openapi: 3.0.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Account Rules API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Rules
paths:
  /api/v2/monitor/notification_rule:
    get:
      description: Returns a list of all monitor notification rules.
      operationId: GetMonitorNotificationRules
      parameters:
      - description: 'Comma-separated list of resource paths for related resources to include in the response. Supported resource

          path is `created_by`.'
        in: query
        name: include
        required: false
        schema:
          example: created_by
          type: string
        example: created_by
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MonitorNotificationRuleListResponse'
          description: OK
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - monitors_read
      summary: Datadog Get All Monitor Notification Rules
      tags:
      - Rules
      x-menu-order: 15
      x-permission:
        operator: OR
        permissions:
        - monitors_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in Preview. If you have any feedback,

        contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      description: Creates a monitor notification rule.
      operationId: CreateMonitorNotificationRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MonitorNotificationRuleCreateRequest'
        description: Request body to create a monitor notification rule.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MonitorNotificationRuleResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - monitor_config_policy_write
      summary: Datadog Create a Monitor Notification Rule
      tags:
      - Rules
      x-given:
        monitor_notification_rule:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"monitor-notification-rule\",\n    \"attributes\": {\n      \"name\":\"test rule\",\n      \"filter\": {\n        \"tags\": [\n          \"app:{{ unique_lower }}\"\n        ]\n      },\n      \"recipients\":[\n        \"slack-monitor-app\"\n      ]\n    }\n  }\n}"
          step: there is a valid "monitor_notification_rule" in the system
      x-menu-order: 16
      x-permission:
        operator: OR
        permissions:
        - monitor_config_policy_write
      x-undo:
        operationId: DeleteMonitorNotificationRule
        parameters:
        - name: rule_id
          source: data.id
        type: unsafe
      x-unstable: '**Note**: This endpoint is in Preview. If you have any feedback,

        contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/monitor/notification_rule/{rule_id}:
    delete:
      description: Deletes a monitor notification rule by `rule_id`.
      operationId: DeleteMonitorNotificationRule
      parameters:
      - description: ID of the monitor notification rule to delete.
        in: path
        name: rule_id
        required: true
        schema:
          type: string
        example: abc-123-def
      responses:
        '204':
          description: OK
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not Found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - monitor_config_policy_write
      summary: Datadog Delete a Monitor Notification Rule
      tags:
      - Rules
      x-menu-order: 18
      x-permission:
        operator: OR
        permissions:
        - monitor_config_policy_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in Preview. If you have any feedback,

        contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: Returns a monitor notification rule by `rule_id`.
      operationId: GetMonitorNotificationRule
      parameters:
      - description: ID of the monitor notification rule to fetch.
        in: path
        name: rule_id
        required: true
        schema:
          type: string
        example: abc-123-def
      - description: 'Comma-separated list of resource paths for related resources to include in the response. Supported resource

          path is `created_by`.'
        in: query
        name: include
        required: false
        schema:
          example: created_by
          type: string
        example: created_by
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MonitorNotificationRuleResponse'
          description: OK
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not Found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - monitors_read
      summary: Datadog Get a Monitor Notification Rule
      tags:
      - Rules
      x-menu-order: 14
      x-permission:
        operator: OR
        permissions:
        - monitors_read
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in Preview. If you have any feedback,

        contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: Updates a monitor notification rule by `rule_id`.
      operationId: UpdateMonitorNotificationRule
      parameters:
      - description: ID of the monitor notification rule to update.
        in: path
        name: rule_id
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MonitorNotificationRuleUpdateRequest'
        description: Request body to update the monitor notification rule.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MonitorNotificationRuleResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Not Found
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - monitor_config_policy_write
      summary: Datadog Update a Monitor Notification Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 17
      x-permission:
        operator: OR
        permissions:
        - monitor_config_policy_write
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in Preview. If you have any feedback,

        contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/on-call/teams/{team_id}/routing-rules:
    get:
      description: Get a team's On-Call routing rules
      operationId: GetOnCallTeamRoutingRules
      parameters:
      - description: The team ID
        in: path
        name: team_id
        required: true
        schema:
          example: 27590dae-47be-4a7d-9abf-8f4e45124020
          type: string
        example: 27590dae-47be-4a7d-9abf-8f4e45124020
      - description: 'Comma-separated list of included relationships to be returned. Allowed values: `rules`, `rules.policy`.'
        in: query
        name: include
        schema:
          type: string
        example: example_value
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamRoutingRules'
          description: OK
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ: []
      summary: Datadog Get On-call Team Routing Rules
      tags:
      - Rules
      x-menu-order: 9
      x-permission:
        operator: AND
        permissions:
        - on_call_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      description: Set a team's On-Call routing rules
      operationId: SetOnCallTeamRoutingRules
      parameters:
      - description: The team ID
        in: path
        name: team_id
        required: true
        schema:
          example: 27590dae-47be-4a7d-9abf-8f4e45124020
          type: string
        example: 27590dae-47be-4a7d-9abf-8f4e45124020
      - description: 'Comma-separated list of included relationships to be returned. Allowed values: `rules`, `rules.policy`.'
        in: query
        name: include
        schema:
          type: string
        example: example_value
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TeamRoutingRulesRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamRoutingRules'
          description: OK
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ: []
      summary: Datadog Set On-call Team Routing Rules
      tags:
      - Rules
      x-given:
        routing_rules:
          parameters:
          - name: team_id
            source: dd_team.data.id
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"team_routing_rules\",\n    \"id\": \"{{ dd_team.data.id }}\",\n    \"attributes\": {\n      \"rules\": [\n        {\n          \"query\": \"\",\n          \"policy_id\": \"{{ escalation_policy.data.id }}\",\n          \"urgency\": \"low\",\n          \"actions\": []\n        }\n      ]\n    }\n  }\n}"
          step: there are valid "routing_rules" in the system
      x-menu-order: 10
      x-permission:
        operator: AND
        permissions:
        - on_call_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/asm/waf/custom_rules:
    get:
      description: Retrieve a list of WAF custom rule.
      operationId: ListApplicationSecurityWAFCustomRules
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleListResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog List All Waf Custom Rules
      tags:
      - Rules
      x-menu-order: 13
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      description: Create a new WAF custom rule with the given parameters.
      operationId: CreateApplicationSecurityWafCustomRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCreateRequest'
        description: The definition of the new WAF Custom Rule.
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleResponse'
          description: Created
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Create a Waf Custom Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-given:
        custom_rule:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"custom_rule\",\n    \"attributes\": {\n      \"blocking\": false,\n      \"conditions\": [\n        {\n          \"operator\": \"match_regex\",\n          \"parameters\": {\n            \"inputs\": [\n              {\n                \"address\": \"server.request.query\",\n                \"key_path\": [\n                  \"id\"\n                ]\n              }\n            ],\n            \"regex\": \"badactor\"\n          }\n        }\n      ],\n      \"enabled\": true,\n      \"name\": \"test\",\n      \"path_glob\": \"/test\",\n      \"scope\": [\n        {\n          \"env\": \"test\",\n          \"service\": \"test\"\n        }\n      ],\n      \"tags\": {\n        \"category\": \"attack_attempt\",\n        \"type\": \"test\"\n      }\n    }\n  }\n}"
          step: there is a valid "custom_rule" in the system
      x-menu-order: 12
      x-undo:
        operationId: DeleteApplicationSecurityWafCustomRule
        parameters:
        - name: custom_rule_id
          source: data.id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/asm/waf/custom_rules/{custom_rule_id}:
    delete:
      description: Delete a specific WAF custom rule.
      operationId: DeleteApplicationSecurityWafCustomRule
      parameters:
      - $ref: '#/components/parameters/ApplicationSecurityWafCustomRuleIDParam'
      responses:
        '204':
          description: No Content
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Delete a Waf Custom Rule
      tags:
      - Rules
      x-menu-order: 16
      x-terraform-resource: appsec_waf_custom_rule
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: Retrieve a WAF custom rule by ID.
      operationId: GetApplicationSecurityWafCustomRule
      parameters:
      - $ref: '#/components/parameters/ApplicationSecurityWafCustomRuleIDParam'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get a Waf Custom Rule
      tags:
      - Rules
      x-menu-order: 10
      x-terraform-resource: appsec_waf_custom_rule
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      description: 'Update a specific WAF custom Rule.

        Returns the Custom Rule object when the request is successful.'
      operationId: UpdateApplicationSecurityWafCustomRule
      parameters:
      - $ref: '#/components/parameters/ApplicationSecurityWafCustomRuleIDParam'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleUpdateRequest'
        description: New definition of the WAF Custom Rule.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Waf Custom Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 15
      x-terraform-resource: appsec_waf_custom_rule
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/cws/agent_rules:
    get:
      description: 'Get the list of Workload Protection agent rules.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: ListCSMThreatsAgentRules
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRulesListResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get All Workload Protection Agent Rules
      tags:
      - Rules
      x-menu-order: 1
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      description: 'Create a new Workload Protection agent rule with the given parameters.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: CreateCSMThreatsAgentRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleCreateRequest'
        description: The definition of the new agent rule
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Create a Workload Protection Agent Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-given:
        agent_rule:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"agent_rule\",\n    \"attributes\": {\n      \"name\": \"{{ unique_lower_alnum }}\",\n      \"description\": \"My Agent rule\",\n      \"expression\": \"exec.file.name == \\\"sh\\\"\",\n      \"enabled\": true,\n      \"product_tags\": [\"security:attack\", \"technique:T1059\"],\n      \"actions\": [{\"set\": {\"name\": \"test_set\", \"value\": \"test_value\", \"scope\": \"process\"}}],\n      \"policy_id\": \"{{ policy.data.id }}\"\n     }\n  }\n}"
          step: there is a valid "agent_rule_rc" in the system
      x-menu-order: 3
      x-undo:
        operationId: DeleteCSMThreatsAgentRule
        parameters:
        - name: agent_rule_id
          source: data.id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}:
    delete:
      description: 'Delete a specific Workload Protection agent rule.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: DeleteCSMThreatsAgentRule
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID'
      - $ref: '#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID'
      responses:
        '204':
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Delete a Workload Protection Agent Rule
      tags:
      - Rules
      x-menu-order: 5
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: 'Get the details of a specific Workload Protection agent rule.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: GetCSMThreatsAgentRule
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID'
      - $ref: '#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get a Workload Protection Agent Rule
      tags:
      - Rules
      x-menu-order: 2
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: 'Update a specific Workload Protection Agent rule.

        Returns the agent rule object when the request is successful.


        **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.'
      operationId: UpdateCSMThreatsAgentRule
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID'
      - $ref: '#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleUpdateRequest'
        description: New definition of the agent rule
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Workload Protection Agent Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/scorecard/outcomes:
    get:
      description: Fetches all rule outcomes.
      operationId: ListScorecardOutcomes
      parameters:
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageOffset'
      - description: Include related rule details in the response.
        in: query
        name: include
        required: false
        schema:
          example: rule
          type: string
        example: rule
      - description: Return only specified values in the outcome attributes.
        in: query
        name: fields[outcome]
        required: false
        schema:
          example: state, service_name
          type: string
        example: state, service_name
      - description: Return only specified values in the included rule details.
        in: query
        name: fields[rule]
        required: false
        schema:
          example: name
          type: string
        example: name
      - description: Filter the outcomes on a specific service name.
        in: query
        name: filter[outcome][service_name]
        required: false
        schema:
          example: web-store
          type: string
        example: web-store
      - description: Filter the outcomes by a specific state.
        in: query
        name: filter[outcome][state]
        required: false
        schema:
          example: fail
          type: string
        example: fail
      - description: Filter outcomes on whether a rule is enabled/disabled.
        in: query
        name: filter[rule][enabled]
        required: false
        schema:
          example: true
          type: boolean
        example: true
      - description: Filter outcomes based on rule ID.
        in: query
        name: filter[rule][id]
        required: false
        schema:
          example: f4485c79-0762-449c-96cf-c31e54a659f6
          type: string
        example: f4485c79-0762-449c-96cf-c31e54a659f6
      - description: Filter outcomes based on rule name.
        in: query
        name: filter[rule][name]
        required: false
        schema:
          example: SLOs Defined
          type: string
        example: SLOs Defined
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutcomesResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_service_catalog_read
      summary: Datadog List All Rule Outcomes
      tags:
      - Rules
      x-menu-order: 2
      x-pagination:
        limitParam: page[size]
        pageOffsetParam: page[offset]
        resultsPath: data
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/scorecard/rules:
    get:
      description: Fetch all rules.
      operationId: ListScorecardRules
      parameters:
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageOffset'
      - description: Include related scorecard details in the response.
        in: query
        name: include
        required: false
        schema:
          example: scorecard
          type: string
        example: scorecard
      - description: Filter the rules on a rule ID.
        in: query
        name: filter[rule][id]
        required: false
        schema:
          example: 37d2f990-c885-4972-949b-8b798213a166
          type: string
        example: 37d2f990-c885-4972-949b-8b798213a166
      - description: Filter for enabled rules only.
        in: query
        name: filter[rule][enabled]
        required: false
        schema:
          example: true
          type: boolean
        example: true
      - description: Filter for custom rules only.
        in: query
        name: filter[rule][custom]
        required: false
        schema:
          example: true
          type: boolean
        example: true
      - description: Filter rules on the rule name.
        in: query
        name: filter[rule][name]
        required: false
        schema:
          example: Code Repos Defined
          type: string
        example: Code Repos Defined
      - description: Filter rules on the rule description.
        in: query
        name: filter[rule][description]
        required: false
        schema:
          example: Identifying
          type: string
        example: Identifying
      - description: Return only specific fields in the response for rule attributes.
        in: query
        name: fields[rule]
        required: false
        schema:
          example: name, description
          type: string
        example: name, description
      - description: Return only specific fields in the included response for scorecard attributes.
        in: query
        name: fields[scorecard]
        required: false
        schema:
          example: name
          type: string
        example: name
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRulesResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_service_catalog_read
      summary: Datadog List All Rules
      tags:
      - Rules
      x-menu-order: 2
      x-pagination:
        limitParam: page[size]
        pageOffsetParam: page[offset]
        resultsPath: data
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      description: Creates a new rule.
      operationId: CreateScorecardRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateRuleRequest'
        description: Rule attributes.
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateRuleResponse'
          description: Created
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_service_catalog_write
      summary: Datadog Create a New Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-given:
        create_scorecard_rule:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"rule\",\n    \"attributes\": {\n      \"name\": \"{{ unique }}\",\n      \"enabled\": true,\n      \"owner\": \"Datadog\",\n      \"scorecard_name\": \"OpenAPI Spec Test Best Practices\"\n    }\n  }\n}"
          step: there is a valid "create_scorecard_rule" in the system
      x-menu-order: 1
      x-undo:
        operationId: DeleteScorecardRule
        parameters:
        - name: rule_id
          source: data.id
        type: unsafe
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/scorecard/rules/{rule_id}:
    delete:
      description: Deletes a single rule.
      operationId: DeleteScorecardRule
      parameters:
      - $ref: '#/components/parameters/RuleId'
      responses:
        '204':
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_service_catalog_write
      summary: Datadog Delete a Rule
      tags:
      - Rules
      x-menu-order: 3
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      description: Updates an existing rule.
      operationId: UpdateScorecardRule
      parameters:
      - $ref: '#/components/parameters/RuleId'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRuleRequest'
        description: Rule attributes.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateRuleResponse'
          description: Rule updated successfully
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - apm_service_catalog_write
      summary: Datadog Update an Existing Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 4
      x-undo:
        type: idempotent
      x-unstable: '**Note**: This endpoint is in public beta.

        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security/signals/notification_rules:
    get:
      description: Returns the list of notification rules for security signals.
      operationId: GetSignalNotificationRules
      responses:
        '200':
          $ref: '#/components/responses/NotificationRulesList'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_notification_profiles_read
      summary: Datadog Get the List of Signal-based Notification Rules
      tags:
      - Rules
      x-menu-order: 15
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_notification_profiles_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      description: Create a new notification rule for security signals and return the created rule.
      operationId: CreateSignalNotificationRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateNotificationRuleParameters'
        description: 'The body of the create notification rule request is composed of the rule type and the rule attributes:

          the rule name, the selectors, the notification targets, and the rule enabled status.

          '
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationRuleResponse'
          description: Successfully created the notification rule.
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_notification_profiles_write
      summary: Datadog Create a New Signal-based Notification Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-given:
        valid_signal_notification_rule:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"notification_rules\",\n    \"attributes\": {\n      \"name\": \"{{ unique }}\",\n      \"selectors\": {\n        \"rule_types\": [\"signal_correlation\"],\n        \"trigger_source\": \"security_signals\",\n        \"severities\": [\"critical\"],\n        \"query\": \"env:test\"\n      },\n      \"targets\": [\"@email@email.com\"],\n      \"enabled\": true\n    }\n  }\n}"
          step: there is a valid "valid_signal_notification_rule" in the system
      x-menu-order: 16
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_notification_profiles_write
      x-undo:
        operationId: DeleteSignalNotificationRule
        parameters:
        - name: id
          source: data.id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security/signals/notification_rules/{id}:
    delete:
      description: Delete a notification rule for security signals.
      operationId: DeleteSignalNotificationRule
      parameters:
      - description: ID of the notification rule.
        in: path
        name: id
        required: true
        schema:
          type: string
        example: abc-123-def
      responses:
        '204':
          description: Rule successfully deleted.
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_notification_profiles_write
      summary: Datadog Delete a Signal-based Notification Rule
      tags:
      - Rules
      x-menu-order: 21
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_notification_profiles_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: Get the details of a notification rule for security signals.
      operationId: GetSignalNotificationRule
      parameters:
      - description: ID of the notification rule.
        in: path
        name: id
        required: true
        schema:
          type: string
        example: abc-123-def
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationRuleResponse'
          description: Notification rule details.
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_notification_profiles_read
      summary: Datadog Get Details of a Signal-based Notification Rule
      tags:
      - Rules
      x-menu-order: 18
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_notification_profiles_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: Partially update the notification rule. All fields are optional; if a field is not provided, it is not updated.
      operationId: PatchSignalNotificationRule
      parameters:
      - description: ID of the notification rule.
        in: path
        name: id
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchNotificationRuleParameters'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationRuleResponse'
          description: Notification rule successfully patched.
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '422':
          $ref: '#/components/responses/UnprocessableEntityResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_notification_profiles_write
      summary: Datadog Patch a Signal-based Notification Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 20
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_notification_profiles_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security/vulnerabilities/notification_rules:
    get:
      description: Returns the list of notification rules for security vulnerabilities.
      operationId: GetVulnerabilityNotificationRules
      responses:
        '200':
          $ref: '#/components/responses/NotificationRulesList'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_notification_profiles_read
      summary: Datadog Get the List of Vulnerability Notification Rules
      tags:
      - Rules
      x-menu-order: 15
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_notification_profiles_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      description: Create a new notification rule for security vulnerabilities and return the created rule.
      operationId: CreateVulnerabilityNotificationRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateNotificationRuleParameters'
        description: 'The body of the create notification rule request is composed of the rule type and the rule attributes:

          the rule name, the selectors, the notification targets, and the rule enabled status.

