Add field attribute to the Workload Protection hash action

.generator/schemas/v2/openapi.yaml

@@ -10205,11 +10205,11 @@ components:
     CloudWorkloadSecurityAgentPolicyVersion:
       description: The versions of the policy
       properties:
-        Date:
+        date:
           description: The date and time the version was created
           nullable: true
           type: string
-        Name:
+        name:
           description: The version of the policy
           example: 1.47.0-rc2
           type: string
@@ -10236,8 +10236,11 @@ components:
           $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionSet'
       type: object
     CloudWorkloadSecurityAgentRuleActionHash:
-      additionalProperties: {}
-      description: An empty object indicating the hash action
+      description: Hash file specified by the field attribute
+      properties:
+        field:
+          description: The field of the hash action
+          type: string
       type: object
     CloudWorkloadSecurityAgentRuleActionMetadata:
       description: The metadata action applied on the scope matching the rule
@@ -10285,9 +10288,14 @@ components:
           format: int64
           type: integer
         value:
-          description: The value of the set action
-          type: string
+          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionSetValue'
       type: object
+    CloudWorkloadSecurityAgentRuleActionSetValue:
+      description: The value of the set action
+      oneOf:
+      - type: string
+      - type: integer
+      - type: boolean
     CloudWorkloadSecurityAgentRuleActions:
       description: The array of actions the rule can perform if triggered
       items:

docs/datadog_api_client.v2.model.rst

@@ -3945,6 +3945,13 @@ datadog\_api\_client.v2.model.cloud\_workload\_security\_agent\_rule\_action\_se
    :members:
    :show-inheritance:
 
+datadog\_api\_client.v2.model.cloud\_workload\_security\_agent\_rule\_action\_set\_value module
+-----------------------------------------------------------------------------------------------
+
+.. automodule:: datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_set_value
+   :members:
+   :show-inheritance:
+
 datadog\_api\_client.v2.model.cloud\_workload\_security\_agent\_rule\_attributes module
 ---------------------------------------------------------------------------------------
 

examples/v2/csm-threats/CreateCSMThreatsAgentRule_1295653933.py

@@ -46,7 +46,9 @@
                     ),
                 ),
                 CloudWorkloadSecurityAgentRuleAction(
-                    hash=CloudWorkloadSecurityAgentRuleActionHash(),
+                    hash=CloudWorkloadSecurityAgentRuleActionHash(
+                        field="exec.file",
+                    ),
                 ),
             ],
         ),

examples/v2/csm-threats/CreateCSMThreatsAgentRule_1363354233.py

@@ -37,7 +37,7 @@
                 CloudWorkloadSecurityAgentRuleAction(
                     set=CloudWorkloadSecurityAgentRuleActionSet(
                         name="test_set",
-                        expression="open.file.path",
+                        expression="exec.file.path",
                         default_value="/dev/null",
                         scope="process",
                     ),

src/datadog_api_client/v2/model/cloud_workload_security_agent_policy_version.py

@@ -23,8 +23,8 @@ def openapi_types(_):
         }
 
     attribute_map = {
-        "date": "Date",
-        "name": "Name",
+        "date": "date",
+        "name": "name",
     }
 
     def __init__(self_, date: Union[str, none_type, UnsetType] = unset, name: Union[str, UnsetType] = unset, **kwargs):

src/datadog_api_client/v2/model/cloud_workload_security_agent_rule_action.py

@@ -73,7 +73,7 @@ def __init__(
         :param filter: SECL expression used to target the container to apply the action on
         :type filter: str, optional
 
-        :param hash: An empty object indicating the hash action
+        :param hash: Hash file specified by the field attribute
         :type hash: CloudWorkloadSecurityAgentRuleActionHash, optional
 
         :param kill: Kill system call applied on the container matching the rule

src/datadog_api_client/v2/model/cloud_workload_security_agent_rule_action_hash.py

@@ -3,15 +3,34 @@
 # Copyright 2019-Present Datadog, Inc.
 from __future__ import annotations
 
