Skip to content

Commit aa94b13

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Add user behavior case actions in API spec (#2796)
Co-authored-by: ci.datadog-api-spec <[email protected]>
1 parent 18a55e6 commit aa94b13

8 files changed

+66
-24
lines changed

‎.apigentools-info

+4-4
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
"spec_versions": {
55
"v1": {
66
"apigentools_version": "1.6.6",
7-
"regenerated": "2025-04-10 11:41:55.216291",
8-
"spec_repo_commit": "7f98e0a9"
7+
"regenerated": "2025-04-10 18:01:22.406444",
8+
"spec_repo_commit": "c0a45137"
99
},
1010
"v2": {
1111
"apigentools_version": "1.6.6",
12-
"regenerated": "2025-04-10 11:41:55.232985",
13-
"spec_repo_commit": "7f98e0a9"
12+
"regenerated": "2025-04-10 18:01:22.422014",
13+
"spec_repo_commit": "c0a45137"
1414
}
1515
}
1616
}

‎.generator/schemas/v2/openapi.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -27215,6 +27215,7 @@ components:
2721527215
$ref: '#/components/schemas/SecurityMonitoringRuleCaseActionType'
2721627216
type: object
2721727217
SecurityMonitoringRuleCaseActionOptions:
27218+
additionalProperties: {}
2721827219
description: Options for the rule action
2721927220
properties:
2722027221
duration:
@@ -27223,16 +27224,24 @@ components:
2722327224
format: int64
2722427225
minimum: 0
2722527226
type: integer
27227+
userBehaviorName:
27228+
$ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsUserBehaviorName'
2722627229
type: object
27230+
SecurityMonitoringRuleCaseActionOptionsUserBehaviorName:
27231+
description: Used with the case action of type 'user_behavior'. The value specified
27232+
in this field is applied as a risk tag to all users affected by the rule.
27233+
type: string
2722727234
SecurityMonitoringRuleCaseActionType:
2722827235
description: The action type.
2722927236
enum:
2723027237
- block_ip
2723127238
- block_user
27239+
- user_behavior
2723227240
type: string
2723327241
x-enum-varnames:
2723427242
- BLOCK_IP
2723527243
- BLOCK_USER
27244+
- USER_BEHAVIOR
2723627245
SecurityMonitoringRuleCaseCreate:
2723727246
description: Case when signal is generated.
2723827247
properties:

‎examples/v2/security-monitoring/CreateSecurityMonitoringRule_1965169892.java

+7-2
Original file line numberDiff line numberDiff line change
@@ -45,12 +45,17 @@ public static void main(String[] args) {
4545
.status(SecurityMonitoringRuleSeverity.INFO)
4646
.condition("a > 100000")
4747
.actions(
48-
Collections.singletonList(
48+
Arrays.asList(
4949
new SecurityMonitoringRuleCaseAction()
5050
.type(SecurityMonitoringRuleCaseActionType.BLOCK_IP)
5151
.options(
5252
new SecurityMonitoringRuleCaseActionOptions()
53-
.duration(900L))))))
53+
.duration(900L)),
54+
new SecurityMonitoringRuleCaseAction()
55+
.type(SecurityMonitoringRuleCaseActionType.USER_BEHAVIOR)
56+
.options(
57+
new SecurityMonitoringRuleCaseActionOptions()
58+
.userBehaviorName("behavior"))))))
5459
.options(
5560
new SecurityMonitoringRuleOptions()
5661
.keepAlive(SecurityMonitoringRuleKeepAlive.ONE_HOUR)

‎src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseActionOptions.java

+33-2
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,20 @@
1717
import java.util.Objects;
1818

