Skip to content

Commit 76438b5

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Add OpenAPI documentation for list and get indicators of compromise endpoints (#3422)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent 7a3ba5d commit 76438b5

31 files changed

Lines changed: 1938 additions & 0 deletions

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 423 additions & 0 deletions
Large diffs are not rendered by default.

‎docs/datadog_api_client.v2.model.rst‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12506,6 +12506,27 @@ datadog\_api\_client.v2.model.get\_investigation\_response\_links module
1250612506
:members:
1250712507
:show-inheritance:
1250812508

12509+
datadog\_api\_client.v2.model.get\_io\_c\_indicator\_response module
12510+
--------------------------------------------------------------------
12511+
12512+
.. automodule:: datadog_api_client.v2.model.get_io_c_indicator_response
12513+
:members:
12514+
:show-inheritance:
12515+
12516+
datadog\_api\_client.v2.model.get\_io\_c\_indicator\_response\_attributes module
12517+
--------------------------------------------------------------------------------
12518+
12519+
.. automodule:: datadog_api_client.v2.model.get_io_c_indicator_response_attributes
12520+
:members:
12521+
:show-inheritance:
12522+
12523+
datadog\_api\_client.v2.model.get\_io\_c\_indicator\_response\_data module
12524+
--------------------------------------------------------------------------
12525+
12526+
.. automodule:: datadog_api_client.v2.model.get_io_c_indicator_response_data
12527+
:members:
12528+
:show-inheritance:
12529+
1250912530
datadog\_api\_client.v2.model.get\_issue\_include\_query\_parameter\_item module
1251012531
--------------------------------------------------------------------------------
1251112532

@@ -15054,6 +15075,83 @@ datadog\_api\_client.v2.model.investigation\_type module
1505415075
:members:
1505515076
:show-inheritance:
1505615077

15078+
datadog\_api\_client.v2.model.io\_c\_explorer\_list\_response module
15079+
--------------------------------------------------------------------
15080+
15081+
.. automodule:: datadog_api_client.v2.model.io_c_explorer_list_response
15082+
:members:
15083+
:show-inheritance:
15084+
15085+
datadog\_api\_client.v2.model.io\_c\_explorer\_list\_response\_attributes module
15086+
--------------------------------------------------------------------------------
15087+
15088+
.. automodule:: datadog_api_client.v2.model.io_c_explorer_list_response_attributes
15089+
:members:
15090+
:show-inheritance:
15091+
15092+
datadog\_api\_client.v2.model.io\_c\_explorer\_list\_response\_data module
15093+
--------------------------------------------------------------------------
15094+
15095+
.. automodule:: datadog_api_client.v2.model.io_c_explorer_list_response_data
15096+
:members:
15097+
:show-inheritance:
15098+
15099+
datadog\_api\_client.v2.model.io\_c\_explorer\_list\_response\_metadata module
15100+
------------------------------------------------------------------------------
15101+
15102+
.. automodule:: datadog_api_client.v2.model.io_c_explorer_list_response_metadata
15103+
:members:
15104+
:show-inheritance:
15105+
15106+
datadog\_api\_client.v2.model.io\_c\_explorer\_list\_response\_paging module
15107+
----------------------------------------------------------------------------
15108+
15109+
.. automodule:: datadog_api_client.v2.model.io_c_explorer_list_response_paging
15110+
:members:
15111+
:show-inheritance:
15112+
15113+
datadog\_api\_client.v2.model.io\_c\_geo\_location module
15114+
---------------------------------------------------------
15115+
15116+
.. automodule:: datadog_api_client.v2.model.io_c_geo_location
15117+
:members:
15118+
:show-inheritance:
15119+
15120+
datadog\_api\_client.v2.model.io\_c\_indicator module
15121+
-----------------------------------------------------
15122+
15123+
.. automodule:: datadog_api_client.v2.model.io_c_indicator
15124+
:members:
15125+
:show-inheritance:
15126+
15127+
datadog\_api\_client.v2.model.io\_c\_indicator\_detailed module
15128+
---------------------------------------------------------------
15129+
15130+
.. automodule:: datadog_api_client.v2.model.io_c_indicator_detailed
15131+
:members:
15132+
:show-inheritance:
15133+
15134+
datadog\_api\_client.v2.model.io\_c\_score\_effect module
15135+
---------------------------------------------------------
15136+
15137+
.. automodule:: datadog_api_client.v2.model.io_c_score_effect
15138+
:members:
15139+
:show-inheritance:
15140+
15141+
datadog\_api\_client.v2.model.io\_c\_signal\_severity\_count module
15142+
-------------------------------------------------------------------
15143+
15144+
.. automodule:: datadog_api_client.v2.model.io_c_signal_severity_count
15145+
:members:
15146+
:show-inheritance:
15147+
15148+
datadog\_api\_client.v2.model.io\_c\_source module
15149+
--------------------------------------------------
15150+
15151+
.. automodule:: datadog_api_client.v2.model.io_c_source
15152+
:members:
15153+
:show-inheritance:
15154+
1505715155
datadog\_api\_client.v2.model.ip\_allowlist\_attributes module
1505815156
--------------------------------------------------------------
1505915157

