From a2ff9d1e937d453e6f8ae4d94eb5ede2a10f2ce4 Mon Sep 17 00:00:00 2001 From: "ci.datadog-api-spec" Date: Tue, 2 Jun 2026 14:06:19 +0000 Subject: [PATCH] Regenerate client from commit 5b8fcb9 of spec repo --- .generator/schemas/v2/openapi.yaml | 191 +++++++++++++++--- docs/datadog_api_client.v2.model.rst | 7 + .../entity-risk-scores/GetEntityRiskScore.py | 16 ++ src/datadog_api_client/configuration.py | 1 + .../v2/api/entity_risk_scores_api.py | 41 ++++ .../v2/model/security_entity_risk_score.py | 4 +- .../security_entity_risk_score_attributes.py | 58 ++++-- .../security_entity_risk_score_response.py | 40 ++++ .../model/security_entity_risk_score_type.py | 8 +- src/datadog_api_client/v2/models/__init__.py | 2 + tests/v2/features/entity_risk_scores.feature | 30 ++- tests/v2/features/undo.json | 6 + 12 files changed, 343 insertions(+), 61 deletions(-) create mode 100644 examples/v2/entity-risk-scores/GetEntityRiskScore.py create mode 100644 src/datadog_api_client/v2/model/security_entity_risk_score_response.py diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml index 9713873b65..a02697caa7 100644 --- a/.generator/schemas/v2/openapi.yaml +++ b/.generator/schemas/v2/openapi.yaml @@ -76116,73 +76116,90 @@ components: - attributes type: object SecurityEntityRiskScoreAttributes: - description: Attributes of an entity risk score + description: Attributes of an entity risk score. properties: + accountIds: + description: Cloud account IDs associated with the entity. + example: ["222233334444", "3333333555555"] + items: + description: A cloud account ID. + type: string + type: array configRisks: $ref: "#/components/schemas/SecurityEntityConfigRisks" - entityID: - description: Unique identifier for the entity - example: "arn:aws:iam::123456789012:user/john.doe" - type: string entityMetadata: $ref: "#/components/schemas/SecurityEntityMetadata" entityName: - description: Human-readable name of the entity + description: Human-readable name of the entity. example: "john.doe" type: string entityProviders: - description: Cloud providers associated with the entity - example: ["aws"] + description: Cloud providers associated with the entity. + example: ["AWS"] items: description: A cloud provider name. type: string type: array entityRoles: - description: Roles associated with the entity - example: ["Admin", "Developer"] + description: Roles associated with the entity. + example: [] items: description: A role assigned to the entity. type: string type: array + entitySubTypes: + description: Sub-types associated with the entity. + example: ["Root"] + items: + description: An entity sub-type label. + type: string + type: array entityType: - description: Type of the entity (e.g., aws_iam_user, aws_ec2_instance) + description: Type of the entity (for example, aws_iam_user, aws_ec2_instance). example: "aws_iam_user" type: string + entityTypes: + description: All types associated with the entity. + example: ["Root", "User Name"] + items: + description: An entity type label. + type: string + type: array firstDetected: - description: Timestamp when the entity was first detected (Unix milliseconds) - example: 1704067200000 + description: Timestamp when the entity was first detected (Unix milliseconds). + example: 1778876604661 format: int64 type: integer lastActivityTitle: - description: Title of the most recent signal detected for this entity + description: Title of the most recent signal detected for this entity. example: "Suspicious API call detected" type: string lastDetected: - description: Timestamp when the entity was last detected (Unix milliseconds) - example: 1705276800000 + description: Timestamp when the entity was last detected (Unix milliseconds). + example: 1780064607093 format: int64 type: integer riskScore: - description: Current risk score for the entity + description: Current risk score for the entity. example: 85 format: int64 type: integer riskScoreEvolution: - description: Change in risk score compared to previous period + description: Change in risk score compared to previous period. example: 