diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml index 67ea97d1d6..3ac7ae5f2b 100644 --- a/.generator/schemas/v2/openapi.yaml +++ b/.generator/schemas/v2/openapi.yaml @@ -1388,6 +1388,20 @@ components: required: true schema: type: string + SecurityMonitoringTerraformResourceId: + description: The ID of the security monitoring resource to export. + in: path + name: resource_id + required: true + schema: + type: string + SecurityMonitoringTerraformResourceType: + description: The type of security monitoring resource to export. + in: path + name: resource_type + required: true + schema: + $ref: "#/components/schemas/SecurityMonitoringTerraformResourceType" SensitiveDataScannerGroupID: description: The ID of a group of rules. in: path @@ -64963,6 +64977,134 @@ components: $ref: "#/components/schemas/SecurityMonitoringSuppression" type: array type: object + SecurityMonitoringTerraformBulkExportAttributes: + description: Attributes for the bulk export request. + properties: + resource_ids: + description: The list of resource IDs to export. Maximum 1000 items. + example: + - "" + items: + description: The ID of the resource to export. + type: string + maxItems: 1000 + type: array + required: + - resource_ids + type: object + SecurityMonitoringTerraformBulkExportData: + description: The bulk export request data object. + properties: + attributes: + $ref: "#/components/schemas/SecurityMonitoringTerraformBulkExportAttributes" + type: + description: The JSON:API type. Always `bulk_export_resources`. + example: bulk_export_resources + type: string + required: + - type + - attributes + type: object + SecurityMonitoringTerraformBulkExportRequest: + description: Request body for bulk exporting security monitoring resources to Terraform. + properties: + data: + $ref: "#/components/schemas/SecurityMonitoringTerraformBulkExportData" + required: + - data + type: object + SecurityMonitoringTerraformConvertAttributes: + description: Attributes for the convert request. + properties: + resource_json: + additionalProperties: {} + description: The resource attributes as a JSON object, matching the structure returned by the corresponding Datadog API (for example, the attributes of a suppression rule). + example: + enabled: true + name: Custom suppression + rule_query: type:log_detection source:cloudtrail + suppression_query: env:staging status:low + type: object + required: + - resource_json + type: object + SecurityMonitoringTerraformConvertData: + description: The convert request data object. + properties: + attributes: + $ref: "#/components/schemas/SecurityMonitoringTerraformConvertAttributes" + id: + description: The ID of the resource being converted. + example: abc-123 + type: string + type: + description: The JSON:API type. Always `convert_resource`. + example: convert_resource + type: string + required: + - type + - id + - attributes + type: object + SecurityMonitoringTerraformConvertRequest: + description: Request body for converting a security monitoring resource JSON to Terraform. + properties: + data: + $ref: "#/components/schemas/SecurityMonitoringTerraformConvertData" + required: + - data + type: object + SecurityMonitoringTerraformExportAttributes: + description: Attributes of the Terraform export response. + properties: + output: + description: The Terraform configuration for the resource. + type: string + resource_id: + description: The ID of the exported resource. + example: abc-123 + type: string + type_name: + description: The Terraform resource type name. + example: datadog_security_monitoring_suppression + type: string + required: + - type_name + - resource_id + type: object + SecurityMonitoringTerraformExportData: + description: The Terraform export data object. + properties: + attributes: + $ref: "#/components/schemas/SecurityMonitoringTerraformExportAttributes" + id: + description: The resource identifier composed of the Terraform type name and the resource ID separated by `|`. + example: datadog_security_monitoring_suppression|abc-123 + type: string + type: + description: The JSON:API type. Always `format_resource`. + example: format_resource + type: string + required: + - type + - id + - attributes + type: object + SecurityMonitoringTerraformExportResponse: + description: Response containing the Terraform configuration for a security monitoring resource. + properties: + data: + $ref: "#/components/schemas/SecurityMonitoringTerraformExportData" + type: object + SecurityMonitoringTerraformResourceType: + description: The type of security monitoring resource to export to Terraform. + enum: + - suppressions + - critical_assets + type: string + x-enum-varnames: + - SUPPRESSIONS + - CRITICAL_ASSETS SecurityMonitoringThirdPartyRootQuery: description: A query to be combined with the third party case query. properties: @@ -114337,6 +114479,141 @@ paths: permissions: - security_monitoring_rules_read - security_monitoring_signals_read + /api/v2/security_monitoring/terraform/{resource_type}/bulk: + post: + description: |- + Export multiple security monitoring resources to Terraform, packaged as a zip archive. + The `resource_type` path parameter specifies the type of resources to export + and must be one of `suppressions` or `critical_assets`. + A maximum of 1000 resources can be exported in a single request. + operationId: BulkExportSecurityMonitoringTerraformResources + parameters: + - $ref: "#/components/parameters/SecurityMonitoringTerraformResourceType" + requestBody: + content: + application/json: + schema: + $ref: "#/components/schemas/SecurityMonitoringTerraformBulkExportRequest" + description: The resource IDs to export. + required: true + responses: + "200": + content: + application/zip: + schema: + format: binary + type: string + description: OK + "400": + $ref: "#/components/responses/BadRequestResponse" + "403": + $ref: "#/components/responses/NotAuthorizedResponse" + "404": + $ref: "#/components/responses/NotFoundResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_suppressions_read + - AuthZ: + - security_monitoring_rules_read + summary: Export security monitoring resources to Terraform + tags: + - Security Monitoring + x-codegen-request-body-name: body + "x-permission": + operator: OR + permissions: + - security_monitoring_suppressions_read + - security_monitoring_rules_read + x-unstable: "**Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." + /api/v2/security_monitoring/terraform/{resource_type}/convert: + post: + description: |- + Convert a security monitoring resource that doesn't (yet) exist from JSON to Terraform. + The `resource_type` path parameter specifies the type of resource to convert + and must be one of `suppressions` or `critical_assets`. + operationId: ConvertSecurityMonitoringTerraformResource + parameters: + - $ref: "#/components/parameters/SecurityMonitoringTerraformResourceType" + requestBody: + content: + application/json: + schema: + $ref: "#/components/schemas/SecurityMonitoringTerraformConvertRequest" + description: The resource JSON to