diff --git a/hugo/config/_default/menus/api.en.yaml b/hugo/config/_default/menus/api.en.yaml index bb2100ee89e..36fa4ede3e4 100644 --- a/hugo/config/_default/menus/api.en.yaml +++ b/hugo/config/_default/menus/api.en.yaml @@ -4518,6 +4518,84 @@ menu: unstable: - v2 order: 146 + - name: Update a severity modifier rule + url: /api/latest/security-monitoring/update-a-severity-modifier-rule/ + identifier: security-monitoring-update-a-severity-modifier-rule + parent: security-monitoring + generated: true + params: + versions: + - v2 + operationids: + - UpdateSecurityFindingsAutomationSeverityModifierRule + unstable: + - v2 + order: 162 + - name: Get a severity modifier rule + url: /api/latest/security-monitoring/get-a-severity-modifier-rule/ + identifier: security-monitoring-get-a-severity-modifier-rule + parent: security-monitoring + generated: true + params: + versions: + - v2 + operationids: + - GetSecurityFindingsAutomationSeverityModifierRule + unstable: + - v2 + order: 161 + - name: Delete a severity modifier rule + url: /api/latest/security-monitoring/delete-a-severity-modifier-rule/ + identifier: security-monitoring-delete-a-severity-modifier-rule + parent: security-monitoring + generated: true + params: + versions: + - v2 + operationids: + - DeleteSecurityFindingsAutomationSeverityModifierRule + unstable: + - v2 + order: 163 + - name: Reorder severity modifier rules + url: /api/latest/security-monitoring/reorder-severity-modifier-rules/ + identifier: security-monitoring-reorder-severity-modifier-rules + parent: security-monitoring + generated: true + params: + versions: + - v2 + operationids: + - ReorderSecurityFindingsAutomationSeverityModifierRules + unstable: + - v2 + order: 160 + - name: Create a severity modifier rule + url: /api/latest/security-monitoring/create-a-severity-modifier-rule/ + identifier: security-monitoring-create-a-severity-modifier-rule + parent: security-monitoring + generated: true + params: + versions: + - v2 + operationids: + - CreateSecurityFindingsAutomationSeverityModifierRule + unstable: + - v2 + order: 159 + - name: Get all severity modifier rules + url: /api/latest/security-monitoring/get-all-severity-modifier-rules/ + identifier: security-monitoring-get-all-severity-modifier-rules + parent: security-monitoring + generated: true + params: + versions: + - v2 + operationids: + - ListSecurityFindingsAutomationSeverityModifierRules + unstable: + - v2 + order: 158 - name: Update a mute rule url: /api/latest/security-monitoring/update-a-mute-rule/ identifier: security-monitoring-update-a-mute-rule diff --git a/hugo/content/en/api/latest/security-monitoring/create-a-severity-modifier-rule/index.md b/hugo/content/en/api/latest/security-monitoring/create-a-severity-modifier-rule/index.md new file mode 100644 index 00000000000..b844b612b92 --- /dev/null +++ b/hugo/content/en/api/latest/security-monitoring/create-a-severity-modifier-rule/index.md @@ -0,0 +1,3 @@ +--- +title: Create a severity modifier rule +--- diff --git a/hugo/content/en/api/latest/security-monitoring/delete-a-severity-modifier-rule/index.md b/hugo/content/en/api/latest/security-monitoring/delete-a-severity-modifier-rule/index.md new file mode 100644 index 00000000000..fdb44335998 --- /dev/null +++ b/hugo/content/en/api/latest/security-monitoring/delete-a-severity-modifier-rule/index.md @@ -0,0 +1,3 @@ +--- +title: Delete a severity modifier rule +--- diff --git a/hugo/content/en/api/latest/security-monitoring/get-a-severity-modifier-rule/index.md b/hugo/content/en/api/latest/security-monitoring/get-a-severity-modifier-rule/index.md new file mode 100644 index 00000000000..a3ea38c97c2 --- /dev/null +++ b/hugo/content/en/api/latest/security-monitoring/get-a-severity-modifier-rule/index.md @@ -0,0 +1,3 @@ +--- +title: Get a severity modifier rule +--- diff --git a/hugo/content/en/api/latest/security-monitoring/get-all-severity-modifier-rules/index.md b/hugo/content/en/api/latest/security-monitoring/get-all-severity-modifier-rules/index.md new file mode 100644 index 00000000000..8591329f85c --- /dev/null +++ b/hugo/content/en/api/latest/security-monitoring/get-all-severity-modifier-rules/index.md @@ -0,0 +1,3 @@ +--- +title: Get all severity modifier rules +--- diff --git a/hugo/content/en/api/latest/security-monitoring/reorder-severity-modifier-rules/index.md b/hugo/content/en/api/latest/security-monitoring/reorder-severity-modifier-rules/index.md new file mode 100644 index 00000000000..407a685200e --- /dev/null +++ b/hugo/content/en/api/latest/security-monitoring/reorder-severity-modifier-rules/index.md @@ -0,0 +1,3 @@ +--- +title: Reorder severity modifier rules +--- diff --git a/hugo/content/en/api/latest/security-monitoring/update-a-severity-modifier-rule/index.md b/hugo/content/en/api/latest/security-monitoring/update-a-severity-modifier-rule/index.md new file mode 100644 index 00000000000..2f9f63dd70b --- /dev/null +++ b/hugo/content/en/api/latest/security-monitoring/update-a-severity-modifier-rule/index.md @@ -0,0 +1,3 @@ +--- +title: Update a severity modifier rule +--- diff --git a/hugo/content/en/api/v2/security-monitoring/examples.json b/hugo/content/en/api/v2/security-monitoring/examples.json index e833b0d7e12..17df43ee773 100644 --- a/hugo/content/en/api/v2/security-monitoring/examples.json +++ b/hugo/content/en/api/v2/security-monitoring/examples.json @@ -1937,6 +1937,578 @@ "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

The data object for a mute rule create or update request.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Attributes for creating or updating a mute rule.

\n
\n
\n
\n
\n
\n

action [required]

\n
\n

object

\n

The action to take when the mute rule matches a finding.

\n
\n
\n
\n
\n
\n

expire_at

\n
\n

int64

\n

The Unix timestamp in milliseconds at which the mute expires. If omitted, the mute does not expire.

\n
\n \n
\n
\n
\n
\n
\n

reason [required]

\n
\n

enum

\n

The reason for muting a security finding. \nAllowed enum values: duplicate,false_positive,no_fix,other,pending_fix,risk_accepted

\n
\n \n
\n
\n
\n
\n
\n

reason_description

\n
\n

string

\n

An optional description providing more context for the mute reason.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the mute rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the mute rule.

\n
\n \n
\n
\n
\n
\n
\n

rule [required]

\n
\n

object

\n

Defines the scope of findings to which the automation rule applies.

