@@ -4,6 +4,13 @@ components:
4
4
headers: {}
5
5
links: {}
6
6
parameters:
7
+ SignalID:
8
+ description: The ID of the signal.
9
+ in: path
10
+ name: signal_id
11
+ required: true
12
+ schema:
13
+ type: string
7
14
SlackAccountNamePathParameter:
8
15
description: Your Slack account name.
9
16
in: path
@@ -360,6 +367,23 @@ components:
360
367
- ADMIN
361
368
- READ_ONLY
362
369
- ERROR
370
+ AddSignalToIncidentRequest:
371
+ description: Attributes describing which incident to add the signal to.
372
+ properties:
373
+ add_to_signal_timeline:
374
+ description: Whether to post the signal on the incident timeline.
375
+ type: boolean
376
+ incident_id:
377
+ description: Public ID attribute of the incident to which the signal will
378
+ be added.
379
+ example: 2066
380
+ format: int64
381
+ type: integer
382
+ version:
383
+ $ref: '#/components/schemas/Version'
384
+ required:
385
+ - incident_id
386
+ type: object
363
387
AgentCheck:
364
388
description: Array of strings.
365
389
example:
@@ -9766,6 +9790,59 @@ components:
9766
9790
type: string
9767
9791
x-enum-varnames:
9768
9792
- TRACE_SERVICE
9793
+ SignalArchiveReason:
9794
+ description: Reason why a signal has been archived.
9795
+ enum:
9796
+ - none
9797
+ - false_positive
9798
+ - testing_or_maintenance
9799
+ - other
9800
+ type: string
9801
+ x-enum-varnames:
9802
+ - NONE
9803
+ - FALSE_POSITIVE
9804
+ - TESTING_OR_MAINTENANCE
9805
+ - OTHER
9806
+ SignalAssigneeUpdateRequest:
9807
+ description: Attributes describing an assignee update operation over a security
9808
+ signal.
9809
+ properties:
9810
+ assignee:
9811
+ description: The UUID of the user being assigned. Use empty string to return
9812
+ signal to unassigned.
9813
+ example: 773b045d-ccf8-4808-bd3b-955ef6a8c940
9814
+ type: string
9815
+ version:
9816
+ $ref: '#/components/schemas/Version'
9817
+ required:
9818
+ - assignee
9819
+ type: object
9820
+ SignalStateUpdateRequest:
9821
+ description: Attributes describing the change of state for a given state.
9822
+ properties:
9823
+ archiveComment:
9824
+ description: Optional comment to explain why a signal is being archived.
9825
+ type: string
9826
+ archiveReason:
9827
+ $ref: '#/components/schemas/SignalArchiveReason'
9828
+ state:
9829
+ $ref: '#/components/schemas/SignalTriageState'
9830
+ version:
9831
+ $ref: '#/components/schemas/Version'
9832
+ required:
9833
+ - state
9834
+ type: object
9835
+ SignalTriageState:
9836
+ description: The new triage state of the signal.
9837
+ enum:
9838
+ - open
9839
+ - archived
9840
+ - under_review
9841
+ type: string
9842
+ x-enum-varnames:
9843
+ - OPEN
9844
+ - ARCHIVED
9845
+ - UNDER_REVIEW
9769
9846
SlackIntegrationChannel:
9770
9847
description: The Slack channel configuration.
9771
9848
properties:
@@ -9814,6 +9891,13 @@ components:
9814
9891
items:
9815
9892
$ref: '#/components/schemas/SlackIntegrationChannel'
9816
9893
type: array
9894
+ SuccessfulSignalUpdateResponse:
9895
+ description: Updated signal data following a successfully performed update.
9896
+ properties:
9897
+ status:
9898
+ description: Status of the response.
9899
+ type: string
9900
+ type: object
9817
9901
SunburstWidgetDefinition:
9818
9902
description: Sunbursts are spot on to highlight how groups contribute to the
9819
9903
total of a query.
@@ -15717,6 +15801,11 @@ components:
15717
15801
user:
15718
15802
$ref: '#/components/schemas/User'
15719
15803
type: object
15804
+ Version:
15805
+ description: Version of the updated signal. If server side version is higher,
15806
+ update will be rejected.
15807
+ format: int64
15808
+ type: integer
15720
15809
WebhooksIntegration:
15721
15810
description: Datadog-Webhooks integration.
15722
15811
properties:
@@ -16636,6 +16725,8 @@ components:
16636
16725
downtimes.
16637
16726
monitors_read: View monitors.
16638
16727
monitors_write: Edit, mute, and delete individual monitors.
16728
+ security_monitoring_signals_read: View Security Signals.
16729
+ security_monitoring_signals_write: Modify Security Signals.
16639
16730
synthetics_global_variable_read: View, search, and use in tests the list
16640
16731
of global variables available for Synthetics.
16641
16732
synthetics_global_variable_write: Create, edit, and delete global variables
@@ -23207,6 +23298,161 @@ paths:
23207
23298
x-menu-order: 4
23208
23299
x-undo:
23209
23300
type: safe
23301
+ /api/v1/security_analytics/signals/{signal_id}/add_to_incident:
23302
+ patch:
23303
+ description: Add a security signal to an incident. This makes it possible to
23304
+ search for signals by incident within the signal explorer and to view the
23305
+ signals on the incident timeline.
23306
+ operationId: AddSecurityMonitoringSignalToIncident
23307
+ parameters:
23308
+ - $ref: '#/components/parameters/SignalID'
23309
+ requestBody:
23310
+ content:
23311
+ application/json:
23312
+ schema:
23313
+ $ref: '#/components/schemas/AddSignalToIncidentRequest'
23314
+ description: Attributes describing the signal update.