          '
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationRuleResponse'
          description: Successfully created the notification rule.
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_notification_profiles_write
      summary: Datadog Create a New Vulnerability-based Notification Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-given:
        valid_vulnerability_notification_rule:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"notification_rules\",\n    \"attributes\": {\n      \"name\": \"{{ unique }}\",\n      \"selectors\": {\n        \"rule_types\": [\"misconfiguration\", \"attack_path\"],\n        \"trigger_source\": \"security_findings\",\n        \"severities\": [\"critical\"],\n        \"query\": \"env:test\"\n      },\n      \"time_aggregation\": 86400,\n      \"targets\": [\"@email@email.com\"],\n      \"enabled\": true\n    }\n  }\n}"
          step: there is a valid "valid_vulnerability_notification_rule" in the system
      x-menu-order: 16
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_notification_profiles_write
      x-undo:
        operationId: DeleteVulnerabilityNotificationRule
        parameters:
        - name: id
          source: data.id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security/vulnerabilities/notification_rules/{id}:
    delete:
      description: Delete a notification rule for security vulnerabilities.
      operationId: DeleteVulnerabilityNotificationRule
      parameters:
      - description: ID of the notification rule.
        in: path
        name: id
        required: true
        schema:
          type: string
        example: abc-123-def
      responses:
        '204':
          description: Rule successfully deleted.
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_notification_profiles_write
      summary: Datadog Delete a Vulnerability-based Notification Rule
      tags:
      - Rules
      x-menu-order: 21
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_notification_profiles_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: Get the details of a notification rule for security vulnerabilities.
      operationId: GetVulnerabilityNotificationRule
      parameters:
      - description: ID of the notification rule.
        in: path
        name: id
        required: true
        schema:
          type: string
        example: abc-123-def
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationRuleResponse'
          description: Notification rule details.
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_notification_profiles_read
      summary: Datadog Get Details of a Vulnerability Notification Rule
      tags:
      - Rules
      x-menu-order: 18
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_notification_profiles_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: Partially update the notification rule. All fields are optional; if a field is not provided, it is not updated.
      operationId: PatchVulnerabilityNotificationRule
      parameters:
      - description: ID of the notification rule.
        in: path
        name: id
        required: true
        schema:
          type: string
        example: abc-123-def
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchNotificationRuleParameters'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationRuleResponse'
          description: Notification rule successfully patched.
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '422':
          $ref: '#/components/responses/UnprocessableEntityResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_notification_profiles_write
      summary: Datadog Patch a Vulnerability-based Notification Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 20
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_notification_profiles_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/cloud_workload_security/agent_rules:
    get:
      description: 'Get the list of agent rules.


        **Note**: This endpoint should only be used for the Government (US1-FED) site.'
      operationId: ListCloudWorkloadSecurityAgentRules
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRulesListResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get All Workload Protection Agent Rules (us1-fed)
      tags:
      - Rules
      x-menu-order: 12
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_cws_agent_rules_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      description: 'Create a new agent rule with the given parameters.


        **Note**: This endpoint should only be used for the Government (US1-FED) site.'
      operationId: CreateCloudWorkloadSecurityAgentRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleCreateRequest'
        description: The definition of the new agent rule
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Create a Workload Protection Agent Rule (us1-fed)
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-given:
        agent_rule:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"agent_rule\",\n    \"attributes\": {\n      \"name\": \"{{ unique_lower_alnum }}\",\n      \"description\": \"My Agent rule\",\n      \"expression\": \"exec.file.name == \\\"sh\\\"\",\n      \"enabled\": true\n     }\n  }\n}"
          step: there is a valid "agent_rule" in the system
      x-menu-order: 14
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_cws_agent_rules_write
      x-undo:
        operationId: DeleteCloudWorkloadSecurityAgentRule
        parameters:
        - name: agent_rule_id
          source: data.id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}:
    delete:
      description: 'Delete a specific agent rule.


        **Note**: This endpoint should only be used for the Government (US1-FED) site.'
      operationId: DeleteCloudWorkloadSecurityAgentRule
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID'
      responses:
        '204':
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Delete a Workload Protection Agent Rule (us1-fed)
      tags:
      - Rules
      x-menu-order: 16
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_cws_agent_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: 'Get the details of a specific agent rule.


        **Note**: This endpoint should only be used for the Government (US1-FED) site.'
      operationId: GetCloudWorkloadSecurityAgentRule
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Get a Workload Protection Agent Rule (us1-fed)
      tags:
      - Rules
      x-menu-order: 13
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_cws_agent_rules_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: 'Update a specific agent rule.

        Returns the agent rule object when the request is successful.


        **Note**: This endpoint should only be used for the Government (US1-FED) site.'
      operationId: UpdateCloudWorkloadSecurityAgentRule
      parameters:
      - $ref: '#/components/parameters/CloudWorkloadSecurityAgentRuleID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleUpdateRequest'
        description: New definition of the agent rule
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update a Workload Protection Agent Rule (us1-fed)
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 15
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_cws_agent_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/configuration/suppressions:
    get:
      description: Get the list of all suppression rules.
      operationId: ListSecurityMonitoringSuppressions
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringSuppressionsResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_suppressions_read
      summary: Datadog Get All Suppression Rules
      tags:
      - Rules
      x-menu-order: 0
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      description: Create a new suppression rule.
      operationId: CreateSecurityMonitoringSuppression
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringSuppressionCreateRequest'
        description: The definition of the new suppression rule.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringSuppressionResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '409':
          $ref: '#/components/responses/ConflictResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_suppressions_write
      summary: Datadog Create a Suppression Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-given:
        suppression:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"suppressions\",\n    \"attributes\": {\n      \"enabled\": true,\n      \"name\": \"{{ unique }}\",\n      \"description\": \"{{ unique }}\",\n      \"rule_query\": \"source:cloudtrail\",\n      \"suppression_query\": \"env:test\"\n    }\n  }\n}"
          step: there is a valid "suppression" in the system
      x-menu-order: 0
      x-undo:
        operationId: DeleteSecurityMonitoringSuppression
        parameters:
        - name: suppression_id
          source: data.id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/configuration/suppressions/{suppression_id}:
    delete:
      description: Delete a specific suppression rule.
      operationId: DeleteSecurityMonitoringSuppression
      parameters:
      - $ref: '#/components/parameters/SecurityMonitoringSuppressionID'
      responses:
        '204':
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_suppressions_write
      summary: Datadog Delete a Suppression Rule
      tags:
      - Rules
      x-menu-order: 0
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      description: Get the details of a specific suppression rule.
      operationId: GetSecurityMonitoringSuppression
      parameters:
      - $ref: '#/components/parameters/SecurityMonitoringSuppressionID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringSuppressionResponse'
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_suppressions_read
      summary: Datadog Get a Suppression Rule
      tags:
      - Rules
      x-menu-order: 0
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: Update a specific suppression rule.
      operationId: UpdateSecurityMonitoringSuppression
      parameters:
      - $ref: '#/components/parameters/SecurityMonitoringSuppressionID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringSuppressionUpdateRequest'
        description: New definition of the suppression rule. Supports partial updates.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringSuppressionResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '409':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_suppressions_write
      summary: Datadog Update a Suppression Rule
      tags:
      - Rules
      x-menu-order: 0
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules:
    get:
      description: List rules.
      operationId: ListSecurityMonitoringRules
      parameters:
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/PageNumber'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringListRulesResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_read
      summary: Datadog List Rules
      tags:
      - Rules
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      description: Create a detection rule.
      operationId: CreateSecurityMonitoringRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringRuleCreatePayload'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Create a Detection Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-given:
        cloud_configuration_rule:
          parameters:
          - name: body
            value: "{\n  \"name\": \"{{ unique }}_cloud\",\n  \"tags\": [\"a:tag\"],\n  \"type\": \"cloud_configuration\",\n  \"isEnabled\": false,\n  \"message\": \"Cloud configuration rule\",\n  \"options\": {\n    \"complianceRuleOptions\": {\n      \"resourceType\": \"gcp_compute_disk\",\n      \"regoRule\": {\n        \"policy\": \"package datadog\\n\\nimport data.datadog.output as dd_output\\n\\nimport future.keywords.contains\\nimport future.keywords.if\\nimport future.keywords.in\\n\\nmilliseconds_in_a_day := ((1000 * 60) * 60) * 24\\n\\neval(iam_service_account_key) = \\\"skip\\\" if {\\n\\tiam_service_account_key.disabled\\n} else = \\\"pass\\\" if {\\n\\t(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90\\n} else = \\\"fail\\\"\\n\\n# This part remains unchanged for all rules\\nresults contains result if {\\n\\tsome resource in input.resources[input.main_resource_type]\\n\\tresult := dd_output.format(resource, eval(resource))\\n}\\n\",\n        \"resourceTypes\": [\n          \"gcp_compute_disk\"\n        ]\n      },\n      \"complexRule\": false\n    }\n  },\n  \"complianceSignalOptions\": {\n    \"userActivationStatus\": true,\n    \"userGroupByFields\": [\"@account_id\"]\n  },\n  \"cases\": [\n    {\n      \"status\": \"info\",\n      \"notifications\": [\"channel\"]\n    }\n  ]\n}"
          step: there is a valid "cloud_configuration_rule" in the system
        security_rule:
          parameters:
          - name: body
            value: "{\n  \"name\": \"{{ unique }}\",\n  \"queries\": [{\n    \"query\": \"@test:true\",\n    \"aggregation\": \"count\",\n    \"groupByFields\": [],\n    \"distinctFields\": [],\n    \"metrics\": []\n  }],\n  \"filters\": [],\n  \"cases\": [{\n    \"name\": \"\",\n    \"status\": \"info\",\n    \"condition\": \"a > 0\",\n    \"notifications\": []\n  }],\n  \"options\": {\n    \"evaluationWindow\": 900,\n    \"keepAlive\": 3600,\n    \"maxSignalDuration\": 86400\n  },\n  \"message\": \"Test rule\",\n  \"tags\": [],\n  \"isEnabled\": true,\n  \"type\": \"log_detection\"\n}"
          step: there is a valid "security_rule" in the system
        security_rule_bis:
          parameters:
          - name: body
            value: "{\n  \"name\": \"{{ unique }}_bis\",\n  \"queries\": [{\n    \"query\": \"@test:false\",\n    \"aggregation\": \"count\",\n    \"groupByFields\": [],\n    \"distinctFields\": [],\n    \"metrics\": []\n  }],\n  \"filters\": [],\n  \"cases\": [{\n    \"name\": \"\",\n    \"status\": \"info\",\n    \"condition\": \"a > 0\",\n    \"notifications\": []\n  }],\n  \"options\": {\n    \"evaluationWindow\": 900,\n    \"keepAlive\": 3600,\n    \"maxSignalDuration\": 86400\n  },\n  \"message\": \"Test rule Bis\",\n  \"tags\": [],\n  \"isEnabled\": true,\n  \"type\": \"log_detection\"\n}"
          step: there is a valid "security_rule_bis" in the system
      x-menu-order: 4
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        operationId: DeleteSecurityMonitoringRule
        parameters:
        - name: rule_id
          source: id
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules/convert:
    post:
      description: 'Convert a rule that doesn''t (yet) exist from JSON to Terraform for datadog provider

        resource datadog_security_monitoring_rule.'
      operationId: ConvertSecurityMonitoringRuleFromJSONToTerraform
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringRuleConvertPayload'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringRuleConvertResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Convert a Rule from Json to Terraform
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 12
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules/test:
    post:
      description: Test a rule.
      operationId: TestSecurityMonitoringRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringRuleTestRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringRuleTestResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Test a Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 9
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules/validation:
    post:
      description: Validate a detection rule.
      operationId: ValidateSecurityMonitoringRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringRuleValidatePayload'
        required: true
      responses:
        '204':
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Validate a Detection Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 10
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules/{rule_id}:
    delete:
      description: Delete an existing rule. Default rules cannot be deleted.
      operationId: DeleteSecurityMonitoringRule
      parameters:
      - $ref: '#/components/parameters/SecurityMonitoringRuleID'
      responses:
        '204':
          description: OK
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Delete an Existing Rule
      tags:
      - Rules
      x-menu-order: 7
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      description: 'Update an existing rule. When updating `cases`, `queries` or `options`, the whole field

        must be included. For example, when modifying a query all queries must be included.

        Default rules can only be updated to be enabled, to change notifications, or to update

        the tags (default tags cannot be removed).'
      operationId: UpdateSecurityMonitoringRule
      parameters:
      - $ref: '#/components/parameters/SecurityMonitoringRuleID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringRuleUpdatePayload'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringRuleResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Update an Existing Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 6
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules/{rule_id}/convert:
    get:
      description: 'Convert an existing rule from JSON to Terraform for datadog provider

        resource datadog_security_monitoring_rule.'
      operationId: ConvertExistingSecurityMonitoringRule
      parameters:
      - $ref: '#/components/parameters/SecurityMonitoringRuleID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringRuleConvertResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_read
      summary: Datadog Convert an Existing Rule from Json to Terraform
      tags:
      - Rules
      x-menu-order: 11
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_read
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security_monitoring/rules/{rule_id}/test:
    post:
      description: Test an existing rule.
      operationId: TestExistingSecurityMonitoringRule
      parameters:
      - $ref: '#/components/parameters/SecurityMonitoringRuleID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityMonitoringRuleTestRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityMonitoringRuleTestResponse'
          description: OK
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '401':
          $ref: '#/components/responses/ConcurrentModificationResponse'
        '403':
          $ref: '#/components/responses/NotAuthorizedResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_rules_write
      summary: Datadog Test an Existing Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 8
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_rules_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/sensitive-data-scanner/config/rules:
    post:
      description: 'Create a scanning rule in a sensitive data scanner group, ordered last.

        The posted rule MUST include a group relationship.

        It MUST include either a standard_pattern relationship or a regex attribute, but not both.

        If included_attributes is empty or missing, we will scan all attributes except

        excluded_attributes. If both are missing, we will scan the whole event.'
      operationId: CreateScanningRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SensitiveDataScannerRuleCreateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SensitiveDataScannerCreateRuleResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication Error
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Create Scanning Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-given:
        rule:
          parameters:
          - name: body
            value: "{\n  \"data\": {\n    \"type\": \"sensitive_data_scanner_rule\",\n    \"attributes\": {\n      \"name\": \"{{ unique }}\",\n      \"pattern\": \"pattern\",\n      \"namespaces\": [\"admin.email\"],\n      \"text_replacement\": {\n        \"type\": \"none\"\n      },\n      \"tags\":[\n        \"sensitive_data:true\"\n      ],\n      \"is_enabled\":true\n    },\n    \"relationships\": {\n      \"group\": {\n        \"data\": {\n          \"id\": \"{{ group.data.id }}\",\n          \"type\": \"{{ group.data.type }}\"\n        }\n      }\n    }\n  },\n  \"meta\": {}\n}"
          step: the "scanning_group" has a "scanning_rule"
      x-menu-order: 7
      x-permission:
        operator: OR
        permissions:
        - data_scanner_write
      x-undo:
        operationId: DeleteScanningRule
        parameters:
        - name: rule_id
          source: data.id
        - name: body
          template: "{\n  \"meta\": {}\n}"
        type: unsafe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/sensitive-data-scanner/config/rules/{rule_id}:
    delete:
      description: Delete a given rule.
      operationId: DeleteScanningRule
      parameters:
      - $ref: '#/components/parameters/SensitiveDataScannerRuleID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SensitiveDataScannerRuleDeleteRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SensitiveDataScannerRuleDeleteResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication Error
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Delete Scanning Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 9
      x-permission:
        operator: OR
        permissions:
        - data_scanner_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      description: 'Update a scanning rule.

        The request body MUST NOT include a standard_pattern relationship, as that relationship

        is non-editable. Trying to edit the regex attribute of a rule with a standard_pattern

        relationship will also result in an error.'
      operationId: UpdateScanningRule
      parameters:
      - $ref: '#/components/parameters/SensitiveDataScannerRuleID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SensitiveDataScannerRuleUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SensitiveDataScannerRuleUpdateResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Bad Request
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse'
          description: Authentication Error
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      summary: Datadog Update Scanning Rule
      tags:
      - Rules
      x-codegen-request-body-name: body
      x-menu-order: 8
      x-permission:
        operator: OR
        permissions:
        - data_scanner_write
      x-undo:
        type: idempotent
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    SecurityMonitoringRuleEvaluationWindow:
      description: 'A time window is specified to match when at least one of the cases matches true. This is a sliding window

        and evaluates in real time. For third party detection method, this field is not used.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    UpdateRuleRequestData:
      description: Data for the request to update a scorecard rule.
      properties:
        attributes:
          $ref: '#/components/schemas/RuleAttributes'
        type:
          $ref: '#/components/schemas/RuleType'
      type: object
    SendTeamsMessageActionType:
      default: send_teams_message
      description: Indicates that the action is a send Microsoft Teams message action.
      enum:
      - send_teams_message
      example: send_teams_message
      type: string
      x-enum-varnames:
      - SEND_TEAMS_MESSAGE
    SecurityMonitoringRuleTypeRead:
      description: The rule type.
      enum:
      - log_detection
      - infrastructure_configuration
      - workload_security
      - cloud_configuration
      - application_security
      type: string
      x-enum-varnames:
      - LOG_DETECTION
      - INFRASTRUCTURE_CONFIGURATION
      - WORKLOAD_SECURITY
      - CLOUD_CONFIGURATION
      - APPLICATION_SECURITY
    SensitiveDataScannerStandardPattern:
      description: Data containing the standard pattern id.
      properties:
        id:
          description: ID of the standard pattern.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/SensitiveDataScannerStandardPatternType'
      type: object
    SecurityMonitoringRuleMaxSignalDuration:
      description: 'A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.

