datadog_api_client 2.32.0 → 2.34.0

data/lib/datadog_api_client/v2/models/observability_pipeline_ocsf_mapper_processor_mapping.rb

@@ -0,0 +1,144 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Defines how specific events are transformed to OCSF using a mapping configuration.
+  class ObservabilityPipelineOcsfMapperProcessorMapping
+    include BaseGenericModel
+
+    # A Datadog search query used to select the logs that this mapping should apply to.
+    attr_reader :include
+
+    # Defines a single mapping rule for transforming logs into the OCSF schema.
+    attr_reader :mapping
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'include' => :'include',
+        :'mapping' => :'mapping'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'include' => :'String',
+        :'mapping' => :'ObservabilityPipelineOcsfMapperProcessorMappingMapping'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::ObservabilityPipelineOcsfMapperProcessorMapping` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'include')
+        self.include = attributes[:'include']
+      end
+
+      if attributes.key?(:'mapping')
+        self.mapping = attributes[:'mapping']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @include.nil?
+      return false if @mapping.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param include [Object] Object to be assigned
+    # @!visibility private
+    def include=(include)
+      if include.nil?
+        fail ArgumentError, 'invalid value for "include", include cannot be nil.'
+      end
+      @include = include
+    end
+
+    # Custom attribute writer method with validation
+    # @param mapping [Object] Object to be assigned
+    # @!visibility private
+    def mapping=(mapping)
+      if mapping.nil?
+        fail ArgumentError, 'invalid value for "mapping", mapping cannot be nil.'
+      end
+      @mapping = mapping
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          include == o.include &&
+          mapping == o.mapping &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [include, mapping, additional_properties].hash
+    end
+  end
+end

data/lib/datadog_api_client/v2/models/observability_pipeline_ocsf_mapper_processor_mapping_mapping.rb

@@ -0,0 +1,62 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Defines a single mapping rule for transforming logs into the OCSF schema.
+  module ObservabilityPipelineOcsfMapperProcessorMappingMapping
+    class << self
+      include BaseOneOfModel
+      include BaseOneOfModelNoDiscriminator
+
+      # List of class defined in oneOf (OpenAPI v3)
+      def openapi_one_of
+        [
+          :'ObservabilityPipelineOcsfMappingLibrary'
+        ]
+      end
+      # Builds the object
+      # @param data [Mixed] Data to be matched against the list of oneOf items
+      # @return [Object] Returns the model or the data itself
+      def build(data)
+        # Go through the list of oneOf items and attempt to identify the appropriate one.
+        # Note:
+        # - We do not attempt to check whether exactly one item matches.
+        # - No advanced validation of types in some cases (e.g. "x: { type: string }" will happily match { x: 123 })
+        #   due to the way the deserialization is made in the base_object template (it just casts without verifying).
+        # - TODO: scalar values are de facto behaving as if they were nullable.
+        # - TODO: logging when debugging is set.
+        openapi_one_of.each do |klass|
+          begin
+            next if klass == :AnyType # "nullable: true"
+            typed_data = find_and_cast_into_type(klass, data)
+            next if typed_data.respond_to?(:_unparsed) && typed_data._unparsed
+            return typed_data if typed_data
+          rescue # rescue all errors so we keep iterating even if the current item lookup raises
+          end
+        end
+
+        if openapi_one_of.include?(:AnyType)
+          data
+        else
+          self._unparsed = true
+          DatadogAPIClient::UnparsedObject.new(data)
+        end
+      end
+    end
+  end
+end

data/lib/datadog_api_client/v2/models/observability_pipeline_ocsf_mapper_processor_type.rb

@@ -0,0 +1,26 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # The processor type. The value should always be `ocsf_mapper`.
+  class ObservabilityPipelineOcsfMapperProcessorType
+    include BaseEnumModel
+
+    OCSF_MAPPER = "ocsf_mapper".freeze
+  end
+end

data/lib/datadog_api_client/v2/models/observability_pipeline_ocsf_mapping_library.rb

