Flag IP case action (#3014)

Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>

Author: api-clients-generation-pipeline[bot]

.generated-info

@@ -1,4 +1,4 @@
 {
-  "spec_repo_commit": "06ccc32",
-  "generated": "2025-07-21 13:56:40.276"
+  "spec_repo_commit": "8ca2883",
+  "generated": "2025-07-22 07:16:11.777"
 }

.generator/schemas/v2/openapi.yaml

@@ -34296,9 +34296,22 @@ components:
           format: int64
           minimum: 0
           type: integer
+        flaggedIPType:
+          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsFlaggedIPType'
         userBehaviorName:
           $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsUserBehaviorName'
       type: object
+    SecurityMonitoringRuleCaseActionOptionsFlaggedIPType:
+      description: Used with the case action of type 'flag_ip'. The value specified
+        in this field is applied as a flag to the IP addresses.
+      enum:
+      - SUSPICIOUS
+      - FLAGGED
+      example: FLAGGED
+      type: string
+      x-enum-varnames:
+      - SUSPICIOUS
+      - FLAGGED
     SecurityMonitoringRuleCaseActionOptionsUserBehaviorName:
       description: Used with the case action of type 'user_behavior'. The value specified
         in this field is applied as a risk tag to all users affected by the rule.
@@ -34309,11 +34322,13 @@ components:
       - block_ip
       - block_user
       - user_behavior
+      - flag_ip
       type: string
       x-enum-varnames:
       - BLOCK_IP
       - BLOCK_USER
       - USER_BEHAVIOR
+      - FLAG_IP
     SecurityMonitoringRuleCaseCreate:
       description: Case when signal is generated.
       properties:

examples/v2/security-monitoring/CreateSecurityMonitoringRule_1965169892.java

@@ -5,6 +5,7 @@
 import com.datadog.api.client.v2.api.SecurityMonitoringApi;
 import com.datadog.api.client.v2.model.SecurityMonitoringRuleCaseAction;
 import com.datadog.api.client.v2.model.SecurityMonitoringRuleCaseActionOptions;
+import com.datadog.api.client.v2.model.SecurityMonitoringRuleCaseActionOptionsFlaggedIPType;
 import com.datadog.api.client.v2.model.SecurityMonitoringRuleCaseActionType;
 import com.datadog.api.client.v2.model.SecurityMonitoringRuleCaseCreate;
 import com.datadog.api.client.v2.model.SecurityMonitoringRuleCreatePayload;
@@ -55,7 +56,14 @@ public static void main(String[] args) {
                                         .type(SecurityMonitoringRuleCaseActionType.USER_BEHAVIOR)
                                         .options(
                                             new SecurityMonitoringRuleCaseActionOptions()
-                                                .userBehaviorName("behavior"))))))
+                                                .userBehaviorName("behavior")),
+                                    new SecurityMonitoringRuleCaseAction()
+                                        .type(SecurityMonitoringRuleCaseActionType.FLAG_IP)
+                                        .options(
+                                            new SecurityMonitoringRuleCaseActionOptions()
+                                                .flaggedIpType(
+                                                    SecurityMonitoringRuleCaseActionOptionsFlaggedIPType
+                                                        .FLAGGED))))))
                 .options(
                     new SecurityMonitoringRuleOptions()
                         .keepAlive(SecurityMonitoringRuleKeepAlive.ONE_HOUR)

src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseActionOptions.java

@@ -19,6 +19,7 @@
 /** Options for the rule action */
 @JsonPropertyOrder({
   SecurityMonitoringRuleCaseActionOptions.JSON_PROPERTY_DURATION,
+  SecurityMonitoringRuleCaseActionOptions.JSON_PROPERTY_FLAGGED_IP_TYPE,
   SecurityMonitoringRuleCaseActionOptions.JSON_PROPERTY_USER_BEHAVIOR_NAME
 })
 @jakarta.annotation.Generated(
@@ -28,6 +29,9 @@ public class SecurityMonitoringRuleCaseActionOptions {
   public static final String JSON_PROPERTY_DURATION = "duration";
   private Long duration;
 
+  public static final String JSON_PROPERTY_FLAGGED_IP_TYPE = "flaggedIPType";
+  private SecurityMonitoringRuleCaseActionOptionsFlaggedIPType flaggedIpType;
+
   public static final String JSON_PROPERTY_USER_BEHAVIOR_NAME = "userBehaviorName";
   private String userBehaviorName;
 
@@ -52,6 +56,33 @@ public void setDuration(Long duration) {
     this.duration = duration;
   }
 