        This time is calculated from the first seen timestamp.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    RuleName:
      description: Name of the notification rule.
      example: Rule 1
      type: string
    SecurityMonitoringRuleCaseActionOptionsUserBehaviorName:
      description: Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
      type: string
    UsersType:
      default: users
      description: Users resource type.
      enum:
      - users
      example: users
      type: string
      x-enum-varnames:
      - USERS
    SecurityMonitoringRuleNewValueOptionsLearningThreshold:
      default: 0
      description: A number of occurrences after which signals will be generated for values that weren't learned.
      enum:
      - 0
      - 1
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_OCCURRENCES
      - ONE_OCCURRENCE
    SecurityMonitoringRuleNewValueOptionsForgetAfter:
      description: The duration in days after which a learned value is forgotten.
      enum:
      - 1
      - 2
      - 7
      - 14
      - 21
      - 28
      format: int32
      type: integer
      x-enum-varnames:
      - ONE_DAY
      - TWO_DAYS
      - ONE_WEEK
      - TWO_WEEKS
      - THREE_WEEKS
      - FOUR_WEEKS
    ApplicationSecurityWafCustomRuleAction:
      description: The definition of `ApplicationSecurityWafCustomRuleAction` object.
      properties:
        action:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleActionAction'
        parameters:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleActionParameters'
      type: object
    SensitiveDataScannerRuleDeleteResponse:
      description: Delete rule response.
      properties:
        meta:
          $ref: '#/components/schemas/SensitiveDataScannerMetaVersionOnly'
      type: object
    CloudWorkloadSecurityAgentRuleKill:
      description: Kill system call applied on the container matching the rule
      properties:
        signal:
          description: Supported signals for the kill system call
          type: string
          example: example_value
      type: object
    RoutingRule:
      description: Represents a routing rule, including its attributes, relationships, and unique identifier.
      properties:
        attributes:
          $ref: '#/components/schemas/RoutingRuleAttributes'
        id:
          description: Specifies the unique identifier of this routing rule.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/RoutingRuleRelationships'
        type:
          $ref: '#/components/schemas/RoutingRuleType'
      required:
      - type
      type: object
    JSONAPIErrorItem:
      description: API error response body
      properties:
        detail:
          description: A human-readable explanation specific to this occurrence of the error.
          example: Missing required attribute in body
          type: string
        meta:
          additionalProperties: {}
          description: Non-standard meta-information about the error
          type: object
        source:
          $ref: '#/components/schemas/JSONAPIErrorItemSource'
        status:
          description: Status code of the response.
          example: '400'
          type: string
        title:
          description: Short human-readable summary of the error.
          example: Bad Request
          type: string
      type: object
    ApplicationSecurityWafCustomRuleTagsCategory:
      description: The category of the WAF Rule, can be either `business_logic`, `attack_attempt` or `security_response`.
      enum:
      - attack_attempt
      - business_logic
      - security_response
      example: business_logic
      type: string
      x-enum-varnames:
      - ATTACK_ATTEMPT
      - BUSINESS_LOGIC
      - SECURITY_RESPONSE
    MonitorNotificationRuleRelationships:
      description: All relationships associated with monitor notification rule.
      properties:
        created_by:
          $ref: '#/components/schemas/MonitorNotificationRuleRelationshipsCreatedBy'
      type: object
    SensitiveDataScannerRuleCreate:
      description: Data related to the creation of a rule.
      properties:
        attributes:
          $ref: '#/components/schemas/SensitiveDataScannerRuleAttributes'
        relationships:
          $ref: '#/components/schemas/SensitiveDataScannerRuleRelationships'
        type:
          $ref: '#/components/schemas/SensitiveDataScannerRuleType'
      required:
      - type
      - attributes
      - relationships
      type: object
    RuleOutcomeRelationships:
      description: The JSON:API relationship to a scorecard rule.
      properties:
        rule:
          $ref: '#/components/schemas/RelationshipToOutcome'
      type: object
    OutcomesResponseIncluded:
      description: Array of rule details.
      items:
        $ref: '#/components/schemas/OutcomesResponseIncludedItem'
      type: array
    CloudConfigurationRuleType:
      description: The rule type.
      enum:
      - cloud_configuration
      type: string
      x-enum-varnames:
      - CLOUD_CONFIGURATION
    ApplicationSecurityWafCustomRuleResponse:
      description: Response object that includes a single WAF custom rule.
      properties:
        data:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleData'
      type: object
    RuleTypesItems:
      description: 'Security rule type which can be used in security rules.

        Signal-based notification rules can filter signals based on rule types application_security, log_detection,

        workload_security, signal_correlation, cloud_configuration and infrastructure_configuration.

        Vulnerability-based notification rules can filter vulnerabilities based on rule types application_code_vulnerability,

        application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration, and api_security.'
      enum:
      - application_security
      - log_detection
      - workload_security
      - signal_correlation
      - cloud_configuration
      - infrastructure_configuration
      - application_code_vulnerability
      - application_library_vulnerability
      - attack_path
      - container_image_vulnerability
      - identity_risk
      - misconfiguration
      - api_security
      type: string
      x-enum-varnames:
      - APPLICATION_SECURITY
      - LOG_DETECTION
      - WORKLOAD_SECURITY
      - SIGNAL_CORRELATION
      - CLOUD_CONFIGURATION
      - INFRASTRUCTURE_CONFIGURATION
      - APPLICATION_CODE_VULNERABILITY
      - APPLICATION_LIBRARY_VULNERABILITY
      - ATTACK_PATH
      - CONTAINER_IMAGE_VULNERABILITY
      - IDENTITY_RISK
      - MISCONFIGURATION
      - API_SECURITY
    ListRulesResponseLinks:
      description: Links attributes.
      properties:
        next:
          description: Link for the next set of rules.
          example: /api/v2/scorecard/rules?page%5Blimit%5D=2&page%5Boffset%5D=2&page%5Bsize%5D=2
          type: string
      type: object
    SensitiveDataScannerRuleDeleteRequest:
      description: Delete rule request.
      properties:
        meta:
          $ref: '#/components/schemas/SensitiveDataScannerMetaVersionOnly'
      required:
      - meta
      type: object
    SensitiveDataScannerRuleAttributes:
      description: Attributes of the Sensitive Data Scanner rule.
      properties:
        description:
          description: Description of the rule.
          type: string
          example: example_value
        excluded_namespaces:
          description: Attributes excluded from the scan. If namespaces is provided, it has to be a sub-path of the namespaces array.
          example:
          - admin.name
          items:
            type: string
          type: array
        included_keyword_configuration:
          $ref: '#/components/schemas/SensitiveDataScannerIncludedKeywordConfiguration'
        is_enabled:
          description: Whether or not the rule is enabled.
          type: boolean
          example: true
        name:
          description: Name of the rule.
          type: string
          example: Example Monitor
        namespaces:
          description: 'Attributes included in the scan. If namespaces is empty or missing, all attributes except excluded_namespaces are scanned.

            If both are missing the whole event is scanned.'
          example:
          - admin
          items:
            type: string
          type: array
        pattern:
          description: Not included if there is a relationship to a standard pattern.
          type: string
          example: example_value
        priority:
          description: Integer from 1 (high) to 5 (low) indicating rule issue severity.
          format: int64
          maximum: 5
          minimum: 1
          type: integer
          example: 42
        tags:
          description: List of tags.
          items:
            type: string
          type: array
        text_replacement:
          $ref: '#/components/schemas/SensitiveDataScannerTextReplacement'
      type: object
    ApplicationSecurityWafCustomRuleConditionParameters:
      description: The scope of the WAF custom rule.
      properties:
        data:
          description: Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter.
          example: blocked_users
          type: string
        inputs:
          description: List of inputs on which at least one should match with the given operator.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionInput'
          type: array
        list:
          description: 'List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and

            !exact_match operator.'
          items:
            type: string
          type: array
        options:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionOptions'
        regex:
          description: Regex to use with the condition. Only used with match_regex and !match_regex operator.
          example: path.*
          type: string
        value:
          description: Store the captured value in the specified tag name. Only used with the capture_data operator.
          example: custom_tag
          type: string
      required:
      - inputs
      type: object
    UserAttributes:
      description: Attributes of user object returned by the API.
      properties:
        created_at:
          description: Creation time of the user.
          format: date-time
          type: string
          example: example_value
        disabled:
          description: Whether the user is disabled.
          type: boolean
          example: true
        email:
          description: Email of the user.
          type: string
          example: user@example.com
        handle:
          description: Handle of the user.
          type: string
          example: example_value
        icon:
          description: URL of the user's icon.
          type: string
          example: example_value
        mfa_enabled:
          description: If user has MFA enabled.
          readOnly: true
          type: boolean
          example: true
        modified_at:
          description: Time that the user was last modified.
          format: date-time
          type: string
          example: example_value
        name:
          description: Name of the user.
          nullable: true
          type: string
          example: Example Monitor
        service_account:
          description: Whether the user is a service account.
          type: boolean
          example: true
        status:
          description: Status of the user.
          type: string
          example: OK
        title:
          description: Title of the user.
          nullable: true
          type: string
          example: Example Monitor
        verified:
          description: Whether the user is verified.
          type: boolean
          example: true
      type: object
    SensitiveDataScannerTextReplacementType:
      default: none
      description: 'Type of the replacement text. None means no replacement.

        hash means the data will be stubbed. replacement_string means that

        one can chose a text to replace the data. partial_replacement_from_beginning

        allows a user to partially replace the data from the beginning, and

        partial_replacement_from_end on the other hand, allows to replace data from

        the end.'
      enum:
      - none
      - hash
      - replacement_string
      - partial_replacement_from_beginning
      - partial_replacement_from_end
      type: string
      x-enum-varnames:
      - NONE
      - HASH
      - REPLACEMENT_STRING
      - PARTIAL_REPLACEMENT_FROM_BEGINNING
      - PARTIAL_REPLACEMENT_FROM_END
    SecurityMonitoringSuppressionID:
      description: The ID of the suppression rule.
      example: 3dd-0uc-h1s
      type: string
    SecurityMonitoringRuleQueryAggregation:
      description: The aggregation type.
      enum:
      - count
      - cardinality
      - sum
      - max
      - new_value
      - geo_data
      - event_count
      - none
      type: string
      x-enum-varnames:
      - COUNT
      - CARDINALITY
      - SUM
      - MAX
      - NEW_VALUE
      - GEO_DATA
      - EVENT_COUNT
      - NONE
    SecurityMonitoringRuleTypeTest:
      description: The rule type.
      enum:
      - log_detection
      type: string
      x-enum-varnames:
      - LOG_DETECTION
    SecurityMonitoringRuleResponse:
      description: Create a new rule.
      oneOf:
      - $ref: '#/components/schemas/SecurityMonitoringStandardRuleResponse'
      - $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponse'
    SecurityMonitoringRuleTestResponse:
      description: Result of the test of the rule queries.
      properties:
        results:
          description: 'Assert results are returned in the same order as the rule query payloads.

            For each payload, it returns True if the result matched the expected result,

            False otherwise.'
          items:
            type: boolean
          type: array
      type: object
    MonitorNotificationRuleId:
      description: The ID of the monitor notification rule.
      example: 00000000-0000-1234-0000-000000000000
      type: string
    NotificationRuleAttributes:
      description: Attributes of the notification rule.
      properties:
        created_at:
          $ref: '#/components/schemas/Date'
        created_by:
          $ref: '#/components/schemas/RuleUser'
        enabled:
          $ref: '#/components/schemas/Enabled'
        modified_at:
          $ref: '#/components/schemas/Date'
        modified_by:
          $ref: '#/components/schemas/RuleUser'
        name:
          $ref: '#/components/schemas/RuleName'
        selectors:
          $ref: '#/components/schemas/Selectors'
        targets:
          $ref: '#/components/schemas/Targets'
        time_aggregation:
          $ref: '#/components/schemas/TimeAggregation'
        version:
          $ref: '#/components/schemas/Version'
      required:
      - created_at
      - created_by
      - enabled
      - modified_at
      - modified_by
      - name
      - selectors
      - targets
      - version
      type: object
    RelationshipToRuleDataObject:
      description: Rule relationship data.
      properties:
        id:
          description: The unique ID for a scorecard.
          example: q8MQxk8TCqrHnWkp
          type: string
        type:
          $ref: '#/components/schemas/ScorecardType'
      type: object
    SensitiveDataScannerIncludedKeywordConfiguration:
      description: 'Object defining a set of keywords and a number of characters that help reduce noise.

        You can provide a list of keywords you would like to check within a defined proximity of the matching pattern.

        If any of the keywords are found within the proximity check, the match is kept.

        If none are found, the match is discarded.'
      properties:
        character_count:
          description: 'The number of characters behind a match detected by Sensitive Data Scanner to look for the keywords defined.

            `character_count` should be greater than the maximum length of a keyword defined for a rule.'
          example: 30
          format: int64
          maximum: 50
          minimum: 1
          type: integer
        keywords:
          description: 'Keyword list that will be checked during scanning in order to validate a match.

            The number of keywords in the list must be less than or equal to 30.'
          example:
          - credit card
          - cc
          items:
            type: string
          type: array
        use_recommended_keywords:
          description: 'Should the rule use the underlying standard pattern keyword configuration. If set to `true`, the rule must be tied

            to a standard pattern. If set to `false`, the specified keywords and `character_count` are applied.'
          type: boolean
          example: true
      required:
      - keywords
      - character_count
      type: object
    ApplicationSecurityWafCustomRuleUpdateAttributes:
      description: Update a WAF custom rule.
      properties:
        action:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAction'
        blocking:
          description: Indicates whether the WAF custom rule will block the request.
          example: false
          type: boolean
        conditions:
          description: 'Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF

            rule to trigger.'
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCondition'
          type: array
        enabled:
          description: Indicates whether the WAF custom rule is enabled.
          example: false
          type: boolean
        name:
          description: The Name of the WAF custom rule.
          example: Block request from bad useragent
          type: string
        path_glob:
          description: The path glob for the WAF custom rule.
          example: /api/search/*
          type: string
        scope:
          description: The scope of the WAF custom rule.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleScope'
          type: array
        tags:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTags'
      required:
      - enabled
      - blocking
      - name
      - tags
      - conditions
      type: object
    RelationshipToOutcome:
      description: The JSON:API relationship to a scorecard outcome.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToOutcomeData'
      type: object
    SecurityMonitoringStandardRuleQuery:
      description: Query for matching rule.
      properties:
        aggregation:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
        dataSource:
          $ref: '#/components/schemas/SecurityMonitoringStandardDataSource'
        distinctFields:
          description: Field for which the cardinality is measured. Sent as an array.
          items:
            description: Field.
            type: string
          type: array
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        hasOptionalGroupByFields:
          description: When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values.
          example: false
          readOnly: true
          type: boolean
        metric:
          deprecated: true
          description: '(Deprecated) The target field to aggregate over when using the sum or max

            aggregations. `metrics` field should be used instead.'
          type: string
          example: example_value
        metrics:
          description: Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
          items:
            description: Field.
            type: string
          type: array
        name:
          description: Name of the query.
          type: string
          example: Example Monitor
        query:
          description: Query to run on logs.
          example: a > 3
          type: string
      type: object
    SecurityMonitoringFilterAction:
      description: The type of filtering action.
      enum:
      - require
      - suppress
      type: string
      x-enum-varnames:
      - REQUIRE
      - SUPPRESS
    SecurityMonitoringSignalRuleResponse:
      description: Rule.
      properties:
        cases:
          description: Cases for generating signals.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCase'
          type: array
        createdAt:
          description: When the rule was created, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        creationAuthorId:
          description: User ID of the user who created the rule.
          format: int64
          type: integer
          example: 42
        deprecationDate:
          description: When the rule will be deprecated, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          type: boolean
          example: true
        id:
          description: The ID of the rule.
          type: string
          example: abc-123-def
        isDefault:
          description: Whether the rule is included by default.
          type: boolean
          example: true
        isDeleted:
          description: Whether the rule has been deleted.
          type: boolean
          example: true
        isEnabled:
          description: Whether the rule is enabled.
          type: boolean
          example: true
        message:
          description: Message for generated signals.
          type: string
          example: CPU usage is high on {{host.name}}
        name:
          description: The name of the rule.
          type: string
          example: Example Monitor
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting logs which are part of the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponseQuery'
          type: array
        tags:
          description: Tags for generated signals.
          items:
            description: Tag.
            type: string
          type: array
        type:
          $ref: '#/components/schemas/SecurityMonitoringSignalRuleType'
        updateAuthorId:
          description: User ID of the user who updated the rule.
          format: int64
          type: integer
          example: 42
        version:
          description: The version of the rule.
          format: int64
          type: integer
          example: 42
      type: object
    JSONAPIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          items:
            $ref: '#/components/schemas/JSONAPIErrorItem'
          type: array
      required:
      - errors
      type: object
    NotificationRule:
      description: 'Notification rules allow full control over notifications generated by the various Datadog security products.

        They allow users to define the conditions under which a notification should be generated (based on rule severities,

        rule types, rule tags, and so on), and the targets to notify.

        A notification rule is composed of a rule ID, a rule type, and the rule attributes. All fields are required.

        '
      properties:
        attributes:
          $ref: '#/components/schemas/NotificationRuleAttributes'
        id:
          $ref: '#/components/schemas/ID'
        type:
          $ref: '#/components/schemas/NotificationRulesType'
      required:
      - attributes
      - id
      - type
      type: object
    SecurityMonitoringRuleThirdPartyOptions:
      description: Options on third party detection method.
      properties:
        defaultNotifications:
          description: Notification targets for the logs that do not correspond to any of the cases.
          items:
            description: Notification.
            type: string
          type: array
        defaultStatus:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
        rootQueries:
          description: Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRootQuery'
          type: array
        signalTitleTemplate:
          description: A template for the signal title; if omitted, the title is generated based on the case name.
          type: string
          example: Example Monitor
      type: object
    CloudWorkloadSecurityAgentRuleUpdateData:
      description: Object for a single Agent rule
      properties:
        attributes:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleUpdateAttributes'
        id:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleID'
        type:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleType'
      required:
      - attributes
      - type
      type: object
    MonitorNotificationRuleResponseAttributes:
      additionalProperties: {}
      description: Attributes of the monitor notification rule.
      properties:
        created:
          description: Creation time of the monitor notification rule.
          example: '2020-01-02T03:04:00.000Z'
          format: date-time
          type: string
        filter:
          $ref: '#/components/schemas/MonitorNotificationRuleFilter'
        modified:
          description: Time the monitor notification rule was last modified.
          example: '2020-01-02T03:04:00.000Z'
          format: date-time
          type: string
        name:
          $ref: '#/components/schemas/MonitorNotificationRuleName'
        recipients:
          $ref: '#/components/schemas/MonitorNotificationRuleRecipients'
      type: object
    SecurityMonitoringSuppressionResponse:
      description: Response object containing a single suppression rule.
      properties:
        data:
          $ref: '#/components/schemas/SecurityMonitoringSuppression'
      type: object
    MonitorNotificationRuleUpdateRequestData:
      description: Object to update a monitor notification rule.
      properties:
        attributes:
          $ref: '#/components/schemas/MonitorNotificationRuleAttributes'
        id:
          $ref: '#/components/schemas/MonitorNotificationRuleId'
        type:
          $ref: '#/components/schemas/MonitorNotificationRuleResourceType'
      required:
      - id
      - attributes
      type: object
    PatchNotificationRuleParameters:
      description: Body of the notification rule patch request.
      properties:
        data:
          $ref: '#/components/schemas/PatchNotificationRuleParametersData'
      type: object
    ApplicationSecurityWafCustomRuleCondition:
      description: One condition of the WAF Custom Rule.
      properties:
        operator:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionOperator'
        parameters:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionParameters'
      required:
      - operator
      - parameters
      type: object
    SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv:
      description: 'If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.

