diff --git a/examples/v2/security-monitoring/CreateSecurityMonitoringRule_914562040.java b/examples/v2/security-monitoring/CreateSecurityMonitoringRule_914562040.java deleted file mode 100644 index 31792729bc0..00000000000 --- a/examples/v2/security-monitoring/CreateSecurityMonitoringRule_914562040.java +++ /dev/null @@ -1,74 +0,0 @@ -// Create a detection rule with type 'signal_correlation' returns "OK" response - -import com.datadog.api.client.ApiClient; -import com.datadog.api.client.ApiException; -import com.datadog.api.client.v2.api.SecurityMonitoringApi; -import com.datadog.api.client.v2.model.SecurityMonitoringRuleCaseCreate; -import com.datadog.api.client.v2.model.SecurityMonitoringRuleCreatePayload; -import com.datadog.api.client.v2.model.SecurityMonitoringRuleEvaluationWindow; -import com.datadog.api.client.v2.model.SecurityMonitoringRuleKeepAlive; -import com.datadog.api.client.v2.model.SecurityMonitoringRuleMaxSignalDuration; -import com.datadog.api.client.v2.model.SecurityMonitoringRuleOptions; -import com.datadog.api.client.v2.model.SecurityMonitoringRuleQueryAggregation; -import com.datadog.api.client.v2.model.SecurityMonitoringRuleResponse; -import com.datadog.api.client.v2.model.SecurityMonitoringRuleSeverity; -import com.datadog.api.client.v2.model.SecurityMonitoringSignalRuleCreatePayload; -import com.datadog.api.client.v2.model.SecurityMonitoringSignalRuleQuery; -import com.datadog.api.client.v2.model.SecurityMonitoringSignalRuleType; -import java.util.Arrays; -import java.util.Collections; - -public class Example { - public static void main(String[] args) { - ApiClient defaultClient = ApiClient.getDefaultApiClient(); - SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient); - - // there is a valid "security_rule" in the system - String SECURITY_RULE_ID = System.getenv("SECURITY_RULE_ID"); - - // there is a valid "security_rule_bis" in the system - String SECURITY_RULE_BIS_ID = System.getenv("SECURITY_RULE_BIS_ID"); - - SecurityMonitoringRuleCreatePayload body = - new SecurityMonitoringRuleCreatePayload( - new SecurityMonitoringSignalRuleCreatePayload() - .name("Example-Security-Monitoring_signal_rule") - .queries( - Arrays.asList( - new SecurityMonitoringSignalRuleQuery() - .ruleId(SECURITY_RULE_ID) - .aggregation(SecurityMonitoringRuleQueryAggregation.EVENT_COUNT) - .correlatedByFields(Collections.singletonList("host")) - .correlatedQueryIndex(1), - new SecurityMonitoringSignalRuleQuery() - .ruleId(SECURITY_RULE_BIS_ID) - .aggregation(SecurityMonitoringRuleQueryAggregation.EVENT_COUNT) - .correlatedByFields(Collections.singletonList("host")))) - .cases( - Collections.singletonList( - new SecurityMonitoringRuleCaseCreate() - .name("") - .status(SecurityMonitoringRuleSeverity.INFO) - .condition("a > 0 && b > 0"))) - .options( - new SecurityMonitoringRuleOptions() - .evaluationWindow(SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES) - .keepAlive(SecurityMonitoringRuleKeepAlive.ONE_HOUR) - .maxSignalDuration(SecurityMonitoringRuleMaxSignalDuration.ONE_DAY)) - .message("Test signal correlation rule") - .isEnabled(true) - .type(SecurityMonitoringSignalRuleType.SIGNAL_CORRELATION)); - - try { - SecurityMonitoringRuleResponse result = apiInstance.createSecurityMonitoringRule(body); - System.out.println(result); - } catch (ApiException e) { - System.err.println( - "Exception when calling SecurityMonitoringApi#createSecurityMonitoringRule"); - System.err.println("Status code: " + e.getCode()); - System.err.println("Reason: " + e.getResponseBody()); - System.err.println("Response headers: " + e.getResponseHeaders()); - e.printStackTrace(); - } - } -} diff --git a/src/test/resources/com/datadog/api/client/v2/api/security_monitoring.feature b/src/test/resources/com/datadog/api/client/v2/api/security_monitoring.feature