diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml index 23e9d015dee..e458c5669bf 100644 --- a/.generator/schemas/v2/openapi.yaml +++ b/.generator/schemas/v2/openapi.yaml @@ -1970,6 +1970,185 @@ components: required: true schema: type: string + SecurityAgentInvestigationFields: + description: Attributes to return, comma-separated. Defaults to all attributes. + example: + - state + - verdict + - conclusion + explode: false + in: query + name: fields[investigations] + required: false + schema: + items: + $ref: "#/components/schemas/SecurityAgentInvestigationField" + type: array + SecurityAgentInvestigationID: + description: The ID of the investigation, as returned by the list. + example: 7f3c9a2e-5d14-4e8b-9c61-2a0b4f8d1e53 + in: path + name: investigation_id + required: true + schema: + type: string + SecurityAgentInvestigationsCountField: + description: Field to count completed investigations by. + in: query + name: field + required: true + schema: + $ref: "#/components/schemas/SecurityAgentInvestigationCountField" + SecurityAgentInvestigationsFilterEntity: + description: |- + Only investigations whose signal has all of these entities. Write each entity as `attribute:value`, matching the + values returned by the count endpoint with `field=entity`. Comma-separated values; an investigation must have + every one of them. + example: "@usr.id:jane.doe" + in: query + name: filter[entity] + required: false + schema: + type: string + SecurityAgentInvestigationsFilterFrom: + description: Only investigations last updated at or after this time, as RFC 3339 or milliseconds since the epoch. + example: "2026-10-01T00:00:00Z" + in: query + name: filter[from] + required: false + schema: + type: string + SecurityAgentInvestigationsFilterRuleID: + description: |- + Only investigations of signals from one of these detection rule IDs. Comma-separated values; an + investigation matches any of them. + example: abc-def-ghi + in: query + name: filter[rule_id] + required: false + schema: + type: string + SecurityAgentInvestigationsFilterRuleType: + description: |- + Only investigations of signals from detection rules of one of these types, as returned by the count with + `field=rule_type`. Comma-separated values; an investigation matches any of them. + example: log_detection + in: query + name: filter[rule_type] + required: false + schema: + type: string + SecurityAgentInvestigationsFilterSignalID: + description: |- + List every investigation of this signal, newest first. Accepts the signal ID in its V1 form, which starts + with `AQ`, or in its longer V3 form, which starts with `Aw`. Investigations carry the V1 form, so their + `signal_id` can differ from the ID you pass. Can't be combined with other filters or with `sort`. + example: AQAAAaGNHjq4XzqcIQAAAABBWm8xY0wybUFBQmNYSjl1QUFBQUFBQUE + in: query + name: filter[signal_id] + required: false + schema: + type: string + SecurityAgentInvestigationsFilterSignalSeverity: + description: |- + Only investigations of signals with one of these severities: `info`, `low`, `medium`, `high`, or `critical`. + Comma-separated values; an investigation matches any of them. + example: high,critical + in: query + name: filter[signal_severity] + required: false + schema: + type: string + SecurityAgentInvestigationsFilterSignalSource: + description: |- + Only investigations of signals from one of these sources, as returned by the count with + `field=signal_source`. Comma-separated values; an investigation matches any of them. + example: okta + in: query + name: filter[signal_source] + required: false + schema: + type: string + SecurityAgentInvestigationsFilterState: + description: |- + Only investigations in one of these states: `investigating` or `completed`. Investigations reported as + `failed` match `investigating`. Comma-separated values; an investigation matches any of them. + example: completed + in: query + name: filter[state] + required: false + schema: + type: string + SecurityAgentInvestigationsFilterTags: + description: |- + Only investigations whose signal has all of these tags, written `key:value`. Comma-separated values; an + investigation must have every one of them. + example: env:prod + in: query + name: filter[tags] + required: false + schema: + type: string + SecurityAgentInvestigationsFilterTitle: + description: Only investigations whose signal title contains this text, case-insensitive. + example: login + in: query + name: filter[title] + required: false + schema: + type: string + SecurityAgentInvestigationsFilterTo: + description: Only investigations last updated at or before this time, as RFC 3339 or milliseconds since the epoch. + example: "2026-10-31T00:00:00Z" + in: query + name: filter[to] + required: false + schema: + type: string + SecurityAgentInvestigationsFilterVerdict: + description: |- + Only investigations with one of these verdicts: `benign`, `suspicious`, or `malicious`. + Comma-separated values; an investigation matches any of them. + example: suspicious,malicious + in: query + name: filter[verdict] + required: false + schema: + type: string + SecurityAgentInvestigationsPageNumber: + description: Page number, starting at 1. + example: 1 + in: query + name: page[number] + required: false + schema: + default: 1 + format: int64 + minimum: 1 + type: integer + SecurityAgentInvestigationsPageSize: + description: Number of investigations per page. + example: 25 + in: query + name: page[size] + required: false + schema: + default: 25 + format: int64 + maximum: 100 + minimum: 1 + type: integer + SecurityAgentInvestigationsSort: + description: |- + Sort field, prefixed with `-` for descending: `updated_at`, `severity`, `verdict`, `rule_id`, or `signal_title`. + Defaults to `-updated_at`. `verdict` sorts by severity (`benign`, `suspicious`, `malicious`), so `-verdict` puts + `malicious` first. + example: -updated_at + in: query + name: sort + required: false + schema: + type: string SecurityFilterID: description: The ID of the security filter. in: path @@ -114879,6 +115058,660 @@ components: - SYSTEM - LIGHT - DARK + SecurityAgentInvestigationAttributes: + description: |- + Attributes of an investigation. When `fields[investigations]` is set, only listed attributes are returned. + Attributes the investigation doesn't have yet are absent. + properties: + conclusion: + description: Summary of the investigation's findings. + example: The login came from a location the user travels to regularly, on a known device. + type: string + created_at: + description: When the investigation started. + example: "2026-10-30T14:02:40Z" + format: date-time + type: string + key_entities: + $ref: "#/components/schemas/SecurityAgentInvestigationKeyEntities" + key_evidence: + description: The evidence the verdict rests on. + items: + $ref: "#/components/schemas/SecurityAgentInvestigationKeyEvidence" + type: array + response_suggestions: + $ref: "#/components/schemas/SecurityAgentInvestigationResponseSuggestions" + rule_id: + description: ID of the detection rule that generated the signal. + example: abc-def-ghi + type: string + signal: + $ref: "#/components/schemas/SecurityAgentInvestigationSignal" + signal_id: + description: ID of the signal, in its V1 form. + example: AQAAAaGNHjq4XzqcIQAAAABBWm8xY0wybUFBQmNYSjl1QUFBQUFBQUE + type: string + state: + $ref: "#/components/schemas/SecurityAgentInvestigationState" + steps: + description: The steps of the investigation, in order. + items: + $ref: "#/components/schemas/SecurityAgentInvestigationStep" + type: array + updated_at: + description: When the investigation last changed. + example: "2026-10-30T14:15:02Z" + format: date-time + type: string + verdict: + $ref: "#/components/schemas/SecurityAgentInvestigationVerdict" + type: object + SecurityAgentInvestigationCount: + description: One value of the counted field and how many completed investigations have it. + properties: + count: + description: Number of completed investigations with this value. + example: 1250 + format: int64 + type: integer + value: + description: A value of the counted field. + example: benign + type: string + required: + - value + - count + type: object + SecurityAgentInvestigationCountField: + description: Field to count completed investigations by. + enum: + - verdict + - rule_type + - signal_source + - entity + example: verdict + type: string + x-enum-varnames: + - VERDICT + - RULE_TYPE + - SIGNAL_SOURCE + - ENTITY + SecurityAgentInvestigationCountsAttributes: + description: The counts of each value of the field. + properties: + counts: + description: One bucket per value, sorted by ascending count. + items: + $ref: "#/components/schemas/SecurityAgentInvestigationCount" + type: array + required: + - counts + type: object + SecurityAgentInvestigationCountsData: + description: Counts of completed investigations. + properties: + attributes: + $ref: "#/components/schemas/SecurityAgentInvestigationCountsAttributes" + id: + description: The counted field. + example: verdict + type: string + type: + $ref: "#/components/schemas/SecurityAgentInvestigationCountsType" + required: + - id + - type + - attributes + type: object + SecurityAgentInvestigationCountsResponse: + description: Completed investigations counted by the values of one field. + properties: + data: + $ref: "#/components/schemas/SecurityAgentInvestigationCountsData" + required: + - data + type: object + SecurityAgentInvestigationCountsType: + default: investigation_counts + description: Type of the investigation counts resource. + enum: + - investigation_counts + example: investigation_counts + type: string + x-enum-varnames: + - INVESTIGATION_COUNTS + SecurityAgentInvestigationData: + description: |- + An investigation and its content. `attributes` is absent when `fields[investigations]` is empty or lists + only attributes the investigation doesn't have. + properties: + attributes: + $ref: "#/components/schemas/SecurityAgentInvestigationAttributes" + id: + description: The ID of the investigation. + example: 7f3c9a2e-5d14-4e8b-9c61-2a0b4f8d1e53 + type: string + type: + $ref: "#/components/schemas/SecurityAgentInvestigationType" + required: + - id + - type + type: object + SecurityAgentInvestigationEntity: + description: An entity the investigation found. + properties: + sub_type: + description: More specific type of the entity. + example: okta_user + type: string + type: + description: Type of the entity, such as a user, a host, or an IP address. + example: user + type: string + value: + description: Value that identifies the entity. + example: jane.doe@example.com + type: string + required: + - type + - value + type: object + SecurityAgentInvestigationField: + description: An attribute of an investigation that `fields[investigations]` can select. + enum: + - signal_id + - rule_id + - state + - verdict + - conclusion + - signal + - key_entities + - key_evidence + - steps + - response_suggestions + - created_at + - updated_at + example: verdict + type: string + x-enum-varnames: + - SIGNAL_ID + - RULE_ID + - STATE + - VERDICT + - CONCLUSION + - SIGNAL + - KEY_ENTITIES + - KEY_EVIDENCE + - STEPS + - RESPONSE_SUGGESTIONS + - CREATED_AT + - UPDATED_AT + SecurityAgentInvestigationKeyEntities: + description: The entities the investigation found, by role. + properties: + actors: + description: Entities that performed the activity. + items: + $ref: "#/components/schemas/SecurityAgentInvestigationEntity" + type: array + targets: + description: Entities the activity was aimed at. + items: + $ref: "#/components/schemas/SecurityAgentInvestigationEntity" + type: array + required: + - actors + - targets + type: object + SecurityAgentInvestigationKeyEvidence: + description: A piece of evidence the verdict rests on. + properties: + category: + description: Category of the evidence. + example: Authentication + type: string + finding: + description: What the investigation found. + example: The user logged in from the same country three times in the last 30 days. + type: string + source_steps: + description: Names of the steps the evidence comes from. + example: + - Has the user logged in from this location before? + items: + type: string + type: array + required: + - category + - finding + type: object + SecurityAgentInvestigationListItem: + description: An investigation in a list. + properties: + attributes: + $ref: "#/components/schemas/SecurityAgentInvestigationListItemAttributes" + id: + description: The ID of the investigation. + example: 7f3c9a2e-5d14-4e8b-9c61-2a0b4f8d1e53 + type: string + type: + $ref: "#/components/schemas/SecurityAgentInvestigationType" + required: + - id + - type + - attributes + type: object + SecurityAgentInvestigationListItemAttributes: + description: |- + Attributes of an investigation in a list. To get an investigation's full content, use the get investigation + endpoint. + properties: + created_at: + description: When the investigation started. + example: "2026-10-30T14:02:40Z" + format: date-time + type: string + is_latest: + description: |- + Whether this is the latest investigation of the signal. Always true when `filter[signal_id]` isn't set. + example: true + type: boolean + rule_id: + description: ID of the detection rule that generated the signal. It can be empty while the investigation runs. + example: abc-def-ghi + type: string + signal: + $ref: "#/components/schemas/SecurityAgentInvestigationSignal" + signal_id: + description: ID of the signal, in its V1 form. + example: AQAAAaGNHjq4XzqcIQAAAABBWm8xY0wybUFBQmNYSjl1QUFBQUFBQUE + type: string + state: + $ref: "#/components/schemas/SecurityAgentInvestigationState" + updated_at: + description: When the investigation last changed. + example: "2026-10-30T14:15:02Z" + format: date-time + type: string + verdict: + $ref: "#/components/schemas/SecurityAgentInvestigationVerdict" + required: + - signal_id + - rule_id + - state + - is_latest + type: object + SecurityAgentInvestigationMitigationAction: + description: An action that applies a mitigation. + properties: + applied: + description: Whether the action has run. + example: false + type: boolean + applied_at: + description: When the action ran. + example: "2026-10-30T14:20:00Z" + format: date-time + type: string + applied_by: + description: Who ran the action. + example: john.smith@example.com + type: string + fqn: + description: ID of the action in the Action Catalog. + example: com.datadoghq.okta.suspend_user + type: string + id: + description: ID of the action. + example: action-1 + type: string + name: + description: Name of the action in the Action Catalog. + example: Suspend user + type: string + resource: + description: The resource the action changes. + example: jane.doe@example.com + type: string + source: + description: Integration that runs the action, such as `dd`, `aws`, or `okta`. + example: okta + type: string + source_connected: + description: Whether the organization has a connection that can run the action. + example: true + type: boolean + target: + description: What the action targets. + example: jane.doe@example.com + type: string + required: + - id + - source + - source_connected + - applied + type: object + SecurityAgentInvestigationMitigationSuggestion: + description: A suggested mitigation. + properties: + actions: + description: Actions that apply the mitigation. + items: + $ref: "#/components/schemas/SecurityAgentInvestigationMitigationAction" + type: array + id: + description: ID of the mitigation. + example: mitigation-1 + type: string + rationale: + description: Why the mitigation is suggested. + example: Only needed if the user doesn't confirm the login. + type: string + recommended: + description: Whether the mitigation is recommended. + example: false + type: boolean + scope_note: + description: What the mitigation applies to. + example: jane.doe@example.com + type: string + step: + description: Order in which to apply the mitigation, starting at 1. + example: 1 + format: int64 + type: integer + title: + description: Title of the mitigation. + example: Suspend the user + type: string + required: + - id + - title + - rationale + - step + - recommended + type: object + SecurityAgentInvestigationNoRunReason: + description: |- + Why `filter[signal_id]` returned no investigation. Set only on the first page of an empty result. The reason is + based on the organization's current settings. Poll again only on `investigation_not_started`, after the number + of seconds in the `Retry-After` header; treat the others as final for this signal. + - `investigation_not_started`: no investigation has started yet, but one may still start. + - `not_investigated`: no investigation started within an hour of the signal, so none is expected. The signal + was skipped for a reason this API doesn't report, such as its severity or a rate limit. + - `rule_not_enabled`: the signal's detection rule doesn't have Bits Security Analyst enabled, so no + investigation starts automatically. + - `signal_not_found`: the ID isn't a signal ID, or no signal with this ID exists in the organization. + - `org_not_activated`: the organization hasn't activated Bits Security Analyst. + enum: + - investigation_not_started + - not_investigated + - rule_not_enabled + - signal_not_found + - org_not_activated + example: investigation_not_started + type: string + x-enum-varnames: + - INVESTIGATION_NOT_STARTED + - NOT_INVESTIGATED + - RULE_NOT_ENABLED + - SIGNAL_NOT_FOUND + - ORG_NOT_ACTIVATED + SecurityAgentInvestigationResponse: + description: An investigation. + properties: + data: + $ref: "#/components/schemas/SecurityAgentInvestigationData" + required: + - data + type: object + SecurityAgentInvestigationResponseSuggestions: + description: Suggested responses to the signal. + properties: + mitigation_suggestions: + description: Suggested mitigations, in the order to apply them. + items: + $ref: "#/components/schemas/SecurityAgentInvestigationMitigationSuggestion" + type: array + rule_tuning_suggestions: + $ref: "#/components/schemas/SecurityAgentInvestigationRuleTuningSuggestions" + type: object + SecurityAgentInvestigationRuleTuningCondition: + description: A condition of a rule tuning suggestion. + properties: + field: + description: Attribute the condition checks. + example: "@usr.device.id" + type: string + value: + description: Value the attribute is compared with. + example: 4b8f2c1e-9a7d-4e3b-8c5f-1d2e3f4a5b6c + type: string + required: + - field + - value + type: object + SecurityAgentInvestigationRuleTuningSuggestion: + description: A suggestion to tune the detection rule. + properties: + action_type: + description: Kind of change the suggestion makes to the rule. + example: create_suppression + type: string + conditions: + description: The conditions the change applies to. + items: + $ref: "#/components/schemas/SecurityAgentInvestigationRuleTuningCondition" + type: array + description: + description: What the suggestion changes. + example: Don't generate signals for logins from devices the user has used before. + type: string + estimated_silenced_count: + description: Estimated number of signals the change would have silenced in the window. + example: 85 + format: int64 + type: integer + id: + description: ID of the suggestion. + example: suggestion-1 + type: string + match_logic: + description: How the conditions combine, such as AND or OR. + example: AND + type: string + recommended: + description: Whether the suggestion is recommended. + example: true + type: boolean + rule_id: + description: ID of the detection rule. + example: abc-def-ghi + type: string + title: + description: Title of the suggestion. + example: Suppress logins from known devices + type: string + warning: + description: What the change could hide. It can be empty. + example: A stolen known device would no longer trigger this rule. + type: string + why: + description: Why the suggestion is made. + example: The user's known devices accounted for most benign signals. + type: string + required: + - id + - title + - action_type + - rule_id + - description + - match_logic + - conditions + - why + - recommended + - warning + type: object + SecurityAgentInvestigationRuleTuningSuggestions: + description: Suggestions to tune the detection rule that generated the signal. + properties: + occurrence_window_days: + description: Length of the window, in days. + example: 30 + format: int64 + type: integer + reasoning: + description: Why tuning the rule is suggested. + example: Most signals from this rule in the last 30 days were benign travel. + type: string + rule_id: + description: ID of the detection rule. + example: abc-def-ghi + type: string + rule_name: + description: Name of the detection rule. + example: Unusual login location for a user + type: string + rule_signal_total: + description: Number of signals the rule generated in the window. + example: 120 + format: int64 + type: integer + suggestions: + description: The tuning suggestions. + items: + $ref: "#/components/schemas/SecurityAgentInvestigationRuleTuningSuggestion" + type: array + summary: + description: Summary of the suggestions. + example: The rule fires often for users who travel to known locations. + type: string + required: + - summary + - reasoning + - rule_id + - rule_name + - rule_signal_total + - occurrence_window_days + - suggestions + type: object + SecurityAgentInvestigationSignal: + description: Summary of the signal the investigation is about. + properties: + severity: + description: "Severity of the signal: `info`, `low`, `medium`, `high`, or `critical`." + example: medium + type: string + sources: + description: Sources of the signal. + example: + - okta + items: + type: string + type: array + tactic: + description: MITRE ATT&CK tactic, from the signal's `tactic` tag. + example: TA0001-initial-access + type: string + tags: + description: Tags of the signal, written `key:value`. + example: + - "source:okta" + items: + type: string + type: array + technique: + description: MITRE ATT&CK technique, from the signal's `technique` tag. + example: T1078-valid-accounts + type: string + timestamp: + description: Time the signal was generated. + example: "2026-10-30T14:02:11Z" + type: string + title: + description: Title of the signal. + example: Unusual login location for a user + type: string + type: object + SecurityAgentInvestigationState: + description: |- + State of the investigation: `investigating` while it runs, `completed` after it has a result, or `failed` + when it produced no result before its timeout. + enum: + - investigating + - completed + - failed + example: completed + type: string + x-enum-varnames: + - INVESTIGATING + - COMPLETED + - FAILED + SecurityAgentInvestigationStep: + description: A step of the investigation. + properties: + name: + description: Name of the step, usually the question it answers. + example: Has the user logged in from this location before? + type: string + summary: + description: Summary of what the step found. It can be empty. + example: Three earlier logins from the same country, on the same device. + type: string + required: + - name + - summary + type: object + SecurityAgentInvestigationType: + default: investigations + description: Type of the investigation resource. + enum: + - investigations + example: investigations + type: string + x-enum-varnames: + - INVESTIGATIONS + SecurityAgentInvestigationVerdict: + description: Verdict of the investigation. Only completed investigations have one. + enum: + - benign + - suspicious + - malicious + example: benign + type: string + x-enum-varnames: + - BENIGN + - SUSPICIOUS + - MALICIOUS + SecurityAgentInvestigationsListMeta: + description: Metadata of a page of investigations. + properties: + reason: + $ref: "#/components/schemas/SecurityAgentInvestigationNoRunReason" + total_count: + description: |- + Without `filter[signal_id]`, the number of signals that match the filters. With `filter[signal_id]`, the + number of investigations of that signal. Pages past the last page return 0. + example: 1 + format: int64 + type: integer + required: + - total_count + type: object + SecurityAgentInvestigationsListResponse: + description: A page of investigations. + properties: + data: + description: The investigations on this page. + items: + $ref: "#/components/schemas/SecurityAgentInvestigationListItem" + type: array + meta: + $ref: "#/components/schemas/SecurityAgentInvestigationsListMeta" + required: + - data + - meta + type: object SecurityAutomationRulesLinks: description: Pagination links for the list of automation rules. properties: @@ -238792,6 +239625,329 @@ paths: x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). + /api/v2/security_monitoring/security_agent/investigations: + get: + description: |- + List Bits Security Analyst investigations. + + Without `filter[signal_id]`, returns the latest investigation of each signal, filtered, sorted, and paginated. + With `filter[signal_id]`, returns every investigation of that signal, newest first. When the signal has no + investigation, the first page carries `meta.reason`, which says why. + operationId: ListSecurityAgentInvestigations + parameters: + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterSignalID" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterTitle" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterFrom" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterTo" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterVerdict" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterState" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterRuleID" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterRuleType" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterSignalSeverity" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterSignalSource" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterTags" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterEntity" + - $ref: "#/components/parameters/SecurityAgentInvestigationsSort" + - $ref: "#/components/parameters/SecurityAgentInvestigationsPageNumber" + - $ref: "#/components/parameters/SecurityAgentInvestigationsPageSize" + responses: + "200": + content: + application/json: + examples: + default: + summary: The latest investigation of each signal + value: + data: + - attributes: + created_at: "2026-10-30T14:02:40Z" + is_latest: true + rule_id: abc-def-ghi + signal: + severity: medium + sources: + - okta + tactic: TA0001-initial-access + tags: + - "source:okta" + - "tactic:TA0001-initial-access" + - "technique:T1078-valid-accounts" + technique: T1078-valid-accounts + timestamp: "2026-10-30T14:02:11Z" + title: Unusual login location for a user + signal_id: AQAAAaGNHjq4XzqcIQAAAABBWm8xY0wybUFBQmNYSjl1QUFBQUFBQUE + state: completed + updated_at: "2026-10-30T14:15:02Z" + verdict: benign + id: 7f3c9a2e-5d14-4e8b-9c61-2a0b4f8d1e53 + type: investigations + meta: + total_count: 1 + investigation_not_started: + summary: A signal with no investigation yet + value: + data: [] + meta: + reason: investigation_not_started + total_count: 0 + not_investigated: + summary: A signal that won't be investigated + value: + data: [] + meta: + reason: not_investigated + total_count: 0 + schema: + $ref: "#/components/schemas/SecurityAgentInvestigationsListResponse" + description: OK + headers: + Retry-After: + description: |- + Present when `meta.reason` is `investigation_not_started`: the number of seconds to wait before + listing the signal's investigations again. + schema: + description: Seconds to wait. + example: 60 + format: int64 + type: integer + "400": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Bad Request + "403": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Forbidden + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_signals_read + summary: List Bits Security Analyst investigations + tags: + - Bits Security Analyst + "x-permission": + operator: OR + permissions: + - security_monitoring_signals_read + x-unstable: |- + **Note**: This endpoint is in preview and is subject to change. + To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. + /api/v2/security_monitoring/security_agent/investigations/count: + get: + description: |- + Count completed Bits Security Analyst investigations by the values of one field. Buckets are sorted by + ascending count. With `field=entity` or `field=signal_source`, an investigation counts in the bucket of + each of its entities or sources. + operationId: CountSecurityAgentInvestigations + parameters: + - $ref: "#/components/parameters/SecurityAgentInvestigationsCountField" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterTitle" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterFrom" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterTo" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterVerdict" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterRuleID" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterRuleType" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterSignalSeverity" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterSignalSource" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterTags" + - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterEntity" + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + attributes: + counts: + - count: 3 + value: malicious + - count: 41 + value: suspicious + - count: 1250 + value: benign + id: verdict + type: investigation_counts + schema: + $ref: "#/components/schemas/SecurityAgentInvestigationCountsResponse" + description: OK + "400": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Bad Request + "403": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Forbidden + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_signals_read + summary: Count Bits Security Analyst investigations + tags: + - Bits Security Analyst + "x-permission": + operator: OR + permissions: + - security_monitoring_signals_read + x-unstable: |- + **Note**: This endpoint is in preview and is subject to change. + To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. + /api/v2/security_monitoring/security_agent/investigations/{investigation_id}: + get: + description: |- + Get a Bits Security Analyst investigation by its ID, with its verdict, conclusion, evidence, steps, and + response suggestions. While the investigation is running, the response has a `Retry-After` header. + operationId: GetSecurityAgentInvestigation + parameters: + - $ref: "#/components/parameters/SecurityAgentInvestigationID" + - $ref: "#/components/parameters/SecurityAgentInvestigationFields" + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + attributes: + conclusion: The login came from a location the user travels to regularly, on a known device. + created_at: "2026-10-30T14:02:40Z" + key_entities: + actors: + - type: user + value: jane.doe@example.com + targets: + - sub_type: okta_app + type: application + value: Corporate VPN + key_evidence: + - category: Authentication + finding: The user logged in from the same country three times in the last 30 days. + source_steps: + - Has the user logged in from this location before? + response_suggestions: + mitigation_suggestions: + - actions: + - applied: false + fqn: com.datadoghq.okta.suspend_user + id: action-1 + name: Suspend user + source: okta + source_connected: true + target: jane.doe@example.com + id: mitigation-1 + rationale: Only needed if the user doesn't confirm the login. + recommended: false + scope_note: jane.doe@example.com + step: 1 + title: Suspend the user + rule_tuning_suggestions: + occurrence_window_days: 30 + reasoning: Most signals from this rule in the last 30 days were benign travel. + rule_id: abc-def-ghi + rule_name: Unusual login location for a user + rule_signal_total: 120 + suggestions: + - action_type: create_suppression + conditions: + - field: "@usr.device.id" + value: 4b8f2c1e-9a7d-4e3b-8c5f-1d2e3f4a5b6c + description: Don't generate signals for logins from devices the user has used before. + estimated_silenced_count: 85 + id: suggestion-1 + match_logic: AND + recommended: true + rule_id: abc-def-ghi + title: Suppress logins from known devices + warning: A stolen known device would no longer trigger this rule. + why: The user's known devices accounted for most benign signals. + summary: The rule fires often for users who travel to known locations. + rule_id: abc-def-ghi + signal: + severity: medium + sources: + - okta + tactic: TA0001-initial-access + tags: + - "source:okta" + - "tactic:TA0001-initial-access" + - "technique:T1078-valid-accounts" + technique: T1078-valid-accounts + timestamp: "2026-10-30T14:02:11Z" + title: Unusual login location for a user + signal_id: AQAAAaGNHjq4XzqcIQAAAABBWm8xY0wybUFBQmNYSjl1QUFBQUFBQUE + state: completed + steps: + - name: Has the user logged in from this location before? + summary: Three earlier logins from the same country, on the same device. + updated_at: "2026-10-30T14:15:02Z" + verdict: benign + id: 7f3c9a2e-5d14-4e8b-9c61-2a0b4f8d1e53 + type: investigations + schema: + $ref: "#/components/schemas/SecurityAgentInvestigationResponse" + description: OK + headers: + Retry-After: + description: |- + Present while `state` is `investigating`: the number of seconds to wait before getting the + investigation again. + schema: + description: Seconds to wait. + example: 300 + format: int64 + type: integer + "400": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Bad Request + "403": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Forbidden + "404": + content: + application/json: + schema: + $ref: "#/components/schemas/JSONAPIErrorResponse" + description: Not Found + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_signals_read + summary: Get a Bits Security Analyst investigation + tags: + - Bits Security Analyst + "x-permission": + operator: OR + permissions: + - security_monitoring_signals_read + x-unstable: |- + **Note**: This endpoint is in preview and is subject to change. + To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. /api/v2/security_monitoring/signals: get: description: |- @@ -258853,6 +260009,10 @@ tags: - description: |- Use the Bits AI endpoints to retrieve AI-powered investigations. name: Bits AI + - description: |- + Use the Bits Security Analyst endpoints to find the investigations of your Cloud SIEM signals, read an + investigation's verdict and findings, and count investigations. + name: Bits Security Analyst - description: |- Manage CI Visibility opt-in status for your GitHub accounts and repositories. See the [CI Visibility GitHub Actions setup page](https://docs.datadoghq.com/continuous_integration/pipelines/github/) diff --git a/examples/v2/bits-security-analyst/CountSecurityAgentInvestigations.java b/examples/v2/bits-security-analyst/CountSecurityAgentInvestigations.java new file mode 100644 index 00000000000..322ea0bff38 --- /dev/null +++ b/examples/v2/bits-security-analyst/CountSecurityAgentInvestigations.java @@ -0,0 +1,30 @@ +// Count Bits Security Analyst investigations returns "OK" response + +import com.datadog.api.client.ApiClient; +import com.datadog.api.client.ApiException; +import com.datadog.api.client.v2.api.BitsSecurityAnalystApi; +import com.datadog.api.client.v2.model.SecurityAgentInvestigationCountField; +import com.datadog.api.client.v2.model.SecurityAgentInvestigationCountsResponse; + +public class Example { + public static void main(String[] args) { + ApiClient defaultClient = ApiClient.getDefaultApiClient(); + defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN")); + defaultClient.setUnstableOperationEnabled("v2.countSecurityAgentInvestigations", true); + BitsSecurityAnalystApi apiInstance = new BitsSecurityAnalystApi(defaultClient); + + try { + SecurityAgentInvestigationCountsResponse result = + apiInstance.countSecurityAgentInvestigations( + SecurityAgentInvestigationCountField.VERDICT); + System.out.println(result); + } catch (ApiException e) { + System.err.println( + "Exception when calling BitsSecurityAnalystApi#countSecurityAgentInvestigations"); + System.err.println("Status code: " + e.getCode()); + System.err.println("Reason: " + e.getResponseBody()); + System.err.println("Response headers: " + e.getResponseHeaders()); + e.printStackTrace(); + } + } +} diff --git a/examples/v2/bits-security-analyst/GetSecurityAgentInvestigation.java b/examples/v2/bits-security-analyst/GetSecurityAgentInvestigation.java new file mode 100644 index 00000000000..68df9ba1451 --- /dev/null +++ b/examples/v2/bits-security-analyst/GetSecurityAgentInvestigation.java @@ -0,0 +1,28 @@ +// Get a Bits Security Analyst investigation returns "OK" response + +import com.datadog.api.client.ApiClient; +import com.datadog.api.client.ApiException; +import com.datadog.api.client.v2.api.BitsSecurityAnalystApi; +import com.datadog.api.client.v2.model.SecurityAgentInvestigationResponse; + +public class Example { + public static void main(String[] args) { + ApiClient defaultClient = ApiClient.getDefaultApiClient(); + defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN")); + defaultClient.setUnstableOperationEnabled("v2.getSecurityAgentInvestigation", true); + BitsSecurityAnalystApi apiInstance = new BitsSecurityAnalystApi(defaultClient); + + try { + SecurityAgentInvestigationResponse result = + apiInstance.getSecurityAgentInvestigation("7f3c9a2e-5d14-4e8b-9c61-2a0b4f8d1e53"); + System.out.println(result); + } catch (ApiException e) { + System.err.println( + "Exception when calling BitsSecurityAnalystApi#getSecurityAgentInvestigation"); + System.err.println("Status code: " + e.getCode()); + System.err.println("Reason: " + e.getResponseBody()); + System.err.println("Response headers: " + e.getResponseHeaders()); + e.printStackTrace(); + } + } +} diff --git a/examples/v2/bits-security-analyst/ListSecurityAgentInvestigations.java b/examples/v2/bits-security-analyst/ListSecurityAgentInvestigations.java new file mode 100644 index 00000000000..0745904235a --- /dev/null +++ b/examples/v2/bits-security-analyst/ListSecurityAgentInvestigations.java @@ -0,0 +1,30 @@ +// List Bits Security Analyst investigations returns "OK" response + +import com.datadog.api.client.ApiClient; +import com.datadog.api.client.ApiException; +import com.datadog.api.client.v2.api.BitsSecurityAnalystApi; +import com.datadog.api.client.v2.api.BitsSecurityAnalystApi.ListSecurityAgentInvestigationsOptionalParameters; +import com.datadog.api.client.v2.model.SecurityAgentInvestigationsListResponse; + +public class Example { + public static void main(String[] args) { + ApiClient defaultClient = ApiClient.getDefaultApiClient(); + defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN")); + defaultClient.setUnstableOperationEnabled("v2.listSecurityAgentInvestigations", true); + BitsSecurityAnalystApi apiInstance = new BitsSecurityAnalystApi(defaultClient); + + try { + SecurityAgentInvestigationsListResponse result = + apiInstance.listSecurityAgentInvestigations( + new ListSecurityAgentInvestigationsOptionalParameters().pageSize(1L)); + System.out.println(result); + } catch (ApiException e) { + System.err.println( + "Exception when calling BitsSecurityAnalystApi#listSecurityAgentInvestigations"); + System.err.println("Status code: " + e.getCode()); + System.err.println("Reason: " + e.getResponseBody()); + System.err.println("Response headers: " + e.getResponseHeaders()); + e.printStackTrace(); + } + } +} diff --git a/src/main/java/com/datadog/api/client/ApiClient.java b/src/main/java/com/datadog/api/client/ApiClient.java index 0cfcabea1c1..6e7ea9d7611 100644 --- a/src/main/java/com/datadog/api/client/ApiClient.java +++ b/src/main/java/com/datadog/api/client/ApiClient.java @@ -1643,6 +1643,9 @@ public class ApiClient { put("v2.getEntityRiskScore", false); put("v2.listEntityRiskScores", false); put("v2.addSTIXThreatIntel", false); + put("v2.countSecurityAgentInvestigations", false); + put("v2.getSecurityAgentInvestigation", false); + put("v2.listSecurityAgentInvestigations", false); put("v2.createSLOReportJob", false); put("v2.getSLOReport", false); put("v2.getSLOReportJobStatus", false); diff --git a/src/main/java/com/datadog/api/client/v2/api/BitsSecurityAnalystApi.java b/src/main/java/com/datadog/api/client/v2/api/BitsSecurityAnalystApi.java new file mode 100644 index 00000000000..0c337629b3f --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/api/BitsSecurityAnalystApi.java @@ -0,0 +1,1145 @@ +package com.datadog.api.client.v2.api; + +import com.datadog.api.client.ApiClient; +import com.datadog.api.client.ApiException; +import com.datadog.api.client.ApiResponse; +import com.datadog.api.client.Pair; +import com.datadog.api.client.v2.model.SecurityAgentInvestigationCountField; +import com.datadog.api.client.v2.model.SecurityAgentInvestigationCountsResponse; +import com.datadog.api.client.v2.model.SecurityAgentInvestigationField; +import com.datadog.api.client.v2.model.SecurityAgentInvestigationResponse; +import com.datadog.api.client.v2.model.SecurityAgentInvestigationsListResponse; +import jakarta.ws.rs.client.Invocation; +import jakarta.ws.rs.core.GenericType; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.concurrent.CompletableFuture; + +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class BitsSecurityAnalystApi { + private ApiClient apiClient; + + public BitsSecurityAnalystApi() { + this(ApiClient.getDefaultApiClient()); + } + + public BitsSecurityAnalystApi(ApiClient apiClient) { + this.apiClient = apiClient; + } + + /** + * Get the API client. + * + * @return API client + */ + public ApiClient getApiClient() { + return apiClient; + } + + /** + * Set the API client. + * + * @param apiClient an instance of API client + */ + public void setApiClient(ApiClient apiClient) { + this.apiClient = apiClient; + } + + /** Manage optional parameters to countSecurityAgentInvestigations. */ + public static class CountSecurityAgentInvestigationsOptionalParameters { + private String filterTitle; + private String filterFrom; + private String filterTo; + private String filterVerdict; + private String filterRuleId; + private String filterRuleType; + private String filterSignalSeverity; + private String filterSignalSource; + private String filterTags; + private String filterEntity; + + /** + * Set filterTitle. + * + * @param filterTitle Only investigations whose signal title contains this text, + * case-insensitive. (optional) + * @return CountSecurityAgentInvestigationsOptionalParameters + */ + public CountSecurityAgentInvestigationsOptionalParameters filterTitle(String filterTitle) { + this.filterTitle = filterTitle; + return this; + } + + /** + * Set filterFrom. + * + * @param filterFrom Only investigations last updated at or after this time, as RFC 3339 or + * milliseconds since the epoch. (optional) + * @return CountSecurityAgentInvestigationsOptionalParameters + */ + public CountSecurityAgentInvestigationsOptionalParameters filterFrom(String filterFrom) { + this.filterFrom = filterFrom; + return this; + } + + /** + * Set filterTo. + * + * @param filterTo Only investigations last updated at or before this time, as RFC 3339 or + * milliseconds since the epoch. (optional) + * @return CountSecurityAgentInvestigationsOptionalParameters + */ + public CountSecurityAgentInvestigationsOptionalParameters filterTo(String filterTo) { + this.filterTo = filterTo; + return this; + } + + /** + * Set filterVerdict. + * + * @param filterVerdict Only investigations with one of these verdicts: benign, + * suspicious, or malicious. Comma-separated values; an + * investigation matches any of them. (optional) + * @return CountSecurityAgentInvestigationsOptionalParameters + */ + public CountSecurityAgentInvestigationsOptionalParameters filterVerdict(String filterVerdict) { + this.filterVerdict = filterVerdict; + return this; + } + + /** + * Set filterRuleId. + * + * @param filterRuleId Only investigations of signals from one of these detection rule IDs. + * Comma-separated values; an investigation matches any of them. (optional) + * @return CountSecurityAgentInvestigationsOptionalParameters + */ + public CountSecurityAgentInvestigationsOptionalParameters filterRuleId(String filterRuleId) { + this.filterRuleId = filterRuleId; + return this; + } + + /** + * Set filterRuleType. + * + * @param filterRuleType Only investigations of signals from detection rules of one of these + * types, as returned by the count with field=rule_type. Comma-separated + * values; an investigation matches any of them. (optional) + * @return CountSecurityAgentInvestigationsOptionalParameters + */ + public CountSecurityAgentInvestigationsOptionalParameters filterRuleType( + String filterRuleType) { + this.filterRuleType = filterRuleType; + return this; + } + + /** + * Set filterSignalSeverity. + * + * @param filterSignalSeverity Only investigations of signals with one of these severities: + * info, low, medium, high, or + * critical. Comma-separated values; an investigation matches any of them. (optional) + * @return CountSecurityAgentInvestigationsOptionalParameters + */ + public CountSecurityAgentInvestigationsOptionalParameters filterSignalSeverity( + String filterSignalSeverity) { + this.filterSignalSeverity = filterSignalSeverity; + return this; + } + + /** + * Set filterSignalSource. + * + * @param filterSignalSource Only investigations of signals from one of these sources, as + * returned by the count with field=signal_source. Comma-separated values; an + * investigation matches any of them. (optional) + * @return CountSecurityAgentInvestigationsOptionalParameters + */ + public CountSecurityAgentInvestigationsOptionalParameters filterSignalSource( + String filterSignalSource) { + this.filterSignalSource = filterSignalSource; + return this; + } + + /** + * Set filterTags. + * + * @param filterTags Only investigations whose signal has all of these tags, written + * key:value. Comma-separated values; an investigation must have every one of them. + * (optional) + * @return CountSecurityAgentInvestigationsOptionalParameters + */ + public CountSecurityAgentInvestigationsOptionalParameters filterTags(String filterTags) { + this.filterTags = filterTags; + return this; + } + + /** + * Set filterEntity. + * + * @param filterEntity Only investigations whose signal has all of these entities. Write each + * entity as attribute:value, matching the values returned by the count + * endpoint with field=entity. Comma-separated values; an investigation must + * have every one of them. (optional) + * @return CountSecurityAgentInvestigationsOptionalParameters + */ + public CountSecurityAgentInvestigationsOptionalParameters filterEntity(String filterEntity) { + this.filterEntity = filterEntity; + return this; + } + } + + /** + * Count Bits Security Analyst investigations. + * + *

