datadog_api_client 2.44.0 → 2.45.0

data/CHANGELOG.md

@@ -1,5 +1,30 @@
 # CHANGELOG
 
+## 2.45.0/2025-11-14
+
+### Added
+* Add suppression tags [#2768](https://github.com/DataDog/datadog-api-client-ruby/pull/2768)
+* Add new summary keys for new standalone billing dimensions [#2764](https://github.com/DataDog/datadog-api-client-ruby/pull/2764)
+* Add Bits AI Investigations and On-Call to  API specs [#2761](https://github.com/DataDog/datadog-api-client-ruby/pull/2761)
+* Add `PreviewCatalogEntities` [#2757](https://github.com/DataDog/datadog-api-client-ruby/pull/2757)
+* Sync 'audience_management.yaml' files with backend [#2755](https://github.com/DataDog/datadog-api-client-ruby/pull/2755)
+* Dashboards - Add on_call_events datasources [#2754](https://github.com/DataDog/datadog-api-client-ruby/pull/2754)
+* 📝 [LOGSAC-1298] Add logs-pipeline type to restriction policy OpenAPI spec [#2748](https://github.com/DataDog/datadog-api-client-ruby/pull/2748)
+* Security Monitoring - Update Signal Archive Reasons [#2746](https://github.com/DataDog/datadog-api-client-ruby/pull/2746)
+* Add New Serverless Summary Entries to Api Spec [#2731](https://github.com/DataDog/datadog-api-client-ruby/pull/2731)
+* Add metric namespace config filters to V2 GCP API [#2729](https://github.com/DataDog/datadog-api-client-ruby/pull/2729)
+* Add specs for v2 eventbridge API [#2726](https://github.com/DataDog/datadog-api-client-ruby/pull/2726)
+* Add last_login_time to Users v2 API [#2712](https://github.com/DataDog/datadog-api-client-ruby/pull/2712)
+* Add Team Connection API Documentation [#2710](https://github.com/DataDog/datadog-api-client-ruby/pull/2710)
+* Add Static Analysis Rules Endpoints [#2708](https://github.com/DataDog/datadog-api-client-ruby/pull/2708)
+
+### Deprecated
+* [api-spec] Mark PATCH /api/v2/incidents/incident_id/attachments endpoint as deprecated [#2766](https://github.com/DataDog/datadog-api-client-ruby/pull/2766)
+* [METEXP-2068] Deprecate api/v1/search Endpoint [#2762](https://github.com/DataDog/datadog-api-client-ruby/pull/2762)
+
+### Changed
+* Rename historical job API endpoints to threat hunting [#2744](https://github.com/DataDog/datadog-api-client-ruby/pull/2744)
+
 ## 2.44.0/2025-10-27
 
 ### Added

data/examples/v2/aws-integration/CreateAWSEventBridgeSource.rb

@@ -0,0 +1,17 @@
+# Create an Amazon EventBridge source returns "Amazon EventBridge source created." response
+
+require "datadog_api_client"
+api_instance = DatadogAPIClient::V2::AWSIntegrationAPI.new
+
+body = DatadogAPIClient::V2::AWSEventBridgeCreateRequest.new({
+  data: DatadogAPIClient::V2::AWSEventBridgeCreateRequestData.new({
+    attributes: DatadogAPIClient::V2::AWSEventBridgeCreateRequestAttributes.new({
+      account_id: "123456789012",
+      create_event_bus: true,
+      event_generator_name: "app-alerts",
+      region: "us-east-1",
+    }),
+    type: DatadogAPIClient::V2::AWSEventBridgeType::EVENT_BRIDGE,
+  }),
+})
+p api_instance.create_aws_event_bridge_source(body)

data/examples/v2/aws-integration/DeleteAWSEventBridgeSource.rb

@@ -0,0 +1,16 @@
+# Delete an Amazon EventBridge source returns "Amazon EventBridge source deleted." response
+
+require "datadog_api_client"
+api_instance = DatadogAPIClient::V2::AWSIntegrationAPI.new
+
+body = DatadogAPIClient::V2::AWSEventBridgeDeleteRequest.new({
+  data: DatadogAPIClient::V2::AWSEventBridgeDeleteRequestData.new({
+    attributes: DatadogAPIClient::V2::AWSEventBridgeDeleteRequestAttributes.new({
+      account_id: "123456789012",
+      event_generator_name: "app-alerts-zyxw3210",
+      region: "us-east-1",
+    }),
+    type: DatadogAPIClient::V2::AWSEventBridgeType::EVENT_BRIDGE,
+  }),
+})
+p api_instance.delete_aws_event_bridge_source(body)

