diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml index 3161aa0d71..dd229dc55f 100644 --- a/.generator/schemas/v2/openapi.yaml +++ b/.generator/schemas/v2/openapi.yaml @@ -64574,6 +64574,38 @@ components: type: string x-enum-varnames: - SIGNAL + SecurityMonitoringSignalUpdateAttributes: + description: Attributes for updating the triage state or assignee of a security signal. + properties: + archive_comment: + $ref: "#/components/schemas/SecurityMonitoringSignalArchiveComment" + archive_reason: + $ref: "#/components/schemas/SecurityMonitoringSignalArchiveReason" + assignee: + $ref: "#/components/schemas/SecurityMonitoringTriageUser" + state: + $ref: "#/components/schemas/SecurityMonitoringSignalState" + version: + $ref: "#/components/schemas/SecurityMonitoringSignalVersion" + type: object + SecurityMonitoringSignalUpdateData: + description: Data containing the triage state or assignee update for a security signal. + properties: + attributes: + $ref: "#/components/schemas/SecurityMonitoringSignalUpdateAttributes" + type: + $ref: "#/components/schemas/SecurityMonitoringSignalMetadataType" + required: + - attributes + type: object + SecurityMonitoringSignalUpdateRequest: + description: Request body for updating the triage state or assignee of a security signal. + properties: + data: + $ref: "#/components/schemas/SecurityMonitoringSignalUpdateData" + required: + - data + type: object SecurityMonitoringSignalVersion: description: Version of the updated signal. If server side version is higher, update will be rejected. format: int64 @@ -64727,6 +64759,33 @@ components: - count - events type: object + SecurityMonitoringSignalsBulkUpdateData: + description: Data for updating a single security signal in a bulk update operation. + properties: + attributes: + $ref: "#/components/schemas/SecurityMonitoringSignalUpdateAttributes" + id: + description: The unique ID of the security signal. + example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA + type: string + type: + $ref: "#/components/schemas/SecurityMonitoringSignalType" + required: + - id + - attributes + type: object + SecurityMonitoringSignalsBulkUpdateRequest: + description: Request body for updating multiple attributes of multiple security signals. + properties: + data: + description: An array of signal updates. + items: + $ref: "#/components/schemas/SecurityMonitoringSignalsBulkUpdateData" + maxItems: 199 + type: array + required: + - data + type: object SecurityMonitoringSignalsListResponse: description: "The response object with all security signals matching the request\nand pagination information." properties: @@ -119533,6 +119592,51 @@ paths: operator: OR permissions: - security_monitoring_signals_write + /api/v2/security_monitoring/signals/bulk/update: + patch: + description: |- + Update the triage state or assignee of multiple security signals at once. + The maximum number of signals that can be updated in a single request is 199. + operationId: BulkEditSecurityMonitoringSignals + requestBody: + content: + application/json: + schema: + $ref: "#/components/schemas/SecurityMonitoringSignalsBulkUpdateRequest" + description: Attributes describing the signal updates. + required: true + responses: + "200": + content: + application/json: + schema: + $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageUpdateResponse" + description: OK + "400": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Bad Request + "403": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Forbidden + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: [] + summary: Bulk update security signals + tags: ["Security Monitoring"] + x-codegen-request-body-name: body + "x-permission": + operator: OR + permissions: + - security_monitoring_signals_write /api/v2/security_monitoring/signals/search: post: description: |- @@ -119855,6 +119959,58 @@ paths: permissions: - security_monitoring_rules_read - security_monitoring_signals_read + /api/v2/security_monitoring/signals/{signal_id}/update: + patch: + description: |- + Update the triage state or assignee of a security signal. + operationId: EditSecurityMonitoringSignal + parameters: + - $ref: "#/components/parameters/SignalID" + requestBody: + content: + application/json: + schema: + $ref: "#/components/schemas/SecurityMonitoringSignalUpdateRequest" + description: Attributes describing the signal triage state or assignee update. + required: true + responses: + "200": + content: + application/json: + schema: + $ref: "#/components/schemas/SecurityMonitoringSignalTriageUpdateResponse" + description: OK + "400": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Bad Request + "403": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Forbidden + "404": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Not Found + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: [] + summary: Update security signal triage state or assignee + tags: ["Security Monitoring"] + x-codegen-request-body-name: body + "x-permission": + operator: OR + permissions: + - security_monitoring_signals_write /api/v2/security_monitoring/terraform/{resource_type}/bulk: post: description: |- diff --git a/docs/datadog_api_client.v2.model.rst b/docs/datadog_api_client.v2.model.rst index 79bedfa521..e218c6a5b3 100644 --- a/docs/datadog_api_client.v2.model.rst +++ b/docs/datadog_api_client.v2.model.rst @@ -28697,6 +28697,27 @@ datadog\_api\_client.v2.model.security\_monitoring\_signal\_type module :members: :show-inheritance: +datadog\_api\_client.v2.model.security\_monitoring\_signal\_update\_attributes module +------------------------------------------------------------------------------------- + +.. automodule:: datadog_api_client.v2.model.security_monitoring_signal_update_attributes + :members: + :show-inheritance: + +datadog\_api\_client.v2.model.security\_monitoring\_signal\_update\_data module +------------------------------------------------------------------------------- + +.. automodule:: datadog_api_client.v2.model.security_monitoring_signal_update_data + :members: + :show-inheritance: + +datadog\_api\_client.v2.model.security\_monitoring\_signal\_update\_request module +---------------------------------------------------------------------------------- + +.. automodule:: datadog_api_client.v2.model.security_monitoring_signal_update_request + :members: + :show-inheritance: + datadog\_api\_client.v2.model.security\_monitoring\_signals\_bulk\_assignee\_update\_attributes module ------------------------------------------------------------------------------------------------------ @@ -28760,6 +28781,20 @@ datadog\_api\_client.v2.model.security\_monitoring\_signals\_bulk\_triage\_updat :members: :show-inheritance: +datadog\_api\_client.v2.model.security\_monitoring\_signals\_bulk\_update\_data module +-------------------------------------------------------------------------------------- + +.. automodule:: datadog_api_client.v2.model.security_monitoring_signals_bulk_update_data + :members: + :show-inheritance: + +datadog\_api\_client.v2.model.security\_monitoring\_signals\_bulk\_update\_request module +----------------------------------------------------------------------------------------- + +.. automodule:: datadog_api_client.v2.model.security_monitoring_signals_bulk_update_request + :members: + :show-inheritance: + datadog\_api\_client.v2.model.security\_monitoring\_signals\_list\_response module ---------------------------------------------------------------------------------- diff --git a/examples/v2/security-monitoring/BulkEditSecurityMonitoringSignals.py b/examples/v2/security-monitoring/BulkEditSecurityMonitoringSignals.py new file mode 100644 index 0000000000..d4ff400246 --- /dev/null +++ b/examples/v2/security-monitoring/BulkEditSecurityMonitoringSignals.py @@ -0,0 +1,42 @@ +""" +Bulk update security signals returns "OK" response +""" + +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi +from datadog_api_client.v2.model.security_monitoring_signal_archive_reason import SecurityMonitoringSignalArchiveReason +from datadog_api_client.v2.model.security_monitoring_signal_state import SecurityMonitoringSignalState +from datadog_api_client.v2.model.security_monitoring_signal_type import SecurityMonitoringSignalType +from datadog_api_client.v2.model.security_monitoring_signal_update_attributes import ( + SecurityMonitoringSignalUpdateAttributes, +) +from datadog_api_client.v2.model.security_monitoring_signals_bulk_update_data import ( + SecurityMonitoringSignalsBulkUpdateData, +) +from datadog_api_client.v2.model.security_monitoring_signals_bulk_update_request import ( + SecurityMonitoringSignalsBulkUpdateRequest, +) +from datadog_api_client.v2.model.security_monitoring_triage_user import SecurityMonitoringTriageUser + +body = SecurityMonitoringSignalsBulkUpdateRequest( + data=[ + SecurityMonitoringSignalsBulkUpdateData( + attributes=SecurityMonitoringSignalUpdateAttributes( + archive_reason=SecurityMonitoringSignalArchiveReason.NONE, + assignee=SecurityMonitoringTriageUser( + uuid="773b045d-ccf8-4808-bd3b-955ef6a8c940", + ), + state=SecurityMonitoringSignalState.OPEN, + ), + id="AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA", + type=SecurityMonitoringSignalType.SIGNAL, + ), + ], +) + +configuration = Configuration() +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + response = api_instance.bulk_edit_security_monitoring_signals(body=body) + + print(response) diff --git a/examples/v2/security-monitoring/EditSecurityMonitoringSignal.py b/examples/v2/security-monitoring/EditSecurityMonitoringSignal.py new file mode 100644 index 0000000000..d7e5fefff6 --- /dev/null +++ b/examples/v2/security-monitoring/EditSecurityMonitoringSignal.py @@ -0,0 +1,35 @@ +""" +Update security signal triage state or assignee returns "OK" response +""" + +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi +from datadog_api_client.v2.model.security_monitoring_signal_archive_reason import SecurityMonitoringSignalArchiveReason +from datadog_api_client.v2.model.security_monitoring_signal_metadata_type import SecurityMonitoringSignalMetadataType +from datadog_api_client.v2.model.security_monitoring_signal_state import SecurityMonitoringSignalState +from datadog_api_client.v2.model.security_monitoring_signal_update_attributes import ( + SecurityMonitoringSignalUpdateAttributes, +) +from datadog_api_client.v2.model.security_monitoring_signal_update_data import SecurityMonitoringSignalUpdateData +from datadog_api_client.v2.model.security_monitoring_signal_update_request import SecurityMonitoringSignalUpdateRequest +from datadog_api_client.v2.model.security_monitoring_triage_user import SecurityMonitoringTriageUser + +body = SecurityMonitoringSignalUpdateRequest( + data=SecurityMonitoringSignalUpdateData( + attributes=SecurityMonitoringSignalUpdateAttributes( + archive_reason=SecurityMonitoringSignalArchiveReason.NONE, + assignee=SecurityMonitoringTriageUser( + uuid="773b045d-ccf8-4808-bd3b-955ef6a8c940", + ), + state=SecurityMonitoringSignalState.OPEN, + ), + type=SecurityMonitoringSignalMetadataType.SIGNAL_METADATA, + ), +) + +configuration = Configuration() +with ApiClient(configuration) as api_client: + api_instance = SecurityMonitoringApi(api_client) + response = api_instance.edit_security_monitoring_signal(signal_id="signal_id", body=body) + + print(response) diff --git a/src/datadog_api_client/v2/api/security_monitoring_api.py b/src/datadog_api_client/v2/api/security_monitoring_api.py index beae891b36..fa18b2b9dd 100644 --- a/src/datadog_api_client/v2/api/security_monitoring_api.py +++ b/src/datadog_api_client/v2/api/security_monitoring_api.py @@ -136,6 +136,9 @@ from datadog_api_client.v2.model.security_monitoring_signals_bulk_state_update_request import ( SecurityMonitoringSignalsBulkStateUpdateRequest, ) +from datadog_api_client.v2.model.security_monitoring_signals_bulk_update_request import ( + SecurityMonitoringSignalsBulkUpdateRequest, +) from datadog_api_client.v2.model.security_monitoring_signal_list_request import SecurityMonitoringSignalListRequest from datadog_api_client.v2.model.security_monitoring_signal_response import SecurityMonitoringSignalResponse from datadog_api_client.v2.model.security_monitoring_signal_triage_update_response import ( @@ -153,6 +156,7 @@ from datadog_api_client.v2.model.security_monitoring_signal_state_update_request import ( SecurityMonitoringSignalStateUpdateRequest, ) +from datadog_api_client.v2.model.security_monitoring_signal_update_request import SecurityMonitoringSignalUpdateRequest from datadog_api_client.v2.model.security_monitoring_terraform_resource_type import ( SecurityMonitoringTerraformResourceType, ) @@ -254,6 +258,26 @@ def __init__(self, api_client=None): api_client=api_client, ) + self._bulk_edit_security_monitoring_signals_endpoint = _Endpoint( + settings={ + "response_type": (SecurityMonitoringSignalsBulkTriageUpdateResponse,), + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/signals/bulk/update", + "operation_id": "bulk_edit_security_monitoring_signals", + "http_method": "PATCH", + "version": "v2", + }, + params_map={ + "body": { + "required": True, + "openapi_types": (SecurityMonitoringSignalsBulkUpdateRequest,), + "location": "body", + }, + }, + headers_map={"accept": ["application/json"], "content_type": ["application/json"]}, + api_client=api_client, + ) + self._bulk_edit_security_monitoring_signals_assignee_endpoint = _Endpoint( settings={ "response_type": (SecurityMonitoringSignalsBulkTriageUpdateResponse,), @@ -865,6 +889,32 @@ def __init__(self, api_client=None): api_client=api_client, ) + self._edit_security_monitoring_signal_endpoint = _Endpoint( + settings={ + "response_type": (SecurityMonitoringSignalTriageUpdateResponse,), + "auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"], + "endpoint_path": "/api/v2/security_monitoring/signals/{signal_id}/update", + "operation_id": "edit_security_monitoring_signal", + "http_method": "PATCH", + "version": "v2", + }, + params_map={ + "signal_id": { + "required": True, + "openapi_types": (str,), + "attribute": "signal_id", + "location": "path", + }, + "body": { + "required": True, + "openapi_types": (SecurityMonitoringSignalUpdateRequest,), + "location": "body", + }, + }, + headers_map={"accept": ["application/json"], "content_type": ["application/json"]}, + api_client=api_client, + ) + self._edit_security_monitoring_signal_assignee_endpoint = _Endpoint( settings={ "response_type": (SecurityMonitoringSignalTriageUpdateResponse,), @@ -2995,6 +3045,24 @@ def attach_jira_issue( return self._attach_jira_issue_endpoint.call_with_http_info(**kwargs) + def bulk_edit_security_monitoring_signals( + self, + body: SecurityMonitoringSignalsBulkUpdateRequest, + ) -> SecurityMonitoringSignalsBulkTriageUpdateResponse: + """Bulk update security signals. + + Update the triage state or assignee of multiple security signals at once. + The maximum number of signals that can be updated in a single request is 199. + + :param body: Attributes describing the signal updates. + :type body: SecurityMonitoringSignalsBulkUpdateRequest + :rtype: SecurityMonitoringSignalsBulkTriageUpdateResponse + """ + kwargs: Dict[str, Any] = {} + kwargs["body"] = body + + return self._bulk_edit_security_monitoring_signals_endpoint.call_with_http_info(**kwargs) + def bulk_edit_security_monitoring_signals_assignee( self, body: SecurityMonitoringSignalsBulkAssigneeUpdateRequest, @@ -3519,6 +3587,28 @@ def detach_case( return self._detach_case_endpoint.call_with_http_info(**kwargs) + def edit_security_monitoring_signal( + self, + signal_id: str, + body: SecurityMonitoringSignalUpdateRequest, + ) -> SecurityMonitoringSignalTriageUpdateResponse: + """Update security signal triage state or assignee. + + Update the triage state or assignee of a security signal. + + :param signal_id: The ID of the signal. + :type signal_id: str + :param body: Attributes describing the signal triage state or assignee update. + :type body: SecurityMonitoringSignalUpdateRequest + :rtype: SecurityMonitoringSignalTriageUpdateResponse + """ + kwargs: Dict[str, Any] = {} + kwargs["signal_id"] = signal_id + + kwargs["body"] = body + + return self._edit_security_monitoring_signal_endpoint.call_with_http_info(**kwargs) + def edit_security_monitoring_signal_assignee( self, signal_id: str, diff --git a/src/datadog_api_client/v2/model/security_monitoring_signal_update_attributes.py b/src/datadog_api_client/v2/model/security_monitoring_signal_update_attributes.py new file mode 100644 index 0000000000..e62b9ac0f6 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_signal_update_attributes.py @@ -0,0 +1,86 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Union, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_signal_archive_reason import ( + SecurityMonitoringSignalArchiveReason, + ) + from datadog_api_client.v2.model.security_monitoring_triage_user import SecurityMonitoringTriageUser + from datadog_api_client.v2.model.security_monitoring_signal_state import SecurityMonitoringSignalState + + +class SecurityMonitoringSignalUpdateAttributes(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_signal_archive_reason import ( + SecurityMonitoringSignalArchiveReason, + ) + from datadog_api_client.v2.model.security_monitoring_triage_user import SecurityMonitoringTriageUser + from datadog_api_client.v2.model.security_monitoring_signal_state import SecurityMonitoringSignalState + + return { + "archive_comment": (str,), + "archive_reason": (SecurityMonitoringSignalArchiveReason,), + "assignee": (SecurityMonitoringTriageUser,), + "state": (SecurityMonitoringSignalState,), + "version": (int,), + } + + attribute_map = { + "archive_comment": "archive_comment", + "archive_reason": "archive_reason", + "assignee": "assignee", + "state": "state", + "version": "version", + } + + def __init__( + self_, + archive_comment: Union[str, UnsetType] = unset, + archive_reason: Union[SecurityMonitoringSignalArchiveReason, UnsetType] = unset, + assignee: Union[SecurityMonitoringTriageUser, UnsetType] = unset, + state: Union[SecurityMonitoringSignalState, UnsetType] = unset, + version: Union[int, UnsetType] = unset, + **kwargs, + ): + """ + Attributes for updating the triage state or assignee of a security signal. + + :param archive_comment: Optional comment to display on archived signals. + :type archive_comment: str, optional + + :param archive_reason: Reason a signal is archived. + :type archive_reason: SecurityMonitoringSignalArchiveReason, optional + + :param assignee: Object representing a given user entity. + :type assignee: SecurityMonitoringTriageUser, optional + + :param state: The new triage state of the signal. + :type state: SecurityMonitoringSignalState, optional + + :param version: Version of the updated signal. If server side version is higher, update will be rejected. + :type version: int, optional + """ + if archive_comment is not unset: + kwargs["archive_comment"] = archive_comment + if archive_reason is not unset: + kwargs["archive_reason"] = archive_reason + if assignee is not unset: + kwargs["assignee"] = assignee + if state is not unset: + kwargs["state"] = state + if version is not unset: + kwargs["version"] = version + super().__init__(kwargs) diff --git a/src/datadog_api_client/v2/model/security_monitoring_signal_update_data.py b/src/datadog_api_client/v2/model/security_monitoring_signal_update_data.py new file mode 100644 index 0000000000..9ee949ef2b --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_signal_update_data.py @@ -0,0 +1,64 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Union, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_signal_update_attributes import ( + SecurityMonitoringSignalUpdateAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_signal_metadata_type import ( + SecurityMonitoringSignalMetadataType, + ) + + +class SecurityMonitoringSignalUpdateData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_signal_update_attributes import ( + SecurityMonitoringSignalUpdateAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_signal_metadata_type import ( + SecurityMonitoringSignalMetadataType, + ) + + return { + "attributes": (SecurityMonitoringSignalUpdateAttributes,), + "type": (SecurityMonitoringSignalMetadataType,), + } + + attribute_map = { + "attributes": "attributes", + "type": "type", + } + + def __init__( + self_, + attributes: SecurityMonitoringSignalUpdateAttributes, + type: Union[SecurityMonitoringSignalMetadataType, UnsetType] = unset, + **kwargs, + ): + """ + Data containing the triage state or assignee update for a security signal. + + :param attributes: Attributes for updating the triage state or assignee of a security signal. + :type attributes: SecurityMonitoringSignalUpdateAttributes + + :param type: The type of event. + :type type: SecurityMonitoringSignalMetadataType, optional + """ + if type is not unset: + kwargs["type"] = type + super().__init__(kwargs) + + self_.attributes = attributes diff --git a/src/datadog_api_client/v2/model/security_monitoring_signal_update_request.py b/src/datadog_api_client/v2/model/security_monitoring_signal_update_request.py new file mode 100644 index 0000000000..bef9170ad7 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_signal_update_request.py @@ -0,0 +1,42 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_signal_update_data import SecurityMonitoringSignalUpdateData + + +class SecurityMonitoringSignalUpdateRequest(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_signal_update_data import ( + SecurityMonitoringSignalUpdateData, + ) + + return { + "data": (SecurityMonitoringSignalUpdateData,), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: SecurityMonitoringSignalUpdateData, **kwargs): + """ + Request body for updating the triage state or assignee of a security signal. + + :param data: Data containing the triage state or assignee update for a security signal. + :type data: SecurityMonitoringSignalUpdateData + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/security_monitoring_signals_bulk_update_data.py b/src/datadog_api_client/v2/model/security_monitoring_signals_bulk_update_data.py new file mode 100644 index 0000000000..dc80437413 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_signals_bulk_update_data.py @@ -0,0 +1,67 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import Union, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, + unset, + UnsetType, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_signal_update_attributes import ( + SecurityMonitoringSignalUpdateAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_signal_type import SecurityMonitoringSignalType + + +class SecurityMonitoringSignalsBulkUpdateData(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_signal_update_attributes import ( + SecurityMonitoringSignalUpdateAttributes, + ) + from datadog_api_client.v2.model.security_monitoring_signal_type import SecurityMonitoringSignalType + + return { + "attributes": (SecurityMonitoringSignalUpdateAttributes,), + "id": (str,), + "type": (SecurityMonitoringSignalType,), + } + + attribute_map = { + "attributes": "attributes", + "id": "id", + "type": "type", + } + + def __init__( + self_, + attributes: SecurityMonitoringSignalUpdateAttributes, + id: str, + type: Union[SecurityMonitoringSignalType, UnsetType] = unset, + **kwargs, + ): + """ + Data for updating a single security signal in a bulk update operation. + + :param attributes: Attributes for updating the triage state or assignee of a security signal. + :type attributes: SecurityMonitoringSignalUpdateAttributes + + :param id: The unique ID of the security signal. + :type id: str + + :param type: The type of event. + :type type: SecurityMonitoringSignalType, optional + """ + if type is not unset: + kwargs["type"] = type + super().__init__(kwargs) + + self_.attributes = attributes + self_.id = id diff --git a/src/datadog_api_client/v2/model/security_monitoring_signals_bulk_update_request.py b/src/datadog_api_client/v2/model/security_monitoring_signals_bulk_update_request.py new file mode 100644 index 0000000000..f74a9bf559 --- /dev/null +++ b/src/datadog_api_client/v2/model/security_monitoring_signals_bulk_update_request.py @@ -0,0 +1,50 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import List, TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_monitoring_signals_bulk_update_data import ( + SecurityMonitoringSignalsBulkUpdateData, + ) + + +class SecurityMonitoringSignalsBulkUpdateRequest(ModelNormal): + validations = { + "data": { + "max_items": 199, + }, + } + + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_monitoring_signals_bulk_update_data import ( + SecurityMonitoringSignalsBulkUpdateData, + ) + + return { + "data": ([SecurityMonitoringSignalsBulkUpdateData],), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: List[SecurityMonitoringSignalsBulkUpdateData], **kwargs): + """ + Request body for updating multiple attributes of multiple security signals. + + :param data: An array of signal updates. + :type data: [SecurityMonitoringSignalsBulkUpdateData] + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/models/__init__.py b/src/datadog_api_client/v2/models/__init__.py index 3e65192779..aff201a663 100644 --- a/src/datadog_api_client/v2/models/__init__.py +++ b/src/datadog_api_client/v2/models/__init__.py @@ -5833,6 +5833,11 @@ SecurityMonitoringSignalTriageUpdateResponse, ) from datadog_api_client.v2.model.security_monitoring_signal_type import SecurityMonitoringSignalType +from datadog_api_client.v2.model.security_monitoring_signal_update_attributes import ( + SecurityMonitoringSignalUpdateAttributes, +) +from datadog_api_client.v2.model.security_monitoring_signal_update_data import SecurityMonitoringSignalUpdateData +from datadog_api_client.v2.model.security_monitoring_signal_update_request import SecurityMonitoringSignalUpdateRequest from datadog_api_client.v2.model.security_monitoring_signals_bulk_assignee_update_attributes import ( SecurityMonitoringSignalsBulkAssigneeUpdateAttributes, ) @@ -5860,6 +5865,12 @@ from datadog_api_client.v2.model.security_monitoring_signals_bulk_triage_update_result import ( SecurityMonitoringSignalsBulkTriageUpdateResult, ) +from datadog_api_client.v2.model.security_monitoring_signals_bulk_update_data import ( + SecurityMonitoringSignalsBulkUpdateData, +) +from datadog_api_client.v2.model.security_monitoring_signals_bulk_update_request import ( + SecurityMonitoringSignalsBulkUpdateRequest, +) from datadog_api_client.v2.model.security_monitoring_signals_list_response import SecurityMonitoringSignalsListResponse from datadog_api_client.v2.model.security_monitoring_signals_list_response_links import ( SecurityMonitoringSignalsListResponseLinks, @@ -11385,6 +11396,9 @@ "SecurityMonitoringSignalTriageUpdateData", "SecurityMonitoringSignalTriageUpdateResponse", "SecurityMonitoringSignalType", + "SecurityMonitoringSignalUpdateAttributes", + "SecurityMonitoringSignalUpdateData", + "SecurityMonitoringSignalUpdateRequest", "SecurityMonitoringSignalsBulkAssigneeUpdateAttributes", "SecurityMonitoringSignalsBulkAssigneeUpdateData", "SecurityMonitoringSignalsBulkAssigneeUpdateRequest", @@ -11394,6 +11408,8 @@ "SecurityMonitoringSignalsBulkTriageEventAttributes", "SecurityMonitoringSignalsBulkTriageUpdateResponse", "SecurityMonitoringSignalsBulkTriageUpdateResult", + "SecurityMonitoringSignalsBulkUpdateData", + "SecurityMonitoringSignalsBulkUpdateRequest", "SecurityMonitoringSignalsListResponse", "SecurityMonitoringSignalsListResponseLinks", "SecurityMonitoringSignalsListResponseMeta", diff --git a/tests/v2/features/security_monitoring.feature b/tests/v2/features/security_monitoring.feature index f6c7f39542..9c65c8a95b 100644 --- a/tests/v2/features/security_monitoring.feature +++ b/tests/v2/features/security_monitoring.feature @@ -121,6 +121,20 @@ Feature: Security Monitoring When the request is sent Then the response status is 200 OK + @skip @team:DataDog/k9-cloud-siem + Scenario: Bulk update security signals returns "Bad Request" response + Given new "BulkEditSecurityMonitoringSignals" request + And body with value {"data": [{"attributes": {"archive_reason": "none", "assignee": {"uuid": "773b045d-ccf8-4808-bd3b-955ef6a8c940"}, "state": "open"}, "id": "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA", "type": "signal"}]} + When the request is sent + Then the response status is 400 Bad Request + + @skip @team:DataDog/k9-cloud-siem + Scenario: Bulk update security signals returns "OK" response + Given new "BulkEditSecurityMonitoringSignals" request + And body with value {"data": [{"attributes": {"archive_reason": "none", "assignee": {"uuid": "773b045d-ccf8-4808-bd3b-955ef6a8c940"}, "state": "open"}, "id": "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA", "type": "signal"}]} + When the request is sent + Then the response status is 200 OK + @skip @team:DataDog/k9-cloud-siem Scenario: Bulk update triage assignee of security signals returns "Bad Request" response Given operation "BulkEditSecurityMonitoringSignalsAssignee" enabled @@ -2232,6 +2246,30 @@ Feature: Security Monitoring When the request is sent Then the response status is 201 OK + @skip @team:DataDog/k9-cloud-siem + Scenario: Update security signal triage state or assignee returns "Bad Request" response + Given new "EditSecurityMonitoringSignal" request + And request contains "signal_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"archive_reason": "none", "assignee": {"uuid": "773b045d-ccf8-4808-bd3b-955ef6a8c940"}, "state": "open"}, "type": "signal_metadata"}} + When the request is sent + Then the response status is 400 Bad Request + + @skip @team:DataDog/k9-cloud-siem + Scenario: Update security signal triage state or assignee returns "Not Found" response + Given new "EditSecurityMonitoringSignal" request + And request contains "signal_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"archive_reason": "none", "assignee": {"uuid": "773b045d-ccf8-4808-bd3b-955ef6a8c940"}, "state": "open"}, "type": "signal_metadata"}} + When the request is sent + Then the response status is 404 Not Found + + @skip @team:DataDog/k9-cloud-siem + Scenario: Update security signal triage state or assignee returns "OK" response + Given new "EditSecurityMonitoringSignal" request + And request contains "signal_id" parameter from "REPLACE.ME" + And body with value {"data": {"attributes": {"archive_reason": "none", "assignee": {"uuid": "773b045d-ccf8-4808-bd3b-955ef6a8c940"}, "state": "open"}, "type": "signal_metadata"}} + When the request is sent + Then the response status is 200 OK + @skip-go @skip-java @skip-python @skip-ruby @skip-rust @skip-typescript @skip-validation @team:DataDog/k9-cloud-siem Scenario: Validate a detection rule returns "Bad Request" response Given new "ValidateSecurityMonitoringRule" request diff --git a/tests/v2/features/undo.json b/tests/v2/features/undo.json index 57c73cd7aa..31f26b9109 100644 --- a/tests/v2/features/undo.json +++ b/tests/v2/features/undo.json @@ -5699,6 +5699,12 @@ "type": "idempotent" } }, + "BulkEditSecurityMonitoringSignals": { + "tag": "Security Monitoring", + "undo": { + "type": "idempotent" + } + }, "SearchSecurityMonitoringSignals": { "tag": "Security Monitoring", "undo": { @@ -5741,6 +5747,12 @@ "type": "safe" } }, + "EditSecurityMonitoringSignal": { + "tag": "Security Monitoring", + "undo": { + "type": "idempotent" + } + }, "BulkExportSecurityMonitoringTerraformResources": { "tag": "Security Monitoring", "undo": {