Skip to content

Commit 723734c

Browse files
api-clients-generation-pipeline[bot]ci.datadog-api-spec
api-clients-generation-pipeline[bot]
and
ci.datadog-api-spec
authored
Security Monitoring - Validation Endpoint for Suppressions (#3107)
Co-authored-by: ci.datadog-api-spec <[email protected]>
1 parent 406068c commit 723734c

File tree

9 files changed

+292
-0
lines changed

9 files changed

+292
-0
lines changed

‎.generator/schemas/v2/openapi.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64816,6 +64816,38 @@ paths:
6481664816
summary: Get suppressions affecting a specific rule
6481764817
tags:
6481864818
- Security Monitoring
64819+
/api/v2/security_monitoring/configuration/suppressions/validation:
64820+
post:
64821+
description: Validate a suppression rule.
64822+
operationId: ValidateSecurityMonitoringSuppression
64823+
requestBody:
64824+
content:
64825+
application/json:
64826+
schema:
64827+
$ref: '#/components/schemas/SecurityMonitoringSuppressionUpdateRequest'
64828+
required: true
64829+
responses:
64830+
'204':
64831+
description: OK
64832+
'400':
64833+
$ref: '#/components/responses/BadRequestResponse'
64834+
'403':
64835+
$ref: '#/components/responses/NotAuthorizedResponse'
64836+
'429':
64837+
$ref: '#/components/responses/TooManyRequestsResponse'
64838+
security:
64839+
- apiKeyAuth: []
64840+
appKeyAuth: []
64841+
- AuthZ:
64842+
- security_monitoring_suppressions_write
64843+
summary: Validate a suppression rule
64844+
tags:
64845+
- Security Monitoring
64846+
x-codegen-request-body-name: body
64847+
x-permission:
64848+
operator: OR
64849+
permissions:
64850+
- security_monitoring_suppressions_write
6481964851
/api/v2/security_monitoring/configuration/suppressions/{suppression_id}:
6482064852
delete:
6482164853
description: Delete a specific suppression rule.

‎examples/v2/security-monitoring/ValidateSecurityMonitoringSuppression.java‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
// Validate a suppression rule returns "OK" response
2+
3+
import com.datadog.api.client.ApiClient;
4+
import com.datadog.api.client.ApiException;
5+
import com.datadog.api.client.v2.api.SecurityMonitoringApi;
6+
import com.datadog.api.client.v2.model.SecurityMonitoringSuppressionType;
7+
import com.datadog.api.client.v2.model.SecurityMonitoringSuppressionUpdateAttributes;
8+
import com.datadog.api.client.v2.model.SecurityMonitoringSuppressionUpdateData;
9+
import com.datadog.api.client.v2.model.SecurityMonitoringSuppressionUpdateRequest;
10+
11+
public class Example {
12+
public static void main(String[] args) {
13+
ApiClient defaultClient = ApiClient.getDefaultApiClient();
14+
SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient);
15+
16+
SecurityMonitoringSuppressionUpdateRequest body =
17+
new SecurityMonitoringSuppressionUpdateRequest()
18+
.data(
19+
new SecurityMonitoringSuppressionUpdateData()
20+
.attributes(
21+
new SecurityMonitoringSuppressionUpdateAttributes()
22+
.dataExclusionQuery("source:cloudtrail account_id:12345")
23+
.description(
24+
"This rule suppresses low-severity signals in staging"
25+
+ " environments.")
26+
.enabled(true)
27+
.name("Custom suppression")
28+
.ruleQuery("type:log_detection source:cloudtrail"))
29+
.type(SecurityMonitoringSuppressionType.SUPPRESSIONS));
30+
31+
try {
32+
apiInstance.validateSecurityMonitoringSuppression(body);
33+
} catch (ApiException e) {
34+
System.err.println(
35+
"Exception when calling SecurityMonitoringApi#validateSecurityMonitoringSuppression");
36+
System.err.println("Status code: " + e.getCode());
37+
System.err.println("Reason: " + e.getResponseBody());
38+
System.err.println("Response headers: " + e.getResponseHeaders());
39+
e.printStackTrace();
40+
}
41+
}
42+
}

