Skip to content

Commit 7fb6e21

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Add anomaly detection options to security monitoring rules (#3017)
Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
1 parent 4380813 commit 7fb6e21

13 files changed

+579
-0
lines changed

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47320,6 +47320,86 @@ components:
4732047320
description: The name of the reference table.
4732147321
type: string
4732247322
type: object
47323+
SecurityMonitoringRuleAnomalyDetectionOptions:
47324+
additionalProperties: {}
47325+
description: Options on anomaly detection method.
47326+
properties:
47327+
bucketDuration:
47328+
$ref: '#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration'
47329+
detectionTolerance:
47330+
$ref: '#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance'
47331+
learningDuration:
47332+
$ref: '#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration'
47333+
learningPeriodBaseline:
47334+
description: An optional override baseline to apply while the rule is in
47335+
the learning period. Must be greater than or equal to 0.
47336+
format: int64
47337+
minimum: 0
47338+
type: integer
47339+
type: object
47340+
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration:
47341+
description: 'Duration in seconds of the time buckets used to aggregate events
47342+
matched by the rule.
47343+
47344+
Must be greater than or equal to 300.'
47345+
enum:
47346+
- 300
47347+
- 600
47348+
- 900
47349+
- 1800
47350+
- 3600
47351+
- 10800
47352+
example: 300
47353+
format: int32
47354+
type: integer
47355+
x-enum-varnames:
47356+
- FIVE_MINUTES
47357+
- TEN_MINUTES
47358+
- FIFTEEN_MINUTES
47359+
- THIRTY_MINUTES
47360+
- ONE_HOUR
47361+
- THREE_HOURS
47362+
SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance:
47363+
description: 'An optional parameter that sets how permissive anomaly detection
47364+
is.
47365+
47366+
Higher values require higher deviations before triggering a signal.'
47367+
enum:
47368+
- 1
47369+
- 2
47370+
- 3
47371+
- 4
47372+
- 5
47373+
example: 5
47374+
format: int32
47375+
type: integer
47376+
x-enum-varnames:
47377+
- ONE
47378+
- TWO
47379+
- THREE
47380+
- FOUR
47381+
- FIVE
47382+
SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration:
47383+
description: Learning duration in hours. Anomaly detection waits for at least
47384+
this amount of historical data before it starts evaluating.
47385+
enum:
47386+
- 1
47387+
- 6
47388+
- 12
47389+
- 24
47390+
- 48
47391+
- 168
47392+
- 336
47393+
format: int32
47394+
type: integer
47395+
x-enum-varnames:
47396+
- ONE_HOUR
47397+
- SIX_HOURS
47398+
- TWELVE_HOURS
47399+
- ONE_DAY
47400+
- TWO_DAYS
47401+
- ONE_WEEK
47402+
- TWO_WEEKS
4732347403
SecurityMonitoringRuleCase:
4732447404
description: Case when signal is generated.
4732547405
properties:
@@ -47685,6 +47765,8 @@ components:
4768547765
SecurityMonitoringRuleOptions:
4768647766
description: Options.
4768747767
properties:
47768+
anomalyDetectionOptions:
47769+
$ref: '#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptions'
4768847770
complianceRuleOptions:
4768947771
$ref: '#/components/schemas/CloudConfigurationComplianceRuleOptions'
4769047772
decreaseCriticalityBasedOnEnv:
@@ -55124,6 +55206,8 @@ components:
5512455206
ThreatHuntingJobOptions:
5512555207
description: Job options.
5512655208
properties:
55209+
anomalyDetectionOptions:
55210+
$ref: '#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptions'
5512755211
detectionMethod:
5512855212
$ref: '#/components/schemas/SecurityMonitoringRuleDetectionMethod'
5512955213
evaluationWindow:

‎docs/datadog_api_client.v2.model.rst‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21032,6 +21032,34 @@ datadog\_api\_client.v2.model.security\_monitoring\_reference\_table module
2103221032
:members:
2103321033
:show-inheritance:
2103421034

21035+
datadog\_api\_client.v2.model.security\_monitoring\_rule\_anomaly\_detection\_options module
21036+
--------------------------------------------------------------------------------------------
21037+
21038+
.. automodule:: datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options
21039+
:members:
21040+
:show-inheritance:
21041+
21042+
datadog\_api\_client.v2.model.security\_monitoring\_rule\_anomaly\_detection\_options\_bucket\_duration module
21043+
--------------------------------------------------------------------------------------------------------------
21044+
21045+
.. automodule:: datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options_bucket_duration
21046+
:members:
21047+
:show-inheritance:
21048+
21049+
datadog\_api\_client.v2.model.security\_monitoring\_rule\_anomaly\_detection\_options\_detection\_tolerance module
21050+
------------------------------------------------------------------------------------------------------------------
21051+
21052+
.. automodule:: datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options_detection_tolerance
21053+
:members:
21054+
:show-inheritance:
21055+
21056+
datadog\_api\_client.v2.model.security\_monitoring\_rule\_anomaly\_detection\_options\_learning\_duration module
21057+
----------------------------------------------------------------------------------------------------------------
21058+
21059+
.. automodule:: datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options_learning_duration
21060+
:members:
21061+
:show-inheritance:
21062+
2103521063
datadog\_api\_client.v2.model.security\_monitoring\_rule\_case module
2103621064
---------------------------------------------------------------------
2103721065