+  public SecurityMonitoringRuleCaseActionOptions flaggedIpType(
+      SecurityMonitoringRuleCaseActionOptionsFlaggedIPType flaggedIpType) {
+    this.flaggedIpType = flaggedIpType;
+    this.unparsed |= !flaggedIpType.isValid();
+    return this;
+  }
+
+  /**
+   * Used with the case action of type 'flag_ip'. The value specified in this field is applied as a
+   * flag to the IP addresses.
+   *
+   * @return flaggedIpType
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_FLAGGED_IP_TYPE)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public SecurityMonitoringRuleCaseActionOptionsFlaggedIPType getFlaggedIpType() {
+    return flaggedIpType;
+  }
+
+  public void setFlaggedIpType(SecurityMonitoringRuleCaseActionOptionsFlaggedIPType flaggedIpType) {
+    if (!flaggedIpType.isValid()) {
+      this.unparsed = true;
+    }
+    this.flaggedIpType = flaggedIpType;
+  }
+
   public SecurityMonitoringRuleCaseActionOptions userBehaviorName(String userBehaviorName) {
     this.userBehaviorName = userBehaviorName;
     return this;
@@ -132,6 +163,7 @@ public boolean equals(Object o) {
     SecurityMonitoringRuleCaseActionOptions securityMonitoringRuleCaseActionOptions =
         (SecurityMonitoringRuleCaseActionOptions) o;
     return Objects.equals(this.duration, securityMonitoringRuleCaseActionOptions.duration)
+        && Objects.equals(this.flaggedIpType, securityMonitoringRuleCaseActionOptions.flaggedIpType)
         && Objects.equals(
             this.userBehaviorName, securityMonitoringRuleCaseActionOptions.userBehaviorName)
         && Objects.equals(
@@ -141,14 +173,15 @@ public boolean equals(Object o) {
 
   @Override
   public int hashCode() {
-    return Objects.hash(duration, userBehaviorName, additionalProperties);
+    return Objects.hash(duration, flaggedIpType, userBehaviorName, additionalProperties);
   }
 
   @Override
   public String toString() {
     StringBuilder sb = new StringBuilder();
     sb.append("class SecurityMonitoringRuleCaseActionOptions {\n");
     sb.append("    duration: ").append(toIndentedString(duration)).append("\n");
+    sb.append("    flaggedIpType: ").append(toIndentedString(flaggedIpType)).append("\n");
     sb.append("    userBehaviorName: ").append(toIndentedString(userBehaviorName)).append("\n");
     sb.append("    additionalProperties: ")
         .append(toIndentedString(additionalProperties))

src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseActionOptionsFlaggedIPType.java

@@ -0,0 +1,68 @@
+/*
+ * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ * This product includes software developed at Datadog (https://www.datadoghq.com/).
+ * Copyright 2019-Present Datadog, Inc.
+ */
+
+package com.datadog.api.client.v2.model;
+
+import com.datadog.api.client.ModelEnum;
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+import com.fasterxml.jackson.databind.ser.std.StdSerializer;
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * Used with the case action of type 'flag_ip'. The value specified in this field is applied as a
+ * flag to the IP addresses.
+ */
+@JsonSerialize(
+    using =
+        SecurityMonitoringRuleCaseActionOptionsFlaggedIPType
+            .SecurityMonitoringRuleCaseActionOptionsFlaggedIPTypeSerializer.class)
+public class SecurityMonitoringRuleCaseActionOptionsFlaggedIPType extends ModelEnum<String> {
+
+  private static final Set<String> allowedValues =
+      new HashSet<String>(Arrays.asList("SUSPICIOUS", "FLAGGED"));
+
+  public static final SecurityMonitoringRuleCaseActionOptionsFlaggedIPType SUSPICIOUS =
+      new SecurityMonitoringRuleCaseActionOptionsFlaggedIPType("SUSPICIOUS");
+  public static final SecurityMonitoringRuleCaseActionOptionsFlaggedIPType FLAGGED =
+      new SecurityMonitoringRuleCaseActionOptionsFlaggedIPType("FLAGGED");
+
+  SecurityMonitoringRuleCaseActionOptionsFlaggedIPType(String value) {
+    super(value, allowedValues);
+  }
+
+  public static class SecurityMonitoringRuleCaseActionOptionsFlaggedIPTypeSerializer
+      extends StdSerializer<SecurityMonitoringRuleCaseActionOptionsFlaggedIPType> {
+    public SecurityMonitoringRuleCaseActionOptionsFlaggedIPTypeSerializer(
+        Class<SecurityMonitoringRuleCaseActionOptionsFlaggedIPType> t) {
+      super(t);
+    }
+
+    public SecurityMonitoringRuleCaseActionOptionsFlaggedIPTypeSerializer() {
+      this(null);
+    }
+
+    @Override
+    public void serialize(
+        SecurityMonitoringRuleCaseActionOptionsFlaggedIPType value,
+        JsonGenerator jgen,
+        SerializerProvider provider)
+        throws IOException, JsonProcessingException {
+      jgen.writeObject(value.value);
+    }
+  }
+
+  @JsonCreator
+  public static SecurityMonitoringRuleCaseActionOptionsFlaggedIPType fromValue(String value) {
+    return new SecurityMonitoringRuleCaseActionOptionsFlaggedIPType(value);
+  }
+}