23315
+ required: true
23316
+ responses:
23317
+ '200':
23318
+ content:
23319
+ application/json:
23320
+ schema:
23321
+ $ref: '#/components/schemas/SuccessfulSignalUpdateResponse'
23322
+ description: OK
23323
+ '400':
23324
+ content:
23325
+ application/json:
23326
+ schema:
23327
+ $ref: '#/components/schemas/APIErrorResponse'
23328
+ description: Bad Request
23329
+ '403':
23330
+ content:
23331
+ application/json:
23332
+ schema:
23333
+ $ref: '#/components/schemas/APIErrorResponse'
23334
+ description: Forbidden
23335
+ '404':
23336
+ content:
23337
+ application/json:
23338
+ schema:
23339
+ $ref: '#/components/schemas/APIErrorResponse'
23340
+ description: Not Found
23341
+ '429':
23342
+ $ref: '#/components/responses/TooManyRequestsResponse'
23343
+ security:
23344
+ - AuthZ:
23345
+ - security_monitoring_signals_write
23346
+ apiKeyAuth: []
23347
+ appKeyAuth: []
23348
+ summary: Add a security signal to an incident
23349
+ tags:
23350
+ - Security Monitoring
23351
+ x-codegen-request-body-name: body
23352
+ x-undo:
23353
+ type: idempotent
23354
+ /api/v1/security_analytics/signals/{signal_id}/assignee:
23355
+ patch:
23356
+ description: Modify the triage assignee of a security signal.
23357
+ operationId: EditSecurityMonitoringSignalAssignee
23358
+ parameters:
23359
+ - $ref: '#/components/parameters/SignalID'
23360
+ requestBody:
23361
+ content:
23362
+ application/json:
23363
+ schema:
23364
+ $ref: '#/components/schemas/SignalAssigneeUpdateRequest'
23365
+ description: Attributes describing the signal update.
23366
+ required: true
23367
+ responses:
23368
+ '200':
23369
+ content:
23370
+ application/json:
23371
+ schema:
23372
+ $ref: '#/components/schemas/SuccessfulSignalUpdateResponse'
23373
+ description: OK
23374
+ '400':
23375
+ content:
23376
+ application/json:
23377
+ schema:
23378
+ $ref: '#/components/schemas/APIErrorResponse'
23379
+ description: Bad Request
23380
+ '403':
23381
+ content:
23382
+ application/json:
23383
+ schema:
23384
+ $ref: '#/components/schemas/APIErrorResponse'
23385
+ description: Forbidden
23386
+ '404':
23387
+ content:
23388
+ application/json:
23389
+ schema:
23390
+ $ref: '#/components/schemas/APIErrorResponse'
23391
+ description: Not Found
23392
+ '429':
23393
+ $ref: '#/components/responses/TooManyRequestsResponse'
23394
+ security:
23395
+ - AuthZ:
23396
+ - security_monitoring_signals_write
23397
+ apiKeyAuth: []
23398
+ appKeyAuth: []
23399
+ summary: Modify the triage assignee of a security signal
23400
+ tags:
23401
+ - Security Monitoring
23402
+ x-codegen-request-body-name: body
23403
+ x-undo:
23404
+ type: idempotent
23405
+ /api/v1/security_analytics/signals/{signal_id}/state:
23406
+ patch:
23407
+ description: Change the triage state of a security signal.
23408
+ operationId: EditSecurityMonitoringSignalState
23409
+ parameters:
23410
+ - $ref: '#/components/parameters/SignalID'
23411
+ requestBody:
23412
+ content:
23413
+ application/json:
23414
+ schema:
23415
+ $ref: '#/components/schemas/SignalStateUpdateRequest'
23416
+ description: Attributes describing the signal update.
23417
+ required: true
23418
+ responses:
23419
+ '200':
23420
+ content:
23421
+ application/json:
23422
+ schema:
23423
+ $ref: '#/components/schemas/SuccessfulSignalUpdateResponse'
23424
+ description: OK
23425
+ '400':
23426
+ content:
23427
+ application/json:
23428
+ schema:
23429
+ $ref: '#/components/schemas/APIErrorResponse'
23430
+ description: Bad Request
23431
+ '403':
23432
+ content:
23433
+ application/json:
23434
+ schema:
23435
+ $ref: '#/components/schemas/APIErrorResponse'
23436
+ description: Forbidden
23437
+ '404':
23438
+ content:
23439
+ application/json:
23440
+ schema:
23441
+ $ref: '#/components/schemas/APIErrorResponse'
23442
+ description: Not Found
23443
+ '429':
23444
+ $ref: '#/components/responses/TooManyRequestsResponse'
23445
+ security:
23446
+ - AuthZ:
23447
+ - security_monitoring_signals_write
23448
+ apiKeyAuth: []
23449
+ appKeyAuth: []
23450
+ summary: Change the triage state of a security signal
23451
+ tags:
23452
+ - Security Monitoring
23453
+ x-codegen-request-body-name: body
23454
+ x-undo:
23455
+ type: idempotent
23210
23456
/api/v1/series:
23211
23457
post:
23212
23458
description: "The metrics end-point allows you to post time-series data that
@@ -28461,6 +28707,10 @@ tags:
28461
28707
externalDocs:
28462
28708
url: https://docs.datadoghq.com/api/?lang=bash#integration-pagerduty
28463
28709
name: PagerDuty Integration
28710
+ - description: 'Detection rules for generating signals and listing of generated
28711
+
28712
+ signals.'
28713
+ name: Security Monitoring
28464
28714
- description: 'The service check endpoint allows you to post check statuses for use
28465
28715
with monitors.
28466
28716
0 commit comments