See {@link #countSecurityAgentInvestigationsWithHttpInfo}. + * + * @param field Field to count completed investigations by. (required) + * @return SecurityAgentInvestigationCountsResponse + * @throws ApiException if fails to make API call + */ + public SecurityAgentInvestigationCountsResponse countSecurityAgentInvestigations( + SecurityAgentInvestigationCountField field) throws ApiException { + return countSecurityAgentInvestigationsWithHttpInfo( + field, new CountSecurityAgentInvestigationsOptionalParameters()) + .getData(); + } + + /** + * Count Bits Security Analyst investigations. + * + *

See {@link #countSecurityAgentInvestigationsWithHttpInfoAsync}. + * + * @param field Field to count completed investigations by. (required) + * @return CompletableFuture<SecurityAgentInvestigationCountsResponse> + */ + public CompletableFuture + countSecurityAgentInvestigationsAsync(SecurityAgentInvestigationCountField field) { + return countSecurityAgentInvestigationsWithHttpInfoAsync( + field, new CountSecurityAgentInvestigationsOptionalParameters()) + .thenApply( + response -> { + return response.getData(); + }); + } + + /** + * Count Bits Security Analyst investigations. + * + *

See {@link #countSecurityAgentInvestigationsWithHttpInfo}. + * + * @param field Field to count completed investigations by. (required) + * @param parameters Optional parameters for the request. + * @return SecurityAgentInvestigationCountsResponse + * @throws ApiException if fails to make API call + */ + public SecurityAgentInvestigationCountsResponse countSecurityAgentInvestigations( + SecurityAgentInvestigationCountField field, + CountSecurityAgentInvestigationsOptionalParameters parameters) + throws ApiException { + return countSecurityAgentInvestigationsWithHttpInfo(field, parameters).getData(); + } + + /** + * Count Bits Security Analyst investigations. + * + *

See {@link #countSecurityAgentInvestigationsWithHttpInfoAsync}. + * + * @param field Field to count completed investigations by. (required) + * @param parameters Optional parameters for the request. + * @return CompletableFuture<SecurityAgentInvestigationCountsResponse> + */ + public CompletableFuture + countSecurityAgentInvestigationsAsync( + SecurityAgentInvestigationCountField field, + CountSecurityAgentInvestigationsOptionalParameters parameters) { + return countSecurityAgentInvestigationsWithHttpInfoAsync(field, parameters) + .thenApply( + response -> { + return response.getData(); + }); + } + + /** + * Count completed Bits Security Analyst investigations by the values of one field. Buckets are + * sorted by ascending count. With field=entity or field=signal_source, + * an investigation counts in the bucket of each of its entities or sources. + * + * @param field Field to count completed investigations by. (required) + * @param parameters Optional parameters for the request. + * @return ApiResponse<SecurityAgentInvestigationCountsResponse> + * @throws ApiException if fails to make API call + * @http.response.details + * + * + * + * + * + * + * + *
Response details
Status Code Description Response Headers
200 OK -
400 Bad Request -
403 Forbidden -
429 Too many requests -
+ */ + public ApiResponse + countSecurityAgentInvestigationsWithHttpInfo( + SecurityAgentInvestigationCountField field, + CountSecurityAgentInvestigationsOptionalParameters parameters) + throws ApiException { + // Check if unstable operation is enabled + String operationId = "countSecurityAgentInvestigations"; + if (apiClient.isUnstableOperationEnabled("v2." + operationId)) { + apiClient.getLogger().warning(String.format("Using unstable operation '%s'", operationId)); + } else { + throw new ApiException(0, String.format("Unstable operation '%s' is disabled", operationId)); + } + Object localVarPostBody = null; + + // verify the required parameter 'field' is set + if (field == null) { + throw new ApiException( + 400, + "Missing the required parameter 'field' when calling countSecurityAgentInvestigations"); + } + String filterTitle = parameters.filterTitle; + String filterFrom = parameters.filterFrom; + String filterTo = parameters.filterTo; + String filterVerdict = parameters.filterVerdict; + String filterRuleId = parameters.filterRuleId; + String filterRuleType = parameters.filterRuleType; + String filterSignalSeverity = parameters.filterSignalSeverity; + String filterSignalSource = parameters.filterSignalSource; + String filterTags = parameters.filterTags; + String filterEntity = parameters.filterEntity; + // create path and map variables + String localVarPath = "/api/v2/security_monitoring/security_agent/investigations/count"; + + List localVarQueryParams = new ArrayList(); + Map localVarHeaderParams = new HashMap(); + + localVarQueryParams.addAll(apiClient.parameterToPairs("", "field", field)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[title]", filterTitle)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[from]", filterFrom)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[to]", filterTo)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[verdict]", filterVerdict)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[rule_id]", filterRuleId)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[rule_type]", filterRuleType)); + localVarQueryParams.addAll( + apiClient.parameterToPairs("", "filter[signal_severity]", filterSignalSeverity)); + localVarQueryParams.addAll( + apiClient.parameterToPairs("", "filter[signal_source]", filterSignalSource)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[tags]", filterTags)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[entity]", filterEntity)); + + Invocation.Builder builder = + apiClient.createBuilder( + "v2.BitsSecurityAnalystApi.countSecurityAgentInvestigations", + localVarPath, + localVarQueryParams, + localVarHeaderParams, + new HashMap(), + new String[] {"application/json"}, + new String[] {"apiKeyAuth", "appKeyAuth", "AuthZ"}); + return apiClient.invokeAPI( + "GET", + builder, + localVarHeaderParams, + new String[] {}, + localVarPostBody, + new HashMap(), + false, + new GenericType() {}); + } + + /** + * Count Bits Security Analyst investigations. + * + *

See {@link #countSecurityAgentInvestigationsWithHttpInfo}. + * + * @param field Field to count completed investigations by. (required) + * @param parameters Optional parameters for the request. + * @return CompletableFuture<ApiResponse<SecurityAgentInvestigationCountsResponse>> + */ + public CompletableFuture> + countSecurityAgentInvestigationsWithHttpInfoAsync( + SecurityAgentInvestigationCountField field, + CountSecurityAgentInvestigationsOptionalParameters parameters) { + // Check if unstable operation is enabled + String operationId = "countSecurityAgentInvestigations"; + if (apiClient.isUnstableOperationEnabled("v2." + operationId)) { + apiClient.getLogger().warning(String.format("Using unstable operation '%s'", operationId)); + } else { + CompletableFuture> result = + new CompletableFuture<>(); + result.completeExceptionally( + new ApiException(0, String.format("Unstable operation '%s' is disabled", operationId))); + return result; + } + Object localVarPostBody = null; + + // verify the required parameter 'field' is set + if (field == null) { + CompletableFuture> result = + new CompletableFuture<>(); + result.completeExceptionally( + new ApiException( + 400, + "Missing the required parameter 'field' when calling" + + " countSecurityAgentInvestigations")); + return result; + } + String filterTitle = parameters.filterTitle; + String filterFrom = parameters.filterFrom; + String filterTo = parameters.filterTo; + String filterVerdict = parameters.filterVerdict; + String filterRuleId = parameters.filterRuleId; + String filterRuleType = parameters.filterRuleType; + String filterSignalSeverity = parameters.filterSignalSeverity; + String filterSignalSource = parameters.filterSignalSource; + String filterTags = parameters.filterTags; + String filterEntity = parameters.filterEntity; + // create path and map variables + String localVarPath = "/api/v2/security_monitoring/security_agent/investigations/count"; + + List localVarQueryParams = new ArrayList(); + Map localVarHeaderParams = new HashMap(); + + localVarQueryParams.addAll(apiClient.parameterToPairs("", "field", field)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[title]", filterTitle)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[from]", filterFrom)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[to]", filterTo)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[verdict]", filterVerdict)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[rule_id]", filterRuleId)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[rule_type]", filterRuleType)); + localVarQueryParams.addAll( + apiClient.parameterToPairs("", "filter[signal_severity]", filterSignalSeverity)); + localVarQueryParams.addAll( + apiClient.parameterToPairs("", "filter[signal_source]", filterSignalSource)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[tags]", filterTags)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[entity]", filterEntity)); + + Invocation.Builder builder; + try { + builder = + apiClient.createBuilder( + "v2.BitsSecurityAnalystApi.countSecurityAgentInvestigations", + localVarPath, + localVarQueryParams, + localVarHeaderParams, + new HashMap(), + new String[] {"application/json"}, + new String[] {"apiKeyAuth", "appKeyAuth", "AuthZ"}); + } catch (ApiException ex) { + CompletableFuture> result = + new CompletableFuture<>(); + result.completeExceptionally(ex); + return result; + } + return apiClient.invokeAPIAsync( + "GET", + builder, + localVarHeaderParams, + new String[] {}, + localVarPostBody, + new HashMap(), + false, + new GenericType() {}); + } + + /** Manage optional parameters to getSecurityAgentInvestigation. */ + public static class GetSecurityAgentInvestigationOptionalParameters { + private List fieldsInvestigations; + + /** + * Set fieldsInvestigations. + * + * @param fieldsInvestigations Attributes to return, comma-separated. Defaults to all + * attributes. (optional) + * @return GetSecurityAgentInvestigationOptionalParameters + */ + public GetSecurityAgentInvestigationOptionalParameters fieldsInvestigations( + List fieldsInvestigations) { + this.fieldsInvestigations = fieldsInvestigations; + return this; + } + } + + /** + * Get a Bits Security Analyst investigation. + * + *