+from typing import Union
 
 from datadog_api_client.model_utils import (
     ModelNormal,
+    cached_property,
+    unset,
+    UnsetType,
 )
 
 
 class CloudWorkloadSecurityAgentRuleActionHash(ModelNormal):
-    def __init__(self_, **kwargs):
+    @cached_property
+    def openapi_types(_):
+        return {
+            "field": (str,),
+        }
+
+    attribute_map = {
+        "field": "field",
+    }
+
+    def __init__(self_, field: Union[str, UnsetType] = unset, **kwargs):
         """
-        An empty object indicating the hash action
+        Hash file specified by the field attribute
+
+        :param field: The field of the hash action
+        :type field: str, optional
         """
+        if field is not unset:
+            kwargs["field"] = field
         super().__init__(kwargs)

src/datadog_api_client/v2/model/cloud_workload_security_agent_rule_action_set.py

@@ -3,7 +3,7 @@
 # Copyright 2019-Present Datadog, Inc.
 from __future__ import annotations
 
-from typing import Union
+from typing import Union, TYPE_CHECKING
 
 from datadog_api_client.model_utils import (
     ModelNormal,
@@ -13,9 +13,19 @@
 )
 
 
+if TYPE_CHECKING:
+    from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_set_value import (
+        CloudWorkloadSecurityAgentRuleActionSetValue,
+    )
+
+
 class CloudWorkloadSecurityAgentRuleActionSet(ModelNormal):
     @cached_property
     def openapi_types(_):
+        from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_set_value import (
+            CloudWorkloadSecurityAgentRuleActionSetValue,
+        )
+
         return {
             "append": (bool,),
             "default_value": (str,),
@@ -26,7 +36,7 @@ def openapi_types(_):
             "scope": (str,),
             "size": (int,),
             "ttl": (int,),
-            "value": (str,),
+            "value": (CloudWorkloadSecurityAgentRuleActionSetValue,),
         }
 
     attribute_map = {
@@ -53,7 +63,7 @@ def __init__(
         scope: Union[str, UnsetType] = unset,
         size: Union[int, UnsetType] = unset,
         ttl: Union[int, UnsetType] = unset,
-        value: Union[str, UnsetType] = unset,
+        value: Union[CloudWorkloadSecurityAgentRuleActionSetValue, str, int, bool, UnsetType] = unset,
         **kwargs,
     ):
         """
@@ -87,7 +97,7 @@ def __init__(
         :type ttl: int, optional
 
         :param value: The value of the set action
-        :type value: str, optional
+        :type value: CloudWorkloadSecurityAgentRuleActionSetValue, optional
         """
         if append is not unset:
             kwargs["append"] = append

src/datadog_api_client/v2/model/cloud_workload_security_agent_rule_action_set_value.py

@@ -0,0 +1,35 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+# This product includes software developed at Datadog (https://www.datadoghq.com/).
+# Copyright 2019-Present Datadog, Inc.
+from __future__ import annotations
+
+
+from datadog_api_client.model_utils import (
+    ModelComposed,
+    cached_property,
+)
+
+
+class CloudWorkloadSecurityAgentRuleActionSetValue(ModelComposed):
+    def __init__(self, **kwargs):
+        """
+        The value of the set action
+        """
+        super().__init__(kwargs)
+
+    @cached_property
+    def _composed_schemas(_):
+        # we need this here to make our import statements work
+        # we must store _composed_schemas in here so the code is only run
+        # when we invoke this method. If we kept this at the class
+        # level we would get an error because the class level
+        # code would be run when this module is imported, and these composed
+        # classes don't exist yet because their module has not finished
+        # loading
+        return {
+            "oneOf": [
+                str,
+                int,
+                bool,
+            ],
+        }

src/datadog_api_client/v2/models/__init__.py

@@ -762,6 +762,9 @@
 from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_set import (
     CloudWorkloadSecurityAgentRuleActionSet,
 )
+from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_set_value import (
+    CloudWorkloadSecurityAgentRuleActionSetValue,
+)
 from datadog_api_client.v2.model.cloud_workload_security_agent_rule_attributes import (
     CloudWorkloadSecurityAgentRuleAttributes,
 )
@@ -5514,6 +5517,7 @@
     "CloudWorkloadSecurityAgentRuleActionHash",
     "CloudWorkloadSecurityAgentRuleActionMetadata",
     "CloudWorkloadSecurityAgentRuleActionSet",
+    "CloudWorkloadSecurityAgentRuleActionSetValue",
     "CloudWorkloadSecurityAgentRuleAttributes",
     "CloudWorkloadSecurityAgentRuleCreateAttributes",
     "CloudWorkloadSecurityAgentRuleCreateData",

tests/v2/cassettes/test_scenarios/test_create_a_workload_protection_agent_rule_returns_bad_request_response.frozen

