Cloud SIEM batch migration endpoints as unstable

examples/v2/security-monitoring/CancelSecurityMonitoringBatchMigration.rb

@@ -0,0 +1,9 @@
+# Cancel a batch migration returns "Accepted" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.access_token = ENV["DD_BEARER_TOKEN"]
+  config.unstable_operations["v2.cancel_security_monitoring_batch_migration".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+p api_instance.cancel_security_monitoring_batch_migration("7cdb3a75-64fb-46ce-9445-41969e78fe8e")

examples/v2/security-monitoring/CreateSecurityMonitoringBatchMigration.rb

@@ -0,0 +1,30 @@
+# Create a batch migration returns "Created" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.access_token = ENV["DD_BEARER_TOKEN"]
+  config.unstable_operations["v2.create_security_monitoring_batch_migration".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+body = DatadogAPIClient::V2::SecurityMonitoringBatchMigrationCreateRequest.new({
+  data: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationCreateData.new({
+    type: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationType::BATCH_MIGRATION,
+    attributes: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationCreateAttributes.new({
+      name: "Example-Security-Monitoring",
+      description: "Rules imported from Splunk",
+      tags: [
+        "source:splunk",
+      ],
+      resources: [
+        DatadogAPIClient::V2::SecurityMonitoringBatchMigrationResourceCreateItem.new({
+          name: "Repeated Windows login failures",
+          description: "Detects repeated failed Windows authentication attempts.",
+          input_type: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationResourceInputType::SPL,
+          input: "index=wineventlog EventCode=4625",
+        }),
+      ],
+    }),
+  }),
+})
+p api_instance.create_security_monitoring_batch_migration(body)

examples/v2/security-monitoring/CreateSecurityMonitoringBatchMigrationResources.rb

@@ -0,0 +1,27 @@
+# Add resources to a batch migration returns "Created" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.access_token = ENV["DD_BEARER_TOKEN"]
+  config.unstable_operations["v2.create_security_monitoring_batch_migration_resources".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+# there is a valid "batch_migration" in the system
+BATCH_MIGRATION_DATA_ID = ENV["BATCH_MIGRATION_DATA_ID"]
+
+body = DatadogAPIClient::V2::SecurityMonitoringBatchMigrationResourcesCreateRequest.new({
+  data: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationResourcesCreateData.new({
+    type: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationResourcesType::BATCH_MIGRATION_RESOURCES,
+    attributes: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationResourcesCreateAttributes.new({
+      resources: [
+        DatadogAPIClient::V2::SecurityMonitoringBatchMigrationResourceCreateItem.new({
+          name: "Linux sudo abuse",
+          input_type: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationResourceInputType::SPL,
+          input: 'index=linux process=sudo "authentication failure" | stats count by user, host',
+        }),
+      ],
+    }),
+  }),
+})
+p api_instance.create_security_monitoring_batch_migration_resources(BATCH_MIGRATION_DATA_ID, body)

examples/v2/security-monitoring/DeleteSecurityMonitoringBatchMigration.rb

@@ -0,0 +1,12 @@
+# Delete a batch migration returns "No Content" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.access_token = ENV["DD_BEARER_TOKEN"]
+  config.unstable_operations["v2.delete_security_monitoring_batch_migration".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+# there is a valid "batch_migration" in the system
+BATCH_MIGRATION_DATA_ID = ENV["BATCH_MIGRATION_DATA_ID"]
+api_instance.delete_security_monitoring_batch_migration(BATCH_MIGRATION_DATA_ID)

examples/v2/security-monitoring/DeleteSecurityMonitoringBatchMigrationResources.rb

@@ -0,0 +1,26 @@
+# Delete resources from a batch migration returns "No Content" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.access_token = ENV["DD_BEARER_TOKEN"]
+  config.unstable_operations["v2.delete_security_monitoring_batch_migration_resources".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+# there is a valid "batch_migration" in the system
+BATCH_MIGRATION_DATA_ID = ENV["BATCH_MIGRATION_DATA_ID"]
+
+# there is a valid "batch_migration_resource" in the system
+BATCH_MIGRATION_RESOURCE_ID = ENV["BATCH_MIGRATION_RESOURCE_ID"]
+
+body = DatadogAPIClient::V2::SecurityMonitoringBatchMigrationResourcesDeleteRequest.new({
+  data: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationResourcesDeleteData.new({
+    type: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationResourcesType::BATCH_MIGRATION_RESOURCES,
+    attributes: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationResourcesDeleteAttributes.new({
+      resource_ids: [
+        BATCH_MIGRATION_RESOURCE_ID,
+      ],
+    }),
+  }),
+})
+api_instance.delete_security_monitoring_batch_migration_resources(BATCH_MIGRATION_DATA_ID, body)