‎examples/v2/security-monitoring/CreateSecurityMonitoringRule_2323193894.py‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
"""
2+
Create a detection rule with detection method 'anomaly_detection' returns "OK" response
3+
"""
4+
5+
from datadog_api_client import ApiClient, Configuration
6+
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
7+
from datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options import (
8+
SecurityMonitoringRuleAnomalyDetectionOptions,
9+
)
10+
from datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options_bucket_duration import (
11+
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration,
12+
)
13+
from datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options_detection_tolerance import (
14+
SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance,
15+
)
16+
from datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options_learning_duration import (
17+
SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration,
18+
)
19+
from datadog_api_client.v2.model.security_monitoring_rule_case_create import SecurityMonitoringRuleCaseCreate
20+
from datadog_api_client.v2.model.security_monitoring_rule_detection_method import SecurityMonitoringRuleDetectionMethod
21+
from datadog_api_client.v2.model.security_monitoring_rule_evaluation_window import (
22+
SecurityMonitoringRuleEvaluationWindow,
23+
)
24+
from datadog_api_client.v2.model.security_monitoring_rule_keep_alive import SecurityMonitoringRuleKeepAlive
25+
from datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration import (
26+
SecurityMonitoringRuleMaxSignalDuration,
27+
)
28+
from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions
29+
from datadog_api_client.v2.model.security_monitoring_rule_query_aggregation import (
30+
SecurityMonitoringRuleQueryAggregation,
31+
)
32+
from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity
33+
from datadog_api_client.v2.model.security_monitoring_rule_type_create import SecurityMonitoringRuleTypeCreate
34+
from datadog_api_client.v2.model.security_monitoring_standard_data_source import SecurityMonitoringStandardDataSource
35+
from datadog_api_client.v2.model.security_monitoring_standard_rule_create_payload import (
36+
SecurityMonitoringStandardRuleCreatePayload,
37+
)
38+
from datadog_api_client.v2.model.security_monitoring_standard_rule_query import SecurityMonitoringStandardRuleQuery
39+
40+
body = SecurityMonitoringStandardRuleCreatePayload(
41+
name="Example-Security-Monitoring",
42+
type=SecurityMonitoringRuleTypeCreate.LOG_DETECTION,
43+
is_enabled=True,
44+
queries=[
45+
SecurityMonitoringStandardRuleQuery(
46+
aggregation=SecurityMonitoringRuleQueryAggregation.COUNT,
47+
data_source=SecurityMonitoringStandardDataSource.LOGS,
48+
distinct_fields=[],
49+
group_by_fields=[
50+
"@usr.email",
51+
"@network.client.ip",
52+
],
53+
has_optional_group_by_fields=False,
54+
name="",
55+
query="service:app status:error",
56+
),
57+
],
58+
cases=[
59+
SecurityMonitoringRuleCaseCreate(
60+
name="",
61+
status=SecurityMonitoringRuleSeverity.INFO,
62+
notifications=[],
63+
condition="a > 0.995",
64+
),
65+
],
66+
message="An anomaly detection rule",
67+
options=SecurityMonitoringRuleOptions(
68+
detection_method=SecurityMonitoringRuleDetectionMethod.ANOMALY_DETECTION,
69+
evaluation_window=SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES,
70+
keep_alive=SecurityMonitoringRuleKeepAlive.ONE_HOUR,
71+
max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.ONE_DAY,
72+
anomaly_detection_options=SecurityMonitoringRuleAnomalyDetectionOptions(
73+
bucket_duration=SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration.FIVE_MINUTES,
74+
learning_duration=SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration.ONE_DAY,
75+
detection_tolerance=SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance.THREE,
76+
learning_period_baseline=10,
77+
),
78+
),
79+
tags=[],
80+
filters=[],
81+
)
82+
83+
configuration = Configuration()
84+
with ApiClient(configuration) as api_client:
85+
api_instance = SecurityMonitoringApi(api_client)
86+
response = api_instance.create_security_monitoring_rule(body=body)
87+
88+
print(response)

