Datadog Rules API

openapi: 3.2.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Rules API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Rules
paths:
  /api/v2/security_monitoring/configuration/suppressions/{suppression_id}:
    patch:
      description: Update a specific suppression rule.
      operationId: UpdateSecurityMonitoringSuppression
      parameters:
      - $ref: '#/components/parameters/SecurityMonitoringSuppressionID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringSuppressionUpdateRequest'
        description: New definition of the suppression rule. Supports partial updates.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringSuppressionResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_suppressions_write
      summary: Datadog Update a Suppression Rule
      tags:
      - Rules
      x-menu-order: 0
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules/test:
    post:
      description: Test a rule.
      operationId: TestSecurityMonitoringRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringRuleTestRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringRuleTestResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Test a Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 9
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/sensitive-data-scanner/config/rules/{rule_id}:
    patch:
      description: 'Update a scanning rule.

        The request body MUST NOT include a standard_pattern relationship, as that relationship

        is non-editable. Trying to edit the regex attribute of a rule with a standard_pattern

        relationship will also result in an error.'
      operationId: UpdateScanningRule
      parameters:
      - $ref: '#/components/parameters/SensitiveDataScannerRuleID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SensitiveDataScannerRuleUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SensitiveDataScannerRuleUpdateResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication Error
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update Scanning Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 8
      x-permission:
        operator: OR
        permissions:
        - data_scanner_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    SensitiveDataScannerRuleUpdateRequest:
      description: Update rule request.
      properties:
        data:
          $ref: '#/components/schemas/SensitiveDataScannerRuleUpdate'
        meta:
          $ref: '#/components/schemas/SensitiveDataScannerMetaVersionOnly'
      required:
      - data
      - meta
      type: object
    SensitiveDataScannerIncludedKeywordConfiguration:
      description: 'Object defining a set of keywords and a number of characters that help reduce noise.

        You can provide a list of keywords you would like to check within a defined proximity of the matching pattern.

        If any of the keywords are found within the proximity check, the match is kept.

        If none are found, the match is discarded.'
      properties:
        character_count:
          description: 'The number of characters behind a match detected by Sensitive Data Scanner to look for the keywords defined.

            `character_count` should be greater than the maximum length of a keyword defined for a rule.'
          example: 30
          format: int64
          maximum: 50
          minimum: 1
          type: integer
        keywords:
          description: 'Keyword list that will be checked during scanning in order to validate a match.

            The number of keywords in the list must be less than or equal to 30.'
          example:
          - credit card
          - cc
          items:
            type: string
          type: array
        use_recommended_keywords:
          description: 'Should the rule use the underlying standard pattern keyword configuration. If set to `true`, the rule must be tied

            to a standard pattern. If set to `false`, the specified keywords and `character_count` are applied.'
          type: boolean
          example: true
      required:
      - keywords
      - character_count
      type: object
    SecurityMonitoringRuleNewValueOptionsForgetAfter:
      description: The duration in days after which a learned value is forgotten.
      enum:
      - 1
      - 2
      - 7
      - 14
      - 21
      - 28
      format: int32
      type: integer
      x-enum-varnames:
      - ONE_DAY
      - TWO_DAYS
      - ONE_WEEK
      - TWO_WEEKS
      - THREE_WEEKS
      - FOUR_WEEKS
    SecurityMonitoringRuleImpossibleTravelOptions:
      description: Options on impossible travel detection method.
      properties:
        baselineUserLocations:
          $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations'
      type: object
    SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations:
      description: 'If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user''s regular

        access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.'
      example: true
      type: boolean
    CloudConfigurationRegoRule:
      description: Rule details.
      properties:
        policy:
          description: 'The policy written in `rego`, see: https://www.openpolicyagent.org/docs/latest/policy-language/'
          example: "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n  # Logic that evaluates to true if the resource should be skipped\n  true\n} else = \"pass\" {\n  # Logic that evaluates to true if the resource is compliant\n  true\n} else = \"fail\" {\n  # Logic that evaluates to true if the resource is not compliant\n  true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n  some resource in input.resources[input.main_resource_type]\n  result := dd_output.format(resource, eval(resource))\n}\n"
          type: string
        resourceTypes:
          description: List of resource types that will be evaluated upon. Must have at least one element.
          example:
          - gcp_iam_service_account
          - gcp_iam_policy
          items:
            type: string
          type: array
      required:
      - policy
      - resourceTypes
      type: object
    SecurityMonitoringRuleCaseAction:
      description: Action to perform when a signal is triggered. Only available for Application Security rule type.
      properties:
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptions'
        type:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionType'
      type: object
    SensitiveDataScannerGroup:
      description: A scanning group.
      properties:
        id:
          description: ID of the group.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/SensitiveDataScannerGroupType'
      type: object
    SecurityMonitoringRuleNewValueOptionsLearningMethod:
      default: duration
      description: The learning method used to determine when signals should be generated for values that weren't learned.
      enum:
      - duration
      - threshold
      type: string
      x-enum-varnames:
      - DURATION
      - THRESHOLD
    SensitiveDataScannerGroupData:
      description: A scanning group data.
      properties:
        data:
          $ref: '#/components/schemas/SensitiveDataScannerGroup'
      type: object
    SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv:
      description: 'If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.