12 format: int64 type: integer severity: $ref: "#/components/schemas/SecurityEntityRiskScoreAttributesSeverity" signalsDetected: - description: Number of security signals detected for this entity + description: Number of security signals detected for this entity. example: 15 format: int64 type: integer required: - - entityID - - entityType - entityProviders + - entitySubTypes + - accountIds - riskScore - riskScoreEvolution - severity @@ -76209,11 +76226,19 @@ components: - MEDIUM - LOW - INFO + SecurityEntityRiskScoreResponse: + description: Response containing a single entity risk score + properties: + data: + $ref: "#/components/schemas/SecurityEntityRiskScore" + required: + - data + type: object SecurityEntityRiskScoreType: - description: Resource type + description: Resource type. enum: - - security_entity_risk_score - example: security_entity_risk_score + - SecurityEntityRiskScore + example: SecurityEntityRiskScore type: string x-enum-varnames: - SECURITY_ENTITY_RISK_SCORE @@ -153097,6 +153122,8 @@ paths: value: data: - attributes: + accountIds: + - "123456789012" configRisks: hasIdentityRisk: false hasMisconfiguration: true @@ -153104,21 +153131,25 @@ paths: isPrivileged: false isProduction: true isPubliclyAccessible: true - entityID: "arn:aws:iam::123456789012:user/test-user" entityMetadata: environments: - production - mitreTactics: [] - mitreTechniques: [] + mitreTactics: + - ta0006-credential-access + mitreTechniques: + - t1078-valid-accounts services: - api-gateway sources: - cloudtrail entityName: test-user entityProviders: - - aws + - AWS entityRoles: [] - entityType: aws_iam_user + entitySubTypes: + - "IAM User" + entityTypes: + - "IAMUser" firstDetected: 1704067200000 lastActivityTitle: "Suspicious API call detected" lastDetected: 1705276800000 @@ -153127,10 +153158,12 @@ paths: severity: critical signalsDetected: 15 id: "arn:aws:iam::123456789012:user/test-user" - type: security_entity_risk_score + type: SecurityEntityRiskScore meta: - page: - total: 1 + pageNumber: 1 + pageSize: 10 + queryId: "abc123def456" + totalRowCount: 1 schema: $ref: "#/components/schemas/SecurityEntityRiskScoresResponse" description: OK @@ -153160,6 +153193,100 @@ paths: x-unstable: |- **Note**: This endpoint is in public beta and it's subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). + /api/v2/security-entities/risk-scores/{entity_id}: + get: + description: |- + Get the risk score for a specific entity by its ID. Returns security risk assessment including risk score, severity, detected signals, misconfigurations, and identity risks. + operationId: GetEntityRiskScore + parameters: + - description: The URL-encoded unique identifier for the entity. + in: path + name: entity_id + required: true + schema: + example: "arn:aws:iam::123456789012:user/john.doe" + type: string + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + attributes: + accountIds: + - "123456789012" + configRisks: + hasIdentityRisk: false + hasMisconfiguration: true + hasPrivilegedRole: false + isPrivileged: false + isProduction: true + isPubliclyAccessible: true + entityMetadata: + environments: + - production + mitreTactics: + - ta0006-credential-access + mitreTechniques: + - t1078-valid-accounts + services: + - api-gateway + sources: + - cloudtrail + entityName: "test-user" + entityProviders: + - AWS + entityRoles: [] + entitySubTypes: + - "IAM User" + entityTypes: + - "IAMUser" + firstDetected: 1704067200000 + lastActivityTitle: "Suspicious API call detected" + lastDetected: 1705276800000 + riskScore: 85 + riskScoreEvolution: 12 + severity: critical + signalsDetected: 15 + id: "arn:aws:iam::123456789012:user/test-user" + type: SecurityEntityRiskScore + schema: + $ref: "#/components/schemas/SecurityEntityRiskScoreResponse" + description: OK + "400": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Bad Request + "401": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Unauthorized + "403": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Forbidden + "404": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Not