‎src/main/java/com/datadog/api/client/v2/api/SecurityMonitoringApi.java‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11220,4 +11220,141 @@ public CompletableFuture<ApiResponse<Void>> validateSecurityMonitoringRuleWithHt
1122011220
false,
1122111221
null);
1122211222
}
11223+
11224+
/**
11225+
* Validate a suppression rule.
11226+
*
11227+
* <p>See {@link #validateSecurityMonitoringSuppressionWithHttpInfo}.
11228+
*
11229+
* @param body (required)
11230+
* @throws ApiException if fails to make API call
11231+
*/
11232+
public void validateSecurityMonitoringSuppression(SecurityMonitoringSuppressionUpdateRequest body)
11233+
throws ApiException {
11234+
validateSecurityMonitoringSuppressionWithHttpInfo(body);
11235+
}
11236+
11237+
/**
11238+
* Validate a suppression rule.
11239+
*
11240+
* <p>See {@link #validateSecurityMonitoringSuppressionWithHttpInfoAsync}.
11241+
*
11242+
* @param body (required)
11243+
* @return CompletableFuture
11244+
*/
11245+
public CompletableFuture<Void> validateSecurityMonitoringSuppressionAsync(
11246+
SecurityMonitoringSuppressionUpdateRequest body) {
11247+
return validateSecurityMonitoringSuppressionWithHttpInfoAsync(body)
11248+
.thenApply(
11249+
response -> {
11250+
return response.getData();
11251+
});
11252+
}
11253+
11254+
/**
11255+
* Validate a suppression rule.
11256+
*
11257+
* @param body (required)
11258+
* @return ApiResponse&lt;Void&gt;
11259+
* @throws ApiException if fails to make API call
11260+
* @http.response.details
11261+
* <table border="1">
11262+
* <caption>Response details</caption>
11263+
* <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
11264+
* <tr><td> 204 </td><td> OK </td><td> - </td></tr>
11265+
* <tr><td> 400 </td><td> Bad Request </td><td> - </td></tr>
11266+
* <tr><td> 403 </td><td> Not Authorized </td><td> - </td></tr>
11267+
* <tr><td> 429 </td><td> Too many requests </td><td> - </td></tr>
11268+
* </table>
11269+
*/
11270+
public ApiResponse<Void> validateSecurityMonitoringSuppressionWithHttpInfo(
11271+
SecurityMonitoringSuppressionUpdateRequest body) throws ApiException {
11272+
Object localVarPostBody = body;
11273+
11274+
// verify the required parameter 'body' is set
11275+
if (body == null) {
11276+
throw new ApiException(
11277+
400,
11278+
"Missing the required parameter 'body' when calling"
11279+
+ " validateSecurityMonitoringSuppression");
11280+
}
11281+
// create path and map variables
11282+
String localVarPath = "/api/v2/security_monitoring/configuration/suppressions/validation";
11283+
11284+
Map<String, String> localVarHeaderParams = new HashMap<String, String>();
11285+
11286+
Invocation.Builder builder =
11287+
apiClient.createBuilder(
11288+
"v2.SecurityMonitoringApi.validateSecurityMonitoringSuppression",
11289+
localVarPath,
11290+
new ArrayList<Pair>(),
11291+
localVarHeaderParams,
11292+
new HashMap<String, String>(),
11293+
new String[] {"*/*"},
11294+
new String[] {"apiKeyAuth", "appKeyAuth", "AuthZ"});
11295+
return apiClient.invokeAPI(
11296+
"POST",
11297+
builder,
11298+
localVarHeaderParams,
11299+
new String[] {"application/json"},
11300+
localVarPostBody,
11301+
new HashMap<String, Object>(),
11302+
false,
11303+
null);
11304+
}
11305+
11306+
/**
11307+
* Validate a suppression rule.
11308+
*
11309+
* <p>See {@link #validateSecurityMonitoringSuppressionWithHttpInfo}.
11310+
*
11311+
* @param body (required)
11312+
* @return CompletableFuture&lt;ApiResponse&lt;Void&gt;&gt;
11313+
*/
11314+
public CompletableFuture<ApiResponse<Void>>
11315+
validateSecurityMonitoringSuppressionWithHttpInfoAsync(
11316+
SecurityMonitoringSuppressionUpdateRequest body) {
11317+
Object localVarPostBody = body;
11318+
11319+
// verify the required parameter 'body' is set
11320+
if (body == null) {
11321+
CompletableFuture<ApiResponse<Void>> result = new CompletableFuture<>();
11322+
result.completeExceptionally(
11323+
new ApiException(
11324+
400,
11325+
"Missing the required parameter 'body' when calling"
11326+
+ " validateSecurityMonitoringSuppression"));
11327+
return result;
11328+
}
11329+
// create path and map variables
11330+
String localVarPath = "/api/v2/security_monitoring/configuration/suppressions/validation";
11331+
11332+
Map<String, String> localVarHeaderParams = new HashMap<String, String>();
11333+
11334+
Invocation.Builder builder;
11335+
try {
11336+
builder =
11337+
apiClient.createBuilder(
11338+
"v2.SecurityMonitoringApi.validateSecurityMonitoringSuppression",
11339+
localVarPath,
11340+
new ArrayList<Pair>(),
11341+
localVarHeaderParams,
11342+
new HashMap<String, String>(),
11343+
new String[] {"*/*"},
11344+
new String[] {"apiKeyAuth", "appKeyAuth", "AuthZ"});
11345+
} catch (ApiException ex) {
11346+
CompletableFuture<ApiResponse<Void>> result = new CompletableFuture<>();
11347+
result.completeExceptionally(ex);
11348+
return result;
11349+
}
11350+
return apiClient.invokeAPIAsync(
11351+
"POST",
11352+
builder,
11353+
localVarHeaderParams,
11354+
new String[] {"application/json"},
11355+
localVarPostBody,
11356+
new HashMap<String, Object>(),
11357+
false,
11358+
null);
11359+
}
1122311360
}

