Skip to content

Commit 1d02249

Browse files
author
ci.datadog-api-spec
committed
Regenerate client from commit 1e3c61b of spec repo
1 parent dda24b8 commit 1d02249

23 files changed

+3437
-4
lines changed

.generator/schemas/v1/openapi.yaml

Lines changed: 238 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6331,6 +6331,7 @@ components:
63316331
- $ref: '#/components/schemas/LogsSpanRemapper'
63326332
- $ref: '#/components/schemas/LogsArrayProcessor'
63336333
- $ref: '#/components/schemas/LogsDecoderProcessor'
6334+
- $ref: '#/components/schemas/LogsSchemaProcessor'
63346335
LogsQueryCompute:
63356336
description: Define computation for a log query.
63366337
properties:
@@ -6392,6 +6393,243 @@ components:
63926393
periods.
63936394
type: string
63946395
type: object
6396+
LogsSchemaCategoryMapper:
6397+
description: "Use the Schema Category Mapper to categorize log event into enum
6398+
fields.\nIn the case of OCSF, they can be used to map sibling fields which
6399+
are composed of an ID and a name.\n\n**Notes**:\n\n- The syntax of the query
6400+
is the one of Logs Explorer search bar.\n The query can be done on any log
6401+
attribute or tag, whether it is a facet or not.\n Wildcards can also be used
6402+
inside your query.\n- Categories are executed in order and processing stops
6403+
at the first match.\n Make sure categories are properly ordered in case a
6404+
log could match multiple queries.\n- Sibling fields always have a numerical
6405+
ID field and a human-readable string name.\n- A fallback section handles cases
6406+
where the name or ID value matches a specific value.\n If the name matches
6407+
\"Other\" or the ID matches 99, the value of the sibling name field will be
6408+
pulled from a source field from the original log."
6409+
properties:
6410+
categories:
6411+
description: 'Array of filters to match or not a log and their
6412+
6413+
corresponding `name` to assign a custom value to the log.'
6414+
example:
6415+
- filter:
6416+
query: '@eventName:(ConsoleLogin OR ExternalIdPDirectoryLogin OR UserAuthentication
6417+
OR Authenticate)'
6418+
id: 1
6419+
name: Logon
6420+
- filter:
6421+
query: '@eventName:*'
6422+
id: 99
6423+
name: Other
6424+
items:
6425+
$ref: '#/components/schemas/LogsSchemaCategoryMapperCategory'
6426+
type: array
6427+
fallback:
6428+
$ref: '#/components/schemas/LogsSchemaCategoryMapperFallback'
6429+
name:
6430+
description: Name of the logs schema category mapper.
6431+
example: activity_id and activity_name
6432+
type: string
6433+
targets:
6434+
$ref: '#/components/schemas/LogsSchemaCategoryMapperTargets'
6435+
type:
6436+
$ref: '#/components/schemas/LogsSchemaCategoryMapperType'
6437+
required:
6438+
- categories
6439+
- targets
6440+
- type
6441+
- name
6442+
type: object
6443+
LogsSchemaCategoryMapperCategory:
6444+
description: Object describing the logs filter with corresponding category ID
6445+
and name assignment.
6446+
properties:
6447+
filter:
6448+
$ref: '#/components/schemas/LogsFilter'
6449+
id:
6450+
description: ID to inject into the category.
6451+
example: 1
6452+
format: int64
6453+
type: integer
6454+
name:
6455+
description: Value to assign to target schema field.
6456+
example: Password Change
6457+
type: string
6458+
required:
6459+
- filter
6460+
- id
6461+
- name
6462+
type: object
6463+
LogsSchemaCategoryMapperFallback:
6464+
description: Used to override hardcoded category values with a value pulled
6465+
from a source attribute on the log.
6466+
properties:
6467+
sources:
6468+
additionalProperties:
6469+
items:
6470+
type: string
6471+
type: array
6472+
description: Fallback sources used to populate value of field.
6473+
example: {}
6474+
type: object
6475+
values:
6476+
additionalProperties:
6477+
type: string
6478+
description: Values that define when the fallback is used.
6479+
example: {}
6480+
type: object
6481+
type: object
6482+
LogsSchemaCategoryMapperTargets:
6483+
description: Name of the target attributes which value is defined by the matching
6484+
category.
6485+
properties:
6486+
id:
6487+
description: ID of the field to map log attributes to.
6488+
example: ocsf.activity_id
6489+
type: string
6490+
name:
6491+
description: Name of the field to map log attributes to.
6492+
example: ocsf.activity_name
6493+
type: string