Found + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + summary: Get Entity Risk Score + tags: + - Entity Risk Scores + x-unstable: |- + **Note**: This endpoint is in public beta and it's subject to change. + If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/cloud_workload/policy/download: get: description: |- diff --git a/docs/datadog_api_client.v2.model.rst b/docs/datadog_api_client.v2.model.rst index c3d453760c..ac0aa4200a 100644 --- a/docs/datadog_api_client.v2.model.rst +++ b/docs/datadog_api_client.v2.model.rst @@ -32946,6 +32946,13 @@ datadog\_api\_client.v2.model.security\_entity\_risk\_score\_attributes\_severit :members: :show-inheritance: +datadog\_api\_client.v2.model.security\_entity\_risk\_score\_response module +---------------------------------------------------------------------------- + +.. automodule:: datadog_api_client.v2.model.security_entity_risk_score_response + :members: + :show-inheritance: + datadog\_api\_client.v2.model.security\_entity\_risk\_score\_type module ------------------------------------------------------------------------ diff --git a/examples/v2/entity-risk-scores/GetEntityRiskScore.py b/examples/v2/entity-risk-scores/GetEntityRiskScore.py new file mode 100644 index 0000000000..20badd0bb1 --- /dev/null +++ b/examples/v2/entity-risk-scores/GetEntityRiskScore.py @@ -0,0 +1,16 @@ +""" +Get Entity Risk Score returns "OK" response +""" + +from datadog_api_client import ApiClient, Configuration +from datadog_api_client.v2.api.entity_risk_scores_api import EntityRiskScoresApi + +configuration = Configuration() +configuration.unstable_operations["get_entity_risk_score"] = True +with ApiClient(configuration) as api_client: + api_instance = EntityRiskScoresApi(api_client) + response = api_instance.get_entity_risk_score( + entity_id="arn:aws:iam::123456789012:user/john.doe", + ) + + print(response) diff --git a/src/datadog_api_client/configuration.py b/src/datadog_api_client/configuration.py index 2d13844d99..b7f1c64484 100644 --- a/src/datadog_api_client/configuration.py +++ b/src/datadog_api_client/configuration.py @@ -629,6 +629,7 @@ def __init__( "v2.query_aggregated_signals_problems": False, "v2.query_aggregated_waterfall": False, "v2.create_scorecard_outcomes_batch": False, + "v2.get_entity_risk_score": False, "v2.list_entity_risk_scores": False, "v2.create_incident_service": False, "v2.delete_incident_service": False, diff --git a/src/datadog_api_client/v2/api/entity_risk_scores_api.py b/src/datadog_api_client/v2/api/entity_risk_scores_api.py index 923351fa2c..325e55d9fd 100644 --- a/src/datadog_api_client/v2/api/entity_risk_scores_api.py +++ b/src/datadog_api_client/v2/api/entity_risk_scores_api.py @@ -12,6 +12,7 @@ unset, ) from datadog_api_client.v2.model.security_entity_risk_scores_response import SecurityEntityRiskScoresResponse +from datadog_api_client.v2.model.security_entity_risk_score_response import SecurityEntityRiskScoreResponse class EntityRiskScoresApi: @@ -24,6 +25,29 @@ def __init__(self, api_client=None): api_client = ApiClient(Configuration()) self.api_client = api_client + self._get_entity_risk_score_endpoint = _Endpoint( + settings={ + "response_type": (SecurityEntityRiskScoreResponse,), + "auth": ["apiKeyAuth", "appKeyAuth"], + "endpoint_path": "/api/v2/security-entities/risk-scores/{entity_id}", + "operation_id": "get_entity_risk_score", + "http_method": "GET", + "version": "v2", + }, + params_map={ + "entity_id": { + "required": True, + "openapi_types": (str,), + "attribute": "entity_id", + "location": "path", + }, + }, + headers_map={ + "accept": ["application/json"], + }, + api_client=api_client, + ) + self._list_entity_risk_scores_endpoint = _Endpoint( settings={ "response_type": (SecurityEntityRiskScoresResponse,), @@ -82,6 +106,23 @@ def __init__(self, api_client=None): api_client=api_client, ) + def get_entity_risk_score( + self, + entity_id: str, + ) -> SecurityEntityRiskScoreResponse: + """Get Entity Risk Score. + + Get the risk score for a specific entity by its ID. Returns security risk assessment including risk