Regenerate client from commit 55b59e4 of spec repo

Author: ci.datadog-api-spec

.generator/schemas/v2/openapi.yaml

@@ -47320,6 +47320,86 @@ components:
           description: The name of the reference table.
           type: string
       type: object
+    SecurityMonitoringRuleAnomalyDetectionOptions:
+      additionalProperties: {}
+      description: Options on anomaly detection method.
+      properties:
+        bucketDuration:
+          $ref: '#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration'
+        detectionTolerance:
+          $ref: '#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance'
+        learningDuration:
+          $ref: '#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration'
+        learningPeriodBaseline:
+          description: An optional override baseline to apply while the rule is in
+            the learning period. Must be greater than or equal to 0.
+          format: int64
+          minimum: 0
+          type: integer
+      type: object
+    SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration:
+      description: 'Duration in seconds of the time buckets used to aggregate events
+        matched by the rule.
+
+        Must be greater than or equal to 300.'
+      enum:
+      - 300
+      - 600
+      - 900
+      - 1800
+      - 3600
+      - 10800
+      example: 300
+      format: int32
+      type: integer
+      x-enum-varnames:
+      - FIVE_MINUTES
+      - TEN_MINUTES
+      - FIFTEEN_MINUTES
+      - THIRTY_MINUTES
+      - ONE_HOUR
+      - THREE_HOURS
+    SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance:
+      description: 'An optional parameter that sets how permissive anomaly detection
+        is.
+
+        Higher values require higher deviations before triggering a signal.'
+      enum:
+      - 1
+      - 2
+      - 3
+      - 4
+      - 5
+      example: 5
+      format: int32
+      type: integer
+      x-enum-varnames:
+      - ONE
+      - TWO
+      - THREE
+      - FOUR
+      - FIVE
+    SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration:
+      description: Learning duration in hours. Anomaly detection waits for at least
+        this amount of historical data before it starts evaluating.
+      enum:
+      - 1
+      - 6
+      - 12
+      - 24
+      - 48
+      - 168
+      - 336
+      format: int32
+      type: integer
+      x-enum-varnames:
+      - ONE_HOUR
+      - SIX_HOURS
+      - TWELVE_HOURS
+      - ONE_DAY
+      - TWO_DAYS
+      - ONE_WEEK
+      - TWO_WEEKS
     SecurityMonitoringRuleCase:
       description: Case when signal is generated.
       properties:
@@ -47685,6 +47765,8 @@ components:
     SecurityMonitoringRuleOptions:
       description: Options.
       properties:
+        anomalyDetectionOptions:
+          $ref: '#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptions'
         complianceRuleOptions:
           $ref: '#/components/schemas/CloudConfigurationComplianceRuleOptions'
         decreaseCriticalityBasedOnEnv:
@@ -55124,6 +55206,8 @@ components:
     ThreatHuntingJobOptions:
       description: Job options.
       properties:
+        anomalyDetectionOptions:
+          $ref: '#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptions'
         detectionMethod:
           $ref: '#/components/schemas/SecurityMonitoringRuleDetectionMethod'
         evaluationWindow:

cassettes/features/v2/security_monitoring/Create-a-detection-rule-with-detection-method-anomaly-detection-returns-OK-response.frozen

@@ -0,0 +1 @@
+2025-12-16T15:19:00.493Z

cassettes/features/v2/security_monitoring/Create-a-detection-rule-with-detection-method-anomaly-detection-returns-OK-response.yml

