Skip to content

Commit 5246874

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Cloud SIEM - Add instantaneousBaseline feature parameter. (#3291)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent 496dbe6 commit 5246874

6 files changed

Lines changed: 171 additions & 1 deletion

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47596,6 +47596,8 @@ components:
4759647596
properties:
4759747597
forgetAfter:
4759847598
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter'
47599+
instantaneousBaseline:
47600+
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsInstantaneousBaseline'
4759947601
learningDuration:
4760047602
$ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration'
4760147603
learningMethod:
@@ -47621,6 +47623,13 @@ components:
4762147623
- TWO_WEEKS
4762247624
- THREE_WEEKS
4762347625
- FOUR_WEEKS
47626+
SecurityMonitoringRuleNewValueOptionsInstantaneousBaseline:
47627+
description: When set to true, Datadog uses previous values that fall within
47628+
the defined learning window to construct the baseline, enabling the system
47629+
to establish an accurate baseline more rapidly rather than relying solely
47630+
on gradual learning over time.
47631+
example: false
47632+
type: boolean
4762447633
SecurityMonitoringRuleNewValueOptionsLearningDuration:
4762547634
default: 0
4762647635
description: 'The duration in days during which values are learned, and after

‎examples/v2/security-monitoring/ValidateSecurityMonitoringRule_2609327779.java‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
// Validate a detection rule with detection method 'new_value' with enabled feature
2+
// 'instantaneousBaseline' returns "OK"
3+
// response
4+
5+
import com.datadog.api.client.ApiClient;
6+
import com.datadog.api.client.ApiException;
7+
import com.datadog.api.client.v2.api.SecurityMonitoringApi;
8+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleCaseCreate;
9+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleDetectionMethod;
10+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleEvaluationWindow;
11+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleKeepAlive;
12+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleMaxSignalDuration;
13+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleNewValueOptions;
14+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleNewValueOptionsForgetAfter;
15+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleNewValueOptionsLearningDuration;
16+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleNewValueOptionsLearningMethod;
17+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleNewValueOptionsLearningThreshold;
18+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleOptions;
19+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleQueryAggregation;
20+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleSeverity;
21+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleTypeCreate;
22+
import com.datadog.api.client.v2.model.SecurityMonitoringRuleValidatePayload;
23+
import com.datadog.api.client.v2.model.SecurityMonitoringStandardDataSource;
24+
import com.datadog.api.client.v2.model.SecurityMonitoringStandardRulePayload;
25+
import com.datadog.api.client.v2.model.SecurityMonitoringStandardRuleQuery;
26+
import java.util.Arrays;
27+
import java.util.Collections;
28+
29+
public class Example {
30+
public static void main(String[] args) {
31+
ApiClient defaultClient = ApiClient.getDefaultApiClient();
32+
SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient);
33+
34+
SecurityMonitoringRuleValidatePayload body =
35+
new SecurityMonitoringRuleValidatePayload(
36+
new SecurityMonitoringStandardRulePayload()
37+
.cases(
38+
Collections.singletonList(
39+
new SecurityMonitoringRuleCaseCreate()
40+
.name("")
41+
.status(SecurityMonitoringRuleSeverity.INFO)))
42+
.hasExtendedTitle(true)
43+
.isEnabled(true)
44+
.message("My security monitoring rule")
45+
.name("My security monitoring rule")
46+
.options(
47+
new SecurityMonitoringRuleOptions()
48+
.evaluationWindow(SecurityMonitoringRuleEvaluationWindow.ZERO_MINUTES)
49+
.keepAlive(SecurityMonitoringRuleKeepAlive.FIVE_MINUTES)
50+
.maxSignalDuration(SecurityMonitoringRuleMaxSignalDuration.TEN_MINUTES)
51+
.detectionMethod(SecurityMonitoringRuleDetectionMethod.NEW_VALUE)
52+
.newValueOptions(
53+
new SecurityMonitoringRuleNewValueOptions()
54+
.forgetAfter(
55+
SecurityMonitoringRuleNewValueOptionsForgetAfter.ONE_WEEK)
56+
.instantaneousBaseline(true)
57+
.learningDuration(
58+
SecurityMonitoringRuleNewValueOptionsLearningDuration.ONE_DAY)
59+
.learningThreshold(
60+
SecurityMonitoringRuleNewValueOptionsLearningThreshold
61+
.ZERO_OCCURRENCES)
62+
.learningMethod(
63+
SecurityMonitoringRuleNewValueOptionsLearningMethod.DURATION)))
64+
.queries(
65+
Collections.singletonList(
66+
new SecurityMonitoringStandardRuleQuery()
67+
.query("source:source_here")
68+
.groupByFields(Collections.singletonList("@userIdentity.assumed_role"))
69+
.metric("name")
70+
.metrics(Collections.singletonList("name"))
71+
.aggregation(SecurityMonitoringRuleQueryAggregation.NEW_VALUE)
72+
.name("")
73+
.dataSource(SecurityMonitoringStandardDataSource.LOGS)))
74+
.tags(Arrays.asList("env:prod", "team:security"))
75+
.type(SecurityMonitoringRuleTypeCreate.LOG_DETECTION));
76+
77+
try {
78+
apiInstance.validateSecurityMonitoringRule(body);
79+
} catch (ApiException e) {
80+
System.err.println(
81+
"Exception when calling SecurityMonitoringApi#validateSecurityMonitoringRule");
82+
System.err.println("Status code: " + e.getCode());
83+
System.err.println("Reason: " + e.getResponseBody());
84+
System.err.println("Response headers: " + e.getResponseHeaders());
85+
e.printStackTrace();
86+
}
87+
}
88+
}