convert. + required: true + responses: + "200": + content: + application/json: + schema: + $ref: "#/components/schemas/SecurityMonitoringTerraformExportResponse" + description: OK + "400": + $ref: "#/components/responses/BadRequestResponse" + "403": + $ref: "#/components/responses/NotAuthorizedResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_suppressions_read + - AuthZ: + - security_monitoring_rules_read + summary: Convert security monitoring resource to Terraform + tags: + - Security Monitoring + x-codegen-request-body-name: body + "x-permission": + operator: OR + permissions: + - security_monitoring_suppressions_read + - security_monitoring_rules_read + x-unstable: "**Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." + /api/v2/security_monitoring/terraform/{resource_type}/{resource_id}: + get: + description: |- + Export a security monitoring resource to a Terraform configuration. + The `resource_type` path parameter specifies the type of resource to export + and must be one of `suppressions` or `critical_assets`. + operationId: ExportSecurityMonitoringTerraformResource + parameters: + - $ref: "#/components/parameters/SecurityMonitoringTerraformResourceType" + - $ref: "#/components/parameters/SecurityMonitoringTerraformResourceId" + responses: + "200": + content: + application/json: + schema: + $ref: "#/components/schemas/SecurityMonitoringTerraformExportResponse" + description: OK + "403": + $ref: "#/components/responses/NotAuthorizedResponse" + "404": + $ref: "#/components/responses/NotFoundResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_suppressions_read + - AuthZ: + - security_monitoring_rules_read + summary: Export security monitoring resource to Terraform + tags: + - Security Monitoring + "x-permission": + operator: OR + permissions: + - security_monitoring_suppressions_read + - security_monitoring_rules_read + x-unstable: "**Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." /api/v2/sensitive-data-scanner/config: get: description: List all the Scanning groups in your organization. diff --git a/docs/datadog_api_client.v2.model.rst b/docs/datadog_api_client.v2.model.rst index c65fd42108..926f637b63 100644 --- a/docs/datadog_api_client.v2.model.rst +++ b/docs/datadog_api_client.v2.model.rst @@ -28732,6 +28732,76 @@ datadog\_api\_client.v2.model.security\_monitoring\_suppressions\_response modul :members: :show-inheritance: +datadog\_api\_client.v2.model.security\_monitoring\_terraform\_bulk\_export\_attributes module +---------------------------------------------------------------------------------------------- + +.. automodule:: datadog_api_client.v2.model.security_monitoring_terraform_bulk_export_attributes + :members: + :show-inheritance: + +datadog\_api\_client.v2.model.security\_monitoring\_terraform\_bulk\_export\_data module +---------------------------------------------------------------------------------------- + +.. automodule:: datadog_api_client.v2.model.security_monitoring_terraform_bulk_export_data + :members: + :show-inheritance: + +datadog\_api\_client.v2.model.security\_monitoring\_terraform\_bulk\_export\_request module +------------------------------------------------------------------------------------------- + +.. automodule:: datadog_api_client.v2.model.security_monitoring_terraform_bulk_export_request + :members: + :show-inheritance: + +datadog\_api\_client.v2.model.security\_monitoring\_terraform\_convert\_attributes module +----------------------------------------------------------------------------------------- + +.. automodule:: datadog_api_client.v2.model.security_monitoring_terraform_convert_attributes + :members: + :show-inheritance: + +datadog\_api\_client.v2.model.security\_monitoring\_terraform\_convert\_data module +----------------------------------------------------------------------------------- + +.. automodule:: datadog_api_client.v2.model.security_monitoring_terraform_convert_data + :members: + :show-inheritance: + +datadog\_api\_client.v2.model.security\_monitoring\_terraform\_convert\_request module +-------------------------------------------------------------------------------------- + +.. automodule:: datadog_api_client.v2.model.security_monitoring_terraform_convert_request + :members: + :show-inheritance: + +datadog\_api\_client.v2.model.security\_monitoring\_terraform\_export\_attributes module +---------------------------------------------------------------------------------------- + +.. automodule:: datadog_api_client.v2.model.security_monitoring_terraform_export_attributes + :members: + :show-inheritance: + +datadog\_api\_client.v2.model.security\_monitoring\_terraform\_export\_data module +---------------------------------------------------------------------------------- + +.. automodule:: datadog_api_client.v2.model.security_monitoring_terraform_export_data + :members: + :show-inheritance: + +datadog\_api\_client.v2.model.security\_monitoring\_terraform\_export\_response module +-------------------------------------------------------------------------------------- + +.. automodule:: datadog_api_client.v2.model.security_monitoring_terraform_export_response + :members: + :show-inheritance: + +datadog\_api\_client.v2.model.security\_monitoring\_terraform\_resource\_type module +------------------------------------------------------------------------------------ + +.. automodule:: datadog_api_client.v2.model.security_monitoring_terraform_resource_type + :members: + :show-inheritance: + datadog\_api\_client.v2.model.security\_monitoring\_third\_party\_root\_query module ------------------------------------------------------------------------------------ diff --git a/examples/v2/security-monitoring/BulkExportSecurityMonitoringTerraformResources.py b/examples/v2/security-monitoring/BulkExportSecurityMonitoringTerraformResources.py new file mode 100644 index 0000000000..0513aaeb07 --- /dev/null +++ b/examples/v2/security-monitoring/BulkExportSecurityMonitoringTerraformResources.py @@ -0,0 +1,43 @@ +""" +Export security monitoring resources to Terraform returns "OK" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi +from datadog_api_client.v2.model.security_monitoring_terraform_bulk_export_attributes import ( + SecurityMonitoringTerraformBulkExportAttributes, +) +from datadog_api_client.v2.model.security_monitoring_terraform_bulk_export_data import ( + SecurityMonitoringTerraformBulkExportData, +) +from datadog_api_client.v2.model.security_monitoring_terraform_bulk_export_request import ( + SecurityMonitoringTerraformBulkExportRequest, +) +from datadog_api_client.v2.model.security_monitoring_terraform_resource_type import ( + SecurityMonitoringTerraformResourceType, +) + +# there is a valid "suppression" in the system +SUPPRESSION_DATA_ID = environ["SUPPRESSION_DATA_ID"] + +body = SecurityMonitoringTerraformBulkExportRequest( + data=SecurityMonitoringTerraformBulkExportData( + attributes=SecurityMonitoringTerraformBulkExportAttributes( + resource_ids=[ + SUPPRESSION_DATA_ID, + ], + ), + type="bulk_export_resources", + ), +) + +configuration = Configuration() +configuration.unstable_operations["bulk_export_security_monitoring_terraform_resources"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + response = api_instance.bulk_export_security_monitoring_terraform_resources( + resource_type=SecurityMonitoringTerraformResourceType.SUPPRESSIONS, body=body + ) + + print(response.read()) diff --git a/examples/v2/security-monitoring/ConvertSecurityMonitoringTerraformResource.py b/examples/v2/security-monitoring/ConvertSecurityMonitoringTerraformResource.py new file mode 100644 index 0000000000..537b357232 --- /dev/null +++ b/examples/v2/security-monitoring/ConvertSecurityMonitoringTerraformResource.py @@ -0,0 +1,45 @@ +""" +Convert security monitoring resource to Terraform returns "OK" response +""" + +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi +from datadog_api_client.v2.model.security_monitoring_terraform_convert_attributes import ( + SecurityMonitoringTerraformConvertAttributes, +) +from datadog_api_client.v2.model.security_monitoring_terraform_convert_data import ( + SecurityMonitoringTerraformConvertData, +) +from datadog_api_client.v2.model.security_monitoring_terraform_convert_request import ( + SecurityMonitoringTerraformConvertRequest, +) +from datadog_api_client.v2.model.security_monitoring_terraform_resource_type import ( + SecurityMonitoringTerraformResourceType, +) + +body = SecurityMonitoringTerraformConvertRequest( + data=SecurityMonitoringTerraformConvertData( + type="convert_resource", + id="abc-123", + attributes=SecurityMonitoringTerraformConvertAttributes( + resource_json=dict( + [ + ("enabled", "True"), + ("name", "Example-Security-Monitoring"), + ("rule_query", "source:cloudtrail"), + ("suppression_query", "env:test"), + ] + ), + ), + ), +) + +configuration = Configuration() +configuration.unstable_operations["convert_security_monitoring_terraform_resource"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + response = api_instance.convert_security_monitoring_terraform_resource( + resource_type=SecurityMonitoringTerraformResourceType.SUPPRESSIONS, body=body + ) + + print(response) diff --git a/examples/v2/security-monitoring/ExportSecurityMonitoringTerraformResource.py b/examples/v2/security-monitoring/ExportSecurityMonitoringTerraformResource.py new file mode 100644 index 0000000000..1199747353 --- /dev/null +++ b/examples/v2/security-monitoring/ExportSecurityMonitoringTerraformResource.py @@ -0,0 +1,24 @@ +""" +Export security monitoring resource to Terraform returns "OK" response +""" + +from os import environ +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi +from datadog_api_client.v2.model.security_monitoring_terraform_resource_type import ( + SecurityMonitoringTerraformResourceType, +) + +# there is a valid "suppression" in the system +SUPPRESSION_DATA_ID = environ["SUPPRESSION_DATA_ID"] + +configuration = Configuration() +configuration.unstable_operations["export_security_monitoring_terraform_resource"] = True +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + response = api_instance.export_security_monitoring_terraform_resource( + resource_type=SecurityMonitoringTerraformResourceType.SUPPRESSIONS, + resource_id=SUPPRESSION_DATA_ID, + ) + + print(response) diff --git a/src/datadog_api_client/configuration.py b/src/datadog_api_client/configuration.py index 8383d6ba53..f252d011b1 100644 --- a/src/datadog_api_client/configuration.py +++ b/src/datadog_api_client/configuration.py @@ -298,10 +298,13 @@ def __init__( "v2.get_aws_cloud_auth_persona_mapping": False, "v2.list_aws_cloud_auth_persona_mappings": False, "v2.activate_content_pack": False, + "v2.bulk_export_security_monitoring_terraform_resources": False, "v2.cancel_threat_hunting_job": False, "v2.convert_job_result_to_signal": False, + "v2.convert_security_monitoring_terraform_resource": False, "v2.deactivate_content_pack": False, "v2.delete_threat_hunting_job": False, + "v2.export_security_monitoring_terraform_resource": False, "v2.get_content_packs_states": False, "v2.get_finding": False, "v2.get_indicator_of_compromise": False, diff --git a/src/datadog_api_client/v2/api/security_monitoring_api.py b/src/datadog_api_client/v2/api/security_monitoring_api.py index e5c6b02989..9ac7f34074 100644 --- a/src/datadog_api_client/v2/api/security_monitoring_api.py +++ b/src/datadog_api_client/v2/api/security_monitoring_api.py @@ -153,6 +153,18 @@ from datadog_api_client.v2.model.security_monitoring_signal_state_update_request import ( SecurityMonitoringSignalStateUpdateRequest, ) +from datadog_api_client.v2.model.security_monitoring_terraform_resource_type import ( + SecurityMonitoringTerraformResourceType, +) +from datadog_api_client.v2.model.security_monitoring_terraform_bulk_export_request import ( + SecurityMonitoringTerraformBulkExportRequest, +) +from datadog_api_client.v2.model.security_monitoring_terraform_export_response import ( + SecurityMonitoringTerraformExportResponse, +) +from datadog_api_client.v2.model.security_monitoring_terraform_convert_request import ( + SecurityMonitoringTerraformConvertRequest, +) from datadog_api_client.v2.model.list_threat_hunting_jobs_response import ListThreatHuntingJobsResponse from datadog_api_client.v2.model.job_create_response import JobCreateResponse from datadog_api_client.v2.model.run_threat_hunting_job_request import RunThreatHuntingJobRequest @@ -302,6 +314,32 @@ def __init__(self, api_client=None): api_client=api_client, ) + self._bulk_export_security_monitoring_terraform_resources_endpoint = _Endpoint( + settings={ + "response_type": (file_type,), + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/terraform/{resource_type}/bulk", + "operation_id": "bulk_export_security_monitoring_terraform_resources", + "http_method": "POST", + "version": "v2", + }, + params_map={ + "resource_type": { + "required": True, + "openapi_types": (SecurityMonitoringTerraformResourceType,), + "attribute": "resource_type", + "location": "path", + }, + "body": { + "required": True, + "openapi_types": (SecurityMonitoringTerraformBulkExportRequest,), + "location": "body", + }, + }, + headers_map={"accept": ["application/zip", "application/json"], "content_type": ["application/json"]}, + api_client=api_client, + ) + self._cancel_threat_hunting_job_endpoint = _Endpoint( settings={ "response_type": None, @@ -388,6 +426,32 @@ def __init__(self, api_client=None): api_client=api_client, ) + self._convert_security_monitoring_terraform_resource_endpoint = _Endpoint( + settings={ + "response_type": (SecurityMonitoringTerraformExportResponse,), + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/terraform/{resource_type}/convert", + "operation_id": "convert_security_monitoring_terraform_resource", + "http_method": "POST", + "version": "v2", + }, + params_map={ + "resource_type": { + "required": True, + "openapi_types": (SecurityMonitoringTerraformResourceType,), + "attribute": "resource_type", + "location": "path", + }, + "body": { + "required": True, + "openapi_types": (SecurityMonitoringTerraformConvertRequest,), + "location": "body", + }, + }, + headers_map={"accept": ["application/json"], "content_type": ["application/json"]}, + api_client=api_client, + ) + self._create_cases_endpoint = _Endpoint( settings={ "response_type": (FindingCaseResponseArray,), @@ -879,6 +943,35 @@ def __init__(self, api_client=None): api_client=api_client, ) + self._export_security_monitoring_terraform_resource_endpoint = _Endpoint( + settings={ + "response_type": (SecurityMonitoringTerraformExportResponse,), + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/terraform/{resource_type}/{resource_id}", + "operation_id": "export_security_monitoring_terraform_resource", + "http_method": "GET", + "version": "v2", + }, + params_map={ + "resource_type": { + "required": True, + "openapi_types": (SecurityMonitoringTerraformResourceType,), + "attribute": "resource_type", + "location": "path", + }, + "resource_id": { + "required": True, + "openapi_types": (str,), + "attribute": "resource_id", + "location": "path", + }, + }, + headers_map={ + "accept": ["application/json"], + }, + api_client=api_client, + ) + self._get_content_packs_states_endpoint = _Endpoint( settings={ "response_type": (SecurityMonitoringContentPackStatesResponse,), @@ -2956,6 +3049,31 @@ def bulk_export_security_monitoring_rules( return self._bulk_export_security_monitoring_rules_endpoint.call_with_http_info(**kwargs) + def bulk_export_security_monitoring_terraform_resources( + self, + resource_type: SecurityMonitoringTerraformResourceType, + body: SecurityMonitoringTerraformBulkExportRequest, + ) -> file_type: + """Export security monitoring resources to Terraform. + + Export multiple security monitoring resources to Terraform, packaged as a zip archive. + The ``resource_type`` path parameter specifies the type of resources to export + and must be one of ``suppressions`` or ``critical_assets``. + A maximum of 1000 resources can be exported in a single request. + + :param resource_type: The type of security monitoring resource to export. + :type resource_type: SecurityMonitoringTerraformResourceType + :param body: The resource IDs to export. + :type body: SecurityMonitoringTerraformBulkExportRequest + :rtype: file_type + """ + kwargs: Dict[str, Any] = {} + kwargs["resource_type"] = resource_type + + kwargs["body"] = body + + return self._bulk_export_security_monitoring_terraform_resources_endpoint.call_with_http_info(**kwargs) + def cancel_threat_hunting_job( self, job_id: str, @@ -3040,6 +3158,30 @@ def convert_security_monitoring_rule_from_json_to_terraform( return self._convert_security_monitoring_rule_from_json_to_terraform_endpoint.call_with_http_info(**kwargs) + def convert_security_monitoring_terraform_resource( + self, + resource_type: SecurityMonitoringTerraformResourceType, + body: SecurityMonitoringTerraformConvertRequest, + ) -> SecurityMonitoringTerraformExportResponse: + """Convert security monitoring resource to Terraform. + + Convert a security monitoring resource that doesn't (yet) exist from JSON to Terraform. + The ``resource_type`` path parameter specifies the type of resource to convert + and must be one of ``suppressions`` or ``critical_assets``. + + :param resource_type: The type of security monitoring resource to export. + :type resource_type: SecurityMonitoringTerraformResourceType + :param body: The resource JSON to convert. + :type body: SecurityMonitoringTerraformConvertRequest + :rtype: SecurityMonitoringTerraformExportResponse + """ + kwargs: Dict[str, Any] = {} + kwargs["resource_type"] = resource_type + + kwargs["body"] = body + + return self._convert_security_monitoring_terraform_resource_endpoint.call_with_http_info(**kwargs) + def create_cases( self, body: CreateCaseRequestArray, @@ -3443,6 +3585,30 @@ def edit_security_monitoring_signal_state( return self._edit_security_monitoring_signal_state_endpoint.call_with_http_info(**kwargs) + def export_security_monitoring_terraform_resource( + self, + resource_type: SecurityMonitoringTerraformResourceType, + resource_id: str, + ) -> SecurityMonitoringTerraformExportResponse: + """Export security monitoring resource to Terraform. + + Export a security monitoring resource to a Terraform configuration. + The ``resource_type`` path parameter specifies the type of resource to export + and must be one of ``suppressions`` or ``critical_assets``. + + :param resource_type: The type of security monitoring resource to export. + :type resource_type: SecurityMonitoringTerraformResourceType + :param resource_id: The ID of the security monitoring resource to export. + :type resource_id: str + :rtype: SecurityMonitoringTerraformExportResponse + """ + kwargs: Dict[str, Any] = {} + kwargs["resource_type"] = resource_type + + kwargs["resource_id"] = resource_id + + return self._export_security_monitoring_terraform_resource_endpoint.call_with_http_info(**kwargs) + def get_content_packs_states( self, ) -> SecurityMonitoringContentPackStatesResponse: diff --git a/src/datadog_api_client/v2/model/security_monitoring_terraform_bulk_export_attributes.py b/src/datadog_api_client/v2/model/security_monitoring_terraform_bulk_export_attributes.py new file mode 100644 index 0000000000..1cf8174530 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_terraform_bulk_export_attributes.py @@ -0,0 +1,40 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import List + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +class SecurityMonitoringTerraformBulkExportAttributes(ModelNormal): + validations = { + "resource_ids": { + "max_items": 1000, + }, + } + + @cached_property + def openapi_types(_): + return { + "resource_ids": ([str],), + } + + attribute_map = { + "resource_ids": "resource_ids", + } + + def __init__(self_, resource_ids: List[str], **kwargs): + """ + Attributes for the bulk export request. + + :param resource_ids: The list of resource IDs to export. Maximum 1000 items. + :type resource_ids: [str] + """ + super().__init__(kwargs) + + self_.resource_ids = resource_ids diff --git a/src/datadog_api_client/v2/model/security_monitoring_terraform_bulk_export_data.py b/src/datadog_api_client/v2/model/security_monitoring_terraform_bulk_export_data.py new file mode 100644 index 0000000000..5834c836f4 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_terraform_bulk_export_data.py @@ -0,0 +1,50 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_terraform_bulk_export_attributes import ( + SecurityMonitoringTerraformBulkExportAttributes, + ) + + +class SecurityMonitoringTerraformBulkExportData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_terraform_bulk_export_attributes import ( + SecurityMonitoringTerraformBulkExportAttributes, + ) + + return { + "attributes": (SecurityMonitoringTerraformBulkExportAttributes,), + "type": (str,), + } + + attribute_map = { + "attributes": "attributes", + "type": "type", + } + + def __init__(self_, attributes: SecurityMonitoringTerraformBulkExportAttributes, type: str, **kwargs): + """ + The bulk export request data object. + + :param attributes: Attributes for the bulk export request. + :type attributes: SecurityMonitoringTerraformBulkExportAttributes + + :param type: The JSON:API type. Always ``bulk_export_resources``. + :type type: str + """ + super().