        The severity is decreased by one level: `CRITICAL` in production becomes `HIGH` in non-production, `HIGH` becomes `MEDIUM` and so on. `INFO` remains `INFO`.

        The decrement is applied when the environment tag of the signal starts with `staging`, `test` or `dev`.'
      example: false
      type: boolean
    SecurityMonitoringRuleQueryPayloadData:
      additionalProperties: {}
      description: Payload used to test the rule query.
      properties:
        ddsource:
          description: Source of the payload.
          example: nginx
          type: string
        ddtags:
          description: Tags associated with your data.
          example: env:staging,version:5.1
          type: string
        hostname:
          description: The name of the originating host of the log.
          example: i-012345678
          type: string
        message:
          description: The message of the payload.
          example: 2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World
          type: string
        service:
          description: The name of the application or service generating the data.
          example: payment
          type: string
      type: object
    ApplicationSecurityWafCustomRuleConditionOperator:
      description: Operator to use for the WAF Condition.
      enum:
      - match_regex
      - '!match_regex'
      - phrase_match
      - '!phrase_match'
      - is_xss
      - is_sqli
      - exact_match
      - '!exact_match'
      - ip_match
      - '!ip_match'
      - capture_data
      example: match_regex
      type: string
      x-enum-varnames:
      - MATCH_REGEX
      - NOT_MATCH_REGEX
      - PHRASE_MATCH
      - NOT_PHRASE_MATCH
      - IS_XSS
      - IS_SQLI
      - EXACT_MATCH
      - NOT_EXACT_MATCH
      - IP_MATCH
      - NOT_IP_MATCH
      - CAPTURE_DATA
    User:
      description: User object returned by the API.
      properties:
        attributes:
          $ref: '#/components/schemas/UserAttributes'
        id:
          description: ID of the user.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/UserResponseRelationships'
        type:
          $ref: '#/components/schemas/UsersType'
      type: object
      x-merge-override:
        required: false
    CloudWorkloadSecurityAgentRuleUpdateAttributes:
      description: Update an existing Cloud Workload Security Agent rule
      properties:
        actions:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions'
        blocking:
          description: The blocking policies that the rule belongs to
          items:
            type: string
          type: array
        description:
          description: The description of the Agent rule
          example: My Agent rule
          type: string
        disabled:
          description: The disabled policies that the rule belongs to
          items:
            type: string
          type: array
        enabled:
          description: Whether the Agent rule is enabled
          example: true
          type: boolean
        expression:
          description: The SECL expression of the Agent rule
          example: exec.file.name == "sh"
          type: string
        monitoring:
          description: The monitoring policies that the rule belongs to
          items:
            type: string
          type: array
        policy_id:
          description: The ID of the policy where the Agent rule is saved
          example: a8c8e364-6556-434d-b798-a4c23de29c0b
          type: string
        product_tags:
          description: The list of product tags associated with the rule
          items:
            type: string
          type: array
      type: object
    ApplicationSecurityWafCustomRuleListResponse:
      description: Response object that includes a list of WAF custom rules.
      properties:
        data:
          description: The WAF custom rule data.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleData'
          type: array
      type: object
    ApplicationSecurityWafCustomRuleConditionInputAddress:
      description: Input from the request on which the condition should apply.
      enum:
      - server.db.statement
      - server.io.fs.file
      - server.io.net.url
      - server.sys.shell.cmd
      - server.request.method
      - server.request.uri.raw
      - server.request.path_params
      - server.request.query
      - server.request.headers.no_cookies
      - server.request.cookies
      - server.request.trailers
      - server.request.body
      - server.response.status
      - server.response.headers.no_cookies
      - server.response.trailers
      - grpc.server.request.metadata
      - grpc.server.request.message
      - grpc.server.method
      - graphql.server.all_resolvers
      - usr.id
      - http.client_ip
      example: server.db.statement
      type: string
      x-enum-varnames:
      - SERVER_DB_STATEMENT
      - SERVER_IO_FS_FILE
      - SERVER_IO_NET_URL
      - SERVER_SYS_SHELL_CMD
      - SERVER_REQUEST_METHOD
      - SERVER_REQUEST_URI_RAW
      - SERVER_REQUEST_PATH_PARAMS
      - SERVER_REQUEST_QUERY
      - SERVER_REQUEST_HEADERS_NO_COOKIES
      - SERVER_REQUEST_COOKIES
      - SERVER_REQUEST_TRAILERS
      - SERVER_REQUEST_BODY
      - SERVER_RESPONSE_STATUS
      - SERVER_RESPONSE_HEADERS_NO_COOKIES
      - SERVER_RESPONSE_TRAILERS
      - GRPC_SERVER_REQUEST_METADATA
      - GRPC_SERVER_REQUEST_MESSAGE
      - GRPC_SERVER_METHOD
      - GRAPHQL_SERVER_ALL_RESOLVERS
      - USR_ID
      - HTTP_CLIENT_IP
    RuleSeverity:
      description: Severity of a security rule.
      enum:
      - critical
      - high
      - medium
      - low
      - unknown
      - info
      example: critical
      type: string
      x-enum-varnames:
      - CRITICAL
      - HIGH
      - MEDIUM
      - LOW
      - UNKNOWN
      - INFO
    TeamRoutingRulesData:
      description: Represents the top-level data object for team routing rules, containing the ID, relationships, and resource type.
      properties:
        id:
          description: Specifies the unique identifier of this team routing rules record.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/TeamRoutingRulesDataRelationships'
        type:
          $ref: '#/components/schemas/TeamRoutingRulesDataType'
      required:
      - type
      type: object
    TeamRoutingRulesDataType:
      default: team_routing_rules
      description: Team routing rules resource type.
      enum:
      - team_routing_rules
      example: team_routing_rules
      type: string
      x-enum-varnames:
      - TEAM_ROUTING_RULES
    CreateRuleResponse:
      description: Created rule in response.
      properties:
        data:
          $ref: '#/components/schemas/CreateRuleResponseData'
      type: object
    SensitiveDataScannerRuleUpdateRequest:
      description: Update rule request.
      properties:
        data:
          $ref: '#/components/schemas/SensitiveDataScannerRuleUpdate'
        meta:
          $ref: '#/components/schemas/SensitiveDataScannerMetaVersionOnly'
      required:
      - data
      - meta
      type: object
    SensitiveDataScannerTextReplacement:
      description: Object describing how the scanned event will be replaced.
      properties:
        number_of_chars:
          description: 'Required if type == ''partial_replacement_from_beginning''

            or ''partial_replacement_from_end''. It must be > 0.'
          format: int64
          minimum: 0
          type: integer
          example: 42
        replacement_string:
          description: Required if type == 'replacement_string'.
          type: string
          example: example_value
        type:
          $ref: '#/components/schemas/SensitiveDataScannerTextReplacementType'
      type: object
    Version:
      description: Version of the notification rule. It is updated when the rule is modified.
      example: 1
      format: int64
      type: integer
    CreateNotificationRuleParametersData:
      description: 'Data of the notification rule create request: the rule type, and the rule attributes. All fields are required.'
      properties:
        attributes:
          $ref: '#/components/schemas/CreateNotificationRuleParametersDataAttributes'
        type:
          $ref: '#/components/schemas/NotificationRulesType'
      required:
      - attributes
      - type
      type: object
    ApplicationSecurityWafCustomRuleUpdateData:
      description: Object for a single WAF Custom Rule.
      properties:
        attributes:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleUpdateAttributes'
        type:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleType'
      required:
      - attributes
      - type
      type: object
    RelationshipToOrganization:
      description: Relationship to an organization.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToOrganizationData'
      required:
      - data
      type: object
    SecurityMonitoringRuleCaseActionType:
      description: The action type.
      enum:
      - block_ip
      - block_user
      - user_behavior
      type: string
      x-enum-varnames:
      - BLOCK_IP
      - BLOCK_USER
      - USER_BEHAVIOR
    RoutingRuleAttributes:
      description: Defines the configurable attributes of a routing rule, such as actions, query, time restriction, and urgency.
      properties:
        actions:
          description: Specifies the list of actions to perform when the routing rule matches.
          items:
            $ref: '#/components/schemas/RoutingRuleAction'
          type: array
        query:
          description: Defines the query or condition that triggers this routing rule.
          type: string
          example: avg:system.cpu.user{*}
        time_restriction:
          $ref: '#/components/schemas/TimeRestrictions'
          nullable: true
        urgency:
          $ref: '#/components/schemas/Urgency'
      type: object
    UpdateRuleRequest:
      description: Request to update a scorecard rule.
      properties:
        data:
          $ref: '#/components/schemas/UpdateRuleRequestData'
      type: object
    SecurityMonitoringRuleHardcodedEvaluatorType:
      description: Hardcoded evaluator type.
      enum:
      - log4shell
      type: string
      x-enum-varnames:
      - LOG4SHELL
    CreateRuleResponseData:
      description: Create rule response data.
      properties:
        attributes:
          $ref: '#/components/schemas/RuleAttributes'
        id:
          $ref: '#/components/schemas/RuleId'
        relationships:
          $ref: '#/components/schemas/RelationshipToRule'
        type:
          $ref: '#/components/schemas/RuleType'
      type: object
    SecurityMonitoringSignalRuleCreatePayload:
      description: Create a new signal correlation rule.
      properties:
        cases:
          description: Cases for generating signals.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseCreate'
          type: array
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          example: true
          type: boolean
        isEnabled:
          description: Whether the rule is enabled.
          example: true
          type: boolean
        message:
          description: Message for generated signals.
          example: ''
          type: string
        name:
          description: The name of the rule.
          example: My security monitoring rule.
          type: string
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting signals which are part of the rule.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringSignalRuleQuery'
          type: array
        tags:
          description: Tags for generated signals.
          example:
          - env:prod
          - team:security
          items:
            description: Tag.
            type: string
          type: array
        type:
          $ref: '#/components/schemas/SecurityMonitoringSignalRuleType'
      required:
      - name
      - isEnabled
      - queries
      - options
      - cases
      - message
      type: object
    SensitiveDataScannerStandardPatternData:
      description: A standard pattern.
      properties:
        data:
          $ref: '#/components/schemas/SensitiveDataScannerStandardPattern'
      type: object
    SecurityMonitoringStandardDataSource:
      default: logs
      description: Source of events, either logs, audit trail, or Datadog events.
      enum:
      - logs
      - audit
      - app_sec_spans
      - spans
      - security_runtime
      - network
      - events
      example: logs
      type: string
      x-enum-varnames:
      - LOGS
      - AUDIT
      - APP_SEC_SPANS
      - SPANS
      - SECURITY_RUNTIME
      - NETWORK
      - EVENTS
    RelationshipToUserData:
      description: Relationship to user object.
      properties:
        id:
          description: A unique identifier that represents the user.
          example: 00000000-0000-0000-2345-000000000000
          type: string
        type:
          $ref: '#/components/schemas/UsersType'
      required:
      - id
      - type
      type: object
      x-merge-override:
        required: false
    TeamRoutingRules:
      description: Represents a complete set of team routing rules, including data and optionally included related resources.
      example:
        data:
          id: 27590dae-47be-4a7d-9abf-8f4e45124020
          relationships:
            rules:
              data:
              - id: 03aff2d6-6cbf-496c-997f-a857bbe9a94a
                type: team_routing_rules
              - id: 03aff2d6-6cbf-496c-997f-a857bbe9a94a
                type: team_routing_rules
          type: team_routing_rules
        included:
        - attributes:
            actions: null
            query: tags.service:test
            time_restriction:
              restrictions:
              - end_day: monday
                end_time: '17:00:00'
                start_day: monday
                start_time: 09:00:00
              - end_day: tuesday
                end_time: '17:00:00'
                start_day: tuesday
                start_time: 09:00:00
              time_zone: ''
            urgency: high
          id: 03aff2d6-6cbf-496c-997f-a857bbe9a94a
          relationships:
            policy:
              data: null
          type: team_routing_rules
      properties:
        data:
          $ref: '#/components/schemas/TeamRoutingRulesData'
        included:
          description: Provides related routing rules or other included resources.
          items:
            $ref: '#/components/schemas/TeamRoutingRulesIncluded'
          type: array
      type: object
    CloudWorkloadSecurityAgentRuleData:
      description: Object for a single Agent rule
      properties:
        attributes:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleAttributes'
        id:
          description: The ID of the Agent rule
          example: 3dd-0uc-h1s
          type: string
        type:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleType'
      type: object
    SecurityMonitoringRuleTypeCreate:
      description: The rule type.
      enum:
      - application_security
      - log_detection
      - workload_security
      type: string
      x-enum-varnames:
      - APPLICATION_SECURITY
      - LOG_DETECTION
      - WORKLOAD_SECURITY
    CloudWorkloadSecurityAgentRuleAction:
      description: The action the rule can perform if triggered
      properties:
        filter:
          description: SECL expression used to target the container to apply the action on
          type: string
          example: example_value
        kill:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleKill'
        metadata:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionMetadata'
        set:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionSet'
      type: object
    TimeRestriction:
      description: Defines a single time restriction rule with start and end times and the applicable weekdays.
      properties:
        end_day:
          $ref: '#/components/schemas/Weekday'
        end_time:
          description: Specifies the ending time for this restriction.
          type: string
          example: '2026-04-17T12:00:00Z'
        start_day:
          $ref: '#/components/schemas/Weekday'
        start_time:
          description: Specifies the starting time for this restriction.
          type: string
          example: '2026-04-17T12:00:00Z'
      type: object
    SecurityMonitoringRuleCaseActionOptions:
      additionalProperties: {}
      description: Options for the rule action
      properties:
        duration:
          description: Duration of the action in seconds. 0 indicates no expiration.
          example: 0
          format: int64
          minimum: 0
          type: integer
        userBehaviorName:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsUserBehaviorName'
      type: object
    SensitiveDataScannerMetaVersionOnly:
      description: Meta payload containing information about the API.
      properties:
        version:
          description: Version of the API (optional).
          example: 0
          format: int64
          minimum: 0
          type: integer
      type: object
    TeamRoutingRulesRequestDataAttributes:
      description: Represents the attributes of a request to update or create team routing rules.
      properties:
        rules:
          description: A list of routing rule items that define how incoming pages should be handled.
          items:
            $ref: '#/components/schemas/TeamRoutingRulesRequestRule'
          type: array
      type: object
    ApplicationSecurityWafCustomRuleActionAction:
      default: block_request
      description: Override the default action to take when the WAF custom rule would block.
      enum:
      - redirect_request
      - block_request
      example: block_request
      type: string
      x-enum-varnames:
      - REDIRECT_REQUEST
      - BLOCK_REQUEST
    SecurityMonitoringRuleConvertPayload:
      description: Convert a rule from JSON to Terraform.
      oneOf:
      - $ref: '#/components/schemas/SecurityMonitoringStandardRulePayload'
      - $ref: '#/components/schemas/SecurityMonitoringSignalRulePayload'
    SecurityMonitoringRuleCreatePayload:
      description: Create a new rule.
      oneOf:
      - $ref: '#/components/schemas/SecurityMonitoringStandardRuleCreatePayload'
      - $ref: '#/components/schemas/SecurityMonitoringSignalRuleCreatePayload'
      - $ref: '#/components/schemas/CloudConfigurationRuleCreatePayload'
    CloudWorkloadSecurityAgentRuleActions:
      description: The array of actions the rule can perform if triggered
      items:
        $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleAction'
      nullable: true
      type: array
    OutcomesResponseData:
      description: List of rule outcomes.
      items:
        $ref: '#/components/schemas/OutcomesResponseDataItem'
      type: array
    OutcomesBatchResponseAttributes:
      description: The JSON:API attributes for an outcome.
      properties:
        created_at:
          description: Creation time of the rule outcome.
          format: date-time
          type: string
          example: example_value
        modified_at:
          description: Time of last rule outcome modification.
          format: date-time
          type: string
          example: example_value
        remarks:
          description: Any remarks regarding the scorecard rule's evaluation, and supports HTML hyperlinks.
          example: 'See: <a href="https://app.datadoghq.com/services">Services</a>'
          type: string
        service_name:
          description: The unique name for a service in the catalog.
          example: my-service
          type: string
        state:
          $ref: '#/components/schemas/State'
      type: object
    SecurityMonitoringUser:
      description: A user.
      properties:
        handle:
          description: The handle of the user.
          example: john.doe@datadoghq.com
          type: string
        name:
          description: The name of the user.
          example: John Doe
          nullable: true
          type: string
      type: object
    RuleType:
      default: rule
      description: The JSON:API type for scorecard rules.
      enum:
      - rule
      example: rule
      type: string
      x-enum-varnames:
      - RULE
    SendSlackMessageActionType:
      default: send_slack_message
      description: Indicates that the action is a send Slack message action.
      enum:
      - send_slack_message
      example: send_slack_message
      type: string
      x-enum-varnames:
      - SEND_SLACK_MESSAGE
    MonitorNotificationRuleRelationshipsCreatedBy:
      description: The user who created the monitor notification rule.
      properties:
        data:
          $ref: '#/components/schemas/MonitorNotificationRuleRelationshipsCreatedByData'
      type: object
    RoutingRuleRelationships:
      description: Specifies relationships for a routing rule, linking to associated policy resources.
      properties:
        policy:
          $ref: '#/components/schemas/RoutingRuleRelationshipsPolicy'
      type: object
    CloudConfigurationRuleCreatePayload:
      description: Create a new cloud configuration rule.
      properties:
        cases:
          description: 'Description of generated findings and signals (severity and channels to be notified in case of a signal). Must contain exactly one item.

