diff --git a/config/_default/menus/api.en.yaml b/config/_default/menus/api.en.yaml index a345a9b5388..d5487b62d24 100644 --- a/config/_default/menus/api.en.yaml +++ b/config/_default/menus/api.en.yaml @@ -2753,6 +2753,18 @@ menu: - ListSecurityMonitoringRules unstable: [] order: 4 + - name: Get a suppression's version history + url: '#get-a-suppressions-version-history' + identifier: security-monitoring-get-a-suppressions-version-history + parent: security-monitoring + generated: true + params: + versions: + - v2 + operationids: + - GetSuppressionVersionHistory + unstable: [] + order: 0 - name: Update a suppression rule url: '#update-a-suppression-rule' identifier: security-monitoring-update-a-suppression-rule diff --git a/content/en/api/v2/security-monitoring/examples.json b/content/en/api/v2/security-monitoring/examples.json index 1fb49afe3bc..90435aa3c8e 100644 --- a/content/en/api/v2/security-monitoring/examples.json +++ b/content/en/api/v2/security-monitoring/examples.json @@ -3461,6 +3461,88 @@ "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

The new suppression properties; partial updates are supported.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

The suppression rule properties to be updated.

\n
\n
\n
\n
\n
\n

data_exclusion_query

\n
\n

string

\n

An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

A description for the suppression rule.

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the suppression rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

expiration_date

\n
\n

int64

\n

A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore. If unset, the expiration date of the suppression rule is left untouched. If set to null, the expiration date is removed.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the suppression rule.

\n
\n \n
\n
\n
\n
\n
\n

rule_query

\n
\n

string

\n

The rule query of the suppression rule, with the same syntax as the search bar for detection rules.

\n
\n \n
\n
\n
\n
\n
\n

start_date

\n
\n

int64

\n

A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals. If unset, the start date of the suppression rule is left untouched. If set to null, the start date is removed.

\n
\n \n
\n
\n
\n
\n
\n

suppression_query

\n
\n

string

\n

The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer.

\n
\n \n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

List of tags associated with the suppression rule.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int32

\n

The current version of the suppression. This is optional, but it can help prevent concurrent modifications.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource. The value should always be suppressions. \nAllowed enum values: suppressions

default: suppressions

\n
\n \n
\n
\n
\n
" } }, + "GetSuppressionVersionHistory": { + "responses": { + "200": { + "json": { + "data": { + "attributes": { + "count": "integer", + "data": { + "": { + "changes": [ + { + "change": "cloud_provider:aws", + "field": "Tags", + "type": "string" + } + ], + "suppression": { + "creation_date": "integer", + "creator": { + "handle": "john.doe@datadoghq.com", + "name": "John Doe" + }, + "data_exclusion_query": "source:cloudtrail account_id:12345", + "description": "This rule suppresses low-severity signals in staging environments.", + "editable": true, + "enabled": true, + "expiration_date": 1703187336000, + "name": "Custom suppression", + "rule_query": "type:log_detection source:cloudtrail", + "start_date": 1703187336000, + "suppression_query": "env:staging status:low", + "tags": [ + "technique:T1110-brute-force", + "source:cloudtrail" + ], + "update_date": "integer", + "updater": { + "handle": "john.doe@datadoghq.com", + "name": "John Doe" + }, + "version": 42 + } + } + } + }, + "id": "string", + "type": "string" + } + }, + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Data for the suppression version history.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

Response object containing the version history of a suppression.

\n
\n
\n
\n
\n
\n

count

\n
\n

int32

\n

The number of suppression versions.

\n
\n \n
\n
\n
\n
\n
\n

data

\n
\n

object

\n

The version history of a suppression.

\n
\n
\n
\n
\n
\n

<any-key>

\n
\n

object

\n

A suppression version with a list of updates.

\n
\n
\n
\n
\n
\n

changes

\n
\n

[object]

\n

A list of changes.

\n
\n
\n
\n
\n
\n

change

\n
\n

string

\n

The new value of the field.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field that was changed.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of change. \nAllowed enum values: create,update,delete

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

suppression

\n
\n

object

\n

The attributes of the suppression rule.

\n
\n
\n
\n
\n
\n

creation_date

\n
\n

int64

\n

A Unix millisecond timestamp given the creation date of the suppression rule.

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

A user.

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

data_exclusion_query

\n
\n

string

\n

An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

A description for the suppression rule.

\n
\n \n
\n
\n
\n
\n
\n

editable

\n
\n

boolean

\n

Whether the suppression rule is editable.

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the suppression rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

expiration_date

\n
\n

int64

\n

A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the suppression rule.

\n
\n \n
\n
\n
\n
\n
\n

rule_query

\n
\n

string

\n

The rule query of the suppression rule, with the same syntax as the search bar for detection rules.

\n
\n \n
\n
\n
\n
\n
\n

start_date

\n
\n

int64

\n

A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals.

\n
\n \n
\n
\n
\n
\n
\n

suppression_query

\n
\n

string

\n

The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer.

\n
\n \n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

List of tags associated with the suppression rule.

\n
\n \n
\n
\n
\n
\n
\n

update_date

\n
\n

int64

\n

A Unix millisecond timestamp given the update date of the suppression rule.

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

A user.