        The severity is decreased by one level: `CRITICAL` in production becomes `HIGH` in non-production, `HIGH` becomes `MEDIUM` and so on. `INFO` remains `INFO`.

        The decrement is applied when the environment tag of the signal starts with `staging`, `test` or `dev`.'
      example: false
      type: boolean
    SecurityMonitoringRuleCaseCreate:
      description: Case when signal is generated.
      properties:
        actions:
          description: Action to perform for each rule case.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseAction'
          type: array
        condition:
          description: 'A case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated

            based on the event counts in the previously defined queries.'
          type: string
          example: example_value
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets.
          items:
            description: Notification.
            type: string
          type: array
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      required:
      - status
      type: object
    SensitiveDataScannerGroupType:
      default: sensitive_data_scanner_group
      description: Sensitive Data Scanner group type.
      enum:
      - sensitive_data_scanner_group
      example: sensitive_data_scanner_group
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER_GROUP
    SecurityMonitoringRuleTestRequest:
      description: Test the rule queries of a rule (rule property is ignored when applied to an existing rule)
      properties:
        rule:
          $ref: '#/components/schemas/SecurityMonitoringRuleTestPayload'
        ruleQueryPayloads:
          description: Data payloads used to test rules query with the expected result.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleQueryPayload'
          type: array
      type: object
    SensitiveDataScannerRuleType:
      default: sensitive_data_scanner_rule
      description: Sensitive Data Scanner rule type.
      enum:
      - sensitive_data_scanner_rule
      example: sensitive_data_scanner_rule
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER_RULE
    SensitiveDataScannerStandardPatternType:
      default: sensitive_data_scanner_standard_pattern
      description: Sensitive Data Scanner standard pattern type.
      enum:
      - sensitive_data_scanner_standard_pattern
      example: sensitive_data_scanner_standard_pattern
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER_STANDARD_PATTERN
    SensitiveDataScannerTextReplacementType:
      default: none
      description: 'Type of the replacement text. None means no replacement.