@@ -0,0 +1,36 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Predefined library mappings for common log formats.
+  class ObservabilityPipelineOcsfMappingLibrary
+    include BaseEnumModel
+
+    CLOUDTRAIL_ACCOUNT_CHANGE = "CloudTrail Account Change".freeze
+    GCP_CLOUD_AUDIT_CREATEBUCKET = "GCP Cloud Audit CreateBucket".freeze
+    GCP_CLOUD_AUDIT_CREATESINK = "GCP Cloud Audit CreateSink".freeze
+    GCP_CLOUD_AUDIT_SETIAMPOLICY = "GCP Cloud Audit SetIamPolicy".freeze
+    GCP_CLOUD_AUDIT_UPDATESINK = "GCP Cloud Audit UpdateSink".freeze
+    GITHUB_AUDIT_LOG_API_ACTIVITY = "Github Audit Log API Activity".freeze
+    GOOGLE_WORKSPACE_ADMIN_AUDIT_ADDPRIVILEGE = "Google Workspace Admin Audit addPrivilege".freeze
+    MICROSOFT_365_DEFENDER_INCIDENT = "Microsoft 365 Defender Incident".freeze
+    MICROSOFT_365_DEFENDER_USERLOGGEDIN = "Microsoft 365 Defender UserLoggedIn".freeze
+    OKTA_SYSTEM_LOG_AUTHENTICATION = "Okta System Log Authentication".freeze
+    PALO_ALTO_NETWORKS_FIREWALL_TRAFFIC = "Palo Alto Networks Firewall Traffic".freeze
+  end
+end

data/lib/datadog_api_client/v2/models/observability_pipeline_open_search_destination.rb

@@ -0,0 +1,177 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # The `opensearch` destination writes logs to an OpenSearch cluster.
+  class ObservabilityPipelineOpenSearchDestination
+    include BaseGenericModel
+
+    # The index to write logs to.
+    attr_accessor :bulk_index
+
+    # The unique identifier for this component.
+    attr_reader :id
+
+    # A list of component IDs whose output is used as the `input` for this component.
+    attr_reader :inputs
+
+    # The destination type. The value should always be `opensearch`.
+    attr_reader :type
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'bulk_index' => :'bulk_index',
+        :'id' => :'id',
+        :'inputs' => :'inputs',
+        :'type' => :'type'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'bulk_index' => :'String',
+        :'id' => :'String',
+        :'inputs' => :'Array<String>',
+        :'type' => :'ObservabilityPipelineOpenSearchDestinationType'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::ObservabilityPipelineOpenSearchDestination` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'bulk_index')
+        self.bulk_index = attributes[:'bulk_index']
+      end
+
+      if attributes.key?(:'id')
+        self.id = attributes[:'id']
+      end
+
+      if attributes.key?(:'inputs')
+        if (value = attributes[:'inputs']).is_a?(Array)
+          self.inputs = value
+        end
+      end
+
+      if attributes.key?(:'type')
+        self.type = attributes[:'type']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @id.nil?
+      return false if @inputs.nil?
+      return false if @type.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param id [Object] Object to be assigned
+    # @!visibility private
+    def id=(id)
+      if id.nil?
+        fail ArgumentError, 'invalid value for "id", id cannot be nil.'
+      end
+      @id = id
+    end
+
+    # Custom attribute writer method with validation
+    # @param inputs [Object] Object to be assigned
+    # @!visibility private
+    def inputs=(inputs)
+      if inputs.nil?
+        fail ArgumentError, 'invalid value for "inputs", inputs cannot be nil.'
+      end
+      @inputs = inputs
+    end
+
+    # Custom attribute writer method with validation
+    # @param type [Object] Object to be assigned
+    # @!visibility private
+    def type=(type)
+      if type.nil?
+        fail ArgumentError, 'invalid value for "type", type cannot be nil.'
+      end
+      @type = type
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          bulk_index == o.bulk_index &&
+          id == o.id &&
+          inputs == o.inputs &&
+          type == o.type &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [bulk_index, id, inputs, type, additional_properties].hash
+    end
+  end
+end

data/lib/datadog_api_client/v2/models/observability_pipeline_open_search_destination_type.rb