data/examples/v2/aws-integration/ListAWSEventBridgeSources.rb

@@ -0,0 +1,5 @@
+# Get all Amazon EventBridge sources returns "Amazon EventBridge sources list." response
+
+require "datadog_api_client"
+api_instance = DatadogAPIClient::V2::AWSIntegrationAPI.new
+p api_instance.list_aws_event_bridge_sources()

data/examples/v2/fleet-automation/CreateFleetDeploymentConfigure.rb

@@ -1,4 +1,4 @@
-# Create a deployment returns "CREATED" response
+# Create a configuration deployment returns "CREATED" response
 
 require "datadog_api_client"
 DatadogAPIClient.configure do |config|

data/examples/v2/fleet-automation/CreateFleetDeploymentUpgrade.rb

@@ -0,0 +1,23 @@
+# Upgrade hosts returns "CREATED" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.create_fleet_deployment_upgrade".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::FleetAutomationAPI.new
+
+body = DatadogAPIClient::V2::FleetDeploymentPackageUpgradeCreateRequest.new({
+  data: DatadogAPIClient::V2::FleetDeploymentPackageUpgradeCreate.new({
+    attributes: DatadogAPIClient::V2::FleetDeploymentPackageUpgradeAttributes.new({
+      filter_query: "env:prod AND service:web",
+      target_packages: [
+        DatadogAPIClient::V2::FleetDeploymentPackage.new({
+          name: "datadog-agent",
+          version: "7.52.0",
+        }),
+      ],
+    }),
+    type: DatadogAPIClient::V2::FleetDeploymentResourceType::DEPLOYMENT,
+  }),
+})
+p api_instance.create_fleet_deployment_upgrade(body)

data/examples/v2/fleet-automation/CreateFleetSchedule.rb

@@ -0,0 +1,30 @@
+# Create a schedule returns "CREATED" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.create_fleet_schedule".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::FleetAutomationAPI.new
+
+body = DatadogAPIClient::V2::FleetScheduleCreateRequest.new({
+  data: DatadogAPIClient::V2::FleetScheduleCreate.new({
+    attributes: DatadogAPIClient::V2::FleetScheduleCreateAttributes.new({
+      name: "Weekly Production Agent Updates",
+      query: "env:prod AND service:web",
+      rule: DatadogAPIClient::V2::FleetScheduleRecurrenceRule.new({
+        days_of_week: [
+          "Mon",
+          "Wed",
+          "Fri",
+        ],
+        maintenance_window_duration: 1200,
+        start_maintenance_window: "02:00",
+        timezone: "America/New_York",
+      }),
+      status: DatadogAPIClient::V2::FleetScheduleStatus::ACTIVE,
+      version_to_latest: 0,
+    }),
+    type: DatadogAPIClient::V2::FleetScheduleResourceType::SCHEDULE,
+  }),
+})
+p api_instance.create_fleet_schedule(body)

data/examples/v2/fleet-automation/DeleteFleetSchedule.rb

@@ -0,0 +1,8 @@
+# Delete a schedule returns "Schedule successfully deleted." response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.delete_fleet_schedule".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::FleetAutomationAPI.new
+api_instance.delete_fleet_schedule("id")

data/examples/v2/fleet-automation/GetFleetDeployment.rb

@@ -1,11 +1,8 @@
-# Get a deployment by ID returns "OK" response
+# Get a configuration deployment by ID returns "OK" response
 
 require "datadog_api_client"
 DatadogAPIClient.configure do |config|
   config.unstable_operations["v2.get_fleet_deployment".to_sym] = true
 end
 api_instance = DatadogAPIClient::V2::FleetAutomationAPI.new
-
-# there is a valid "deployment" in the system
-DEPLOYMENT_ID = ENV["DEPLOYMENT_ID"]
-p api_instance.get_fleet_deployment(DEPLOYMENT_ID)
+p api_instance.get_fleet_deployment("deployment_id")