        hash means the data will be stubbed. replacement_string means that

        one can chose a text to replace the data. partial_replacement_from_beginning

        allows a user to partially replace the data from the beginning, and

        partial_replacement_from_end on the other hand, allows to replace data from

        the end.'
      enum:
      - none
      - hash
      - replacement_string
      - partial_replacement_from_beginning
      - partial_replacement_from_end
      type: string
      x-enum-varnames:
      - NONE
      - HASH
      - REPLACEMENT_STRING
      - PARTIAL_REPLACEMENT_FROM_BEGINNING
      - PARTIAL_REPLACEMENT_FROM_END
    SecurityMonitoringSuppressionType:
      default: suppressions
      description: The type of the resource. The value should always be `suppressions`.
      enum:
      - suppressions
      example: suppressions
      type: string
      x-enum-varnames:
      - SUPPRESSIONS
    SecurityMonitoringSuppressionAttributes:
      description: The attributes of the suppression rule.
      properties:
        creation_date:
          description: A Unix millisecond timestamp given the creation date of the suppression rule.
          format: int64
          type: integer
          example: 42
        creator:
          $ref: '#/components/schemas/SecurityMonitoringUser'
        data_exclusion_query:
          description: An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
          example: source:cloudtrail account_id:12345
          type: string
        description:
          description: A description for the suppression rule.
          example: This rule suppresses low-severity signals in staging environments.
          type: string
        editable:
          description: Whether the suppression rule is editable.
          example: true
          type: boolean
        enabled:
          description: Whether the suppression rule is enabled.
          example: true
          type: boolean
        expiration_date:
          description: A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
          example: 1703187336000
          format: int64
          type: integer
        name:
          description: The name of the suppression rule.
          example: Custom suppression
          type: string
        rule_query:
          description: The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
          example: type:log_detection source:cloudtrail
          type: string
        start_date:
          description: A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals.
          example: 1703187336000
          format: int64
          type: integer
        suppression_query:
          description: The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer.
          example: env:staging status:low
          type: string
        update_date:
          description: A Unix millisecond timestamp given the update date of the suppression rule.
          format: int64
          type: integer
          example: 42
        updater:
          $ref: '#/components/schemas/SecurityMonitoringUser'
        version:
          description: The version of the suppression rule; it starts at 1, and is incremented at each update.
          example: 42
          format: int32
          maximum: 2147483647
          type: integer
      type: object
    SecurityMonitoringStandardRuleTestPayload:
      description: The payload of a rule to test
      properties:
        cases:
          description: Cases for generating signals.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseCreate'
          type: array
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        groupSignalsBy:
          description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
          example:
          - service
          items:
            description: Field to group by.
            type: string
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          example: true
          type: boolean
        isEnabled:
          description: Whether the rule is enabled.
          example: true
          type: boolean
        message:
          description: Message for generated signals.
          example: ''
          type: string
        name:
          description: The name of the rule.
          example: My security monitoring rule.
          type: string
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting logs which are part of the rule.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
          type: array
        referenceTables:
          description: Reference tables for the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
          type: array
        tags:
          description: Tags for generated signals.
          example:
          - env:prod
          - team:security
          items:
            description: Tag.
            type: string
          type: array
        thirdPartyCases:
          description: Cases for generating signals from third-party rules. Only available for third-party rules.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate'
          type: array
        type:
          $ref: '#/components/schemas/SecurityMonitoringRuleTypeTest'
      required:
      - name
      - isEnabled
      - queries
      - options
      - cases
      - message
      type: object
    SecurityMonitoringUser:
      description: A user.
      properties:
        handle:
          description: The handle of the user.
          example: john.doe@datadoghq.com
          type: string
        name:
          description: The name of the user.
          example: John Doe
          type:
          - string
          - 'null'
      type: object
    SecurityMonitoringRuleThirdPartyOptions:
      description: Options on third party detection method.
      properties:
        defaultNotifications:
          description: Notification targets for the logs that do not correspond to any of the cases.
          items:
            description: Notification.
            type: string
          type: array
        defaultStatus:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
        rootQueries:
          description: Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRootQuery'
          type: array
        signalTitleTemplate:
          description: A template for the signal title; if omitted, the title is generated based on the case name.
          type: string
          example: Example Monitor
      type: object
    SecurityMonitoringStandardDataSource:
      default: logs
      description: Source of events, either logs, audit trail, or Datadog events.
      enum:
      - logs
      - audit
      - app_sec_spans
      - spans
      - security_runtime
      - network
      - events
      example: logs
      type: string
      x-enum-varnames:
      - LOGS
      - AUDIT
      - APP_SEC_SPANS
      - SPANS
      - SECURITY_RUNTIME
      - NETWORK
      - EVENTS
    SecurityMonitoringRuleSeverity:
      description: Severity of the Security Signal.
      enum:
      - info
      - low
      - medium
      - high
      - critical
      example: critical
      type: string
      x-enum-varnames:
      - INFO
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
    SecurityMonitoringSuppressionUpdateRequest:
      description: Request object containing the fields to update on the suppression rule.
      properties:
        data:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionUpdateData'
      required:
      - data
      type: object
    SensitiveDataScannerRuleUpdateResponse:
      description: Update rule response.
      properties:
        meta:
          $ref: '#/components/schemas/SensitiveDataScannerMetaVersionOnly'
      type: object
    APIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          example:
          - Bad Request
          items:
            description: A list of items.
            example: Bad Request
            type: string
          type: array
      required:
      - errors
      type: object
    SecurityMonitoringRuleQueryPayloadData:
      additionalProperties: {}
      description: Payload used to test the rule query.
      properties:
        ddsource:
          description: Source of the payload.
          example: nginx
          type: string
        ddtags:
          description: Tags associated with your data.
          example: env:staging,version:5.1
          type: string
        hostname:
          description: The name of the originating host of the log.
          example: i-012345678
          type: string
        message:
          description: The message of the payload.
          example: 2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World
          type: string
        service:
          description: The name of the application or service generating the data.
          example: payment
          type: string
      type: object
    SecurityMonitoringFilterAction:
      description: The type of filtering action.
      enum:
      - require
      - suppress
      type: string
      x-enum-varnames:
      - REQUIRE
      - SUPPRESS
    SecurityMonitoringReferenceTable:
      description: Reference tables used in the queries.
      properties:
        checkPresence:
          description: Whether to include or exclude the matched values.
          type: boolean
          example: true
        columnName:
          description: The name of the column in the reference table.
          type: string
          example: Example Monitor
        logFieldPath:
          description: The field in the log to match against the reference table.
          type: string
          example: example_value
        ruleQueryName:
          description: The name of the query to apply the reference table to.
          type: string
          example: Example Monitor
        tableName:
          description: The name of the reference table.
          type: string
          example: Example Monitor
      type: object
    SecurityMonitoringRuleCaseActionType:
      description: The action type.
      enum:
      - block_ip
      - block_user
      - user_behavior
      type: string
      x-enum-varnames:
      - BLOCK_IP
      - BLOCK_USER
      - USER_BEHAVIOR
    SecurityMonitoringRuleCaseActionOptions:
      additionalProperties: {}
      description: Options for the rule action
      properties:
        duration:
          description: Duration of the action in seconds. 0 indicates no expiration.
          example: 0
          format: int64
          minimum: 0
          type: integer
        userBehaviorName:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsUserBehaviorName'
      type: object
    SensitiveDataScannerRuleAttributes:
      description: Attributes of the Sensitive Data Scanner rule.
      properties:
        description:
          description: Description of the rule.
          type: string
          example: example_value
        excluded_namespaces:
          description: Attributes excluded from the scan. If namespaces is provided, it has to be a sub-path of the namespaces array.
          example:
          - admin.name
          items:
            type: string
          type: array
        included_keyword_configuration:
          $ref: '#/components/schemas/SensitiveDataScannerIncludedKeywordConfiguration'
        is_enabled:
          description: Whether or not the rule is enabled.
          type: boolean
          example: true
        name:
          description: Name of the rule.
          type: string
          example: Example Monitor
        namespaces:
          description: 'Attributes included in the scan. If namespaces is empty or missing, all attributes except excluded_namespaces are scanned.

