Datadog Tests API

openapi: 3.0.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Account Tests API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Tests
paths:
  /api/v2/ci/tests/analytics/aggregate:
    post:
      description: The API endpoint to aggregate CI Visibility test events into buckets of computed metrics and timeseries.
      operationId: AggregateCIAppTestEvents
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CIAppTestsAggregateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CIAppTestsAnalyticsAggregateResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - ci_visibility_read
      summary: Datadog Aggregate Tests Events
      tags:
      - Tests
      x-codegen-request-body-name: body
      x-menu-order: 3
      x-permission:
        operator: OR
        permissions:
        - ci_visibility_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/ci/tests/events:
    get:
      description: 'List endpoint returns CI Visibility test events that match a [search query](https://docs.datadoghq.com/continuous_integration/explorer/search_syntax/).

        [Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination).


        Use this endpoint to see your latest test events.'
      operationId: ListCIAppTestEvents
      parameters:
      - description: Search query following log syntax.
        example: '@test.name:test_foo @test.suite:github.com/DataDog/dd-go/model'
        in: query
        name: filter[query]
        required: false
        schema:
          type: string
      - description: Minimum timestamp for requested events.
        example: '2019-01-02T09:42:36.320Z'
        in: query
        name: filter[from]
        required: false
        schema:
          format: date-time
          type: string
      - description: Maximum timestamp for requested events.
        example: '2019-01-03T09:42:36.320Z'
        in: query
        name: filter[to]
        required: false
        schema:
          format: date-time
          type: string
      - description: Order of events in results.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/CIAppSort'
        example: example_value
      - description: List following results with a cursor provided in the previous query.
        example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
        in: query
        name: page[cursor]
        required: false
        schema:
          type: string
      - description: Maximum number of events in the response.
        example: 25
        in: query
        name: page[limit]
        required: false
        schema:
          default: 10
          format: int32
          maximum: 1000
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CIAppTestEventsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - ci_visibility_read
      summary: Datadog Get a List of Tests Events
      tags:
      - Tests
      x-menu-order: 1
      x-pagination:
        cursorParam: page[cursor]
        cursorPath: meta.page.after
        limitParam: page[limit]
        resultsPath: data
      x-permission:
        operator: OR
        permissions:
        - ci_visibility_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/ci/tests/events/search:
    post:
      description: 'List endpoint returns CI Visibility test events that match a [search query](https://docs.datadoghq.com/continuous_integration/explorer/search_syntax/).

        [Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination).


        Use this endpoint to build complex events filtering and search.'
      operationId: SearchCIAppTestEvents
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CIAppTestEventsRequest'
        required: false
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CIAppTestEventsResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - ci_visibility_read
      summary: Datadog Search Tests Events
      tags:
      - Tests
      x-codegen-request-body-name: body
      x-menu-order: 2
      x-pagination:
        cursorParam: body.page.cursor
        cursorPath: meta.page.after
        limitParam: body.page.limit
        resultsPath: data
      x-permission:
        operator: OR
        permissions:
        - ci_visibility_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules/test:
    post:
      description: Test a rule.
      operationId: TestSecurityMonitoringRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringRuleTestRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringRuleTestResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Test a Rule
      tags:
      - Tests
      x-codegen-request-body-name: body
      x-menu-order: 9
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules/{rule_id}/test:
    post:
      description: Test an existing rule.
      operationId: TestExistingSecurityMonitoringRule
      parameters:
      - $ref: '#/components/parameters/SecurityMonitoringRuleID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringRuleTestRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringRuleTestResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Test an Existing Rule
      tags:
      - Tests
      x-codegen-request-body-name: body
      x-menu-order: 8
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    SecurityMonitoringRuleEvaluationWindow:
      description: 'A time window is specified to match when at least one of the cases matches true. This is a sliding window

        and evaluates in real time. For third party detection method, this field is not used.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    CIAppGroupByTotal:
      default: false
      description: A resulting object to put the given computes in over all the matching records.
      oneOf:
      - $ref: '#/components/schemas/CIAppGroupByTotalBoolean'
      - $ref: '#/components/schemas/CIAppGroupByTotalString'
      - $ref: '#/components/schemas/CIAppGroupByTotalNumber'
    CIAppAggregateBucketValueSingleString:
      description: A single string value.
      type: string
    SecurityMonitoringRuleMaxSignalDuration:
      description: 'A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.