\n
\n
\n
\n
\n
\n

finding_types [required]

\n
\n

[string]

\n

The list of security finding types that the automation rule applies to.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The JSON:API type for mute rules. \nAllowed enum values: mute_rules

\n
\n \n
\n
\n
\n
" } }, + "ListSecurityFindingsAutomationSeverityModifierRules": { + "responses": { + "200": { + "json": { + "data": [ + { + "attributes": { + "action": { + "description": "Lower severity for dev environment noise", + "severity": "low", + "type": "set" + }, + "created_at": 1722439510282, + "created_by": { + "id": "00000000-0000-0000-0000-000000000000", + "name": "Jane Doe", + "type": "user" + }, + "enabled": true, + "modified_at": 1722439510282, + "modified_by": { + "id": "00000000-0000-0000-0000-000000000000", + "name": "Jane Doe", + "type": "user" + }, + "name": "Downgrade misconfigurations in dev", + "rule": { + "finding_types": [ + "misconfiguration" + ], + "query": "env:prod team:platform" + } + }, + "id": "00000000-0000-0000-0000-000000000000", + "type": "severity_modifier_rules" + } + ], + "links": { + "first": "/api/v2/security/findings/automation/mute_rules?page[size]=10&page[number]=0", + "last": "/api/v2/security/findings/automation/mute_rules?page[size]=10&page[number]=5", + "next": "/api/v2/security/findings/automation/mute_rules?page[size]=10&page[number]=2", + "prev": "/api/v2/security/findings/automation/mute_rules?page[size]=10&page[number]=0" + }, + "meta": { + "page": { + "total_filtered_count": 42 + } + } + }, + "html": "
\n
\n
\n
\n

data [required]

\n
\n

[object]

\n

A list of severity modifier rule data objects.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Attributes of a severity modifier rule as returned by the API.

\n
\n
\n
\n
\n
\n

action [required]

\n
\n

 <oneOf>

\n

The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one rank.

A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace.

Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.

\n
\n
\n
\n
\n
\n

<type=set>

\n
\n

object

\n

Sets matched findings to a fixed severity.

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

An optional free-form explanation for the severity change.

\n
\n \n
\n
\n
\n
\n
\n

severity [required]

\n
\n

enum

\n

The severity to assign to matched findings. info_none is not supported for the iac_misconfiguration, runtime_code_vulnerability, secret, or static_code_vulnerability finding types. \nAllowed enum values: info_none,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of a severity modifier rule action that sets a fixed severity. \nAllowed enum values: set

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

<type=shift>

\n
\n

object

\n

Shifts matched findings up or down by one severity rank.

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

An optional free-form explanation for the severity change.

\n
\n \n
\n
\n
\n
\n
\n

severity_delta [required]

\n
\n

enum

\n

The direction in which to shift the severity of matched findings by one rank. \nAllowed enum values: up_one,down_one

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of a severity modifier rule action that shifts the severity by one rank. \nAllowed enum values: shift

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

created_at [required]

\n
\n

int64

\n

The Unix timestamp in milliseconds when the rule was created.

\n
\n \n
\n
\n
\n
\n
\n

created_by [required]

\n
\n

object

\n

The user or Datadog system who created the rule.

\n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The actor's identifier (a user UUID or a system identifier).

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the actor.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Whether the actor is a user or the Datadog system. \nAllowed enum values: user,system

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

Whether the severity modifier rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

modified_at [required]

\n
\n

int64

\n

The Unix timestamp in milliseconds when the rule was last modified.

\n
\n \n
\n
\n
\n
\n
\n

modified_by [required]

\n
\n

object

\n

The user or Datadog system who last modified the rule.

\n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The actor's identifier (a user UUID or a system identifier).

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the actor.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Whether the actor is a user or the Datadog system. \nAllowed enum values: user,system

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the severity modifier rule.

\n
\n \n
\n
\n
\n
\n
\n

rule [required]

\n
\n

object

\n

Defines the scope of findings to which the automation rule applies.

\n
\n
\n
\n
\n
\n

finding_types [required]

\n
\n

[string]

\n

The list of security finding types that the automation rule applies to.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

id [required]

\n
\n

uuid

\n

The ID of the severity modifier rule.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The JSON:API type for severity modifier rules. \nAllowed enum values: severity_modifier_rules

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

links [required]

\n
\n

object

\n

Pagination links for the list of automation rules.

\n
\n
\n
\n
\n
\n

first [required]

\n
\n

string

\n

Link to the first page of results.

\n
\n \n
\n
\n
\n
\n
\n

last [required]

\n
\n

string

\n

Link to the last page of results.

\n
\n \n
\n
\n
\n
\n
\n

next

\n
\n

string

\n

Link to the next page of results.

\n
\n \n
\n
\n
\n
\n
\n

prev

\n
\n

string

\n

Link to the previous page of results.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

meta [required]

\n
\n

object

\n

Metadata for the list of automation rules.

\n
\n
\n
\n
\n
\n

page [required]

\n
\n

object

\n

Pagination information for the list of automation rules.

\n
\n
\n
\n
\n
\n

total_filtered_count [required]

\n
\n

int64

\n

The total number of rules matching the current filter.

\n
\n \n
\n
\n
\n
\n
\n
" + }, + "403": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "404": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "429": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + } + }, + "request": { + "json_curl": {}, + "json": {}, + "html": "" + } + }, + "CreateSecurityFindingsAutomationSeverityModifierRule": { + "responses": { + "201": { + "json": { + "data": { + "attributes": { + "action": { + "description": "Lower severity for dev environment noise", + "severity": "low", + "type": "set" + }, + "created_at": 1722439510282, + "created_by": { + "id": "00000000-0000-0000-0000-000000000000", + "name": "Jane Doe", + "type": "user" + }, + "enabled": true, + "modified_at": 1722439510282, + "modified_by": { + "id": "00000000-0000-0000-0000-000000000000", + "name": "Jane Doe", + "type": "user" + }, + "name": "Downgrade misconfigurations in dev", + "rule": { + "finding_types": [ + "misconfiguration" + ], + "query": "env:prod team:platform" + } + }, + "id": "00000000-0000-0000-0000-000000000000", + "type": "severity_modifier_rules" + } + }, + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

The data object for a severity modifier rule as returned by the API.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Attributes of a severity modifier rule as returned by the API.

\n
\n
\n
\n
\n
\n

action [required]

\n
\n

 <oneOf>

\n

The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one rank.

A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace.

Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.

\n
\n
\n
\n
\n
\n

<type=set>

\n
\n

object

\n

Sets matched findings to a fixed severity.

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

An optional free-form explanation for the severity change.

\n
\n \n
\n
\n
\n
\n
\n

severity [required]

\n
\n

enum

\n

The severity to assign to matched findings. info_none is not supported for the iac_misconfiguration, runtime_code_vulnerability, secret, or static_code_vulnerability finding types. \nAllowed enum values: info_none,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of a severity modifier rule action that sets a fixed severity. \nAllowed enum values: set

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

<type=shift>

\n
\n

object

\n

Shifts matched findings up or down by one severity rank.

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

An optional free-form explanation for the severity change.

\n
\n \n
\n
\n
\n
\n
\n

severity_delta [required]

\n
\n

enum

\n

The direction in which to shift the severity of matched findings by one rank. \nAllowed enum values: up_one,down_one

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of a severity modifier rule action that shifts the severity by one rank. \nAllowed enum values: shift

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

created_at [required]

\n
\n

int64

\n

The Unix timestamp in milliseconds when the rule was created.

\n
\n \n
\n
\n
\n
\n
\n

created_by [required]

\n
\n

object

\n

The user or Datadog system who created the rule.

\n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The actor's identifier (a user UUID or a system identifier).

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the actor.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Whether the actor is a user or the Datadog system. \nAllowed enum values: user,system

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

Whether the severity modifier rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

modified_at [required]

\n
\n

int64

\n

The Unix timestamp in milliseconds when the rule was last modified.

\n
\n \n
\n
\n
\n
\n
\n

modified_by [required]

\n
\n

object

\n

The user or Datadog system who last modified the rule.

