@@ -4,6 +4,13 @@ components:
44 headers: {}
55 links: {}
66 parameters:
7+ SignalID:
8+ description: The ID of the signal.
9+ in: path
10+ name: signal_id
11+ required: true
12+ schema:
13+ type: string
714 SlackAccountNamePathParameter:
815 description: Your Slack account name.
916 in: path
@@ -360,6 +367,23 @@ components:
360367 - ADMIN
361368 - READ_ONLY
362369 - ERROR
370+ AddSignalToIncidentRequest:
371+ description: Attributes describing which incident to add the signal to.
372+ properties:
373+ add_to_signal_timeline:
374+ description: Whether to post the signal on the incident timeline.
375+ type: boolean
376+ incident_id:
377+ description: Public ID attribute of the incident to which the signal will
378+ be added.
379+ example: 2066
380+ format: int64
381+ type: integer
382+ version:
383+ $ref: '#/components/schemas/Version'
384+ required:
385+ - incident_id
386+ type: object
363387 AgentCheck:
364388 description: Array of strings.
365389 example:
@@ -9766,6 +9790,59 @@ components:
97669790 type: string
97679791 x-enum-varnames:
97689792 - TRACE_SERVICE
9793+ SignalArchiveReason:
9794+ description: Reason why a signal has been archived.
9795+ enum:
9796+ - none
9797+ - false_positive
9798+ - testing_or_maintenance
9799+ - other
9800+ type: string
9801+ x-enum-varnames:
9802+ - NONE
9803+ - FALSE_POSITIVE
9804+ - TESTING_OR_MAINTENANCE
9805+ - OTHER
9806+ SignalAssigneeUpdateRequest:
9807+ description: Attributes describing an assignee update operation over a security
9808+ signal.
9809+ properties:
9810+ assignee:
9811+ description: The UUID of the user being assigned. Use empty string to return
9812+ signal to unassigned.
9813+ example: 773b045d-ccf8-4808-bd3b-955ef6a8c940
9814+ type: string
9815+ version:
9816+ $ref: '#/components/schemas/Version'
9817+ required:
9818+ - assignee
9819+ type: object
9820+ SignalStateUpdateRequest:
9821+ description: Attributes describing the change of state for a given state.
9822+ properties:
9823+ archiveComment:
9824+ description: Optional comment to explain why a signal is being archived.
9825+ type: string
9826+ archiveReason:
9827+ $ref: '#/components/schemas/SignalArchiveReason'
9828+ state:
9829+ $ref: '#/components/schemas/SignalTriageState'
9830+ version:
9831+ $ref: '#/components/schemas/Version'
9832+ required:
9833+ - state
9834+ type: object
9835+ SignalTriageState:
9836+ description: The new triage state of the signal.
9837+ enum:
9838+ - open
9839+ - archived
9840+ - under_review
9841+ type: string
9842+ x-enum-varnames:
9843+ - OPEN
9844+ - ARCHIVED
9845+ - UNDER_REVIEW
97699846 SlackIntegrationChannel:
97709847 description: The Slack channel configuration.
97719848 properties:
@@ -9814,6 +9891,13 @@ components:
98149891 items:
98159892 $ref: '#/components/schemas/SlackIntegrationChannel'
98169893 type: array
9894+ SuccessfulSignalUpdateResponse:
9895+ description: Updated signal data following a successfully performed update.
9896+ properties:
9897+ status:
9898+ description: Status of the response.
9899+ type: string
9900+ type: object
98179901 SunburstWidgetDefinition:
98189902 description: Sunbursts are spot on to highlight how groups contribute to the
98199903 total of a query.
@@ -15717,6 +15801,11 @@ components:
1571715801 user:
1571815802 $ref: '#/components/schemas/User'
1571915803 type: object
15804+ Version:
15805+ description: Version of the updated signal. If server side version is higher,
15806+ update will be rejected.
15807+ format: int64
15808+ type: integer
1572015809 WebhooksIntegration:
1572115810 description: Datadog-Webhooks integration.
1572215811 properties:
@@ -16636,6 +16725,8 @@ components:
1663616725 downtimes.
1663716726 monitors_read: View monitors.
1663816727 monitors_write: Edit, mute, and delete individual monitors.
16728+ security_monitoring_signals_read: View Security Signals.
16729+ security_monitoring_signals_write: Modify Security Signals.
1663916730 synthetics_global_variable_read: View, search, and use in tests the list
1664016731 of global variables available for Synthetics.
1664116732 synthetics_global_variable_write: Create, edit, and delete global variables
@@ -23207,6 +23298,161 @@ paths:
2320723298 x-menu-order: 4
2320823299 x-undo:
2320923300 type: safe
23301+ /api/v1/security_analytics/signals/{signal_id}/add_to_incident:
23302+ patch:
23303+ description: Add a security signal to an incident. This makes it possible to
23304+ search for signals by incident within the signal explorer and to view the
23305+ signals on the incident timeline.
23306+ operationId: AddSecurityMonitoringSignalToIncident
23307+ parameters:
23308+ - $ref: '#/components/parameters/SignalID'
23309+ requestBody:
23310+ content:
23311+ application/json:
23312+ schema:
23313+ $ref: '#/components/schemas/AddSignalToIncidentRequest'
23314+ description: Attributes describing the signal update.