        This time is calculated from the first seen timestamp.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    CIAppComputeType:
      default: total
      description: The type of compute.
      enum:
      - timeseries
      - total
      type: string
      x-enum-varnames:
      - TIMESERIES
      - TOTAL
    SecurityMonitoringRuleCaseActionOptionsUserBehaviorName:
      description: Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
      type: string
    SecurityMonitoringRuleNewValueOptionsLearningThreshold:
      default: 0
      description: A number of occurrences after which signals will be generated for values that weren't learned.
      enum:
      - 0
      - 1
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_OCCURRENCES
      - ONE_OCCURRENCE
    SecurityMonitoringRuleNewValueOptionsForgetAfter:
      description: The duration in days after which a learned value is forgotten.
      enum:
      - 1
      - 2
      - 7
      - 14
      - 21
      - 28
      format: int32
      type: integer
      x-enum-varnames:
      - ONE_DAY
      - TWO_DAYS
      - ONE_WEEK
      - TWO_WEEKS
      - THREE_WEEKS
      - FOUR_WEEKS
    CIAppGroupByMissing:
      description: The value to use for logs that don't have the facet used to group-by.
      oneOf:
      - $ref: '#/components/schemas/CIAppGroupByMissingString'
      - $ref: '#/components/schemas/CIAppGroupByMissingNumber'
    SecurityMonitoringRuleQueryAggregation:
      description: The aggregation type.
      enum:
      - count
      - cardinality
      - sum
      - max
      - new_value
      - geo_data
      - event_count
      - none
      type: string
      x-enum-varnames:
      - COUNT
      - CARDINALITY
      - SUM
      - MAX
      - NEW_VALUE
      - GEO_DATA
      - EVENT_COUNT
      - NONE
    SecurityMonitoringRuleTypeTest:
      description: The rule type.
      enum:
      - log_detection
      type: string
      x-enum-varnames:
      - LOG_DETECTION
    CIAppCompute:
      description: A compute rule to compute metrics or timeseries.
      properties:
        aggregation:
          $ref: '#/components/schemas/CIAppAggregationFunction'
        interval:
          description: 'The time buckets'' size (only used for type=timeseries)

            Defaults to a resolution of 150 points.'
          example: 5m
          type: string
        metric:
          description: The metric to use.
          example: '@duration'
          type: string
        type:
          $ref: '#/components/schemas/CIAppComputeType'
      required:
      - aggregation
      type: object
    SecurityMonitoringRuleTestResponse:
      description: Result of the test of the rule queries.
      properties:
        results:
          description: 'Assert results are returned in the same order as the rule query payloads.

            For each payload, it returns True if the result matched the expected result,

            False otherwise.'
          items:
            type: boolean
          type: array
      type: object
    SecurityMonitoringStandardRuleQuery:
      description: Query for matching rule.
      properties:
        aggregation:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
        dataSource:
          $ref: '#/components/schemas/SecurityMonitoringStandardDataSource'
        distinctFields:
          description: Field for which the cardinality is measured. Sent as an array.
          items:
            description: Field.
            type: string
          type: array
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        hasOptionalGroupByFields:
          description: When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values.
          example: false
          readOnly: true
          type: boolean
        metric:
          deprecated: true
          description: '(Deprecated) The target field to aggregate over when using the sum or max