@@ -1 +1 @@
-2025-10-10T15:20:39.566Z
+2025-11-27T16:28:19.381Z

tests/v2/cassettes/test_scenarios/test_create_a_workload_protection_agent_rule_returns_bad_request_response.yaml

@@ -1,6 +1,6 @@
 interactions:
 - request:
-    body: '{"data":{"attributes":{"description":"My agent policy","enabled":true,"hostTags":["env:staging"],"name":"testcreateaworkloadprotectionagentrulereturnsbadrequestresponse1760109639"},"type":"policy"}}'
+    body: '{"data":{"attributes":{"description":"My agent policy","enabled":true,"hostTags":["env:staging"],"name":"testcreateaworkloadprotectionagentrulereturnsbadrequestresponse1764260899"},"type":"policy"}}'
     headers:
       accept:
       - application/json
@@ -10,16 +10,16 @@ interactions:
     uri: https://api.datadoghq.com/api/v2/remote_config/products/cws/policy
   response:
     body:
-      string: '{"data":{"id":"sr5-i0h-lty","type":"policy","attributes":{"blockingRulesCount":0,"datadogManaged":false,"description":"My
-        agent policy","disabledRulesCount":1,"enabled":true,"hostTagsLists":[["env:staging"]],"monitoringRulesCount":7,"name":"testcreateaworkloadprotectionagentrulereturnsbadrequestresponse1760109639","pinned":false,"policyVersion":"1","ruleCount":8,"updateDate":1760109639958,"updater":{"name":"frog","handle":"[email protected]"}}}}'
+      string: '{"data":{"id":"mmu-85c-3gj","type":"policy","attributes":{"blockingRulesCount":0,"datadogManaged":false,"description":"My
+        agent policy","disabledRulesCount":1,"enabled":true,"hostTagsLists":[["env:staging"]],"monitoringRulesCount":7,"name":"testcreateaworkloadprotectionagentrulereturnsbadrequestresponse1764260899","pinned":false,"policyVersion":"1","ruleCount":8,"updateDate":1764260899768,"updater":{"name":"frog","handle":"[email protected]"}}}}'
     headers:
       content-type:
       - application/json
     status:
       code: 200
       message: OK
 - request:
-    body: '{"data":{"attributes":{"description":"My Agent rule","enabled":true,"expression":"exec.file.name","filters":[],"name":"my_agent_rule","policy_id":"sr5-i0h-lty","product_tags":[]},"type":"agent_rule"}}'
+    body: '{"data":{"attributes":{"description":"My Agent rule","enabled":true,"expression":"exec.file.name","filters":[],"name":"my_agent_rule","policy_id":"mmu-85c-3gj","product_tags":[]},"type":"agent_rule"}}'
     headers:
       accept:
       - application/json
@@ -29,8 +29,8 @@ interactions:
     uri: https://api.datadoghq.com/api/v2/remote_config/products/cws/agent_rules
   response:
     body:
-      string: '{"errors":["input_validation_error(Field ''name'' is invalid: the name
-        ''my_agent_rule'' is already used by a custom rule)"]}'
+      string: '{"errors":["input_validation_error(Field ''expression'' is invalid:
+        rule `my_agent_rule` error: rule syntax error: bool expected: 1:1: exec.file.name\n^)"]}'
     headers:
       content-type:
       - application/json
@@ -43,7 +43,7 @@ interactions:
       accept:
       - '*/*'
     method: DELETE
-    uri: https://api.datadoghq.com/api/v2/remote_config/products/cws/policy/sr5-i0h-lty
+    uri: https://api.datadoghq.com/api/v2/remote_config/products/cws/policy/mmu-85c-3gj
   response:
     body:
       string: ''

tests/v2/cassettes/test_scenarios/test_create_a_workload_protection_agent_rule_returns_ok_response.frozen

@@ -1 +1 @@
-2025-10-10T15:20:41.757Z
+2025-11-27T16:28:22.363Z

tests/v2/cassettes/test_scenarios/test_create_a_workload_protection_agent_rule_returns_ok_response.yaml

