Skip to content

Commit 44f95bb

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Security Monitoring - Related Suppressions for a Rule (#2805)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent 6a881df commit 44f95bb

15 files changed

Lines changed: 412 additions & 5 deletions

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64757,6 +64757,65 @@ paths:
6475764757
tags:
6475864758
- Security Monitoring
6475964759
x-codegen-request-body-name: body
64760+
/api/v2/security_monitoring/configuration/suppressions/rules:
64761+
post:
64762+
description: Get the list of suppressions that would affect a rule.
64763+
operationId: GetSuppressionsAffectingFutureRule
64764+
requestBody:
64765+
content:
64766+
application/json:
64767+
schema:
64768+
$ref: '#/components/schemas/SecurityMonitoringRuleCreatePayload'
64769+
required: true
64770+
responses:
64771+
'200':
64772+
content:
64773+
application/json:
64774+
schema:
64775+
$ref: '#/components/schemas/SecurityMonitoringSuppressionsResponse'
64776+
description: OK
64777+
'400':
64778+
$ref: '#/components/responses/BadRequestResponse'
64779+
'403':
64780+
$ref: '#/components/responses/NotAuthorizedResponse'
64781+
'429':
64782+
$ref: '#/components/responses/TooManyRequestsResponse'
64783+
security:
64784+
- apiKeyAuth: []
64785+
appKeyAuth: []
64786+
- AuthZ:
64787+
- security_monitoring_suppressions_read
64788+
summary: Get suppressions affecting future rule
64789+
tags:
64790+
- Security Monitoring
64791+
/api/v2/security_monitoring/configuration/suppressions/rules/{rule_id}:
64792+
get:
64793+
description: Get the list of suppressions that affect a specific existing rule
64794+
by its ID.
64795+
operationId: GetSuppressionsAffectingRule
64796+
parameters:
64797+
- $ref: '#/components/parameters/SecurityMonitoringRuleID'
64798+
responses:
64799+
'200':
64800+
content:
64801+
application/json:
64802+
schema:
64803+
$ref: '#/components/schemas/SecurityMonitoringSuppressionsResponse'
64804+
description: OK
64805+
'403':
64806+
$ref: '#/components/responses/NotAuthorizedResponse'
64807+
'404':
64808+
$ref: '#/components/responses/NotFoundResponse'
64809+
'429':
64810+
$ref: '#/components/responses/TooManyRequestsResponse'
64811+
security:
64812+
- apiKeyAuth: []
64813+
appKeyAuth: []
64814+
- AuthZ:
64815+
- security_monitoring_suppressions_read
64816+
summary: Get suppressions affecting a specific rule
64817+
tags:
64818+
- Security Monitoring
6476064819
/api/v2/security_monitoring/configuration/suppressions/{suppression_id}:
6476164820
delete:
6476264821
description: Delete a specific suppression rule.