data/examples/v2/fleet-automation/GetFleetDeployment_1482493803.rb

@@ -0,0 +1,11 @@
+# Get a deployment by ID returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.get_fleet_deployment".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::FleetAutomationAPI.new
+
+# there is a valid "deployment" in the system
+DEPLOYMENT_ID = ENV["DEPLOYMENT_ID"]
+p api_instance.get_fleet_deployment(DEPLOYMENT_ID)

data/examples/v2/fleet-automation/GetFleetSchedule.rb

@@ -0,0 +1,8 @@
+# Get a schedule by ID returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.get_fleet_schedule".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::FleetAutomationAPI.new
+p api_instance.get_fleet_schedule("id")

data/examples/v2/fleet-automation/ListFleetAgentVersions.rb

@@ -0,0 +1,8 @@
+# List all available Agent versions returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.list_fleet_agent_versions".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::FleetAutomationAPI.new
+p api_instance.list_fleet_agent_versions()

data/examples/v2/fleet-automation/ListFleetSchedules.rb

@@ -0,0 +1,8 @@
+# List all schedules returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.list_fleet_schedules".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::FleetAutomationAPI.new
+p api_instance.list_fleet_schedules()

data/examples/v2/fleet-automation/TriggerFleetSchedule.rb

@@ -0,0 +1,8 @@
+# Trigger a schedule deployment returns "CREATED - Deployment successfully created and started." response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.trigger_fleet_schedule".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::FleetAutomationAPI.new
+p api_instance.trigger_fleet_schedule("id")

data/examples/v2/fleet-automation/UpdateFleetSchedule.rb

@@ -0,0 +1,30 @@
+# Update a schedule returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.update_fleet_schedule".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::FleetAutomationAPI.new
+
+body = DatadogAPIClient::V2::FleetSchedulePatchRequest.new({
+  data: DatadogAPIClient::V2::FleetSchedulePatch.new({
+    attributes: DatadogAPIClient::V2::FleetSchedulePatchAttributes.new({
+      name: "Weekly Production Agent Updates",
+      query: "env:prod AND service:web",
+      rule: DatadogAPIClient::V2::FleetScheduleRecurrenceRule.new({
+        days_of_week: [
+          "Mon",
+          "Wed",
+          "Fri",
+        ],
+        maintenance_window_duration: 1200,
+        start_maintenance_window: "02:00",
+        timezone: "America/New_York",
+      }),
+      status: DatadogAPIClient::V2::FleetScheduleStatus::ACTIVE,
+      version_to_latest: 0,
+    }),
+    type: DatadogAPIClient::V2::FleetScheduleResourceType::SCHEDULE,
+  }),
+})
+p api_instance.update_fleet_schedule("id", body)

data/examples/v2/reference-tables/UpdateReferenceTable.rb

@@ -37,7 +37,6 @@ body = DatadogAPIClient::V2::PatchTableRequest.new({
         "test_tag",
       ],
     }),
-    id: "00000000-0000-0000-0000-000000000000",
     type: DatadogAPIClient::V2::PatchTableRequestDataType::REFERENCE_TABLE,
   }),
 })

data/examples/v2/rum-audience-management/CreateConnection.rb

@@ -0,0 +1,36 @@
+# Create connection returns "Connection created successfully" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.create_connection".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::RumAudienceManagementAPI.new
+
+body = DatadogAPIClient::V2::CreateConnectionRequest.new({
+  data: DatadogAPIClient::V2::CreateConnectionRequestData.new({
+    attributes: DatadogAPIClient::V2::CreateConnectionRequestDataAttributes.new({
+      fields: [
+        DatadogAPIClient::V2::CreateConnectionRequestDataAttributesFieldsItems.new({
+          description: "Customer subscription tier from `CRM`",
+          display_name: "Customer Tier",
+          id: "customer_tier",
+          source_name: "subscription_tier",
+          type: "string",
+        }),
+        DatadogAPIClient::V2::CreateConnectionRequestDataAttributesFieldsItems.new({
+          description: "Customer lifetime value in `USD`",
+          display_name: "Lifetime Value",
+          id: "lifetime_value",
+          source_name: "ltv",
+          type: "number",
+        }),
+      ],
+      join_attribute: "user_email",
+      join_type: "email",
+      type: "ref_table",
+    }),
+    id: "crm-integration",
+    type: DatadogAPIClient::V2::UpdateConnectionRequestDataType::CONNECTION_ID,
+  }),
+})
+p api_instance.create_connection("users", body)

