Improve the spec of Cloud SIEM historical jobs (#396)

Co-authored-by: ci.datadog-api-spec <[email protected]>

.apigentools-info

@@ -4,13 +4,13 @@
     "spec_versions": {
         "v1": {
             "apigentools_version": "1.6.6",
-            "regenerated": "2024-12-18 19:23:38.680515",
-            "spec_repo_commit": "3f22290a"
+            "regenerated": "2024-12-19 07:26:20.419256",
+            "spec_repo_commit": "5dd2cbe4"
         },
         "v2": {
             "apigentools_version": "1.6.6",
-            "regenerated": "2024-12-18 19:23:38.695560",
-            "spec_repo_commit": "3f22290a"
+            "regenerated": "2024-12-19 07:26:20.435562",
+            "spec_repo_commit": "5dd2cbe4"
         }
     }
 }

.generator/schemas/v2/openapi.yaml

@@ -12250,6 +12250,65 @@ components:
           maximum: 2147483647
           type: integer
       type: object
+    HistoricalJobOptions:
+      description: Job options.
+      properties:
+        detectionMethod:
+          $ref: '#/components/schemas/SecurityMonitoringRuleDetectionMethod'
+        evaluationWindow:
+          $ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
+        impossibleTravelOptions:
+          $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptions'
+        keepAlive:
+          $ref: '#/components/schemas/SecurityMonitoringRuleKeepAlive'
+        maxSignalDuration:
+          $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
+        newValueOptions:
+          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
+        thirdPartyRuleOptions:
+          $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
+      type: object
+    HistoricalJobQuery:
+      description: Query for selecting logs analyzed by the historical job.
+      properties:
+        aggregation:
+          $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
+        distinctFields:
+          description: Field for which the cardinality is measured. Sent as an array.
+          items:
+            description: Field.
+            type: string
+          type: array
+        groupByFields:
+          description: Fields to group by.
+          items:
+            description: Field.
+            type: string
+          type: array
+        hasOptionalGroupByFields:
+          description: When false, events without a group-by value are ignored by
+            the query. When true, events with missing group-by fields are processed
+            with `N/A`, replacing the missing values.
+          example: false
+          readOnly: true
+          type: boolean
+        metrics:
+          description: Group of target fields to aggregate over when using the sum,
+            max, geo data, or new value aggregations. The sum, max, and geo data aggregations
+            only accept one value in this list, whereas the new value aggregation
+            accepts up to five values.
+          items:
+            description: Field.
+            type: string
+          type: array
+        name:
+          description: Name of the query.
+          type: string
+        query:
+          description: Query to run on logs.
+          example: a > 3
+          type: string
+      type: object
     HistoricalJobResponse:
       description: Historical job response.
       properties:
@@ -14824,13 +14883,6 @@ components:
           items:
             $ref: '#/components/schemas/SecurityMonitoringRuleCaseCreate'
           type: array
-        filters:
-          description: Additional queries to filter matched events before they are
-            processed. This field is deprecated for log detection, signal correlation,
-            and workload security rules.
-          items:
-            $ref: '#/components/schemas/SecurityMonitoringFilter'
-          type: array
         from:
           description: Starting time of data analyzed by the job.
           example: 1729843470000
@@ -14849,14 +14901,14 @@ components:
           example: Excessive number of failed attempts.
           type: string
         options:
-          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
+          $ref: '#/components/schemas/HistoricalJobOptions'
         queries:
           description: Queries for selecting logs analyzed by the job.
           items:
-            $ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
+            $ref: '#/components/schemas/HistoricalJobQuery'
           type: array
         referenceTables:
-          description: Reference tables for the rule.
+          description: Reference tables used in the queries.
           items:
             $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
           type: array
@@ -14866,8 +14918,8 @@ components:
             type: string
           type: array
         thirdPartyCases:
-          description: Cases for generating results from third-party rules. Only available
-            for third-party rules.
+          description: Cases for generating results from third-party detection method.
+            Only available for third-party detection method.
           example: []
           items:
             $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate'
@@ -22792,7 +22844,7 @@ components:
           $ref: '#/components/schemas/ResponseMetaAttributes'
       type: object
     SecurityMonitoringReferenceTable:
-      description: Reference table for the rule.
+      description: Reference tables used in the queries.
       properties:
         checkPresence:
           description: Whether to include or exclude the matched values.
@@ -22804,7 +22856,7 @@ components:
           description: The field in the log to match against the reference table.
           type: string
         ruleQueryName:
-          description: The name of the rule query to apply the reference table to.
+          description: The name of the query to apply the reference table to.
           type: string
         tableName:
           description: The name of the reference table.
@@ -22835,7 +22887,7 @@ components:
       description: Case when signal is generated.
       properties:
         condition:
-          description: 'A rule case contains logical operations (`>`,`>=`, `&&`, `||`)
+          description: 'A case contains logical operations (`>`,`>=`, `&&`, `||`)
             to determine if a signal should be generated
 
             based on the event counts in the previously defined queries.'
@@ -22844,7 +22896,7 @@ components:
           description: Name of the case.
           type: string
         notifications:
-          description: Notification targets for each rule case.
+          description: Notification targets.
           items:
             description: Notification.
             type: string
@@ -22906,7 +22958,8 @@ components:
       description: 'A time window is specified to match when at least one of the cases
         matches true. This is a sliding window
 