@@ -0,0 +1,48 @@
+# Create a detection rule with detection method 'anomaly_detection' returns "OK" response
+
+require "datadog_api_client"
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+body = DatadogAPIClient::V2::SecurityMonitoringStandardRuleCreatePayload.new({
+  name: "Example-Security-Monitoring",
+  type: DatadogAPIClient::V2::SecurityMonitoringRuleTypeCreate::LOG_DETECTION,
+  is_enabled: true,
+  queries: [
+    DatadogAPIClient::V2::SecurityMonitoringStandardRuleQuery.new({
+      aggregation: DatadogAPIClient::V2::SecurityMonitoringRuleQueryAggregation::COUNT,
+      data_source: DatadogAPIClient::V2::SecurityMonitoringStandardDataSource::LOGS,
+      distinct_fields: [],
+      group_by_fields: [
+        "@usr.email",
+        "@network.client.ip",
+      ],
+      has_optional_group_by_fields: false,
+      name: "",
+      query: "service:app status:error",
+    }),
+  ],
+  cases: [
+    DatadogAPIClient::V2::SecurityMonitoringRuleCaseCreate.new({
+      name: "",
+      status: DatadogAPIClient::V2::SecurityMonitoringRuleSeverity::INFO,
+      notifications: [],
+      condition: "a > 0.995",
+    }),
+  ],
+  message: "An anomaly detection rule",
+  options: DatadogAPIClient::V2::SecurityMonitoringRuleOptions.new({
+    detection_method: DatadogAPIClient::V2::SecurityMonitoringRuleDetectionMethod::ANOMALY_DETECTION,
+    evaluation_window: DatadogAPIClient::V2::SecurityMonitoringRuleEvaluationWindow::FIFTEEN_MINUTES,
+    keep_alive: DatadogAPIClient::V2::SecurityMonitoringRuleKeepAlive::ONE_HOUR,
+    max_signal_duration: DatadogAPIClient::V2::SecurityMonitoringRuleMaxSignalDuration::ONE_DAY,
+    anomaly_detection_options: DatadogAPIClient::V2::SecurityMonitoringRuleAnomalyDetectionOptions.new({
+      bucket_duration: DatadogAPIClient::V2::SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration::FIVE_MINUTES,
+      learning_duration: DatadogAPIClient::V2::SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration::ONE_DAY,
+      detection_tolerance: DatadogAPIClient::V2::SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance::THREE,
+      learning_period_baseline: 10,
+    }),
+  }),
+  tags: [],
+  filters: [],
+})
+p api_instance.create_security_monitoring_rule(body)

examples/v2/security-monitoring/CreateSecurityMonitoringRule_2323193894.rb

@@ -333,6 +333,20 @@ Feature: Security Monitoring
     And the response "message" is equal to "Test rule"
     And the response "referenceTables" is equal to [{"tableName": "synthetics_test_reference_table_dont_delete", "columnName": "value", "logFieldPath":"testtag", "checkPresence":true, "ruleQueryName":"a"}]
 
+  @team:DataDog/k9-cloud-security-platform
+  Scenario: Create a detection rule with detection method 'anomaly_detection' returns "OK" response
+    Given new "CreateSecurityMonitoringRule" request
+    And body with value {"name":"{{ unique }}","type":"log_detection","isEnabled":true,"queries":[{"aggregation":"count","dataSource":"logs","distinctFields":[],"groupByFields":["@usr.email","@network.client.ip"],"hasOptionalGroupByFields":false,"name":"","query":"service:app status:error"}],"cases":[{"name":"","status":"info","notifications":[],"condition":"a > 0.995"}],"message":"An anomaly detection rule","options":{"detectionMethod":"anomaly_detection","evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400,"anomalyDetectionOptions":{"bucketDuration":300,"learningDuration":24,"detectionTolerance":3,"learningPeriodBaseline":10}},"tags":[],"filters":[]}
+    When the request is sent
+    Then the response status is 200 OK
+    And the response "name" is equal to "{{ unique }}"
+    And the response "type" is equal to "log_detection"
+    And the response "options.detectionMethod" is equal to "anomaly_detection"
+    And the response "options.anomalyDetectionOptions.bucketDuration" is equal to 300
+    And the response "options.anomalyDetectionOptions.learningDuration" is equal to 24
+    And the response "options.anomalyDetectionOptions.learningPeriodBaseline" is equal to 10
+    And the response "options.anomalyDetectionOptions.detectionTolerance" is equal to 3
+
   @team:DataDog/k9-cloud-security-platform
   Scenario: Create a detection rule with detection method 'sequence_detection' returns "OK" response
     Given new "CreateSecurityMonitoringRule" request