1919
/** Options for the rule action */
20-
@JsonPropertyOrder({SecurityMonitoringRuleCaseActionOptions.JSON_PROPERTY_DURATION})
20+
@JsonPropertyOrder({
21+
SecurityMonitoringRuleCaseActionOptions.JSON_PROPERTY_DURATION,
22+
SecurityMonitoringRuleCaseActionOptions.JSON_PROPERTY_USER_BEHAVIOR_NAME
23+
})
2124
@jakarta.annotation.Generated(
2225
value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator")
2326
public class SecurityMonitoringRuleCaseActionOptions {
2427
@JsonIgnore public boolean unparsed = false;
2528
public static final String JSON_PROPERTY_DURATION = "duration";
2629
private Long duration;
2730

31+
public static final String JSON_PROPERTY_USER_BEHAVIOR_NAME = "userBehaviorName";
32+
private String userBehaviorName;
33+
2834
public SecurityMonitoringRuleCaseActionOptions duration(Long duration) {
2935
this.duration = duration;
3036
return this;
@@ -46,6 +52,28 @@ public void setDuration(Long duration) {
4652
this.duration = duration;
4753
}
4854

55+
public SecurityMonitoringRuleCaseActionOptions userBehaviorName(String userBehaviorName) {
56+
this.userBehaviorName = userBehaviorName;
57+
return this;
58+
}
59+
60+
/**
61+
* Used with the case action of type 'user_behavior'. The value specified in this field is applied
62+
* as a risk tag to all users affected by the rule.
63+
*
64+
* @return userBehaviorName
65+
*/
66+
@jakarta.annotation.Nullable
67+
@JsonProperty(JSON_PROPERTY_USER_BEHAVIOR_NAME)
68+
@JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
69+
public String getUserBehaviorName() {
70+
return userBehaviorName;
71+
}
72+
73+
public void setUserBehaviorName(String userBehaviorName) {
74+
this.userBehaviorName = userBehaviorName;
75+
}
76+
4977
/**
5078
* A container for additional, undeclared properties. This is a holder for any undeclared
5179
* properties as specified with the 'additionalProperties' keyword in the OAS document.
@@ -104,21 +132,24 @@ public boolean equals(Object o) {
104132
SecurityMonitoringRuleCaseActionOptions securityMonitoringRuleCaseActionOptions =
105133
(SecurityMonitoringRuleCaseActionOptions) o;
106134
return Objects.equals(this.duration, securityMonitoringRuleCaseActionOptions.duration)
135+
&& Objects.equals(
136+
this.userBehaviorName, securityMonitoringRuleCaseActionOptions.userBehaviorName)
107137
&& Objects.equals(
108138
this.additionalProperties,
109139
securityMonitoringRuleCaseActionOptions.additionalProperties);
110140
}
111141

112142
@Override
113143
public int hashCode() {
114-
return Objects.hash(duration, additionalProperties);
144+
return Objects.hash(duration, userBehaviorName, additionalProperties);
115145
}
116146

117147
@Override
118148
public String toString() {
119149
StringBuilder sb = new StringBuilder();
120150
sb.append("class SecurityMonitoringRuleCaseActionOptions {\n");
121151
sb.append(" duration: ").append(toIndentedString(duration)).append("\n");
152+
sb.append(" userBehaviorName: ").append(toIndentedString(userBehaviorName)).append("\n");
122153
sb.append(" additionalProperties: ")
123154
.append(toIndentedString(additionalProperties))
124155
.append("\n");

‎src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseActionType.java

+3-1
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,14 @@
2525
public class SecurityMonitoringRuleCaseActionType extends ModelEnum<String> {
2626

2727
private static final Set<String> allowedValues =
28-
new HashSet<String>(Arrays.asList("block_ip", "block_user"));
28+
new HashSet<String>(Arrays.asList("block_ip", "block_user", "user_behavior"));
2929

3030
public static final SecurityMonitoringRuleCaseActionType BLOCK_IP =
3131
new SecurityMonitoringRuleCaseActionType("block_ip");
3232
public static final SecurityMonitoringRuleCaseActionType BLOCK_USER =
3333
new SecurityMonitoringRuleCaseActionType("block_user");
34+
public static final SecurityMonitoringRuleCaseActionType USER_BEHAVIOR =
35+
new SecurityMonitoringRuleCaseActionType("user_behavior");
3436