‎examples/v2/security-monitoring/GetSuppressionsAffectingFutureRule.py‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
"""
2+
Get suppressions affecting future rule returns "OK" response
3+
"""
4+
5+
from datadog_api_client import ApiClient, Configuration
6+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
7+
from datadog_api_client.v2.model.security_monitoring_rule_case_create import SecurityMonitoringRuleCaseCreate
8+
from datadog_api_client.v2.model.security_monitoring_rule_evaluation_window import (
9+
SecurityMonitoringRuleEvaluationWindow,
10+
)
11+
from datadog_api_client.v2.model.security_monitoring_rule_keep_alive import SecurityMonitoringRuleKeepAlive
12+
from datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration import (
13+
SecurityMonitoringRuleMaxSignalDuration,
14+
)
15+
from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions
16+
from datadog_api_client.v2.model.security_monitoring_rule_query_aggregation import (
17+
SecurityMonitoringRuleQueryAggregation,
18+
)
19+
from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity
20+
from datadog_api_client.v2.model.security_monitoring_rule_type_create import SecurityMonitoringRuleTypeCreate
21+
from datadog_api_client.v2.model.security_monitoring_standard_rule_create_payload import (
22+
SecurityMonitoringStandardRuleCreatePayload,
23+
)
24+
from datadog_api_client.v2.model.security_monitoring_standard_rule_query import SecurityMonitoringStandardRuleQuery
25+
26+
body = SecurityMonitoringStandardRuleCreatePayload(
27+
name="Example-Security-Monitoring",
28+
queries=[
29+
SecurityMonitoringStandardRuleQuery(
30+
query="@test:true",
31+
aggregation=SecurityMonitoringRuleQueryAggregation.COUNT,
32+
group_by_fields=[],
33+
distinct_fields=[],
34+
metrics=[],
35+
),
36+
],
37+
filters=[],
38+
cases=[
39+
SecurityMonitoringRuleCaseCreate(
40+
name="",
41+
status=SecurityMonitoringRuleSeverity.INFO,
42+
condition="a > 0",
43+
notifications=[],
44+
),
45+
],
46+
options=SecurityMonitoringRuleOptions(
47+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES,
48+
keep_alive=SecurityMonitoringRuleKeepAlive.ONE_HOUR,
49+
max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.ONE_DAY,
50+
),
51+
message="Test rule",
52+
tags=[],
53+
is_enabled=True,
54+
type=SecurityMonitoringRuleTypeCreate.LOG_DETECTION,
55+
)
56+
57+
configuration = Configuration()
58+
with ApiClient(configuration) as api_client:
59+
api_instance = SecurityMonitoringApi(api_client)
60+
response = api_instance.get_suppressions_affecting_future_rule(body=body)
61+
62+
print(response)

‎examples/v2/security-monitoring/GetSuppressionsAffectingRule.py‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
"""
2+
Get suppressions affecting a specific rule returns "OK" response
3+
"""
4+
5+
from os import environ
6+
from datadog_api_client import ApiClient, Configuration
7+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
8+
9+
# there is a valid "security_rule" in the system
10+
SECURITY_RULE_ID = environ["SECURITY_RULE_ID"]
11+
12+
configuration = Configuration()
13+
with ApiClient(configuration) as api_client:
14+
api_instance = SecurityMonitoringApi(api_client)
15+
response = api_instance.get_suppressions_affecting_rule(
16+
rule_id=SECURITY_RULE_ID,
17+
)
18+
19+
print(response)

‎src/datadog_api_client/v2/api/security_monitoring_api.py‎

Lines changed: 86 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -59,11 +59,6 @@
5959
from datadog_api_client.v2.model.security_monitoring_suppression_create_request import (
6060
SecurityMonitoringSuppressionCreateRequest,
6161
)
62-
from datadog_api_client.v2.model.security_monitoring_suppression_update_request import (
63-
SecurityMonitoringSuppressionUpdateRequest,
64-
)
65-
from datadog_api_client.v2.model.security_monitoring_list_rules_response import SecurityMonitoringListRulesResponse
66-
from datadog_api_client.v2.model.security_monitoring_rule_response import SecurityMonitoringRuleResponse
6762
from datadog_api_client.v2.model.security_monitoring_rule_create_payload import SecurityMonitoringRuleCreatePayload
6863
from datadog_api_client.v2.model.security_monitoring_standard_rule_create_payload import (
6964
SecurityMonitoringStandardRuleCreatePayload,
@@ -72,6 +67,11 @@
7267
SecurityMonitoringSignalRuleCreatePayload,
7368
)
7469
from datadog_api_client.v2.model.cloud_configuration_rule_create_payload import CloudConfigurationRuleCreatePayload
70+
from datadog_api_client.v2.model.security_monitoring_suppression_update_request import (
71+
SecurityMonitoringSuppressionUpdateRequest,
72+
)
73+
from datadog_api_client.v2.model.security_monitoring_list_rules_response import SecurityMonitoringListRulesResponse
74+
from datadog_api_client.v2.model.security_monitoring_rule_response import SecurityMonitoringRuleResponse
7575
from datadog_api_client.v2.model.security_monitoring_rule_convert_response import SecurityMonitoringRuleConvertResponse
7676
from datadog_api_client.v2.model.security_monitoring_rule_convert_payload import SecurityMonitoringRuleConvertPayload
7777
from datadog_api_client.v2.model.security_monitoring_standard_rule_payload import SecurityMonitoringStandardRulePayload
@@ -880,6 +880,49 @@ def __init__(self, api_client=None):
880880
api_client=api_client,
881881
)
882882