\n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The actor's identifier (a user UUID or a system identifier).

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the actor.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Whether the actor is a user or the Datadog system. \nAllowed enum values: user,system

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the severity modifier rule.

\n
\n \n
\n
\n
\n
\n
\n

rule [required]

\n
\n

object

\n

Defines the scope of findings to which the automation rule applies.

\n
\n
\n
\n
\n
\n

finding_types [required]

\n
\n

[string]

\n

The list of security finding types that the automation rule applies to.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

id [required]

\n
\n

uuid

\n

The ID of the severity modifier rule.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The JSON:API type for severity modifier rules. \nAllowed enum values: severity_modifier_rules

\n
\n \n
\n
\n
\n
" + }, + "400": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "403": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "422": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "429": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + } + }, + "request": { + "json_curl": { + "data": { + "attributes": { + "action": {}, + "name": "Downgrade misconfigurations in dev", + "rule": { + "finding_types": [ + "misconfiguration" + ] + } + }, + "type": "severity_modifier_rules" + } + }, + "json": { + "data": { + "attributes": { + "action": { + "description": "Lower severity for dev environment noise", + "severity": "low", + "type": "set" + }, + "enabled": true, + "name": "Downgrade misconfigurations in dev", + "rule": { + "finding_types": [ + "misconfiguration" + ], + "query": "env:prod team:platform" + } + }, + "type": "severity_modifier_rules" + } + }, + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

The data object for a severity modifier rule create or update request.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Attributes for creating or updating a severity modifier rule.

\n
\n
\n
\n
\n
\n

action [required]

\n
\n

 <oneOf>

\n

The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one rank.

A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace.

Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.

\n
\n
\n
\n
\n
\n

<type=set>

\n
\n

object

\n

Sets matched findings to a fixed severity.

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

An optional free-form explanation for the severity change.

\n
\n \n
\n
\n
\n
\n
\n

severity [required]

\n
\n

enum

\n

The severity to assign to matched findings. info_none is not supported for the iac_misconfiguration, runtime_code_vulnerability, secret, or static_code_vulnerability finding types. \nAllowed enum values: info_none,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of a severity modifier rule action that sets a fixed severity. \nAllowed enum values: set

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

<type=shift>

\n
\n

object

\n

Shifts matched findings up or down by one severity rank.

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

An optional free-form explanation for the severity change.

\n
\n \n
\n
\n
\n
\n
\n

severity_delta [required]

\n
\n

enum

\n

The direction in which to shift the severity of matched findings by one rank. \nAllowed enum values: up_one,down_one

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of a severity modifier rule action that shifts the severity by one rank. \nAllowed enum values: shift

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the severity modifier rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the severity modifier rule.

\n
\n \n
\n
\n
\n
\n
\n

rule [required]

\n
\n

object

\n

Defines the scope of findings to which the automation rule applies.

\n
\n
\n
\n
\n
\n

finding_types [required]

\n
\n

[string]

\n

The list of security finding types that the automation rule applies to.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The JSON:API type for severity modifier rules. \nAllowed enum values: severity_modifier_rules

\n
\n \n
\n
\n
\n
" + } + }, + "ReorderSecurityFindingsAutomationSeverityModifierRules": { + "responses": { + "200": { + "json": { + "data": [ + { + "id": "00000000-0000-0000-0000-000000000000", + "type": "severity_modifier_rules" + } + ] + }, + "html": "
\n
\n
\n
\n

data [required]

\n
\n

[object]

\n

The ordered list of severity modifier rules; every rule must be included.

\n
\n
\n
\n
\n
\n

id [required]

\n
\n

uuid

\n

The ID of the automation rule.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The JSON:API type for severity modifier rules. \nAllowed enum values: severity_modifier_rules

\n
\n \n
\n
\n
\n
" + }, + "400": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "403": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "422": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "429": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + } + }, + "request": { + "json_curl": { + "data": [ + { + "id": "00000000-0000-0000-0000-000000000000", + "type": "severity_modifier_rules" + } + ] + }, + "json": { + "data": [ + { + "id": "00000000-0000-0000-0000-000000000000", + "type": "severity_modifier_rules" + } + ] + }, + "html": "
\n
\n
\n
\n

data [required]

\n
\n

[object]

\n

The ordered list of severity modifier rules; every rule must be included.

\n
\n
\n
\n
\n
\n

id [required]

\n
\n

uuid

\n

The ID of the automation rule.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The JSON:API type for severity modifier rules. \nAllowed enum values: severity_modifier_rules

\n
\n \n
\n
\n
\n
" + } + }, + "DeleteSecurityFindingsAutomationSeverityModifierRule": { + "responses": { + "403": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "404": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "422": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "429": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + } + }, + "request": { + "json_curl": {}, + "json": {}, + "html": "" + } + }, + "GetSecurityFindingsAutomationSeverityModifierRule": { + "responses": { + "200": { + "json": { + "data": { + "attributes": { + "action": { + "description": "Lower severity for dev environment noise", + "severity": "low", + "type": "set" + }, + "created_at": 1722439510282, + "created_by": { + "id": "00000000-0000-0000-0000-000000000000", + "name": "Jane Doe", + "type": "user" + }, + "enabled": true, + "modified_at": 1722439510282, + "modified_by": { + "id": "00000000-0000-0000-0000-000000000000", + "name": "Jane Doe", + "type": "user" + }, + "name": "Downgrade misconfigurations in dev", + "rule": { + "finding_types": [ + "misconfiguration" + ], + "query": "env:prod team:platform" + } + }, + "id": "00000000-0000-0000-0000-000000000000", + "type": "severity_modifier_rules" + } + }, + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

The data object for a severity modifier rule as returned by the API.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Attributes of a severity modifier rule as returned by the API.

\n
\n
\n
\n
\n
\n

action [required]

\n
\n

 <oneOf>

\n

The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one rank.

A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace.

Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.

\n
\n
\n
\n
\n
\n

<type=set>

\n
\n

object

\n

Sets matched findings to a fixed severity.

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

An optional free-form explanation for the severity change.

\n
\n \n
\n
\n
\n
\n
\n

severity [required]

\n
\n

enum

\n

The severity to assign to matched findings. info_none is not supported for the iac_misconfiguration, runtime_code_vulnerability, secret, or static_code_vulnerability finding types. \nAllowed enum values: info_none,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of a severity modifier rule action that sets a fixed severity. \nAllowed enum values: set

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

<type=shift>

\n
\n

object

\n

Shifts matched findings up or down by one severity rank.

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

An optional free-form explanation for the severity change.

\n
\n \n
\n
\n
\n
\n
\n

severity_delta [required]

\n
\n

enum

\n

The direction in which to shift the severity of matched findings by one rank. \nAllowed enum values: up_one,down_one

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of a severity modifier rule action that shifts the severity by one rank. \nAllowed enum values: shift

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

created_at [required]

\n
\n

int64

\n

The Unix timestamp in milliseconds when the rule was created.

\n
\n \n
\n
\n
\n
\n
\n

created_by [required]

\n
\n

object

\n

The user or Datadog system who created the rule.

\n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The actor's identifier (a user UUID or a system identifier).

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the actor.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Whether the actor is a user or the Datadog system. \nAllowed enum values: user,system

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

Whether the severity modifier rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

modified_at [required]

\n
\n

int64

\n

The Unix timestamp in milliseconds when the rule was last modified.