data/examples/v2/rum-audience-management/DeleteConnection.rb

@@ -0,0 +1,8 @@
+# Delete connection returns "Connection deleted successfully" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.delete_connection".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::RumAudienceManagementAPI.new
+api_instance.delete_connection("connection-id-123", "users")

data/examples/v2/rum-audience-management/GetAccountFacetInfo.rb

@@ -0,0 +1,25 @@
+# Get account facet info returns "Successful response with facet information" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.get_account_facet_info".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::RumAudienceManagementAPI.new
+
+body = DatadogAPIClient::V2::FacetInfoRequest.new({
+  data: DatadogAPIClient::V2::FacetInfoRequestData.new({
+    attributes: DatadogAPIClient::V2::FacetInfoRequestDataAttributes.new({
+      facet_id: "first_browser_name",
+      limit: 10,
+      search: DatadogAPIClient::V2::FacetInfoRequestDataAttributesSearch.new({
+        query: "user_org_id:5001 AND first_country_code:US",
+      }),
+      term_search: DatadogAPIClient::V2::FacetInfoRequestDataAttributesTermSearch.new({
+        value: "Chrome",
+      }),
+    }),
+    id: "facet_info_request",
+    type: DatadogAPIClient::V2::FacetInfoRequestDataType::USERS_FACET_INFO_REQUEST,
+  }),
+})
+p api_instance.get_account_facet_info(body)

data/examples/v2/rum-audience-management/GetMapping.rb

@@ -0,0 +1,8 @@
+# Get mapping returns "Successful response with entity mapping configuration" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.get_mapping".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::RumAudienceManagementAPI.new
+p api_instance.get_mapping("users")

data/examples/v2/rum-audience-management/GetUserFacetInfo.rb

@@ -0,0 +1,25 @@
+# Get user facet info returns "Successful response with facet information" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.get_user_facet_info".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::RumAudienceManagementAPI.new
+
+body = DatadogAPIClient::V2::FacetInfoRequest.new({
+  data: DatadogAPIClient::V2::FacetInfoRequestData.new({
+    attributes: DatadogAPIClient::V2::FacetInfoRequestDataAttributes.new({
+      facet_id: "first_browser_name",
+      limit: 10,
+      search: DatadogAPIClient::V2::FacetInfoRequestDataAttributesSearch.new({
+        query: "user_org_id:5001 AND first_country_code:US",
+      }),
+      term_search: DatadogAPIClient::V2::FacetInfoRequestDataAttributesTermSearch.new({
+        value: "Chrome",
+      }),
+    }),
+    id: "facet_info_request",
+    type: DatadogAPIClient::V2::FacetInfoRequestDataType::USERS_FACET_INFO_REQUEST,
+  }),
+})
+p api_instance.get_user_facet_info(body)

data/examples/v2/rum-audience-management/ListConnections.rb

@@ -0,0 +1,8 @@
+# List connections returns "Successful response with list of connections" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.list_connections".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::RumAudienceManagementAPI.new
+p api_instance.list_connections("users")

data/examples/v2/rum-audience-management/QueryAccounts.rb

@@ -0,0 +1,34 @@
+# Query accounts returns "Successful response with account data" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.query_accounts".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::RumAudienceManagementAPI.new
+
+body = DatadogAPIClient::V2::QueryAccountRequest.new({
+  data: DatadogAPIClient::V2::QueryAccountRequestData.new({
+    attributes: DatadogAPIClient::V2::QueryAccountRequestDataAttributes.new({
+      limit: 20,
+      query: "plan_type:enterprise AND user_count:>100 AND subscription_status:active",
+      select_columns: [
+        "account_id",
+        "account_name",
+        "user_count",
+        "plan_type",
+        "subscription_status",
+        "created_at",
+        "mrr",
+        "industry",
+      ],
+      sort: DatadogAPIClient::V2::QueryAccountRequestDataAttributesSort.new({
+        field: "user_count",
+        order: "DESC",
+      }),
+      wildcard_search_term: "tech",
+    }),
+    id: "query_account_request",
+    type: DatadogAPIClient::V2::QueryAccountRequestDataType::QUERY_ACCOUNT_REQUEST,
+  }),
+})
+p api_instance.query_accounts(body)