src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseActionType.java

@@ -25,14 +25,16 @@
 public class SecurityMonitoringRuleCaseActionType extends ModelEnum<String> {
 
   private static final Set<String> allowedValues =
-      new HashSet<String>(Arrays.asList("block_ip", "block_user", "user_behavior"));
+      new HashSet<String>(Arrays.asList("block_ip", "block_user", "user_behavior", "flag_ip"));
 
   public static final SecurityMonitoringRuleCaseActionType BLOCK_IP =
       new SecurityMonitoringRuleCaseActionType("block_ip");
   public static final SecurityMonitoringRuleCaseActionType BLOCK_USER =
       new SecurityMonitoringRuleCaseActionType("block_user");
   public static final SecurityMonitoringRuleCaseActionType USER_BEHAVIOR =
       new SecurityMonitoringRuleCaseActionType("user_behavior");
+  public static final SecurityMonitoringRuleCaseActionType FLAG_IP =
+      new SecurityMonitoringRuleCaseActionType("flag_ip");
 
   SecurityMonitoringRuleCaseActionType(String value) {
     super(value, allowedValues);

src/test/resources/cassettes/features/v2/Create_a_detection_rule_with_type_application_security_returns_OK_response.freeze

@@ -1 +1 @@
-2025-04-09T15:02:05.047Z
+2025-07-17T10:35:24.061Z

src/test/resources/cassettes/features/v2/Create_a_detection_rule_with_type_application_security_returns_OK_response.json

@@ -3,7 +3,7 @@
     "httpRequest": {
       "body": {
         "type": "JSON",
-        "json": "{\"cases\":[{\"actions\":[{\"options\":{\"duration\":900},\"type\":\"block_ip\"},{\"options\":{\"userBehaviorName\":\"behavior\"},\"type\":\"user_behavior\"}],\"condition\":\"a > 100000\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"groupSignalsBy\":[\"service\"],\"isEnabled\":true,\"message\":\"Test rule\",\"name\":\"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1744210925_appsec_rule\",\"options\":{\"detectionMethod\":\"threshold\",\"evaluationWindow\":900,\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[\"service\",\"@http.client_ip\"],\"query\":\"@appsec.security_activity:business_logic.users.login.failure\"}],\"tags\":[],\"type\":\"application_security\"}"
+        "json": "{\"cases\":[{\"actions\":[{\"options\":{\"duration\":900},\"type\":\"block_ip\"},{\"options\":{\"userBehaviorName\":\"behavior\"},\"type\":\"user_behavior\"},{\"options\":{\"flaggedIPType\":\"FLAGGED\"},\"type\":\"flag_ip\"}],\"condition\":\"a > 100000\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"groupSignalsBy\":[\"service\"],\"isEnabled\":true,\"message\":\"Test rule\",\"name\":\"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1752748524_appsec_rule\",\"options\":{\"detectionMethod\":\"threshold\",\"evaluationWindow\":900,\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[\"service\",\"@http.client_ip\"],\"query\":\"@appsec.security_activity:business_logic.users.login.failure\"}],\"tags\":[],\"type\":\"application_security\"}"
       },
       "headers": {},
       "method": "POST",
@@ -12,7 +12,7 @@
       "secure": true
     },
     "httpResponse": {
-      "body": "{\"name\":\"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1744210925_appsec_rule\",\"createdAt\":1744210925675,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isBeta\":false,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"@appsec.security_activity:business_logic.users.login.failure\",\"groupByFields\":[\"service\",\"@http.client_ip\"],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\",\"dataSource\":\"app_sec_spans\"}],\"options\":{\"evaluationWindow\":900,\"detectionMethod\":\"threshold\",\"maxSignalDuration\":86400,\"keepAlive\":3600},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a \\u003e 100000\",\"actions\":[{\"type\":\"block_ip\",\"options\":{\"duration\":900}},{\"type\":\"user_behavior\",\"options\":{\"userBehaviorName\":\"behavior\"}}]}],\"message\":\"Test rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"application_security\",\"filters\":[],\"version\":1,\"id\":\"lfr-zxg-fyc\",\"blocking\":true,\"groupSignalsBy\":[\"service\"],\"dependencies\":[\"business_logic.users.login.failure\"],\"metadata\":{\"entities\":null,\"sources\":null},\"creationAuthorId\":2320499,\"creator\":{\"handle\":\"9919ec9b-ebc7-49ee-8dc8-03626e717cca\",\"name\":\"CI Account\"},\"updater\":{\"handle\":\"\",\"name\":\"\"}}",
+      "body": "{\"name\":\"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1752748524_appsec_rule\",\"createdAt\":1752748524806,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isBeta\":false,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"@appsec.security_activity:business_logic.users.login.failure\",\"groupByFields\":[\"service\",\"@http.client_ip\"],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\",\"dataSource\":\"app_sec_spans\"}],\"options\":{\"evaluationWindow\":900,\"detectionMethod\":\"threshold\",\"maxSignalDuration\":86400,\"keepAlive\":3600},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a \\u003e 100000\",\"actions\":[{\"type\":\"block_ip\",\"options\":{\"duration\":900}},{\"type\":\"user_behavior\",\"options\":{\"userBehaviorName\":\"behavior\"}},{\"type\":\"flag_ip\",\"options\":{\"flaggedIPType\":\"FLAGGED\"}}]}],\"message\":\"Test rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"application_security\",\"filters\":[],\"version\":1,\"id\":\"wgo-lgy-ajy\",\"blocking\":true,\"groupSignalsBy\":[\"service\"],\"dependencies\":[\"business_logic.users.login.failure\"],\"metadata\":{\"entities\":null,\"sources\":null},\"creationAuthorId\":2320499,\"creator\":{\"handle\":\"9919ec9b-ebc7-49ee-8dc8-03626e717cca\",\"name\":\"CI Account\"},\"updater\":{\"handle\":\"\",\"name\":\"\"}}",
       "headers": {
         "Content-Type": [
           "application/json"
@@ -27,13 +27,13 @@
     "timeToLive": {
       "unlimited": true
     },
-    "id": "2f689fb3-a0a5-4f45-bf36-37e6331a9f25"
+    "id": "29eb6c54-9b50-360b-d2c3-8ca9462c0177"
   },
   {
     "httpRequest": {
       "headers": {},
       "method": "DELETE",
-      "path": "/api/v2/security_monitoring/rules/lfr-zxg-fyc",
+      "path": "/api/v2/security_monitoring/rules/wgo-lgy-ajy",
       "keepAlive": false,
       "secure": true
     },
@@ -48,6 +48,6 @@
     "timeToLive": {
       "unlimited": true
     },
-    "id": "a32045c8-5c74-ebb2-99fe-6584f15ea321"
+    "id": "eaf198f3-1c33-3ac3-09eb-713901fb969e"
   }
 ]