@@ -0,0 +1,26 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # The destination type. The value should always be `opensearch`.
+  class ObservabilityPipelineOpenSearchDestinationType
+    include BaseEnumModel
+
+    OPENSEARCH = "opensearch".freeze
+  end
+end

data/lib/datadog_api_client/v2/models/observability_pipeline_parse_grok_processor.rb

@@ -0,0 +1,221 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # The `parse_grok` processor extracts structured fields from unstructured log messages using Grok patterns.
+  class ObservabilityPipelineParseGrokProcessor
+    include BaseGenericModel
+
+    # If set to `true`, disables the default Grok rules provided by Datadog.
+    attr_accessor :disable_library_rules
+
+    # A unique identifier for this processor.
+    attr_reader :id
+
+    # A Datadog search query used to determine which logs this processor targets.
+    attr_reader :include
+
+    # A list of component IDs whose output is used as the `input` for this component.
+    attr_reader :inputs
+
+    # The list of Grok parsing rules. If multiple matching rules are provided, they are evaluated in order. The first successful match is applied.
+    attr_reader :rules
+
+    # The processor type. The value should always be `parse_grok`.
+    attr_reader :type
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'disable_library_rules' => :'disable_library_rules',
+        :'id' => :'id',
+        :'include' => :'include',
+        :'inputs' => :'inputs',
+        :'rules' => :'rules',
+        :'type' => :'type'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'disable_library_rules' => :'Boolean',
+        :'id' => :'String',
+        :'include' => :'String',
+        :'inputs' => :'Array<String>',
+        :'rules' => :'Array<ObservabilityPipelineParseGrokProcessorRule>',
+        :'type' => :'ObservabilityPipelineParseGrokProcessorType'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::ObservabilityPipelineParseGrokProcessor` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'disable_library_rules')
+        self.disable_library_rules = attributes[:'disable_library_rules']
+      end
+
+      if attributes.key?(:'id')
+        self.id = attributes[:'id']
+      end
+
+      if attributes.key?(:'include')
+        self.include = attributes[:'include']
+      end
+
+      if attributes.key?(:'inputs')
+        if (value = attributes[:'inputs']).is_a?(Array)
+          self.inputs = value
+        end
+      end
+
+      if attributes.key?(:'rules')
+        if (value = attributes[:'rules']).is_a?(Array)
+          self.rules = value
+        end
+      end
+
+      if attributes.key?(:'type')
+        self.type = attributes[:'type']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @id.nil?
+      return false if @include.nil?
+      return false if @inputs.nil?
+      return false if @rules.nil?
+      return false if @type.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param id [Object] Object to be assigned
+    # @!visibility private
+    def id=(id)
+      if id.nil?
+        fail ArgumentError, 'invalid value for "id", id cannot be nil.'
+      end
+      @id = id
+    end
+
+    # Custom attribute writer method with validation
+    # @param include [Object] Object to be assigned
+    # @!visibility private
+    def include=(include)
+      if include.nil?
+        fail ArgumentError, 'invalid value for "include", include cannot be nil.'
+      end
+      @include = include
+    end
+
+    # Custom attribute writer method with validation
+    # @param inputs [Object] Object to be assigned
+    # @!visibility private
+    def inputs=(inputs)
+      if inputs.nil?
+        fail ArgumentError, 'invalid value for "inputs", inputs cannot be nil.'
+      end
+      @inputs = inputs
+    end
+
+    # Custom attribute writer method with validation
+    # @param rules [Object] Object to be assigned
+    # @!visibility private
+    def rules=(rules)
+      if rules.nil?
+        fail ArgumentError, 'invalid value for "rules", rules cannot be nil.'
+      end
+      @rules = rules
+    end
+
+    # Custom attribute writer method with validation
+    # @param type [Object] Object to be assigned
+    # @!visibility private
+    def type=(type)
+      if type.nil?
+        fail ArgumentError, 'invalid value for "type", type cannot be nil.'
+      end
+      @type = type
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          disable_library_rules == o.disable_library_rules &&
+          id == o.id &&
+          include == o.include &&
+          inputs == o.inputs &&
+          rules == o.rules &&
+          type == o.type &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [disable_library_rules, id, include, inputs, rules, type, additional_properties].hash
+    end
+  end
+end