‎examples/v2/security-monitoring/GetIndicatorOfCompromise.py‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
"""
2+
Get an indicator of compromise returns "OK" response
3+
"""
4+
5+
from datadog_api_client import ApiClient, Configuration
6+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
7+
8+
configuration = Configuration()
9+
configuration.unstable_operations["get_indicator_of_compromise"] = True
10+
with ApiClient(configuration) as api_client:
11+
api_instance = SecurityMonitoringApi(api_client)
12+
response = api_instance.get_indicator_of_compromise(
13+
indicator="masscan/1.3 (https://github.com/robertdavidgraham/masscan)",
14+
)
15+
16+
print(response)

‎examples/v2/security-monitoring/ListIndicatorsOfCompromise.py‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
"""
2+
List indicators of compromise returns "OK" response
3+
"""
4+
5+
from datadog_api_client import ApiClient, Configuration
6+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
7+
8+
configuration = Configuration()
9+
configuration.unstable_operations["list_indicators_of_compromise"] = True
10+
with ApiClient(configuration) as api_client:
11+
api_instance = SecurityMonitoringApi(api_client)
12+
response = api_instance.list_indicators_of_compromise(
13+
limit=1,
14+
)
15+
16+
print(response)

‎src/datadog_api_client/configuration.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -304,12 +304,14 @@ def __init__(
304304
"v2.delete_threat_hunting_job": False,
305305
"v2.get_content_packs_states": False,
306306
"v2.get_finding": False,
307+
"v2.get_indicator_of_compromise": False,
307308
"v2.get_rule_version_history": False,
308309
"v2.get_secrets_rules": False,
309310
"v2.get_security_monitoring_histsignal": False,
310311
"v2.get_security_monitoring_histsignals_by_job_id": False,
311312
"v2.get_threat_hunting_job": False,
312313
"v2.list_findings": False,
314+
"v2.list_indicators_of_compromise": False,
313315
"v2.list_multiple_rulesets": False,
314316
"v2.list_scanned_assets_metadata": False,
315317
"v2.list_security_monitoring_histsignals": False,

‎src/datadog_api_client/v2/api/security_monitoring_api.py‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,8 @@
5656
from datadog_api_client.v2.model.sbom_format import SBOMFormat
5757
from datadog_api_client.v2.model.scanned_assets_metadata import ScannedAssetsMetadata
5858
from datadog_api_client.v2.model.cloud_asset_type import CloudAssetType
59+
from datadog_api_client.v2.model.io_c_explorer_list_response import IoCExplorerListResponse
60+
from datadog_api_client.v2.model.get_io_c_indicator_response import GetIoCIndicatorResponse
5961
from datadog_api_client.v2.model.notification_rule_response import NotificationRuleResponse
6062
from datadog_api_client.v2.model.create_notification_rule_parameters import CreateNotificationRuleParameters
6163
from datadog_api_client.v2.model.patch_notification_rule_parameters import PatchNotificationRuleParameters
@@ -976,6 +978,29 @@ def __init__(self, api_client=None):
976978
api_client=api_client,
977979
)
978980