@@ -1,6 +1,6 @@
 interactions:
 - request:
-    body: '{"data":{"attributes":{"description":"My agent policy","enabled":true,"hostTags":["env:staging"],"name":"testcreateaworkloadprotectionagentrulereturnsokresponse1760109641"},"type":"policy"}}'
+    body: '{"data":{"attributes":{"description":"My agent policy","enabled":true,"hostTags":["env:staging"],"name":"testcreateaworkloadprotectionagentrulereturnsokresponse1764260902"},"type":"policy"}}'
     headers:
       accept:
       - application/json
@@ -10,8 +10,8 @@ interactions:
     uri: https://api.datadoghq.com/api/v2/remote_config/products/cws/policy
   response:
     body:
-      string: '{"data":{"id":"cwy-qfn-4k8","type":"policy","attributes":{"blockingRulesCount":0,"datadogManaged":false,"description":"My
-        agent policy","disabledRulesCount":1,"enabled":true,"hostTagsLists":[["env:staging"]],"monitoringRulesCount":7,"name":"testcreateaworkloadprotectionagentrulereturnsokresponse1760109641","pinned":false,"policyVersion":"1","ruleCount":8,"updateDate":1760109642133,"updater":{"name":"frog","handle":"[email protected]"}}}}'
+      string: '{"data":{"id":"6et-dtp-wuv","type":"policy","attributes":{"blockingRulesCount":0,"datadogManaged":false,"description":"My
+        agent policy","disabledRulesCount":1,"enabled":true,"hostTagsLists":[["env:staging"]],"monitoringRulesCount":7,"name":"testcreateaworkloadprotectionagentrulereturnsokresponse1764260902","pinned":false,"policyVersion":"1","ruleCount":8,"updateDate":1764260902720,"updater":{"name":"frog","handle":"[email protected]"}}}}'
     headers:
       content-type:
       - application/json
@@ -20,7 +20,7 @@ interactions:
       message: OK
 - request:
     body: '{"data":{"attributes":{"agent_version":"> 7.60","description":"My Agent
-      rule","enabled":true,"expression":"exec.file.name == \"sh\"","filters":[],"name":"testcreateaworkloadprotectionagentrulereturnsokresponse1760109641","policy_id":"cwy-qfn-4k8","product_tags":[]},"type":"agent_rule"}}'
+      rule","enabled":true,"expression":"exec.file.name == \"sh\"","filters":[],"name":"testcreateaworkloadprotectionagentrulereturnsokresponse1764260902","policy_id":"6et-dtp-wuv","product_tags":[]},"type":"agent_rule"}}'
     headers:
       accept:
       - application/json
@@ -30,10 +30,10 @@ interactions:
     uri: https://api.datadoghq.com/api/v2/remote_config/products/cws/agent_rules
   response:
     body:
-      string: '{"data":{"id":"iua-dxr-uvh","type":"agent_rule","attributes":{"category":"Process
-        Activity","creationDate":1760109643225,"creator":{"name":"frog","handle":"[email protected]"},"defaultRule":false,"description":"My
+      string: '{"data":{"id":"7o5-duk-qqn","type":"agent_rule","attributes":{"category":"Process
+        Activity","creationDate":1764260903944,"creator":{"name":"frog","handle":"[email protected]"},"defaultRule":false,"description":"My
         Agent rule","enabled":true,"expression":"exec.file.name == \"sh\"","filters":["os
-        == \"linux\""],"monitoring":["cwy-qfn-4k8"],"name":"testcreateaworkloadprotectionagentrulereturnsokresponse1760109641","product_tags":[],"updateDate":1760109643225,"updater":{"name":"frog","handle":"[email protected]"}}}}'
+        == \"linux\""],"monitoring":["6et-dtp-wuv"],"name":"testcreateaworkloadprotectionagentrulereturnsokresponse1764260902","product_tags":[],"updateDate":1764260903944,"updater":{"name":"frog","handle":"[email protected]"}}}}'
     headers:
       content-type:
       - application/json
@@ -46,7 +46,7 @@ interactions:
       accept:
       - '*/*'
     method: DELETE
-    uri: https://api.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/iua-dxr-uvh
+    uri: https://api.datadoghq.com/api/v2/remote_config/products/cws/agent_rules/7o5-duk-qqn
   response:
     body:
       string: ''
@@ -62,7 +62,7 @@ interactions:
       accept:
       - '*/*'
     method: DELETE
-    uri: https://api.datadoghq.com/api/v2/remote_config/products/cws/policy/cwy-qfn-4k8
+    uri: https://api.datadoghq.com/api/v2/remote_config/products/cws/policy/6et-dtp-wuv
   response:
     body:
       string: ''

tests/v2/cassettes/test_scenarios/test_create_a_workload_protection_agent_rule_with_set_action_returns_ok_response.frozen

@@ -1 +1 @@
-2025-10-10T15:20:46.004Z
+2025-11-27T16:28:26.189Z