            '
          items:
            $ref: '#/components/schemas/CloudConfigurationRuleCaseCreate'
          type: array
        complianceSignalOptions:
          $ref: '#/components/schemas/CloudConfigurationRuleComplianceSignalOptions'
        filters:
          description: Additional queries to filter matched events before they are processed.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        isEnabled:
          description: Whether the rule is enabled.
          example: true
          type: boolean
        message:
          description: Message in markdown format for generated findings and signals.
          example: '#Description

            Explanation of the rule.


            #Remediation

            How to fix the security issue.

            '
          type: string
        name:
          description: The name of the rule.
          example: My security monitoring rule.
          type: string
        options:
          $ref: '#/components/schemas/CloudConfigurationRuleOptions'
        tags:
          description: Tags for generated findings and signals.
          example:
          - env:prod
          - team:security
          items:
            description: Tag.
            type: string
          type: array
        type:
          $ref: '#/components/schemas/CloudConfigurationRuleType'
      required:
      - name
      - isEnabled
      - options
      - complianceSignalOptions
      - cases
      - message
      type: object
    Enabled:
      description: Field used to enable or disable the rule.
      example: true
      type: boolean
    CloudWorkloadSecurityAgentRuleUpdaterAttributes:
      description: The attributes of the user who last updated the Agent rule
      properties:
        handle:
          description: The handle of the user
          example: datadog.user@example.com
          type: string
        name:
          description: The name of the user
          example: Datadog User
          nullable: true
          type: string
      type: object
    TimeRestrictions:
      description: Holds time zone information and a list of time restrictions for a routing rule.
      properties:
        restrictions:
          description: Defines the list of time-based restrictions.
          items:
            $ref: '#/components/schemas/TimeRestriction'
          type: array
        time_zone:
          description: Specifies the time zone applicable to the restrictions.
          example: ''
          type: string
      required:
      - time_zone
      - restrictions
      type: object
    ApplicationSecurityWafCustomRuleData:
      description: Object for a single WAF custom rule.
      properties:
        attributes:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAttributes'
        id:
          description: The ID of the custom rule.
          example: 2857c47d-1e3a-4300-8b2f-dc24089c084b
          readOnly: true
          type: string
        type:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleType'
      type: object
    ApplicationSecurityWafCustomRuleCreateRequest:
      description: Request object that includes the custom rule to create.
      properties:
        data:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCreateData'
      required:
      - data
      type: object
    TriggerSource:
      description: 'The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals",

        while notification rules based on security vulnerabilities need to use the trigger source "security_findings".'
      enum:
      - security_findings
      - security_signals
      example: security_findings
      type: string
      x-enum-varnames:
      - SECURITY_FINDINGS
      - SECURITY_SIGNALS
    CloudWorkloadSecurityAgentRuleCreateRequest:
      description: Request object that includes the Agent rule to create
      properties:
        data:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleCreateData'
      required:
      - data
      type: object
    SensitiveDataScannerRuleCreateRequest:
      description: Create rule request.
      properties:
        data:
          $ref: '#/components/schemas/SensitiveDataScannerRuleCreate'
        meta:
          $ref: '#/components/schemas/SensitiveDataScannerMetaVersionOnly'
      required:
      - data
      - meta
      type: object
    JSONAPIErrorItemSource:
      description: References to the source of the error.
      properties:
        header:
          description: A string indicating the name of a single request header which caused the error.
          example: Authorization
          type: string
        parameter:
          description: A string indicating which URI query parameter caused the error.
          example: limit
          type: string
        pointer:
          description: A JSON pointer to the value in the request document that caused the error.
          example: /data/attributes/title
          type: string
      type: object
    Targets:
      description: 'List of recipients to notify when a notification rule is triggered. Many different target types are supported,

        such as email addresses, Slack channels, and PagerDuty services.

        The appropriate integrations need to be properly configured to send notifications to the specified targets.'
      example:
      - '@john.doe@email.com'
      items:
        description: Recipients to notify.
        type: string
      type: array
    NotificationRulesType:
      description: The rule type associated to notification rules.
      enum:
      - notification_rules
      example: notification_rules
      type: string
      x-enum-varnames:
      - NOTIFICATION_RULES
    MonitorNotificationRuleResponse:
      description: A monitor notification rule.
      properties:
        data:
          $ref: '#/components/schemas/MonitorNotificationRuleData'
        included:
          description: Array of objects related to the monitor notification rule that the user requested.
          items:
            $ref: '#/components/schemas/MonitorNotificationRuleResponseIncludedItem'
          type: array
      type: object
    SensitiveDataScannerRuleUpdateResponse:
      description: Update rule response.
      properties:
        meta:
          $ref: '#/components/schemas/SensitiveDataScannerMetaVersionOnly'
      type: object
    SecurityMonitoringRuleOptions:
      description: Options.
      properties:
        complianceRuleOptions:
          $ref: '#/components/schemas/CloudConfigurationComplianceRuleOptions'
        decreaseCriticalityBasedOnEnv:
          $ref: '#/components/schemas/SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv'
        detectionMethod:
          $ref: '#/components/schemas/SecurityMonitoringRuleDetectionMethod'
        evaluationWindow:
          $ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow'
        hardcodedEvaluatorType:
          $ref: '#/components/schemas/SecurityMonitoringRuleHardcodedEvaluatorType'
        impossibleTravelOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptions'
        keepAlive:
          $ref: '#/components/schemas/SecurityMonitoringRuleKeepAlive'
        maxSignalDuration:
          $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
        newValueOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
        thirdPartyRuleOptions:
          $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
      type: object
    SecurityMonitoringSignalRuleQuery:
      description: Query for matching rule on signals.
      properties:
        aggregation:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
        correlatedByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        correlatedQueryIndex:
          description: Index of the rule query used to retrieve the correlated field.
          format: int32
          maximum: 9
          type: integer
          example: 42
        metrics:
          description: Group of target fields to aggregate over.
          items:
            description: Field.
            type: string
          type: array
        name:
          description: Name of the query.
          type: string
          example: Example Monitor
        ruleId:
          description: Rule ID to match on signals.
          example: org-ru1-e1d
          type: string
      required:
      - ruleId
      type: object
    ApplicationSecurityWafCustomRuleCreateAttributes:
      description: Create a new WAF custom rule.
      properties:
        action:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAction'
        blocking:
          description: Indicates whether the WAF custom rule will block the request.
          example: false
          type: boolean
        conditions:
          description: 'Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF

            rule to trigger'
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCondition'
          type: array
        enabled:
          description: Indicates whether the WAF custom rule is enabled.
          example: false
          type: boolean
        name:
          description: The Name of the WAF custom rule.
          example: Block request from a bad useragent
          type: string
        path_glob:
          description: The path glob for the WAF custom rule.
          example: /api/search/*
          type: string
        scope:
          description: The scope of the WAF custom rule.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleScope'
          type: array
        tags:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTags'
      required:
      - enabled
      - blocking
      - name
      - tags
      - conditions
      type: object
    SecurityMonitoringRuleTestPayload:
      description: Test a rule.
      oneOf:
      - $ref: '#/components/schemas/SecurityMonitoringStandardRuleTestPayload'
    SecurityMonitoringRuleQueryPayload:
      description: Payload to test a rule query with the expected result.
      properties:
        expectedResult:
          description: Expected result of the test.
          example: true
          type: boolean
        index:
          description: Index of the query under test.
          example: 0
          format: int64
          minimum: 0
          type: integer
        payload:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryPayloadData'
      type: object
    SecurityMonitoringThirdPartyRuleCaseCreate:
      description: Case when a signal is generated by a third party rule.
      properties:
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets for each case.
          items:
            description: Notification.
            type: string
          type: array
        query:
          description: A query to map a third party event to this case.
          type: string
          example: avg:system.cpu.user{*}
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      required:
      - status
      type: object
    RelationshipToRuleData:
      description: Relationship data for a rule.
      properties:
        data:
          $ref: '#/components/schemas/RelationshipToRuleDataObject'
      type: object
    SecurityMonitoringReferenceTable:
      description: Reference tables used in the queries.
      properties:
        checkPresence:
          description: Whether to include or exclude the matched values.
          type: boolean
          example: true
        columnName:
          description: The name of the column in the reference table.
          type: string
          example: Example Monitor
        logFieldPath:
          description: The field in the log to match against the reference table.
          type: string
          example: example_value
        ruleQueryName:
          description: The name of the query to apply the reference table to.
          type: string
          example: Example Monitor
        tableName:
          description: The name of the reference table.
          type: string
          example: Example Monitor
      type: object
    CreateRuleRequestData:
      description: Scorecard create rule request data.
      properties:
        attributes:
          $ref: '#/components/schemas/RuleAttributes'
        type:
          $ref: '#/components/schemas/RuleType'
      type: object
    TeamRoutingRulesDataRelationshipsRulesDataItemsType:
      default: team_routing_rules
      description: Indicates that the resource is of type 'team_routing_rules'.
      enum:
      - team_routing_rules
      example: team_routing_rules
      type: string
      x-enum-varnames:
      - TEAM_ROUTING_RULES
    SecurityMonitoringRuleKeepAlive:
      description: 'Once a signal is generated, the signal will remain "open" if a case is matched at least once within

        this keep alive window. For third party detection method, this field is not used.'
      enum:
      - 0
      - 60
      - 300
      - 600
      - 900
      - 1800
      - 3600
      - 7200
      - 10800
      - 21600
      - 43200
      - 86400
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_MINUTES
      - ONE_MINUTE
      - FIVE_MINUTES
      - TEN_MINUTES
      - FIFTEEN_MINUTES
      - THIRTY_MINUTES
      - ONE_HOUR
      - TWO_HOURS
      - THREE_HOURS
      - SIX_HOURS
      - TWELVE_HOURS
      - ONE_DAY
    MonitorNotificationRuleResourceType:
      default: monitor-notification-rule
      description: Monitor notification rule resource type.
      enum:
      - monitor-notification-rule
      example: monitor-notification-rule
      type: string
      x-enum-varnames:
      - MONITOR_NOTIFICATION_RULE
    SecurityMonitoringSuppressionCreateRequest:
      description: Request object that includes the suppression rule that you would like to create.
      properties:
        data:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionCreateData'
      required:
      - data
      type: object
    OutcomesResponseIncludedRuleAttributes:
      description: Details of a rule.
      properties:
        name:
          description: Name of the rule.
          example: Team Defined
          type: string
        scorecard_name:
          description: The scorecard name to which this rule must belong.
          example: Observability Best Practices
          type: string
      type: object
    SecurityMonitoringSuppressionCreateAttributes:
      description: Object containing the attributes of the suppression rule to be created.
      properties:
        data_exclusion_query:
          description: An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
          example: source:cloudtrail account_id:12345
          type: string
        description:
          description: A description for the suppression rule.
          example: This rule suppresses low-severity signals in staging environments.
          type: string
        enabled:
          description: Whether the suppression rule is enabled.
          example: true
          type: boolean
        expiration_date:
          description: A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
          example: 1703187336000
          format: int64
          type: integer
        name:
          description: The name of the suppression rule.
          example: Custom suppression
          type: string
        rule_query:
          description: The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
          example: type:log_detection source:cloudtrail
          type: string
        start_date:
          description: A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals.
          example: 1703187336000
          format: int64
          type: integer
        suppression_query:
          description: The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer.
          example: env:staging status:low
          type: string
      required:
      - name
      - enabled
      - rule_query
      type: object
    UpdateRuleResponse:
      description: The response from a rule update request.
      properties:
        data:
          $ref: '#/components/schemas/UpdateRuleResponseData'
      type: object
    RuleTypes:
      description: Security rule types used as filters in security rules.
      example:
      - misconfiguration
      - attack_path
      items:
        $ref: '#/components/schemas/RuleTypesItems'
      type: array
    OrganizationsType:
      default: orgs
      description: Organizations resource type.
      enum:
      - orgs
      example: orgs
      type: string
      x-enum-varnames:
      - ORGS
    NotificationRuleResponse:
      description: Response object which includes a notification rule.
      properties:
        data:
          $ref: '#/components/schemas/NotificationRule'
      type: object
    CloudWorkloadSecurityAgentRuleCreatorAttributes:
      description: The attributes of the user who created the Agent rule
      properties:
        handle:
          description: The handle of the user
          example: datadog.user@example.com
          type: string
        name:
          description: The name of the user
          example: Datadog User
          nullable: true
          type: string
      type: object
    ApplicationSecurityWafCustomRuleConditionOptions:
      description: Options for the operator of this condition.
      properties:
        case_sensitive:
          default: false
          description: Evaluate the value as case sensitive.
          type: boolean
          example: true
        min_length:
          default: 0
          description: Only evaluate this condition if the value has a minimum amount of characters.
          format: int64
          type: integer
          example: 42
      type: object
    SecurityMonitoringRuleSeverity:
      description: Severity of the Security Signal.
      enum:
      - info
      - low
      - medium
      - high
      - critical
      example: critical
      type: string
      x-enum-varnames:
      - INFO
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
    MonitorNotificationRuleData:
      description: Monitor notification rule data.
      properties:
        attributes:
          $ref: '#/components/schemas/MonitorNotificationRuleResponseAttributes'
        id:
          $ref: '#/components/schemas/MonitorNotificationRuleId'
        relationships:
          $ref: '#/components/schemas/MonitorNotificationRuleRelationships'
        type:
          $ref: '#/components/schemas/MonitorNotificationRuleResourceType'
      type: object
    CreateRuleRequest:
      description: Scorecard create rule request.
      properties:
        data:
          $ref: '#/components/schemas/CreateRuleRequestData'
      type: object
    RoutingRuleAction:
      description: Defines an action that is executed when a routing rule matches certain criteria.
      oneOf:
      - $ref: '#/components/schemas/SendSlackMessageAction'
      - $ref: '#/components/schemas/SendTeamsMessageAction'
    MonitorNotificationRuleName:
      description: The name of the monitor notification rule.
      example: A notification rule name
      maxLength: 1000
      minLength: 1
      type: string
    ListRulesResponseData:
      description: Array of rule details.
      items:
        $ref: '#/components/schemas/ListRulesResponseDataItem'
      type: array
    SecurityMonitoringSignalRuleResponseQuery:
      description: Query for matching rule on signals.
      properties:
        aggregation:
          $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
        correlatedByFields:
          description: Fields to correlate by.
          items:
            description: Field.
            type: string
          type: array
        correlatedQueryIndex:
          description: Index of the rule query used to retrieve the correlated field.
          format: int32
          maximum: 9
          type: integer
          example: 42
        defaultRuleId:
          description: Default Rule ID to match on signals.
          example: d3f-ru1-e1d
          type: string
        distinctFields:
          description: Field for which the cardinality is measured. Sent as an array.
          items:
            description: Field.
            type: string
          type: array
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        metrics:
          description: Group of target fields to aggregate over.
          items:
            description: Field.
            type: string
          type: array
        name:
          description: Name of the query.
          type: string
          example: Example Monitor
        ruleId:
          description: Rule ID to match on signals.
          example: org-ru1-e1d
          type: string
      type: object
    SensitiveDataScannerGroupData:
      description: A scanning group data.
      properties:
        data:
          $ref: '#/components/schemas/SensitiveDataScannerGroup'
      type: object
    SecurityMonitoringSuppression:
      description: The suppression rule's properties.
      properties:
        attributes:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionAttributes'
        id:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionID'
        type:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionType'
      type: object
    SecurityMonitoringListRulesResponse:
      description: List of rules.
      properties:
        data:
          description: Array containing the list of rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleResponse'
          type: array
        meta:
          $ref: '#/components/schemas/ResponseMetaAttributes'
      type: object
    SensitiveDataScannerRuleUpdate:
      description: Data related to the update of a rule.
      properties:
        attributes:
          $ref: '#/components/schemas/SensitiveDataScannerRuleAttributes'
        id:
          description: ID of the rule.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/SensitiveDataScannerRuleRelationships'
        type:
          $ref: '#/components/schemas/SensitiveDataScannerRuleType'
      type: object
    Weekday:
      description: A day of the week.
      enum:
      - monday
      - tuesday
      - wednesday
      - thursday
      - friday
      - saturday
      - sunday
      type: string
      x-enum-varnames:
      - MONDAY
      - TUESDAY
      - WEDNESDAY
      - THURSDAY
      - FRIDAY
      - SATURDAY
      - SUNDAY
    PatchNotificationRuleParametersData:
      description: 'Data of the notification rule patch request: the rule ID, the rule type, and the rule attributes. All fields are required.'
      properties:
        attributes:
          $ref: '#/components/schemas/PatchNotificationRuleParametersDataAttributes'
        id:
          $ref: '#/components/schemas/ID'
        type:
          $ref: '#/components/schemas/NotificationRulesType'
      required:
      - attributes
      - id
      - type
      type: object
    ApplicationSecurityWafCustomRuleMetadata:
      description: Metadata associated with the WAF Custom Rule.
      properties:
        added_at:
          description: The date and time the WAF custom rule was created.
          example: '2021-01-01T00:00:00Z'
          format: date-time
          type: string
        added_by:
          description: The handle of the user who created the WAF custom rule.
          example: john.doe@datadoghq.com
          type: string
        added_by_name:
          description: The name of the user who created the WAF custom rule.
          example: John Doe
          type: string
        modified_at:
          description: The date and time the WAF custom rule was last updated.
          example: '2021-01-01T00:00:00Z'
          format: date-time
          type: string
        modified_by:
          description: The handle of the user who last updated the WAF custom rule.
          example: john.doe@datadoghq.com
          type: string
        modified_by_name:
          description: The name of the user who last updated the WAF custom rule.
          example: John Doe
          type: string
      readOnly: true
      type: object
    SecurityMonitoringSuppressionType:
      default: suppressions
      description: The type of the resource. The value should always be `suppressions`.
      enum:
      - suppressions
      example: suppressions
      type: string
      x-enum-varnames:
      - SUPPRESSIONS
    ScorecardType:
      default: scorecard
      description: The JSON:API type for scorecard.
      enum:
      - scorecard
      example: scorecard
      type: string
      x-enum-varnames:
      - SCORECARD
    TeamRoutingRulesRequestData:
      description: Holds the data necessary to create or update team routing rules, including attributes, ID, and resource type.
      properties:
        attributes:
          $ref: '#/components/schemas/TeamRoutingRulesRequestDataAttributes'
        id:
          description: Specifies the unique identifier for this set of team routing rules.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/TeamRoutingRulesRequestDataType'
      required:
      - type
      type: object
    TeamRoutingRulesDataRelationshipsRulesDataItems:
      description: Defines a relationship item to link a routing rule by its ID and type.
      properties:
        id:
          description: Specifies the unique identifier for the related routing rule.
          example: ''
          type: string
        type:
          $ref: '#/components/schemas/TeamRoutingRulesDataRelationshipsRulesDataItemsType'
      required:
      - type
      - id
      type: object
    SecurityMonitoringSuppressionAttributes:
      description: The attributes of the suppression rule.
      properties:
        creation_date:
          description: A Unix millisecond timestamp given the creation date of the suppression rule.
          format: int64
          type: integer
          example: 42
        creator:
          $ref: '#/components/schemas/SecurityMonitoringUser'
        data_exclusion_query:
          description: An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
          example: source:cloudtrail account_id:12345
          type: string
        description:
          description: A description for the suppression rule.
          example: This rule suppresses low-severity signals in staging environments.
          type: string
        editable:
          description: Whether the suppression rule is editable.
          example: true
          type: boolean
        enabled:
          description: Whether the suppression rule is enabled.
          example: true
          type: boolean
        expiration_date:
          description: A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore.
          example: 1703187336000
          format: int64
          type: integer
        name:
          description: The name of the suppression rule.
          example: Custom suppression
          type: string
        rule_query:
          description: The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
          example: type:log_detection source:cloudtrail
          type: string
        start_date:
          description: A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals.
          example: 1703187336000
          format: int64
          type: integer
        suppression_query:
          description: The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer.
          example: env:staging status:low
          type: string
        update_date:
          description: A Unix millisecond timestamp given the update date of the suppression rule.
          format: int64
          type: integer
          example: 42
        updater:
          $ref: '#/components/schemas/SecurityMonitoringUser'
        version:
          description: The version of the suppression rule; it starts at 1, and is incremented at each update.
          example: 42
          format: int32
          maximum: 2147483647
          type: integer
      type: object
    APIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          example:
          - Bad Request
          items:
            description: A list of items.
            example: Bad Request
            type: string
          type: array
      required:
      - errors
      type: object
    MonitorNotificationRuleCreateRequestData:
      description: Object to create a monitor notification rule.
      properties:
        attributes:
          $ref: '#/components/schemas/MonitorNotificationRuleAttributes'
        type:
          $ref: '#/components/schemas/MonitorNotificationRuleResourceType'
      required:
      - attributes
      type: object
    UserResponseRelationships:
      description: Relationships of the user object returned by the API.
      properties:
        org:
          $ref: '#/components/schemas/RelationshipToOrganization'
        other_orgs:
          $ref: '#/components/schemas/RelationshipToOrganizations'
        other_users:
          $ref: '#/components/schemas/RelationshipToUsers'
        roles:
          $ref: '#/components/schemas/RelationshipToRoles'
      type: object
      x-merge-override:
        properties: false
    CloudWorkloadSecurityAgentRuleActionMetadata:
      description: The metadata action applied on the scope matching the rule
      properties:
        image_tag:
          description: The image tag of the metadata action
          type: string
          example: env:production
        service:
          description: The service of the metadata action
          type: string
          example: example_value
        short_image:
          description: The short image of the metadata action
          type: string
          example: example_value
      type: object
    SensitiveDataScannerRuleRelationships:
      description: Relationships of a scanning rule.
      properties:
        group:
          $ref: '#/components/schemas/SensitiveDataScannerGroupData'
        standard_pattern:
          $ref: '#/components/schemas/SensitiveDataScannerStandardPatternData'
      type: object
    SensitiveDataScannerRuleResponse:
      description: Response data related to the creation of a rule.
      properties:
        attributes:
          $ref: '#/components/schemas/SensitiveDataScannerRuleAttributes'
        id:
          description: ID of the rule.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/SensitiveDataScannerRuleRelationships'
        type:
          $ref: '#/components/schemas/SensitiveDataScannerRuleType'
      type: object
    CloudConfigurationRegoRule:
      description: Rule details.
      properties:
        policy:
          description: 'The policy written in `rego`, see: https://www.openpolicyagent.org/docs/latest/policy-language/'
          example: "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n  # Logic that evaluates to true if the resource should be skipped\n  true\n} else = \"pass\" {\n  # Logic that evaluates to true if the resource is compliant\n  true\n} else = \"fail\" {\n  # Logic that evaluates to true if the resource is not compliant\n  true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n  some resource in input.resources[input.main_resource_type]\n  result := dd_output.format(resource, eval(resource))\n}\n"
          type: string
        resourceTypes:
          description: List of resource types that will be evaluated upon. Must have at least one element.
          example:
          - gcp_iam_service_account
          - gcp_iam_policy
          items:
            type: string
          type: array
      required:
      - policy
      - resourceTypes
      type: object
    SecurityMonitoringSignalRulePayload:
      description: The payload of a signal correlation rule.
      properties:
        cases:
          description: Cases for generating signals.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseCreate'
          type: array
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          example: true
          type: boolean
        isEnabled:
          description: Whether the rule is enabled.
          example: true
          type: boolean
        message:
          description: Message for generated signals.
          example: ''
          type: string
        name:
          description: The name of the rule.
          example: My security monitoring rule.
          type: string
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting signals which are part of the rule.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringSignalRuleQuery'
          type: array
        tags:
          description: Tags for generated signals.
          example:
          - env:prod
          - team:security
          items:
            description: Tag.
            type: string
          type: array
        type:
          $ref: '#/components/schemas/SecurityMonitoringSignalRuleType'
      required:
      - name
      - isEnabled
      - queries
      - options
      - cases
      - message
      type: object
    TimeAggregation:
      description: 'Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation.

        Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation.

        Notifications are only sent for new issues discovered during the window.

        Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation

        is done.'
      example: 86400
      format: int64
      type: integer
    ApplicationSecurityWafCustomRuleTags:
      additionalProperties:
        type: string
      description: 'Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security

        activity field associated with the traces.'
      maxProperties: 32
      properties:
        category:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTagsCategory'
        type:
          description: The type of the WAF rule, associated with the category will form the security activity.
          example: users.login.success
          type: string
      required:
      - category
      - type
      type: object
    CreateNotificationRuleParametersDataAttributes:
      description: Attributes of the notification rule create request.
      properties:
        enabled:
          $ref: '#/components/schemas/Enabled'
        name:
          $ref: '#/components/schemas/RuleName'
        selectors:
          $ref: '#/components/schemas/Selectors'
        targets:
          $ref: '#/components/schemas/Targets'
        time_aggregation:
          $ref: '#/components/schemas/TimeAggregation'
      required:
      - selectors
      - name
      - targets
      type: object
    PatchNotificationRuleParametersDataAttributes:
      description: Attributes of the notification rule patch request. It is required to update the version of the rule when patching it.
      properties:
        enabled:
          $ref: '#/components/schemas/Enabled'
        name:
          $ref: '#/components/schemas/RuleName'
        selectors:
          $ref: '#/components/schemas/Selectors'
        targets:
          $ref: '#/components/schemas/Targets'
        time_aggregation:
          $ref: '#/components/schemas/TimeAggregation'
        version:
          $ref: '#/components/schemas/Version'
      type: object
    CloudWorkloadSecurityAgentRuleID:
      description: The ID of the Agent rule
      example: 3dd-0uc-h1s
      type: string
    Date:
      description: Date as Unix timestamp in milliseconds.
      example: 1722439510282
      format: int64
      type: integer
    RoutingRuleRelationshipsPolicyData:
      description: Represents the policy data reference, containing the policy's ID and resource type.
      properties:
        id:
          description: Specifies the unique identifier of the policy.
          example: ''
          type: string
        type:
          $ref: '#/components/schemas/RoutingRuleRelationshipsPolicyDataType'
      required:
      - type
      - id
      type: object
    SecurityMonitoringRuleCaseCreate:
      description: Case when signal is generated.
      properties:
        actions:
          description: Action to perform for each rule case.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseAction'
          type: array
        condition:
          description: 'A case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated

            based on the event counts in the previously defined queries.'
          type: string
          example: example_value
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets.
          items:
            description: Notification.
            type: string
          type: array
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      required:
      - status
      type: object
    MonitorNotificationRuleCreateRequest:
      description: Request for creating a monitor notification rule.
      properties:
        data:
          $ref: '#/components/schemas/MonitorNotificationRuleCreateRequestData'
      required:
      - data
      type: object
    CloudConfigurationRuleComplianceSignalOptions:
      description: How to generate compliance signals. Useful for cloud_configuration rules only.
      properties:
        defaultActivationStatus:
          description: The default activation status.
          nullable: true
          type: boolean
          example: true
        defaultGroupByFields:
          description: The default group by fields.
          items:
            type: string
          nullable: true
          type: array
        userActivationStatus:
          description: Whether signals will be sent.
          nullable: true
          type: boolean
          example: true
        userGroupByFields:
          description: Fields to use to group findings by when sending signals.
          items:
            type: string
          nullable: true
          type: array
      type: object
    MonitorNotificationRuleFilterTags:
      additionalProperties: false
      description: Filter monitors by tags. Monitors must match all tags.
      properties:
        tags:
          description: A list of monitor tags.
          example:
          - team:product
          - host:abc
          items:
            maxLength: 255
            type: string
          maxItems: 20
          minItems: 1
          type: array
          uniqueItems: true
      required:
      - tags
      type: object
    MonitorNotificationRuleListResponse:
      description: Response for retrieving all monitor notification rules.
      properties:
        data:
          description: A list of monitor notification rules.
          items:
            $ref: '#/components/schemas/MonitorNotificationRuleData'
          type: array
        included:
          description: Array of objects related to the monitor notification rules.
          items:
            $ref: '#/components/schemas/MonitorNotificationRuleResponseIncludedItem'
          type: array
      type: object
    SecurityMonitoringStandardRulePayload:
      description: The payload of a rule.
      properties:
        cases:
          description: Cases for generating signals.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseCreate'
          type: array
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        groupSignalsBy:
          description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
          example:
          - service
          items:
            description: Field to group by.
            type: string
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          example: true
          type: boolean
        isEnabled:
          description: Whether the rule is enabled.
          example: true
          type: boolean
        message:
          description: Message for generated signals.
          example: ''
          type: string
        name:
          description: The name of the rule.
          example: My security monitoring rule.
          type: string
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting logs which are part of the rule.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
          type: array
        referenceTables:
          description: Reference tables for the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
          type: array
        tags:
          description: Tags for generated signals.
          example:
          - env:prod
          - team:security
          items:
            description: Tag.
            type: string
          type: array
        thirdPartyCases:
          description: Cases for generating signals from third-party rules. Only available for third-party rules.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate'
          type: array
        type:
          $ref: '#/components/schemas/SecurityMonitoringRuleTypeCreate'
      required:
      - name
      - isEnabled
      - queries
      - options
      - cases
      - message
      type: object
    ApplicationSecurityWafCustomRuleConditionInput:
      description: Input from the request on which the condition should apply.
      properties:
        address:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionInputAddress'
        key_path:
          description: Specific path for the input.
          items:
            type: string
          type: array
      required:
      - address
      type: object
    OutcomesResponseLinks:
      description: Links attributes.
      properties:
        next:
          description: Link for the next set of results.
          example: /api/v2/scorecard/outcomes?include=rule&page%5Blimit%5D=100&page%5Boffset%5D=100
          type: string
      type: object
    State:
      description: The state of the rule evaluation.
      enum:
      - pass
      - fail
      - skip
      example: pass
      type: string
      x-enum-varnames:
      - PASS
      - FAIL
      - SKIP
    SecurityMonitoringSuppressionCreateData:
      description: Object for a single suppression rule.
      properties:
        attributes:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionCreateAttributes'
        type:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionType'
      required:
      - type
      - attributes
      type: object
    ApplicationSecurityWafCustomRuleUpdateRequest:
      description: Request object that includes the Custom Rule to update.
      properties:
        data:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleUpdateData'
      required:
      - data
      type: object
    SecurityMonitoringSuppressionsResponse:
      description: Response object containing the available suppression rules.
      properties:
        data:
          description: A list of suppressions objects.
          items:
            $ref: '#/components/schemas/SecurityMonitoringSuppression'
          type: array
      type: object
    RelationshipToRule:
      description: Scorecard create rule response relationship.
      properties:
        scorecard:
          $ref: '#/components/schemas/RelationshipToRuleData'
      type: object
    SecurityMonitoringRuleImpossibleTravelOptions:
      description: Options on impossible travel detection method.
      properties:
        baselineUserLocations:
          $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations'
      type: object
    RelationshipToRoleData:
      description: Relationship to role object.
      properties:
        id:
          description: The unique identifier of the role.
          example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d
          type: string
        type:
          $ref: '#/components/schemas/RolesType'
      type: object
      x-merge-override:
        required: false
    TeamRoutingRulesDataRelationships:
      description: Specifies relationships for team routing rules, including rule references.
      properties:
        rules:
          $ref: '#/components/schemas/TeamRoutingRulesDataRelationshipsRules'
      type: object
    UpdateRuleResponseData:
      description: The data for a rule update response.
      properties:
        attributes:
          $ref: '#/components/schemas/RuleAttributes'
        id:
          $ref: '#/components/schemas/RuleId'
        relationships:
          $ref: '#/components/schemas/RelationshipToRule'
        type:
          $ref: '#/components/schemas/RuleType'
      type: object
    TeamRoutingRulesRequest:
      description: Represents a request to create or update team routing rules, including the data payload.
      example:
        data:
          attributes:
            rules:
            - actions: null
              policy_id: ''
              query: tags.service:test
              time_restriction:
                restrictions:
                - end_day: monday
                  end_time: '17:00:00'
                  start_day: monday
                  start_time: 09:00:00
                - end_day: tuesday
                  end_time: '17:00:00'
                  start_day: tuesday
                  start_time: 09:00:00
                time_zone: ''
              urgency: high
            - actions:
              - channel: channel
                type: send_slack_message
                workspace: workspace
              policy_id: fad4eee1-13f5-40d8-886b-4e56d8d5d1c6
              query: ''
              time_restriction: null
              urgency: low
          id: 27590dae-47be-4a7d-9abf-8f4e45124020
          type: team_routing_rules
      properties:
        data:
          $ref: '#/components/schemas/TeamRoutingRulesRequestData'
      type: object
    ApplicationSecurityWafCustomRuleActionParameters:
      description: The definition of `ApplicationSecurityWafCustomRuleActionParameters` object.
      properties:
        location:
          description: The location to redirect to when the WAF custom rule triggers.
          example: /blocking
          type: string
        status_code:
          default: 403
          description: The status code to return when the WAF custom rule triggers.
          example: 403
          format: int64
          type: integer
      type: object
    ListRulesResponse:
      description: Scorecard rules response.
      properties:
        data:
          $ref: '#/components/schemas/ListRulesResponseData'
        links:
          $ref: '#/components/schemas/ListRulesResponseLinks'
      type: object
    RelationshipToOrganizationData:
      description: Relationship to organization object.
      properties:
        id:
          description: ID of the organization.
          example: 00000000-0000-beef-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/OrganizationsType'
      required:
      - id
      - type
      type: object
    ApplicationSecurityWafCustomRuleAttributes:
      description: A WAF custom rule.
      properties:
        action:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAction'
        blocking:
          description: Indicates whether the WAF custom rule will block the request.
          example: false
          type: boolean
        conditions:
          description: 'Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF

            rule to trigger.'
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCondition'
          type: array
        enabled:
          description: Indicates whether the WAF custom rule is enabled.
          example: false
          type: boolean
        metadata:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleMetadata'
        name:
          description: The Name of the WAF custom rule.
          example: Block request from bad useragent
          type: string
        path_glob:
          description: The path glob for the WAF custom rule.
          example: /api/search/*
          type: string
        scope:
          description: The scope of the WAF custom rule.
          items:
            $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleScope'
          type: array
        tags:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTags'
      required:
      - enabled
      - blocking
      - name
      - tags
      - conditions
      type: object
    SecurityMonitoringRuleConvertResponse:
      description: Result of the convert rule request containing Terraform content.
      properties:
        terraformContent:
          description: Terraform string as a result of converting the rule from JSON.
          type: string
          example: example_value
      type: object
    ApplicationSecurityWafCustomRuleScope:
      description: The scope of the WAF custom rule.
      properties:
        env:
          description: The environment scope for the WAF custom rule.
          example: prod
          type: string
        service:
          description: The service scope for the WAF custom rule.
          example: billing-service
          type: string
      required:
      - service
      - env
      type: object
    Urgency:
      description: Specifies the level of urgency for a routing rule (low, high, or dynamic).
      enum:
      - low
      - high
      - dynamic
      example: low
      type: string
      x-enum-varnames:
      - LOW
      - HIGH
      - DYNAMIC
    ApplicationSecurityWafCustomRuleType:
      default: custom_rule
      description: The type of the resource. The value should always be `custom_rule`.
      enum:
      - custom_rule
      example: custom_rule
      type: string
      x-enum-varnames:
      - CUSTOM_RULE
    CloudConfigurationComplianceRuleOptions:
      additionalProperties: {}
      description: 'Options for cloud_configuration rules.

        Fields `resourceType` and `regoRule` are mandatory when managing custom `cloud_configuration` rules.

        '
      properties:
        complexRule:
          description: 'Whether the rule is a complex one.

            Must be set to true if `regoRule.resourceTypes` contains more than one item. Defaults to false.

            '
          type: boolean
          example: true
        regoRule:
          $ref: '#/components/schemas/CloudConfigurationRegoRule'
        resourceType:
          description: 'Main resource type to be checked by the rule. It should be specified again in `regoRule.resourceTypes`.