score, severity, detected signals, misconfigurations, and identity risks. + + :param entity_id: The URL-encoded unique identifier for the entity. + :type entity_id: str + :rtype: SecurityEntityRiskScoreResponse + """ + kwargs: Dict[str, Any] = {} + kwargs["entity_id"] = entity_id + + return self._get_entity_risk_score_endpoint.call_with_http_info(**kwargs) + def list_entity_risk_scores( self, *, diff --git a/src/datadog_api_client/v2/model/security_entity_risk_score.py b/src/datadog_api_client/v2/model/security_entity_risk_score.py index 40f73eb6fc..3175c3a6ea 100644 --- a/src/datadog_api_client/v2/model/security_entity_risk_score.py +++ b/src/datadog_api_client/v2/model/security_entity_risk_score.py @@ -40,13 +40,13 @@ def __init__( """ An entity risk score containing security risk assessment information - :param attributes: Attributes of an entity risk score + :param attributes: Attributes of an entity risk score. :type attributes: SecurityEntityRiskScoreAttributes :param id: Unique identifier for the entity :type id: str - :param type: Resource type + :param type: Resource type. :type type: SecurityEntityRiskScoreType """ super().__init__(kwargs) diff --git a/src/datadog_api_client/v2/model/security_entity_risk_score_attributes.py b/src/datadog_api_client/v2/model/security_entity_risk_score_attributes.py index 92f86d86c4..1f6f925bcd 100644 --- a/src/datadog_api_client/v2/model/security_entity_risk_score_attributes.py +++ b/src/datadog_api_client/v2/model/security_entity_risk_score_attributes.py @@ -31,13 +31,15 @@ def openapi_types(_): ) return { + "account_ids": ([str],), "config_risks": (SecurityEntityConfigRisks,), - "entity_id": (str,), "entity_metadata": (SecurityEntityMetadata,), "entity_name": (str,), "entity_providers": ([str],), "entity_roles": ([str],), + "entity_sub_types": ([str],), "entity_type": (str,), + "entity_types": ([str],), "first_detected": (int,), "last_activity_title": (str,), "last_detected": (int,), @@ -48,13 +50,15 @@ def openapi_types(_): } attribute_map = { + "account_ids": "accountIds", "config_risks": "configRisks", - "entity_id": "entityID", "entity_metadata": "entityMetadata", "entity_name": "entityName", "entity_providers": "entityProviders", "entity_roles": "entityRoles", + "entity_sub_types": "entitySubTypes", "entity_type": "entityType", + "entity_types": "entityTypes", "first_detected": "firstDetected", "last_activity_title": "lastActivityTitle", "last_detected": "lastDetected", @@ -66,11 +70,11 @@ def openapi_types(_): def __init__( self_, + account_ids: List[str], config_risks: SecurityEntityConfigRisks, - entity_id: str, entity_metadata: SecurityEntityMetadata, entity_providers: List[str], - entity_type: str, + entity_sub_types: List[str], first_detected: int, last_activity_title: str, last_detected: int, @@ -80,64 +84,76 @@ def __init__( signals_detected: int, entity_name: Union[str, UnsetType] = unset, entity_roles: Union[List[str], UnsetType] = unset, + entity_type: Union[str, UnsetType] = unset, + entity_types: Union[List[str], UnsetType] = unset, **kwargs, ): """ - Attributes of an entity risk score + Attributes of an entity risk score. + + :param account_ids: Cloud account IDs associated with the entity. + :type account_ids: [str] :param config_risks: Configuration risks associated with the entity :type config_risks: SecurityEntityConfigRisks - :param entity_id: Unique identifier for the entity - :type entity_id: str - :param entity_metadata: Metadata about the entity from cloud providers :type entity_metadata: SecurityEntityMetadata - :param entity_name: Human-readable name of the entity + :param entity_name: Human-readable name of the entity. :type entity_name: str, optional - :param entity_providers: Cloud providers associated with the entity + :param entity_providers: Cloud providers associated with the entity. :type entity_providers: [str] - :param entity_roles: Roles associated with the entity + :param entity_roles: Roles associated with the entity. :type entity_roles: [str], optional - :param entity_type: Type of the entity (e.g., aws_iam_user, aws_ec2_instance) - :type entity_type: str + :param entity_sub_types: Sub-types associated with the entity. + :type entity_sub_types: [str] + + :param entity_type: Type of the entity (for example, aws_iam_user, aws_ec2_instance). + :type entity_type: str, optional + + :param entity_types: All types associated with the entity. + :type entity_types: [str], optional - :param first_detected: Timestamp when the entity was first detected (Unix milliseconds) + :param first_detected: Timestamp when the entity was first detected (Unix milliseconds). :type first_detected: int - :param last_activity_title: Title of the most recent signal detected for this entity + :param last_activity_title: Title of the most recent signal detected for this entity. :type last_activity_title: str - :param last_detected: Timestamp when the entity was last detected (Unix milliseconds) + :param last_detected: Timestamp when the entity was last detected (Unix milliseconds). :type last_detected: int - :param risk_score: Current risk score for the entity + :param risk_score: Current risk score for the entity. :type risk_score: int - :param risk_score_evolution: Change in risk score compared to previous period + :param risk_score_evolution: Change in risk score compared to previous period. :type risk_score_evolution: int :param severity: Severity level based on risk score :type severity: SecurityEntityRiskScoreAttributesSeverity - :param signals_detected: Number of security signals detected for this entity + :param signals_detected: Number of security signals detected for this entity. :type signals_detected: int """ if entity_name is not unset: kwargs["entity_name"] = entity_name if entity_roles is not unset: kwargs["entity_roles"] = entity_roles + if entity_type is not unset: + kwargs["entity_type"] = entity_type + if entity_types is not unset: + kwargs["entity_types"] = entity_types super().__init__(kwargs) + self_.account_ids = account_ids self_.config_risks = config_risks - self_.entity_id = entity_id self_.entity_metadata = entity_metadata self_.entity_providers = entity_providers - self_.entity_type = entity_type + self_.entity_sub_types = entity_sub_types self_.first_detected = first_detected self_.last_activity_title = last_activity_title self_.last_detected = last_detected diff --git a/src/datadog_api_client/v2/model/security_entity_risk_score_response.py b/src/datadog_api_client/v2/model/security_entity_risk_score_response.py new file mode 100644 index 0000000000..76f95856ff --- /dev/null +++ b/src/datadog_api_client/v2/model/security_entity_risk_score_response.py @@ -0,0 +1,40 @@ +# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. +# This product includes software developed at Datadog (https://www.datadoghq.com/). +# Copyright 2019-Present Datadog, Inc. +from __future__ import annotations + +from typing import TYPE_CHECKING + +from datadog_api_client.model_utils import ( + ModelNormal, + cached_property, +) + + +if TYPE_CHECKING: + from datadog_api_client.v2.model.security_entity_risk_score import SecurityEntityRiskScore + + +class SecurityEntityRiskScoreResponse(ModelNormal): + @cached_property + def openapi_types(_): + from datadog_api_client.v2.model.security_entity_risk_score import SecurityEntityRiskScore + + return { + "data": (SecurityEntityRiskScore,), + } + + attribute_map = { + "data": "data", + } + + def __init__(self_, data: SecurityEntityRiskScore, **kwargs): + """ + Response containing a single entity risk score + + :param data: An entity risk score containing security risk assessment information + :type data: SecurityEntityRiskScore + """ + super().