            aggregations. `metrics` field should be used instead.'
          type: string
          example: example_value
        metrics:
          description: Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
          items:
            description: Field.
            type: string
          type: array
        name:
          description: Name of the query.
          type: string
          example: Example Monitor
        query:
          description: Query to run on logs.
          example: a > 3
          type: string
      type: object
    SecurityMonitoringFilterAction:
      description: The type of filtering action.
      enum:
      - require
      - suppress
      type: string
      x-enum-varnames:
      - REQUIRE
      - SUPPRESS
    CIAppTestsQueryFilter:
      description: The search and filter query settings.
      properties:
        from:
          default: now-15m
          description: The minimum time for the requested events; supports date, math, and regular timestamps (in milliseconds).
          example: now-15m
          type: string
        query:
          default: '*'
          description: The search query following the CI Visibility Explorer search syntax.
          example: '@test.service:web-ui-tests AND @test.status:fail'
          type: string
        to:
          default: now
          description: The maximum time for the requested events, supports date, math, and regular timestamps (in milliseconds).
          example: now
          type: string
      type: object
    CIAppTestEvent:
      description: Object description of test event after being processed and stored by Datadog.
      properties:
        attributes:
          $ref: '#/components/schemas/CIAppEventAttributes'
        id:
          description: Unique ID of the event.
          example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
          type: string
        type:
          $ref: '#/components/schemas/CIAppTestEventTypeName'
      type: object
    SecurityMonitoringRuleThirdPartyOptions:
      description: Options on third party detection method.
      properties:
        defaultNotifications:
          description: Notification targets for the logs that do not correspond to any of the cases.
          items:
            description: Notification.
            type: string
          type: array
        defaultStatus:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
        rootQueries:
          description: Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRootQuery'
          type: array
        signalTitleTemplate:
          description: A template for the signal title; if omitted, the title is generated based on the case name.
          type: string
          example: Example Monitor
      type: object
    CIAppTestsAggregateRequest:
      description: The object sent with the request to retrieve aggregation buckets of test events from your organization.
      properties:
        compute:
          description: The list of metrics or timeseries to compute for the retrieved buckets.
          items:
            $ref: '#/components/schemas/CIAppCompute'
          type: array
        filter:
          $ref: '#/components/schemas/CIAppTestsQueryFilter'
        group_by:
          description: The rules for the group-by.
          items:
            $ref: '#/components/schemas/CIAppTestsGroupBy'
          type: array
        options:
          $ref: '#/components/schemas/CIAppQueryOptions'
      type: object
    SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv:
      description: 'If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.

        The severity is decreased by one level: `CRITICAL` in production becomes `HIGH` in non-production, `HIGH` becomes `MEDIUM` and so on. `INFO` remains `INFO`.