3537
SecurityMonitoringRuleCaseActionType(String value) {
3638
super(value, allowedValues);

‎src/test/resources/cassettes/features/v2/Create_a_detection_rule_with_type_application_security_returns_OK_response.freeze

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2025-02-06T16:50:39.787Z
1+
2025-04-09T15:02:05.047Z

‎src/test/resources/cassettes/features/v2/Create_a_detection_rule_with_type_application_security_returns_OK_response.json

+8-13
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"httpRequest": {
44
"body": {
55
"type": "JSON",
6-
"json": "{\"cases\":[{\"actions\":[{\"options\":{\"duration\":900},\"type\":\"block_ip\"}],\"condition\":\"a > 100000\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"groupSignalsBy\":[\"service\"],\"isEnabled\":true,\"message\":\"Test rule\",\"name\":\"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1738860639_appsec_rule\",\"options\":{\"detectionMethod\":\"threshold\",\"evaluationWindow\":900,\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[\"service\",\"@http.client_ip\"],\"query\":\"@appsec.security_activity:business_logic.users.login.failure\"}],\"tags\":[],\"type\":\"application_security\"}"
6+
"json": "{\"cases\":[{\"actions\":[{\"options\":{\"duration\":900},\"type\":\"block_ip\"},{\"options\":{\"userBehaviorName\":\"behavior\"},\"type\":\"user_behavior\"}],\"condition\":\"a > 100000\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"groupSignalsBy\":[\"service\"],\"isEnabled\":true,\"message\":\"Test rule\",\"name\":\"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1744210925_appsec_rule\",\"options\":{\"detectionMethod\":\"threshold\",\"evaluationWindow\":900,\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[\"service\",\"@http.client_ip\"],\"query\":\"@appsec.security_activity:business_logic.users.login.failure\"}],\"tags\":[],\"type\":\"application_security\"}"
77
},
88
"headers": {},
99
"method": "POST",
@@ -12,7 +12,7 @@
1212
"secure": true
1313
},
1414
"httpResponse": {
15-
"body": "{\"name\":\"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1738860639_appsec_rule\",\"createdAt\":1738860640426,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isBeta\":false,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"@appsec.security_activity:business_logic.users.login.failure\",\"groupByFields\":[\"service\",\"@http.client_ip\"],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\",\"dataSource\":\"app_sec_spans\"}],\"options\":{\"evaluationWindow\":900,\"detectionMethod\":\"threshold\",\"maxSignalDuration\":86400,\"keepAlive\":3600},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a \\u003e 100000\",\"actions\":[{\"type\":\"block_ip\",\"options\":{\"duration\":900}}]}],\"message\":\"Test rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"application_security\",\"filters\":[],\"version\":1,\"id\":\"rfn-h2v-udr\",\"blocking\":true,\"groupSignalsBy\":[\"service\"],\"casesActions\":[[{\"type\":\"block_ip\",\"options\":{\"duration\":900}}]],\"dependencies\":[\"business_logic.users.login.failure\"],\"metadata\":{\"entities\":null,\"sources\":null},\"creator\":{\"handle\":\"\",\"name\":\"\"},\"updater\":{\"handle\":\"\",\"name\":\"\"}}",
15+
"body": "{\"name\":\"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1744210925_appsec_rule\",\"createdAt\":1744210925675,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isBeta\":false,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"@appsec.security_activity:business_logic.users.login.failure\",\"groupByFields\":[\"service\",\"@http.client_ip\"],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\",\"dataSource\":\"app_sec_spans\"}],\"options\":{\"evaluationWindow\":900,\"detectionMethod\":\"threshold\",\"maxSignalDuration\":86400,\"keepAlive\":3600},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a \\u003e 100000\",\"actions\":[{\"type\":\"block_ip\",\"options\":{\"duration\":900}},{\"type\":\"user_behavior\",\"options\":{\"userBehaviorName\":\"behavior\"}}]}],\"message\":\"Test rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"application_security\",\"filters\":[],\"version\":1,\"id\":\"lfr-zxg-fyc\",\"blocking\":true,\"groupSignalsBy\":[\"service\"],\"dependencies\":[\"business_logic.users.login.failure\"],\"metadata\":{\"entities\":null,\"sources\":null},\"creationAuthorId\":2320499,\"creator\":{\"handle\":\"9919ec9b-ebc7-49ee-8dc8-03626e717cca\",\"name\":\"CI Account\"},\"updater\":{\"handle\":\"\",\"name\":\"\"}}",
1616
"headers": {
1717
"Content-Type": [
1818
"application/json"
@@ -27,32 +27,27 @@
2727
"timeToLive": {
2828
"unlimited": true
2929
},
30-
"id": "e25ba2dd-2cd8-54ae-985a-97cf9b520975"
30+
"id": "2f689fb3-a0a5-4f45-bf36-37e6331a9f25"
3131
},
3232
{
3333
"httpRequest": {
3434
"headers": {},
3535
"method": "DELETE",
36-
"path": "/api/v2/security_monitoring/rules/rfn-h2v-udr",
36+
"path": "/api/v2/security_monitoring/rules/lfr-zxg-fyc",
3737
"keepAlive": false,
3838
"secure": true
3939
},
4040
"httpResponse": {
41-
"body": "{\"status\":\"404\",\"title\":\"Not Found\"}",
42-
"headers": {
43-
"Content-Type": [
44-
"application/json"
45-
]
46-
},
47-
"statusCode": 404,
48-
"reasonPhrase": "Not Found"
41+
"headers": {},
42+
"statusCode": 204,
43+
"reasonPhrase": "No Content"
4944
},
5045
"times": {
5146
"remainingTimes": 1
5247
},
5348
"timeToLive": {
5449
"unlimited": true
5550
},
56-
"id": "d0c7ee9e-7178-f2b7-bb6a-b84e899effed"
51+
"id": "a32045c8-5c74-ebb2-99fe-6584f15ea321"
5752
}
5853
]