            If both are missing the whole event is scanned.'
          example:
          - admin
          items:
            type: string
          type: array
        pattern:
          description: Not included if there is a relationship to a standard pattern.
          type: string
          example: example_value
        priority:
          description: Integer from 1 (high) to 5 (low) indicating rule issue severity.
          format: int64
          maximum: 5
          minimum: 1
          type: integer
          example: 42
        tags:
          description: List of tags.
          items:
            type: string
          type: array
        text_replacement:
          $ref: '#/components/schemas/SensitiveDataScannerTextReplacement'
      type: object
    SecurityMonitoringRuleQueryAggregation:
      description: The aggregation type.
      enum:
      - count
      - cardinality
      - sum
      - max
      - new_value
      - geo_data
      - event_count
      - none
      type: string
      x-enum-varnames:
      - COUNT
      - CARDINALITY
      - SUM
      - MAX
      - NEW_VALUE
      - GEO_DATA
      - EVENT_COUNT
      - NONE
    SecurityMonitoringThirdPartyRootQuery:
      description: A query to be combined with the third party case query.
      properties:
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        query:
          description: Query to run on logs.
          example: source:cloudtrail
          type: string
      type: object
    SecurityMonitoringRuleOptions:
      description: Options.
      properties:
        complianceRuleOptions:
          $ref: '#/components/schemas/CloudConfigurationComplianceRuleOptions'
        decreaseCriticalityBasedOnEnv:
          $ref: '#/components/schemas/SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv'
        detectionMethod:
          $ref: '#/components/schemas/SecurityMonitoringRuleDetectionMethod'
        evaluationWindow:
          $ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
        hardcodedEvaluatorType:
          $ref: '#/components/schemas/SecurityMonitoringRuleHardcodedEvaluatorType'
        impossibleTravelOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptions'
        keepAlive:
          $ref: '#/components/schemas/SecurityMonitoringRuleKeepAlive'
        maxSignalDuration:
          $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
        newValueOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
        thirdPartyRuleOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
      type: object
    SecurityMonitoringRuleEvaluationWindow:
      description: 'A time window is specified to match when at least one of the cases matches true. This is a sliding window

        and evaluates in real time. For third party detection method, this field is not used.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    SecurityMonitoringSuppressionUpdateData:
      description: The new suppression properties; partial updates are supported.
      properties:
        attributes:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionUpdateAttributes'
        type:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionType'
      required:
      - type
      - attributes
      type: object
    SecurityMonitoringRuleTestResponse:
      description: Result of the test of the rule queries.
      properties:
        results:
          description: 'Assert results are returned in the same order as the rule query payloads.

            For each payload, it returns True if the result matched the expected result,

            False otherwise.'
          items:
            type: boolean
          type: array
      type: object
    SecurityMonitoringSuppression:
      description: The suppression rule's properties.
      properties:
        attributes:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionAttributes'
        id:
          $ref: '#/compon

# --- truncated at 32 KB (53 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/openapi/datadog-rules-api-openapi.yml