6494+
type: object
6495+
LogsSchemaCategoryMapperType:
6496+
description: Type of logs schema category mapper.
6497+
enum:
6498+
- schema-category-mapper
6499+
example: schema-category-mapper
6500+
type: string
6501+
x-enum-varnames:
6502+
- SCHEMA_CATEGORY_MAPPER
6503+
LogsSchemaData:
6504+
description: Configuration of the schema data to use.
6505+
properties:
6506+
class_name:
6507+
description: Class name of the schema to use.
6508+
example: Account Change
6509+
type: string
6510+
class_uid:
6511+
description: Class UID of the schema to use.
6512+
example: 3001
6513+
format: int64
6514+
type: integer
6515+
profiles:
6516+
description: Optional list of profiles to modify the schema.
6517+
example:
6518+
- security_control
6519+
- host
6520+
items:
6521+
type: string
6522+
type: array
6523+
schema_type:
6524+
description: Type of schema to use.
6525+
example: ocsf
6526+
type: string
6527+
version:
6528+
description: Version of the schema to use.
6529+
example: 1.5.0
6530+
type: string
6531+
required:
6532+
- schema_type
6533+
- version
6534+
- class_uid
6535+
- class_name
6536+
type: object
6537+
LogsSchemaMapper:
6538+
description: Configuration of the schema processor mapper to use.
6539+
oneOf:
6540+
- $ref: '#/components/schemas/LogsSchemaRemapper'
6541+
- $ref: '#/components/schemas/LogsSchemaCategoryMapper'
6542+
LogsSchemaProcessor:
6543+
description: A processor that has additional validations and checks for a given
6544+
schema. Currently supported schema types include OCSF.
6545+
properties:
6546+
is_enabled:
6547+
default: false
6548+
description: Whether or not the processor is enabled.
6549+
type: boolean
6550+
mappers:
6551+
description: The `LogsSchemaProcessor` `mappers`.
6552+
example:
6553+
- name: Map userIdentity to ocsf.user.uid
6554+
sources:
6555+
- userIdentity.principalId
6556+
target: ocsf.user.uid
6557+
type: schema-remapper
6558+
items:
6559+
$ref: '#/components/schemas/LogsSchemaMapper'
6560+
type: array
6561+
name:
6562+
description: Name of the processor.
6563+
example: Map additionalEventData.LoginTo to ocsf.dst_endpoint.svc_name
6564+
type: string
6565+
schema:
6566+
$ref: '#/components/schemas/LogsSchemaData'
6567+
type:
6568+
$ref: '#/components/schemas/LogsSchemaProcessorType'
6569+
required:
6570+
- name
6571+
- mappers
6572+
- type
6573+
- schema
6574+
type: object
6575+
LogsSchemaProcessorType:
6576+
default: schema-processor
6577+
description: Type of logs schema processor.
6578+
enum:
6579+
- schema-processor
6580+
example: schema-processor
6581+
type: string
6582+
x-enum-varnames:
6583+
- SCHEMA_PROCESSOR
6584+
LogsSchemaRemapper:
6585+
description: The schema remapper maps source log fields to their correct fields.
6586+
properties:
6587+
name:
6588+
description: Name of the logs schema remapper.
6589+
example: Map userIdentity.principalId, responseElements.role.roleId, responseElements.user.userId
6590+
to ocsf.user.uid
6591+
type: string
6592+
override_on_conflict:
6593+
default: false
6594+
description: Override or not the target element if already set.
6595+
type: boolean
6596+
preserve_source:
6597+
default: false
6598+
description: Remove or preserve the remapped source element.
6599+
type: boolean
6600+
sources:
6601+
description: Array of source attributes.
6602+
example:
6603+
- userIdentity.principalId
6604+
- responseElements.role.roleId
6605+
- responseElements.user.userId
6606+
items:
6607+
description: Attribute used as a source to remap its value to the target
6608+
attribute.
6609+
type: string
6610+
type: array
6611+
target:
6612+
description: Target field to map log source field to.
6613+
example: ocsf.user.uid
6614+
type: string
6615+
target_format:
6616+
$ref: '#/components/schemas/TargetFormatType'
6617+
type:
6618+
$ref: '#/components/schemas/LogsSchemaRemapperType'
6619+
required:
6620+
- name
6621+
- sources
6622+
- target
6623+
- type
6624+
type: object
6625+
LogsSchemaRemapperType:
6626+
description: Type of logs schema remapper.
6627+
enum:
6628+
- schema-remapper
6629+
example: schema-remapper
6630+
type: string
6631+
x-enum-varnames:
6632+
- SCHEMA_REMAPPER
63956633
LogsServiceRemapper:
63966634
description: 'Use this processor if you want to assign one or more attributes
63976635
as the official service.

0 commit comments

Comments
 (0)