[pull] master from DataDog:master

hugo/config/_default/menus/api.en.yaml

@@ -4518,6 +4518,84 @@ menu:
         unstable:
           - v2
         order: 146
+    - name: Update a severity modifier rule
+      url: /api/latest/security-monitoring/update-a-severity-modifier-rule/
+      identifier: security-monitoring-update-a-severity-modifier-rule
+      parent: security-monitoring
+      generated: true
+      params:
+        versions:
+          - v2
+        operationids:
+          - UpdateSecurityFindingsAutomationSeverityModifierRule
+        unstable:
+          - v2
+        order: 162
+    - name: Get a severity modifier rule
+      url: /api/latest/security-monitoring/get-a-severity-modifier-rule/
+      identifier: security-monitoring-get-a-severity-modifier-rule
+      parent: security-monitoring
+      generated: true
+      params:
+        versions:
+          - v2
+        operationids:
+          - GetSecurityFindingsAutomationSeverityModifierRule
+        unstable:
+          - v2
+        order: 161
+    - name: Delete a severity modifier rule
+      url: /api/latest/security-monitoring/delete-a-severity-modifier-rule/
+      identifier: security-monitoring-delete-a-severity-modifier-rule
+      parent: security-monitoring
+      generated: true
+      params:
+        versions:
+          - v2
+        operationids:
+          - DeleteSecurityFindingsAutomationSeverityModifierRule
+        unstable:
+          - v2
+        order: 163
+    - name: Reorder severity modifier rules
+      url: /api/latest/security-monitoring/reorder-severity-modifier-rules/
+      identifier: security-monitoring-reorder-severity-modifier-rules
+      parent: security-monitoring
+      generated: true
+      params:
+        versions:
+          - v2
+        operationids:
+          - ReorderSecurityFindingsAutomationSeverityModifierRules
+        unstable:
+          - v2
+        order: 160
+    - name: Create a severity modifier rule
+      url: /api/latest/security-monitoring/create-a-severity-modifier-rule/
+      identifier: security-monitoring-create-a-severity-modifier-rule
+      parent: security-monitoring
+      generated: true
+      params:
+        versions:
+          - v2
+        operationids:
+          - CreateSecurityFindingsAutomationSeverityModifierRule
+        unstable:
+          - v2
+        order: 159
+    - name: Get all severity modifier rules
+      url: /api/latest/security-monitoring/get-all-severity-modifier-rules/
+      identifier: security-monitoring-get-all-severity-modifier-rules
+      parent: security-monitoring
+      generated: true
+      params:
+        versions:
+          - v2
+        operationids:
+          - ListSecurityFindingsAutomationSeverityModifierRules
+        unstable:
+          - v2
+        order: 158
     - name: Update a mute rule
       url: /api/latest/security-monitoring/update-a-mute-rule/
       identifier: security-monitoring-update-a-mute-rule

hugo/content/en/api/latest/security-monitoring/create-a-severity-modifier-rule/index.md

@@ -0,0 +1,3 @@
+---
+title: Create a severity modifier rule
+---

hugo/content/en/api/latest/security-monitoring/delete-a-severity-modifier-rule/index.md

@@ -0,0 +1,3 @@
+---
+title: Delete a severity modifier rule
+---

hugo/content/en/api/latest/security-monitoring/get-a-severity-modifier-rule/index.md

@@ -0,0 +1,3 @@
+---
+title: Get a severity modifier rule
+---

hugo/content/en/api/latest/security-monitoring/get-all-severity-modifier-rules/index.md

@@ -0,0 +1,3 @@
+---
+title: Get all severity modifier rules
+---

hugo/content/en/api/latest/security-monitoring/reorder-severity-modifier-rules/index.md

@@ -0,0 +1,3 @@
+---
+title: Reorder severity modifier rules
+---

hugo/content/en/api/latest/security-monitoring/update-a-severity-modifier-rule/index.md

@@ -0,0 +1,3 @@
+---
+title: Update a severity modifier rule
+---

hugo/content/en/api/v2/security-monitoring/request.CreateSecurityFindingsAutomationSeverityModifierRule.json