data/examples/v2/rum-audience-management/QueryEventFilteredUsers.rb

@@ -0,0 +1,37 @@
+# Query event filtered users returns "Successful response with filtered user data" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.query_event_filtered_users".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::RumAudienceManagementAPI.new
+
+body = DatadogAPIClient::V2::QueryEventFilteredUsersRequest.new({
+  data: DatadogAPIClient::V2::QueryEventFilteredUsersRequestData.new({
+    attributes: DatadogAPIClient::V2::QueryEventFilteredUsersRequestDataAttributes.new({
+      event_query: DatadogAPIClient::V2::QueryEventFilteredUsersRequestDataAttributesEventQuery.new({
+        query: "@type:view AND @view.loading_time:>3000 AND @application.name:ecommerce-platform",
+        time_frame: DatadogAPIClient::V2::QueryEventFilteredUsersRequestDataAttributesEventQueryTimeFrame.new({
+          _end: 1761309676,
+          start: 1760100076,
+        }),
+      }),
+      include_row_count: true,
+      limit: 25,
+      query: "user_org_id:5001 AND first_country_code:US AND first_browser_name:Chrome",
+      select_columns: [
+        "user_id",
+        "user_email",
+        "first_country_code",
+        "first_browser_name",
+        "events_count",
+        "session_count",
+        "error_count",
+        "avg_loading_time",
+      ],
+    }),
+    id: "query_event_filtered_users_request",
+    type: DatadogAPIClient::V2::QueryEventFilteredUsersRequestDataType::QUERY_EVENT_FILTERED_USERS_REQUEST,
+  }),
+})
+p api_instance.query_event_filtered_users(body)

data/examples/v2/rum-audience-management/QueryUsers.rb

@@ -0,0 +1,34 @@
+# Query users returns "Successful response with user data" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.query_users".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::RumAudienceManagementAPI.new
+
+body = DatadogAPIClient::V2::QueryUsersRequest.new({
+  data: DatadogAPIClient::V2::QueryUsersRequestData.new({
+    attributes: DatadogAPIClient::V2::QueryUsersRequestDataAttributes.new({
+      limit: 25,
+      query: "user_email:*@techcorp.com AND first_country_code:US AND first_browser_name:Chrome",
+      select_columns: [
+        "user_id",
+        "user_email",
+        "user_name",
+        "user_org_id",
+        "first_country_code",
+        "first_browser_name",
+        "first_device_type",
+        "last_seen",
+      ],
+      sort: DatadogAPIClient::V2::QueryUsersRequestDataAttributesSort.new({
+        field: "first_seen",
+        order: "DESC",
+      }),
+      wildcard_search_term: "john",
+    }),
+    id: "query_users_request",
+    type: DatadogAPIClient::V2::QueryUsersRequestDataType::QUERY_USERS_REQUEST,
+  }),
+})
+p api_instance.query_users(body)