883+
self._get_suppressions_affecting_future_rule_endpoint = _Endpoint(
884+
settings={
885+
"response_type": (SecurityMonitoringSuppressionsResponse,),
886+
"auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"],
887+
"endpoint_path": "/api/v2/security_monitoring/configuration/suppressions/rules",
888+
"operation_id": "get_suppressions_affecting_future_rule",
889+
"http_method": "POST",
890+
"version": "v2",
891+
},
892+
params_map={
893+
"body": {
894+
"required": True,
895+
"openapi_types": (SecurityMonitoringRuleCreatePayload,),
896+
"location": "body",
897+
},
898+
},
899+
headers_map={"accept": ["application/json"], "content_type": ["application/json"]},
900+
api_client=api_client,
901+
)
902+
903+
self._get_suppressions_affecting_rule_endpoint = _Endpoint(
904+
settings={
905+
"response_type": (SecurityMonitoringSuppressionsResponse,),
906+
"auth": ["apiKeyAuth", "appKeyAuth", "AuthZ"],
907+
"endpoint_path": "/api/v2/security_monitoring/configuration/suppressions/rules/{rule_id}",
908+
"operation_id": "get_suppressions_affecting_rule",
909+
"http_method": "GET",
910+
"version": "v2",
911+
},
912+
params_map={
913+
"rule_id": {
914+
"required": True,
915+
"openapi_types": (str,),
916+
"attribute": "rule_id",
917+
"location": "path",
918+
},
919+
},
920+
headers_map={
921+
"accept": ["application/json"],
922+
},
923+
api_client=api_client,
924+
)
925+
883926
self._get_vulnerability_notification_rule_endpoint = _Endpoint(
884927
settings={
885928
"response_type": (NotificationRuleResponse,),
@@ -2504,6 +2547,44 @@ def get_signal_notification_rules(
25042547
kwargs: Dict[str, Any] = {}
25052548
return self._get_signal_notification_rules_endpoint.call_with_http_info(**kwargs)
25062549

2550+
def get_suppressions_affecting_future_rule(
2551+
self,
2552+
body: Union[
2553+
SecurityMonitoringRuleCreatePayload,
2554+
SecurityMonitoringStandardRuleCreatePayload,
2555+
SecurityMonitoringSignalRuleCreatePayload,
2556+
CloudConfigurationRuleCreatePayload,
2557+
],
2558+
) -> SecurityMonitoringSuppressionsResponse:
2559+
"""Get suppressions affecting future rule.
2560+
2561+
Get the list of suppressions that would affect a rule.
2562+
2563+
:type body: SecurityMonitoringRuleCreatePayload
2564+
:rtype: SecurityMonitoringSuppressionsResponse
2565+
"""
2566+
kwargs: Dict[str, Any] = {}
2567+
kwargs["body"] = body
2568+
2569+
return self._get_suppressions_affecting_future_rule_endpoint.call_with_http_info(**kwargs)
2570+
2571+
def get_suppressions_affecting_rule(
2572+
self,
2573+
rule_id: str,
2574+
) -> SecurityMonitoringSuppressionsResponse:
2575+
"""Get suppressions affecting a specific rule.
2576+
2577+
Get the list of suppressions that affect a specific existing rule by its ID.
2578+
2579+
:param rule_id: The ID of the rule.
2580+
:type rule_id: str
2581+
:rtype: SecurityMonitoringSuppressionsResponse
2582+
"""
2583+
kwargs: Dict[str, Any] = {}
2584+
kwargs["rule_id"] = rule_id
2585+
2586+
return self._get_suppressions_affecting_rule_endpoint.call_with_http_info(**kwargs)
2587+
25072588
def get_vulnerability_notification_rule(
25082589
self,
25092590
id: str,

‎tests/v2/cassettes/test_scenarios/test_get_suppressions_affecting_a_specific_rule_returns_not_found_response.frozen‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2025-08-30T15:29:04.687Z

