Skip to content

Commit 0dd4d39

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Cloud SIEM - Add instantaneousBaseline feature parameter. (#2990)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent 9fa4783 commit 0dd4d39

6 files changed

+135
-0
lines changed

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47596,6 +47596,8 @@ components:
4759647596
properties:
4759747597
forgetAfter:
4759847598
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter'
47599+
instantaneousBaseline:
47600+
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsInstantaneousBaseline'
4759947601
learningDuration:
4760047602
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration'
4760147603
learningMethod:
@@ -47621,6 +47623,13 @@ components:
4762147623
- TWO_WEEKS
4762247624
- THREE_WEEKS
4762347625
- FOUR_WEEKS
47626+
SecurityMonitoringRuleNewValueOptionsInstantaneousBaseline:
47627+
description: When set to true, Datadog uses previous values that fall within
47628+
the defined learning window to construct the baseline, enabling the system
47629+
to establish an accurate baseline more rapidly rather than relying solely
47630+
on gradual learning over time.
47631+
example: false
47632+
type: boolean
4762447633
SecurityMonitoringRuleNewValueOptionsLearningDuration:
4762547634
default: 0
4762647635
description: 'The duration in days during which values are learned, and after

‎examples/v2/security-monitoring/ValidateSecurityMonitoringRule_2609327779.py‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
"""
2+
Validate a detection rule with detection method 'new_value' with enabled feature 'instantaneousBaseline' returns "OK"
3+
response
4+
"""
5+
6+
from datadog_api_client import ApiClient, Configuration
7+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
8+
from datadog_api_client.v2.model.security_monitoring_rule_case_create import SecurityMonitoringRuleCaseCreate
9+
from datadog_api_client.v2.model.security_monitoring_rule_detection_method import SecurityMonitoringRuleDetectionMethod
10+
from datadog_api_client.v2.model.security_monitoring_rule_evaluation_window import (
11+
SecurityMonitoringRuleEvaluationWindow,
12+
)
13+
from datadog_api_client.v2.model.security_monitoring_rule_keep_alive import SecurityMonitoringRuleKeepAlive
14+
from datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration import (
15+
SecurityMonitoringRuleMaxSignalDuration,
16+
)
17+
from datadog_api_client.v2.model.security_monitoring_rule_new_value_options import SecurityMonitoringRuleNewValueOptions
18+
from datadog_api_client.v2.model.security_monitoring_rule_new_value_options_forget_after import (
19+
SecurityMonitoringRuleNewValueOptionsForgetAfter,
20+
)
21+
from datadog_api_client.v2.model.security_monitoring_rule_new_value_options_learning_duration import (
22+
SecurityMonitoringRuleNewValueOptionsLearningDuration,
23+
)
24+
from datadog_api_client.v2.model.security_monitoring_rule_new_value_options_learning_method import (
25+
SecurityMonitoringRuleNewValueOptionsLearningMethod,
26+
)
27+
from datadog_api_client.v2.model.security_monitoring_rule_new_value_options_learning_threshold import (
28+
SecurityMonitoringRuleNewValueOptionsLearningThreshold,
29+
)
30+
from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions
31+
from datadog_api_client.v2.model.security_monitoring_rule_query_aggregation import (
32+
SecurityMonitoringRuleQueryAggregation,
33+
)
34+
from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity
35+
from datadog_api_client.v2.model.security_monitoring_rule_type_create import SecurityMonitoringRuleTypeCreate
36+
from datadog_api_client.v2.model.security_monitoring_standard_data_source import SecurityMonitoringStandardDataSource
37+
from datadog_api_client.v2.model.security_monitoring_standard_rule_payload import SecurityMonitoringStandardRulePayload
38+
from datadog_api_client.v2.model.security_monitoring_standard_rule_query import SecurityMonitoringStandardRuleQuery
39+
40+
body = SecurityMonitoringStandardRulePayload(
41+
cases=[
42+
SecurityMonitoringRuleCaseCreate(
43+
name="",
44+
status=SecurityMonitoringRuleSeverity.INFO,
45+
notifications=[],
46+
),
47+
],
48+
has_extended_title=True,
49+
is_enabled=True,
50+
message="My security monitoring rule",
51+
name="My security monitoring rule",
52+
options=SecurityMonitoringRuleOptions(
53+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.ZERO_MINUTES,
54+
keep_alive=SecurityMonitoringRuleKeepAlive.FIVE_MINUTES,
55+
max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.TEN_MINUTES,
56+
detection_method=SecurityMonitoringRuleDetectionMethod.NEW_VALUE,
57+
new_value_options=SecurityMonitoringRuleNewValueOptions(
58+
forget_after=SecurityMonitoringRuleNewValueOptionsForgetAfter.ONE_WEEK,
59+
instantaneous_baseline=True,
60+
learning_duration=SecurityMonitoringRuleNewValueOptionsLearningDuration.ONE_DAY,
61+
learning_threshold=SecurityMonitoringRuleNewValueOptionsLearningThreshold.ZERO_OCCURRENCES,
62+
learning_method=SecurityMonitoringRuleNewValueOptionsLearningMethod.DURATION,
63+
),
64+
),
65+
queries=[
66+
SecurityMonitoringStandardRuleQuery(
67+
query="source:source_here",
68+
group_by_fields=[
69+
"@userIdentity.assumed_role",
70+
],
71+
distinct_fields=[],
72+
metric="name",
73+
metrics=[
74+
"name",
75+
],
76+
aggregation=SecurityMonitoringRuleQueryAggregation.NEW_VALUE,
77+
name="",
78+
data_source=SecurityMonitoringStandardDataSource.LOGS,
79+
),
80+
],
81+
tags=[
82+
"env:prod",
83+
"team:security",
84+
],
85+
type=SecurityMonitoringRuleTypeCreate.LOG_DETECTION,
86+
)
87+
88+
configuration = Configuration()
89+
with ApiClient(configuration) as api_client:
90+
api_instance = SecurityMonitoringApi(api_client)
91+
api_instance.validate_security_monitoring_rule(body=body)