‎src/test/resources/com/datadog/api/client/v2/api/security_monitoring.feature

+1-1
Original file line numberDiff line numberDiff line change
@@ -203,7 +203,7 @@ Feature: Security Monitoring
203203
@skip-validation @team:DataDog/k9-cloud-security-platform
204204
Scenario: Create a detection rule with type 'application_security 'returns "OK" response
205205
Given new "CreateSecurityMonitoringRule" request
206-
And body with value {"type":"application_security","name":"{{unique}}_appsec_rule","queries":[{"query":"@appsec.security_activity:business_logic.users.login.failure","aggregation":"count","groupByFields":["service","@http.client_ip"],"distinctFields":[]}],"filters":[],"cases":[{"name":"","status":"info","notifications":[],"condition":"a > 100000","actions":[{"type":"block_ip","options":{"duration":900}}]}],"options":{"keepAlive":3600,"maxSignalDuration":86400,"evaluationWindow":900,"detectionMethod":"threshold"},"isEnabled":true,"message":"Test rule","tags":[],"groupSignalsBy":["service"]}
206+
And body with value {"type":"application_security","name":"{{unique}}_appsec_rule","queries":[{"query":"@appsec.security_activity:business_logic.users.login.failure","aggregation":"count","groupByFields":["service","@http.client_ip"],"distinctFields":[]}],"filters":[],"cases":[{"name":"","status":"info","notifications":[],"condition":"a > 100000","actions":[{"type":"block_ip","options":{"duration":900}}, {"type":"user_behavior","options":{"userBehaviorName":"behavior"}}]}],"options":{"keepAlive":3600,"maxSignalDuration":86400,"evaluationWindow":900,"detectionMethod":"threshold"},"isEnabled":true,"message":"Test rule","tags":[],"groupSignalsBy":["service"]}
207207
When the request is sent
208208
Then the response status is 200 OK
209209
And the response "name" is equal to "{{ unique }}_appsec_rule"

0 commit comments

Comments
 (0)