        The decrement is applied when the environment tag of the signal starts with `staging`, `test` or `dev`.'
      example: false
      type: boolean
    SecurityMonitoringRuleQueryPayloadData:
      additionalProperties: {}
      description: Payload used to test the rule query.
      properties:
        ddsource:
          description: Source of the payload.
          example: nginx
          type: string
        ddtags:
          description: Tags associated with your data.
          example: env:staging,version:5.1
          type: string
        hostname:
          description: The name of the originating host of the log.
          example: i-012345678
          type: string
        message:
          description: The message of the payload.
          example: 2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World
          type: string
        service:
          description: The name of the application or service generating the data.
          example: payment
          type: string
      type: object
    CIAppGroupByTotalNumber:
      description: A number to use as the key value for the total bucket.
      format: double
      type: number
    CIAppAggregateBucketValueSingleNumber:
      description: A single number value.
      format: double
      type: number
    CIAppWarning:
      description: A warning message indicating something that went wrong with the query.
      properties:
        code:
          description: A unique code for this type of warning.
          example: unknown_index
          type: string
        detail:
          description: A detailed explanation of this specific warning.
          example: 'indexes: foo, bar'
          type: string
        title:
          description: A short human-readable summary of the warning.
          example: One or several indexes are missing or invalid, results hold data from the other indexes
          type: string
      type: object
    CIAppAggregateSort:
      description: A sort rule. The `aggregation` field is required when `type` is `measure`.
      example:
        aggregation: count
        order: asc
      properties:
        aggregation:
          $ref: '#/components/schemas/CIAppAggregationFunction'
        metric:
          description: The metric to sort by (only used for `type=measure`).
          example: '@duration'
          type: string
        order:
          $ref: '#/components/schemas/CIAppSortOrder'
        type:
          $ref: '#/components/schemas/CIAppAggregateSortType'
      type: object
    SecurityMonitoringRuleCaseActionType:
      description: The action type.
      enum:
      - block_ip
      - block_user
      - user_behavior
      type: string
      x-enum-varnames:
      - BLOCK_IP
      - BLOCK_USER
      - USER_BEHAVIOR
    CIAppTestEventsRequest:
      description: The request for a tests search.
      properties:
        filter:
          $ref: '#/components/schemas/CIAppTestsQueryFilter'
        options:
          $ref: '#/components/schemas/CIAppQueryOptions'
        page:
          $ref: '#/components/schemas/CIAppQueryPageOptions'
        sort:
          $ref: '#/components/schemas/CIAppSort'
      type: object
    CIAppComputes:
      additionalProperties:
        $ref: '#/components/schemas/CIAppAggregateBucketValue'
      description: A map of the metric name to value for regular compute, or a list of values for a timeseries.
      type: object
    SecurityMonitoringRuleHardcodedEvaluatorType:
      description: Hardcoded evaluator type.
      enum:
      - log4shell
      type: string
      x-enum-varnames:
      - LOG4SHELL
    SecurityMonitoringStandardDataSource:
      default: logs
      description: Source of events, either logs, audit trail, or Datadog events.
      enum:
      - logs
      - audit
      - app_sec_spans
      - spans
      - security_runtime
      - network
      - events
      example: logs
      type: string
      x-enum-varnames:
      - LOGS
      - AUDIT
      - APP_SEC_SPANS
      - SPANS
      - SECURITY_RUNTIME
      - NETWORK
      - EVENTS
    CIAppTestsGroupBy:
      description: A group-by rule.
      properties:
        facet:
          description: The name of the facet to use (required).
          example: '@test.service'
          type: string
        histogram:
          $ref: '#/components/schemas/CIAppGroupByHistogram'
        limit:
          default: 10
          description: The maximum buckets to return for this group-by.
          format: int64
          type: integer
          example: 42
        missing:
          $ref: '#/components/schemas/CIAppGroupByMissing'
        sort:
          $ref: '#/components/schemas/CIAppAggregateSort'
        total:
          $ref: '#/components/schemas/CIAppGroupByTotal'
      required:
      - facet
      type: object
    SecurityMonitoringRuleCaseActionOptions:
      additionalProperties: {}
      description: Options for the rule action
      properties:
        duration:
          description: Duration of the action in seconds. 0 indicates no expiration.
          example: 0
          format: int64
          minimum: 0
          type: integer
        userBehaviorName:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsUserBehaviorName'
      type: object
    CIAppGroupByMissingNumber:
      description: The missing value to use if there is a number valued facet.
      format: double
      type: number
    CIAppResponseStatus:
      description: The status of the response.
      enum:
      - done
      - timeout
      example: done
      type: string
      x-enum-varnames:
      - DONE
      - TIMEOUT
    CIAppTestEventsResponse:
      description: Response object with all test events matching the request and pagination information.
      properties:
        data:
          description: Array of events matching the request.
          items:
            $ref: '#/components/schemas/CIAppTestEvent'
          type: array
        links:
          $ref: '#/components/schemas/CIAppResponseLinks'
        meta:
          $ref: '#/components/schemas/CIAppResponseMetadataWithPagination'
      type: object
    CIAppAggregateSortType:
      default: alphabetical
      description: The type of sorting algorithm.
      enum:
      - alphabetical
      - measure
      type: string
      x-enum-varnames:
      - ALPHABETICAL
      - MEASURE
    SecurityMonitoringRuleOptions:
      description: Options.
      properties:
        complianceRuleOptions:
          $ref: '#/components/schemas/CloudConfigurationComplianceRuleOptions'
        decreaseCriticalityBasedOnEnv:
          $ref: '#/components/schemas/SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv'
        detectionMethod:
          $ref: '#/components/schemas/SecurityMonitoringRuleDetectionMethod'
        evaluationWindow:
          $ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
        hardcodedEvaluatorType:
          $ref: '#/components/schemas/SecurityMonitoringRuleHardcodedEvaluatorType'
        impossibleTravelOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptions'
        keepAlive:
          $ref: '#/components/schemas/SecurityMonitoringRuleKeepAlive'
        maxSignalDuration:
          $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
        newValueOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
        thirdPartyRuleOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
      type: object
    SecurityMonitoringRuleTestPayload:
      description: Test a rule.
      oneOf:
      - $ref: '#/components/schemas/SecurityMonitoringStandardRuleTestPayload'
    CIAppGroupByMissingString:
      description: The missing value to use if there is a string valued facet.
      type: string
    SecurityMonitoringRuleQueryPayload:
      description: Payload to test a rule query with the expected result.
      properties:
        expectedResult:
          description: Expected result of the test.
          example: true
          type: boolean
        index:
          description: Index of the query under test.
          example: 0
          format: int64
          minimum: 0
          type: integer
        payload:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryPayloadData'
      type: object
    SecurityMonitoringThirdPartyRuleCaseCreate:
      description: Case when a signal is generated by a third party rule.
      properties:
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets for each case.
          items:
            description: Notification.
            type: string
          type: array
        query:
          description: A query to map a third party event to this case.
          type: string
          example: avg:system.cpu.user{*}
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      required:
      - status
      type: object
    SecurityMonitoringReferenceTable:
      description: Reference tables used in the queries.
      properties:
        checkPresence:
          description: Whether to include or exclude the matched values.
          type: boolean
          example: true
        columnName:
          description: The name of the column in the reference table.
          type: string
          example: Example Monitor
        logFieldPath:
          description: The field in the log to match against the reference table.
          type: string
          example: example_value
        ruleQueryName:
          description: The name of the query to apply the reference table to.
          type: string
          example: Example Monitor
        tableName:
          description: The name of the reference table.
          type: string
          example: Example Monitor
      type: object
    CIAppTestLevel:
      description: Test run level.
      enum:
      - session
      - module
      - suite
      - test
      example: test
      type: string
      x-enum-varnames:
      - SESSION
      - MODULE
      - SUITE
      - TEST
    SecurityMonitoringRuleKeepAlive:
      description: 'Once a signal is generated, the signal will remain "open" if a case is matched at least once within

        this keep alive window. For third party detection method, this field is not used.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    SecurityMonitoringRuleSeverity:
      description: Severity of the Security Signal.
      enum:
      - info
      - low
      - medium
      - high
      - critical
      example: critical
      type: string
      x-enum-varnames:
      - INFO
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
    CIAppAggregateBucketValueTimeseries:
      description: A timeseries array.
      items:
        $ref: '#/components/schemas/CIAppAggregateBucketValueTimeseriesPoint'
      type: array
      x-generate-alias-as-model: true
    CIAppGroupByTotalString:
      description: A string to use as the key value for the total bucket.
      type: string
    CIAppAggregateBucketValue:
      description: A bucket value, can either be a timeseries or a single value.
      oneOf:
      - $ref: '#/components/schemas/CIAppAggregateBucketValueSing

# --- truncated at 32 KB (57 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/openapi/datadog-tests-api-openapi.yml