‎src/datadog_api_client/v2/model/security_monitoring_rule_new_value_options.py‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,15 @@ def openapi_types(_):
4646

4747
return {
4848
"forget_after": (SecurityMonitoringRuleNewValueOptionsForgetAfter,),
49+
"instantaneous_baseline": (bool,),
4950
"learning_duration": (SecurityMonitoringRuleNewValueOptionsLearningDuration,),
5051
"learning_method": (SecurityMonitoringRuleNewValueOptionsLearningMethod,),
5152
"learning_threshold": (SecurityMonitoringRuleNewValueOptionsLearningThreshold,),
5253
}
5354

5455
attribute_map = {
5556
"forget_after": "forgetAfter",
57+
"instantaneous_baseline": "instantaneousBaseline",
5658
"learning_duration": "learningDuration",
5759
"learning_method": "learningMethod",
5860
"learning_threshold": "learningThreshold",
@@ -61,6 +63,7 @@ def openapi_types(_):
6163
def __init__(
6264
self_,
6365
forget_after: Union[SecurityMonitoringRuleNewValueOptionsForgetAfter, UnsetType] = unset,
66+
instantaneous_baseline: Union[bool, UnsetType] = unset,
6467
learning_duration: Union[SecurityMonitoringRuleNewValueOptionsLearningDuration, UnsetType] = unset,
6568
learning_method: Union[SecurityMonitoringRuleNewValueOptionsLearningMethod, UnsetType] = unset,
6669
learning_threshold: Union[SecurityMonitoringRuleNewValueOptionsLearningThreshold, UnsetType] = unset,
@@ -72,6 +75,9 @@ def __init__(
7275
:param forget_after: The duration in days after which a learned value is forgotten.
7376
:type forget_after: SecurityMonitoringRuleNewValueOptionsForgetAfter, optional
7477
78+
:param instantaneous_baseline: When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time.
79+
:type instantaneous_baseline: bool, optional
80+
7581
:param learning_duration: The duration in days during which values are learned, and after which signals will be generated for values that
7682
weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
7783
:type learning_duration: SecurityMonitoringRuleNewValueOptionsLearningDuration, optional
@@ -84,6 +90,8 @@ def __init__(
8490
"""
8591
if forget_after is not unset:
8692
kwargs["forget_after"] = forget_after
93+
if instantaneous_baseline is not unset:
94+
kwargs["instantaneous_baseline"] = instantaneous_baseline
8795
if learning_duration is not unset:
8896
kwargs["learning_duration"] = learning_duration
8997
if learning_method is not unset:

‎tests/v2/cassettes/test_scenarios/test_validate_a_detection_rule_with_detection_method_new_value_with_enabled_feature_instantaneousbaseline_returns_ok_response.frozen‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2025-12-10T08:37:17.537Z

‎tests/v2/cassettes/test_scenarios/test_validate_a_detection_rule_with_detection_method_new_value_with_enabled_feature_instantaneousbaseline_returns_ok_response.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
interactions:
2+
- request:
3+
body: '{"cases":[{"name":"","notifications":[],"status":"info"}],"hasExtendedTitle":true,"isEnabled":true,"message":"My
4+
security monitoring rule","name":"My security monitoring rule","options":{"detectionMethod":"new_value","evaluationWindow":0,"keepAlive":300,"maxSignalDuration":600,"newValueOptions":{"forgetAfter":7,"instantaneousBaseline":true,"learningDuration":1,"learningMethod":"duration","learningThreshold":0}},"queries":[{"aggregation":"new_value","dataSource":"logs","distinctFields":[],"groupByFields":["@userIdentity.assumed_role"],"metric":"name","metrics":["name"],"name":"","query":"source:source_here"}],"tags":["env:prod","team:security"],"type":"log_detection"}'
5+
headers:
6+
accept:
7+
- '*/*'
8+
content-type:
9+
- application/json
10+
method: POST
11+
uri: https://api.datadoghq.com/api/v2/security_monitoring/rules/validation
12+
response:
13+
body:
14+
string: ''
15+
headers: {}
16+
status:
17+
code: 204
18+
message: No Content
19+
version: 1

‎tests/v2/features/security_monitoring.feature‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1764,6 +1764,13 @@ Feature: Security Monitoring
17641764
When the request is sent
17651765
Then the response status is 204 OK
17661766

1767+
@team:DataDog/k9-cloud-security-platform
1768+
Scenario: Validate a detection rule with detection method 'new_value' with enabled feature 'instantaneousBaseline' returns "OK" response
1769+
Given new "ValidateSecurityMonitoringRule" request
1770+
And body with value {"cases":[{"name":"","status":"info","notifications":[]}],"hasExtendedTitle":true,"isEnabled":true,"message":"My security monitoring rule","name":"My security monitoring rule","options":{"evaluationWindow":0,"keepAlive":300,"maxSignalDuration":600,"detectionMethod":"new_value","newValueOptions":{"forgetAfter":7,"instantaneousBaseline":true,"learningDuration":1,"learningThreshold":0,"learningMethod":"duration"}},"queries":[{"query":"source:source_here","groupByFields":["@userIdentity.assumed_role"],"distinctFields":[],"metric":"name","metrics":["name"],"aggregation":"new_value","name":"","dataSource":"logs"}],"tags":["env:prod","team:security"],"type":"log_detection"}
1771+
When the request is sent
1772+
Then the response status is 204 OK
1773+
17671774
@team:DataDog/k9-cloud-security-platform
17681775
Scenario: Validate a detection rule with detection method 'sequence_detection' returns "OK" response
17691776
Given new "ValidateSecurityMonitoringRule" request

0 commit comments

Comments
 (0)