@@ -0,0 +1,20 @@
+{
+  "data": {
+    "attributes": {
+      "action": {
+        "description": "Lower severity for dev environment noise",
+        "severity": "low",
+        "type": "set"
+      },
+      "enabled": true,
+      "name": "Downgrade misconfigurations in dev",
+      "rule": {
+        "finding_types": [
+          "misconfiguration"
+        ],
+        "query": "env:prod team:platform"
+      }
+    },
+    "type": "severity_modifier_rules"
+  }
+}

hugo/content/en/api/v2/security-monitoring/request.ReorderSecurityFindingsAutomationSeverityModifierRules.json

@@ -0,0 +1,8 @@
+{
+  "data": [
+    {
+      "id": "00000000-0000-0000-0000-000000000000",
+      "type": "severity_modifier_rules"
+    }
+  ]
+}

hugo/content/en/api/v2/security-monitoring/request.UpdateSecurityFindingsAutomationSeverityModifierRule.json

@@ -0,0 +1,20 @@
+{
+  "data": {
+    "attributes": {
+      "action": {
+        "description": "Lower severity for dev environment noise",
+        "severity": "low",
+        "type": "set"
+      },
+      "enabled": true,
+      "name": "Downgrade misconfigurations in dev",
+      "rule": {
+        "finding_types": [
+          "misconfiguration"
+        ],
+        "query": "env:prod team:platform"
+      }
+    },
+    "type": "severity_modifier_rules"
+  }
+}

hugo/content/en/data_security/data_retention_periods.md

@@ -117,7 +117,7 @@ attributes:
   - product: Log Management
     data_type: |
        - **Logs**: Determined by customer plan
-       - **Sensitive Data Scanner example logs**: <span class="d-none site-region-container" data-region="us,us3,us5,eu,ap1,ap2,uk1">3 days</span><span class="d-none site-region-container" data-region="gov,gov2">7 days</span>
+       - **Sensitive Data Scanner example logs**: 7 days
   - product: Metrics
     data_type: |
        - **Tags and values**: 15 months

hugo/content/en/security/code_security/iac_security/configuration.md

@@ -18,15 +18,15 @@ further_reading:
     text: "IaC Security Rules"
 ---
 
-Infrastructure as Code (IaC) Security detects IaC misconfigurations. By default, IaC Security scans repositories with [all supported rules][3]. You can customize which rules run and on which paths, as well as their severities and categories. Configure these settings under the `iac` key in the Code Security configuration, either in Datadog or in a `code-security.datadog.yaml` file.
+Infrastructure as Code (IaC) Security detects IaC misconfigurations. By default, IaC Security scans repositories with [all supported rules][3]. You can customize which rules run and on which paths, as well as their severities and rule types. Configure these settings under the `iac` key in the Code Security configuration, either in Datadog or in a `code-security.datadog.yaml` file.
 
 For information on configuration locations, precedence, and merging, see [Code Security Configuration Reference][1].
 
 ## Configuration methods
 
 You can configure IaC Security using:
 
-- Datadog or a `code-security.datadog.yaml` file for repository-wide rule, severity, category, and path settings. Use this method when you want the same configuration to apply across a repository or organization.
+- Datadog or a `code-security.datadog.yaml` file for repository-wide rule, severity, rule type, and path settings. Use this method when you want the same configuration to apply across a repository or organization.
 - Inline comments for local, file-specific exclusions that should stay with the IaC file. Use this method when an exception applies to a specific line, block, or file.
 
 ## Configuration format
@@ -64,10 +64,10 @@ iac:
     only-severities:
       - high
       - critical
-    # Do not report findings in these categories.
+    # Do not report findings with these rule types.
     ignore-categories:
       - "Best Practices"
-    # Report only findings in these categories.
+    # Report only findings with these rule types.
     only-categories:
       - "Encryption"
     # Do not run rules from these platforms.
@@ -136,8 +136,8 @@ The `global-config` object controls repository-wide settings:
 | `ignore-paths` | Array | File paths or glob patterns to exclude. Matching files are not analyzed. |
 | `only-severities` | Array | Severity levels to report. Findings with other severities are not reported. |
 | `ignore-severities` | Array | Severity levels to ignore. |
-| `only-categories` | Array | Categories to report. Findings in other categories are not reported. |
-| `ignore-categories` | Array | Categories to ignore. |
+| `only-categories` | Array | Rule types to report. Findings with other rule types are not reported. |
+| `ignore-categories` | Array | Rule types to ignore. |
 | `ignore-platforms` | Array | Platforms to skip. Rules from these platforms are not applied. |
 | `only-platforms` | Array | Platforms to scan. Rules from other platforms are not applied. |
 