__init__(kwargs) + + self_.attributes = attributes + self_.type = type diff --git a/src/datadog_api_client/v2/model/security_monitoring_terraform_bulk_export_request.py b/src/datadog_api_client/v2/model/security_monitoring_terraform_bulk_export_request.py new file mode 100644 index 0000000000..516b3852c9 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_terraform_bulk_export_request.py @@ -0,0 +1,44 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_terraform_bulk_export_data import ( + SecurityMonitoringTerraformBulkExportData, + ) + + +class SecurityMonitoringTerraformBulkExportRequest(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_terraform_bulk_export_data import ( + SecurityMonitoringTerraformBulkExportData, + ) + + return { + "data": (SecurityMonitoringTerraformBulkExportData,), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: SecurityMonitoringTerraformBulkExportData, **kwargs): + """ + Request body for bulk exporting security monitoring resources to Terraform. + + :param data: The bulk export request data object. + :type data: SecurityMonitoringTerraformBulkExportData + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/security_monitoring_terraform_convert_attributes.py b/src/datadog_api_client/v2/model/security_monitoring_terraform_convert_attributes.py new file mode 100644 index 0000000000..1722da0737 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_terraform_convert_attributes.py @@ -0,0 +1,53 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Any, Dict + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + date, + datetime, + none_type, + UUID, +) + + +class SecurityMonitoringTerraformConvertAttributes(ModelNormal): + @cached_property + def openapi_types(_): + return { + "resource_json": ( + { + str: ( + bool, + date, + datetime, + dict, + float, + int, + list, + str, + UUID, + none_type, + ) + }, + ), + } + + attribute_map = { + "resource_json": "resource_json", + } + + def __init__(self_, resource_json: Dict[str, Any], **kwargs): + """ + Attributes for the convert request. + + :param resource_json: The resource attributes as a JSON object, matching the structure returned by the corresponding Datadog API (for example, the attributes of a suppression rule). + :type resource_json: {str: (bool, date, datetime, dict, float, int, list, str, UUID, none_type,)} + """ + super().__init__(kwargs) + + self_.resource_json = resource_json diff --git a/src/datadog_api_client/v2/model/security_monitoring_terraform_convert_data.py b/src/datadog_api_client/v2/model/security_monitoring_terraform_convert_data.py new file mode 100644 index 0000000000..92dfb0afa4 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_terraform_convert_data.py @@ -0,0 +1,56 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_terraform_convert_attributes import ( + SecurityMonitoringTerraformConvertAttributes, + ) + + +class SecurityMonitoringTerraformConvertData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_terraform_convert_attributes import ( + SecurityMonitoringTerraformConvertAttributes, + ) + + return { + "attributes": (SecurityMonitoringTerraformConvertAttributes,), + "id": (str,), + "type": (str,), + } + + attribute_map = { + "attributes": "attributes", + "id": "id", + "type": "type", + } + + def __init__(self_, attributes: SecurityMonitoringTerraformConvertAttributes, id: str, type: str, **kwargs): + """ + The convert request data object. + + :param attributes: Attributes for the convert request. + :type attributes: SecurityMonitoringTerraformConvertAttributes + + :param id: The ID of the resource being converted. + :type id: str + + :param type: The JSON:API type. Always ``convert_resource``. + :type type: str + """ + super().__init__(kwargs) + + self_.attributes = attributes + self_.id = id + self_.type = type diff --git a/src/datadog_api_client/v2/model/security_monitoring_terraform_convert_request.py b/src/datadog_api_client/v2/model/security_monitoring_terraform_convert_request.py new file mode 100644 index 0000000000..9814719a62 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_terraform_convert_request.py @@ -0,0 +1,44 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_terraform_convert_data import ( + SecurityMonitoringTerraformConvertData, + ) + + +class SecurityMonitoringTerraformConvertRequest(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_terraform_convert_data import ( + SecurityMonitoringTerraformConvertData, + ) + + return { + "data": (SecurityMonitoringTerraformConvertData,), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: SecurityMonitoringTerraformConvertData, **kwargs): + """ + Request body for converting a security monitoring resource JSON to Terraform. + + :param data: The convert request data object. + :type data: SecurityMonitoringTerraformConvertData + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/security_monitoring_terraform_export_attributes.py b/src/datadog_api_client/v2/model/security_monitoring_terraform_export_attributes.py new file mode 100644 index 0000000000..d72253b299 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_terraform_export_attributes.py @@ -0,0 +1,49 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Union + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, +) + + +class SecurityMonitoringTerraformExportAttributes(ModelNormal): + @cached_property + def openapi_types(_): + return { + "output": (str,), + "resource_id": (str,), + "type_name": (str,), + } + + attribute_map = { + "output": "output", + "resource_id": "resource_id", + "type_name": "type_name", + } + + def __init__(self_, resource_id: str, type_name: str, output: Union[str, UnsetType] = unset, **kwargs): + """ + Attributes of the Terraform export response. + + :param output: The Terraform configuration for the resource. + :type output: str, optional + + :param resource_id: The ID of the exported resource. + :type resource_id: str + + :param type_name: The Terraform resource type name. + :type type_name: str + """ + if output is not unset: + kwargs["output"] = output + super().__init__(kwargs) + + self_.resource_id = resource_id + self_.type_name = type_name diff --git a/src/datadog_api_client/v2/model/security_monitoring_terraform_export_data.py b/src/datadog_api_client/v2/model/security_monitoring_terraform_export_data.py new file mode 100644 index 0000000000..f16c128cde --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_terraform_export_data.py @@ -0,0 +1,56 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_terraform_export_attributes import ( + SecurityMonitoringTerraformExportAttributes, + ) + + +class SecurityMonitoringTerraformExportData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_terraform_export_attributes import ( + SecurityMonitoringTerraformExportAttributes, + ) + + return { + "attributes": (SecurityMonitoringTerraformExportAttributes,), + "id": (str,), + "type": (str,), + } + + attribute_map = { + "attributes": "attributes", + "id": "id", + "type": "type", + } + + def __init__(self_, attributes: SecurityMonitoringTerraformExportAttributes, id: str, type: str, **kwargs): + """ + The Terraform export data object. + + :param attributes: Attributes of the Terraform export response. + :type attributes: SecurityMonitoringTerraformExportAttributes + + :param id: The resource identifier composed of the Terraform type name and the resource ID separated by ``|``. + :type id: str + + :param type: The JSON:API type. Always ``format_resource``. + :type type: str + """ + super().