\n
\n \n
\n
\n
\n
\n
\n

modified_by [required]

\n
\n

object

\n

The user or Datadog system who last modified the rule.

\n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The actor's identifier (a user UUID or a system identifier).

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the actor.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Whether the actor is a user or the Datadog system. \nAllowed enum values: user,system

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the severity modifier rule.

\n
\n \n
\n
\n
\n
\n
\n

rule [required]

\n
\n

object

\n

Defines the scope of findings to which the automation rule applies.

\n
\n
\n
\n
\n
\n

finding_types [required]

\n
\n

[string]

\n

The list of security finding types that the automation rule applies to.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

id [required]

\n
\n

uuid

\n

The ID of the severity modifier rule.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The JSON:API type for severity modifier rules. \nAllowed enum values: severity_modifier_rules

\n
\n \n
\n
\n
\n
" + }, + "403": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "404": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "422": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "429": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + } + }, + "request": { + "json_curl": {}, + "json": {}, + "html": "" + } + }, + "UpdateSecurityFindingsAutomationSeverityModifierRule": { + "responses": { + "200": { + "json": { + "data": { + "attributes": { + "action": { + "description": "Lower severity for dev environment noise", + "severity": "low", + "type": "set" + }, + "created_at": 1722439510282, + "created_by": { + "id": "00000000-0000-0000-0000-000000000000", + "name": "Jane Doe", + "type": "user" + }, + "enabled": true, + "modified_at": 1722439510282, + "modified_by": { + "id": "00000000-0000-0000-0000-000000000000", + "name": "Jane Doe", + "type": "user" + }, + "name": "Downgrade misconfigurations in dev", + "rule": { + "finding_types": [ + "misconfiguration" + ], + "query": "env:prod team:platform" + } + }, + "id": "00000000-0000-0000-0000-000000000000", + "type": "severity_modifier_rules" + } + }, + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

The data object for a severity modifier rule as returned by the API.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Attributes of a severity modifier rule as returned by the API.

\n
\n
\n
\n
\n
\n

action [required]

\n
\n

 <oneOf>

\n

The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one rank.

A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace.

Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.

\n
\n
\n
\n
\n
\n

<type=set>

\n
\n

object

\n

Sets matched findings to a fixed severity.

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

An optional free-form explanation for the severity change.

\n
\n \n
\n
\n
\n
\n
\n

severity [required]

\n
\n

enum

\n

The severity to assign to matched findings. info_none is not supported for the iac_misconfiguration, runtime_code_vulnerability, secret, or static_code_vulnerability finding types. \nAllowed enum values: info_none,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of a severity modifier rule action that sets a fixed severity. \nAllowed enum values: set

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

<type=shift>

\n
\n

object

\n

Shifts matched findings up or down by one severity rank.

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

An optional free-form explanation for the severity change.

\n
\n \n
\n
\n
\n
\n
\n

severity_delta [required]

\n
\n

enum

\n

The direction in which to shift the severity of matched findings by one rank. \nAllowed enum values: up_one,down_one

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of a severity modifier rule action that shifts the severity by one rank. \nAllowed enum values: shift

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

created_at [required]

\n
\n

int64

\n

The Unix timestamp in milliseconds when the rule was created.

\n
\n \n
\n
\n
\n
\n
\n

created_by [required]

\n
\n

object

\n

The user or Datadog system who created the rule.

\n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The actor's identifier (a user UUID or a system identifier).

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the actor.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Whether the actor is a user or the Datadog system. \nAllowed enum values: user,system

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

Whether the severity modifier rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

modified_at [required]

\n
\n

int64

\n

The Unix timestamp in milliseconds when the rule was last modified.

\n
\n \n
\n
\n
\n
\n
\n

modified_by [required]

\n
\n

object

\n

The user or Datadog system who last modified the rule.

\n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The actor's identifier (a user UUID or a system identifier).

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the actor.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Whether the actor is a user or the Datadog system. \nAllowed enum values: user,system

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the severity modifier rule.

\n
\n \n
\n
\n
\n
\n
\n

rule [required]

\n
\n

object

\n

Defines the scope of findings to which the automation rule applies.

\n
\n
\n
\n
\n
\n

finding_types [required]

\n
\n

[string]

\n

The list of security finding types that the automation rule applies to.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

id [required]

\n
\n

uuid

\n

The ID of the severity modifier rule.

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The JSON:API type for severity modifier rules. \nAllowed enum values: severity_modifier_rules

\n
\n \n
\n
\n
\n
" + }, + "400": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "403": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "404": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "422": { + "json": { + "errors": [ + { + "detail": "Missing required attribute in body", + "meta": {}, + "source": { + "header": "Authorization", + "parameter": "limit", + "pointer": "/data/attributes/title" + }, + "status": "400", + "title": "Bad Request" + } + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[object]

\n

A list of errors.

\n
\n
\n
\n
\n
\n

detail

\n
\n

string

\n

A human-readable explanation specific to this occurrence of the error.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Non-standard meta-information about the error

\n
\n \n
\n
\n
\n
\n
\n

source

\n
\n

object

\n

References to the source of the error.

\n
\n
\n
\n
\n
\n

header

\n
\n

string

\n

A string indicating the name of a single request header which caused the error.

\n
\n \n
\n
\n
\n
\n
\n

parameter

\n
\n

string

\n

A string indicating which URI query parameter caused the error.

\n
\n \n
\n
\n
\n
\n
\n

pointer

\n
\n

string

\n

A JSON pointer to the value in the request document that caused the error.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

status

\n
\n

string

\n

Status code of the response.

\n
\n \n
\n
\n
\n
\n
\n

title

\n
\n

string

\n

Short human-readable summary of the error.

\n
\n \n
\n
\n
\n
" + }, + "429": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + } + }, + "request": { + "json_curl": { + "data": { + "attributes": { + "action": {}, + "name": "Downgrade misconfigurations in dev", + "rule": { + "finding_types": [ + "misconfiguration" + ] + } + }, + "type": "severity_modifier_rules" + } + }, + "json": { + "data": { + "attributes": { + "action": { + "description": "Lower severity for dev environment noise", + "severity": "low", + "type": "set" + }, + "enabled": true, + "name": "Downgrade misconfigurations in dev", + "rule": { + "finding_types": [ + "misconfiguration" + ], + "query": "env:prod team:platform" + } + }, + "type": "severity_modifier_rules" + } + }, + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

The data object for a severity modifier rule create or update request.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Attributes for creating or updating a severity modifier rule.

\n
\n
\n
\n
\n
\n

action [required]

\n
\n

 <oneOf>

\n

The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one rank.

A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace.

Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.

\n
\n
\n
\n
\n
\n

<type=set>

\n
\n

object

\n

Sets matched findings to a fixed severity.

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

An optional free-form explanation for the severity change.

\n
\n \n
\n
\n
\n
\n
\n

severity [required]

\n
\n

enum

\n

The severity to assign to matched findings. info_none is not supported for the iac_misconfiguration, runtime_code_vulnerability, secret, or static_code_vulnerability finding types. \nAllowed enum values: info_none,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of a severity modifier rule action that sets a fixed severity. \nAllowed enum values: set

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

<type=shift>

\n
\n

object

\n

Shifts matched findings up or down by one severity rank.

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

An optional free-form explanation for the severity change.