src/test/resources/com/datadog/api/client/v2/api/security_monitoring.feature

@@ -225,7 +225,7 @@ Feature: Security Monitoring
   @skip-validation @team:DataDog/k9-cloud-security-platform
   Scenario: Create a detection rule with type 'application_security 'returns "OK" response
     Given new "CreateSecurityMonitoringRule" request
-    And body with value {"type":"application_security","name":"{{unique}}_appsec_rule","queries":[{"query":"@appsec.security_activity:business_logic.users.login.failure","aggregation":"count","groupByFields":["service","@http.client_ip"],"distinctFields":[]}],"filters":[],"cases":[{"name":"","status":"info","notifications":[],"condition":"a > 100000","actions":[{"type":"block_ip","options":{"duration":900}}, {"type":"user_behavior","options":{"userBehaviorName":"behavior"}}]}],"options":{"keepAlive":3600,"maxSignalDuration":86400,"evaluationWindow":900,"detectionMethod":"threshold"},"isEnabled":true,"message":"Test rule","tags":[],"groupSignalsBy":["service"]}
+    And body with value {"type":"application_security","name":"{{unique}}_appsec_rule","queries":[{"query":"@appsec.security_activity:business_logic.users.login.failure","aggregation":"count","groupByFields":["service","@http.client_ip"],"distinctFields":[]}],"filters":[],"cases":[{"name":"","status":"info","notifications":[],"condition":"a > 100000","actions":[{"type":"block_ip","options":{"duration":900}}, {"type":"user_behavior","options":{"userBehaviorName":"behavior"}}, {"type":"flag_ip","options":{"flaggedIPType":"FLAGGED"}}]}],"options":{"keepAlive":3600,"maxSignalDuration":86400,"evaluationWindow":900,"detectionMethod":"threshold"},"isEnabled":true,"message":"Test rule","tags":[],"groupSignalsBy":["service"]}
     When the request is sent
     Then the response status is 200 OK
     And the response "name" is equal to "{{ unique }}_appsec_rule"