index 1088a2c5de2..12b40ab104a 100644 --- a/src/test/resources/com/datadog/api/client/v2/api/security_monitoring.feature +++ b/src/test/resources/com/datadog/api/client/v2/api/security_monitoring.feature @@ -795,19 +795,6 @@ Feature: Security Monitoring And the response "message" is equal to "test" And the response "options.detectionMethod" is equal to "impossible_travel" - @skip-validation @team:DataDog/cloud-siem - Scenario: Create a detection rule with type 'signal_correlation' returns "OK" response - Given there is a valid "security_rule" in the system - And there is a valid "security_rule_bis" in the system - And new "CreateSecurityMonitoringRule" request - And body with value {"name":"{{ unique }}_signal_rule", "queries":[{"ruleId":"{{ security_rule.id }}","aggregation":"event_count","correlatedByFields":["host"],"correlatedQueryIndex":1}, {"ruleId":"{{ security_rule_bis.id }}","aggregation":"event_count","correlatedByFields":["host"]}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0 && b > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test signal correlation rule","tags":[],"isEnabled":true, "type": "signal_correlation"} - When the request is sent - Then the response status is 200 OK - And the response "name" is equal to "{{ unique }}_signal_rule" - And the response "type" is equal to "signal_correlation" - And the response "message" is equal to "Test signal correlation rule" - And the response "isEnabled" is equal to true - @skip-validation @team:DataDog/cloud-siem Scenario: Create a detection rule with type 'workload_security' returns "OK" response Given new "CreateSecurityMonitoringRule" request diff --git a/src/test/resources/generated-test/test-runner-data/manifest.json b/src/test/resources/generated-test/test-runner-data/manifest.json index 2ca1c742b53..a4f966c5aed 100644 --- a/src/test/resources/generated-test/test-runner-data/manifest.json +++ b/src/test/resources/generated-test/test-runner-data/manifest.json @@ -9359,13 +9359,6 @@ "scenario": "Create a detection rule with type 'impossible_travel' returns \"OK\" response", "version": "v2" }, - { - "feature": "Security Monitoring", - "feature_file": "../../com/datadog/api/client/v2/api/security_monitoring.feature", - "file": "v2/security-monitoring/create-a-detection-rule-with-type-signal-correlation-returns-ok-response.json", - "scenario": "Create a detection rule with type 'signal_correlation' returns \"OK\" response", - "version": "v2" - }, { "feature": "Security Monitoring", "feature_file": "../../com/datadog/api/client/v2/api/security_monitoring.feature", diff --git a/src/test/resources/generated-test/test-runner-data/v2/security-monitoring/create-a-detection-rule-with-type-signal-correlation-returns-ok-response.json b/src/test/resources/generated-test/test-runner-data/v2/security-monitoring/create-a-detection-rule-with-type-signal-correlation-returns-ok-response.json deleted file mode 100644 index becea3819c5..00000000000 --- a/src/test/resources/generated-test/test-runner-data/v2/security-monitoring/create-a-detection-rule-with-type-signal-correlation-returns-ok-response.json +++ /dev/null @@ -1,63 +0,0 @@ -{ - "api": "SecurityMonitoring", - "expected_status": 200, - "feature": "Security Monitoring", - "id": "v2/Security Monitoring/Create a detection rule with type 'signal_correlation' returns \"OK\" response", - "operation_id": "CreateSecurityMonitoringRule", - "request": { - "body": { - "schema": { - "format": null, - "ref": "SecurityMonitoringRuleCreatePayload", - "type": null - }, - "source": "inline", - "value": { - "cases": [ - { - "condition": "a > 0 && b > 0", - "name": "", - "notifications": [], - "status": "info" - } - ], - "filters": [], - "isEnabled": true, - "message": "Test signal correlation