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int32

\n

The version of the suppression rule; it starts at 1, and is incremented at each update.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the suppression.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

Type of data. \nAllowed enum values: suppression_version_history

\n
\n \n
\n
\n
\n
" + }, + "403": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "404": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "429": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + } + }, + "request": { + "json_curl": {}, + "json": {}, + "html": "" + } + }, "ListSecurityMonitoringRules": { "responses": { "200": { diff --git a/data/api/v2/full_spec.yaml b/data/api/v2/full_spec.yaml index 86def950cf6..10adfc138cc 100644 --- a/data/api/v2/full_spec.yaml +++ b/data/api/v2/full_spec.yaml @@ -23539,6 +23539,30 @@ components: required: - data type: object + GetSuppressionVersionHistoryData: + description: Data for the suppression version history. + properties: + attributes: + $ref: '#/components/schemas/SuppressionVersionHistory' + id: + description: ID of the suppression. + type: string + type: + $ref: '#/components/schemas/GetSuppressionVersionHistoryDataType' + type: object + GetSuppressionVersionHistoryDataType: + description: Type of data. + enum: + - suppression_version_history + type: string + x-enum-varnames: + - SUPPRESSIONVERSIONHISTORY + GetSuppressionVersionHistoryResponse: + description: Response for getting the suppression version history. + properties: + data: + $ref: '#/components/schemas/GetSuppressionVersionHistoryData' + type: object GetTeamMembershipsSort: description: Specifies the order of returned team memberships enum: @@ -43178,38 +43202,13 @@ components: description: The `RuleVersionHistory` `data`. type: object type: object - RuleVersionUpdate: - description: A change in a rule version. - properties: - change: - description: The new value of the field. - example: cloud_provider:aws - type: string - field: - description: The field that was changed. - example: Tags - type: string - type: - $ref: '#/components/schemas/RuleVersionUpdateType' - type: object - RuleVersionUpdateType: - description: The type of change. - enum: - - create - - update - - delete - type: string - x-enum-varnames: - - CREATE - - UPDATE - - DELETE RuleVersions: description: A rule version with a list of updates. properties: changes: description: A list of changes. items: - $ref: '#/components/schemas/RuleVersionUpdate' + $ref: '#/components/schemas/VersionHistoryUpdate' type: array rule: $ref: '#/components/schemas/SecurityMonitoringRuleResponse' @@ -51755,6 +51754,32 @@ components: format: double type: number type: object + SuppressionVersionHistory: + description: Response object containing the version history of a suppression. + properties: + count: + description: The number of suppression versions. + format: int32 + maximum: 2147483647 + type: integer + data: + additionalProperties: + $ref: '#/components/schemas/SuppressionVersions' + description: A suppression version with a list of updates. + description: The version history of a suppression. + type: object + type: object + SuppressionVersions: + description: A suppression version with a list of updates. + properties: + changes: + description: A list of changes. + items: + $ref: '#/components/schemas/VersionHistoryUpdate' + type: array + suppression: + $ref: '#/components/schemas/SecurityMonitoringSuppressionAttributes' + type: object TableResultV2: description: A reference table resource containing its full configuration and state. @@ -55805,6 +55830,31 @@ components: example: 1 format: int64 type: integer + VersionHistoryUpdate: + description: A change in a rule version. + properties: + change: + description: The new value of the field. + example: cloud_provider:aws + type: string + field: + description: The field that was changed. + example: Tags + type: string + type: + $ref: '#/components/schemas/VersionHistoryUpdateType' + type: object + VersionHistoryUpdateType: + description: The type of change. + enum: + - create + - update + - delete + type: string + x-enum-varnames: + - CREATE + - UPDATE + - DELETE VirusTotalAPIKey: description: The definition of the `VirusTotalAPIKey` object. properties: @@ -80862,6 +80912,36 @@ paths: tags: - Security Monitoring x-menu-order: 0 + /api/v2/security_monitoring/configuration/suppressions/{suppression_id}/version_history: + get: + description: Get a suppression's version history. + operationId: GetSuppressionVersionHistory + parameters: + - $ref: '#/components/parameters/SecurityMonitoringSuppressionID' + - $ref: '#/components/parameters/PageSize' + - $ref: '#/components/parameters/PageNumber' + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GetSuppressionVersionHistoryResponse' + description: OK + '403': + $ref: '#/components/responses/NotAuthorizedResponse' + '404': + $ref: '#/components/responses/NotFoundResponse' + '429': + $ref: '#/components/responses/TooManyRequestsResponse' + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_suppressions_read + summary: Get a suppression's version history + tags: + - Security Monitoring + x-menu-order: 0 /api/v2/security_monitoring/rules: get: description: List rules. diff --git a/data/api/v2/translate_actions.json b/data/api/v2/translate_actions.json index d009a396a56..999d4269f58 100644 --- a/data/api/v2/translate_actions.json +++ b/data/api/v2/translate_actions.json @@ -2736,6 +2736,10 @@ "request_description": "New definition of the suppression rule. Supports partial updates.", "request_schema_description": "Request object containing the fields to update on the suppression rule." }, + "GetSuppressionVersionHistory": { + "description": "Get a suppression's version history.", + "summary": "Get a suppression's version history" + }, "ListSecurityMonitoringRules": { "description": "List rules.", "summary": "List rules"