‎src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleNewValueOptions.java‎

Lines changed: 39 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
/** Options on new value detection method. */
2020
@JsonPropertyOrder({
2121
SecurityMonitoringRuleNewValueOptions.JSON_PROPERTY_FORGET_AFTER,
22+
SecurityMonitoringRuleNewValueOptions.JSON_PROPERTY_INSTANTANEOUS_BASELINE,
2223
SecurityMonitoringRuleNewValueOptions.JSON_PROPERTY_LEARNING_DURATION,
2324
SecurityMonitoringRuleNewValueOptions.JSON_PROPERTY_LEARNING_METHOD,
2425
SecurityMonitoringRuleNewValueOptions.JSON_PROPERTY_LEARNING_THRESHOLD
@@ -30,6 +31,9 @@ public class SecurityMonitoringRuleNewValueOptions {
3031
public static final String JSON_PROPERTY_FORGET_AFTER = "forgetAfter";
3132
private SecurityMonitoringRuleNewValueOptionsForgetAfter forgetAfter;
3233

34+
public static final String JSON_PROPERTY_INSTANTANEOUS_BASELINE = "instantaneousBaseline";
35+
private Boolean instantaneousBaseline;
36+
3337
public static final String JSON_PROPERTY_LEARNING_DURATION = "learningDuration";
3438
private SecurityMonitoringRuleNewValueOptionsLearningDuration learningDuration =
3539
SecurityMonitoringRuleNewValueOptionsLearningDuration.ZERO_DAYS;
@@ -68,6 +72,30 @@ public void setForgetAfter(SecurityMonitoringRuleNewValueOptionsForgetAfter forg
6872
this.forgetAfter = forgetAfter;
6973
}
7074

75+
public SecurityMonitoringRuleNewValueOptions instantaneousBaseline(
76+
Boolean instantaneousBaseline) {
77+
this.instantaneousBaseline = instantaneousBaseline;
78+
return this;
79+
}
80+
81+
/**
82+
* When set to true, Datadog uses previous values that fall within the defined learning window to
83+
* construct the baseline, enabling the system to establish an accurate baseline more rapidly
84+
* rather than relying solely on gradual learning over time.
85+
*
86+
* @return instantaneousBaseline
87+
*/
88+
@jakarta.annotation.Nullable
89+
@JsonProperty(JSON_PROPERTY_INSTANTANEOUS_BASELINE)
90+
@JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
91+
public Boolean getInstantaneousBaseline() {
92+
return instantaneousBaseline;
93+
}
94+
95+
public void setInstantaneousBaseline(Boolean instantaneousBaseline) {
96+
this.instantaneousBaseline = instantaneousBaseline;
97+
}
98+
7199
public SecurityMonitoringRuleNewValueOptions learningDuration(
72100
SecurityMonitoringRuleNewValueOptionsLearningDuration learningDuration) {
73101
this.learningDuration = learningDuration;
@@ -210,6 +238,8 @@ public boolean equals(Object o) {
210238
SecurityMonitoringRuleNewValueOptions securityMonitoringRuleNewValueOptions =
211239
(SecurityMonitoringRuleNewValueOptions) o;
212240
return Objects.equals(this.forgetAfter, securityMonitoringRuleNewValueOptions.forgetAfter)
241+
&& Objects.equals(
242+
this.instantaneousBaseline, securityMonitoringRuleNewValueOptions.instantaneousBaseline)
213243
&& Objects.equals(
214244
this.learningDuration, securityMonitoringRuleNewValueOptions.learningDuration)
215245
&& Objects.equals(this.learningMethod, securityMonitoringRuleNewValueOptions.learningMethod)
@@ -222,14 +252,22 @@ public boolean equals(Object o) {
222252
@Override
223253
public int hashCode() {
224254
return Objects.hash(
225-
forgetAfter, learningDuration, learningMethod, learningThreshold, additionalProperties);
255+
forgetAfter,
256+
instantaneousBaseline,
257+
learningDuration,
258+
learningMethod,
259+
learningThreshold,
260+
additionalProperties);
226261
}
227262