            '
          example: aws_acm
          type: string
      type: object
    MonitorNotificationRuleResponseIncludedItem:
      description: An object related to a monitor notification rule.
      oneOf:
      - $ref: '#/components/schemas/User'
    SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations:
      description: 'If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user''s regular

        access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.'
      example: true
      type: boolean
    SecurityMonitoringRuleQuery:
      description: Query for matching rule.
      oneOf:
      - $ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
      - $ref: '#/components/schemas/SecurityMonitoringSignalRuleQuery'
    SensitiveDataScannerRuleType:
      default: sensitive_data_scanner_rule
      description: Sensitive Data Scanner rule type.
      enum:
      - sensitive_data_scanner_rule
      example: sensitive_data_scanner_rule
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER_RULE
    SendTeamsMessageAction:
      description: Sends a message to a Microsoft Teams channel.
      properties:
        channel:
          description: The channel ID.
          example: CHANNEL
          type: string
        team:
          description: The team ID.
          example: TEAM
          type: string
        tenant:
          description: The tenant ID.
          example: TENANT
          type: string
        type:
          $ref: '#/components/schemas/SendTeamsMessageActionType'
      required:
      - type
      - channel
      - tenant
      - team
      type: object
    RelationshipToUsers:
      description: Relationship to users.
      properties:
        data:
          description: Relationships to user objects.
          example: []
          items:
            $ref: '#/components/schemas/RelationshipToUserData'
          type: array
      required:
      - data
      type: object
    SecurityMonitoringThirdPartyRuleCase:
      description: Case when signal is generated by a third party rule.
      properties:
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets for each rule case.
          items:
            description: Notification.
            type: string
          type: array
        query:
          description: A query to map a third party event to this case.
          type: string
          example: avg:system.cpu.user{*}
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      type: object
    SecurityMonitoringRuleValidatePayload:
      description: Validate a rule.
      oneOf:
      - $ref: '#/components/schemas/SecurityMonitoringStandardRulePayload'
      - $ref: '#/components/schemas/SecurityMonitoringSignalRulePayload'
      - $ref: '#/components/schemas/CloudConfigurationRulePayload'
    CloudWorkloadSecurityAgentRuleAttributes:
      description: A Cloud Workload Security Agent rule returned by the API
      properties:
        actions:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions'
        agentConstraint:
          description: The version of the Agent
          type: string
          example: example_value
        blocking:
          description: The blocking policies that the rule belongs to
          items:
            type: string
          type: array
        category:
          description: The category of the Agent rule
          example: Process Activity
          type: string
        creationAuthorUuId:
          description: The ID of the user who created the rule
          example: e51c9744-d158-11ec-ad23-da7ad0900002
          type: string
        creationDate:
          description: When the Agent rule was created, timestamp in milliseconds
          example: 1624366480320
          format: int64
          type: integer
        creator:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleCreatorAttributes'
        defaultRule:
          description: Whether the rule is included by default
          example: false
          type: boolean
        description:
          description: The description of the Agent rule
          example: My Agent rule
          type: string
        disabled:
          description: The disabled policies that the rule belongs to
          items:
            type: string
          type: array
        enabled:
          description: Whether the Agent rule is enabled
          example: true
          type: boolean
        expression:
          description: The SECL expression of the Agent rule
          example: exec.file.name == "sh"
          type: string
        filters:
          description: The platforms the Agent rule is supported on
          items:
            type: string
          type: array
        monitoring:
          description: The monitoring policies that the rule belongs to
          items:
            type: string
          type: array
        name:
          description: The name of the Agent rule
          example: my_agent_rule
          type: string
        product_tags:
          description: The list of product tags associated with the rule
          items:
            type: string
          type: array
        updateAuthorUuId:
          description: The ID of the user who updated the rule
          example: e51c9744-d158-11ec-ad23-da7ad0900002
          type: string
        updateDate:
          description: Timestamp in milliseconds when the Agent rule was last updated
          example: 1624366480320
          format: int64
          type: integer
        updatedAt:
          description: When the Agent rule was last updated, timestamp in milliseconds
          example: 1624366480320
          format: int64
          type: integer
        updater:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleUpdaterAttributes'
        version:
          description: The version of the Agent rule
          example: 23
          format: int64
          type: integer
      type: object
    TeamRoutingRulesRequestDataType:
      default: team_routing_rules
      description: Team routing rules resource type.
      enum:
      - team_routing_rules
      example: team_routing_rules
      type: string
      x-enum-varnames:
      - TEAM_ROUTING_RULES
    OutcomeType:
      default: outcome
      description: The JSON:API type for an outcome.
      enum:
      - outcome
      example: outcome
      type: string
      x-enum-varnames:
      - OUTCOME
    RuleUser:
      description: User creating or modifying a rule.
      properties:
        handle:
          description: The user handle.
          example: john.doe@domain.com
          type: string
        name:
          description: The user name.
          example: John Doe
          type: string
      type: object
    OutcomesResponse:
      description: Scorecard outcomes - the result of a rule for a service.
      properties:
        data:
          $ref: '#/components/schemas/OutcomesResponseData'
        included:
          $ref: '#/components/schemas/OutcomesResponseIncluded'
        links:
          $ref: '#/components/schemas/OutcomesResponseLinks'
      type: object
    CloudWorkloadSecurityAgentRuleResponse:
      description: Response object that includes an Agent rule
      properties:
        data:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleData'
      type: object
    RoutingRuleRelationshipsPolicyDataType:
      default: policies
      description: Indicates that the resource is of type 'policies'.
      enum:
      - policies
      example: policies
      type: string
      x-enum-varnames:
      - POLICIES
    CloudWorkloadSecurityAgentRuleCreateData:
      description: Object for a single Agent rule
      properties:
        attributes:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleCreateAttributes'
        type:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleType'
      required:
      - attributes
      - type
      type: object
    OutcomesResponseDataItem:
      description: A single rule outcome.
      properties:
        attributes:
          $ref: '#/components/schemas/OutcomesBatchResponseAttributes'
        id:
          description: The unique ID for a rule outcome.
          type: string
          example: abc-123-def
        relationships:
          $ref: '#/components/schemas/RuleOutcomeRelationships'
        type:
          $ref: '#/components/schemas/OutcomeType'
      type: object
    SecurityMonitoringSignalRuleType:
      description: The rule type.
      enum:
      - signal_correlation
      type: string
      x-enum-varnames:
      - SIGNAL_CORRELATION
    MonitorNotificationRuleRecipients:
      description: A list of recipients to notify. Uses the same format as the monitor `message` field. Must not start with an '@'.
      example:
      - slack-test-channel
      - jira-test
      items:
        description: individual recipient.
        maxLength: 255
        type: string
      maxItems: 20
      minItems: 1
      type: array
      uniqueItems: true
    CloudWorkloadSecurityAgentRuleUpdateRequest:
      description: Request object that includes the Agent rule with the attributes to update
      properties:
        data:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleUpdateData'
      required:
      - data
      type: object
    RuleId:
      description: The unique ID for a scorecard rule.
      example: q8MQxk8TCqrHnWkx
      type: string
    RelationshipToRoles:
      description: Relationship to roles.
      properties:
        data:
          description: An array containing type and the unique identifier of a role.
          items:
            $ref: '#/components/schemas/RelationshipToRoleData'
          type: array
      type: object
      x-merge-override:
        required: false
    SecurityMonitoringSuppressionUpdateAttributes:
      description: The suppression rule properties to be updated.
      properties:
        data_exclusion_query:
          description: An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule.
          example: source:cloudtrail account_id:12345
          type: string
        description:
          description: A description for the suppression rule.
          example: This rule suppresses low-severity signals in staging environments.
          type: string
        enabled:
          description: Whether the suppression rule is enabled.
          example: true
          type: boolean
        expiration_date:
          description: A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore. If unset, the expiration date of the suppression rule is left untouched. If set to `null`, the expiration date is removed.
          example: 1703187336000
          format: int64
          nullable: true
          type: integer
        name:
          description: The name of the suppression rule.
          example: Custom suppression
          type: string
        rule_query:
          description: The rule query of the suppression rule, with the same syntax as the search bar for detection rules.
          example: type:log_detection source:cloudtrail
          type: string
        start_date:
          description: A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals. If unset, the start date of the suppression rule is left untouched. If set to `null`, the start date is removed.
          example: 1703187336000
          format: int64
          nullable: true
          type: integer
        suppression_query:
          description: The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer.
          example: env:staging status:low
          type: string
        version:
          description: The current version of the suppression. This is optional, but it can help prevent concurrent modifications.
          format: int32
          maximum: 2147483647
          type: integer
          example: 42
      type: object
    TeamRoutingRulesIncluded:
      description: Represents additional included resources for team routing rules, such as associated routing rules.
      oneOf:
      - $ref: '#/components/schemas/RoutingRule'
    RelationshipToOrganizations:
      description: Relationship to organizations.
      properties:
        data:
          description: Relationships to organization objects.
          example: []
          items:
            $ref: '#/components/schemas/RelationshipToOrganizationData'
          type: array
      required:
      - data
      type: object
    MonitorNotificationRuleUpdateRequest:
      description: Request for updating a monitor notification rule.
      properties:
        data:
          $ref: '#/components/schemas/MonitorNotificationRuleUpdateRequestData'
      required:
      - data
      type: object
    ID:
      description: The ID of a notification rule.
      example: aaa-bbb-ccc
      type: string
    SensitiveDataScannerStandardPatternType:
      default: sensitive_data_scanner_standard_pattern
      description: Sensitive Data Scanner standard pattern type.
      enum:
      - sensitive_data_scanner_standard_pattern
      example: sensitive_data_scanner_standard_pattern
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER_STANDARD_PATTERN
    SecurityMonitoringThirdPartyRootQuery:
      description: A query to be combined with the third party case query.
      properties:
        groupByFields:
          description: Fields to group by.
          items:
            description: Field.
            type: string
          type: array
        query:
          description: Query to run on logs.
          example: source:cloudtrail
          type: string
      type: object
    SensitiveDataScannerGroupType:
      default: sensitive_data_scanner_group
      description: Sensitive Data Scanner group type.
      enum:
      - sensitive_data_scanner_group
      example: sensitive_data_scanner_group
      type: string
      x-enum-varnames:
      - SENSITIVE_DATA_SCANNER_GROUP
    SecurityMonitoringRuleNewValueOptionsLearningMethod:
      default: duration
      description: The learning method used to determine when signals should be generated for values that weren't learned.
      enum:
      - duration
      - threshold
      type: string
      x-enum-varnames:
      - DURATION
      - THRESHOLD
    MonitorNotificationRuleAttributes:
      additionalProperties: false
      description: Attributes of the monitor notification rule.
      properties:
        filter:
          $ref: '#/components/schemas/MonitorNotificationRuleFilter'
        name:
          $ref: '#/components/schemas/MonitorNotificationRuleName'
        recipients:
          $ref: '#/components/schemas/MonitorNotificationRuleRecipients'
      required:
      - name
      - recipients
      type: object
    Pagination:
      description: Pagination object.
      properties:
        total_count:
          description: Total count.
          format: int64
          type: integer
          example: 42
        total_filtered_count:
          description: Total count of elements matched by the filter.
          format: int64
          type: integer
          example: 42
      type: object
    SecurityMonitoringRuleCaseAction:
      description: Action to perform when a signal is triggered. Only available for Application Security rule type.
      properties:
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptions'
        type:
          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionType'
      type: object
    SensitiveDataScannerCreateRuleResponse:
      description: Create rule response.
      properties:
        data:
          $ref: '#/components/schemas/SensitiveDataScannerRuleResponse'
        meta:
          $ref: '#/components/schemas/SensitiveDataScannerMetaVersionOnly'
      type: object
    RoutingRuleRelationshipsPolicy:
      description: Defines the relationship that links a routing rule to a policy.
      properties:
        data:
          $ref: '#/components/schemas/RoutingRuleRelationshipsPolicyData'
          nullable: true
      type: object
    SecurityMonitoringRuleNewValueOptionsLearningDuration:
      default: 0
      description: 'The duration in days during which values are learned, and after which signals will be generated for values that

        weren''t learned. If set to 0, a signal will be generated for all new values after the first value is learned.'
      enum:
      - 0
      - 1
      - 7
      format: int32
      type: integer
      x-enum-varnames:
      - ZERO_DAYS
      - ONE_DAY
      - SEVEN_DAYS
    RuleAttributes:
      description: Details of a rule.
      properties:
        category:
          deprecated: true
          description: The scorecard name to which this rule must belong.
          type: string
          example: example_value
        created_at:
          description: Creation time of the rule outcome.
          format: date-time
          type: string
          example: example_value
        custom:
          description: Defines if the rule is a custom rule.
          type: boolean
          example: true
        description:
          description: Explanation of the rule.
          type: string
          example: example_value
        enabled:
          description: If enabled, the rule is calculated as part of the score.
          example: true
          type: boolean
        modified_at:
          description: Time of the last rule outcome modification.
          format: date-time
          type: string
          example: example_value
        name:
          description: Name of the rule.
          example: Team Defined
          type: string
        owner:
          description: Owner of the rule.
          type: string
          example: example_value
        scorecard_name:
          description: The scorecard name to which this rule must belong.
          example: Deployments automated via Deployment Trains
          type: string
      type: object
    SecurityMonitoringRuleUpdatePayload:
      description: Update an existing rule.
      properties:
        cases:
          description: Cases for generating signals.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCase'
          type: array
        complianceSignalOptions:
          $ref: '#/components/schemas/CloudConfigurationRuleComplianceSignalOptions'
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        groupSignalsBy:
          description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
          example:
          - service
          items:
            description: Field to group by.
            type: string
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          example: true
          type: boolean
        isEnabled:
          description: Whether the rule is enabled.
          type: boolean
          example: true
        message:
          description: Message for generated signals.
          type: string
          example: CPU usage is high on {{host.name}}
        name:
          description: Name of the rule.
          type: string
          example: Example Monitor
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting logs which are part of the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleQuery'
          type: array
        referenceTables:
          description: Reference tables for the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
          type: array
        tags:
          description: Tags for generated signals.
          items:
            description: Tag.
            type: string
          type: array
        thirdPartyCases:
          description: Cases for generating signals from third-party rules. Only available for third-party rules.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCase'
          type: array
        version:
          description: The version of the rule being updated.
          example: 1
          format: int32
          maximum: 2147483647
          type: integer
      type: object
    TeamRoutingRulesRequestRule:
      description: Defines an individual routing rule item that contains the rule data for the request.
      properties:
        actions:
          description: Specifies the list of actions to perform when the routing rule is matched.
          items:
            $ref: '#/components/schemas/RoutingRuleAction'
          type: array
        policy_id:
          description: Identifies the policy to be applied when this routing rule matches.
          type: string
          example: abc-123-def
        query:
          description: Defines the query or condition that triggers this routing rule.
          type: string
          example: avg:system.cpu.user{*}
        time_restriction:
          $ref: '#/components/schemas/TimeRestrictions'
        urgency:
          $ref: '#/components/schemas/Urgency'
      type: object
    ListRulesResponseDataItem:
      description: Rule details.
      properties:
        attributes:
          $ref: '#/components/schemas/RuleAttributes'
        id:
          $ref: '#/components/schemas/RuleId'
        relationships:
          $ref: '#/components/schemas/RelationshipToRule'
        type:
          $ref: '#/components/schemas/RuleType'
      type: object
    RelationshipToOutcomeData:
      description: The JSON:API relationship to an outcome, which returns the related rule id.
      properties:
        id:
          $ref: '#/components/schemas/RuleId'
        type:
          $ref: '#/components/schemas/RuleType'
      type: object
    SecurityMonitoringRuleCase:
      description: Case when signal is generated.
      properties:
        actions:
          description: Action to perform for each rule case.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseAction'
          type: array
        condition:
          description: 'A rule case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated

            based on the event counts in the previously defined queries.'
          type: string
          example: example_value
        name:
          description: Name of the case.
          type: string
          example: Example Monitor
        notifications:
          description: Notification targets for each rule case.
          items:
            description: Notification.
            type: string
          type: array
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      type: object
    Selectors:
      description: 'Selectors are used to filter security issues for which notifications should be generated.

        Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source.

        Only the trigger_source field is required.'
      properties:
        query:
          $ref: '#/components/schemas/NotificationRuleQuery'
        rule_types:
          $ref: '#/components/schemas/RuleTypes'
        severities:
          description: The security rules severities to consider.
          items:
            $ref: '#/components/schemas/RuleSeverity'
          type: array
        trigger_source:
          $ref: '#/components/schemas/TriggerSource'
      required:
      - trigger_source
      type: object
    CloudWorkloadSecurityAgentRuleType:
      default: agent_rule
      description: The type of the resource, must always be `agent_rule`
      enum:
      - agent_rule
      example: agent_rule
      type: string
      x-enum-varnames:
      - AGENT_RULE
    MonitorNotificationRuleFilter:
      description: Filter used to associate the notification rule with monitors.
      oneOf:
      - $ref: '#/components/schemas/MonitorNotificationRuleFilterTags'
    SecurityMonitoringRuleNewValueOptions:
      description: Options on new value detection method.
      properties:
        forgetAfter:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter'
        learningDuration:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration'
        learningMethod:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningMethod'
        learningThreshold:
          $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningThreshold'
      type: object
    SecurityMonitoringStandardRuleCreatePayload:
      description: Create a new rule.
      properties:
        cases:
          description: Cases for generating signals.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseCreate'
          type: array
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        groupSignalsBy:
          description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
          example:
          - service
          items:
            description: Field to group by.
            type: string
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          example: true
          type: boolean
        isEnabled:
          description: Whether the rule is enabled.
          example: true
          type: boolean
        message:
          description: Message for generated signals.
          example: ''
          type: string
        name:
          description: The name of the rule.
          example: My security monitoring rule.
          type: string
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting logs which are part of the rule.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
          type: array
        referenceTables:
          description: Reference tables for the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
          type: array
        tags:
          description: Tags for generated signals.
          example:
          - env:prod
          - team:security
          items:
            description: Tag.
            type: string
          type: array
        thirdPartyCases:
          description: Cases for generating signals from third-party rules. Only available for third-party rules.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate'
          type: array
        type:
          $ref: '#/components/schemas/SecurityMonitoringRuleTypeCreate'
      required:
      - name
      - isEnabled
      - queries
      - options
      - cases
      - message
      type: object
    RoutingRuleType:
      default: team_routing_rules
      description: Team routing rules resource type.
      enum:
      - team_routing_rules
      example: team_routing_rules
      type: string
      x-enum-varnames:
      - TEAM_ROUTING_RULES
    SecurityMonitoringFilter:
      description: The rule's suppression filter.
      properties:
        action:
          $ref: '#/components/schemas/SecurityMonitoringFilterAction'
        query:
          description: Query for selecting logs to apply the filtering action.
          type: string
          example: avg:system.cpu.user{*}
      type: object
    CloudConfigurationRuleCaseCreate:
      description: Description of signals.
      properties:
        notifications:
          description: Notification targets for each rule case.
          items:
            description: Notification.
            type: string
          type: array
        status:
          $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
      required:
      - status
      type: object
    SecurityMonitoringStandardRuleTestPayload:
      description: The payload of a rule to test
      properties:
        cases:
          description: Cases for generating signals.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCaseCreate'
          type: array
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        groupSignalsBy:
          description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
          example:
          - service
          items:
            description: Field to group by.
            type: string
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          example: true
          type: boolean
        isEnabled:
          description: Whether the rule is enabled.
          example: true
          type: boolean
        message:
          description: Message for generated signals.
          example: ''
          type: string
        name:
          description: The name of the rule.
          example: My security monitoring rule.
          type: string
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting logs which are part of the rule.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
          type: array
        referenceTables:
          description: Reference tables for the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
          type: array
        tags:
          description: Tags for generated signals.
          example:
          - env:prod
          - team:security
          items:
            description: Tag.
            type: string
          type: array
        thirdPartyCases:
          description: Cases for generating signals from third-party rules. Only available for third-party rules.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate'
          type: array
        type:
          $ref: '#/components/schemas/SecurityMonitoringRuleTypeTest'
      required:
      - name
      - isEnabled
      - queries
      - options
      - cases
      - message
      type: object
    SensitiveDataScannerGroup:
      description: A scanning group.
      properties:
        id:
          description: ID of the group.
          type: string
          example: abc-123-def
        type:
          $ref: '#/components/schemas/SensitiveDataScannerGroupType'
      type: object
    CreateNotificationRuleParameters:
      description: Body of the notification rule create request.
      properties:
        data:
          $ref: '#/components/schemas/CreateNotificationRuleParametersData'
      type: object
    ResponseMetaAttributes:
      description: Object describing meta attributes of response.
      properties:
        page:
          $ref: '#/components/schemas/Pagination'
      type: object
      x-merge-override:
        properties: false
    TeamRoutingRulesDataRelationshipsRules:
      description: Holds references to a set of routing rules in a relationship.
      properties:
        data:
          description: An array of references to the routing rules associated with this team.
          items:
            $ref: '#/components/schemas/TeamRoutingRulesDataRelationshipsRulesDataItems'
          type: array
      type: object
    CloudConfigurationRulePayload:
      description: The payload of a cloud configuration rule.
      properties:
        cases:
          description: 'Description of generated findings and signals (severity and channels to be notified in case of a signal). Must contain exactly one item.