__init__(kwargs) + + self_.data = data diff --git a/src/datadog_api_client/v2/model/security_entity_risk_score_type.py b/src/datadog_api_client/v2/model/security_entity_risk_score_type.py index 34de3abd84..f520d6f28a 100644 --- a/src/datadog_api_client/v2/model/security_entity_risk_score_type.py +++ b/src/datadog_api_client/v2/model/security_entity_risk_score_type.py @@ -14,14 +14,14 @@ class SecurityEntityRiskScoreType(ModelSimple): """ - Resource type + Resource type. - :param value: If omitted defaults to "security_entity_risk_score". Must be one of ["security_entity_risk_score"]. + :param value: If omitted defaults to "SecurityEntityRiskScore". Must be one of ["SecurityEntityRiskScore"]. :type value: str """ allowed_values = { - "security_entity_risk_score", + "SecurityEntityRiskScore", } SECURITY_ENTITY_RISK_SCORE: ClassVar["SecurityEntityRiskScoreType"] @@ -32,4 +32,4 @@ def openapi_types(_): } -SecurityEntityRiskScoreType.SECURITY_ENTITY_RISK_SCORE = SecurityEntityRiskScoreType("security_entity_risk_score") +SecurityEntityRiskScoreType.SECURITY_ENTITY_RISK_SCORE = SecurityEntityRiskScoreType("SecurityEntityRiskScore") diff --git a/src/datadog_api_client/v2/models/__init__.py b/src/datadog_api_client/v2/models/__init__.py index 1d27d4cd84..9a3020c70d 100644 --- a/src/datadog_api_client/v2/models/__init__.py +++ b/src/datadog_api_client/v2/models/__init__.py @@ -6568,6 +6568,7 @@ from datadog_api_client.v2.model.security_entity_risk_score_attributes_severity import ( SecurityEntityRiskScoreAttributesSeverity, ) +from datadog_api_client.v2.model.security_entity_risk_score_response import SecurityEntityRiskScoreResponse from datadog_api_client.v2.model.security_entity_risk_score_type import SecurityEntityRiskScoreType from datadog_api_client.v2.model.security_entity_risk_scores_meta import SecurityEntityRiskScoresMeta from datadog_api_client.v2.model.security_entity_risk_scores_response import SecurityEntityRiskScoresResponse @@ -13429,6 +13430,7 @@ "SecurityEntityRiskScore", "SecurityEntityRiskScoreAttributes", "SecurityEntityRiskScoreAttributesSeverity", + "SecurityEntityRiskScoreResponse", "SecurityEntityRiskScoreType", "SecurityEntityRiskScoresMeta", "SecurityEntityRiskScoresResponse", diff --git a/tests/v2/features/entity_risk_scores.feature b/tests/v2/features/entity_risk_scores.feature index f6e28ae740..be283af2fb 100644 --- a/tests/v2/features/entity_risk_scores.feature +++ b/tests/v2/features/entity_risk_scores.feature @@ -6,15 +6,41 @@ Feature: Entity Risk Scores Given a valid "apiKeyAuth" key in the system And a valid "appKeyAuth" key in the system And an instance of "EntityRiskScores" API - And operation "ListEntityRiskScores" enabled - And new "ListEntityRiskScores" request + + @generated @skip @team:DataDog/cloud-siem + Scenario: Get Entity Risk Score returns "Bad Request" response + Given operation "GetEntityRiskScore" enabled + And new "GetEntityRiskScore" request + And request contains "entity_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 400 Bad Request + + @generated @skip @team:DataDog/cloud-siem + Scenario: Get Entity Risk Score returns "Not Found" response + Given operation "GetEntityRiskScore" enabled + And new "GetEntityRiskScore" request + And request contains "entity_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 404 Not Found + + @generated @skip @team:DataDog/cloud-siem + Scenario: Get Entity Risk Score returns "OK" response + Given operation "GetEntityRiskScore" enabled + And new "GetEntityRiskScore" request + And request contains "entity_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 200 OK @generated @skip @team:DataDog/cloud-siem Scenario: List Entity Risk Scores returns "Bad Request" response + Given operation "ListEntityRiskScores" enabled + And new "ListEntityRiskScores" request When the request is sent Then the response status is 400 Bad Request @generated @skip @team:DataDog/cloud-siem Scenario: List Entity Risk Scores returns "OK" response + Given operation "ListEntityRiskScores" enabled + And new "ListEntityRiskScores" request When the request is sent Then the response status is 200 OK diff --git a/tests/v2/features/undo.json b/tests/v2/features/undo.json index 8e00370969..07db45886a 100644 --- a/tests/v2/features/undo.json +++ b/tests/v2/features/undo.json @@ -6396,6 +6396,12 @@ "type": "safe" } }, + "GetEntityRiskScore": { + "tag": "Entity Risk Scores", + "undo": { + "type": "safe" + } + }, "DownloadCloudWorkloadPolicyFile": { "tag": "CSM Threats", "undo": {