__init__(kwargs) + + self_.attributes = attributes + self_.id = id + self_.type = type diff --git a/src/datadog_api_client/v2/model/security_monitoring_terraform_export_response.py b/src/datadog_api_client/v2/model/security_monitoring_terraform_export_response.py new file mode 100644 index 0000000000..93dc6d88b5 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_terraform_export_response.py @@ -0,0 +1,46 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Union, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_terraform_export_data import ( + SecurityMonitoringTerraformExportData, + ) + + +class SecurityMonitoringTerraformExportResponse(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_terraform_export_data import ( + SecurityMonitoringTerraformExportData, + ) + + return { + "data": (SecurityMonitoringTerraformExportData,), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: Union[SecurityMonitoringTerraformExportData, UnsetType] = unset, **kwargs): + """ + Response containing the Terraform configuration for a security monitoring resource. + + :param data: The Terraform export data object. + :type data: SecurityMonitoringTerraformExportData, optional + """ + if data is not unset: + kwargs["data"] = data + super().__init__(kwargs) diff --git a/src/datadog_api_client/v2/model/security_monitoring_terraform_resource_type.py b/src/datadog_api_client/v2/model/security_monitoring_terraform_resource_type.py new file mode 100644 index 0000000000..24e2b29eb1 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_terraform_resource_type.py @@ -0,0 +1,38 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + + +from datadog_api_client.model_utils import ( + ModelSimple, + cached_property, +) + +from typing import ClassVar + + +class SecurityMonitoringTerraformResourceType(ModelSimple): + """ + The type of security monitoring resource to export to Terraform. + + :param value: Must be one of ["suppressions", "critical_assets"]. + :type value: str + """ + + allowed_values = { + "suppressions", + "critical_assets", + } + SUPPRESSIONS: ClassVar["SecurityMonitoringTerraformResourceType"] + CRITICAL_ASSETS: ClassVar["SecurityMonitoringTerraformResourceType"] + + @cached_property + def openapi_types(_): + return { + "value": (str,), + } + + +SecurityMonitoringTerraformResourceType.SUPPRESSIONS = SecurityMonitoringTerraformResourceType("suppressions") +SecurityMonitoringTerraformResourceType.CRITICAL_ASSETS = SecurityMonitoringTerraformResourceType("critical_assets") diff --git a/src/datadog_api_client/v2/models/__init__.py b/src/datadog_api_client/v2/models/__init__.py index 557e3a838a..9bc2da4ed7 100644 --- a/src/datadog_api_client/v2/models/__init__.py +++ b/src/datadog_api_client/v2/models/__init__.py @@ -5869,6 +5869,34 @@ SecurityMonitoringSuppressionsPageMeta, ) from datadog_api_client.v2.model.security_monitoring_suppressions_response import SecurityMonitoringSuppressionsResponse +from datadog_api_client.v2.model.security_monitoring_terraform_bulk_export_attributes import ( + SecurityMonitoringTerraformBulkExportAttributes, +) +from datadog_api_client.v2.model.security_monitoring_terraform_bulk_export_data import ( + SecurityMonitoringTerraformBulkExportData, +) +from datadog_api_client.v2.model.security_monitoring_terraform_bulk_export_request import ( + SecurityMonitoringTerraformBulkExportRequest, +) +from datadog_api_client.v2.model.security_monitoring_terraform_convert_attributes import ( + SecurityMonitoringTerraformConvertAttributes, +) +from datadog_api_client.v2.model.security_monitoring_terraform_convert_data import ( + SecurityMonitoringTerraformConvertData, +) +from datadog_api_client.v2.model.security_monitoring_terraform_convert_request import ( + SecurityMonitoringTerraformConvertRequest, +) +from datadog_api_client.v2.model.security_monitoring_terraform_export_attributes import ( + SecurityMonitoringTerraformExportAttributes, +) +from datadog_api_client.v2.model.security_monitoring_terraform_export_data import SecurityMonitoringTerraformExportData +from datadog_api_client.v2.model.security_monitoring_terraform_export_response import ( + SecurityMonitoringTerraformExportResponse, +) +from datadog_api_client.v2.model.security_monitoring_terraform_resource_type import ( + SecurityMonitoringTerraformResourceType, +) from datadog_api_client.v2.model.security_monitoring_third_party_root_query import SecurityMonitoringThirdPartyRootQuery from datadog_api_client.v2.model.security_monitoring_third_party_rule_case import SecurityMonitoringThirdPartyRuleCase from datadog_api_client.v2.model.security_monitoring_third_party_rule_case_create import ( @@ -11324,6 +11352,16 @@ "SecurityMonitoringSuppressionsMeta", "SecurityMonitoringSuppressionsPageMeta", "SecurityMonitoringSuppressionsResponse", + "SecurityMonitoringTerraformBulkExportAttributes", + "SecurityMonitoringTerraformBulkExportData", + "SecurityMonitoringTerraformBulkExportRequest", + "SecurityMonitoringTerraformConvertAttributes", + "SecurityMonitoringTerraformConvertData", + "SecurityMonitoringTerraformConvertRequest", + "SecurityMonitoringTerraformExportAttributes", + "SecurityMonitoringTerraformExportData", + "SecurityMonitoringTerraformExportResponse", + "SecurityMonitoringTerraformResourceType", "SecurityMonitoringThirdPartyRootQuery", "SecurityMonitoringThirdPartyRuleCase", "SecurityMonitoringThirdPartyRuleCaseCreate", diff --git a/tests/v2/cassettes/test_scenarios/test_convert_security_monitoring_resource_to_terraform_returns_ok_response.frozen b/tests/v2/cassettes/test_scenarios/test_convert_security_monitoring_resource_to_terraform_returns_ok_response.frozen new file mode 100644 index 0000000000..58f519964f --- /dev/null +++ b/tests/v2/cassettes/test_scenarios/test_convert_security_monitoring_resource_to_terraform_returns_ok_response.frozen @@ -0,0 +1 @@ +2026-04-10T08:55:44.730Z \ No newline at end of file diff --git a/tests/v2/cassettes/test_scenarios/test_convert_security_monitoring_resource_to_terraform_returns_ok_response.yaml b/tests/v2/cassettes/test_scenarios/test_convert_security_monitoring_resource_to_terraform_returns_ok_response.yaml new file mode 100644 index 0000000000..1ed41ced20 --- /dev/null +++ b/tests/v2/cassettes/test_scenarios/test_convert_security_monitoring_resource_to_terraform_returns_ok_response.yaml @@ -0,0 +1,23 @@ +interactions: +- request: + body: '{"data":{"attributes":{"resource_json":{"enabled":true,"name":"Example-Security-Monitoring","rule_query":"source:cloudtrail","suppression_query":"env:test"}},"id":"abc-123","type":"convert_resource"}}' + headers: + accept: + - application/json + content-type: + - application/json + method: POST + uri: https://api.datadoghq.com/api/v2/security_monitoring/terraform/suppressions/convert + response: + body: + string: '{"data":{"id":"datadog_security_monitoring_suppression|abc-123","type":"format_resource","attributes":{"output":"resource + \"datadog_security_monitoring_suppression\" \"abc-123\" {\n enabled = + true\n name = \"Example-Security-Monitoring\"\n rule_query = + \"source:cloudtrail\"\n suppression_query = \"env:test\"\n}\n","resource_id":"abc-123","type_name":"datadog_security_monitoring_suppression"}}}' + headers: + content-type: + - application/vnd.api+json + status: + code: 200 + message: OK +version: 1 diff --git a/tests/v2/cassettes/test_scenarios/test_export_security_monitoring_resource_to_terraform_returns_ok_response.frozen b/tests/v2/cassettes/test_scenarios/test_export_security_monitoring_resource_to_terraform_returns_ok_response.frozen new file mode 100644 index 0000000000..fb2c871902 --- /dev/null +++ b/tests/v2/cassettes/test_scenarios/test_export_security_monitoring_resource_to_terraform_returns_ok_response.frozen @@ -0,0 +1 @@ +2026-04-10T08:56:17.310Z \ No newline at end of file diff --git a/tests/v2/cassettes/test_scenarios/test_export_security_monitoring_resource_to_terraform_returns_ok_response.yaml b/tests/v2/cassettes/test_scenarios/test_export_security_monitoring_resource_to_terraform_returns_ok_response.yaml new file mode 100644 index 0000000000..f5da151dc5 --- /dev/null +++ b/tests/v2/cassettes/test_scenarios/test_export_security_monitoring_resource_to_terraform_returns_ok_response.yaml @@ -0,0 +1,57 @@ +interactions: +- request: + body: '{"data":{"attributes":{"description":"Test-Export_security_monitoring_resource_to_Terraform_returns_OK_response-1775811377","enabled":true,"name":"suppression + 934620bff161fb60","rule_query":"source:cloudtrail","suppression_query":"env:test","tags":["technique:T1110-brute-force","source:cloudtrail"]},"type":"suppressions"}}' + headers: + accept: + - application/json + content-type: + - application/json + method: POST + uri: https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions + response: + body: + string: '{"data":{"id":"urh-ldl-f7e","type":"suppressions","attributes":{"creation_date":1775811377666,"creator":{"handle":"frog@datadoghq.com","name":"frog"},"data_exclusion_query":"","description":"Test-Export_security_monitoring_resource_to_Terraform_returns_OK_response-1775811377","editable":true,"enabled":true,"name":"suppression + 934620bff161fb60","rule_query":"source:cloudtrail","suppression_query":"env:test","tags":["source:cloudtrail","technique:T1110-brute-force"],"update_date":1775811377666,"updater":{"handle":"frog@datadoghq.com","name":"frog"},"version":1}}}' + headers: + content-type: + - application/vnd.api+json + status: + code: 200 + message: OK +- request: + body: null + headers: + accept: + - application/json + method: GET + uri: https://api.datadoghq.com/api/v2/security_monitoring/terraform/suppressions/urh-ldl-f7e + response: + body: + string: '{"data":{"id":"datadog_security_monitoring_suppression|urh-ldl-f7e","type":"format_resource","attributes":{"output":"resource + \"datadog_security_monitoring_suppression\" \"urh-ldl-f7e\" {\n description = + \"Test-Export_security_monitoring_resource_to_Terraform_returns_OK_response-1775811377\"\n enabled = + true\n name = \"suppression 934620bff161fb60\"\n rule_query = + \"source:cloudtrail\"\n suppression_query = \"env:test\"\n tags = + [\"source:cloudtrail\", \"technique:T1110-brute-force\"]\n}\n","resource_id":"urh-ldl-f7e","type_name":"datadog_security_monitoring_suppression"}}}' + headers: + content-type: + - application/vnd.api+json + status: + code: 200 + message: OK +- request: + body: null + headers: + accept: + - '*/*' + method: DELETE + uri: https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/urh-ldl-f7e + response: + body: + string: '' + headers: {} + status: + code: 204 + message: No Content +version: 1 diff --git a/tests/v2/cassettes/test_scenarios/test_export_security_monitoring_resources_to_terraform_returns_ok_response.frozen b/tests/v2/cassettes/test_scenarios/test_export_security_monitoring_resources_to_terraform_returns_ok_response.frozen new file mode 100644 index 0000000000..2515d91011 --- /dev/null +++ b/tests/v2/cassettes/test_scenarios/test_export_security_monitoring_resources_to_terraform_returns_ok_response.frozen @@ -0,0 +1 @@ +2026-04-10T08:56:18.628Z \ No newline at end of file diff --git a/tests/v2/cassettes/test_scenarios/test_export_security_monitoring_resources_to_terraform_returns_ok_response.yaml b/tests/v2/cassettes/test_scenarios/test_export_security_monitoring_resources_to_terraform_returns_ok_response.yaml new file mode 100644 index 0000000000..4656dcc5e2 --- /dev/null +++ b/tests/v2/cassettes/test_scenarios/test_export_security_monitoring_resources_to_terraform_returns_ok_response.yaml @@ -0,0 +1,54 @@ +interactions: +- request: + body: '{"data":{"attributes":{"description":"Test-Export_security_monitoring_resources_to_Terraform_returns_OK_response-1775811378","enabled":true,"name":"suppression + 281e64d265076a2a","rule_query":"source:cloudtrail","suppression_query":"env:test","tags":["technique:T1110-brute-force","source:cloudtrail"]},"type":"suppressions"}}' + headers: + accept: + - application/json + content-type: + - application/json + method: POST + uri: https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions + response: + body: + string: '{"data":{"id":"vgr-gcw-s7m","type":"suppressions","attributes":{"creation_date":1775811378970,"creator":{"handle":"frog@datadoghq.com","name":"frog"},"data_exclusion_query":"","description":"Test-Export_security_monitoring_resources_to_Terraform_returns_OK_response-1775811378","editable":true,"enabled":true,"name":"suppression + 281e64d265076a2a","rule_query":"source:cloudtrail","suppression_query":"env:test","tags":["source:cloudtrail","technique:T1110-brute-force"],"update_date":1775811378970,"updater":{"handle":"frog@datadoghq.com","name":"frog"},"version":1}}}' + headers: + content-type: + - application/vnd.api+json + status: + code: 200 + message: OK +- request: + body: '{"data":{"attributes":{"resource_ids":["vgr-gcw-s7m"]},"type":"bulk_export_resources"}}' + headers: + accept: + - application/zip, application/json + content-type: + - application/json + method: POST + uri: https://api.datadoghq.com/api/v2/security_monitoring/terraform/suppressions/bulk + response: + body: + string: UEsDBBQACAAIAAAAAAAAAAAAAAAAAAAAAAAaAAAAc3VwcHJlc3Npb25fdmdyLWdjdy1zN20udGZsjj1PMzEQhPv7FSvXr6U4L8lFka6koqBJh5Dl2JvD0p33srsORIj/jo4PEVCmfuaZYRSqHBFMChoS9V4wVs569iOVrMS59F7qNDGKZCoGzKln28dnK+1o4LUBSCiR86SZCnymA7NDUXv7MhHrVef3snglv0PmcCAePaNWLuLv72ZioiJoXduuNs79bzemAcAS9gMm+EkHyhUbgBJGhF/pwFych+XG4fomLderRbsOyzD7uA7ojxX5fFn6+LaNA9WkHPIwkxemr0IHBstpqyg6Axp6+bv/cMX1D4xifCr5WHG7c84t7J6roj0QRzSPzVvzHgAA//9QSwcIw6lzsPYAAACZAQAAUEsBAhQAFAAIAAgAAAAAAMOpc7D2AAAAmQEAABoAAAAAAAAAAAAAAAAAAAAAAHN1cHByZXNzaW9uX3Znci1nY3ctczdtLnRmUEsFBgAAAAABAAEASAAAAD4BAAAAAA== + headers: + content-type: + - application/zip + status: + code: 200 + message: OK +- request: + body: null + headers: + accept: + - '*/*' + method: DELETE + uri: https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/vgr-gcw-s7m + response: + body: + string: '' + headers: {} + status: + code: 204 + message: No Content +version: 1 diff --git a/tests/v2/features/security_monitoring.feature b/tests/v2/features/security_monitoring.feature index d2cfdeaea0..1da592aca2 100644 --- a/tests/v2/features/security_monitoring.feature +++ b/tests/v2/features/security_monitoring.feature @@ -326,6 +326,26 @@ Feature: Security Monitoring Then the response status is 200 OK And the response "terraformContent" is equal to "resource \"datadog_security_monitoring_rule\" \"_{{ unique_hash }}\" {\n\tname = \"_{{ unique_hash }}\"\n\tenabled = true\n\tquery {\n\t\tquery = \"@test:true\"\n\t\tgroup_by_fields = []\n\t\thas_optional_group_by_fields = false\n\t\tdistinct_fields = []\n\t\taggregation = \"count\"\n\t\tname = \"\"\n\t\tdata_source = \"logs\"\n\t}\n\toptions {\n\t\tkeep_alive = 3600\n\t\tmax_signal_duration = 86400\n\t\tdetection_method = \"threshold\"\n\t\tevaluation_window = 900\n\t}\n\tcase {\n\t\tname = \"\"\n\t\tstatus = \"info\"\n\t\tnotifications = []\n\t\tcondition = \"a > 0\"\n\t}\n\tmessage = \"Test rule\"\n\ttags = []\n\thas_extended_title = false\n\ttype = \"log_detection\"\n}\n" + @generated @skip @team:DataDog/k9-cloud-siem + Scenario: Convert security monitoring resource to Terraform returns "Bad Request" response + Given operation "ConvertSecurityMonitoringTerraformResource" enabled + And new "ConvertSecurityMonitoringTerraformResource" request + And request contains "resource_type" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"resource_json": {"enabled": true, "name": "Custom suppression", "rule_query": "type:log_detection source:cloudtrail", "suppression_query": "env:staging status:low"}}, "id": "abc-123", "type": "convert_resource"}} + When the request is sent + Then the response status is 400 Bad Request + + @replay-only @team:DataDog/k9-cloud-siem + Scenario: Convert security monitoring resource to Terraform returns "OK" response + Given operation "ConvertSecurityMonitoringTerraformResource" enabled + And new "ConvertSecurityMonitoringTerraformResource" request + And request contains "resource_type" parameter with value "suppressions" + And body with value {"data": {"type": "convert_resource", "id": "abc-123", "attributes": {"resource_json": {"enabled": true, "name": "Example-Security-Monitoring", "rule_query": "source:cloudtrail", "suppression_query": "env:test"}}}} + When the request is sent + Then the response status is 200 OK + And the response "data.attributes.type_name" is equal to "datadog_security_monitoring_suppression" + And the response "data.attributes.resource_id" is equal to "abc-123" + @team:DataDog/k9-investigation Scenario: Create Jira issue for security finding returns "Created" response Given new "CreateJiraIssues" request @@ -935,6 +955,55 @@ Feature: Security Monitoring When the request is sent Then the response status is 404 Not Found + @generated @skip @team:DataDog/k9-cloud-siem + Scenario: Export security monitoring resource to Terraform returns "Not Found" response + Given operation "ExportSecurityMonitoringTerraformResource" enabled + And new "ExportSecurityMonitoringTerraformResource" request + And request contains "resource_type" parameter from "REPLACE.ME" + And request contains "resource_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 404 Not Found + + @replay-only @team:DataDog/k9-cloud-siem + Scenario: Export security monitoring resource to Terraform returns "OK" response + Given operation "ExportSecurityMonitoringTerraformResource" enabled + And there is a valid "suppression" in the system + And new "ExportSecurityMonitoringTerraformResource" request + And request contains "resource_type" parameter with value "suppressions" + And request contains "resource_id" parameter from "suppression.data.id" + When the request is sent + Then the response status is 200 OK + And the response "data.attributes.type_name" is equal to "datadog_security_monitoring_suppression" + And the response "data.attributes.resource_id" has the same value as "suppression.data.id" + + @generated @skip @team:DataDog/k9-cloud-siem + Scenario: Export security monitoring resources to Terraform returns "Bad Request" response + Given operation "BulkExportSecurityMonitoringTerraformResources" enabled + And new "BulkExportSecurityMonitoringTerraformResources" request + And request contains "resource_type" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"resource_ids": [""]}, "type": "bulk_export_resources"}} + When the request is sent + Then the response status is 400 Bad Request + + @generated @skip @team:DataDog/k9-cloud-siem + Scenario: Export security monitoring resources to Terraform returns "Not Found" response + Given operation "BulkExportSecurityMonitoringTerraformResources" enabled + And new "BulkExportSecurityMonitoringTerraformResources" request + And request contains "resource_type" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"resource_ids": [""]}, "type": "bulk_export_resources"}} + When the request is sent + Then the response status is 404 Not Found + + @replay-only @team:DataDog/k9-cloud-siem + Scenario: Export security monitoring resources to Terraform returns "OK" response + Given operation "BulkExportSecurityMonitoringTerraformResources" enabled + And there is a valid "suppression" in the system + And new "BulkExportSecurityMonitoringTerraformResources" request + And request contains "resource_type" parameter with value "suppressions" + And body with value {"data": {"attributes": {"resource_ids": ["{{ suppression.data.id }}"]}, "type": "bulk_export_resources"}} + When the request is sent + Then the response status is 200 OK + @generated @skip @team:DataDog/k9-cloud-vm Scenario: Get SBOM returns "Bad request: The server cannot process the request due to invalid syntax in the request." response Given new "GetSBOM" request diff --git a/tests/v2/features/undo.json b/tests/v2/features/undo.json index c7ef9624df..f78cd823b2 100644 --- a/tests/v2/features/undo.json +++ b/tests/v2/features/undo.json @@ -5716,6 +5716,24 @@ "type": "safe" } }, + "BulkExportSecurityMonitoringTerraformResources": { + "tag": "Security Monitoring", + "undo": { + "type": "safe" + } + }, + "ConvertSecurityMonitoringTerraformResource": { + "tag": "Security Monitoring", + "undo": { + "type": "safe" + } + }, + "ExportSecurityMonitoringTerraformResource": { + "tag": "Security Monitoring", + "undo": { + "type": "safe" + } + }, "ListScanningGroups": { "tag": "Sensitive Data Scanner", "undo": {