‎tests/v2/cassettes/test_scenarios/test_get_suppressions_affecting_a_specific_rule_returns_not_found_response.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
interactions:
2+
- request:
3+
body: null
4+
headers:
5+
accept:
6+
- application/json
7+
method: GET
8+
uri: https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/rules/aaa-bbb-ccc-ddd
9+
response:
10+
body:
11+
string: '{"errors":["not_found(Threat detection rule not found: aaa-bbb-ccc-ddd)"]}'
12+
headers:
13+
content-type:
14+
- application/json
15+
status:
16+
code: 404
17+
message: Not Found
18+
version: 1

‎tests/v2/cassettes/test_scenarios/test_get_suppressions_affecting_a_specific_rule_returns_ok_response.frozen‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2025-08-30T11:40:50.061Z

‎tests/v2/cassettes/test_scenarios/test_get_suppressions_affecting_a_specific_rule_returns_ok_response.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
interactions:
2+
- request:
3+
body: '{"cases":[{"condition":"a > 0","name":"","notifications":[],"status":"info"}],"filters":[],"isEnabled":true,"message":"Test
4+
rule","name":"Test-Get_suppressions_affecting_a_specific_rule_returns_OK_response-1756554050","options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"queries":[{"aggregation":"count","distinctFields":[],"groupByFields":[],"metrics":[],"query":"@test:true"}],"tags":[],"type":"log_detection"}'
5+
headers:
6+
accept:
7+
- application/json
8+
content-type:
9+
- application/json
10+
method: POST
11+
uri: https://api.datadoghq.com/api/v2/security_monitoring/rules
12+
response:
13+
body:
14+
string: '{"name":"Test-Get_suppressions_affecting_a_specific_rule_returns_OK_response-1756554050","createdAt":1756554050604,"isDefault":false,"isPartner":false,"isEnabled":true,"isBeta":false,"isDeleted":false,"isDeprecated":false,"queries":[{"query":"@test:true","groupByFields":[],"hasOptionalGroupByFields":false,"distinctFields":[],"aggregation":"count","name":"","dataSource":"logs"}],"options":{"evaluationWindow":900,"detectionMethod":"threshold","maxSignalDuration":86400,"keepAlive":3600},"cases":[{"name":"","status":"info","notifications":[],"condition":"a
15+
\u003e 0"}],"message":"Test rule","tags":[],"hasExtendedTitle":false,"type":"log_detection","filters":[],"version":1,"id":"wrh-hm6-4zf","blocking":false,"metadata":{"entities":null,"sources":null},"creationAuthorId":1445416,"creator":{"handle":"frog@datadoghq.com","name":"frog"},"updater":{"handle":"","name":""}}'
16+
headers:
17+
content-type:
18+
- application/json
19+
status:
20+
code: 200
21+
message: OK
22+
- request:
23+
body: null
24+
headers:
25+
accept:
26+
- application/json
27+
method: GET
28+
uri: https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/rules/wrh-hm6-4zf
29+
response:
30+
body:
31+
string: '{"data":[]}'
32+
headers:
33+
content-type:
34+
- application/vnd.api+json
35+
status:
36+
code: 200
37+
message: OK
38+
- request:
39+
body: null
40+
headers:
41+
accept:
42+
- '*/*'
43+
method: DELETE
44+
uri: https://api.datadoghq.com/api/v2/security_monitoring/rules/wrh-hm6-4zf
45+
response:
46+
body:
47+
string: ''
48+
headers: {}
49+
status:
50+
code: 204
51+
message: No Content
52+
version: 1

‎tests/v2/cassettes/test_scenarios/test_get_suppressions_affecting_future_rule_returns_bad_request_response.frozen‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2025-08-30T15:29:48.867Z

‎tests/v2/cassettes/test_scenarios/test_get_suppressions_affecting_future_rule_returns_bad_request_response.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
interactions:
2+
- request:
3+
body: '{"invalid_key":"invalid_value"}'
4+
headers:
5+
accept:
6+
- application/json
7+
content-type:
8+
- application/json
9+
method: POST
10+
uri: https://api.datadoghq.com/api/v2/security_monitoring/configuration/suppressions/rules
11+
response:
12+
body:
13+
string: '{"errors":["invalid_argument(Invalid rule configuration)"]}'
14+
headers:
15+
content-type:
16+
- application/json
17+
status:
18+
code: 400
19+
message: Bad Request
20+
version: 1

0 commit comments

Comments
 (0)