examples/v2/security-monitoring/ListSecurityMonitoringBatchMigrationResources.rb

@@ -0,0 +1,12 @@
+# List batch migration resources returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.access_token = ENV["DD_BEARER_TOKEN"]
+  config.unstable_operations["v2.list_security_monitoring_batch_migration_resources".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+# there is a valid "batch_migration" in the system
+BATCH_MIGRATION_DATA_ID = ENV["BATCH_MIGRATION_DATA_ID"]
+p api_instance.list_security_monitoring_batch_migration_resources(BATCH_MIGRATION_DATA_ID)

examples/v2/security-monitoring/ListSecurityMonitoringBatchMigrations.rb

@@ -0,0 +1,15 @@
+# List batch migrations returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.access_token = ENV["DD_BEARER_TOKEN"]
+  config.unstable_operations["v2.list_security_monitoring_batch_migrations".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+# there is a valid "batch_migration" in the system
+BATCH_MIGRATION_DATA_ID = ENV["BATCH_MIGRATION_DATA_ID"]
+opts = {
+  filter_query: "id:7cdb3a75-64fb-46ce-9445-41969e78fe8e",
+}
+p api_instance.list_security_monitoring_batch_migrations(opts)

examples/v2/security-monitoring/PublishSecurityMonitoringBatchMigration.rb

@@ -0,0 +1,20 @@
+# Publish a batch migration returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.access_token = ENV["DD_BEARER_TOKEN"]
+  config.unstable_operations["v2.publish_security_monitoring_batch_migration".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+body = DatadogAPIClient::V2::SecurityMonitoringBatchMigrationPublishRequest.new({
+  data: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationPublishData.new({
+    attributes: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationPublishAttributes.new({
+      resource_ids: [
+        "c968cf83-56c2-4d54-a993-6c86dfb83527",
+      ],
+    }),
+    type: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationPublishType::BATCH_MIGRATION_PUBLISH,
+  }),
+})
+p api_instance.publish_security_monitoring_batch_migration("7cdb3a75-64fb-46ce-9445-41969e78fe8e", body)

examples/v2/security-monitoring/StartSecurityMonitoringBatchMigration.rb

@@ -0,0 +1,9 @@
+# Start a batch migration returns "Accepted" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.access_token = ENV["DD_BEARER_TOKEN"]
+  config.unstable_operations["v2.start_security_monitoring_batch_migration".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+p api_instance.start_security_monitoring_batch_migration("7cdb3a75-64fb-46ce-9445-41969e78fe8e")

examples/v2/security-monitoring/UpdateSecurityMonitoringBatchMigration.rb

@@ -0,0 +1,25 @@
+# Update a batch migration returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.access_token = ENV["DD_BEARER_TOKEN"]
+  config.unstable_operations["v2.update_security_monitoring_batch_migration".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+# there is a valid "batch_migration" in the system
+BATCH_MIGRATION_DATA_ID = ENV["BATCH_MIGRATION_DATA_ID"]
+
+body = DatadogAPIClient::V2::SecurityMonitoringBatchMigrationUpdateRequest.new({
+  data: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationUpdateData.new({
+    type: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationType::BATCH_MIGRATION,
+    attributes: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationUpdateAttributes.new({
+      name: "Example-Security-Monitoring-updated",
+      tags: [
+        "source:splunk",
+        "team:secops",
+      ],
+    }),
+  }),
+})
+p api_instance.update_security_monitoring_batch_migration(BATCH_MIGRATION_DATA_ID, body)

examples/v2/security-monitoring/UpdateSecurityMonitoringBatchMigrationResource.rb

