diff --git a/examples/v2/security-monitoring/CreateSecurityMonitoringRule_914562040.py b/examples/v2/security-monitoring/CreateSecurityMonitoringRule_914562040.py deleted file mode 100644 index ea3806564e..0000000000 --- a/examples/v2/security-monitoring/CreateSecurityMonitoringRule_914562040.py +++ /dev/null @@ -1,77 +0,0 @@ -""" -Create a detection rule with type 'signal_correlation' returns "OK" response -""" - -from os import environ -from datadog_api_client import ApiClient, Configuration -from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi -from datadog_api_client.v2.model.security_monitoring_rule_case_create import SecurityMonitoringRuleCaseCreate -from datadog_api_client.v2.model.security_monitoring_rule_evaluation_window import ( - SecurityMonitoringRuleEvaluationWindow, -) -from datadog_api_client.v2.model.security_monitoring_rule_keep_alive import SecurityMonitoringRuleKeepAlive -from datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration import ( - SecurityMonitoringRuleMaxSignalDuration, -) -from datadog_api_client.v2.model.security_monitoring_rule_options import SecurityMonitoringRuleOptions -from datadog_api_client.v2.model.security_monitoring_rule_query_aggregation import ( - SecurityMonitoringRuleQueryAggregation, -) -from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity -from datadog_api_client.v2.model.security_monitoring_signal_rule_create_payload import ( - SecurityMonitoringSignalRuleCreatePayload, -) -from datadog_api_client.v2.model.security_monitoring_signal_rule_query import SecurityMonitoringSignalRuleQuery -from datadog_api_client.v2.model.security_monitoring_signal_rule_type import SecurityMonitoringSignalRuleType - -# there is a valid "security_rule" in the system -SECURITY_RULE_ID = environ["SECURITY_RULE_ID"] - -# there is a valid "security_rule_bis" in the system -SECURITY_RULE_BIS_ID = environ["SECURITY_RULE_BIS_ID"] - -body = SecurityMonitoringSignalRuleCreatePayload( - name="Example-Security-Monitoring_signal_rule", - queries=[ - SecurityMonitoringSignalRuleQuery( - rule_id=SECURITY_RULE_ID, - aggregation=SecurityMonitoringRuleQueryAggregation.EVENT_COUNT, - correlated_by_fields=[ - "host", - ], - correlated_query_index=1, - ), - SecurityMonitoringSignalRuleQuery( - rule_id=SECURITY_RULE_BIS_ID, - aggregation=SecurityMonitoringRuleQueryAggregation.EVENT_COUNT, - correlated_by_fields=[ - "host", - ], - ), - ], - filters=[], - cases=[ - SecurityMonitoringRuleCaseCreate( - name="", - status=SecurityMonitoringRuleSeverity.INFO, - condition="a > 0 && b > 0", - notifications=[], - ), - ], - options=SecurityMonitoringRuleOptions( - evaluation_window=SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES, - keep_alive=SecurityMonitoringRuleKeepAlive.ONE_HOUR, - max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.ONE_DAY, - ), - message="Test signal correlation rule", - tags=[], - is_enabled=True, - type=SecurityMonitoringSignalRuleType.SIGNAL_CORRELATION, -) - -configuration = Configuration() -with ApiClient(configuration) as api_client: - api_instance = SecurityMonitoringApi(api_client) - response = api_instance.create_security_monitoring_rule(body=body) - - print(response) diff --git a/tests/generated-test/test-runner-data/manifest.json b/tests/generated-test/test-runner-data/manifest.json index 5957f4accd..d71533b0a1 100644 --- a/tests/generated-test/test-runner-data/manifest.json +++ b/tests/generated-test/test-runner-data/manifest.json @@ -9359,13 +9359,6 @@ "scenario": "Create a detection rule with type 'impossible_travel' returns \"OK\" response", "version": "v2" }, - { - "feature": "Security Monitoring", - "feature_file": "../../v2/features/security_monitoring.feature", - "file": "v2/security-monitoring/create-a-detection-rule-with-type-signal-correlation-returns-ok-response.json", - "scenario": "Create a detection rule with type 'signal_correlation' returns \"OK\" response", - "version": "v2" - }, { "feature": "Security Monitoring", "feature_file": "../../v2/features/security_monitoring.feature", diff --git a/tests/generated-test/test-runner-data/v2/security-monitoring/create-a-detection-rule-with-type-signal-correlation-returns-ok-response.json b/tests/generated-test/test-runner-data/v2/security-monitoring/create-a-detection-rule-with-type-signal-correlation-returns-ok-response.json deleted file mode 100644 index becea3819c..0000000000 --- a/tests/generated-test/test-runner-data/v2/security-monitoring/create-a-detection-rule-with-type-signal-correlation-returns-ok-response.json +++ /dev/null @@ -1,63 +0,0 @@ -{ - "api": "SecurityMonitoring", - "expected_status": 200, - "feature": "Security Monitoring", - "id": "v2/Security Monitoring/Create a detection rule with type 'signal_correlation' returns \"OK\" response", - "operation_id": "CreateSecurityMonitoringRule", - "request": { - "body": { - "schema": { - "format": null, - "ref": "SecurityMonitoringRuleCreatePayload", - "type": null - }, - "source": "inline", - "value": { - "cases": [ - { - "condition": "a > 0 && b > 0", - "name": "", - "notifications": [], - "status": "info" - } - ], - "filters": [], - "isEnabled": true, - "message": "Test signal correlation rule", - "name": "{{ unique }}_signal_rule", - "options": { - "evaluationWindow": 900, - "keepAlive": 3600, - "maxSignalDuration": 86400 - }, - "queries": [ - { - "aggregation": "event_count", - "correlatedByFields": [ - "host" - ], - "correlatedQueryIndex": 1, - "ruleId": "{{ security_rule.id }}" - }, - { - "aggregation": "event_count", - "correlatedByFields": [ - "host" - ], - "ruleId": "{{ security_rule_bis.id }}" - } - ], - "tags": [], - "type": "signal_correlation" - } - }, - "content_type": "application/json", - "method": "POST", - "pagination": false, - "parameters": [], - "path": "/api/v2/security_monitoring/rules" - }, - "scenario": "Create a detection rule with type 'signal_correlation' returns \"OK\" response", - "schema_version": 1, - "version": "v2" -} diff --git a/tests/generated-test/test-server-data/v2/security-monitoring.json b/tests/generated-test/test-server-data/v2/security-monitoring.json index 8dd359c09a..16d767e78e 100644 --- a/tests/generated-test/test-server-data/v2/security-monitoring.json +++ b/tests/generated-test/test-server-data/v2/security-monitoring.json @@ -2622,241 +2622,6 @@ "scenario": "Create a detection rule with type 'impossible_travel' returns \"OK\" response", "version": "v2" }, - { - "feature": "Security Monitoring", - "frozen_at": "2024-05-10T16:34:31.015Z", - "interactions": [ - { - "request": { - "body": { - "type": "json", - "value": { - "cases": [ - { - "condition": "a > 0", - "name": "", - "notifications": [], - "status": "info" - } - ], - "filters": [], - "isEnabled": true, - "message": "Test rule", - "name": "Test-Create_a_detection_rule_with_type_signal_correlation_returns_OK_response-1715358871", - "options": { - "evaluationWindow": 900, - "keepAlive": 3600, - "maxSignalDuration": 86400 - }, - "queries": [ - { - "aggregation": "count", - "distinctFields": [], - "groupByFields": [], - "metrics": [], - "query": "@test:true" - } - ], - "tags": [], - "type": "log_detection" - } - }, - "content_type": "application/json", - "method": "POST", - "path": "/api/v2/security_monitoring/rules", - "query": [] - }, - "response": { - "body": { - "encoding": "text", - "value": "{\"id\":\"gl8-lry-akp\",\"version\":1,\"name\":\"Test-Create_a_detection_rule_with_type_signal_correlation_returns_OK_response-1715358871\",\"createdAt\":1715358871390,\"creationAuthorId\":1445416,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"@test:true\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\"}],\"options\":{\"keepAlive\":3600,\"maxSignalDuration\":86400,\"detectionMethod\":\"threshold\",\"evaluationWindow\":900},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a > 0\"}],\"message\":\"Test rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"log_detection\",\"filters\":[]}\n" - }, - "headers": { - "content-type": "application/json" - }, - "reason": "OK", - "status": 200 - } - }, - { - "request": { - "body": { - "type": "json", - "value": { - "cases": [ - { - "condition": "a > 0", - "name": "", - "notifications": [], - "status": "info" - } - ], - "filters": [], - "isEnabled": true, - "message": "Test rule Bis", - "name": "Test-Create_a_detection_rule_with_type_signal_correlation_returns_OK_response-1715358871_bis", - "options": { - "evaluationWindow": 900, - "keepAlive": 3600, - "maxSignalDuration": 86400 - }, - "queries": [ - { - "aggregation": "count", - "distinctFields": [], - "groupByFields": [], - "metrics": [], - "query": "@test:false" - } - ], - "tags": [], - "type": "log_detection" - } - }, - "content_type": "application/json", - "method": "POST", - "path": "/api/v2/security_monitoring/rules", - "query": [] - }, - "response": { - "body": { - "encoding": "text", - "value": "{\"id\":\"j2a-wag-ngu\",\"version\":1,\"name\":\"Test-Create_a_detection_rule_with_type_signal_correlation_returns_OK_response-1715358871_bis\",\"createdAt\":1715358871759,\"creationAuthorId\":1445416,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"@test:false\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\"}],\"options\":{\"keepAlive\":3600,\"maxSignalDuration\":86400,\"detectionMethod\":\"threshold\",\"evaluationWindow\":900},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a > 0\"}],\"message\":\"Test rule Bis\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"log_detection\",\"filters\":[]}\n" - }, - "headers": { - "content-type": "application/json" - }, - "reason": "OK", - "status": 200 - } - }, - { - "request": { - "body": { - "type": "json", - "value": { - "cases": [ - { - "condition": "a > 0 && b > 0", - "name": "", - "notifications": [], - "status": "info" - } - ], - "filters": [], - "isEnabled": true, - "message": "Test signal correlation rule", - "name": "Test-Create_a_detection_rule_with_type_signal_correlation_returns_OK_response-1715358871_signal_rule", - "options": { - "evaluationWindow": 900, - "keepAlive": 3600, - "maxSignalDuration": 86400 - }, - "queries": [ - { - "aggregation": "event_count", - "correlatedByFields": [ - "host" - ], - "correlatedQueryIndex": 1, - "ruleId": "gl8-lry-akp" - }, - { - "aggregation": "event_count", - "correlatedByFields": [ - "host" - ], - "ruleId": "j2a-wag-ngu" - } - ], - "tags": [], - "type": "signal_correlation" - } - }, - "content_type": "application/json", - "method": "POST", - "path": "/api/v2/security_monitoring/rules", - "query": [] - }, - "response": { - "body": { - "encoding": "text", - "value": "{\"id\":\"x0w-iu0-izf\",\"version\":1,\"name\":\"Test-Create_a_detection_rule_with_type_signal_correlation_returns_OK_response-1715358871_signal_rule\",\"createdAt\":1715358872108,\"creationAuthorId\":1445416,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"event_count\",\"name\":\"\",\"ruleId\":\"gl8-lry-akp\",\"correlatedByFields\":[\"host\"],\"correlatedQueryIndex\":1},{\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"event_count\",\"name\":\"\",\"ruleId\":\"j2a-wag-ngu\",\"correlatedByFields\":[\"host\"]}],\"options\":{\"keepAlive\":3600,\"maxSignalDuration\":86400,\"detectionMethod\":\"threshold\",\"evaluationWindow\":900},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a > 0 && b > 0\"}],\"message\":\"Test signal correlation rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"signal_correlation\",\"filters\":[]}\n" - }, - "headers": { - "content-type": "application/json" - }, - "reason": "OK", - "status": 200 - } - }, - { - "request": { - "body": { - "type": "empty", - "value": null - }, - "content_type": "", - "method": "DELETE", - "path": "/api/v2/security_monitoring/rules/x0w-iu0-izf", - "query": [] - }, - "response": { - "body": { - "encoding": "text", - "value": "" - }, - "headers": {}, - "reason": "No Content", - "status": 204 - } - }, - { - "request": { - "body": { - "type": "empty", - "value": null - }, - "content_type": "", - "method": "DELETE", - "path": "/api/v2/security_monitoring/rules/j2a-wag-ngu", - "query": [] - }, - "response": { - "body": { - "encoding": "text", - "value": "" - }, - "headers": {}, - "reason": "No Content", - "status": 204 - } - }, - { - "request": { - "body": { - "type": "empty", - "value": null - }, - "content_type": "", - "method": "DELETE", - "path": "/api/v2/security_monitoring/rules/gl8-lry-akp", - "query": [] - }, - "response": { - "body": { - "encoding": "text", - "value": "" - }, - "headers": {}, - "reason": "No Content", - "status": 204 - } - } - ], - "scenario": "Create a detection rule with type 'signal_correlation' returns \"OK\" response", - "version": "v2" - }, { "feature": "Security Monitoring", "frozen_at": "2024-05-10T16:34:33.405Z", diff --git a/tests/v2/features/security_monitoring.feature b/tests/v2/features/security_monitoring.feature index 1088a2c5de..12b40ab104 100644 --- a/tests/v2/features/security_monitoring.feature +++ b/tests/v2/features/security_monitoring.feature @@ -795,19 +795,6 @@ Feature: Security Monitoring And the response "message" is equal to "test" And the response "options.detectionMethod" is equal to "impossible_travel" - @skip-validation @team:DataDog/cloud-siem - Scenario: Create a detection rule with type 'signal_correlation' returns "OK" response - Given there is a valid "security_rule" in the system - And there is a valid "security_rule_bis" in the system - And new "CreateSecurityMonitoringRule" request - And body with value {"name":"{{ unique }}_signal_rule", "queries":[{"ruleId":"{{ security_rule.id }}","aggregation":"event_count","correlatedByFields":["host"],"correlatedQueryIndex":1}, {"ruleId":"{{ security_rule_bis.id }}","aggregation":"event_count","correlatedByFields":["host"]}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0 && b > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test signal correlation rule","tags":[],"isEnabled":true, "type": "signal_correlation"} - When the request is sent - Then the response status is 200 OK - And the response "name" is equal to "{{ unique }}_signal_rule" - And the response "type" is equal to "signal_correlation" - And the response "message" is equal to "Test signal correlation rule" - And the response "isEnabled" is equal to true - @skip-validation @team:DataDog/cloud-siem Scenario: Create a detection rule with type 'workload_security' returns "OK" response Given new "CreateSecurityMonitoringRule" request