See {@link #getSecurityAgentInvestigationWithHttpInfo}. + * + * @param investigationId The ID of the investigation, as returned by the list. (required) + * @return SecurityAgentInvestigationResponse + * @throws ApiException if fails to make API call + */ + public SecurityAgentInvestigationResponse getSecurityAgentInvestigation(String investigationId) + throws ApiException { + return getSecurityAgentInvestigationWithHttpInfo( + investigationId, new GetSecurityAgentInvestigationOptionalParameters()) + .getData(); + } + + /** + * Get a Bits Security Analyst investigation. + * + *

See {@link #getSecurityAgentInvestigationWithHttpInfoAsync}. + * + * @param investigationId The ID of the investigation, as returned by the list. (required) + * @return CompletableFuture<SecurityAgentInvestigationResponse> + */ + public CompletableFuture getSecurityAgentInvestigationAsync( + String investigationId) { + return getSecurityAgentInvestigationWithHttpInfoAsync( + investigationId, new GetSecurityAgentInvestigationOptionalParameters()) + .thenApply( + response -> { + return response.getData(); + }); + } + + /** + * Get a Bits Security Analyst investigation. + * + *

See {@link #getSecurityAgentInvestigationWithHttpInfo}. + * + * @param investigationId The ID of the investigation, as returned by the list. (required) + * @param parameters Optional parameters for the request. + * @return SecurityAgentInvestigationResponse + * @throws ApiException if fails to make API call + */ + public SecurityAgentInvestigationResponse getSecurityAgentInvestigation( + String investigationId, GetSecurityAgentInvestigationOptionalParameters parameters) + throws ApiException { + return getSecurityAgentInvestigationWithHttpInfo(investigationId, parameters).getData(); + } + + /** + * Get a Bits Security Analyst investigation. + * + *

See {@link #getSecurityAgentInvestigationWithHttpInfoAsync}. + * + * @param investigationId The ID of the investigation, as returned by the list. (required) + * @param parameters Optional parameters for the request. + * @return CompletableFuture<SecurityAgentInvestigationResponse> + */ + public CompletableFuture getSecurityAgentInvestigationAsync( + String investigationId, GetSecurityAgentInvestigationOptionalParameters parameters) { + return getSecurityAgentInvestigationWithHttpInfoAsync(investigationId, parameters) + .thenApply( + response -> { + return response.getData(); + }); + } + + /** + * Get a Bits Security Analyst investigation by its ID, with its verdict, conclusion, evidence, + * steps, and response suggestions. While the investigation is running, the response has a + * Retry-After header. + * + * @param investigationId The ID of the investigation, as returned by the list. (required) + * @param parameters Optional parameters for the request. + * @return ApiResponse<SecurityAgentInvestigationResponse> + * @throws ApiException if fails to make API call + * @http.response.details + * + * + * + * + * + * + * + * + *
Response details
Status Code Description Response Headers
200 OK -
400 Bad Request -
403 Forbidden -
404 Not Found -
429 Too many requests -
+ */ + public ApiResponse getSecurityAgentInvestigationWithHttpInfo( + String investigationId, GetSecurityAgentInvestigationOptionalParameters parameters) + throws ApiException { + // Check if unstable operation is enabled + String operationId = "getSecurityAgentInvestigation"; + if (apiClient.isUnstableOperationEnabled("v2." + operationId)) { + apiClient.getLogger().warning(String.format("Using unstable operation '%s'", operationId)); + } else { + throw new ApiException(0, String.format("Unstable operation '%s' is disabled", operationId)); + } + Object localVarPostBody = null; + + // verify the required parameter 'investigationId' is set + if (investigationId == null) { + throw new ApiException( + 400, + "Missing the required parameter 'investigationId' when calling" + + " getSecurityAgentInvestigation"); + } + List fieldsInvestigations = parameters.fieldsInvestigations; + // create path and map variables + String localVarPath = + "/api/v2/security_monitoring/security_agent/investigations/{investigation_id}" + .replaceAll( + "\\{" + "investigation_id" + "\\}", + apiClient.escapeString(investigationId.toString())); + + List localVarQueryParams = new ArrayList(); + Map localVarHeaderParams = new HashMap(); + + localVarQueryParams.addAll( + apiClient.parameterToPairs("csv", "fields[investigations]", fieldsInvestigations)); + + Invocation.Builder builder = + apiClient.createBuilder( + "v2.BitsSecurityAnalystApi.getSecurityAgentInvestigation", + localVarPath, + localVarQueryParams, + localVarHeaderParams, + new HashMap(), + new String[] {"application/json"}, + new String[] {"apiKeyAuth", "appKeyAuth", "AuthZ"}); + return apiClient.invokeAPI( + "GET", + builder, + localVarHeaderParams, + new String[] {}, + localVarPostBody, + new HashMap(), + false, + new GenericType() {}); + } + + /** + * Get a Bits Security Analyst investigation. + * + *

See {@link #getSecurityAgentInvestigationWithHttpInfo}. + * + * @param investigationId The ID of the investigation, as returned by the list. (required) + * @param parameters Optional parameters for the request. + * @return CompletableFuture<ApiResponse<SecurityAgentInvestigationResponse>> + */ + public CompletableFuture> + getSecurityAgentInvestigationWithHttpInfoAsync( + String investigationId, GetSecurityAgentInvestigationOptionalParameters parameters) { + // Check if unstable operation is enabled + String operationId = "getSecurityAgentInvestigation"; + if (apiClient.isUnstableOperationEnabled("v2." + operationId)) { + apiClient.getLogger().warning(String.format("Using unstable operation '%s'", operationId)); + } else { + CompletableFuture> result = + new CompletableFuture<>(); + result.completeExceptionally( + new ApiException(0, String.format("Unstable operation '%s' is disabled", operationId))); + return result; + } + Object localVarPostBody = null; + + // verify the required parameter 'investigationId' is set + if (investigationId == null) { + CompletableFuture> result = + new CompletableFuture<>(); + result.completeExceptionally( + new ApiException( + 400, + "Missing the required parameter 'investigationId' when calling" + + " getSecurityAgentInvestigation")); + return result; + } + List fieldsInvestigations = parameters.fieldsInvestigations; + // create path and map variables + String localVarPath = + "/api/v2/security_monitoring/security_agent/investigations/{investigation_id}" + .replaceAll( + "\\{" + "investigation_id" + "\\}", + apiClient.escapeString(investigationId.toString())); + + List localVarQueryParams = new ArrayList(); + Map localVarHeaderParams = new HashMap(); + + localVarQueryParams.addAll( + apiClient.parameterToPairs("csv", "fields[investigations]", fieldsInvestigations)); + + Invocation.Builder builder; + try { + builder = + apiClient.createBuilder( + "v2.BitsSecurityAnalystApi.getSecurityAgentInvestigation", + localVarPath, + localVarQueryParams, + localVarHeaderParams, + new HashMap(), + new String[] {"application/json"}, + new String[] {"apiKeyAuth", "appKeyAuth", "AuthZ"}); + } catch (ApiException ex) { + CompletableFuture> result = + new CompletableFuture<>(); + result.completeExceptionally(ex); + return result; + } + return apiClient.invokeAPIAsync( + "GET", + builder, + localVarHeaderParams, + new String[] {}, + localVarPostBody, + new HashMap(), + false, + new GenericType() {}); + } + + /** Manage optional parameters to listSecurityAgentInvestigations. */ + public static class ListSecurityAgentInvestigationsOptionalParameters { + private String filterSignalId; + private String filterTitle; + private String filterFrom; + private String filterTo; + private String filterVerdict; + private String filterState; + private String filterRuleId; + private String filterRuleType; + private String filterSignalSeverity; + private String filterSignalSource; + private String filterTags; + private String filterEntity; + private String sort; + private Long pageNumber; + private Long pageSize; + + /** + * Set filterSignalId. + * + * @param filterSignalId List every investigation of this signal, newest first. Accepts the + * signal ID in its V1 form, which starts with AQ, or in its longer V3 form, + * which starts with Aw. Investigations carry the V1 form, so their + * signal_id can differ from the ID you pass. Can't be combined with other filters or + * with sort. (optional) + * @return ListSecurityAgentInvestigationsOptionalParameters + */ + public ListSecurityAgentInvestigationsOptionalParameters filterSignalId(String filterSignalId) { + this.filterSignalId = filterSignalId; + return this; + } + + /** + * Set filterTitle. + * + * @param filterTitle Only investigations whose signal title contains this text, + * case-insensitive. (optional) + * @return ListSecurityAgentInvestigationsOptionalParameters + */ + public ListSecurityAgentInvestigationsOptionalParameters filterTitle(String filterTitle) { + this.filterTitle = filterTitle; + return this; + } + + /** + * Set filterFrom. + * + * @param filterFrom Only investigations last updated at or after this time, as RFC 3339 or + * milliseconds since the epoch. (optional) + * @return ListSecurityAgentInvestigationsOptionalParameters + */ + public ListSecurityAgentInvestigationsOptionalParameters filterFrom(String filterFrom) { + this.filterFrom = filterFrom; + return this; + } + + /** + * Set filterTo. + * + * @param filterTo Only investigations last updated at or before this time, as RFC 3339 or + * milliseconds since the epoch. (optional) + * @return ListSecurityAgentInvestigationsOptionalParameters + */ + public ListSecurityAgentInvestigationsOptionalParameters filterTo(String filterTo) { + this.filterTo = filterTo; + return this; + } + + /** + * Set filterVerdict. + * + * @param filterVerdict Only investigations with one of these verdicts: benign, + * suspicious, or malicious. Comma-separated values; an + * investigation matches any of them. (optional) + * @return ListSecurityAgentInvestigationsOptionalParameters + */ + public ListSecurityAgentInvestigationsOptionalParameters filterVerdict(String filterVerdict) { + this.filterVerdict = filterVerdict; + return this; + } + + /** + * Set filterState. + * + * @param filterState Only investigations in one of these states: investigating or + * completed. Investigations reported as failed match + * investigating. Comma-separated values; an investigation matches any of them. + * (optional) + * @return ListSecurityAgentInvestigationsOptionalParameters + */ + public ListSecurityAgentInvestigationsOptionalParameters filterState(String filterState) { + this.filterState = filterState; + return this; + } + + /** + * Set filterRuleId. + * + * @param filterRuleId Only investigations of signals from one of these detection rule IDs. + * Comma-separated values; an investigation matches any of them. (optional) + * @return ListSecurityAgentInvestigationsOptionalParameters + */ + public ListSecurityAgentInvestigationsOptionalParameters filterRuleId(String filterRuleId) { + this.filterRuleId = filterRuleId; + return this; + } + + /** + * Set filterRuleType. + * + * @param filterRuleType Only investigations of signals from detection rules of one of these + * types, as returned by the count with field=rule_type. Comma-separated + * values; an investigation matches any of them. (optional) + * @return ListSecurityAgentInvestigationsOptionalParameters + */ + public ListSecurityAgentInvestigationsOptionalParameters filterRuleType(String filterRuleType) { + this.filterRuleType = filterRuleType; + return this; + } + + /** + * Set filterSignalSeverity. + * + * @param filterSignalSeverity Only investigations of signals with one of these severities: + * info, low, medium, high, or + * critical. Comma-separated values; an investigation matches any of them. (optional) + * @return ListSecurityAgentInvestigationsOptionalParameters + */ + public ListSecurityAgentInvestigationsOptionalParameters filterSignalSeverity( + String filterSignalSeverity) { + this.filterSignalSeverity = filterSignalSeverity; + return this; + } + + /** + * Set filterSignalSource. + * + * @param filterSignalSource Only investigations of signals from one of these sources, as + * returned by the count with field=signal_source. Comma-separated values; an + * investigation matches any of them. (optional) + * @return ListSecurityAgentInvestigationsOptionalParameters + */ + public ListSecurityAgentInvestigationsOptionalParameters filterSignalSource( + String filterSignalSource) { + this.filterSignalSource = filterSignalSource; + return this; + } + + /** + * Set filterTags. + * + * @param filterTags Only investigations whose signal has all of these tags, written + * key:value. Comma-separated values; an investigation must have every one of them. + * (optional) + * @return ListSecurityAgentInvestigationsOptionalParameters + */ + public ListSecurityAgentInvestigationsOptionalParameters filterTags(String filterTags) { + this.filterTags = filterTags; + return this; + } + + /** + * Set filterEntity. + * + * @param filterEntity Only investigations whose signal has all of these entities. Write each + * entity as attribute:value, matching the values returned by the count + * endpoint with field=entity. Comma-separated values; an investigation must + * have every one of them. (optional) + * @return ListSecurityAgentInvestigationsOptionalParameters + */ + public ListSecurityAgentInvestigationsOptionalParameters filterEntity(String filterEntity) { + this.filterEntity = filterEntity; + return this; + } + + /** + * Set sort. + * + * @param sort Sort field, prefixed with - for descending: updated_at, + * severity, verdict, rule_id, or signal_title + * . Defaults to -updated_at. verdict sorts by severity ( + * benign, suspicious, malicious), so -verdict + * puts malicious first. (optional) + * @return ListSecurityAgentInvestigationsOptionalParameters + */ + public ListSecurityAgentInvestigationsOptionalParameters sort(String sort) { + this.sort = sort; + return this; + } + + /** + * Set pageNumber. + * + * @param pageNumber Page number, starting at 1. (optional, default to 1) + * @return ListSecurityAgentInvestigationsOptionalParameters + */ + public ListSecurityAgentInvestigationsOptionalParameters pageNumber(Long pageNumber) { + this.pageNumber = pageNumber; + return this; + } + + /** + * Set pageSize. + * + * @param pageSize Number of investigations per page. (optional, default to 25) + * @return ListSecurityAgentInvestigationsOptionalParameters + */ + public ListSecurityAgentInvestigationsOptionalParameters pageSize(Long pageSize) { + this.pageSize = pageSize; + return this; + } + } + + /** + * List Bits Security Analyst investigations. + * + *

See {@link #listSecurityAgentInvestigationsWithHttpInfo}. + * + * @return SecurityAgentInvestigationsListResponse + * @throws ApiException if fails to make API call + */ + public SecurityAgentInvestigationsListResponse listSecurityAgentInvestigations() + throws ApiException { + return listSecurityAgentInvestigationsWithHttpInfo( + new ListSecurityAgentInvestigationsOptionalParameters()) + .getData(); + } + + /** + * List Bits Security Analyst investigations. + * + *

See {@link #listSecurityAgentInvestigationsWithHttpInfoAsync}. + * + * @return CompletableFuture<SecurityAgentInvestigationsListResponse> + */ + public CompletableFuture + listSecurityAgentInvestigationsAsync() { + return listSecurityAgentInvestigationsWithHttpInfoAsync( + new ListSecurityAgentInvestigationsOptionalParameters()) + .thenApply( + response -> { + return response.getData(); + }); + } + + /** + * List Bits Security Analyst investigations. + * + *

See {@link #listSecurityAgentInvestigationsWithHttpInfo}. + * + * @param parameters Optional parameters for the request. + * @return SecurityAgentInvestigationsListResponse + * @throws ApiException if fails to make API call + */ + public SecurityAgentInvestigationsListResponse listSecurityAgentInvestigations( + ListSecurityAgentInvestigationsOptionalParameters parameters) throws ApiException { + return listSecurityAgentInvestigationsWithHttpInfo(parameters).getData(); + } + + /** + * List Bits Security Analyst investigations. + * + *

See {@link #listSecurityAgentInvestigationsWithHttpInfoAsync}. + * + * @param parameters Optional parameters for the request. + * @return CompletableFuture<SecurityAgentInvestigationsListResponse> + */ + public CompletableFuture + listSecurityAgentInvestigationsAsync( + ListSecurityAgentInvestigationsOptionalParameters parameters) { + return listSecurityAgentInvestigationsWithHttpInfoAsync(parameters) + .thenApply( + response -> { + return response.getData(); + }); + } + + /** + * List Bits Security Analyst investigations. + * + *

Without filter[signal_id], returns the latest investigation of each signal, + * filtered, sorted, and paginated. With filter[signal_id], returns every + * investigation of that signal, newest first. When the signal has no investigation, the first + * page carries meta.reason, which says why. + * + * @param parameters Optional parameters for the request. + * @return ApiResponse<SecurityAgentInvestigationsListResponse> + * @throws ApiException if fails to make API call + * @http.response.details + * + * + * + * + * + * + * + *
Response details
Status Code Description Response Headers
200 OK -
400 Bad Request -
403 Forbidden -
429 Too many requests -
+ */ + public ApiResponse + listSecurityAgentInvestigationsWithHttpInfo( + ListSecurityAgentInvestigationsOptionalParameters parameters) throws ApiException { + // Check if unstable operation is enabled + String operationId = "listSecurityAgentInvestigations"; + if (apiClient.isUnstableOperationEnabled("v2." + operationId)) { + apiClient.getLogger().warning(String.format("Using unstable operation '%s'", operationId)); + } else { + throw new ApiException(0, String.format("Unstable operation '%s' is disabled", operationId)); + } + Object localVarPostBody = null; + String filterSignalId = parameters.filterSignalId; + String filterTitle = parameters.filterTitle; + String filterFrom = parameters.filterFrom; + String filterTo = parameters.filterTo; + String filterVerdict = parameters.filterVerdict; + String filterState = parameters.filterState; + String filterRuleId = parameters.filterRuleId; + String filterRuleType = parameters.filterRuleType; + String filterSignalSeverity = parameters.filterSignalSeverity; + String filterSignalSource = parameters.filterSignalSource; + String filterTags = parameters.filterTags; + String filterEntity = parameters.filterEntity; + String sort = parameters.sort; + Long pageNumber = parameters.pageNumber; + Long pageSize = parameters.pageSize; + // create path and map variables + String localVarPath = "/api/v2/security_monitoring/security_agent/investigations"; + + List localVarQueryParams = new ArrayList(); + Map localVarHeaderParams = new HashMap(); + + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[signal_id]", filterSignalId)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[title]", filterTitle)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[from]", filterFrom)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[to]", filterTo)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[verdict]", filterVerdict)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[state]", filterState)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[rule_id]", filterRuleId)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[rule_type]", filterRuleType)); + localVarQueryParams.addAll( + apiClient.parameterToPairs("", "filter[signal_severity]", filterSignalSeverity)); + localVarQueryParams.addAll( + apiClient.parameterToPairs("", "filter[signal_source]", filterSignalSource)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[tags]", filterTags)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[entity]", filterEntity)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "sort", sort)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "page[number]", pageNumber)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "page[size]", pageSize)); + + Invocation.Builder builder = + apiClient.createBuilder( + "v2.BitsSecurityAnalystApi.listSecurityAgentInvestigations", + localVarPath, + localVarQueryParams, + localVarHeaderParams, + new HashMap(), + new String[] {"application/json"}, + new String[] {"apiKeyAuth", "appKeyAuth", "AuthZ"}); + return apiClient.invokeAPI( + "GET", + builder, + localVarHeaderParams, + new String[] {}, + localVarPostBody, + new HashMap(), + false, + new GenericType() {}); + } + + /** + * List Bits Security Analyst investigations. + * + *