‎src/datadog_api_client/v2/model/security_monitoring_rule_anomaly_detection_options.py‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
2+
# This product includes software developed at Datadog (https://www.datadoghq.com/).
3+
# Copyright 2019-Present Datadog, Inc.
4+
from __future__ import annotations
5+
6+
from typing import Union, TYPE_CHECKING
7+
8+
from datadog_api_client.model_utils import (
9+
ModelNormal,
10+
cached_property,
11+
unset,
12+
UnsetType,
13+
)
14+
15+
16+
if TYPE_CHECKING:
17+
from datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options_bucket_duration import (
18+
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration,
19+
)
20+
from datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options_detection_tolerance import (
21+
SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance,
22+
)
23+
from datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options_learning_duration import (
24+
SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration,
25+
)
26+
27+
28+
class SecurityMonitoringRuleAnomalyDetectionOptions(ModelNormal):
29+
validations = {
30+
"learning_period_baseline": {
31+
"inclusive_minimum": 0,
32+
},
33+
}
34+
35+
@cached_property
36+
def openapi_types(_):
37+
from datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options_bucket_duration import (
38+
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration,
39+
)
40+
from datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options_detection_tolerance import (
41+
SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance,
42+
)
43+
from datadog_api_client.v2.model.security_monitoring_rule_anomaly_detection_options_learning_duration import (
44+
SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration,
45+
)
46+
47+
return {
48+
"bucket_duration": (SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration,),
49+
"detection_tolerance": (SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance,),
50+
"learning_duration": (SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration,),
51+
"learning_period_baseline": (int,),
52+
}
53+
54+
attribute_map = {
55+
"bucket_duration": "bucketDuration",
56+
"detection_tolerance": "detectionTolerance",
57+
"learning_duration": "learningDuration",
58+
"learning_period_baseline": "learningPeriodBaseline",
59+
}
60+
61+
def __init__(
62+
self_,
63+
bucket_duration: Union[SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration, UnsetType] = unset,
64+
detection_tolerance: Union[SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance, UnsetType] = unset,
65+
learning_duration: Union[SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration, UnsetType] = unset,
66+
learning_period_baseline: Union[int, UnsetType] = unset,
67+
**kwargs,
68+
):
69+
"""
70+
Options on anomaly detection method.
71+
72+
:param bucket_duration: Duration in seconds of the time buckets used to aggregate events matched by the rule.
73+
Must be greater than or equal to 300.
74+
:type bucket_duration: SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration, optional
75+
76+
:param detection_tolerance: An optional parameter that sets how permissive anomaly detection is.
77+
Higher values require higher deviations before triggering a signal.
78+
:type detection_tolerance: SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance, optional
79+
80+
:param learning_duration: Learning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating.
81+
:type learning_duration: SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration, optional
82+
83+
:param learning_period_baseline: An optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0.
84+
:type learning_period_baseline: int, optional
85+
"""
86+
if bucket_duration is not unset:
87+
kwargs["bucket_duration"] = bucket_duration
88+
if detection_tolerance is not unset:
89+
kwargs["detection_tolerance"] = detection_tolerance
90+
if learning_duration is not unset:
91+
kwargs["learning_duration"] = learning_duration
92+
if learning_period_baseline is not unset:
93+
kwargs["learning_period_baseline"] = learning_period_baseline
94+
super().__init__(kwargs)

‎src/datadog_api_client/v2/model/security_monitoring_rule_anomaly_detection_options_bucket_duration.py‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
2+
# This product includes software developed at Datadog (https://www.datadoghq.com/).
3+
# Copyright 2019-Present Datadog, Inc.
4+
from __future__ import annotations
5+
6+
7+
from datadog_api_client.model_utils import (
8+
ModelSimple,
9+
cached_property,
10+
)
11+
12+
from typing import ClassVar
13+
14+
15+
class SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration(ModelSimple):
16+
"""
17+
Duration in seconds of the time buckets used to aggregate events matched by the rule.
18+
Must be greater than or equal to 300.
19+
20+
:param value: Must be one of [300, 600, 900, 1800, 3600, 10800].
21+
:type value: int
22+
"""
23+
24+
allowed_values = {
25+
300,
26+
600,
27+
900,
28+
1800,
29+
3600,
30+
10800,
31+
}
32+
FIVE_MINUTES: ClassVar["SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration"]
33+
TEN_MINUTES: ClassVar["SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration"]
34+
FIFTEEN_MINUTES: ClassVar["SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration"]
35+
THIRTY_MINUTES: ClassVar["SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration"]
36+
ONE_HOUR: ClassVar["SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration"]
37+
THREE_HOURS: ClassVar["SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration"]
38+
39+
@cached_property
40+
def openapi_types(_):
41+
return {
42+
"value": (int,),
43+
}
44+
45+
46+
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration.FIVE_MINUTES = (
47+
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration(300)
48+
)
49+
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration.TEN_MINUTES = (
50+
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration(600)
51+
)
52+
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration.FIFTEEN_MINUTES = (
53+
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration(900)
54+
)
55+
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration.THIRTY_MINUTES = (
56+
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration(1800)
57+
)
58+
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration.ONE_HOUR = (
59+
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration(3600)
60+
)
61+
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration.THREE_HOURS = (
62+
SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration(10800)
63+
)

0 commit comments

Comments
 (0)