\n
\n \n
\n
\n
\n
\n
\n

severity_delta [required]

\n
\n

enum

\n

The direction in which to shift the severity of matched findings by one rank. \nAllowed enum values: up_one,down_one

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of a severity modifier rule action that shifts the severity by one rank. \nAllowed enum values: shift

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the severity modifier rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the severity modifier rule.

\n
\n \n
\n
\n
\n
\n
\n

rule [required]

\n
\n

object

\n

Defines the scope of findings to which the automation rule applies.

\n
\n
\n
\n
\n
\n

finding_types [required]

\n
\n

[string]

\n

The list of security finding types that the automation rule applies to.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The JSON:API type for severity modifier rules. \nAllowed enum values: severity_modifier_rules

\n
\n \n
\n
\n
\n
" + } + }, "ListSecurityFindingsAutomationTicketCreationRules": { "responses": { "200": { diff --git a/hugo/content/en/api/v2/security-monitoring/request.CreateSecurityFindingsAutomationSeverityModifierRule.json b/hugo/content/en/api/v2/security-monitoring/request.CreateSecurityFindingsAutomationSeverityModifierRule.json new file mode 100644 index 00000000000..f00143e2f83 --- /dev/null +++ b/hugo/content/en/api/v2/security-monitoring/request.CreateSecurityFindingsAutomationSeverityModifierRule.json @@ -0,0 +1,20 @@ +{ + "data": { + "attributes": { + "action": { + "description": "Lower severity for dev environment noise", + "severity": "low", + "type": "set" + }, + "enabled": true, + "name": "Downgrade misconfigurations in dev", + "rule": { + "finding_types": [ + "misconfiguration" + ], + "query": "env:prod team:platform" + } + }, + "type": "severity_modifier_rules" + } +} \ No newline at end of file diff --git a/hugo/content/en/api/v2/security-monitoring/request.ReorderSecurityFindingsAutomationSeverityModifierRules.json b/hugo/content/en/api/v2/security-monitoring/request.ReorderSecurityFindingsAutomationSeverityModifierRules.json new file mode 100644 index 00000000000..ff69fd3d587 --- /dev/null +++ b/hugo/content/en/api/v2/security-monitoring/request.ReorderSecurityFindingsAutomationSeverityModifierRules.json @@ -0,0 +1,8 @@ +{ + "data": [ + { + "id": "00000000-0000-0000-0000-000000000000", + "type": "severity_modifier_rules" + } + ] +} \ No newline at end of file diff --git a/hugo/content/en/api/v2/security-monitoring/request.UpdateSecurityFindingsAutomationSeverityModifierRule.json b/hugo/content/en/api/v2/security-monitoring/request.UpdateSecurityFindingsAutomationSeverityModifierRule.json new file mode 100644 index 00000000000..f00143e2f83 --- /dev/null +++ b/hugo/content/en/api/v2/security-monitoring/request.UpdateSecurityFindingsAutomationSeverityModifierRule.json @@ -0,0 +1,20 @@ +{ + "data": { + "attributes": { + "action": { + "description": "Lower severity for dev environment noise", + "severity": "low", + "type": "set" + }, + "enabled": true, + "name": "Downgrade misconfigurations in dev", + "rule": { + "finding_types": [ + "misconfiguration" + ], + "query": "env:prod team:platform" + } + }, + "type": "severity_modifier_rules" + } +} \ No newline at end of file diff --git a/hugo/content/en/data_security/data_retention_periods.md b/hugo/content/en/data_security/data_retention_periods.md index f4d2f81744a..e069813460a 100644 --- a/hugo/content/en/data_security/data_retention_periods.md +++ b/hugo/content/en/data_security/data_retention_periods.md @@ -117,7 +117,7 @@ attributes: - product: Log Management data_type: | - **Logs**: Determined by customer plan - - **Sensitive Data Scanner example logs**: 3 days7 days + - **Sensitive Data Scanner example logs**: 7 days - product: Metrics data_type: | - **Tags and values**: 15 months diff --git a/hugo/content/en/security/code_security/iac_security/configuration.md b/hugo/content/en/security/code_security/iac_security/configuration.md index e655087e91d..6f4209c8964 100644 --- a/hugo/content/en/security/code_security/iac_security/configuration.md +++ b/hugo/content/en/security/code_security/iac_security/configuration.md @@ -18,7 +18,7 @@ further_reading: text: "IaC Security Rules" --- -Infrastructure as Code (IaC) Security detects IaC misconfigurations. By default, IaC Security scans repositories with [all supported rules][3]. You can customize which rules run and on which paths, as well as their severities and categories. Configure these settings under the `iac` key in the Code Security configuration, either in Datadog or in a `code-security.datadog.yaml` file. +Infrastructure as Code (IaC) Security detects IaC misconfigurations. By default, IaC Security scans repositories with [all supported rules][3]. You can customize which rules run and on which paths, as well as their severities and rule types. Configure these settings under the `iac` key in the Code Security configuration, either in Datadog or in a `code-security.datadog.yaml` file. For information on configuration locations, precedence, and merging, see [Code Security Configuration Reference][1]. @@ -26,7 +26,7 @@ For information on configuration locations, precedence, and merging, see [Code S You can configure IaC Security using: -- Datadog or a `code-security.datadog.yaml` file for repository-wide rule, severity, category, and path settings. Use this method when you want the same configuration to apply across a repository or organization. +- Datadog or a `code-security.datadog.yaml` file for repository-wide rule, severity, rule type, and path settings. Use this method when you want the same configuration to apply across a repository or organization. - Inline comments for local, file-specific exclusions that should stay with the IaC file. Use this method when an exception applies to a specific line, block, or file. ## Configuration format @@ -64,10 +64,10 @@ iac: only-severities: - high - critical - # Do not report findings in these categories. + # Do not report findings with these rule types. ignore-categories: - "Best Practices" - # Report only findings in these categories. + # Report only findings with these rule types. only-categories: - "Encryption" # Do not run rules from these platforms. @@ -136,8 +136,8 @@ The `global-config` object controls repository-wide settings: | `ignore-paths` | Array | File paths or glob patterns to exclude. Matching files are not analyzed. | | `only-severities` | Array | Severity levels to report. Findings with other severities are not reported. | | `ignore-severities` | Array | Severity levels to ignore. | -| `only-categories` | Array | Categories to report. Findings in other categories are not reported. | -| `ignore-categories` | Array | Categories to ignore. | +| `only-categories` | Array | Rule types to report. Findings with other rule types are not reported. | +| `ignore-categories` | Array | Rule types to ignore. | | `ignore-platforms` | Array | Platforms to skip. Rules from these platforms are not applied. | | `only-platforms` | Array | Platforms to scan. Rules from other platforms are not applied. | @@ -175,9 +175,9 @@ iac: - "**/config.file" {{< /code-block >}} -### Categories +### Rule types -Use `ignore-categories` to ignore findings in specific categories. Use `only-categories` to report only specific categories. +Use `ignore-categories` to ignore findings with specific rule types. Use `only-categories` to report only specific rule types. **Possible values:** diff --git a/hugo/content/en/security/sensitive_data_scanner/guide/investigate_sensitive_data_findings.md b/hugo/content/en/security/sensitive_data_scanner/guide/investigate_sensitive_data_findings.md index fda9a7e391c..2d122f3681e 100644 --- a/hugo/content/en/security/sensitive_data_scanner/guide/investigate_sensitive_data_findings.md +++ b/hugo/content/en/security/sensitive_data_scanner/guide/investigate_sensitive_data_findings.md @@ -50,7 +50,7 @@ To investigate a log finding: 3. At the top of the panel, check {{< ui >}}First Detected{{< /ui >}} and {{< ui >}}Last Detected{{< /ui >}} to understand how long the exposure has been active. 