228263
@Override
229264
public String toString() {
230265
StringBuilder sb = new StringBuilder();
231266
sb.append("class SecurityMonitoringRuleNewValueOptions {\n");
232267
sb.append(" forgetAfter: ").append(toIndentedString(forgetAfter)).append("\n");
268+
sb.append(" instantaneousBaseline: ")
269+
.append(toIndentedString(instantaneousBaseline))
270+
.append("\n");
233271
sb.append(" learningDuration: ").append(toIndentedString(learningDuration)).append("\n");
234272
sb.append(" learningMethod: ").append(toIndentedString(learningMethod)).append("\n");
235273
sb.append(" learningThreshold: ").append(toIndentedString(learningThreshold)).append("\n");

‎src/test/resources/cassettes/features/v2/Validate_a_detection_rule_with_detection_method_new_value_with_enabled_feature_instantaneousBaseline_returns_OK_response.freeze‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2025-12-10T08:37:17.537Z

‎src/test/resources/cassettes/features/v2/Validate_a_detection_rule_with_detection_method_new_value_with_enabled_feature_instantaneousBaseline_returns_OK_response.json‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
[
2+
{
3+
"httpRequest": {
4+
"body": {
5+
"type": "JSON",
6+
"json": "{\"cases\":[{\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"hasExtendedTitle\":true,\"isEnabled\":true,\"message\":\"My security monitoring rule\",\"name\":\"My security monitoring rule\",\"options\":{\"detectionMethod\":\"new_value\",\"evaluationWindow\":0,\"keepAlive\":300,\"maxSignalDuration\":600,\"newValueOptions\":{\"forgetAfter\":7,\"instantaneousBaseline\":true,\"learningDuration\":1,\"learningMethod\":\"duration\",\"learningThreshold\":0}},\"queries\":[{\"aggregation\":\"new_value\",\"dataSource\":\"logs\",\"distinctFields\":[],\"groupByFields\":[\"@userIdentity.assumed_role\"],\"metric\":\"name\",\"metrics\":[\"name\"],\"name\":\"\",\"query\":\"source:source_here\"}],\"tags\":[\"env:prod\",\"team:security\"],\"type\":\"log_detection\"}"
7+
},
8+
"headers": {},
9+
"method": "POST",
10+
"path": "/api/v2/security_monitoring/rules/validation",
11+
"keepAlive": false,
12+
"secure": true
13+
},
14+
"httpResponse": {
15+
"headers": {},
16+
"statusCode": 204,
17+
"reasonPhrase": "No Content"
18+
},
19+
"times": {
20+
"remainingTimes": 1
21+
},
22+
"timeToLive": {
23+
"unlimited": true
24+
},
25+
"id": "cbc72101-0d20-de2d-84fc-d5191be021fe"
26+
}
27+
]

‎src/test/resources/com/datadog/api/client/v2/api/security_monitoring.feature‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1764,6 +1764,13 @@ Feature: Security Monitoring
17641764
When the request is sent
17651765
Then the response status is 204 OK
17661766

1767+
@team:DataDog/k9-cloud-security-platform
1768+
Scenario: Validate a detection rule with detection method 'new_value' with enabled feature 'instantaneousBaseline' returns "OK" response
1769+
Given new "ValidateSecurityMonitoringRule" request
1770+
And body with value {"cases":[{"name":"","status":"info","notifications":[]}],"hasExtendedTitle":true,"isEnabled":true,"message":"My security monitoring rule","name":"My security monitoring rule","options":{"evaluationWindow":0,"keepAlive":300,"maxSignalDuration":600,"detectionMethod":"new_value","newValueOptions":{"forgetAfter":7,"instantaneousBaseline":true,"learningDuration":1,"learningThreshold":0,"learningMethod":"duration"}},"queries":[{"query":"source:source_here","groupByFields":["@userIdentity.assumed_role"],"distinctFields":[],"metric":"name","metrics":["name"],"aggregation":"new_value","name":"","dataSource":"logs"}],"tags":["env:prod","team:security"],"type":"log_detection"}
1771+
When the request is sent
1772+
Then the response status is 204 OK
1773+
17671774
@team:DataDog/k9-cloud-security-platform
17681775
Scenario: Validate a detection rule with detection method 'sequence_detection' returns "OK" response
17691776
Given new "ValidateSecurityMonitoringRule" request

0 commit comments

Comments
 (0)