@@ -175,9 +175,9 @@ iac:
       - "**/config.file"
 {{< /code-block >}}
 
-### Categories
+### Rule types
 
-Use `ignore-categories` to ignore findings in specific categories. Use `only-categories` to report only specific categories.
+Use `ignore-categories` to ignore findings with specific rule types. Use `only-categories` to report only specific rule types.
 
 **Possible values:**
 

hugo/content/en/security/sensitive_data_scanner/guide/investigate_sensitive_data_findings.md

@@ -50,7 +50,7 @@ To investigate a log finding:
 3. At the top of the panel, check {{< ui >}}First Detected{{< /ui >}} and {{< ui >}}Last Detected{{< /ui >}} to understand how long the exposure has been active.
 4. In the summary section, review {{< ui >}}Match State{{< /ui >}}, {{< ui >}}Service{{< /ui >}}, {{< ui >}}Environment{{< /ui >}}, and {{< ui >}}Total matches{{< /ui >}} to understand the scope of the exposure.
 5. Review the {{< ui >}}Logs Pattern{{< /ui >}} to understand the format of the log line where sensitive data was detected.
-6. In the {{< ui >}}Example Logs{{< /ui >}} section, review up to 5 representative examples of affected logs. When an example log expires it is replaced with the next matching event. Click {{< ui >}}Show log{{< /ui >}} to expand an example and inspect its log message, fields, and attributes inline. By default, example logs are stored for <span class="d-none site-region-container" data-region="us,us3,us5,eu,ap1,ap2,uk1">3 days</span><span class="d-none site-region-container" data-region="gov,gov2">7 days</span> and are accessible to all users with the Data Scanner Read permission. To store these representative logs for a different period, contact [Support][1].
+6. In the {{< ui >}}Example Logs{{< /ui >}} section, review up to five representative examples of affected logs. When an example log expires, it is replaced with the next matching event. Click {{< ui >}}Show log{{< /ui >}} to expand an example and inspect its log message, fields, and attributes inline. By default, example logs are stored for 7 days and are accessible to all users with the Data Scanner Read permission. To store these representative logs for a different period, contact [Support][1].
 7. Review {{< ui >}}Matches Trend{{< /ui >}} to see how match volume has changed over the past week. Use {{< ui >}}Related Access and Configuration Events{{< /ui >}} to check whether recent access events or changes to the scanning group or scanning rule line up with changes in match volume.
 
 Additionally, you can:

hugo/data/api/v2/CodeExamples.json

@@ -2288,6 +2288,13 @@
       "description": "Create a security filter returns \"OK\" response"
     }
   ],
+  "CreateSecurityFindingsAutomationSeverityModifierRule": [
+    {
+      "group": "security_monitoring",
+      "suffix": "",
+      "description": "Create a severity modifier rule returns \"Successfully created the severity modifier rule\" response"
+    }
+  ],
   "CreateSecurityMonitoringSuppression": [
     {
       "group": "security_monitoring",
@@ -2406,6 +2413,13 @@
       "description": "Reorder mute rules returns \"Successfully reordered the mute rules\" response"
     }
   ],
+  "ReorderSecurityFindingsAutomationSeverityModifierRules": [
+    {
+      "group": "security_monitoring",
+      "suffix": "",
+      "description": "Reorder severity modifier rules returns \"Successfully reordered the severity modifier rules\" response"
+    }
+  ],
   "ReorderSecurityFindingsAutomationTicketCreationRules": [
     {
       "group": "security_monitoring",
@@ -2493,6 +2507,13 @@
       "description": "Update a security filter returns \"OK\" response"
     }
   ],
+  "UpdateSecurityFindingsAutomationSeverityModifierRule": [
+    {
+      "group": "security_monitoring",
+      "suffix": "",
+      "description": "Update a severity modifier rule returns \"Successfully updated the severity modifier rule\" response"
+    }
+  ],
   "UpdateSecurityMonitoringSuppression": [
     {
       "group": "security_monitoring",