4. In the summary section, review {{< ui >}}Match State{{< /ui >}}, {{< ui >}}Service{{< /ui >}}, {{< ui >}}Environment{{< /ui >}}, and {{< ui >}}Total matches{{< /ui >}} to understand the scope of the exposure. 5. Review the {{< ui >}}Logs Pattern{{< /ui >}} to understand the format of the log line where sensitive data was detected. -6. In the {{< ui >}}Example Logs{{< /ui >}} section, review up to 5 representative examples of affected logs. When an example log expires it is replaced with the next matching event. Click {{< ui >}}Show log{{< /ui >}} to expand an example and inspect its log message, fields, and attributes inline. By default, example logs are stored for 3 days7 days and are accessible to all users with the Data Scanner Read permission. To store these representative logs for a different period, contact [Support][1]. +6. In the {{< ui >}}Example Logs{{< /ui >}} section, review up to five representative examples of affected logs. When an example log expires, it is replaced with the next matching event. Click {{< ui >}}Show log{{< /ui >}} to expand an example and inspect its log message, fields, and attributes inline. By default, example logs are stored for 7 days and are accessible to all users with the Data Scanner Read permission. To store these representative logs for a different period, contact [Support][1]. 7. Review {{< ui >}}Matches Trend{{< /ui >}} to see how match volume has changed over the past week. Use {{< ui >}}Related Access and Configuration Events{{< /ui >}} to check whether recent access events or changes to the scanning group or scanning rule line up with changes in match volume. Additionally, you can: diff --git a/hugo/data/api/v2/CodeExamples.json b/hugo/data/api/v2/CodeExamples.json index 79b1a9e87ba..e36fad79ec1 100644 --- a/hugo/data/api/v2/CodeExamples.json +++ b/hugo/data/api/v2/CodeExamples.json @@ -2288,6 +2288,13 @@ "description": "Create a security filter returns \"OK\" response" } ], + "CreateSecurityFindingsAutomationSeverityModifierRule": [ + { + "group": "security_monitoring", + "suffix": "", + "description": "Create a severity modifier rule returns \"Successfully created the severity modifier rule\" response" + } + ], "CreateSecurityMonitoringSuppression": [ { "group": "security_monitoring", @@ -2406,6 +2413,13 @@ "description": "Reorder mute rules returns \"Successfully reordered the mute rules\" response" } ], + "ReorderSecurityFindingsAutomationSeverityModifierRules": [ + { + "group": "security_monitoring", + "suffix": "", + "description": "Reorder severity modifier rules returns \"Successfully reordered the severity modifier rules\" response" + } + ], "ReorderSecurityFindingsAutomationTicketCreationRules": [ { "group": "security_monitoring", @@ -2493,6 +2507,13 @@ "description": "Update a security filter returns \"OK\" response" } ], + "UpdateSecurityFindingsAutomationSeverityModifierRule": [ + { + "group": "security_monitoring", + "suffix": "", + "description": "Update a severity modifier rule returns \"Successfully updated the severity modifier rule\" response" + } + ], "UpdateSecurityMonitoringSuppression": [ { "group": "security_monitoring", diff --git a/hugo/data/api/v2/full_spec.yaml b/hugo/data/api/v2/full_spec.yaml index b899a80a949..6cae24f8d75 100644 --- a/hugo/data/api/v2/full_spec.yaml +++ b/hugo/data/api/v2/full_spec.yaml @@ -103566,6 +103566,267 @@ components: required: - type type: object + SeverityModifierRuleAction: + description: |- + The action to take when a severity modifier rule matches a finding. This is a discriminated union on `type`: `set` assigns a fixed severity, while `shift` moves the severity up or down by one rank. + + A severity modifier rule's `rule.query` must not filter on `@severity` or on the `@severity_details.user_adjusted.*` namespace. + + Use `@severity_details.adjusted.value` instead, which reflects the severity before user-defined adjustments. + oneOf: + - $ref: "#/components/schemas/SeverityModifierRuleSetAction" + - $ref: "#/components/schemas/SeverityModifierRuleShiftAction" + SeverityModifierRuleAttributesCreate: + description: Attributes for creating or updating a severity modifier rule. + properties: + action: + $ref: "#/components/schemas/SeverityModifierRuleAction" + enabled: + description: Whether the severity modifier rule is enabled. + example: true + type: boolean + name: + description: The name of the severity modifier rule. + example: "Downgrade misconfigurations in dev" + maxLength: 255 + minLength: 1 + type: string + rule: + $ref: "#/components/schemas/AutomationRuleScope" + required: + - name + - rule + - action + type: object + SeverityModifierRuleAttributesResponse: + description: Attributes of a severity modifier rule as returned by the API. + properties: + action: + $ref: "#/components/schemas/SeverityModifierRuleAction" + created_at: + description: The Unix timestamp in milliseconds when the rule was created. + example: 1722439510282 + format: int64 + type: integer + created_by: + $ref: "#/components/schemas/AutomationRuleCreatedBy" + enabled: + description: Whether the severity modifier rule is enabled. + example: true + type: boolean + modified_at: + description: The Unix timestamp in milliseconds when the rule was last modified. + example: 1722439510282 + format: int64 + type: integer + modified_by: + $ref: "#/components/schemas/AutomationRuleModifiedBy" + name: + description: The name of the severity modifier rule. + example: "Downgrade misconfigurations in dev" + maxLength: 255 + minLength: 1 + type: string + rule: + $ref: "#/components/schemas/AutomationRuleScope" + required: + - name + - enabled + - rule + - action + - created_at + - created_by + - modified_at + - modified_by + type: object + SeverityModifierRuleCreateRequest: + description: The body of a severity modifier rule create request. + properties: + data: + $ref: "#/components/schemas/SeverityModifierRuleDataCreate" + required: + - data + type: object + SeverityModifierRuleDataCreate: + description: The data object for a severity modifier rule create or update request. + properties: + attributes: + $ref: "#/components/schemas/SeverityModifierRuleAttributesCreate" + type: + $ref: "#/components/schemas/SeverityModifierRuleType" + required: + - type + - attributes + type: object + SeverityModifierRuleDataResponse: + description: The data object for a severity modifier rule as returned by the API. + properties: + attributes: + $ref: "#/components/schemas/SeverityModifierRuleAttributesResponse" + id: + description: The ID of the severity modifier rule. + example: "00000000-0000-0000-0000-000000000000" + format: uuid + type: string + type: + $ref: "#/components/schemas/SeverityModifierRuleType" + required: + - id + - type + - attributes + type: object + SeverityModifierRuleReorderData: + description: The ordered list of severity modifier rules; every rule must be included. + items: + $ref: "#/components/schemas/SeverityModifierRuleReorderItem" + type: array + SeverityModifierRuleReorderItem: + description: A reference to a severity modifier rule used for reordering. + properties: + id: + description: The ID of the automation rule. + example: "00000000-0000-0000-0000-000000000000" + format: uuid + type: string + type: + $ref: "#/components/schemas/SeverityModifierRuleType" + required: + - type + - id + type: object + SeverityModifierRuleReorderRequest: + description: The body of a severity modifier rule reorder request. + properties: + data: + $ref: "#/components/schemas/SeverityModifierRuleReorderData" + required: + - data + type: object + SeverityModifierRuleReorderResponse: + description: The response of a severity modifier rule reorder request. + properties: + data: + $ref: "#/components/schemas/SeverityModifierRuleReorderData" + required: + - data + type: object + SeverityModifierRuleResponse: + description: A single severity modifier rule response. + properties: + data: + $ref: "#/components/schemas/SeverityModifierRuleDataResponse" + required: + - data + type: object + SeverityModifierRuleSetAction: + description: Sets matched findings to a fixed severity. + properties: + description: + description: An optional free-form explanation for the severity change. + example: "Lower severity for dev environment noise" + maxLength: 20000 + type: string + severity: + $ref: "#/components/schemas/SeverityModifierSeverity" + type: + $ref: "#/components/schemas/SeverityModifierRuleSetActionType" + required: + - type + - severity + type: object + SeverityModifierRuleSetActionType: + description: The type of a severity modifier rule action that sets a fixed severity. + enum: + - set + example: set + type: string + x-enum-varnames: + - SET + SeverityModifierRuleShiftAction: + description: Shifts matched findings up or down by one severity rank. + properties: + description: + description: An optional free-form explanation for the severity change. + example: "Lower severity for dev environment noise" + maxLength: 20000 + type: string + severity_delta: + $ref: "#/components/schemas/SeverityModifierSeverityDelta" + type: + $ref: "#/components/schemas/SeverityModifierRuleShiftActionType" + required: + - type + - severity_delta + type: object + SeverityModifierRuleShiftActionType: + description: The type of a severity modifier rule action that shifts the severity by one rank. + enum: + - shift + example: shift + type: string + x-enum-varnames: + - SHIFT + SeverityModifierRuleType: + description: The JSON:API type for severity modifier rules. + enum: + - severity_modifier_rules + example: severity_modifier_rules + type: string + x-enum-varnames: + - SEVERITY_MODIFIER_RULES + SeverityModifierRuleUpdateRequest: + description: The body of a severity modifier rule update request. + properties: + data: + $ref: "#/components/schemas/SeverityModifierRuleDataCreate" + required: + - data + type: object + SeverityModifierRulesDataList: + description: A list of severity modifier rule data objects. + items: + $ref: "#/components/schemas/SeverityModifierRuleDataResponse" + type: array + SeverityModifierRulesResponse: + description: A list of severity modifier rules with pagination metadata. + properties: + data: + $ref: "#/components/schemas/SeverityModifierRulesDataList" + links: + $ref: "#/components/schemas/SecurityAutomationRulesLinks" + meta: + $ref: "#/components/schemas/SecurityAutomationRulesMeta" + required: + - data + - meta + - links + type: object + SeverityModifierSeverity: + description: The severity to assign to matched findings. `info_none` is not supported for the `iac_misconfiguration`, `runtime_code_vulnerability`, `secret`, or `static_code_vulnerability` finding types. + enum: + - info_none + - low + - medium + - high + - critical + example: low + type: string + x-enum-varnames: + - INFO_NONE + - LOW + - MEDIUM + - HIGH + - CRITICAL + SeverityModifierSeverityDelta: + description: The direction in which to shift the severity of matched findings by one rank. + enum: + - up_one + - down_one + example: up_one + type: string + x-enum-varnames: + - UP_ONE + - DOWN_ONE SharedDashboardGlobalTime: additionalProperties: {} description: Default time range configuration for the shared dashboard. @@ -191751,6 +192012,459 @@ paths: x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). + /api/v2/security/findings/automation/severity_modifier_rules: + get: + description: Get all severity modifier rules for the current organization. + operationId: ListSecurityFindingsAutomationSeverityModifierRules + parameters: + - description: The number of rules per page. Maximum is 1000. + in: query + name: page[size] + required: false + schema: + default: 1000 + example: 10 + format: int64 + maximum: 1000 + minimum: 1 + type: integer + - description: The page number to return. + in: query + name: page[number] + required: false + schema: + default: 0 + example: 0 + format: int64 + minimum: 0 + type: integer + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + - attributes: + action: + description: "Lower severity for dev environment noise" + severity: low + type: set + created_at: 1722439510282 + created_by: + id: "00000000-0000-0000-0000-000000000000" + name: "Jane Doe" + type: user + enabled: true + modified_at: 1722439510282 + modified_by: + id: "00000000-0000-0000-0000-000000000000" + name: "Jane Doe" + type: user + name: "Downgrade misconfigurations in dev" + rule: + finding_types: + - misconfiguration + query: "env:dev" + id: "00000000-0000-0000-0000-000000000000" + type: severity_modifier_rules + links: + first: "/api/v2/security/findings/automation/severity_modifier_rules?page[size]=1000&page[number]=0" + last: "/api/v2/security/findings/automation/severity_modifier_rules?page[size]=1000&page[number]=0" + meta: + page: + total_filtered_count: 1 + schema: + $ref: "#/components/schemas/SeverityModifierRulesResponse" + description: Successfully retrieved the list of severity modifier rules + "403": + $ref: "#/components/responses/ForbiddenResponse" + "404": + $ref: "#/components/responses/NotFoundResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + summary: Get all severity modifier rules + tags: + - Security Monitoring + x-menu-order: 158 + x-permission: + operator: OR + permissions: + - security_pipelines_read + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). + post: + description: Create a new severity modifier rule for the current organization. + operationId: CreateSecurityFindingsAutomationSeverityModifierRule + requestBody: + content: + application/json: + examples: + default: + value: + data: + attributes: + action: + description: "Lower severity for dev environment noise" + severity: low + type: set + enabled: true + name: "Downgrade misconfigurations in dev" + rule: + finding_types: + - misconfiguration + query: "env:dev" + type: severity_modifier_rules + schema: + $ref: "#/components/schemas/SeverityModifierRuleCreateRequest" + required: true + responses: + "201": + content: + application/json: + examples: + default: + value: + data: + attributes: + action: + description: "Lower severity for dev environment noise" + severity: low + type: set + created_at: 1722439510282 + created_by: + id: "00000000-0000-0000-0000-000000000000" + name: "Jane Doe" + type: user + enabled: true + modified_at: 1722439510282 + modified_by: + id: "00000000-0000-0000-0000-000000000000" + name: "Jane Doe" + type: user + name: "Downgrade misconfigurations in dev" + rule: + finding_types: + - misconfiguration + query: "env:dev" + id: "00000000-0000-0000-0000-000000000000" + type: severity_modifier_rules + schema: + $ref: "#/components/schemas/SeverityModifierRuleResponse" + description: Successfully created the severity modifier rule + "400": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Bad Request + "403": + $ref: "#/components/responses/ForbiddenResponse" + "422": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Unprocessable Entity + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + summary: Create a severity modifier rule + tags: + - Security Monitoring + x-codegen-request-body-name: body + x-menu-order: 159 + x-permission: + operator: OR + permissions: + - security_pipelines_write + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). + /api/v2/security/findings/automation/severity_modifier_rules/reorder: + post: + description: Reorder the list of severity modifier rules for the current organization. + operationId: ReorderSecurityFindingsAutomationSeverityModifierRules + requestBody: + content: + application/json: + examples: + default: + value: + data: + - id: "00000000-0000-0000-0000-000000000000" + type: severity_modifier_rules + - id: "11111111-1111-1111-1111-111111111111" + type: severity_modifier_rules + schema: + $ref: "#/components/schemas/SeverityModifierRuleReorderRequest" + required: true + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + - id: "00000000-0000-0000-0000-000000000000" + type: severity_modifier_rules + - id: "11111111-1111-1111-1111-111111111111" + type: severity_modifier_rules + schema: + $ref: "#/components/schemas/SeverityModifierRuleReorderResponse" + description: Successfully reordered the severity modifier rules + "400": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Bad Request + "403": + $ref: "#/components/responses/ForbiddenResponse" + "422": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Unprocessable Entity + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + summary: Reorder severity modifier rules + tags: + - Security Monitoring + x-codegen-request-body-name: body + x-menu-order: 160 + x-permission: + operator: OR + permissions: + - security_pipelines_write + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). + /api/v2/security/findings/automation/severity_modifier_rules/{rule_id}: + delete: + description: Delete an existing severity modifier rule by ID. + operationId: DeleteSecurityFindingsAutomationSeverityModifierRule + parameters: + - description: The ID of the severity modifier rule. + in: path + name: rule_id + required: true + schema: + example: "00000000-0000-0000-0000-000000000000" + format: uuid + type: string + responses: + "204": + description: "Rule successfully deleted" + "403": + $ref: "#/components/responses/ForbiddenResponse" + "404": + $ref: "#/components/responses/NotFoundResponse" + "422": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Unprocessable Entity + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + summary: Delete a severity modifier rule + tags: + - Security Monitoring + x-menu-order: 163 + x-permission: + operator: OR + permissions: + - security_pipelines_write + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). + get: + description: Get the details of a severity modifier rule by ID. + operationId: GetSecurityFindingsAutomationSeverityModifierRule + parameters: + - description: The ID of the severity modifier rule. + in: path + name: rule_id + required: true + schema: + example: "00000000-0000-0000-0000-000000000000" + format: uuid + type: string + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + attributes: + action: + description: "Lower severity for dev environment noise" + severity: low + type: set + created_at: 1722439510282 + created_by: + id: "00000000-0000-0000-0000-000000000000" + name: "Jane Doe" + type: user + enabled: true + modified_at: 1722439510282 + modified_by: + id: "00000000-0000-0000-0000-000000000000" + name: "Jane Doe" + type: user + name: "Downgrade misconfigurations in dev" + rule: + finding_types: + - misconfiguration + query: "env:dev" + id: "00000000-0000-0000-0000-000000000000" + type: severity_modifier_rules + schema: + $ref: "#/components/schemas/SeverityModifierRuleResponse" + description: Successfully retrieved the severity modifier rule + "403": + $ref: "#/components/responses/ForbiddenResponse" + "404": + $ref: "#/components/responses/NotFoundResponse" + "422": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Unprocessable Entity + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + summary: Get a severity modifier rule + tags: + - Security Monitoring + x-menu-order: 161 + x-permission: + operator: OR + permissions: + - security_pipelines_read + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). + put: + description: Update an existing severity modifier rule by ID. + operationId: UpdateSecurityFindingsAutomationSeverityModifierRule + parameters: + - description: The ID of the severity modifier rule. + in: path + name: rule_id + required: true + schema: + example: "00000000-0000-0000-0000-000000000000" + format: uuid + type: string + requestBody: + content: + application/json: + examples: + default: + value: + data: + attributes: + action: + severity_delta: down_one + type: shift + enabled: false + name: "Downgrade misconfigurations in dev" + rule: + finding_types: + - misconfiguration + query: "env:dev" + type: severity_modifier_rules + schema: + $ref: "#/components/schemas/SeverityModifierRuleUpdateRequest" + required: true + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + attributes: + action: + severity_delta: down_one + type: shift + created_at: 1722439510282 + created_by: + id: "00000000-0000-0000-0000-000000000000" + name: "Jane Doe" + type: user + enabled: false + modified_at: 1722439510999 + modified_by: + id: "00000000-0000-0000-0000-000000000000" + name: "Jane Doe" + type: user + name: "Downgrade misconfigurations in dev" + rule: + finding_types: + - misconfiguration + query: "env:dev" + id: "00000000-0000-0000-0000-000000000000" + type: severity_modifier_rules + schema: + $ref: "#/components/schemas/SeverityModifierRuleResponse" + description: Successfully updated the severity modifier rule + "400": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Bad Request + "403": + $ref: "#/components/responses/ForbiddenResponse" + "404": + $ref: "#/components/responses/NotFoundResponse" + "422": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Unprocessable Entity + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + summary: Update a severity modifier rule + tags: + - Security Monitoring + x-codegen-request-body-name: body + x-menu-order: 162 + x-permission: + operator: OR + permissions: + - security_pipelines_write + x-unstable: |- + **Note**: This endpoint is in Preview and is subject to change. + If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/ticket_creation_rules: get: description: Get all ticket creation rules for the current organization. diff --git a/hugo/data/api/v2/translate_actions.json b/hugo/data/api/v2/translate_actions.json index 0fd6fc13591..70f66ab39da 100644 --- a/hugo/data/api/v2/translate_actions.json +++ b/hugo/data/api/v2/translate_actions.json @@ -5473,6 +5473,36 @@ "request_description": "", "request_schema_description": "The body of a mute rule update request." }, + "ListSecurityFindingsAutomationSeverityModifierRules": { + "description": "Get all severity modifier rules for the current organization.", + "summary": "Get all severity modifier rules" + }, + "CreateSecurityFindingsAutomationSeverityModifierRule": { + "description": "Create a new severity modifier rule for the current organization.", + "summary": "Create a severity modifier rule", + "request_description": "", + "request_schema_description": "The body of a severity modifier rule create request." + }, + "ReorderSecurityFindingsAutomationSeverityModifierRules": { + "description": "Reorder the list of severity modifier rules for the current organization.", + "summary": "Reorder severity modifier rules", + "request_description": "", + "request_schema_description": "The body of a severity modifier rule reorder request." + }, + "DeleteSecurityFindingsAutomationSeverityModifierRule": { + "description": "Delete an existing severity modifier rule by ID.", + "summary": "Delete a severity modifier rule" + }, + "GetSecurityFindingsAutomationSeverityModifierRule": { + "description": "Get the details of a severity modifier rule by ID.", + "summary": "Get a severity modifier rule" + }, + "UpdateSecurityFindingsAutomationSeverityModifierRule": { + "description": "Update an existing severity modifier rule by ID.", + "summary": "Update a severity modifier rule", + "request_description": "", + "request_schema_description": "The body of a severity modifier rule update request." + }, "ListSecurityFindingsAutomationTicketCreationRules": { "description": "Get all ticket creation rules for the current organization.", "summary": "Get all ticket creation rules" diff --git a/hugo/layouts/iac_security/list.html b/hugo/layouts/iac_security/list.html index e94b2c1a4d6..e95219d1fb4 100644 --- a/hugo/layouts/iac_security/list.html +++ b/hugo/layouts/iac_security/list.html @@ -85,7 +85,7 @@

{{ .Title }}

* } * show ruleEl if condition met (aws OR azure) AND (terraform OR kubernetes) AND security AND warning * - * Filter info structure: [cloud_provider, category, severity, platform] + * Filter info structure: [cloud_provider, rule_type, severity, platform] * Map each filter type to its specific index position */ @@ -372,11 +372,12 @@

{{ .Title }}

{{/* NAV - Keep here. scratch pad for filters need to form first */}}