Skip to content

Commit a586ce4

Browse files
author
ci.datadog-api-spec
committed
Regenerate client from commit 16dee31 of spec repo
1 parent 6770461 commit a586ce4

File tree

3 files changed

+27
-0
lines changed

3 files changed

+27
-0
lines changed

.generator/schemas/v2/openapi.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47194,6 +47194,8 @@ components:
4719447194
properties:
4719547195
forgetAfter:
4719647196
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter'
47197+
instantaneousBaseline:
47198+
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsInstantaneousBaseline'
4719747199
learningDuration:
4719847200
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration'
4719947201
learningMethod:
@@ -47219,6 +47221,15 @@ components:
4721947221
- TWO_WEEKS
4722047222
- THREE_WEEKS
4722147223
- FOUR_WEEKS
47224+
SecurityMonitoringRuleNewValueOptionsInstantaneousBaseline:
47225+
description: 'If true, every time Datadog learns a new group-by value, it takes
47226+
old matching values within the learning window and builds the baseline with
47227+
it.
47228+
47229+
Therefore, it attempts to build the baseline swiftly using existing values
47230+
instead of learning them over time.'
47231+
example: false
47232+
type: boolean
4722247233
SecurityMonitoringRuleNewValueOptionsLearningDuration:
4722347234
default: 0
4722447235
description: 'The duration in days during which values are learned, and after

features/v2/security_monitoring.feature

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1797,6 +1797,13 @@ Feature: Security Monitoring
17971797
When the request is sent
17981798
Then the response status is 204 OK
17991799

1800+
@team:DataDog/k9-cloud-security-platform
1801+
Scenario: Validate a detection rule with detection method 'new_value' with enabled feature 'instantaneousBaseline' returns "OK" response
1802+
Given new "ValidateSecurityMonitoringRule" request
1803+
And body with value {"cases":[{"name":"","status":"info","notifications":[]}],"hasExtendedTitle":true,"isEnabled":true,"message":"My security monitoring rule","name":"My security monitoring rule","options":{"evaluationWindow":0,"keepAlive":300,"maxSignalDuration":600,"detectionMethod":"new_value","newValueOptions":{"forgetAfter":7,"instantaneousBaseline":true,"learningDuration":1,"learningThreshold":0,"learningMethod":"duration"}},"queries":[{"query":"source:source_here","groupByFields":["@userIdentity.assumed_role"],"distinctFields":[],"metric":"name","metrics":["name"],"aggregation":"new_value","name":"","dataSource":"logs"}],"tags":["env:prod","team:security"],"type":"log_detection"}
1804+
When the request is sent
1805+
Then the response status is 204 OK
1806+
18001807
@team:DataDog/k9-cloud-security-platform
18011808
Scenario: Validate a detection rule with detection method 'sequence_detection' returns "OK" response
18021809
Given new "ValidateSecurityMonitoringRule" request

services/security_monitoring/src/v2/models/SecurityMonitoringRuleNewValueOptions.ts

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,11 @@ export class SecurityMonitoringRuleNewValueOptions {
1313
* The duration in days after which a learned value is forgotten.
1414
*/
1515
"forgetAfter"?: SecurityMonitoringRuleNewValueOptionsForgetAfter;
16+
/**
17+
* If true, every time Datadog learns a new group-by value, it takes old matching values within the learning window and builds the baseline with it.
18+
* Therefore, it attempts to build the baseline swiftly using existing values instead of learning them over time.
19+
*/
20+
"instantaneousBaseline"?: boolean;
1621
/**
1722
* The duration in days during which values are learned, and after which signals will be generated for values that
1823
* weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned.
@@ -46,6 +51,10 @@ export class SecurityMonitoringRuleNewValueOptions {
4651
type: "SecurityMonitoringRuleNewValueOptionsForgetAfter",
4752
format: "int32",
4853
},
54+
instantaneousBaseline: {
55+
baseName: "instantaneousBaseline",
56+
type: "boolean",
57+
},
4958
learningDuration: {
5059
baseName: "learningDuration",
5160
type: "SecurityMonitoringRuleNewValueOptionsLearningDuration",

0 commit comments

Comments
 (0)