See {@link #listSecurityAgentInvestigationsWithHttpInfo}. + * + * @param parameters Optional parameters for the request. + * @return CompletableFuture<ApiResponse<SecurityAgentInvestigationsListResponse>> + */ + public CompletableFuture> + listSecurityAgentInvestigationsWithHttpInfoAsync( + ListSecurityAgentInvestigationsOptionalParameters parameters) { + // Check if unstable operation is enabled + String operationId = "listSecurityAgentInvestigations"; + if (apiClient.isUnstableOperationEnabled("v2." + operationId)) { + apiClient.getLogger().warning(String.format("Using unstable operation '%s'", operationId)); + } else { + CompletableFuture> result = + new CompletableFuture<>(); + result.completeExceptionally( + new ApiException(0, String.format("Unstable operation '%s' is disabled", operationId))); + return result; + } + Object localVarPostBody = null; + String filterSignalId = parameters.filterSignalId; + String filterTitle = parameters.filterTitle; + String filterFrom = parameters.filterFrom; + String filterTo = parameters.filterTo; + String filterVerdict = parameters.filterVerdict; + String filterState = parameters.filterState; + String filterRuleId = parameters.filterRuleId; + String filterRuleType = parameters.filterRuleType; + String filterSignalSeverity = parameters.filterSignalSeverity; + String filterSignalSource = parameters.filterSignalSource; + String filterTags = parameters.filterTags; + String filterEntity = parameters.filterEntity; + String sort = parameters.sort; + Long pageNumber = parameters.pageNumber; + Long pageSize = parameters.pageSize; + // create path and map variables + String localVarPath = "/api/v2/security_monitoring/security_agent/investigations"; + + List localVarQueryParams = new ArrayList(); + Map localVarHeaderParams = new HashMap(); + + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[signal_id]", filterSignalId)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[title]", filterTitle)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[from]", filterFrom)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[to]", filterTo)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[verdict]", filterVerdict)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[state]", filterState)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[rule_id]", filterRuleId)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[rule_type]", filterRuleType)); + localVarQueryParams.addAll( + apiClient.parameterToPairs("", "filter[signal_severity]", filterSignalSeverity)); + localVarQueryParams.addAll( + apiClient.parameterToPairs("", "filter[signal_source]", filterSignalSource)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[tags]", filterTags)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "filter[entity]", filterEntity)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "sort", sort)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "page[number]", pageNumber)); + localVarQueryParams.addAll(apiClient.parameterToPairs("", "page[size]", pageSize)); + + Invocation.Builder builder; + try { + builder = + apiClient.createBuilder( + "v2.BitsSecurityAnalystApi.listSecurityAgentInvestigations", + localVarPath, + localVarQueryParams, + localVarHeaderParams, + new HashMap(), + new String[] {"application/json"}, + new String[] {"apiKeyAuth", "appKeyAuth", "AuthZ"}); + } catch (ApiException ex) { + CompletableFuture> result = + new CompletableFuture<>(); + result.completeExceptionally(ex); + return result; + } + return apiClient.invokeAPIAsync( + "GET", + builder, + localVarHeaderParams, + new String[] {}, + localVarPostBody, + new HashMap(), + false, + new GenericType() {}); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationAttributes.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationAttributes.java new file mode 100644 index 00000000000..251253c388e --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationAttributes.java @@ -0,0 +1,523 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.time.OffsetDateTime; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Objects; + +/** + * Attributes of an investigation. When fields[investigations] is set, only listed + * attributes are returned. Attributes the investigation doesn't have yet are absent. + */ +@JsonPropertyOrder({ + SecurityAgentInvestigationAttributes.JSON_PROPERTY_CONCLUSION, + SecurityAgentInvestigationAttributes.JSON_PROPERTY_CREATED_AT, + SecurityAgentInvestigationAttributes.JSON_PROPERTY_KEY_ENTITIES, + SecurityAgentInvestigationAttributes.JSON_PROPERTY_KEY_EVIDENCE, + SecurityAgentInvestigationAttributes.JSON_PROPERTY_RESPONSE_SUGGESTIONS, + SecurityAgentInvestigationAttributes.JSON_PROPERTY_RULE_ID, + SecurityAgentInvestigationAttributes.JSON_PROPERTY_SIGNAL, + SecurityAgentInvestigationAttributes.JSON_PROPERTY_SIGNAL_ID, + SecurityAgentInvestigationAttributes.JSON_PROPERTY_STATE, + SecurityAgentInvestigationAttributes.JSON_PROPERTY_STEPS, + SecurityAgentInvestigationAttributes.JSON_PROPERTY_UPDATED_AT, + SecurityAgentInvestigationAttributes.JSON_PROPERTY_VERDICT +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationAttributes { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_CONCLUSION = "conclusion"; + private String conclusion; + + public static final String JSON_PROPERTY_CREATED_AT = "created_at"; + private OffsetDateTime createdAt; + + public static final String JSON_PROPERTY_KEY_ENTITIES = "key_entities"; + private SecurityAgentInvestigationKeyEntities keyEntities; + + public static final String JSON_PROPERTY_KEY_EVIDENCE = "key_evidence"; + private List keyEvidence = null; + + public static final String JSON_PROPERTY_RESPONSE_SUGGESTIONS = "response_suggestions"; + private SecurityAgentInvestigationResponseSuggestions responseSuggestions; + + public static final String JSON_PROPERTY_RULE_ID = "rule_id"; + private String ruleId; + + public static final String JSON_PROPERTY_SIGNAL = "signal"; + private SecurityAgentInvestigationSignal signal; + + public static final String JSON_PROPERTY_SIGNAL_ID = "signal_id"; + private String signalId; + + public static final String JSON_PROPERTY_STATE = "state"; + private SecurityAgentInvestigationState state; + + public static final String JSON_PROPERTY_STEPS = "steps"; + private List steps = null; + + public static final String JSON_PROPERTY_UPDATED_AT = "updated_at"; + private OffsetDateTime updatedAt; + + public static final String JSON_PROPERTY_VERDICT = "verdict"; + private SecurityAgentInvestigationVerdict verdict; + + public SecurityAgentInvestigationAttributes conclusion(String conclusion) { + this.conclusion = conclusion; + return this; + } + + /** + * Summary of the investigation's findings. + * + * @return conclusion + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_CONCLUSION) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public String getConclusion() { + return conclusion; + } + + public void setConclusion(String conclusion) { + this.conclusion = conclusion; + } + + public SecurityAgentInvestigationAttributes createdAt(OffsetDateTime createdAt) { + this.createdAt = createdAt; + return this; + } + + /** + * When the investigation started. + * + * @return createdAt + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_CREATED_AT) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public OffsetDateTime getCreatedAt() { + return createdAt; + } + + public void setCreatedAt(OffsetDateTime createdAt) { + this.createdAt = createdAt; + } + + public SecurityAgentInvestigationAttributes keyEntities( + SecurityAgentInvestigationKeyEntities keyEntities) { + this.keyEntities = keyEntities; + this.unparsed |= keyEntities.unparsed; + return this; + } + + /** + * The entities the investigation found, by role. + * + * @return keyEntities + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_KEY_ENTITIES) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public SecurityAgentInvestigationKeyEntities getKeyEntities() { + return keyEntities; + } + + public void setKeyEntities(SecurityAgentInvestigationKeyEntities keyEntities) { + this.keyEntities = keyEntities; + if (keyEntities != null) { + this.unparsed |= keyEntities.unparsed; + } + } + + public SecurityAgentInvestigationAttributes keyEvidence( + List keyEvidence) { + this.keyEvidence = keyEvidence; + if (keyEvidence != null) { + for (SecurityAgentInvestigationKeyEvidence item : keyEvidence) { + this.unparsed |= item.unparsed; + } + } + return this; + } + + public SecurityAgentInvestigationAttributes addKeyEvidenceItem( + SecurityAgentInvestigationKeyEvidence keyEvidenceItem) { + if (this.keyEvidence == null) { + this.keyEvidence = new ArrayList<>(); + } + this.keyEvidence.add(keyEvidenceItem); + this.unparsed |= keyEvidenceItem.unparsed; + return this; + } + + /** + * The evidence the verdict rests on. + * + * @return keyEvidence + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_KEY_EVIDENCE) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public List getKeyEvidence() { + return keyEvidence; + } + + public void setKeyEvidence(List keyEvidence) { + this.keyEvidence = keyEvidence; + if (keyEvidence != null) { + for (SecurityAgentInvestigationKeyEvidence item : keyEvidence) { + this.unparsed |= item.unparsed; + } + } + } + + public SecurityAgentInvestigationAttributes responseSuggestions( + SecurityAgentInvestigationResponseSuggestions responseSuggestions) { + this.responseSuggestions = responseSuggestions; + this.unparsed |= responseSuggestions.unparsed; + return this; + } + + /** + * Suggested responses to the signal. + * + * @return responseSuggestions + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_RESPONSE_SUGGESTIONS) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public SecurityAgentInvestigationResponseSuggestions getResponseSuggestions() { + return responseSuggestions; + } + + public void setResponseSuggestions( + SecurityAgentInvestigationResponseSuggestions responseSuggestions) { + this.responseSuggestions = responseSuggestions; + if (responseSuggestions != null) { + this.unparsed |= responseSuggestions.unparsed; + } + } + + public SecurityAgentInvestigationAttributes ruleId(String ruleId) { + this.ruleId = ruleId; + return this; + } + + /** + * ID of the detection rule that generated the signal. + * + * @return ruleId + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_RULE_ID) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public String getRuleId() { + return ruleId; + } + + public void setRuleId(String ruleId) { + this.ruleId = ruleId; + } + + public SecurityAgentInvestigationAttributes signal(SecurityAgentInvestigationSignal signal) { + this.signal = signal; + this.unparsed |= signal.unparsed; + return this; + } + + /** + * Summary of the signal the investigation is about. + * + * @return signal + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_SIGNAL) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public SecurityAgentInvestigationSignal getSignal() { + return signal; + } + + public void setSignal(SecurityAgentInvestigationSignal signal) { + this.signal = signal; + if (signal != null) { + this.unparsed |= signal.unparsed; + } + } + + public SecurityAgentInvestigationAttributes signalId(String signalId) { + this.signalId = signalId; + return this; + } + + /** + * ID of the signal, in its V1 form. + * + * @return signalId + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_SIGNAL_ID) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public String getSignalId() { + return signalId; + } + + public void setSignalId(String signalId) { + this.signalId = signalId; + } + + public SecurityAgentInvestigationAttributes state(SecurityAgentInvestigationState state) { + this.state = state; + this.unparsed |= !state.isValid(); + return this; + } + + /** + * State of the investigation: investigating while it runs, completed + * after it has a result, or failed when it produced no result before its timeout. + * + * @return state + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_STATE) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public SecurityAgentInvestigationState getState() { + return state; + } + + public void setState(SecurityAgentInvestigationState state) { + if (!state.isValid()) { + this.unparsed = true; + } + this.state = state; + } + + public SecurityAgentInvestigationAttributes steps(List steps) { + this.steps = steps; + if (steps != null) { + for (SecurityAgentInvestigationStep item : steps) { + this.unparsed |= item.unparsed; + } + } + return this; + } + + public SecurityAgentInvestigationAttributes addStepsItem( + SecurityAgentInvestigationStep stepsItem) { + if (this.steps == null) { + this.steps = new ArrayList<>(); + } + this.steps.add(stepsItem); + this.unparsed |= stepsItem.unparsed; + return this; + } + + /** + * The steps of the investigation, in order. + * + * @return steps + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_STEPS) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public List getSteps() { + return steps; + } + + public void setSteps(List steps) { + this.steps = steps; + if (steps != null) { + for (SecurityAgentInvestigationStep item : steps) { + this.unparsed |= item.unparsed; + } + } + } + + public SecurityAgentInvestigationAttributes updatedAt(OffsetDateTime updatedAt) { + this.updatedAt = updatedAt; + return this; + } + + /** + * When the investigation last changed. + * + * @return updatedAt + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_UPDATED_AT) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public OffsetDateTime getUpdatedAt() { + return updatedAt; + } + + public void setUpdatedAt(OffsetDateTime updatedAt) { + this.updatedAt = updatedAt; + } + + public SecurityAgentInvestigationAttributes verdict(SecurityAgentInvestigationVerdict verdict) { + this.verdict = verdict; + this.unparsed |= !verdict.isValid(); + return this; + } + + /** + * Verdict of the investigation. Only completed investigations have one. + * + * @return verdict + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_VERDICT) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public SecurityAgentInvestigationVerdict getVerdict() { + return verdict; + } + + public void setVerdict(SecurityAgentInvestigationVerdict verdict) { + if (!verdict.isValid()) { + this.unparsed = true; + } + this.verdict = verdict; + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationAttributes + */ + @JsonAnySetter + public SecurityAgentInvestigationAttributes putAdditionalProperty(String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationAttributes object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationAttributes securityAgentInvestigationAttributes = + (SecurityAgentInvestigationAttributes) o; + return Objects.equals(this.conclusion, securityAgentInvestigationAttributes.conclusion) + && Objects.equals(this.createdAt, securityAgentInvestigationAttributes.createdAt) + && Objects.equals(this.keyEntities, securityAgentInvestigationAttributes.keyEntities) + && Objects.equals(this.keyEvidence, securityAgentInvestigationAttributes.keyEvidence) + && Objects.equals( + this.responseSuggestions, securityAgentInvestigationAttributes.responseSuggestions) + && Objects.equals(this.ruleId, securityAgentInvestigationAttributes.ruleId) + && Objects.equals(this.signal, securityAgentInvestigationAttributes.signal) + && Objects.equals(this.signalId, securityAgentInvestigationAttributes.signalId) + && Objects.equals(this.state, securityAgentInvestigationAttributes.state) + && Objects.equals(this.steps, securityAgentInvestigationAttributes.steps) + && Objects.equals(this.updatedAt, securityAgentInvestigationAttributes.updatedAt) + && Objects.equals(this.verdict, securityAgentInvestigationAttributes.verdict) + && Objects.equals( + this.additionalProperties, securityAgentInvestigationAttributes.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash( + conclusion, + createdAt, + keyEntities, + keyEvidence, + responseSuggestions, + ruleId, + signal, + signalId, + state, + steps, + updatedAt, + verdict, + additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationAttributes {\n"); + sb.append(" conclusion: ").append(toIndentedString(conclusion)).append("\n"); + sb.append(" createdAt: ").append(toIndentedString(createdAt)).append("\n"); + sb.append(" keyEntities: ").append(toIndentedString(keyEntities)).append("\n"); + sb.append(" keyEvidence: ").append(toIndentedString(keyEvidence)).append("\n"); + sb.append(" responseSuggestions: ") + .append(toIndentedString(responseSuggestions)) + .append("\n"); + sb.append(" ruleId: ").append(toIndentedString(ruleId)).append("\n"); + sb.append(" signal: ").append(toIndentedString(signal)).append("\n"); + sb.append(" signalId: ").append(toIndentedString(signalId)).append("\n"); + sb.append(" state: ").append(toIndentedString(state)).append("\n"); + sb.append(" steps: ").append(toIndentedString(steps)).append("\n"); + sb.append(" updatedAt: ").append(toIndentedString(updatedAt)).append("\n"); + sb.append(" verdict: ").append(toIndentedString(verdict)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCount.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCount.java new file mode 100644 index 00000000000..55850ef8697 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCount.java @@ -0,0 +1,175 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.HashMap; +import java.util.Map; +import java.util.Objects; + +/** One value of the counted field and how many completed investigations have it. */ +@JsonPropertyOrder({ + SecurityAgentInvestigationCount.JSON_PROPERTY_COUNT, + SecurityAgentInvestigationCount.JSON_PROPERTY_VALUE +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationCount { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_COUNT = "count"; + private Long count; + + public static final String JSON_PROPERTY_VALUE = "value"; + private String value; + + public SecurityAgentInvestigationCount() {} + + @JsonCreator + public SecurityAgentInvestigationCount( + @JsonProperty(required = true, value = JSON_PROPERTY_COUNT) Long count, + @JsonProperty(required = true, value = JSON_PROPERTY_VALUE) String value) { + this.count = count; + this.value = value; + } + + public SecurityAgentInvestigationCount count(Long count) { + this.count = count; + return this; + } + + /** + * Number of completed investigations with this value. + * + * @return count + */ + @JsonProperty(JSON_PROPERTY_COUNT) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public Long getCount() { + return count; + } + + public void setCount(Long count) { + this.count = count; + } + + public SecurityAgentInvestigationCount value(String value) { + this.value = value; + return this; + } + + /** + * A value of the counted field. + * + * @return value + */ + @JsonProperty(JSON_PROPERTY_VALUE) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getValue() { + return value; + } + + public void setValue(String value) { + this.value = value; + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationCount + */ + @JsonAnySetter + public SecurityAgentInvestigationCount putAdditionalProperty(String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationCount object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationCount securityAgentInvestigationCount = + (SecurityAgentInvestigationCount) o; + return Objects.equals(this.count, securityAgentInvestigationCount.count) + && Objects.equals(this.value, securityAgentInvestigationCount.value) + && Objects.equals( + this.additionalProperties, securityAgentInvestigationCount.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash(count, value, additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationCount {\n"); + sb.append(" count: ").append(toIndentedString(count)).append("\n"); + sb.append(" value: ").append(toIndentedString(value)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCountField.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCountField.java new file mode 100644 index 00000000000..ba3e7a957a7 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCountField.java @@ -0,0 +1,66 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.datadog.api.client.ModelEnum; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.core.JsonGenerator; +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.databind.SerializerProvider; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; +import com.fasterxml.jackson.databind.ser.std.StdSerializer; +import java.io.IOException; +import java.util.Arrays; +import java.util.HashSet; +import java.util.Set; + +/** Field to count completed investigations by. */ +@JsonSerialize( + using = + SecurityAgentInvestigationCountField.SecurityAgentInvestigationCountFieldSerializer.class) +public class SecurityAgentInvestigationCountField extends ModelEnum { + + private static final Set allowedValues = + new HashSet(Arrays.asList("verdict", "rule_type", "signal_source", "entity")); + + public static final SecurityAgentInvestigationCountField VERDICT = + new SecurityAgentInvestigationCountField("verdict"); + public static final SecurityAgentInvestigationCountField RULE_TYPE = + new SecurityAgentInvestigationCountField("rule_type"); + public static final SecurityAgentInvestigationCountField SIGNAL_SOURCE = + new SecurityAgentInvestigationCountField("signal_source"); + public static final SecurityAgentInvestigationCountField ENTITY = + new SecurityAgentInvestigationCountField("entity"); + + SecurityAgentInvestigationCountField(String value) { + super(value, allowedValues); + } + + public static class SecurityAgentInvestigationCountFieldSerializer + extends StdSerializer { + public SecurityAgentInvestigationCountFieldSerializer( + Class t) { + super(t); + } + + public SecurityAgentInvestigationCountFieldSerializer() { + this(null); + } + + @Override + public void serialize( + SecurityAgentInvestigationCountField value, JsonGenerator jgen, SerializerProvider provider) + throws IOException, JsonProcessingException { + jgen.writeObject(value.value); + } + } + + @JsonCreator + public static SecurityAgentInvestigationCountField fromValue(String value) { + return new SecurityAgentInvestigationCountField(value); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCountsAttributes.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCountsAttributes.java new file mode 100644 index 00000000000..02882e2c95c --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCountsAttributes.java @@ -0,0 +1,169 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Objects; + +/** The counts of each value of the field. */ +@JsonPropertyOrder({SecurityAgentInvestigationCountsAttributes.JSON_PROPERTY_COUNTS}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationCountsAttributes { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_COUNTS = "counts"; + private List counts = new ArrayList<>(); + + public SecurityAgentInvestigationCountsAttributes() {} + + @JsonCreator + public SecurityAgentInvestigationCountsAttributes( + @JsonProperty(required = true, value = JSON_PROPERTY_COUNTS) + List counts) { + this.counts = counts; + for (SecurityAgentInvestigationCount item : counts) { + this.unparsed |= item.unparsed; + } + } + + public SecurityAgentInvestigationCountsAttributes counts( + List counts) { + this.counts = counts; + for (SecurityAgentInvestigationCount item : counts) { + this.unparsed |= item.unparsed; + } + return this; + } + + public SecurityAgentInvestigationCountsAttributes addCountsItem( + SecurityAgentInvestigationCount countsItem) { + this.counts.add(countsItem); + this.unparsed |= countsItem.unparsed; + return this; + } + + /** + * One bucket per value, sorted by ascending count. + * + * @return counts + */ + @JsonProperty(JSON_PROPERTY_COUNTS) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public List getCounts() { + return counts; + } + + public void setCounts(List counts) { + this.counts = counts; + if (counts != null) { + for (SecurityAgentInvestigationCount item : counts) { + this.unparsed |= item.unparsed; + } + } + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationCountsAttributes + */ + @JsonAnySetter + public SecurityAgentInvestigationCountsAttributes putAdditionalProperty( + String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationCountsAttributes object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationCountsAttributes securityAgentInvestigationCountsAttributes = + (SecurityAgentInvestigationCountsAttributes) o; + return Objects.equals(this.counts, securityAgentInvestigationCountsAttributes.counts) + && Objects.equals( + this.additionalProperties, + securityAgentInvestigationCountsAttributes.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash(counts, additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationCountsAttributes {\n"); + sb.append(" counts: ").append(toIndentedString(counts)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCountsData.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCountsData.java new file mode 100644 index 00000000000..a69fb76cdb8 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCountsData.java @@ -0,0 +1,217 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.HashMap; +import java.util.Map; +import java.util.Objects; + +/** Counts of completed investigations. */ +@JsonPropertyOrder({ + SecurityAgentInvestigationCountsData.JSON_PROPERTY_ATTRIBUTES, + SecurityAgentInvestigationCountsData.JSON_PROPERTY_ID, + SecurityAgentInvestigationCountsData.JSON_PROPERTY_TYPE +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationCountsData { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_ATTRIBUTES = "attributes"; + private SecurityAgentInvestigationCountsAttributes attributes; + + public static final String JSON_PROPERTY_ID = "id"; + private String id; + + public static final String JSON_PROPERTY_TYPE = "type"; + private SecurityAgentInvestigationCountsType type = + SecurityAgentInvestigationCountsType.INVESTIGATION_COUNTS; + + public SecurityAgentInvestigationCountsData() {} + + @JsonCreator + public SecurityAgentInvestigationCountsData( + @JsonProperty(required = true, value = JSON_PROPERTY_ATTRIBUTES) + SecurityAgentInvestigationCountsAttributes attributes, + @JsonProperty(required = true, value = JSON_PROPERTY_ID) String id, + @JsonProperty(required = true, value = JSON_PROPERTY_TYPE) + SecurityAgentInvestigationCountsType type) { + this.attributes = attributes; + this.unparsed |= attributes.unparsed; + this.id = id; + this.type = type; + this.unparsed |= !type.isValid(); + } + + public SecurityAgentInvestigationCountsData attributes( + SecurityAgentInvestigationCountsAttributes attributes) { + this.attributes = attributes; + this.unparsed |= attributes.unparsed; + return this; + } + + /** + * The counts of each value of the field. + * + * @return attributes + */ + @JsonProperty(JSON_PROPERTY_ATTRIBUTES) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public SecurityAgentInvestigationCountsAttributes getAttributes() { + return attributes; + } + + public void setAttributes(SecurityAgentInvestigationCountsAttributes attributes) { + this.attributes = attributes; + if (attributes != null) { + this.unparsed |= attributes.unparsed; + } + } + + public SecurityAgentInvestigationCountsData id(String id) { + this.id = id; + return this; + } + + /** + * The counted field. + * + * @return id + */ + @JsonProperty(JSON_PROPERTY_ID) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getId() { + return id; + } + + public void setId(String id) { + this.id = id; + } + + public SecurityAgentInvestigationCountsData type(SecurityAgentInvestigationCountsType type) { + this.type = type; + this.unparsed |= !type.isValid(); + return this; + } + + /** + * Type of the investigation counts resource. + * + * @return type + */ + @JsonProperty(JSON_PROPERTY_TYPE) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public SecurityAgentInvestigationCountsType getType() { + return type; + } + + public void setType(SecurityAgentInvestigationCountsType type) { + if (!type.isValid()) { + this.unparsed = true; + } + this.type = type; + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationCountsData + */ + @JsonAnySetter + public SecurityAgentInvestigationCountsData putAdditionalProperty(String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationCountsData object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationCountsData securityAgentInvestigationCountsData = + (SecurityAgentInvestigationCountsData) o; + return Objects.equals(this.attributes, securityAgentInvestigationCountsData.attributes) + && Objects.equals(this.id, securityAgentInvestigationCountsData.id) + && Objects.equals(this.type, securityAgentInvestigationCountsData.type) + && Objects.equals( + this.additionalProperties, securityAgentInvestigationCountsData.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash(attributes, id, type, additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationCountsData {\n"); + sb.append(" attributes: ").append(toIndentedString(attributes)).append("\n"); + sb.append(" id: ").append(toIndentedString(id)).append("\n"); + sb.append(" type: ").append(toIndentedString(type)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCountsResponse.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCountsResponse.java new file mode 100644 index 00000000000..2536f53f7dd --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCountsResponse.java @@ -0,0 +1,152 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.HashMap; +import java.util.Map; +import java.util.Objects; + +/** Completed investigations counted by the values of one field. */ +@JsonPropertyOrder({SecurityAgentInvestigationCountsResponse.JSON_PROPERTY_DATA}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationCountsResponse { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_DATA = "data"; + private SecurityAgentInvestigationCountsData data; + + public SecurityAgentInvestigationCountsResponse() {} + + @JsonCreator + public SecurityAgentInvestigationCountsResponse( + @JsonProperty(required = true, value = JSON_PROPERTY_DATA) + SecurityAgentInvestigationCountsData data) { + this.data = data; + this.unparsed |= data.unparsed; + } + + public SecurityAgentInvestigationCountsResponse data(SecurityAgentInvestigationCountsData data) { + this.data = data; + this.unparsed |= data.unparsed; + return this; + } + + /** + * Counts of completed investigations. + * + * @return data + */ + @JsonProperty(JSON_PROPERTY_DATA) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public SecurityAgentInvestigationCountsData getData() { + return data; + } + + public void setData(SecurityAgentInvestigationCountsData data) { + this.data = data; + if (data != null) { + this.unparsed |= data.unparsed; + } + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationCountsResponse + */ + @JsonAnySetter + public SecurityAgentInvestigationCountsResponse putAdditionalProperty(String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationCountsResponse object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationCountsResponse securityAgentInvestigationCountsResponse = + (SecurityAgentInvestigationCountsResponse) o; + return Objects.equals(this.data, securityAgentInvestigationCountsResponse.data) + && Objects.equals( + this.additionalProperties, + securityAgentInvestigationCountsResponse.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash(data, additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationCountsResponse {\n"); + sb.append(" data: ").append(toIndentedString(data)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCountsType.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCountsType.java new file mode 100644 index 00000000000..0916bf5ce2f --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationCountsType.java @@ -0,0 +1,60 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.datadog.api.client.ModelEnum; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.core.JsonGenerator; +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.databind.SerializerProvider; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; +import com.fasterxml.jackson.databind.ser.std.StdSerializer; +import java.io.IOException; +import java.util.Arrays; +import java.util.HashSet; +import java.util.Set; + +/** Type of the investigation counts resource. */ +@JsonSerialize( + using = + SecurityAgentInvestigationCountsType.SecurityAgentInvestigationCountsTypeSerializer.class) +public class SecurityAgentInvestigationCountsType extends ModelEnum { + + private static final Set allowedValues = + new HashSet(Arrays.asList("investigation_counts")); + + public static final SecurityAgentInvestigationCountsType INVESTIGATION_COUNTS = + new SecurityAgentInvestigationCountsType("investigation_counts"); + + SecurityAgentInvestigationCountsType(String value) { + super(value, allowedValues); + } + + public static class SecurityAgentInvestigationCountsTypeSerializer + extends StdSerializer { + public SecurityAgentInvestigationCountsTypeSerializer( + Class t) { + super(t); + } + + public SecurityAgentInvestigationCountsTypeSerializer() { + this(null); + } + + @Override + public void serialize( + SecurityAgentInvestigationCountsType value, JsonGenerator jgen, SerializerProvider provider) + throws IOException, JsonProcessingException { + jgen.writeObject(value.value); + } + } + + @JsonCreator + public static SecurityAgentInvestigationCountsType fromValue(String value) { + return new SecurityAgentInvestigationCountsType(value); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationData.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationData.java new file mode 100644 index 00000000000..e65323ef9b9 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationData.java @@ -0,0 +1,217 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.HashMap; +import java.util.Map; +import java.util.Objects; + +/** + * An investigation and its content. attributes is absent when + * fields[investigations] is empty or lists only attributes the investigation doesn't have. + */ +@JsonPropertyOrder({ + SecurityAgentInvestigationData.JSON_PROPERTY_ATTRIBUTES, + SecurityAgentInvestigationData.JSON_PROPERTY_ID, + SecurityAgentInvestigationData.JSON_PROPERTY_TYPE +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationData { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_ATTRIBUTES = "attributes"; + private SecurityAgentInvestigationAttributes attributes; + + public static final String JSON_PROPERTY_ID = "id"; + private String id; + + public static final String JSON_PROPERTY_TYPE = "type"; + private SecurityAgentInvestigationType type = SecurityAgentInvestigationType.INVESTIGATIONS; + + public SecurityAgentInvestigationData() {} + + @JsonCreator + public SecurityAgentInvestigationData( + @JsonProperty(required = true, value = JSON_PROPERTY_ID) String id, + @JsonProperty(required = true, value = JSON_PROPERTY_TYPE) + SecurityAgentInvestigationType type) { + this.id = id; + this.type = type; + this.unparsed |= !type.isValid(); + } + + public SecurityAgentInvestigationData attributes( + SecurityAgentInvestigationAttributes attributes) { + this.attributes = attributes; + this.unparsed |= attributes.unparsed; + return this; + } + + /** + * Attributes of an investigation. When fields[investigations] is set, only listed + * attributes are returned. Attributes the investigation doesn't have yet are absent. + * + * @return attributes + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_ATTRIBUTES) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public SecurityAgentInvestigationAttributes getAttributes() { + return attributes; + } + + public void setAttributes(SecurityAgentInvestigationAttributes attributes) { + this.attributes = attributes; + if (attributes != null) { + this.unparsed |= attributes.unparsed; + } + } + + public SecurityAgentInvestigationData id(String id) { + this.id = id; + return this; + } + + /** + * The ID of the investigation. + * + * @return id + */ + @JsonProperty(JSON_PROPERTY_ID) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getId() { + return id; + } + + public void setId(String id) { + this.id = id; + } + + public SecurityAgentInvestigationData type(SecurityAgentInvestigationType type) { + this.type = type; + this.unparsed |= !type.isValid(); + return this; + } + + /** + * Type of the investigation resource. + * + * @return type + */ + @JsonProperty(JSON_PROPERTY_TYPE) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public SecurityAgentInvestigationType getType() { + return type; + } + + public void setType(SecurityAgentInvestigationType type) { + if (!type.isValid()) { + this.unparsed = true; + } + this.type = type; + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationData + */ + @JsonAnySetter + public SecurityAgentInvestigationData putAdditionalProperty(String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationData object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationData securityAgentInvestigationData = + (SecurityAgentInvestigationData) o; + return Objects.equals(this.attributes, securityAgentInvestigationData.attributes) + && Objects.equals(this.id, securityAgentInvestigationData.id) + && Objects.equals(this.type, securityAgentInvestigationData.type) + && Objects.equals( + this.additionalProperties, securityAgentInvestigationData.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash(attributes, id, type, additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationData {\n"); + sb.append(" attributes: ").append(toIndentedString(attributes)).append("\n"); + sb.append(" id: ").append(toIndentedString(id)).append("\n"); + sb.append(" type: ").append(toIndentedString(type)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationEntity.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationEntity.java new file mode 100644 index 00000000000..fa3ab249657 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationEntity.java @@ -0,0 +1,202 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.HashMap; +import java.util.Map; +import java.util.Objects; + +/** An entity the investigation found. */ +@JsonPropertyOrder({ + SecurityAgentInvestigationEntity.JSON_PROPERTY_SUB_TYPE, + SecurityAgentInvestigationEntity.JSON_PROPERTY_TYPE, + SecurityAgentInvestigationEntity.JSON_PROPERTY_VALUE +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationEntity { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_SUB_TYPE = "sub_type"; + private String subType; + + public static final String JSON_PROPERTY_TYPE = "type"; + private String type; + + public static final String JSON_PROPERTY_VALUE = "value"; + private String value; + + public SecurityAgentInvestigationEntity() {} + + @JsonCreator + public SecurityAgentInvestigationEntity( + @JsonProperty(required = true, value = JSON_PROPERTY_TYPE) String type, + @JsonProperty(required = true, value = JSON_PROPERTY_VALUE) String value) { + this.type = type; + this.value = value; + } + + public SecurityAgentInvestigationEntity subType(String subType) { + this.subType = subType; + return this; + } + + /** + * More specific type of the entity. + * + * @return subType + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_SUB_TYPE) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public String getSubType() { + return subType; + } + + public void setSubType(String subType) { + this.subType = subType; + } + + public SecurityAgentInvestigationEntity type(String type) { + this.type = type; + return this; + } + + /** + * Type of the entity, such as a user, a host, or an IP address. + * + * @return type + */ + @JsonProperty(JSON_PROPERTY_TYPE) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getType() { + return type; + } + + public void setType(String type) { + this.type = type; + } + + public SecurityAgentInvestigationEntity value(String value) { + this.value = value; + return this; + } + + /** + * Value that identifies the entity. + * + * @return value + */ + @JsonProperty(JSON_PROPERTY_VALUE) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getValue() { + return value; + } + + public void setValue(String value) { + this.value = value; + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationEntity + */ + @JsonAnySetter + public SecurityAgentInvestigationEntity putAdditionalProperty(String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationEntity object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationEntity securityAgentInvestigationEntity = + (SecurityAgentInvestigationEntity) o; + return Objects.equals(this.subType, securityAgentInvestigationEntity.subType) + && Objects.equals(this.type, securityAgentInvestigationEntity.type) + && Objects.equals(this.value, securityAgentInvestigationEntity.value) + && Objects.equals( + this.additionalProperties, securityAgentInvestigationEntity.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash(subType, type, value, additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationEntity {\n"); + sb.append(" subType: ").append(toIndentedString(subType)).append("\n"); + sb.append(" type: ").append(toIndentedString(type)).append("\n"); + sb.append(" value: ").append(toIndentedString(value)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationField.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationField.java new file mode 100644 index 00000000000..1e6609a7a2b --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationField.java @@ -0,0 +1,93 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.datadog.api.client.ModelEnum; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.core.JsonGenerator; +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.databind.SerializerProvider; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; +import com.fasterxml.jackson.databind.ser.std.StdSerializer; +import java.io.IOException; +import java.util.Arrays; +import java.util.HashSet; +import java.util.Set; + +/** An attribute of an investigation that fields[investigations] can select. */ +@JsonSerialize( + using = SecurityAgentInvestigationField.SecurityAgentInvestigationFieldSerializer.class) +public class SecurityAgentInvestigationField extends ModelEnum { + + private static final Set allowedValues = + new HashSet( + Arrays.asList( + "signal_id", + "rule_id", + "state", + "verdict", + "conclusion", + "signal", + "key_entities", + "key_evidence", + "steps", + "response_suggestions", + "created_at", + "updated_at")); + + public static final SecurityAgentInvestigationField SIGNAL_ID = + new SecurityAgentInvestigationField("signal_id"); + public static final SecurityAgentInvestigationField RULE_ID = + new SecurityAgentInvestigationField("rule_id"); + public static final SecurityAgentInvestigationField STATE = + new SecurityAgentInvestigationField("state"); + public static final SecurityAgentInvestigationField VERDICT = + new SecurityAgentInvestigationField("verdict"); + public static final SecurityAgentInvestigationField CONCLUSION = + new SecurityAgentInvestigationField("conclusion"); + public static final SecurityAgentInvestigationField SIGNAL = + new SecurityAgentInvestigationField("signal"); + public static final SecurityAgentInvestigationField KEY_ENTITIES = + new SecurityAgentInvestigationField("key_entities"); + public static final SecurityAgentInvestigationField KEY_EVIDENCE = + new SecurityAgentInvestigationField("key_evidence"); + public static final SecurityAgentInvestigationField STEPS = + new SecurityAgentInvestigationField("steps"); + public static final SecurityAgentInvestigationField RESPONSE_SUGGESTIONS = + new SecurityAgentInvestigationField("response_suggestions"); + public static final SecurityAgentInvestigationField CREATED_AT = + new SecurityAgentInvestigationField("created_at"); + public static final SecurityAgentInvestigationField UPDATED_AT = + new SecurityAgentInvestigationField("updated_at"); + + SecurityAgentInvestigationField(String value) { + super(value, allowedValues); + } + + public static class SecurityAgentInvestigationFieldSerializer + extends StdSerializer { + public SecurityAgentInvestigationFieldSerializer(Class t) { + super(t); + } + + public SecurityAgentInvestigationFieldSerializer() { + this(null); + } + + @Override + public void serialize( + SecurityAgentInvestigationField value, JsonGenerator jgen, SerializerProvider provider) + throws IOException, JsonProcessingException { + jgen.writeObject(value.value); + } + } + + @JsonCreator + public static SecurityAgentInvestigationField fromValue(String value) { + return new SecurityAgentInvestigationField(value); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationKeyEntities.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationKeyEntities.java new file mode 100644 index 00000000000..a434b92ebe0 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationKeyEntities.java @@ -0,0 +1,217 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Objects; + +/** The entities the investigation found, by role. */ +@JsonPropertyOrder({ + SecurityAgentInvestigationKeyEntities.JSON_PROPERTY_ACTORS, + SecurityAgentInvestigationKeyEntities.JSON_PROPERTY_TARGETS +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationKeyEntities { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_ACTORS = "actors"; + private List actors = new ArrayList<>(); + + public static final String JSON_PROPERTY_TARGETS = "targets"; + private List targets = new ArrayList<>(); + + public SecurityAgentInvestigationKeyEntities() {} + + @JsonCreator + public SecurityAgentInvestigationKeyEntities( + @JsonProperty(required = true, value = JSON_PROPERTY_ACTORS) + List actors, + @JsonProperty(required = true, value = JSON_PROPERTY_TARGETS) + List targets) { + this.actors = actors; + for (SecurityAgentInvestigationEntity item : actors) { + this.unparsed |= item.unparsed; + } + this.targets = targets; + for (SecurityAgentInvestigationEntity item : targets) { + this.unparsed |= item.unparsed; + } + } + + public SecurityAgentInvestigationKeyEntities actors( + List actors) { + this.actors = actors; + for (SecurityAgentInvestigationEntity item : actors) { + this.unparsed |= item.unparsed; + } + return this; + } + + public SecurityAgentInvestigationKeyEntities addActorsItem( + SecurityAgentInvestigationEntity actorsItem) { + this.actors.add(actorsItem); + this.unparsed |= actorsItem.unparsed; + return this; + } + + /** + * Entities that performed the activity. + * + * @return actors + */ + @JsonProperty(JSON_PROPERTY_ACTORS) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public List getActors() { + return actors; + } + + public void setActors(List actors) { + this.actors = actors; + if (actors != null) { + for (SecurityAgentInvestigationEntity item : actors) { + this.unparsed |= item.unparsed; + } + } + } + + public SecurityAgentInvestigationKeyEntities targets( + List targets) { + this.targets = targets; + for (SecurityAgentInvestigationEntity item : targets) { + this.unparsed |= item.unparsed; + } + return this; + } + + public SecurityAgentInvestigationKeyEntities addTargetsItem( + SecurityAgentInvestigationEntity targetsItem) { + this.targets.add(targetsItem); + this.unparsed |= targetsItem.unparsed; + return this; + } + + /** + * Entities the activity was aimed at. + * + * @return targets + */ + @JsonProperty(JSON_PROPERTY_TARGETS) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public List getTargets() { + return targets; + } + + public void setTargets(List targets) { + this.targets = targets; + if (targets != null) { + for (SecurityAgentInvestigationEntity item : targets) { + this.unparsed |= item.unparsed; + } + } + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationKeyEntities + */ + @JsonAnySetter + public SecurityAgentInvestigationKeyEntities putAdditionalProperty(String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationKeyEntities object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationKeyEntities securityAgentInvestigationKeyEntities = + (SecurityAgentInvestigationKeyEntities) o; + return Objects.equals(this.actors, securityAgentInvestigationKeyEntities.actors) + && Objects.equals(this.targets, securityAgentInvestigationKeyEntities.targets) + && Objects.equals( + this.additionalProperties, securityAgentInvestigationKeyEntities.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash(actors, targets, additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationKeyEntities {\n"); + sb.append(" actors: ").append(toIndentedString(actors)).append("\n"); + sb.append(" targets: ").append(toIndentedString(targets)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationKeyEvidence.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationKeyEvidence.java new file mode 100644 index 00000000000..423b90f05f4 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationKeyEvidence.java @@ -0,0 +1,212 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Objects; + +/** A piece of evidence the verdict rests on. */ +@JsonPropertyOrder({ + SecurityAgentInvestigationKeyEvidence.JSON_PROPERTY_CATEGORY, + SecurityAgentInvestigationKeyEvidence.JSON_PROPERTY_FINDING, + SecurityAgentInvestigationKeyEvidence.JSON_PROPERTY_SOURCE_STEPS +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationKeyEvidence { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_CATEGORY = "category"; + private String category; + + public static final String JSON_PROPERTY_FINDING = "finding"; + private String finding; + + public static final String JSON_PROPERTY_SOURCE_STEPS = "source_steps"; + private List sourceSteps = null; + + public SecurityAgentInvestigationKeyEvidence() {} + + @JsonCreator + public SecurityAgentInvestigationKeyEvidence( + @JsonProperty(required = true, value = JSON_PROPERTY_CATEGORY) String category, + @JsonProperty(required = true, value = JSON_PROPERTY_FINDING) String finding) { + this.category = category; + this.finding = finding; + } + + public SecurityAgentInvestigationKeyEvidence category(String category) { + this.category = category; + return this; + } + + /** + * Category of the evidence. + * + * @return category + */ + @JsonProperty(JSON_PROPERTY_CATEGORY) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getCategory() { + return category; + } + + public void setCategory(String category) { + this.category = category; + } + + public SecurityAgentInvestigationKeyEvidence finding(String finding) { + this.finding = finding; + return this; + } + + /** + * What the investigation found. + * + * @return finding + */ + @JsonProperty(JSON_PROPERTY_FINDING) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getFinding() { + return finding; + } + + public void setFinding(String finding) { + this.finding = finding; + } + + public SecurityAgentInvestigationKeyEvidence sourceSteps(List sourceSteps) { + this.sourceSteps = sourceSteps; + return this; + } + + public SecurityAgentInvestigationKeyEvidence addSourceStepsItem(String sourceStepsItem) { + if (this.sourceSteps == null) { + this.sourceSteps = new ArrayList<>(); + } + this.sourceSteps.add(sourceStepsItem); + return this; + } + + /** + * Names of the steps the evidence comes from. + * + * @return sourceSteps + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_SOURCE_STEPS) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public List getSourceSteps() { + return sourceSteps; + } + + public void setSourceSteps(List sourceSteps) { + this.sourceSteps = sourceSteps; + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationKeyEvidence + */ + @JsonAnySetter + public SecurityAgentInvestigationKeyEvidence putAdditionalProperty(String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationKeyEvidence object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationKeyEvidence securityAgentInvestigationKeyEvidence = + (SecurityAgentInvestigationKeyEvidence) o; + return Objects.equals(this.category, securityAgentInvestigationKeyEvidence.category) + && Objects.equals(this.finding, securityAgentInvestigationKeyEvidence.finding) + && Objects.equals(this.sourceSteps, securityAgentInvestigationKeyEvidence.sourceSteps) + && Objects.equals( + this.additionalProperties, securityAgentInvestigationKeyEvidence.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash(category, finding, sourceSteps, additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationKeyEvidence {\n"); + sb.append(" category: ").append(toIndentedString(category)).append("\n"); + sb.append(" finding: ").append(toIndentedString(finding)).append("\n"); + sb.append(" sourceSteps: ").append(toIndentedString(sourceSteps)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationListItem.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationListItem.java new file mode 100644 index 00000000000..8b75b1048ee --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationListItem.java @@ -0,0 +1,217 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.HashMap; +import java.util.Map; +import java.util.Objects; + +/** An investigation in a list. */ +@JsonPropertyOrder({ + SecurityAgentInvestigationListItem.JSON_PROPERTY_ATTRIBUTES, + SecurityAgentInvestigationListItem.JSON_PROPERTY_ID, + SecurityAgentInvestigationListItem.JSON_PROPERTY_TYPE +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationListItem { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_ATTRIBUTES = "attributes"; + private SecurityAgentInvestigationListItemAttributes attributes; + + public static final String JSON_PROPERTY_ID = "id"; + private String id; + + public static final String JSON_PROPERTY_TYPE = "type"; + private SecurityAgentInvestigationType type = SecurityAgentInvestigationType.INVESTIGATIONS; + + public SecurityAgentInvestigationListItem() {} + + @JsonCreator + public SecurityAgentInvestigationListItem( + @JsonProperty(required = true, value = JSON_PROPERTY_ATTRIBUTES) + SecurityAgentInvestigationListItemAttributes attributes, + @JsonProperty(required = true, value = JSON_PROPERTY_ID) String id, + @JsonProperty(required = true, value = JSON_PROPERTY_TYPE) + SecurityAgentInvestigationType type) { + this.attributes = attributes; + this.unparsed |= attributes.unparsed; + this.id = id; + this.type = type; + this.unparsed |= !type.isValid(); + } + + public SecurityAgentInvestigationListItem attributes( + SecurityAgentInvestigationListItemAttributes attributes) { + this.attributes = attributes; + this.unparsed |= attributes.unparsed; + return this; + } + + /** + * Attributes of an investigation in a list. To get an investigation's full content, use the get + * investigation endpoint. + * + * @return attributes + */ + @JsonProperty(JSON_PROPERTY_ATTRIBUTES) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public SecurityAgentInvestigationListItemAttributes getAttributes() { + return attributes; + } + + public void setAttributes(SecurityAgentInvestigationListItemAttributes attributes) { + this.attributes = attributes; + if (attributes != null) { + this.unparsed |= attributes.unparsed; + } + } + + public SecurityAgentInvestigationListItem id(String id) { + this.id = id; + return this; + } + + /** + * The ID of the investigation. + * + * @return id + */ + @JsonProperty(JSON_PROPERTY_ID) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getId() { + return id; + } + + public void setId(String id) { + this.id = id; + } + + public SecurityAgentInvestigationListItem type(SecurityAgentInvestigationType type) { + this.type = type; + this.unparsed |= !type.isValid(); + return this; + } + + /** + * Type of the investigation resource. + * + * @return type + */ + @JsonProperty(JSON_PROPERTY_TYPE) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public SecurityAgentInvestigationType getType() { + return type; + } + + public void setType(SecurityAgentInvestigationType type) { + if (!type.isValid()) { + this.unparsed = true; + } + this.type = type; + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationListItem + */ + @JsonAnySetter + public SecurityAgentInvestigationListItem putAdditionalProperty(String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationListItem object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationListItem securityAgentInvestigationListItem = + (SecurityAgentInvestigationListItem) o; + return Objects.equals(this.attributes, securityAgentInvestigationListItem.attributes) + && Objects.equals(this.id, securityAgentInvestigationListItem.id) + && Objects.equals(this.type, securityAgentInvestigationListItem.type) + && Objects.equals( + this.additionalProperties, securityAgentInvestigationListItem.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash(attributes, id, type, additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationListItem {\n"); + sb.append(" attributes: ").append(toIndentedString(attributes)).append("\n"); + sb.append(" id: ").append(toIndentedString(id)).append("\n"); + sb.append(" type: ").append(toIndentedString(type)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationListItemAttributes.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationListItemAttributes.java new file mode 100644 index 00000000000..ce3c6ba6b4f --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationListItemAttributes.java @@ -0,0 +1,373 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.time.OffsetDateTime; +import java.util.HashMap; +import java.util.Map; +import java.util.Objects; + +/** + * Attributes of an investigation in a list. To get an investigation's full content, use the get + * investigation endpoint. + */ +@JsonPropertyOrder({ + SecurityAgentInvestigationListItemAttributes.JSON_PROPERTY_CREATED_AT, + SecurityAgentInvestigationListItemAttributes.JSON_PROPERTY_IS_LATEST, + SecurityAgentInvestigationListItemAttributes.JSON_PROPERTY_RULE_ID, + SecurityAgentInvestigationListItemAttributes.JSON_PROPERTY_SIGNAL, + SecurityAgentInvestigationListItemAttributes.JSON_PROPERTY_SIGNAL_ID, + SecurityAgentInvestigationListItemAttributes.JSON_PROPERTY_STATE, + SecurityAgentInvestigationListItemAttributes.JSON_PROPERTY_UPDATED_AT, + SecurityAgentInvestigationListItemAttributes.JSON_PROPERTY_VERDICT +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationListItemAttributes { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_CREATED_AT = "created_at"; + private OffsetDateTime createdAt; + + public static final String JSON_PROPERTY_IS_LATEST = "is_latest"; + private Boolean isLatest; + + public static final String JSON_PROPERTY_RULE_ID = "rule_id"; + private String ruleId; + + public static final String JSON_PROPERTY_SIGNAL = "signal"; + private SecurityAgentInvestigationSignal signal; + + public static final String JSON_PROPERTY_SIGNAL_ID = "signal_id"; + private String signalId; + + public static final String JSON_PROPERTY_STATE = "state"; + private SecurityAgentInvestigationState state; + + public static final String JSON_PROPERTY_UPDATED_AT = "updated_at"; + private OffsetDateTime updatedAt; + + public static final String JSON_PROPERTY_VERDICT = "verdict"; + private SecurityAgentInvestigationVerdict verdict; + + public SecurityAgentInvestigationListItemAttributes() {} + + @JsonCreator + public SecurityAgentInvestigationListItemAttributes( + @JsonProperty(required = true, value = JSON_PROPERTY_IS_LATEST) Boolean isLatest, + @JsonProperty(required = true, value = JSON_PROPERTY_RULE_ID) String ruleId, + @JsonProperty(required = true, value = JSON_PROPERTY_SIGNAL_ID) String signalId, + @JsonProperty(required = true, value = JSON_PROPERTY_STATE) + SecurityAgentInvestigationState state) { + this.isLatest = isLatest; + this.ruleId = ruleId; + this.signalId = signalId; + this.state = state; + this.unparsed |= !state.isValid(); + } + + public SecurityAgentInvestigationListItemAttributes createdAt(OffsetDateTime createdAt) { + this.createdAt = createdAt; + return this; + } + + /** + * When the investigation started. + * + * @return createdAt + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_CREATED_AT) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public OffsetDateTime getCreatedAt() { + return createdAt; + } + + public void setCreatedAt(OffsetDateTime createdAt) { + this.createdAt = createdAt; + } + + public SecurityAgentInvestigationListItemAttributes isLatest(Boolean isLatest) { + this.isLatest = isLatest; + return this; + } + + /** + * Whether this is the latest investigation of the signal. Always true when + * filter[signal_id] isn't set. + * + * @return isLatest + */ + @JsonProperty(JSON_PROPERTY_IS_LATEST) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public Boolean getIsLatest() { + return isLatest; + } + + public void setIsLatest(Boolean isLatest) { + this.isLatest = isLatest; + } + + public SecurityAgentInvestigationListItemAttributes ruleId(String ruleId) { + this.ruleId = ruleId; + return this; + } + + /** + * ID of the detection rule that generated the signal. It can be empty while the investigation + * runs. + * + * @return ruleId + */ + @JsonProperty(JSON_PROPERTY_RULE_ID) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getRuleId() { + return ruleId; + } + + public void setRuleId(String ruleId) { + this.ruleId = ruleId; + } + + public SecurityAgentInvestigationListItemAttributes signal( + SecurityAgentInvestigationSignal signal) { + this.signal = signal; + this.unparsed |= signal.unparsed; + return this; + } + + /** + * Summary of the signal the investigation is about. + * + * @return signal + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_SIGNAL) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public SecurityAgentInvestigationSignal getSignal() { + return signal; + } + + public void setSignal(SecurityAgentInvestigationSignal signal) { + this.signal = signal; + if (signal != null) { + this.unparsed |= signal.unparsed; + } + } + + public SecurityAgentInvestigationListItemAttributes signalId(String signalId) { + this.signalId = signalId; + return this; + } + + /** + * ID of the signal, in its V1 form. + * + * @return signalId + */ + @JsonProperty(JSON_PROPERTY_SIGNAL_ID) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getSignalId() { + return signalId; + } + + public void setSignalId(String signalId) { + this.signalId = signalId; + } + + public SecurityAgentInvestigationListItemAttributes state(SecurityAgentInvestigationState state) { + this.state = state; + this.unparsed |= !state.isValid(); + return this; + } + + /** + * State of the investigation: investigating while it runs, completed + * after it has a result, or failed when it produced no result before its timeout. + * + * @return state + */ + @JsonProperty(JSON_PROPERTY_STATE) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public SecurityAgentInvestigationState getState() { + return state; + } + + public void setState(SecurityAgentInvestigationState state) { + if (!state.isValid()) { + this.unparsed = true; + } + this.state = state; + } + + public SecurityAgentInvestigationListItemAttributes updatedAt(OffsetDateTime updatedAt) { + this.updatedAt = updatedAt; + return this; + } + + /** + * When the investigation last changed. + * + * @return updatedAt + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_UPDATED_AT) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public OffsetDateTime getUpdatedAt() { + return updatedAt; + } + + public void setUpdatedAt(OffsetDateTime updatedAt) { + this.updatedAt = updatedAt; + } + + public SecurityAgentInvestigationListItemAttributes verdict( + SecurityAgentInvestigationVerdict verdict) { + this.verdict = verdict; + this.unparsed |= !verdict.isValid(); + return this; + } + + /** + * Verdict of the investigation. Only completed investigations have one. + * + * @return verdict + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_VERDICT) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public SecurityAgentInvestigationVerdict getVerdict() { + return verdict; + } + + public void setVerdict(SecurityAgentInvestigationVerdict verdict) { + if (!verdict.isValid()) { + this.unparsed = true; + } + this.verdict = verdict; + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationListItemAttributes + */ + @JsonAnySetter + public SecurityAgentInvestigationListItemAttributes putAdditionalProperty( + String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationListItemAttributes object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationListItemAttributes securityAgentInvestigationListItemAttributes = + (SecurityAgentInvestigationListItemAttributes) o; + return Objects.equals(this.createdAt, securityAgentInvestigationListItemAttributes.createdAt) + && Objects.equals(this.isLatest, securityAgentInvestigationListItemAttributes.isLatest) + && Objects.equals(this.ruleId, securityAgentInvestigationListItemAttributes.ruleId) + && Objects.equals(this.signal, securityAgentInvestigationListItemAttributes.signal) + && Objects.equals(this.signalId, securityAgentInvestigationListItemAttributes.signalId) + && Objects.equals(this.state, securityAgentInvestigationListItemAttributes.state) + && Objects.equals(this.updatedAt, securityAgentInvestigationListItemAttributes.updatedAt) + && Objects.equals(this.verdict, securityAgentInvestigationListItemAttributes.verdict) + && Objects.equals( + this.additionalProperties, + securityAgentInvestigationListItemAttributes.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash( + createdAt, + isLatest, + ruleId, + signal, + signalId, + state, + updatedAt, + verdict, + additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationListItemAttributes {\n"); + sb.append(" createdAt: ").append(toIndentedString(createdAt)).append("\n"); + sb.append(" isLatest: ").append(toIndentedString(isLatest)).append("\n"); + sb.append(" ruleId: ").append(toIndentedString(ruleId)).append("\n"); + sb.append(" signal: ").append(toIndentedString(signal)).append("\n"); + sb.append(" signalId: ").append(toIndentedString(signalId)).append("\n"); + sb.append(" state: ").append(toIndentedString(state)).append("\n"); + sb.append(" updatedAt: ").append(toIndentedString(updatedAt)).append("\n"); + sb.append(" verdict: ").append(toIndentedString(verdict)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationMitigationAction.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationMitigationAction.java new file mode 100644 index 00000000000..8df6b5f4e05 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationMitigationAction.java @@ -0,0 +1,410 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.time.OffsetDateTime; +import java.util.HashMap; +import java.util.Map; +import java.util.Objects; + +/** An action that applies a mitigation. */ +@JsonPropertyOrder({ + SecurityAgentInvestigationMitigationAction.JSON_PROPERTY_APPLIED, + SecurityAgentInvestigationMitigationAction.JSON_PROPERTY_APPLIED_AT, + SecurityAgentInvestigationMitigationAction.JSON_PROPERTY_APPLIED_BY, + SecurityAgentInvestigationMitigationAction.JSON_PROPERTY_FQN, + SecurityAgentInvestigationMitigationAction.JSON_PROPERTY_ID, + SecurityAgentInvestigationMitigationAction.JSON_PROPERTY_NAME, + SecurityAgentInvestigationMitigationAction.JSON_PROPERTY_RESOURCE, + SecurityAgentInvestigationMitigationAction.JSON_PROPERTY_SOURCE, + SecurityAgentInvestigationMitigationAction.JSON_PROPERTY_SOURCE_CONNECTED, + SecurityAgentInvestigationMitigationAction.JSON_PROPERTY_TARGET +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationMitigationAction { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_APPLIED = "applied"; + private Boolean applied; + + public static final String JSON_PROPERTY_APPLIED_AT = "applied_at"; + private OffsetDateTime appliedAt; + + public static final String JSON_PROPERTY_APPLIED_BY = "applied_by"; + private String appliedBy; + + public static final String JSON_PROPERTY_FQN = "fqn"; + private String fqn; + + public static final String JSON_PROPERTY_ID = "id"; + private String id; + + public static final String JSON_PROPERTY_NAME = "name"; + private String name; + + public static final String JSON_PROPERTY_RESOURCE = "resource"; + private String resource; + + public static final String JSON_PROPERTY_SOURCE = "source"; + private String source; + + public static final String JSON_PROPERTY_SOURCE_CONNECTED = "source_connected"; + private Boolean sourceConnected; + + public static final String JSON_PROPERTY_TARGET = "target"; + private String target; + + public SecurityAgentInvestigationMitigationAction() {} + + @JsonCreator + public SecurityAgentInvestigationMitigationAction( + @JsonProperty(required = true, value = JSON_PROPERTY_APPLIED) Boolean applied, + @JsonProperty(required = true, value = JSON_PROPERTY_ID) String id, + @JsonProperty(required = true, value = JSON_PROPERTY_SOURCE) String source, + @JsonProperty(required = true, value = JSON_PROPERTY_SOURCE_CONNECTED) + Boolean sourceConnected) { + this.applied = applied; + this.id = id; + this.source = source; + this.sourceConnected = sourceConnected; + } + + public SecurityAgentInvestigationMitigationAction applied(Boolean applied) { + this.applied = applied; + return this; + } + + /** + * Whether the action has run. + * + * @return applied + */ + @JsonProperty(JSON_PROPERTY_APPLIED) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public Boolean getApplied() { + return applied; + } + + public void setApplied(Boolean applied) { + this.applied = applied; + } + + public SecurityAgentInvestigationMitigationAction appliedAt(OffsetDateTime appliedAt) { + this.appliedAt = appliedAt; + return this; + } + + /** + * When the action ran. + * + * @return appliedAt + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_APPLIED_AT) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public OffsetDateTime getAppliedAt() { + return appliedAt; + } + + public void setAppliedAt(OffsetDateTime appliedAt) { + this.appliedAt = appliedAt; + } + + public SecurityAgentInvestigationMitigationAction appliedBy(String appliedBy) { + this.appliedBy = appliedBy; + return this; + } + + /** + * Who ran the action. + * + * @return appliedBy + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_APPLIED_BY) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public String getAppliedBy() { + return appliedBy; + } + + public void setAppliedBy(String appliedBy) { + this.appliedBy = appliedBy; + } + + public SecurityAgentInvestigationMitigationAction fqn(String fqn) { + this.fqn = fqn; + return this; + } + + /** + * ID of the action in the Action Catalog. + * + * @return fqn + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_FQN) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public String getFqn() { + return fqn; + } + + public void setFqn(String fqn) { + this.fqn = fqn; + } + + public SecurityAgentInvestigationMitigationAction id(String id) { + this.id = id; + return this; + } + + /** + * ID of the action. + * + * @return id + */ + @JsonProperty(JSON_PROPERTY_ID) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getId() { + return id; + } + + public void setId(String id) { + this.id = id; + } + + public SecurityAgentInvestigationMitigationAction name(String name) { + this.name = name; + return this; + } + + /** + * Name of the action in the Action Catalog. + * + * @return name + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_NAME) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public String getName() { + return name; + } + + public void setName(String name) { + this.name = name; + } + + public SecurityAgentInvestigationMitigationAction resource(String resource) { + this.resource = resource; + return this; + } + + /** + * The resource the action changes. + * + * @return resource + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_RESOURCE) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public String getResource() { + return resource; + } + + public void setResource(String resource) { + this.resource = resource; + } + + public SecurityAgentInvestigationMitigationAction source(String source) { + this.source = source; + return this; + } + + /** + * Integration that runs the action, such as dd, aws, or okta + * . + * + * @return source + */ + @JsonProperty(JSON_PROPERTY_SOURCE) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getSource() { + return source; + } + + public void setSource(String source) { + this.source = source; + } + + public SecurityAgentInvestigationMitigationAction sourceConnected(Boolean sourceConnected) { + this.sourceConnected = sourceConnected; + return this; + } + + /** + * Whether the organization has a connection that can run the action. + * + * @return sourceConnected + */ + @JsonProperty(JSON_PROPERTY_SOURCE_CONNECTED) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public Boolean getSourceConnected() { + return sourceConnected; + } + + public void setSourceConnected(Boolean sourceConnected) { + this.sourceConnected = sourceConnected; + } + + public SecurityAgentInvestigationMitigationAction target(String target) { + this.target = target; + return this; + } + + /** + * What the action targets. + * + * @return target + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_TARGET) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public String getTarget() { + return target; + } + + public void setTarget(String target) { + this.target = target; + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationMitigationAction + */ + @JsonAnySetter + public SecurityAgentInvestigationMitigationAction putAdditionalProperty( + String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationMitigationAction object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationMitigationAction securityAgentInvestigationMitigationAction = + (SecurityAgentInvestigationMitigationAction) o; + return Objects.equals(this.applied, securityAgentInvestigationMitigationAction.applied) + && Objects.equals(this.appliedAt, securityAgentInvestigationMitigationAction.appliedAt) + && Objects.equals(this.appliedBy, securityAgentInvestigationMitigationAction.appliedBy) + && Objects.equals(this.fqn, securityAgentInvestigationMitigationAction.fqn) + && Objects.equals(this.id, securityAgentInvestigationMitigationAction.id) + && Objects.equals(this.name, securityAgentInvestigationMitigationAction.name) + && Objects.equals(this.resource, securityAgentInvestigationMitigationAction.resource) + && Objects.equals(this.source, securityAgentInvestigationMitigationAction.source) + && Objects.equals( + this.sourceConnected, securityAgentInvestigationMitigationAction.sourceConnected) + && Objects.equals(this.target, securityAgentInvestigationMitigationAction.target) + && Objects.equals( + this.additionalProperties, + securityAgentInvestigationMitigationAction.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash( + applied, + appliedAt, + appliedBy, + fqn, + id, + name, + resource, + source, + sourceConnected, + target, + additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationMitigationAction {\n"); + sb.append(" applied: ").append(toIndentedString(applied)).append("\n"); + sb.append(" appliedAt: ").append(toIndentedString(appliedAt)).append("\n"); + sb.append(" appliedBy: ").append(toIndentedString(appliedBy)).append("\n"); + sb.append(" fqn: ").append(toIndentedString(fqn)).append("\n"); + sb.append(" id: ").append(toIndentedString(id)).append("\n"); + sb.append(" name: ").append(toIndentedString(name)).append("\n"); + sb.append(" resource: ").append(toIndentedString(resource)).append("\n"); + sb.append(" source: ").append(toIndentedString(source)).append("\n"); + sb.append(" sourceConnected: ").append(toIndentedString(sourceConnected)).append("\n"); + sb.append(" target: ").append(toIndentedString(target)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationMitigationSuggestion.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationMitigationSuggestion.java new file mode 100644 index 00000000000..f85c45104de --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationMitigationSuggestion.java @@ -0,0 +1,340 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Objects; + +/** A suggested mitigation. */ +@JsonPropertyOrder({ + SecurityAgentInvestigationMitigationSuggestion.JSON_PROPERTY_ACTIONS, + SecurityAgentInvestigationMitigationSuggestion.JSON_PROPERTY_ID, + SecurityAgentInvestigationMitigationSuggestion.JSON_PROPERTY_RATIONALE, + SecurityAgentInvestigationMitigationSuggestion.JSON_PROPERTY_RECOMMENDED, + SecurityAgentInvestigationMitigationSuggestion.JSON_PROPERTY_SCOPE_NOTE, + SecurityAgentInvestigationMitigationSuggestion.JSON_PROPERTY_STEP, + SecurityAgentInvestigationMitigationSuggestion.JSON_PROPERTY_TITLE +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationMitigationSuggestion { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_ACTIONS = "actions"; + private List actions = null; + + public static final String JSON_PROPERTY_ID = "id"; + private String id; + + public static final String JSON_PROPERTY_RATIONALE = "rationale"; + private String rationale; + + public static final String JSON_PROPERTY_RECOMMENDED = "recommended"; + private Boolean recommended; + + public static final String JSON_PROPERTY_SCOPE_NOTE = "scope_note"; + private String scopeNote; + + public static final String JSON_PROPERTY_STEP = "step"; + private Long step; + + public static final String JSON_PROPERTY_TITLE = "title"; + private String title; + + public SecurityAgentInvestigationMitigationSuggestion() {} + + @JsonCreator + public SecurityAgentInvestigationMitigationSuggestion( + @JsonProperty(required = true, value = JSON_PROPERTY_ID) String id, + @JsonProperty(required = true, value = JSON_PROPERTY_RATIONALE) String rationale, + @JsonProperty(required = true, value = JSON_PROPERTY_RECOMMENDED) Boolean recommended, + @JsonProperty(required = true, value = JSON_PROPERTY_STEP) Long step, + @JsonProperty(required = true, value = JSON_PROPERTY_TITLE) String title) { + this.id = id; + this.rationale = rationale; + this.recommended = recommended; + this.step = step; + this.title = title; + } + + public SecurityAgentInvestigationMitigationSuggestion actions( + List actions) { + this.actions = actions; + if (actions != null) { + for (SecurityAgentInvestigationMitigationAction item : actions) { + this.unparsed |= item.unparsed; + } + } + return this; + } + + public SecurityAgentInvestigationMitigationSuggestion addActionsItem( + SecurityAgentInvestigationMitigationAction actionsItem) { + if (this.actions == null) { + this.actions = new ArrayList<>(); + } + this.actions.add(actionsItem); + this.unparsed |= actionsItem.unparsed; + return this; + } + + /** + * Actions that apply the mitigation. + * + * @return actions + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_ACTIONS) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public List getActions() { + return actions; + } + + public void setActions(List actions) { + this.actions = actions; + if (actions != null) { + for (SecurityAgentInvestigationMitigationAction item : actions) { + this.unparsed |= item.unparsed; + } + } + } + + public SecurityAgentInvestigationMitigationSuggestion id(String id) { + this.id = id; + return this; + } + + /** + * ID of the mitigation. + * + * @return id + */ + @JsonProperty(JSON_PROPERTY_ID) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getId() { + return id; + } + + public void setId(String id) { + this.id = id; + } + + public SecurityAgentInvestigationMitigationSuggestion rationale(String rationale) { + this.rationale = rationale; + return this; + } + + /** + * Why the mitigation is suggested. + * + * @return rationale + */ + @JsonProperty(JSON_PROPERTY_RATIONALE) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getRationale() { + return rationale; + } + + public void setRationale(String rationale) { + this.rationale = rationale; + } + + public SecurityAgentInvestigationMitigationSuggestion recommended(Boolean recommended) { + this.recommended = recommended; + return this; + } + + /** + * Whether the mitigation is recommended. + * + * @return recommended + */ + @JsonProperty(JSON_PROPERTY_RECOMMENDED) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public Boolean getRecommended() { + return recommended; + } + + public void setRecommended(Boolean recommended) { + this.recommended = recommended; + } + + public SecurityAgentInvestigationMitigationSuggestion scopeNote(String scopeNote) { + this.scopeNote = scopeNote; + return this; + } + + /** + * What the mitigation applies to. + * + * @return scopeNote + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_SCOPE_NOTE) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public String getScopeNote() { + return scopeNote; + } + + public void setScopeNote(String scopeNote) { + this.scopeNote = scopeNote; + } + + public SecurityAgentInvestigationMitigationSuggestion step(Long step) { + this.step = step; + return this; + } + + /** + * Order in which to apply the mitigation, starting at 1. + * + * @return step + */ + @JsonProperty(JSON_PROPERTY_STEP) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public Long getStep() { + return step; + } + + public void setStep(Long step) { + this.step = step; + } + + public SecurityAgentInvestigationMitigationSuggestion title(String title) { + this.title = title; + return this; + } + + /** + * Title of the mitigation. + * + * @return title + */ + @JsonProperty(JSON_PROPERTY_TITLE) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getTitle() { + return title; + } + + public void setTitle(String title) { + this.title = title; + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationMitigationSuggestion + */ + @JsonAnySetter + public SecurityAgentInvestigationMitigationSuggestion putAdditionalProperty( + String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationMitigationSuggestion object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationMitigationSuggestion securityAgentInvestigationMitigationSuggestion = + (SecurityAgentInvestigationMitigationSuggestion) o; + return Objects.equals(this.actions, securityAgentInvestigationMitigationSuggestion.actions) + && Objects.equals(this.id, securityAgentInvestigationMitigationSuggestion.id) + && Objects.equals(this.rationale, securityAgentInvestigationMitigationSuggestion.rationale) + && Objects.equals( + this.recommended, securityAgentInvestigationMitigationSuggestion.recommended) + && Objects.equals(this.scopeNote, securityAgentInvestigationMitigationSuggestion.scopeNote) + && Objects.equals(this.step, securityAgentInvestigationMitigationSuggestion.step) + && Objects.equals(this.title, securityAgentInvestigationMitigationSuggestion.title) + && Objects.equals( + this.additionalProperties, + securityAgentInvestigationMitigationSuggestion.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash( + actions, id, rationale, recommended, scopeNote, step, title, additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationMitigationSuggestion {\n"); + sb.append(" actions: ").append(toIndentedString(actions)).append("\n"); + sb.append(" id: ").append(toIndentedString(id)).append("\n"); + sb.append(" rationale: ").append(toIndentedString(rationale)).append("\n"); + sb.append(" recommended: ").append(toIndentedString(recommended)).append("\n"); + sb.append(" scopeNote: ").append(toIndentedString(scopeNote)).append("\n"); + sb.append(" step: ").append(toIndentedString(step)).append("\n"); + sb.append(" title: ").append(toIndentedString(title)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationNoRunReason.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationNoRunReason.java new file mode 100644 index 00000000000..f7288db65a8 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationNoRunReason.java @@ -0,0 +1,88 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.datadog.api.client.ModelEnum; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.core.JsonGenerator; +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.databind.SerializerProvider; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; +import com.fasterxml.jackson.databind.ser.std.StdSerializer; +import java.io.IOException; +import java.util.Arrays; +import java.util.HashSet; +import java.util.Set; + +/** + * Why filter[signal_id] returned no investigation. Set only on the first page of an + * empty result. The reason is based on the organization's current settings. Poll again only on + * investigation_not_started, after the number of seconds in the Retry-After + * header; treat the others as final for this signal. - investigation_not_started + * : no investigation has started yet, but one may still start. - not_investigated + * : no investigation started within an hour of the signal, so none is expected. The signal + * was skipped for a reason this API doesn't report, such as its severity or a rate limit. - + * rule_not_enabled: the signal's detection rule doesn't have Bits Security Analyst enabled, + * so no investigation starts automatically. - signal_not_found: the ID isn't a signal + * ID, or no signal with this ID exists in the organization. - org_not_activated: the + * organization hasn't activated Bits Security Analyst. + */ +@JsonSerialize( + using = + SecurityAgentInvestigationNoRunReason.SecurityAgentInvestigationNoRunReasonSerializer.class) +public class SecurityAgentInvestigationNoRunReason extends ModelEnum { + + private static final Set allowedValues = + new HashSet( + Arrays.asList( + "investigation_not_started", + "not_investigated", + "rule_not_enabled", + "signal_not_found", + "org_not_activated")); + + public static final SecurityAgentInvestigationNoRunReason INVESTIGATION_NOT_STARTED = + new SecurityAgentInvestigationNoRunReason("investigation_not_started"); + public static final SecurityAgentInvestigationNoRunReason NOT_INVESTIGATED = + new SecurityAgentInvestigationNoRunReason("not_investigated"); + public static final SecurityAgentInvestigationNoRunReason RULE_NOT_ENABLED = + new SecurityAgentInvestigationNoRunReason("rule_not_enabled"); + public static final SecurityAgentInvestigationNoRunReason SIGNAL_NOT_FOUND = + new SecurityAgentInvestigationNoRunReason("signal_not_found"); + public static final SecurityAgentInvestigationNoRunReason ORG_NOT_ACTIVATED = + new SecurityAgentInvestigationNoRunReason("org_not_activated"); + + SecurityAgentInvestigationNoRunReason(String value) { + super(value, allowedValues); + } + + public static class SecurityAgentInvestigationNoRunReasonSerializer + extends StdSerializer { + public SecurityAgentInvestigationNoRunReasonSerializer( + Class t) { + super(t); + } + + public SecurityAgentInvestigationNoRunReasonSerializer() { + this(null); + } + + @Override + public void serialize( + SecurityAgentInvestigationNoRunReason value, + JsonGenerator jgen, + SerializerProvider provider) + throws IOException, JsonProcessingException { + jgen.writeObject(value.value); + } + } + + @JsonCreator + public static SecurityAgentInvestigationNoRunReason fromValue(String value) { + return new SecurityAgentInvestigationNoRunReason(value); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationResponse.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationResponse.java new file mode 100644 index 00000000000..3f12f464092 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationResponse.java @@ -0,0 +1,152 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.HashMap; +import java.util.Map; +import java.util.Objects; + +/** An investigation. */ +@JsonPropertyOrder({SecurityAgentInvestigationResponse.JSON_PROPERTY_DATA}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationResponse { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_DATA = "data"; + private SecurityAgentInvestigationData data; + + public SecurityAgentInvestigationResponse() {} + + @JsonCreator + public SecurityAgentInvestigationResponse( + @JsonProperty(required = true, value = JSON_PROPERTY_DATA) + SecurityAgentInvestigationData data) { + this.data = data; + this.unparsed |= data.unparsed; + } + + public SecurityAgentInvestigationResponse data(SecurityAgentInvestigationData data) { + this.data = data; + this.unparsed |= data.unparsed; + return this; + } + + /** + * An investigation and its content. attributes is absent when + * fields[investigations] is empty or lists only attributes the investigation doesn't have. + * + * @return data + */ + @JsonProperty(JSON_PROPERTY_DATA) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public SecurityAgentInvestigationData getData() { + return data; + } + + public void setData(SecurityAgentInvestigationData data) { + this.data = data; + if (data != null) { + this.unparsed |= data.unparsed; + } + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationResponse + */ + @JsonAnySetter + public SecurityAgentInvestigationResponse putAdditionalProperty(String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationResponse object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationResponse securityAgentInvestigationResponse = + (SecurityAgentInvestigationResponse) o; + return Objects.equals(this.data, securityAgentInvestigationResponse.data) + && Objects.equals( + this.additionalProperties, securityAgentInvestigationResponse.