‎src/test/resources/cassettes/features/v2/Validate_a_suppression_rule_returns_Bad_Request_response.freeze‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2025-09-01T21:36:42.334Z

‎src/test/resources/cassettes/features/v2/Validate_a_suppression_rule_returns_Bad_Request_response.json‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
[
2+
{
3+
"httpRequest": {
4+
"body": {
5+
"type": "JSON",
6+
"json": "{\"data\":{\"attributes\":{\"data_exclusion_query\":\"not enough attributes\"},\"type\":\"suppressions\"}}"
7+
},
8+
"headers": {},
9+
"method": "POST",
10+
"path": "/api/v2/security_monitoring/configuration/suppressions/validation",
11+
"keepAlive": false,
12+
"secure": true
13+
},
14+
"httpResponse": {
15+
"body": "{\"errors\":[\"input_validation_error(Field 'data.attributes.rule_query' is invalid: field 'rule_query' is required)\",\"input_validation_error(Field 'data.attributes.name' is invalid: name cannot be empty)\"]}",
16+
"headers": {
17+
"Content-Type": [
18+
"application/json"
19+
]
20+
},
21+
"statusCode": 400,
22+
"reasonPhrase": "Bad Request"
23+
},
24+
"times": {
25+
"remainingTimes": 1
26+
},
27+
"timeToLive": {
28+
"unlimited": true
29+
},
30+
"id": "703e6a45-408a-1cf4-017d-6f3d7e7b26c9"
31+
}
32+
]

‎src/test/resources/cassettes/features/v2/Validate_a_suppression_rule_returns_OK_response.freeze‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2025-09-01T21:36:20.593Z

‎src/test/resources/cassettes/features/v2/Validate_a_suppression_rule_returns_OK_response.json‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
[
2+
{
3+
"httpRequest": {
4+
"body": {
5+
"type": "JSON",
6+
"json": "{\"data\":{\"attributes\":{\"data_exclusion_query\":\"source:cloudtrail account_id:12345\",\"description\":\"This rule suppresses low-severity signals in staging environments.\",\"enabled\":true,\"name\":\"Custom suppression\",\"rule_query\":\"type:log_detection source:cloudtrail\"},\"type\":\"suppressions\"}}"
7+
},
8+
"headers": {},
9+
"method": "POST",
10+
"path": "/api/v2/security_monitoring/configuration/suppressions/validation",
11+
"keepAlive": false,
12+
"secure": true
13+
},
14+
"httpResponse": {
15+
"headers": {},
16+
"statusCode": 204,
17+
"reasonPhrase": "No Content"
18+
},
19+
"times": {
20+
"remainingTimes": 1
21+
},
22+
"timeToLive": {
23+
"unlimited": true
24+
},
25+
"id": "7fdeeb56-d69b-7809-c8f4-8bdeffca83e0"
26+
}
27+
]

‎src/test/resources/com/datadog/api/client/v2/api/security_monitoring.feature‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1389,3 +1389,17 @@ Feature: Security Monitoring
13891389
And body with value {"cases":[{"name":"","status":"info","notifications":[],"condition":"a > 0"}],"hasExtendedTitle":true,"isEnabled":true,"message":"My security monitoring rule","name":"My security monitoring rule","options":{"evaluationWindow":1800,"keepAlive":1800,"maxSignalDuration":1800,"detectionMethod":"threshold"},"queries":[{"query":"source:source_here","groupByFields":["@userIdentity.assumed_role"],"distinctFields":[],"aggregation":"count","name":""}],"tags":["env:prod","team:security"],"type":"log_detection"}
13901390
When the request is sent
13911391
Then the response status is 204 OK
1392+
1393+
@team:DataDog/k9-cloud-security-platform
1394+
Scenario: Validate a suppression rule returns "Bad Request" response
1395+
Given new "ValidateSecurityMonitoringSuppression" request
1396+
And body with value {"data": {"attributes": {"data_exclusion_query": "not enough attributes"}, "type": "suppressions"}}
1397+
When the request is sent
1398+
Then the response status is 400 Bad Request
1399+
1400+
@team:DataDog/k9-cloud-security-platform
1401+
Scenario: Validate a suppression rule returns "OK" response
1402+
Given new "ValidateSecurityMonitoringSuppression" request
1403+
And body with value {"data": {"attributes": {"data_exclusion_query": "source:cloudtrail account_id:12345", "description": "This rule suppresses low-severity signals in staging environments.", "enabled": true, "name": "Custom suppression", "rule_query": "type:log_detection source:cloudtrail"}, "type": "suppressions"}}
1404+
When the request is sent
1405+
Then the response status is 204 OK

‎src/test/resources/com/datadog/api/client/v2/api/undo.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3024,6 +3024,12 @@
30243024
"type": "safe"
30253025
}
30263026
},
3027+
"ValidateSecurityMonitoringSuppression": {
3028+
"tag": "Security Monitoring",
3029+
"undo": {
3030+
"type": "idempotent"
3031+
}
3032+
},
30273033
"DeleteSecurityMonitoringSuppression": {
30283034
"tag": "Security Monitoring",
30293035
"undo": {

0 commit comments

Comments
 (0)