features/v2/security_monitoring.feature

@@ -3946,6 +3946,10 @@ def overrides
           "v2.security_monitoring_filter_action" => "SecurityMonitoringFilterAction",
           "v2.security_monitoring_list_rules_response" => "SecurityMonitoringListRulesResponse",
           "v2.security_monitoring_reference_table" => "SecurityMonitoringReferenceTable",
+          "v2.security_monitoring_rule_anomaly_detection_options" => "SecurityMonitoringRuleAnomalyDetectionOptions",
+          "v2.security_monitoring_rule_anomaly_detection_options_bucket_duration" => "SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration",
+          "v2.security_monitoring_rule_anomaly_detection_options_detection_tolerance" => "SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance",
+          "v2.security_monitoring_rule_anomaly_detection_options_learning_duration" => "SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration",
           "v2.security_monitoring_rule_case" => "SecurityMonitoringRuleCase",
           "v2.security_monitoring_rule_case_action" => "SecurityMonitoringRuleCaseAction",
           "v2.security_monitoring_rule_case_action_options" => "SecurityMonitoringRuleCaseActionOptions",

lib/datadog_api_client/inflector.rb

@@ -0,0 +1,155 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Options on anomaly detection method.
+  class SecurityMonitoringRuleAnomalyDetectionOptions
+    include BaseGenericModel
+
+    # Duration in seconds of the time buckets used to aggregate events matched by the rule.
+    # Must be greater than or equal to 300.
+    attr_accessor :bucket_duration
+
+    # An optional parameter that sets how permissive anomaly detection is.
+    # Higher values require higher deviations before triggering a signal.
+    attr_accessor :detection_tolerance
+
+    # Learning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating.
+    attr_accessor :learning_duration
+
+    # An optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0.
+    attr_reader :learning_period_baseline
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'bucket_duration' => :'bucketDuration',
+        :'detection_tolerance' => :'detectionTolerance',
+        :'learning_duration' => :'learningDuration',
+        :'learning_period_baseline' => :'learningPeriodBaseline'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'bucket_duration' => :'SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration',
+        :'detection_tolerance' => :'SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance',
+        :'learning_duration' => :'SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration',
+        :'learning_period_baseline' => :'Integer'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::SecurityMonitoringRuleAnomalyDetectionOptions` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'bucket_duration')
+        self.bucket_duration = attributes[:'bucket_duration']
+      end
+
+      if attributes.key?(:'detection_tolerance')
+        self.detection_tolerance = attributes[:'detection_tolerance']
+      end
+
+      if attributes.key?(:'learning_duration')
+        self.learning_duration = attributes[:'learning_duration']
+      end
+
+      if attributes.key?(:'learning_period_baseline')
+        self.learning_period_baseline = attributes[:'learning_period_baseline']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if !@learning_period_baseline.nil? && @learning_period_baseline < 0
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param learning_period_baseline [Object] Object to be assigned
+    # @!visibility private
+    def learning_period_baseline=(learning_period_baseline)
+      if !learning_period_baseline.nil? && learning_period_baseline < 0
+        fail ArgumentError, 'invalid value for "learning_period_baseline", must be greater than or equal to 0.'
+      end
+      @learning_period_baseline = learning_period_baseline
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          bucket_duration == o.bucket_duration &&
+          detection_tolerance == o.detection_tolerance &&
+          learning_duration == o.learning_duration &&
+          learning_period_baseline == o.learning_period_baseline &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [bucket_duration, detection_tolerance, learning_duration, learning_period_baseline, additional_properties].hash
+    end
+  end
+end