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash(data, additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationResponse {\n"); + sb.append(" data: ").append(toIndentedString(data)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationResponseSuggestions.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationResponseSuggestions.java new file mode 100644 index 00000000000..dbb0f4c7de9 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationResponseSuggestions.java @@ -0,0 +1,206 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Objects; + +/** Suggested responses to the signal. */ +@JsonPropertyOrder({ + SecurityAgentInvestigationResponseSuggestions.JSON_PROPERTY_MITIGATION_SUGGESTIONS, + SecurityAgentInvestigationResponseSuggestions.JSON_PROPERTY_RULE_TUNING_SUGGESTIONS +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationResponseSuggestions { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_MITIGATION_SUGGESTIONS = "mitigation_suggestions"; + private List mitigationSuggestions = null; + + public static final String JSON_PROPERTY_RULE_TUNING_SUGGESTIONS = "rule_tuning_suggestions"; + private SecurityAgentInvestigationRuleTuningSuggestions ruleTuningSuggestions; + + public SecurityAgentInvestigationResponseSuggestions mitigationSuggestions( + List mitigationSuggestions) { + this.mitigationSuggestions = mitigationSuggestions; + if (mitigationSuggestions != null) { + for (SecurityAgentInvestigationMitigationSuggestion item : mitigationSuggestions) { + this.unparsed |= item.unparsed; + } + } + return this; + } + + public SecurityAgentInvestigationResponseSuggestions addMitigationSuggestionsItem( + SecurityAgentInvestigationMitigationSuggestion mitigationSuggestionsItem) { + if (this.mitigationSuggestions == null) { + this.mitigationSuggestions = new ArrayList<>(); + } + this.mitigationSuggestions.add(mitigationSuggestionsItem); + this.unparsed |= mitigationSuggestionsItem.unparsed; + return this; + } + + /** + * Suggested mitigations, in the order to apply them. + * + * @return mitigationSuggestions + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_MITIGATION_SUGGESTIONS) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public List getMitigationSuggestions() { + return mitigationSuggestions; + } + + public void setMitigationSuggestions( + List mitigationSuggestions) { + this.mitigationSuggestions = mitigationSuggestions; + if (mitigationSuggestions != null) { + for (SecurityAgentInvestigationMitigationSuggestion item : mitigationSuggestions) { + this.unparsed |= item.unparsed; + } + } + } + + public SecurityAgentInvestigationResponseSuggestions ruleTuningSuggestions( + SecurityAgentInvestigationRuleTuningSuggestions ruleTuningSuggestions) { + this.ruleTuningSuggestions = ruleTuningSuggestions; + this.unparsed |= ruleTuningSuggestions.unparsed; + return this; + } + + /** + * Suggestions to tune the detection rule that generated the signal. + * + * @return ruleTuningSuggestions + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_RULE_TUNING_SUGGESTIONS) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public SecurityAgentInvestigationRuleTuningSuggestions getRuleTuningSuggestions() { + return ruleTuningSuggestions; + } + + public void setRuleTuningSuggestions( + SecurityAgentInvestigationRuleTuningSuggestions ruleTuningSuggestions) { + this.ruleTuningSuggestions = ruleTuningSuggestions; + if (ruleTuningSuggestions != null) { + this.unparsed |= ruleTuningSuggestions.unparsed; + } + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationResponseSuggestions + */ + @JsonAnySetter + public SecurityAgentInvestigationResponseSuggestions putAdditionalProperty( + String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationResponseSuggestions object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationResponseSuggestions securityAgentInvestigationResponseSuggestions = + (SecurityAgentInvestigationResponseSuggestions) o; + return Objects.equals( + this.mitigationSuggestions, + securityAgentInvestigationResponseSuggestions.mitigationSuggestions) + && Objects.equals( + this.ruleTuningSuggestions, + securityAgentInvestigationResponseSuggestions.ruleTuningSuggestions) + && Objects.equals( + this.additionalProperties, + securityAgentInvestigationResponseSuggestions.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash(mitigationSuggestions, ruleTuningSuggestions, additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationResponseSuggestions {\n"); + sb.append(" mitigationSuggestions: ") + .append(toIndentedString(mitigationSuggestions)) + .append("\n"); + sb.append(" ruleTuningSuggestions: ") + .append(toIndentedString(ruleTuningSuggestions)) + .append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationRuleTuningCondition.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationRuleTuningCondition.java new file mode 100644 index 00000000000..8168d68fe61 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationRuleTuningCondition.java @@ -0,0 +1,177 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.HashMap; +import java.util.Map; +import java.util.Objects; + +/** A condition of a rule tuning suggestion. */ +@JsonPropertyOrder({ + SecurityAgentInvestigationRuleTuningCondition.JSON_PROPERTY_FIELD, + SecurityAgentInvestigationRuleTuningCondition.JSON_PROPERTY_VALUE +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationRuleTuningCondition { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_FIELD = "field"; + private String field; + + public static final String JSON_PROPERTY_VALUE = "value"; + private String value; + + public SecurityAgentInvestigationRuleTuningCondition() {} + + @JsonCreator + public SecurityAgentInvestigationRuleTuningCondition( + @JsonProperty(required = true, value = JSON_PROPERTY_FIELD) String field, + @JsonProperty(required = true, value = JSON_PROPERTY_VALUE) String value) { + this.field = field; + this.value = value; + } + + public SecurityAgentInvestigationRuleTuningCondition field(String field) { + this.field = field; + return this; + } + + /** + * Attribute the condition checks. + * + * @return field + */ + @JsonProperty(JSON_PROPERTY_FIELD) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getField() { + return field; + } + + public void setField(String field) { + this.field = field; + } + + public SecurityAgentInvestigationRuleTuningCondition value(String value) { + this.value = value; + return this; + } + + /** + * Value the attribute is compared with. + * + * @return value + */ + @JsonProperty(JSON_PROPERTY_VALUE) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getValue() { + return value; + } + + public void setValue(String value) { + this.value = value; + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationRuleTuningCondition + */ + @JsonAnySetter + public SecurityAgentInvestigationRuleTuningCondition putAdditionalProperty( + String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationRuleTuningCondition object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationRuleTuningCondition securityAgentInvestigationRuleTuningCondition = + (SecurityAgentInvestigationRuleTuningCondition) o; + return Objects.equals(this.field, securityAgentInvestigationRuleTuningCondition.field) + && Objects.equals(this.value, securityAgentInvestigationRuleTuningCondition.value) + && Objects.equals( + this.additionalProperties, + securityAgentInvestigationRuleTuningCondition.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash(field, value, additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationRuleTuningCondition {\n"); + sb.append(" field: ").append(toIndentedString(field)).append("\n"); + sb.append(" value: ").append(toIndentedString(value)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationRuleTuningSuggestion.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationRuleTuningSuggestion.java new file mode 100644 index 00000000000..0aa8f3aff75 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationRuleTuningSuggestion.java @@ -0,0 +1,472 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Objects; + +/** A suggestion to tune the detection rule. */ +@JsonPropertyOrder({ + SecurityAgentInvestigationRuleTuningSuggestion.JSON_PROPERTY_ACTION_TYPE, + SecurityAgentInvestigationRuleTuningSuggestion.JSON_PROPERTY_CONDITIONS, + SecurityAgentInvestigationRuleTuningSuggestion.JSON_PROPERTY_DESCRIPTION, + SecurityAgentInvestigationRuleTuningSuggestion.JSON_PROPERTY_ESTIMATED_SILENCED_COUNT, + SecurityAgentInvestigationRuleTuningSuggestion.JSON_PROPERTY_ID, + SecurityAgentInvestigationRuleTuningSuggestion.JSON_PROPERTY_MATCH_LOGIC, + SecurityAgentInvestigationRuleTuningSuggestion.JSON_PROPERTY_RECOMMENDED, + SecurityAgentInvestigationRuleTuningSuggestion.JSON_PROPERTY_RULE_ID, + SecurityAgentInvestigationRuleTuningSuggestion.JSON_PROPERTY_TITLE, + SecurityAgentInvestigationRuleTuningSuggestion.JSON_PROPERTY_WARNING, + SecurityAgentInvestigationRuleTuningSuggestion.JSON_PROPERTY_WHY +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationRuleTuningSuggestion { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_ACTION_TYPE = "action_type"; + private String actionType; + + public static final String JSON_PROPERTY_CONDITIONS = "conditions"; + private List conditions = new ArrayList<>(); + + public static final String JSON_PROPERTY_DESCRIPTION = "description"; + private String description; + + public static final String JSON_PROPERTY_ESTIMATED_SILENCED_COUNT = "estimated_silenced_count"; + private Long estimatedSilencedCount; + + public static final String JSON_PROPERTY_ID = "id"; + private String id; + + public static final String JSON_PROPERTY_MATCH_LOGIC = "match_logic"; + private String matchLogic; + + public static final String JSON_PROPERTY_RECOMMENDED = "recommended"; + private Boolean recommended; + + public static final String JSON_PROPERTY_RULE_ID = "rule_id"; + private String ruleId; + + public static final String JSON_PROPERTY_TITLE = "title"; + private String title; + + public static final String JSON_PROPERTY_WARNING = "warning"; + private String warning; + + public static final String JSON_PROPERTY_WHY = "why"; + private String why; + + public SecurityAgentInvestigationRuleTuningSuggestion() {} + + @JsonCreator + public SecurityAgentInvestigationRuleTuningSuggestion( + @JsonProperty(required = true, value = JSON_PROPERTY_ACTION_TYPE) String actionType, + @JsonProperty(required = true, value = JSON_PROPERTY_CONDITIONS) + List conditions, + @JsonProperty(required = true, value = JSON_PROPERTY_DESCRIPTION) String description, + @JsonProperty(required = true, value = JSON_PROPERTY_ID) String id, + @JsonProperty(required = true, value = JSON_PROPERTY_MATCH_LOGIC) String matchLogic, + @JsonProperty(required = true, value = JSON_PROPERTY_RECOMMENDED) Boolean recommended, + @JsonProperty(required = true, value = JSON_PROPERTY_RULE_ID) String ruleId, + @JsonProperty(required = true, value = JSON_PROPERTY_TITLE) String title, + @JsonProperty(required = true, value = JSON_PROPERTY_WARNING) String warning, + @JsonProperty(required = true, value = JSON_PROPERTY_WHY) String why) { + this.actionType = actionType; + this.conditions = conditions; + for (SecurityAgentInvestigationRuleTuningCondition item : conditions) { + this.unparsed |= item.unparsed; + } + this.description = description; + this.id = id; + this.matchLogic = matchLogic; + this.recommended = recommended; + this.ruleId = ruleId; + this.title = title; + this.warning = warning; + this.why = why; + } + + public SecurityAgentInvestigationRuleTuningSuggestion actionType(String actionType) { + this.actionType = actionType; + return this; + } + + /** + * Kind of change the suggestion makes to the rule. + * + * @return actionType + */ + @JsonProperty(JSON_PROPERTY_ACTION_TYPE) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getActionType() { + return actionType; + } + + public void setActionType(String actionType) { + this.actionType = actionType; + } + + public SecurityAgentInvestigationRuleTuningSuggestion conditions( + List conditions) { + this.conditions = conditions; + for (SecurityAgentInvestigationRuleTuningCondition item : conditions) { + this.unparsed |= item.unparsed; + } + return this; + } + + public SecurityAgentInvestigationRuleTuningSuggestion addConditionsItem( + SecurityAgentInvestigationRuleTuningCondition conditionsItem) { + this.conditions.add(conditionsItem); + this.unparsed |= conditionsItem.unparsed; + return this; + } + + /** + * The conditions the change applies to. + * + * @return conditions + */ + @JsonProperty(JSON_PROPERTY_CONDITIONS) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public List getConditions() { + return conditions; + } + + public void setConditions(List conditions) { + this.conditions = conditions; + if (conditions != null) { + for (SecurityAgentInvestigationRuleTuningCondition item : conditions) { + this.unparsed |= item.unparsed; + } + } + } + + public SecurityAgentInvestigationRuleTuningSuggestion description(String description) { + this.description = description; + return this; + } + + /** + * What the suggestion changes. + * + * @return description + */ + @JsonProperty(JSON_PROPERTY_DESCRIPTION) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getDescription() { + return description; + } + + public void setDescription(String description) { + this.description = description; + } + + public SecurityAgentInvestigationRuleTuningSuggestion estimatedSilencedCount( + Long estimatedSilencedCount) { + this.estimatedSilencedCount = estimatedSilencedCount; + return this; + } + + /** + * Estimated number of signals the change would have silenced in the window. + * + * @return estimatedSilencedCount + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_ESTIMATED_SILENCED_COUNT) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public Long getEstimatedSilencedCount() { + return estimatedSilencedCount; + } + + public void setEstimatedSilencedCount(Long estimatedSilencedCount) { + this.estimatedSilencedCount = estimatedSilencedCount; + } + + public SecurityAgentInvestigationRuleTuningSuggestion id(String id) { + this.id = id; + return this; + } + + /** + * ID of the suggestion. + * + * @return id + */ + @JsonProperty(JSON_PROPERTY_ID) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getId() { + return id; + } + + public void setId(String id) { + this.id = id; + } + + public SecurityAgentInvestigationRuleTuningSuggestion matchLogic(String matchLogic) { + this.matchLogic = matchLogic; + return this; + } + + /** + * How the conditions combine, such as AND or OR. + * + * @return matchLogic + */ + @JsonProperty(JSON_PROPERTY_MATCH_LOGIC) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getMatchLogic() { + return matchLogic; + } + + public void setMatchLogic(String matchLogic) { + this.matchLogic = matchLogic; + } + + public SecurityAgentInvestigationRuleTuningSuggestion recommended(Boolean recommended) { + this.recommended = recommended; + return this; + } + + /** + * Whether the suggestion is recommended. + * + * @return recommended + */ + @JsonProperty(JSON_PROPERTY_RECOMMENDED) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public Boolean getRecommended() { + return recommended; + } + + public void setRecommended(Boolean recommended) { + this.recommended = recommended; + } + + public SecurityAgentInvestigationRuleTuningSuggestion ruleId(String ruleId) { + this.ruleId = ruleId; + return this; + } + + /** + * ID of the detection rule. + * + * @return ruleId + */ + @JsonProperty(JSON_PROPERTY_RULE_ID) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getRuleId() { + return ruleId; + } + + public void setRuleId(String ruleId) { + this.ruleId = ruleId; + } + + public SecurityAgentInvestigationRuleTuningSuggestion title(String title) { + this.title = title; + return this; + } + + /** + * Title of the suggestion. + * + * @return title + */ + @JsonProperty(JSON_PROPERTY_TITLE) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getTitle() { + return title; + } + + public void setTitle(String title) { + this.title = title; + } + + public SecurityAgentInvestigationRuleTuningSuggestion warning(String warning) { + this.warning = warning; + return this; + } + + /** + * What the change could hide. It can be empty. + * + * @return warning + */ + @JsonProperty(JSON_PROPERTY_WARNING) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getWarning() { + return warning; + } + + public void setWarning(String warning) { + this.warning = warning; + } + + public SecurityAgentInvestigationRuleTuningSuggestion why(String why) { + this.why = why; + return this; + } + + /** + * Why the suggestion is made. + * + * @return why + */ + @JsonProperty(JSON_PROPERTY_WHY) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getWhy() { + return why; + } + + public void setWhy(String why) { + this.why = why; + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationRuleTuningSuggestion + */ + @JsonAnySetter + public SecurityAgentInvestigationRuleTuningSuggestion putAdditionalProperty( + String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationRuleTuningSuggestion object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationRuleTuningSuggestion securityAgentInvestigationRuleTuningSuggestion = + (SecurityAgentInvestigationRuleTuningSuggestion) o; + return Objects.equals( + this.actionType, securityAgentInvestigationRuleTuningSuggestion.actionType) + && Objects.equals( + this.conditions, securityAgentInvestigationRuleTuningSuggestion.conditions) + && Objects.equals( + this.description, securityAgentInvestigationRuleTuningSuggestion.description) + && Objects.equals( + this.estimatedSilencedCount, + securityAgentInvestigationRuleTuningSuggestion.estimatedSilencedCount) + && Objects.equals(this.id, securityAgentInvestigationRuleTuningSuggestion.id) + && Objects.equals( + this.matchLogic, securityAgentInvestigationRuleTuningSuggestion.matchLogic) + && Objects.equals( + this.recommended, securityAgentInvestigationRuleTuningSuggestion.recommended) + && Objects.equals(this.ruleId, securityAgentInvestigationRuleTuningSuggestion.ruleId) + && Objects.equals(this.title, securityAgentInvestigationRuleTuningSuggestion.title) + && Objects.equals(this.warning, securityAgentInvestigationRuleTuningSuggestion.warning) + && Objects.equals(this.why, securityAgentInvestigationRuleTuningSuggestion.why) + && Objects.equals( + this.additionalProperties, + securityAgentInvestigationRuleTuningSuggestion.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash( + actionType, + conditions, + description, + estimatedSilencedCount, + id, + matchLogic, + recommended, + ruleId, + title, + warning, + why, + additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationRuleTuningSuggestion {\n"); + sb.append(" actionType: ").append(toIndentedString(actionType)).append("\n"); + sb.append(" conditions: ").append(toIndentedString(conditions)).append("\n"); + sb.append(" description: ").append(toIndentedString(description)).append("\n"); + sb.append(" estimatedSilencedCount: ") + .append(toIndentedString(estimatedSilencedCount)) + .append("\n"); + sb.append(" id: ").append(toIndentedString(id)).append("\n"); + sb.append(" matchLogic: ").append(toIndentedString(matchLogic)).append("\n"); + sb.append(" recommended: ").append(toIndentedString(recommended)).append("\n"); + sb.append(" ruleId: ").append(toIndentedString(ruleId)).append("\n"); + sb.append(" title: ").append(toIndentedString(title)).append("\n"); + sb.append(" warning: ").append(toIndentedString(warning)).append("\n"); + sb.append(" why: ").append(toIndentedString(why)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationRuleTuningSuggestions.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationRuleTuningSuggestions.java new file mode 100644 index 00000000000..f68d9327455 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationRuleTuningSuggestions.java @@ -0,0 +1,356 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Objects; + +/** Suggestions to tune the detection rule that generated the signal. */ +@JsonPropertyOrder({ + SecurityAgentInvestigationRuleTuningSuggestions.JSON_PROPERTY_OCCURRENCE_WINDOW_DAYS, + SecurityAgentInvestigationRuleTuningSuggestions.JSON_PROPERTY_REASONING, + SecurityAgentInvestigationRuleTuningSuggestions.JSON_PROPERTY_RULE_ID, + SecurityAgentInvestigationRuleTuningSuggestions.JSON_PROPERTY_RULE_NAME, + SecurityAgentInvestigationRuleTuningSuggestions.JSON_PROPERTY_RULE_SIGNAL_TOTAL, + SecurityAgentInvestigationRuleTuningSuggestions.JSON_PROPERTY_SUGGESTIONS, + SecurityAgentInvestigationRuleTuningSuggestions.JSON_PROPERTY_SUMMARY +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationRuleTuningSuggestions { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_OCCURRENCE_WINDOW_DAYS = "occurrence_window_days"; + private Long occurrenceWindowDays; + + public static final String JSON_PROPERTY_REASONING = "reasoning"; + private String reasoning; + + public static final String JSON_PROPERTY_RULE_ID = "rule_id"; + private String ruleId; + + public static final String JSON_PROPERTY_RULE_NAME = "rule_name"; + private String ruleName; + + public static final String JSON_PROPERTY_RULE_SIGNAL_TOTAL = "rule_signal_total"; + private Long ruleSignalTotal; + + public static final String JSON_PROPERTY_SUGGESTIONS = "suggestions"; + private List suggestions = new ArrayList<>(); + + public static final String JSON_PROPERTY_SUMMARY = "summary"; + private String summary; + + public SecurityAgentInvestigationRuleTuningSuggestions() {} + + @JsonCreator + public SecurityAgentInvestigationRuleTuningSuggestions( + @JsonProperty(required = true, value = JSON_PROPERTY_OCCURRENCE_WINDOW_DAYS) + Long occurrenceWindowDays, + @JsonProperty(required = true, value = JSON_PROPERTY_REASONING) String reasoning, + @JsonProperty(required = true, value = JSON_PROPERTY_RULE_ID) String ruleId, + @JsonProperty(required = true, value = JSON_PROPERTY_RULE_NAME) String ruleName, + @JsonProperty(required = true, value = JSON_PROPERTY_RULE_SIGNAL_TOTAL) Long ruleSignalTotal, + @JsonProperty(required = true, value = JSON_PROPERTY_SUGGESTIONS) + List suggestions, + @JsonProperty(required = true, value = JSON_PROPERTY_SUMMARY) String summary) { + this.occurrenceWindowDays = occurrenceWindowDays; + this.reasoning = reasoning; + this.ruleId = ruleId; + this.ruleName = ruleName; + this.ruleSignalTotal = ruleSignalTotal; + this.suggestions = suggestions; + for (SecurityAgentInvestigationRuleTuningSuggestion item : suggestions) { + this.unparsed |= item.unparsed; + } + this.summary = summary; + } + + public SecurityAgentInvestigationRuleTuningSuggestions occurrenceWindowDays( + Long occurrenceWindowDays) { + this.occurrenceWindowDays = occurrenceWindowDays; + return this; + } + + /** + * Length of the window, in days. + * + * @return occurrenceWindowDays + */ + @JsonProperty(JSON_PROPERTY_OCCURRENCE_WINDOW_DAYS) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public Long getOccurrenceWindowDays() { + return occurrenceWindowDays; + } + + public void setOccurrenceWindowDays(Long occurrenceWindowDays) { + this.occurrenceWindowDays = occurrenceWindowDays; + } + + public SecurityAgentInvestigationRuleTuningSuggestions reasoning(String reasoning) { + this.reasoning = reasoning; + return this; + } + + /** + * Why tuning the rule is suggested. + * + * @return reasoning + */ + @JsonProperty(JSON_PROPERTY_REASONING) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getReasoning() { + return reasoning; + } + + public void setReasoning(String reasoning) { + this.reasoning = reasoning; + } + + public SecurityAgentInvestigationRuleTuningSuggestions ruleId(String ruleId) { + this.ruleId = ruleId; + return this; + } + + /** + * ID of the detection rule. + * + * @return ruleId + */ + @JsonProperty(JSON_PROPERTY_RULE_ID) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getRuleId() { + return ruleId; + } + + public void setRuleId(String ruleId) { + this.ruleId = ruleId; + } + + public SecurityAgentInvestigationRuleTuningSuggestions ruleName(String ruleName) { + this.ruleName = ruleName; + return this; + } + + /** + * Name of the detection rule. + * + * @return ruleName + */ + @JsonProperty(JSON_PROPERTY_RULE_NAME) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getRuleName() { + return ruleName; + } + + public void setRuleName(String ruleName) { + this.ruleName = ruleName; + } + + public SecurityAgentInvestigationRuleTuningSuggestions ruleSignalTotal(Long ruleSignalTotal) { + this.ruleSignalTotal = ruleSignalTotal; + return this; + } + + /** + * Number of signals the rule generated in the window. + * + * @return ruleSignalTotal + */ + @JsonProperty(JSON_PROPERTY_RULE_SIGNAL_TOTAL) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public Long getRuleSignalTotal() { + return ruleSignalTotal; + } + + public void setRuleSignalTotal(Long ruleSignalTotal) { + this.ruleSignalTotal = ruleSignalTotal; + } + + public SecurityAgentInvestigationRuleTuningSuggestions suggestions( + List suggestions) { + this.suggestions = suggestions; + for (SecurityAgentInvestigationRuleTuningSuggestion item : suggestions) { + this.unparsed |= item.unparsed; + } + return this; + } + + public SecurityAgentInvestigationRuleTuningSuggestions addSuggestionsItem( + SecurityAgentInvestigationRuleTuningSuggestion suggestionsItem) { + this.suggestions.add(suggestionsItem); + this.unparsed |= suggestionsItem.unparsed; + return this; + } + + /** + * The tuning suggestions. + * + * @return suggestions + */ + @JsonProperty(JSON_PROPERTY_SUGGESTIONS) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public List getSuggestions() { + return suggestions; + } + + public void setSuggestions(List suggestions) { + this.suggestions = suggestions; + if (suggestions != null) { + for (SecurityAgentInvestigationRuleTuningSuggestion item : suggestions) { + this.unparsed |= item.unparsed; + } + } + } + + public SecurityAgentInvestigationRuleTuningSuggestions summary(String summary) { + this.summary = summary; + return this; + } + + /** + * Summary of the suggestions. + * + * @return summary + */ + @JsonProperty(JSON_PROPERTY_SUMMARY) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getSummary() { + return summary; + } + + public void setSummary(String summary) { + this.summary = summary; + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationRuleTuningSuggestions + */ + @JsonAnySetter + public SecurityAgentInvestigationRuleTuningSuggestions putAdditionalProperty( + String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationRuleTuningSuggestions object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationRuleTuningSuggestions + securityAgentInvestigationRuleTuningSuggestions = + (SecurityAgentInvestigationRuleTuningSuggestions) o; + return Objects.equals( + this.occurrenceWindowDays, + securityAgentInvestigationRuleTuningSuggestions.occurrenceWindowDays) + && Objects.equals(this.reasoning, securityAgentInvestigationRuleTuningSuggestions.reasoning) + && Objects.equals(this.ruleId, securityAgentInvestigationRuleTuningSuggestions.ruleId) + && Objects.equals(this.ruleName, securityAgentInvestigationRuleTuningSuggestions.ruleName) + && Objects.equals( + this.ruleSignalTotal, securityAgentInvestigationRuleTuningSuggestions.ruleSignalTotal) + && Objects.equals( + this.suggestions, securityAgentInvestigationRuleTuningSuggestions.suggestions) + && Objects.equals(this.summary, securityAgentInvestigationRuleTuningSuggestions.summary) + && Objects.equals( + this.additionalProperties, + securityAgentInvestigationRuleTuningSuggestions.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash( + occurrenceWindowDays, + reasoning, + ruleId, + ruleName, + ruleSignalTotal, + suggestions, + summary, + additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationRuleTuningSuggestions {\n"); + sb.append(" occurrenceWindowDays: ") + .append(toIndentedString(occurrenceWindowDays)) + .append("\n"); + sb.append(" reasoning: ").append(toIndentedString(reasoning)).append("\n"); + sb.append(" ruleId: ").append(toIndentedString(ruleId)).append("\n"); + sb.append(" ruleName: ").append(toIndentedString(ruleName)).append("\n"); + sb.append(" ruleSignalTotal: ").append(toIndentedString(ruleSignalTotal)).append("\n"); + sb.append(" suggestions: ").append(toIndentedString(suggestions)).append("\n"); + sb.append(" summary: ").append(toIndentedString(summary)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationSignal.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationSignal.java new file mode 100644 index 00000000000..5501768f585 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationSignal.java @@ -0,0 +1,321 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Objects; + +/** Summary of the signal the investigation is about. */ +@JsonPropertyOrder({ + SecurityAgentInvestigationSignal.JSON_PROPERTY_SEVERITY, + SecurityAgentInvestigationSignal.JSON_PROPERTY_SOURCES, + SecurityAgentInvestigationSignal.JSON_PROPERTY_TACTIC, + SecurityAgentInvestigationSignal.JSON_PROPERTY_TAGS, + SecurityAgentInvestigationSignal.JSON_PROPERTY_TECHNIQUE, + SecurityAgentInvestigationSignal.JSON_PROPERTY_TIMESTAMP, + SecurityAgentInvestigationSignal.JSON_PROPERTY_TITLE +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationSignal { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_SEVERITY = "severity"; + private String severity; + + public static final String JSON_PROPERTY_SOURCES = "sources"; + private List sources = null; + + public static final String JSON_PROPERTY_TACTIC = "tactic"; + private String tactic; + + public static final String JSON_PROPERTY_TAGS = "tags"; + private List tags = null; + + public static final String JSON_PROPERTY_TECHNIQUE = "technique"; + private String technique; + + public static final String JSON_PROPERTY_TIMESTAMP = "timestamp"; + private String timestamp; + + public static final String JSON_PROPERTY_TITLE = "title"; + private String title; + + public SecurityAgentInvestigationSignal severity(String severity) { + this.severity = severity; + return this; + } + + /** + * Severity of the signal: info, low, medium, high + * , or critical. + * + * @return severity + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_SEVERITY) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public String getSeverity() { + return severity; + } + + public void setSeverity(String severity) { + this.severity = severity; + } + + public SecurityAgentInvestigationSignal sources(List sources) { + this.sources = sources; + return this; + } + + public SecurityAgentInvestigationSignal addSourcesItem(String sourcesItem) { + if (this.sources == null) { + this.sources = new ArrayList<>(); + } + this.sources.add(sourcesItem); + return this; + } + + /** + * Sources of the signal. + * + * @return sources + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_SOURCES) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public List getSources() { + return sources; + } + + public void setSources(List sources) { + this.sources = sources; + } + + public SecurityAgentInvestigationSignal tactic(String tactic) { + this.tactic = tactic; + return this; + } + + /** + * MITRE ATT&CK tactic, from the signal's tactic tag. + * + * @return tactic + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_TACTIC) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public String getTactic() { + return tactic; + } + + public void setTactic(String tactic) { + this.tactic = tactic; + } + + public SecurityAgentInvestigationSignal tags(List tags) { + this.tags = tags; + return this; + } + + public SecurityAgentInvestigationSignal addTagsItem(String tagsItem) { + if (this.tags == null) { + this.tags = new ArrayList<>(); + } + this.tags.add(tagsItem); + return this; + } + + /** + * Tags of the signal, written key:value. + * + * @return tags + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_TAGS) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public List getTags() { + return tags; + } + + public void setTags(List tags) { + this.tags = tags; + } + + public SecurityAgentInvestigationSignal technique(String technique) { + this.technique = technique; + return this; + } + + /** + * MITRE ATT&CK technique, from the signal's technique tag. + * + * @return technique + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_TECHNIQUE) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public String getTechnique() { + return technique; + } + + public void setTechnique(String technique) { + this.technique = technique; + } + + public SecurityAgentInvestigationSignal timestamp(String timestamp) { + this.timestamp = timestamp; + return this; + } + + /** + * Time the signal was generated. + * + * @return timestamp + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_TIMESTAMP) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public String getTimestamp() { + return timestamp; + } + + public void setTimestamp(String timestamp) { + this.timestamp = timestamp; + } + + public SecurityAgentInvestigationSignal title(String title) { + this.title = title; + return this; + } + + /** + * Title of the signal. + * + * @return title + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_TITLE) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public String getTitle() { + return title; + } + + public void setTitle(String title) { + this.title = title; + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationSignal + */ + @JsonAnySetter + public SecurityAgentInvestigationSignal putAdditionalProperty(String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationSignal object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationSignal securityAgentInvestigationSignal = + (SecurityAgentInvestigationSignal) o; + return Objects.equals(this.severity, securityAgentInvestigationSignal.severity) + && Objects.equals(this.sources, securityAgentInvestigationSignal.sources) + && Objects.equals(this.tactic, securityAgentInvestigationSignal.tactic) + && Objects.equals(this.tags, securityAgentInvestigationSignal.tags) + && Objects.equals(this.technique, securityAgentInvestigationSignal.technique) + && Objects.equals(this.timestamp, securityAgentInvestigationSignal.timestamp) + && Objects.equals(this.title, securityAgentInvestigationSignal.title) + && Objects.equals( + this.additionalProperties, securityAgentInvestigationSignal.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash( + severity, sources, tactic, tags, technique, timestamp, title, additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationSignal {\n"); + sb.append(" severity: ").append(toIndentedString(severity)).append("\n"); + sb.append(" sources: ").append(toIndentedString(sources)).append("\n"); + sb.append(" tactic: ").append(toIndentedString(tactic)).append("\n"); + sb.append(" tags: ").append(toIndentedString(tags)).append("\n"); + sb.append(" technique: ").append(toIndentedString(technique)).append("\n"); + sb.append(" timestamp: ").append(toIndentedString(timestamp)).append("\n"); + sb.append(" title: ").append(toIndentedString(title)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationState.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationState.java new file mode 100644 index 00000000000..8da8430339d --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationState.java @@ -0,0 +1,65 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.datadog.api.client.ModelEnum; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.core.JsonGenerator; +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.databind.SerializerProvider; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; +import com.fasterxml.jackson.databind.ser.std.StdSerializer; +import java.io.IOException; +import java.util.Arrays; +import java.util.HashSet; +import java.util.Set; + +/** + * State of the investigation: investigating while it runs, completed + * after it has a result, or failed when it produced no result before its timeout. + */ +@JsonSerialize( + using = SecurityAgentInvestigationState.SecurityAgentInvestigationStateSerializer.class) +public class SecurityAgentInvestigationState extends ModelEnum { + + private static final Set allowedValues = + new HashSet(Arrays.asList("investigating", "completed", "failed")); + + public static final SecurityAgentInvestigationState INVESTIGATING = + new SecurityAgentInvestigationState("investigating"); + public static final SecurityAgentInvestigationState COMPLETED = + new SecurityAgentInvestigationState("completed"); + public static final SecurityAgentInvestigationState FAILED = + new SecurityAgentInvestigationState("failed"); + + SecurityAgentInvestigationState(String value) { + super(value, allowedValues); + } + + public static class SecurityAgentInvestigationStateSerializer + extends StdSerializer { + public SecurityAgentInvestigationStateSerializer(Class t) { + super(t); + } + + public SecurityAgentInvestigationStateSerializer() { + this(null); + } + + @Override + public void serialize( + SecurityAgentInvestigationState value, JsonGenerator jgen, SerializerProvider provider) + throws IOException, JsonProcessingException { + jgen.writeObject(value.value); + } + } + + @JsonCreator + public static SecurityAgentInvestigationState fromValue(String value) { + return new SecurityAgentInvestigationState(value); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationStep.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationStep.java new file mode 100644 index 00000000000..2af5a103f59 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationStep.java @@ -0,0 +1,175 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.HashMap; +import java.util.Map; +import java.util.Objects; + +/** A step of the investigation. */ +@JsonPropertyOrder({ + SecurityAgentInvestigationStep.JSON_PROPERTY_NAME, + SecurityAgentInvestigationStep.JSON_PROPERTY_SUMMARY +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationStep { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_NAME = "name"; + private String name; + + public static final String JSON_PROPERTY_SUMMARY = "summary"; + private String summary; + + public SecurityAgentInvestigationStep() {} + + @JsonCreator + public SecurityAgentInvestigationStep( + @JsonProperty(required = true, value = JSON_PROPERTY_NAME) String name, + @JsonProperty(required = true, value = JSON_PROPERTY_SUMMARY) String summary) { + this.name = name; + this.summary = summary; + } + + public SecurityAgentInvestigationStep name(String name) { + this.name = name; + return this; + } + + /** + * Name of the step, usually the question it answers. + * + * @return name + */ + @JsonProperty(JSON_PROPERTY_NAME) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getName() { + return name; + } + + public void setName(String name) { + this.name = name; + } + + public SecurityAgentInvestigationStep summary(String summary) { + this.summary = summary; + return this; + } + + /** + * Summary of what the step found. It can be empty. + * + * @return summary + */ + @JsonProperty(JSON_PROPERTY_SUMMARY) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public String getSummary() { + return summary; + } + + public void setSummary(String summary) { + this.summary = summary; + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationStep + */ + @JsonAnySetter + public SecurityAgentInvestigationStep putAdditionalProperty(String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationStep object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationStep securityAgentInvestigationStep = + (SecurityAgentInvestigationStep) o; + return Objects.equals(this.name, securityAgentInvestigationStep.name) + && Objects.equals(this.summary, securityAgentInvestigationStep.summary) + && Objects.equals( + this.additionalProperties, securityAgentInvestigationStep.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash(name, summary, additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationStep {\n"); + sb.append(" name: ").append(toIndentedString(name)).append("\n"); + sb.append(" summary: ").append(toIndentedString(summary)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationType.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationType.java new file mode 100644 index 00000000000..e765a9baace --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationType.java @@ -0,0 +1,58 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.datadog.api.client.ModelEnum; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.core.JsonGenerator; +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.databind.SerializerProvider; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; +import com.fasterxml.jackson.databind.ser.std.StdSerializer; +import java.io.IOException; +import java.util.Arrays; +import java.util.HashSet; +import java.util.Set; + +/** Type of the investigation resource. */ +@JsonSerialize( + using = SecurityAgentInvestigationType.SecurityAgentInvestigationTypeSerializer.class) +public class SecurityAgentInvestigationType extends ModelEnum { + + private static final Set allowedValues = + new HashSet(Arrays.asList("investigations")); + + public static final SecurityAgentInvestigationType INVESTIGATIONS = + new SecurityAgentInvestigationType("investigations"); + + SecurityAgentInvestigationType(String value) { + super(value, allowedValues); + } + + public static class SecurityAgentInvestigationTypeSerializer + extends StdSerializer { + public SecurityAgentInvestigationTypeSerializer(Class t) { + super(t); + } + + public SecurityAgentInvestigationTypeSerializer() { + this(null); + } + + @Override + public void serialize( + SecurityAgentInvestigationType value, JsonGenerator jgen, SerializerProvider provider) + throws IOException, JsonProcessingException { + jgen.writeObject(value.value); + } + } + + @JsonCreator + public static SecurityAgentInvestigationType fromValue(String value) { + return new SecurityAgentInvestigationType(value); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationVerdict.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationVerdict.java new file mode 100644 index 00000000000..486a56d4484 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationVerdict.java @@ -0,0 +1,62 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.datadog.api.client.ModelEnum; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.core.JsonGenerator; +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.databind.SerializerProvider; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; +import com.fasterxml.jackson.databind.ser.std.StdSerializer; +import java.io.IOException; +import java.util.Arrays; +import java.util.HashSet; +import java.util.Set; + +/** Verdict of the investigation. Only completed investigations have one. */ +@JsonSerialize( + using = SecurityAgentInvestigationVerdict.SecurityAgentInvestigationVerdictSerializer.class) +public class SecurityAgentInvestigationVerdict extends ModelEnum { + + private static final Set allowedValues = + new HashSet(Arrays.asList("benign", "suspicious", "malicious")); + + public static final SecurityAgentInvestigationVerdict BENIGN = + new SecurityAgentInvestigationVerdict("benign"); + public static final SecurityAgentInvestigationVerdict SUSPICIOUS = + new SecurityAgentInvestigationVerdict("suspicious"); + public static final SecurityAgentInvestigationVerdict MALICIOUS = + new SecurityAgentInvestigationVerdict("malicious"); + + SecurityAgentInvestigationVerdict(String value) { + super(value, allowedValues); + } + + public static class SecurityAgentInvestigationVerdictSerializer + extends StdSerializer { + public SecurityAgentInvestigationVerdictSerializer(Class t) { + super(t); + } + + public SecurityAgentInvestigationVerdictSerializer() { + this(null); + } + + @Override + public void serialize( + SecurityAgentInvestigationVerdict value, JsonGenerator jgen, SerializerProvider provider) + throws IOException, JsonProcessingException { + jgen.writeObject(value.value); + } + } + + @JsonCreator + public static SecurityAgentInvestigationVerdict fromValue(String value) { + return new SecurityAgentInvestigationVerdict(value); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationsListMeta.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationsListMeta.java new file mode 100644 index 00000000000..22fa9ff6944 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationsListMeta.java @@ -0,0 +1,190 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.HashMap; +import java.util.Map; +import java.util.Objects; + +/** Metadata of a page of investigations. */ +@JsonPropertyOrder({ + SecurityAgentInvestigationsListMeta.JSON_PROPERTY_REASON, + SecurityAgentInvestigationsListMeta.JSON_PROPERTY_TOTAL_COUNT +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationsListMeta { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_REASON = "reason"; + private SecurityAgentInvestigationNoRunReason reason; + + public static final String JSON_PROPERTY_TOTAL_COUNT = "total_count"; + private Long totalCount; + + public SecurityAgentInvestigationsListMeta() {} + + @JsonCreator + public SecurityAgentInvestigationsListMeta( + @JsonProperty(required = true, value = JSON_PROPERTY_TOTAL_COUNT) Long totalCount) { + this.totalCount = totalCount; + } + + public SecurityAgentInvestigationsListMeta reason(SecurityAgentInvestigationNoRunReason reason) { + this.reason = reason; + this.unparsed |= !reason.isValid(); + return this; + } + + /** + * Why filter[signal_id] returned no investigation. Set only on the first page of an + * empty result. The reason is based on the organization's current settings. Poll again only on + * investigation_not_started, after the number of seconds in the Retry-After + * header; treat the others as final for this signal. - investigation_not_started + * : no investigation has started yet, but one may still start. - not_investigated + * : no investigation started within an hour of the signal, so none is expected. The signal + * was skipped for a reason this API doesn't report, such as its severity or a rate limit. - + * rule_not_enabled: the signal's detection rule doesn't have Bits Security Analyst + * enabled, so no investigation starts automatically. - signal_not_found: the ID + * isn't a signal ID, or no signal with this ID exists in the organization. - + * org_not_activated: the organization hasn't activated Bits Security Analyst. + * + * @return reason + */ + @jakarta.annotation.Nullable + @JsonProperty(JSON_PROPERTY_REASON) + @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS) + public SecurityAgentInvestigationNoRunReason getReason() { + return reason; + } + + public void setReason(SecurityAgentInvestigationNoRunReason reason) { + if (!reason.isValid()) { + this.unparsed = true; + } + this.reason = reason; + } + + public SecurityAgentInvestigationsListMeta totalCount(Long totalCount) { + this.totalCount = totalCount; + return this; + } + + /** + * Without filter[signal_id], the number of signals that match the filters. With + * filter[signal_id], the number of investigations of that signal. Pages past the + * last page return 0. + * + * @return totalCount + */ + @JsonProperty(JSON_PROPERTY_TOTAL_COUNT) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public Long getTotalCount() { + return totalCount; + } + + public void setTotalCount(Long totalCount) { + this.totalCount = totalCount; + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationsListMeta + */ + @JsonAnySetter + public SecurityAgentInvestigationsListMeta putAdditionalProperty(String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationsListMeta object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationsListMeta securityAgentInvestigationsListMeta = + (SecurityAgentInvestigationsListMeta) o; + return Objects.equals(this.reason, securityAgentInvestigationsListMeta.reason) + && Objects.equals(this.totalCount, securityAgentInvestigationsListMeta.totalCount) + && Objects.equals( + this.additionalProperties, securityAgentInvestigationsListMeta.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash(reason, totalCount, additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationsListMeta {\n"); + sb.append(" reason: ").append(toIndentedString(reason)).append("\n"); + sb.append(" totalCount: ").append(toIndentedString(totalCount)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationsListResponse.java b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationsListResponse.java new file mode 100644 index 00000000000..6a3aa1ce994 --- /dev/null +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityAgentInvestigationsListResponse.java @@ -0,0 +1,204 @@ +/* + * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. + * This product includes software developed at Datadog (https://www.datadoghq.com/). + * Copyright 2019-Present Datadog, Inc. + */ + +package com.datadog.api.client.v2.model; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Objects; + +/** A page of investigations. */ +@JsonPropertyOrder({ + SecurityAgentInvestigationsListResponse.JSON_PROPERTY_DATA, + SecurityAgentInvestigationsListResponse.JSON_PROPERTY_META +}) +@jakarta.annotation.Generated( + value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator") +public class SecurityAgentInvestigationsListResponse { + @JsonIgnore public boolean unparsed = false; + public static final String JSON_PROPERTY_DATA = "data"; + private List data = new ArrayList<>(); + + public static final String JSON_PROPERTY_META = "meta"; + private SecurityAgentInvestigationsListMeta meta; + + public SecurityAgentInvestigationsListResponse() {} + + @JsonCreator + public SecurityAgentInvestigationsListResponse( + @JsonProperty(required = true, value = JSON_PROPERTY_DATA) + List data, + @JsonProperty(required = true, value = JSON_PROPERTY_META) + SecurityAgentInvestigationsListMeta meta) { + this.data = data; + for (SecurityAgentInvestigationListItem item : data) { + this.unparsed |= item.unparsed; + } + this.meta = meta; + this.unparsed |= meta.unparsed; + } + + public SecurityAgentInvestigationsListResponse data( + List data) { + this.data = data; + for (SecurityAgentInvestigationListItem item : data) { + this.unparsed |= item.unparsed; + } + return this; + } + + public SecurityAgentInvestigationsListResponse addDataItem( + SecurityAgentInvestigationListItem dataItem) { + this.data.add(dataItem); + this.unparsed |= dataItem.unparsed; + return this; + } + + /** + * The investigations on this page. + * + * @return data + */ + @JsonProperty(JSON_PROPERTY_DATA) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public List getData() { + return data; + } + + public void setData(List data) { + this.data = data; + if (data != null) { + for (SecurityAgentInvestigationListItem item : data) { + this.unparsed |= item.unparsed; + } + } + } + + public SecurityAgentInvestigationsListResponse meta(SecurityAgentInvestigationsListMeta meta) { + this.meta = meta; + this.unparsed |= meta.unparsed; + return this; + } + + /** + * Metadata of a page of investigations. + * + * @return meta + */ + @JsonProperty(JSON_PROPERTY_META) + @JsonInclude(value = JsonInclude.Include.ALWAYS) + public SecurityAgentInvestigationsListMeta getMeta() { + return meta; + } + + public void setMeta(SecurityAgentInvestigationsListMeta meta) { + this.meta = meta; + if (meta != null) { + this.unparsed |= meta.unparsed; + } + } + + /** + * A container for additional, undeclared properties. This is a holder for any undeclared + * properties as specified with the 'additionalProperties' keyword in the OAS document. + */ + private Map additionalProperties; + + /** + * Set the additional (undeclared) property with the specified name and value. If the property + * does not already exist, create it otherwise replace it. + * + * @param key The arbitrary key to set + * @param value The associated value + * @return SecurityAgentInvestigationsListResponse + */ + @JsonAnySetter + public SecurityAgentInvestigationsListResponse putAdditionalProperty(String key, Object value) { + if (this.additionalProperties == null) { + this.additionalProperties = new HashMap(); + } + this.additionalProperties.put(key, value); + return this; + } + + /** + * Return the additional (undeclared) property. + * + * @return The additional properties + */ + @JsonAnyGetter + public Map getAdditionalProperties() { + return additionalProperties; + } + + /** + * Return the additional (undeclared) property with the specified name. + * + * @param key The arbitrary key to get + * @return The specific additional property for the given key + */ + public Object getAdditionalProperty(String key) { + if (this.additionalProperties == null) { + return null; + } + return this.additionalProperties.get(key); + } + + /** Return true if this SecurityAgentInvestigationsListResponse object is equal to o. */ + @Override + public boolean equals(Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + SecurityAgentInvestigationsListResponse securityAgentInvestigationsListResponse = + (SecurityAgentInvestigationsListResponse) o; + return Objects.equals(this.data, securityAgentInvestigationsListResponse.data) + && Objects.equals(this.meta, securityAgentInvestigationsListResponse.meta) + && Objects.equals( + this.additionalProperties, + securityAgentInvestigationsListResponse.additionalProperties); + } + + @Override + public int hashCode() { + return Objects.hash(data, meta, additionalProperties); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("class SecurityAgentInvestigationsListResponse {\n"); + sb.append(" data: ").append(toIndentedString(data)).append("\n"); + sb.append(" meta: ").append(toIndentedString(meta)).append("\n"); + sb.append(" additionalProperties: ") + .append(toIndentedString(additionalProperties)) + .append("\n"); + sb.append('}'); + return sb.toString(); + } + + /** + * Convert the given object to string with each line indented by 4 spaces (except the first line). + */ + private String toIndentedString(Object o) { + if (o == null) { + return "null"; + } + return o.toString().replace("\n", "\n "); + } +} diff --git a/src/test/resources/com/datadog/api/client/v2/api/bits_security_analyst.feature b/src/test/resources/com/datadog/api/client/v2/api/bits_security_analyst.feature new file mode 100644 index 00000000000..76dda7f3b4e --- /dev/null +++ b/src/test/resources/com/datadog/api/client/v2/api/bits_security_analyst.feature @@ -0,0 +1,73 @@ +@endpoint(bits-security-analyst) @endpoint(bits-security-analyst-v2) +Feature: Bits Security Analyst + Use the Bits Security Analyst endpoints to find the investigations of your + Cloud SIEM signals, read an investigation's verdict and findings, and + count investigations. + + Background: + Given a valid "apiKeyAuth" key in the system + And a valid "appKeyAuth" key in the system + And an instance of "BitsSecurityAnalyst" API + + @skip @team:ddoghq/k9-bits-ai + Scenario: Count Bits Security Analyst investigations returns "Bad Request" response + Given operation "CountSecurityAgentInvestigations" enabled + And new "CountSecurityAgentInvestigations" request + And request contains "field" parameter with value "verdict" + And request contains "filter[from]" parameter with value "not-a-time" + When the request is sent + Then the response status is 400 Bad Request + And the response "errors" has length 1 + And the response "errors[0].source.parameter" is equal to "filter[from]" + + @skip @team:ddoghq/k9-bits-ai + Scenario: Count Bits Security Analyst investigations returns "OK" response + Given operation "CountSecurityAgentInvestigations" enabled + And new "CountSecurityAgentInvestigations" request + And request contains "field" parameter with value "verdict" + When the request is sent + Then the response status is 200 OK + And the response "data.id" is equal to "verdict" + And the response "data.type" is equal to "investigation_counts" + + @skip @team:ddoghq/k9-bits-ai + Scenario: Get a Bits Security Analyst investigation returns "Bad Request" response + Given operation "GetSecurityAgentInvestigation" enabled + And new "GetSecurityAgentInvestigation" request + And request contains "investigation_id" parameter with value "not-a-uuid" + When the request is sent + Then the response status is 400 Bad Request + And the response "errors[0].source.parameter" is equal to "investigation_id" + + @skip @team:ddoghq/k9-bits-ai + Scenario: Get a Bits Security Analyst investigation returns "Not Found" response + Given operation "GetSecurityAgentInvestigation" enabled + And new "GetSecurityAgentInvestigation" request + And request contains "investigation_id" parameter with value "00000000-0000-4000-8000-000000000000" + When the request is sent + Then the response status is 404 Not Found + + @generated @skip @team:ddoghq/k9-bits-ai + Scenario: Get a Bits Security Analyst investigation returns "OK" response + Given operation "GetSecurityAgentInvestigation" enabled + And new "GetSecurityAgentInvestigation" request + And request contains "investigation_id" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 200 OK + + @skip @team:ddoghq/k9-bits-ai + Scenario: List Bits Security Analyst investigations returns "Bad Request" response + Given operation "ListSecurityAgentInvestigations" enabled + And new "ListSecurityAgentInvestigations" request + And request contains "filter[signal_id]" parameter with value "first-signal,second-signal" + When the request is sent + Then the response status is 400 Bad Request + And the response "errors[0].source.parameter" is equal to "filter[signal_id]" + + @skip @team:ddoghq/k9-bits-ai + Scenario: List Bits Security Analyst investigations returns "OK" response + Given operation "ListSecurityAgentInvestigations" enabled + And new "ListSecurityAgentInvestigations" request + And request contains "page[size]" parameter with value 1 + When the request is sent + Then the response status is 200 OK diff --git a/src/test/resources/com/datadog/api/client/v2/api/undo.json b/src/test/resources/com/datadog/api/client/v2/api/undo.json index 40a38e4bb7e..723033198e0 100644 --- a/src/test/resources/com/datadog/api/client/v2/api/undo.json +++ b/src/test/resources/com/datadog/api/client/v2/api/undo.json @@ -9606,6 +9606,24 @@ "type": "idempotent" } }, + "ListSecurityAgentInvestigations": { + "tag": "Bits Security Analyst", + "undo": { + "type": "safe" + } + }, + "CountSecurityAgentInvestigations": { + "tag": "Bits Security Analyst", + "undo": { + "type": "safe" + } + }, + "GetSecurityAgentInvestigation": { + "tag": "Bits Security Analyst", + "undo": { + "type": "safe" + } + }, "ListSecurityMonitoringSignals": { "tag": "Security Monitoring", "undo": {