@@ -0,0 +1,24 @@
+# Update a batch migration resource returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.access_token = ENV["DD_BEARER_TOKEN"]
+  config.unstable_operations["v2.update_security_monitoring_batch_migration_resource".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+# there is a valid "batch_migration" in the system
+BATCH_MIGRATION_DATA_ID = ENV["BATCH_MIGRATION_DATA_ID"]
+
+# there is a valid "batch_migration_resource" in the system
+BATCH_MIGRATION_RESOURCE_ID = ENV["BATCH_MIGRATION_RESOURCE_ID"]
+
+body = DatadogAPIClient::V2::SecurityMonitoringBatchMigrationResourceUpdateRequest.new({
+  data: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationResourceUpdateData.new({
+    type: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationResourceType::BATCH_MIGRATION_RESOURCE,
+    attributes: DatadogAPIClient::V2::SecurityMonitoringBatchMigrationResourceUpdateAttributes.new({
+      input: "index=wineventlog EventCode=4625 | stats count by user",
+    }),
+  }),
+})
+p api_instance.update_security_monitoring_batch_migration_resource(BATCH_MIGRATION_DATA_ID, BATCH_MIGRATION_RESOURCE_ID, body)

features/scenarios_model_mapping.rb

@@ -2465,6 +2465,50 @@
             "filter_operating_system_name" => "String",
             "filter_operating_system_version" => "String",
     },
+    "v2.ListSecurityMonitoringBatchMigrations" => {
+            "page_size" => "Integer",
+            "page_number" => "Integer",
+            "filter_query" => "String",
+    },
+    "v2.CreateSecurityMonitoringBatchMigration" => {
+            "body" => "SecurityMonitoringBatchMigrationCreateRequest",
+    },
+    "v2.DeleteSecurityMonitoringBatchMigration" => {
+            "batch_id" => "UUID",
+    },
+    "v2.UpdateSecurityMonitoringBatchMigration" => {
+            "batch_id" => "UUID",
+            "body" => "SecurityMonitoringBatchMigrationUpdateRequest",
+    },
+    "v2.CancelSecurityMonitoringBatchMigration" => {
+            "batch_id" => "UUID",
+    },
+    "v2.PublishSecurityMonitoringBatchMigration" => {
+            "batch_id" => "UUID",
+            "body" => "SecurityMonitoringBatchMigrationPublishRequest",
+    },
+    "v2.DeleteSecurityMonitoringBatchMigrationResources" => {
+            "batch_id" => "UUID",
+            "body" => "SecurityMonitoringBatchMigrationResourcesDeleteRequest",
+    },
+    "v2.ListSecurityMonitoringBatchMigrationResources" => {
+            "batch_id" => "UUID",
+            "page_size" => "Integer",
+            "page_number" => "Integer",
+            "filter_query" => "String",
+    },
+    "v2.CreateSecurityMonitoringBatchMigrationResources" => {
+            "batch_id" => "UUID",
+            "body" => "SecurityMonitoringBatchMigrationResourcesCreateRequest",
+    },
+    "v2.UpdateSecurityMonitoringBatchMigrationResource" => {
+            "batch_id" => "UUID",
+            "resource_id" => "UUID",
+            "body" => "SecurityMonitoringBatchMigrationResourceUpdateRequest",
+    },
+    "v2.StartSecurityMonitoringBatchMigration" => {
+            "batch_id" => "UUID",
+    },
     "v2.CreateSecurityMonitoringCriticalAsset" => {
             "body" => "SecurityMonitoringCriticalAssetCreateRequest",
     },

features/v2/given.json

@@ -1618,6 +1618,31 @@
     "tag": "Security Monitoring",
     "operationId": "CreateVulnerabilityNotificationRule"
   },
+  {
+    "parameters": [
+      {
+        "name": "body",
+        "value": "{\n  \"data\": {\n    \"type\": \"batchMigration\",\n    \"attributes\": {\n      \"name\": \"{{ unique }}\",\n      \"description\": \"Rules imported from Splunk\",\n      \"tags\": [\"source:splunk\"],\n      \"resources\": [\n        {\n          \"name\": \"Repeated Windows login failures\",\n          \"inputType\": \"spl\",\n          \"input\": \"index=wineventlog EventCode=4625\"\n        }\n      ]\n    }\n  }\n}"
+      }
+    ],
+    "step": "there is a valid \"batch_migration\" in the system",
+    "key": "batch_migration",
+    "tag": "Security Monitoring",
+    "operationId": "CreateSecurityMonitoringBatchMigration"
+  },
+  {
+    "parameters": [
+      {
+        "name": "batch_id",
+        "value": "\"{{ batch_migration.data.id }}\""
+      }
+    ],
+    "source": "data[0]",
+    "step": "there is a valid \"batch_migration_resource\" in the system",
+    "key": "batch_migration_resource",
+    "tag": "Security Monitoring",
+    "operationId": "ListSecurityMonitoringBatchMigrationResources"
+  },
   {
     "parameters": [
       {