            '
          items:
            $ref: '#/components/schemas/CloudConfigurationRuleCaseCreate'
          type: array
        complianceSignalOptions:
          $ref: '#/components/schemas/CloudConfigurationRuleComplianceSignalOptions'
        filters:
          description: Additional queries to filter matched events before they are processed.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        isEnabled:
          description: Whether the rule is enabled.
          example: true
          type: boolean
        message:
          description: Message in markdown format for generated findings and signals.
          example: '#Description

            Explanation of the rule.


            #Remediation

            How to fix the security issue.

            '
          type: string
        name:
          description: The name of the rule.
          example: My security monitoring rule.
          type: string
        options:
          $ref: '#/components/schemas/CloudConfigurationRuleOptions'
        tags:
          description: Tags for generated findings and signals.
          example:
          - env:prod
          - team:security
          items:
            description: Tag.
            type: string
          type: array
        type:
          $ref: '#/components/schemas/CloudConfigurationRuleType'
      required:
      - name
      - isEnabled
      - options
      - complianceSignalOptions
      - cases
      - message
      type: object
    CloudWorkloadSecurityAgentRulesListResponse:
      description: Response object that includes a list of Agent rule
      properties:
        data:
          description: A list of Agent rules objects
          items:
            $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleData'
          type: array
      type: object
    CloudWorkloadSecurityAgentRuleCreateAttributes:
      description: Create a new Cloud Workload Security Agent rule.
      properties:
        actions:
          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions'
        blocking:
          description: The blocking policies that the rule belongs to
          items:
            type: string
          type: array
        description:
          description: The description of the Agent rule.
          example: My Agent rule
          type: string
        disabled:
          description: The disabled policies that the rule belongs to
          items:
            type: string
          type: array
        enabled:
          description: Whether the Agent rule is enabled
          example: true
          type: boolean
        expression:
          description: The SECL expression of the Agent rule.
          example: exec.file.name == "sh"
          type: string
        filters:
          description: The platforms the Agent rule is supported on
          items:
            type: string
          type: array
        monitoring:
          description: The monitoring policies that the rule belongs to
          items:
            type: string
          type: array
        name:
          description: The name of the Agent rule.
          example: my_agent_rule
          type: string
        policy_id:
          description: The ID of the policy where the Agent rule is saved
          example: a8c8e364-6556-434d-b798-a4c23de29c0b
          type: string
        product_tags:
          description: The list of product tags associated with the rule
          items:
            type: string
          type: array
      required:
      - name
      - expression
      type: object
    CloudConfigurationRuleOptions:
      description: Options on cloud configuration rules.
      properties:
        complianceRuleOptions:
          $ref: '#/components/schemas/CloudConfigurationComplianceRuleOptions'
      required:
      - complianceRuleOptions
      type: object
    MonitorNotificationRuleRelationshipsCreatedByData:
      description: Data for the user who created the monitor notification rule.
      nullable: true
      properties:
        id:
          description: User ID of the monitor notification rule creator.
          example: 00000000-0000-1234-0000-000000000000
          type: string
        type:
          $ref: '#/components/schemas/UsersType'
      type: object
    SecurityMonitoringSuppressionUpdateRequest:
      description: Request object containing the fields to update on the suppression rule.
      properties:
        data:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionUpdateData'
      required:
      - data
      type: object
    RolesType:
      default: roles
      description: Roles type.
      enum:
      - roles
      example: roles
      type: string
      x-enum-varnames:
      - ROLES
    SecurityMonitoringStandardRuleResponse:
      description: Rule.
      properties:
        cases:
          description: Cases for generating signals.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleCase'
          type: array
        complianceSignalOptions:
          $ref: '#/components/schemas/CloudConfigurationRuleComplianceSignalOptions'
        createdAt:
          description: When the rule was created, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        creationAuthorId:
          description: User ID of the user who created the rule.
          format: int64
          type: integer
          example: 42
        defaultTags:
          description: Default Tags for default rules (included in tags)
          example:
          - security:attacks
          items:
            description: Default Tag.
            type: string
          type: array
        deprecationDate:
          description: When the rule will be deprecated, timestamp in milliseconds.
          format: int64
          type: integer
          example: 42
        filters:
          description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.
          items:
            $ref: '#/components/schemas/SecurityMonitoringFilter'
          type: array
        groupSignalsBy:
          description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
          example:
          - service
          items:
            description: Field to group by.
            type: string
          type: array
        hasExtendedTitle:
          description: Whether the notifications include the triggering group-by values in their title.
          type: boolean
          example: true
        id:
          description: The ID of the rule.
          type: string
          example: abc-123-def
        isDefault:
          description: Whether the rule is included by default.
          type: boolean
          example: true
        isDeleted:
          description: Whether the rule has been deleted.
          type: boolean
          example: true
        isEnabled:
          description: Whether the rule is enabled.
          type: boolean
          example: true
        message:
          description: Message for generated signals.
          type: string
          example: CPU usage is high on {{host.name}}
        name:
          description: The name of the rule.
          type: string
          example: Example Monitor
        options:
          $ref: '#/components/schemas/SecurityMonitoringRuleOptions'
        queries:
          description: Queries for selecting logs which are part of the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery'
          type: array
        referenceTables:
          description: Reference tables for the rule.
          items:
            $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
          type: array
        tags:
          description: Tags for generated signals.
          items:
            description: Tag.
            type: string
          type: array
        thirdPartyCases:
          description: Cases for generating signals from third-party rules. Only available for third-party rules.
          example: []
          items:
            $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCase'
          type: array
        type:
          $ref: '#/components/schemas/SecurityMonitoringRuleTypeRead'
        updateAuthorId:
          description: User ID of the user who updated the rule.
          format: int64
          type: integer
          example: 42
        updatedAt:
          description: The date the rule was last updated, in milliseconds.
          format: int64
          type: integer
          example: 42
        version:
          description: The version of the rule.
          format: int64
          type: integer
          example: 42
      type: object
    OutcomesResponseIncludedItem:
      description: Attributes of the included rule.
      properties:
        attributes:
          $ref: '#/components/schemas/OutcomesResponseIncludedRuleAttributes'
        id:
          $ref: '#/components/schemas/RuleId'
        type:
          $ref: '#/components/schemas/RuleType'
      type: object
    SecurityMonitoringRuleDetectionMethod:
      description: The detection method.
      enum:
      - threshold
      - new_value
      - anomaly_detection
      - impossible_travel
      - hardcoded
      - third_party
      - anomaly_threshold
      type: string
      x-enum-varnames:
      - THRESHOLD
      - NEW_VALUE
      - ANOMALY_DETECTION
      - IMPOSSIBLE_TRAVEL
      - HARDCODED
      - THIRD_PARTY
      - ANOMALY_THRESHOLD
    SecurityMonitoringSuppressionUpdateData:
      description: The new suppression properties; partial updates are supported.
      properties:
        attributes:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionUpdateAttributes'
        type:
          $ref: '#/components/schemas/SecurityMonitoringSuppressionType'
      required:
      - type
      - attributes
      type: object
    NotificationRuleQuery:
      description: The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
      example: (source:production_service OR env:prod)
      type: string
    SecurityMonitoringRuleTestRequest:
      description: Test the rule queries of a rule (rule property is ignored when applied to an existing rule)
      properties:
        rule:
          $ref: '#/components/schemas/SecurityMonitoringRuleTestPayload'
        ruleQueryPayloads:
          description: Data payloads used to test rules query with the expected result.
          items:
            $ref: '#/components/schemas/SecurityMonitoringRuleQueryPayload'
          type: array
      type: object
    CloudWorkloadSecurityAgentRuleActionSet:
      description: The set action applied on the scope matching the rule
      properties:
        append:
          description: Whether the value should be appended to the field
          type: boolean
          example: true
        field:
          description: The field of the set action
          type: string
          example: example_value
        name:
          description: The name of the set action
          type: string
          example: Example Monitor
        scope:
          description: The scope of the set action
          type: string
          example: example_value
        size:
          description: The size of the set action
          format: int64
          type: integer
          example: 42
        ttl:
          description: The time to live of the set action
          format: int64
          type: integer
          example: 42
        value:
          description: The value of the set action
          type: string
          example: example_value
      type: object
    ApplicationSecurityWafCustomRuleCreateData:
      description: Object for a single WAF custom rule.
      properties:
        attributes:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCreateAttributes'
        type:
          $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleType'
      required:
      - attributes
      - type
      type: object
    SendSlackMessageAction:
      description: Sends a message to a Slack channel.
      properties:
        channel:
          description: The channel ID.
          example: CHANNEL
          type: string
        type:
          $ref: '#/components/schemas/SendSlackMessageActionType'
        workspace:
          description: The workspace ID.
          example: WORKSPACE
          type: string
      required:
      - type
      - channel
      - workspace
      type: object
  parameters:
    SecurityMonitoringSuppressionID:
      description: The ID of the suppression rule
      in: path
      name: suppression_id
      required: true
      schema:
        type: string
    RuleId:
      description: The ID of the rule.
      in: path
      name: rule_id
      required: true
      schema:
        type: string
    PageSize:
      description: Size for a given page. The maximum allowed value is 100.
      in: query
      name: page[size]
      required: false
      schema:
        default: 10
        example: 10
        format: int64
        type: integer
    SensitiveDataScannerRuleID:
      description: The ID of the rule.
      in: path
      name: rule_id
      required: true
      schema:
        type: string
    PageNumber:
      description: Specific page number to return.
      in: query
      name: page[number]
      required: false
      schema:
        default: 0
        example: 0
        format: int64
        type: integer
    CloudWorkloadSecurityAgentRuleID:
      description: The ID of the Agent rule
      example: 3b5-v82-ns6
      in: path
      name: agent_rule_id
      required: true
      schema:
        type: string
    PageOffset:
      description: Specific offset to use as the beginning of the returned page.
      in: query
      name: page[offset]
      required: false
      schema:
        default: 0
        example: 0
        format: int64
        type: integer
    CloudWorkloadSecurityQueryAgentPolicyID:
      description: The ID of the Agent policy
      example: 6517fcc1-cec7-4394-a655-8d6e9d085255
      in: query
      name: policy_id
      required: false
      schema:
        type: string
    ApplicationSecurityWafCustomRuleIDParam:
      description: The ID of the custom rule.
      example: 3b5-v82-ns6
      in: path
      name: custom_rule_id
      required: true
      schema:
        type: string
    SecurityMonitoringRuleID:
      description: The ID of the rule.
      in: path
      name: rule_id
      required: true
      schema:
        type: string
  responses:
    NotFoundResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Not Found
    NotificationRulesList:
      content:
        application/json:
          schema:
            properties:
              data:
                items:
                  $ref: '#/components/schemas/NotificationRule'
                type: array
            type: object
      description: The list of notification rules.
    ForbiddenResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Forbidden
    ConflictResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Conflict
    ConcurrentModificationResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Concurrent Modification
    NotAuthorizedResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Not Authorized
    TooManyRequestsResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Too many requests
    BadRequestResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Bad Request
    UnprocessableEntityResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/JSONAPIErrorResponse'
      description: The server cannot process the request because it contains invalid data.
  securitySchemes:
    AuthZ:
      description: This API uses OAuth 2 with the implicit grant flow.
      flows:
        authorizationCode:
          authorizationUrl: /oauth2/v1/authorize
          scopes:
            apm_api_catalog_read: View API catalog and API definitions.
            apm_api_catalog_write: Add, modify, and delete API catalog definitions.
            apm_read: Read and query APM and Trace Analytics.
            apm_service_catalog_read: View service catalog and service definitions.
            apm_service_catalog_write: Add, modify, and delete service catalog definitions when those definitions are maintained by Datadog.
            appsec_vm_read: View infrastructure, application code, and library vulnerabilities. This does not restrict API or inventory SQL access to the vulnerability data source.
            cases_read: View Cases.
            cases_write: Create and update cases.
            ci_visibility_pipelines_write: Create CI Visibility pipeline spans using the API.
            ci_visibility_read: View CI Visibility.
            cloud_cost_management_read: View Cloud Cost pages and the cloud cost data source in dashboards and notebooks. For more details, see the Cloud Cost Management docs.
            cloud_cost_management_write: Configure cloud cost accounts and global customizations. For more details, see the Cloud Cost Management docs.
            code_analysis_read: View Code Analysis.
            continuous_profiler_pgo_read: Read and query Continuous Profiler data for Profile-Guided Optimization (PGO).
            create_webhooks: Create webhooks integrations.
            dashboards_embed_share: Create, modify, and delete shared dashboards with share type 'embed'.
            dashboards_invite_share: Create, modify, and delete shared dashboards with share type 'invite'.
            dashboards_public_share: Generate public and authenticated links to share dashboards or embeddable graphs externally.
            dashboards_read: View dashboards.
            dashboards_write: Create and change dashboards.
            data_scanner_read: View Data Scanner configurations.
            data_scanner_write: Edit Data Scanner configurations.
            embeddable_graphs_share: Generate public links to share embeddable graphs externally.
            events_read: Read Events data.
            hosts_read: List hosts and their attributes.
            incident_notification_settings_write: Configure Incidents Notification settings.
            incident_read: View incidents in Datadog.
            incident_settings_write: Configure Incident Settings.
            incident_write: Create, view, and manage incidents in Datadog.
            metrics_read: View custom metrics.
            monitor_config_policy_write: Edit and delete monitor configuration.
            monitors_downtime: Set downtimes to suppress alerts from any monitor in an organization. Mute and unmute monitors. The ability to write monitors is not required to set downtimes.
            monitors_read: View monitors.
            monitors_write: Edit, delete, and resolve individual monitors.
            org_management: Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.
            security_comments_read: Read comments of vulnerabilities.
            security_monitoring_filters_read: Read Security Filters.
            security_monitoring_filters_write: Create, edit, and delete Security Filters.
            security_monitoring_findings_read: View a list of findings that include both misconfigurations and identity risks.
            security_monitoring_notification_profiles_read: View Rule Security Notification rules.
            security_monitoring_notification_profiles_write: Create, edit, and delete Security Notification rules.
            security_monitoring_rules_read: Read Detection Rules.
            security_monitoring_rules_write: Create and edit Detection Rules.
            security_monitoring_signals_read: View Security Signals.
            security_monitoring_suppressions_read: Read Rule Suppressions.
            security_monitoring_suppressions_write: Write Rule Suppressions.
            security_pipelines_read: View Security Pipelines.
            security_pipelines_write: Create, edit, and delete CSM Security Pipelines.
            slos_corrections: Apply, edit, and delete SLO status corrections. A user with this permission can make status corrections, even if they do not have permission to edit those SLOs.
            slos_read: View SLOs and status corrections.
            slos_write: Create, edit, and delete SLOs.
            synthetics_global_variable_read: View, search, and use Synthetics global variables.
            synthetics_global_variable_write: Create, edit, and delete global variables for Synthetics.
            synthetics_private_location_read: View, search, and use Synthetics private locations.
            synthetics_private_location_write: Create and delete private locations in addition to having access to the associated installation guidelines.
            synthetics_read: List and view configured Synthetic tests and test results.
            synthetics_write: Create, edit, and delete Synthetic tests.
            teams_manage: Manage Teams. Create, delete, rename, and edit metadata of all Teams. To control Team membership across all Teams, use the User Access Manage permission.
            teams_read: Read Teams data. A User with this permission can view Team names, metadata, and which Users are on each Team.
            test_optimization_read: View Test Optimization.
            timeseries_query: Query Timeseries data.
            usage_read: View your organization's usage and usage attribution.
            user_access_invite: Invite other users to your organization.
            user_access_manage: Disable users, manage user roles, manage SAML-to-role mappings, and configure logs restriction queries.
            user_access_read: View users and their roles and settings.
            workflows_read: View workflows.
            workflows_run: Run workflows.
            workflows_write: Create, edit, and delete workflows.
          tokenUrl: /oauth2/v1/token
      type: oauth2
    apiKeyAuth:
      description: Your Datadog API Key.
      in: header
      name: DD-API-KEY
      type: apiKey
      x-env-name: DD_API_KEY
    appKeyAuth:
      description: Your Datadog APP Key.
      in: header
      name: DD-APPLICATION-KEY
      type: apiKey
      x-env-name: DD_APP_KEY
    bearerAuth:
      scheme: bearer
      type: http
      x-env-name: DD_BEARER_TOKEN
x-group-parameters: true
x-merge-override:
  paths: false