23315+ required: true
23316+ responses:
23317+ '200':
23318+ content:
23319+ application/json:
23320+ schema:
23321+ $ref: '#/components/schemas/SuccessfulSignalUpdateResponse'
23322+ description: OK
23323+ '400':
23324+ content:
23325+ application/json:
23326+ schema:
23327+ $ref: '#/components/schemas/APIErrorResponse'
23328+ description: Bad Request
23329+ '403':
23330+ content:
23331+ application/json:
23332+ schema:
23333+ $ref: '#/components/schemas/APIErrorResponse'
23334+ description: Forbidden
23335+ '404':
23336+ content:
23337+ application/json:
23338+ schema:
23339+ $ref: '#/components/schemas/APIErrorResponse'
23340+ description: Not Found
23341+ '429':
23342+ $ref: '#/components/responses/TooManyRequestsResponse'
23343+ security:
23344+ - AuthZ:
23345+ - security_monitoring_signals_write
23346+ apiKeyAuth: []
23347+ appKeyAuth: []
23348+ summary: Add a security signal to an incident
23349+ tags:
23350+ - Security Monitoring
23351+ x-codegen-request-body-name: body
23352+ x-undo:
23353+ type: idempotent
23354+ /api/v1/security_analytics/signals/{signal_id}/assignee:
23355+ patch:
23356+ description: Modify the triage assignee of a security signal.
23357+ operationId: EditSecurityMonitoringSignalAssignee
23358+ parameters:
23359+ - $ref: '#/components/parameters/SignalID'
23360+ requestBody:
23361+ content:
23362+ application/json:
23363+ schema:
23364+ $ref: '#/components/schemas/SignalAssigneeUpdateRequest'
23365+ description: Attributes describing the signal update.
23366+ required: true
23367+ responses:
23368+ '200':
23369+ content:
23370+ application/json:
23371+ schema:
23372+ $ref: '#/components/schemas/SuccessfulSignalUpdateResponse'
23373+ description: OK
23374+ '400':
23375+ content:
23376+ application/json:
23377+ schema:
23378+ $ref: '#/components/schemas/APIErrorResponse'
23379+ description: Bad Request
23380+ '403':
23381+ content:
23382+ application/json:
23383+ schema:
23384+ $ref: '#/components/schemas/APIErrorResponse'
23385+ description: Forbidden
23386+ '404':
23387+ content:
23388+ application/json:
23389+ schema:
23390+ $ref: '#/components/schemas/APIErrorResponse'
23391+ description: Not Found
23392+ '429':
23393+ $ref: '#/components/responses/TooManyRequestsResponse'
23394+ security:
23395+ - AuthZ:
23396+ - security_monitoring_signals_write
23397+ apiKeyAuth: []
23398+ appKeyAuth: []
23399+ summary: Modify the triage assignee of a security signal
23400+ tags:
23401+ - Security Monitoring
23402+ x-codegen-request-body-name: body
23403+ x-undo:
23404+ type: idempotent
23405+ /api/v1/security_analytics/signals/{signal_id}/state:
23406+ patch:
23407+ description: Change the triage state of a security signal.
23408+ operationId: EditSecurityMonitoringSignalState
23409+ parameters:
23410+ - $ref: '#/components/parameters/SignalID'
23411+ requestBody:
23412+ content:
23413+ application/json:
23414+ schema:
23415+ $ref: '#/components/schemas/SignalStateUpdateRequest'
23416+ description: Attributes describing the signal update.
23417+ required: true
23418+ responses:
23419+ '200':
23420+ content:
23421+ application/json:
23422+ schema:
23423+ $ref: '#/components/schemas/SuccessfulSignalUpdateResponse'
23424+ description: OK
23425+ '400':
23426+ content:
23427+ application/json:
23428+ schema:
23429+ $ref: '#/components/schemas/APIErrorResponse'
23430+ description: Bad Request
23431+ '403':
23432+ content:
23433+ application/json:
23434+ schema:
23435+ $ref: '#/components/schemas/APIErrorResponse'
23436+ description: Forbidden
23437+ '404':
23438+ content:
23439+ application/json:
23440+ schema:
23441+ $ref: '#/components/schemas/APIErrorResponse'
23442+ description: Not Found
23443+ '429':
23444+ $ref: '#/components/responses/TooManyRequestsResponse'
23445+ security:
23446+ - AuthZ:
23447+ - security_monitoring_signals_write
23448+ apiKeyAuth: []
23449+ appKeyAuth: []
23450+ summary: Change the triage state of a security signal
23451+ tags:
23452+ - Security Monitoring
23453+ x-codegen-request-body-name: body
23454+ x-undo:
23455+ type: idempotent
2321023456 /api/v1/series:
2321123457 post:
2321223458 description: "The metrics end-point allows you to post time-series data that
@@ -28461,6 +28707,10 @@ tags:
2846128707 externalDocs:
2846228708 url: https://docs.datadoghq.com/api/?lang=bash#integration-pagerduty
2846328709 name: PagerDuty Integration
28710+ - description: 'Detection rules for generating signals and listing of generated
28711+
28712+ signals.'
28713+ name: Security Monitoring
2846428714- description: 'The service check endpoint allows you to post check statuses for use
2846528715 with monitors.
2846628716
0 commit comments