-        and evaluates in real time. For third party rules, this field is not used.'
+        and evaluates in real time. For third party detection method, this field is
+        not used.'
       enum:
       - 0
       - 60
@@ -22935,7 +22988,7 @@ components:
       x-enum-varnames:
       - LOG4SHELL
     SecurityMonitoringRuleImpossibleTravelOptions:
-      description: Options on impossible travel rules.
+      description: Options on impossible travel detection method.
       properties:
         baselineUserLocations:
           $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations'
@@ -22951,7 +23004,7 @@ components:
     SecurityMonitoringRuleKeepAlive:
       description: "Once a signal is generated, the signal will remain \u201Copen\u201D
         if a case is matched at least once within\nthis keep alive window. For third
-        party rules, this field is not used."
+        party detection method, this field is not used."
       enum:
       - 0
       - 60
@@ -23009,7 +23062,7 @@ components:
       - TWELVE_HOURS
       - ONE_DAY
     SecurityMonitoringRuleNewValueOptions:
-      description: Options on new value rules.
+      description: Options on new value detection method.
       properties:
         forgetAfter:
           $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter'
@@ -23079,7 +23132,7 @@ components:
       - ZERO_OCCURRENCES
       - ONE_OCCURRENCE
     SecurityMonitoringRuleOptions:
-      description: Options on rules.
+      description: Options.
       properties:
         complianceRuleOptions:
           $ref: '#/components/schemas/CloudConfigurationComplianceRuleOptions'
@@ -23221,7 +23274,7 @@ components:
           type: array
       type: object
     SecurityMonitoringRuleThirdPartyOptions:
-      description: Options on third party rules.
+      description: Options on third party detection method.
       properties:
         defaultNotifications:
           description: Notification targets for the logs that do not correspond to
@@ -24621,7 +24674,7 @@ components:
           description: Name of the case.
           type: string
         notifications:
-          description: Notification targets for each rule case.
+          description: Notification targets for each case.
           items:
             description: Notification.
             type: string

examples/v2_security-monitoring_RunHistoricalJob.rs

@@ -1,6 +1,8 @@
 // Run a historical job returns "Status created" response
 use datadog_api_client::datadog;
 use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;
+use datadog_api_client::datadogV2::model::HistoricalJobOptions;
+use datadog_api_client::datadogV2::model::HistoricalJobQuery;
 use datadog_api_client::datadogV2::model::JobDefinition;
 use datadog_api_client::datadogV2::model::RunHistoricalJobRequest;
 use datadog_api_client::datadogV2::model::RunHistoricalJobRequestAttributes;
@@ -10,10 +12,8 @@ use datadog_api_client::datadogV2::model::SecurityMonitoringRuleCaseCreate;
 use datadog_api_client::datadogV2::model::SecurityMonitoringRuleEvaluationWindow;
 use datadog_api_client::datadogV2::model::SecurityMonitoringRuleKeepAlive;
 use datadog_api_client::datadogV2::model::SecurityMonitoringRuleMaxSignalDuration;
-use datadog_api_client::datadogV2::model::SecurityMonitoringRuleOptions;
 use datadog_api_client::datadogV2::model::SecurityMonitoringRuleQueryAggregation;
 use datadog_api_client::datadogV2::model::SecurityMonitoringRuleSeverity;
-use datadog_api_client::datadogV2::model::SecurityMonitoringStandardRuleQuery;
 
 #[tokio::main]
 async fn main() {
@@ -32,15 +32,15 @@ async fn main() {
                         "main".to_string(),
                         "A large number of failed login attempts.".to_string(),
                         "Excessive number of failed attempts.".to_string(),
-                        vec![SecurityMonitoringStandardRuleQuery::new()
+                        vec![HistoricalJobQuery::new()
                             .aggregation(SecurityMonitoringRuleQueryAggregation::COUNT)
                             .distinct_fields(vec![])
                             .group_by_fields(vec![])
                             .query("source:non_existing_src_weekend".to_string())],
                         1730387532611,
                     )
                     .options(
-                        SecurityMonitoringRuleOptions::new()
+                        HistoricalJobOptions::new()
                             .evaluation_window(
                                 SecurityMonitoringRuleEvaluationWindow::FIFTEEN_MINUTES,
                             )

src/datadogV2/model/mod.rs

@@ -3302,6 +3302,10 @@ pub mod model_job_definition;
 pub use self::model_job_definition::JobDefinition;
 pub mod model_calculated_field;
 pub use self::model_calculated_field::CalculatedField;
+pub mod model_historical_job_options;
+pub use self::model_historical_job_options::HistoricalJobOptions;
+pub mod model_historical_job_query;
+pub use self::model_historical_job_query::HistoricalJobQuery;
 pub mod model_historical_job_data_type;
 pub use self::model_historical_job_data_type::HistoricalJobDataType;
 pub mod model_historical_job_list_meta;