rule", - "name": "{{ unique }}_signal_rule", - "options": { - "evaluationWindow": 900, - "keepAlive": 3600, - "maxSignalDuration": 86400 - }, - "queries": [ - { - "aggregation": "event_count", - "correlatedByFields": [ - "host" - ], - "correlatedQueryIndex": 1, - "ruleId": "{{ security_rule.id }}" - }, - { - "aggregation": "event_count", - "correlatedByFields": [ - "host" - ], - "ruleId": "{{ security_rule_bis.id }}" - } - ], - "tags": [], - "type": "signal_correlation" - } - }, - "content_type": "application/json", - "method": "POST", - "pagination": false, - "parameters": [], - "path": "/api/v2/security_monitoring/rules" - }, - "scenario": "Create a detection rule with type 'signal_correlation' returns \"OK\" response", - "schema_version": 1, - "version": "v2" -} diff --git a/src/test/resources/generated-test/test-server-data/v2/security-monitoring.json b/src/test/resources/generated-test/test-server-data/v2/security-monitoring.json index 8dd359c09a4..16d767e78e9 100644 --- a/src/test/resources/generated-test/test-server-data/v2/security-monitoring.json +++ b/src/test/resources/generated-test/test-server-data/v2/security-monitoring.json @@ -2622,241 +2622,6 @@ "scenario": "Create a detection rule with type 'impossible_travel' returns \"OK\" response", "version": "v2" }, - { - "feature": "Security Monitoring", - "frozen_at": "2024-05-10T16:34:31.015Z", - "interactions": [ - { - "request": { - "body": { - "type": "json", - "value": { - "cases": [ - { - "condition": "a > 0", - "name": "", - "notifications": [], - "status": "info" - } - ], - "filters": [], - "isEnabled": true, - "message": "Test rule", - "name": "Test-Create_a_detection_rule_with_type_signal_correlation_returns_OK_response-1715358871", - "options": { - "evaluationWindow": 900, - "keepAlive": 3600, - "maxSignalDuration": 86400 - }, - "queries": [ - { - "aggregation": "count", - "distinctFields": [], - "groupByFields": [], - "metrics": [], - "query": "@test:true" - } - ], - "tags": [], - "type": "log_detection" - } - }, - "content_type": "application/json", - "method": "POST", - "path": "/api/v2/security_monitoring/rules", - "query": [] - }, - "response": { - "body": { - "encoding": "text", - "value": "{\"id\":\"gl8-lry-akp\",\"version\":1,\"name\":\"Test-Create_a_detection_rule_with_type_signal_correlation_returns_OK_response-1715358871\",\"createdAt\":1715358871390,\"creationAuthorId\":1445416,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"@test:true\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\"}],\"options\":{\"keepAlive\":3600,\"maxSignalDuration\":86400,\"detectionMethod\":\"threshold\",\"evaluationWindow\":900},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a > 0\"}],\"message\":\"Test rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"log_detection\",\"filters\":[]}\n" - }, - "headers": { - "content-type": "application/json" - }, - "reason": "OK", - "status": 200 - } - }, - { - "request": { - "body": { - "type": "json", - "value": { - "cases": [ - { - "condition": "a > 0", - "name": "", - "notifications": [], - "status": "info" - } - ], - "filters": [], - "isEnabled": true, - "message": "Test rule Bis", - "name": "Test-Create_a_detection_rule_with_type_signal_correlation_returns_OK_response-1715358871_bis", - "options": { - "evaluationWindow": 900, - "keepAlive": 3600, - "maxSignalDuration": 86400 - }, - "queries": [ - { - "aggregation": "count", - "distinctFields": [], - "groupByFields": [], - "metrics": [], - "query": "@test:false" - } - ], - "tags": [], - "type": "log_detection" - } - }, - "content_type": "application/json", - "method": "POST", - "path": "/api/v2/security_monitoring/rules", - "query": [] - }, - "response": { - "body": { - "encoding": "text", - "value": "{\"id\":\"j2a-wag-ngu\",\"version\":1,\"name\":\"Test-Create_a_detection_rule_with_type_signal_correlation_returns_OK_response-1715358871_bis\",\"createdAt\":1715358871759,\"creationAuthorId\":1445416,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"@test:false\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\"}],\"options\":{\"keepAlive\":3600,\"maxSignalDuration\":86400,\"detectionMethod\":\"threshold\",\"evaluationWindow\":900},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a > 0\"}],\"message\":\"Test rule Bis\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"log_detection\",\"filters\":[]}\n" - }, - "headers": { - "content-type": "application/json" - }, - "reason": "OK", - "status": 200 - } - }, - { - "request": { - "body": { - "type": "json", - "value": { - "cases": [ - { - "condition": "a > 0 && b > 0", - "name": "", - "notifications": [], - "status": "info" - } - ], - "filters": [], - "isEnabled": true, - "message": "Test signal correlation rule", - "name": "Test-Create_a_detection_rule_with_type_signal_correlation_returns_OK_response-1715358871_signal_rule", - "options": { - "evaluationWindow": 900, - "keepAlive": 3600, - "maxSignalDuration": 86400 - }, - "queries": [ - { - "aggregation": "event_count", - "correlatedByFields": [ - "host" - ], - "correlatedQueryIndex": 1, - "ruleId": "gl8-lry-akp" - }, - { - "aggregation": "event_count", - "correlatedByFields": [ - "host" - ], - "ruleId": "j2a-wag-ngu" - } - ], - "tags": [], - "type": "signal_correlation" - } - }, - "content_type": "application/json", - "method": "POST", - "path": "/api/v2/security_monitoring/rules", - "query": [] - }, - "response": { - "body": { - "encoding": "text", - "value": "{\"id\":\"x0w-iu0-izf\",\"version\":1,\"name\":\"Test-Create_a_detection_rule_with_type_signal_correlation_returns_OK_response-1715358871_signal_rule\",\"createdAt\":1715358872108,\"creationAuthorId\":1445416,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"event_count\",\"name\":\"\",\"ruleId\":\"gl8-lry-akp\",\"correlatedByFields\":[\"host\"],\"correlatedQueryIndex\":1},{\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"event_count\",\"name\":\"\",\"ruleId\":\"j2a-wag-ngu\",\"correlatedByFields\":[\"host\"]}],\"options\":{\"keepAlive\":3600,\"maxSignalDuration\":86400,\"detectionMethod\":\"threshold\",\"evaluationWindow\":900},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a > 0 && b > 0\"}],\"message\":\"Test signal correlation rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"signal_correlation\",\"filters\":[]}\n" - }, - "headers": { - "content-type": "application/json" - }, - "reason": "OK", - "status": 200 - } - }, - { - "request": { - "body": { - "type": "empty", - "value": null - }, - "content_type": "", - "method": "DELETE", - "path": "/api/v2/security_monitoring/rules/x0w-iu0-izf", - "query": [] - }, - "response": { - "body": { - "encoding": "text", - "value": "" - }, - "headers": {}, - "reason": "No Content", - "status": 204 - } - }, - { - "request": { - "body": { - "type": "empty", - "value": null - }, - "content_type": "", - "method": "DELETE", - "path": "/api/v2/security_monitoring/rules/j2a-wag-ngu", - "query": [] - }, - "response": { - "body": { - "encoding": "text", - "value": "" - }, - "headers": {}, - "reason": "No Content", - "status": 204 - } - }, - { - "request": { - "body": { - "type": "empty", - "value": null - }, - "content_type": "", - "method": "DELETE", - "path": "/api/v2/security_monitoring/rules/gl8-lry-akp", - "query": [] - }, - "response": { - "body": { - "encoding": "text", - "value": "" - }, - "headers": {}, - "reason": "No Content", - "status": 204 - } - } - ], - "scenario": "Create a detection rule with type 'signal_correlation' returns \"OK\" response", - "version": "v2" - }, { "feature": "Security Monitoring", "frozen_at": "2024-05-10T16:34:33.405Z",