981+
self._get_indicator_of_compromise_endpoint = _Endpoint(
982+
settings={
983+
"response_type": (GetIoCIndicatorResponse,),
984+
"auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"],
985+
"endpoint_path": "/api/v2/security/siem/ioc-explorer/indicator",
986+
"operation_id": "get_indicator_of_compromise",
987+
"http_method": "GET",
988+
"version": "v2",
989+
},
990+
params_map={
991+
"indicator": {
992+
"required": True,
993+
"openapi_types": (str,),
994+
"attribute": "indicator",
995+
"location": "query",
996+
},
997+
},
998+
headers_map={
999+
"accept": ["application/json"],
1000+
},
1001+
api_client=api_client,
1002+
)
1003+
9791004
self._get_investigation_log_queries_matching_signal_endpoint = _Endpoint(
9801005
settings={
9811006
"response_type": (SecurityMonitoringSignalSuggestedActionsResponse,),
@@ -1673,6 +1698,54 @@ def __init__(self, api_client=None):
16731698
api_client=api_client,
16741699
)
16751700

1701+
self._list_indicators_of_compromise_endpoint = _Endpoint(
1702+
settings={
1703+
"response_type": (IoCExplorerListResponse,),
1704+
"auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"],
1705+
"endpoint_path": "/api/v2/security/siem/ioc-explorer",
1706+
"operation_id": "list_indicators_of_compromise",
1707+
"http_method": "GET",
1708+
"version": "v2",
1709+
},
1710+
params_map={
1711+
"limit": {
1712+
"validation": {
1713+
"inclusive_maximum": 2147483647,
1714+
},
1715+
"openapi_types": (int,),
1716+
"attribute": "limit",
1717+
"location": "query",
1718+
},
1719+
"offset": {
1720+
"validation": {
1721+
"inclusive_maximum": 2147483647,
1722+
},
1723+
"openapi_types": (int,),
1724+
"attribute": "offset",
1725+
"location": "query",
1726+
},
1727+
"query": {
1728+
"openapi_types": (str,),
1729+
"attribute": "query",
1730+
"location": "query",
1731+
},
1732+
"sort_column": {
1733+
"openapi_types": (str,),
1734+
"attribute": "sort[column]",
1735+
"location": "query",
1736+
},
1737+
"sort_order": {
1738+
"openapi_types": (str,),
1739+
"attribute": "sort[order]",
1740+
"location": "query",
1741+
},
1742+
},
1743+
headers_map={
1744+
"accept": ["application/json"],
1745+
},
1746+
api_client=api_client,
1747+
)
1748+
16761749
self._list_multiple_rulesets_endpoint = _Endpoint(
16771750
settings={
16781751
"response_type": (GetMultipleRulesetsResponse,),
@@ -3447,6 +3520,23 @@ def get_finding(
34473520

34483521
return self._get_finding_endpoint.call_with_http_info(**kwargs)
34493522

3523+
def get_indicator_of_compromise(
3524+
self,
3525+
indicator: str,
3526+
) -> GetIoCIndicatorResponse:
3527+
"""Get an indicator of compromise.
3528+
3529+
Get detailed information about a specific indicator of compromise (IoC).
3530+
3531+
:param indicator: The indicator value to look up (for example, an IP address or domain).
3532+
:type indicator: str
3533+
:rtype: GetIoCIndicatorResponse
3534+
"""
3535+
kwargs: Dict[str, Any] = {}
3536+
kwargs["indicator"] = indicator
3537+
3538+
return self._get_indicator_of_compromise_endpoint.call_with_http_info(**kwargs)
3539+
34503540
def get_investigation_log_queries_matching_signal(
34513541
self,
34523542
signal_id: str,
@@ -4227,6 +4317,49 @@ def list_findings_with_pagination(
42274317
}
42284318
return endpoint.call_with_http_info_paginated(pagination)
42294319

4320+
def list_indicators_of_compromise(
4321+
self,
4322+
*,
4323+
limit: Union[int, UnsetType] = unset,
4324+
offset: Union[int, UnsetType] = unset,
4325+
query: Union[str, UnsetType] = unset,
4326+
sort_column: Union[str, UnsetType] = unset,
4327+
sort_order: Union[str, UnsetType] = unset,
4328+
) -> IoCExplorerListResponse:
4329+
"""List indicators of compromise.
4330+
4331+
Get a list of indicators of compromise (IoCs) matching the specified filters.
4332+
4333+
:param limit: Number of results per page.
4334+
:type limit: int, optional
4335+
:param offset: Pagination offset.
4336+
:type offset: int, optional
4337+
:param query: Search/filter query (supports field:value syntax).
4338+
:type query: str, optional
4339+
:param sort_column: Sort column: score, first_seen_ts_epoch, last_seen_ts_epoch, indicator, indicator_type, signal_count, log_count, category, as_type.
4340+
:type sort_column: str, optional
4341+
:param sort_order: Sort order: asc or desc.
4342+
:type sort_order: str, optional
4343+
:rtype: IoCExplorerListResponse
4344+
"""
4345+
kwargs: Dict[str, Any] = {}
4346+
if limit is not unset:
4347+
kwargs["limit"] = limit
4348+
4349+
if offset is not unset:
4350+
kwargs["offset"] = offset
4351+
4352+
if query is not unset:
4353+
kwargs["query"] = query
4354+
4355+
if sort_column is not unset:
4356+
kwargs["sort_column"] = sort_column
4357+
4358+
if sort_order is not unset:
4359+
kwargs["sort_order"] = sort_order
4360+
4361+
return self._list_indicators_of_compromise_endpoint.call_with_http_info(**kwargs)
4362+
42304363
def list_multiple_rulesets(
42314364
self,
42324365
body: GetMultipleRulesetsRequest,

‎src/datadog_api_client/v2/model/get_io_c_indicator_response.py‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
2+
# This product includes software developed at Datadog (https://www.datadoghq.com/).
3+
# Copyright 2019-Present Datadog, Inc.
4+
from __future__ import annotations
5+
6+
from typing import Union, TYPE_CHECKING
7+
8+
from datadog_api_client.model_utils import (
9+
ModelNormal,
10+
cached_property,
11+
unset,
12+
UnsetType,
13+
)
14+
15+
16+
if TYPE_CHECKING:
17+
from datadog_api_client.v2.model.get_io_c_indicator_response_data import GetIoCIndicatorResponseData
18+
19+
20+
class GetIoCIndicatorResponse(ModelNormal):
21+
@cached_property
22+
def openapi_types(_):
23+
from datadog_api_client.v2.model.get_io_c_indicator_response_data import GetIoCIndicatorResponseData
24+
25+
return {
26+
"data": (GetIoCIndicatorResponseData,),
27+
}
28+
29+
attribute_map = {
30+
"data": "data",
31+
}
32+
33+
def __init__(self_, data: Union[GetIoCIndicatorResponseData, UnsetType] = unset, **kwargs):
34+
"""
35+
Response for the get indicator of compromise endpoint.
36+
37+
:param data: IoC indicator response data object.
38+
:type data: GetIoCIndicatorResponseData, optional
39+
"""
40+
if data is not unset:
41+
kwargs["data"] = data
42+
super().__init__(kwargs)

0 commit comments

Comments
 (0)