data/examples/v2/rum-audience-management/UpdateConnection.rb

@@ -0,0 +1,43 @@
+# Update connection returns "Connection updated successfully" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.update_connection".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::RumAudienceManagementAPI.new
+
+body = DatadogAPIClient::V2::UpdateConnectionRequest.new({
+  data: DatadogAPIClient::V2::UpdateConnectionRequestData.new({
+    attributes: DatadogAPIClient::V2::UpdateConnectionRequestDataAttributes.new({
+      fields_to_add: [
+        DatadogAPIClient::V2::CreateConnectionRequestDataAttributesFieldsItems.new({
+          description: "Net Promoter Score from customer surveys",
+          display_name: "NPS Score",
+          groups: [
+            "Satisfaction",
+            "Metrics",
+          ],
+          id: "nps_score",
+          source_name: "net_promoter_score",
+          type: "number",
+        }),
+      ],
+      fields_to_delete: [
+        "old_revenue_field",
+      ],
+      fields_to_update: [
+        DatadogAPIClient::V2::UpdateConnectionRequestDataAttributesFieldsToUpdateItems.new({
+          field_id: "lifetime_value",
+          updated_display_name: "Customer Lifetime Value (`USD`)",
+          updated_groups: [
+            "Financial",
+            "Metrics",
+          ],
+        }),
+      ],
+    }),
+    id: "crm-integration",
+    type: DatadogAPIClient::V2::UpdateConnectionRequestDataType::CONNECTION_ID,
+  }),
+})
+p api_instance.update_connection("users", body)

data/examples/v2/security-monitoring/CancelThreatHuntingJob.rb

@@ -0,0 +1,8 @@
+# Cancel a threat hunting job returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.cancel_threat_hunting_job".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+api_instance.cancel_threat_hunting_job("job_id")

data/examples/v2/security-monitoring/CancelThreatHuntingJob_1945505845.rb

@@ -0,0 +1,12 @@
+# Cancel a historical job returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.cancel_threat_hunting_job".to_sym] = true
+  config.unstable_operations["v2.run_threat_hunting_job".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+# there is a valid "threat_hunting_job" in the system
+THREAT_HUNTING_JOB_DATA_ID = ENV["THREAT_HUNTING_JOB_DATA_ID"]
+api_instance.cancel_threat_hunting_job(THREAT_HUNTING_JOB_DATA_ID)

data/examples/v2/security-monitoring/CreateSecurityMonitoringSuppression.rb

@@ -13,6 +13,10 @@ body = DatadogAPIClient::V2::SecurityMonitoringSuppressionCreateRequest.new({
       name: "Example-Security-Monitoring",
       rule_query: "type:log_detection source:cloudtrail",
       suppression_query: "env:staging status:low",
+      tags: [
+        "technique:T1110-brute-force",
+        "source:cloudtrail",
+      ],
     }),
     type: DatadogAPIClient::V2::SecurityMonitoringSuppressionType::SUPPRESSIONS,
   }),

data/examples/v2/security-monitoring/{DeleteHistoricalJob.rb → DeleteThreatHuntingJob.rb}

@@ -2,7 +2,7 @@
 
 require "datadog_api_client"
 DatadogAPIClient.configure do |config|
-  config.unstable_operations["v2.delete_historical_job".to_sym] = true
+  config.unstable_operations["v2.delete_threat_hunting_job".to_sym] = true
 end
 api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
-api_instance.delete_historical_job("job_id")
+api_instance.delete_threat_hunting_job("job_id")

data/examples/v2/security-monitoring/GetSecretsRules.rb

@@ -0,0 +1,8 @@
+# Returns list of Secrets rules returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.get_secrets_rules".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+p api_instance.get_secrets_rules()

data/examples/v2/security-monitoring/GetThreatHuntingJob.rb

@@ -0,0 +1,12 @@
+# Get a job's details returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.get_threat_hunting_job".to_sym] = true
+  config.unstable_operations["v2.run_threat_hunting_job".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+# there is a valid "threat_hunting_job" in the system
+THREAT_HUNTING_JOB_DATA_ID = ENV["THREAT_HUNTING_JOB_DATA_ID"]
+p api_instance.get_threat_hunting_job(THREAT_HUNTING_JOB_DATA_ID)

data/examples/v2/security-monitoring/ListMultipleRulesets.rb

@@ -0,0 +1,17 @@
+# Ruleset get multiple returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.list_multiple_rulesets".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+body = DatadogAPIClient::V2::GetMultipleRulesetsRequest.new({
+  data: DatadogAPIClient::V2::GetMultipleRulesetsRequestData.new({
+    attributes: DatadogAPIClient::V2::GetMultipleRulesetsRequestDataAttributes.new({
+      rulesets: [],
+    }),
+    type: DatadogAPIClient::V2::GetMultipleRulesetsRequestDataType::GET_MULTIPLE_RULESETS_REQUEST,
+  }),
+})
+p api_instance.list_multiple_rulesets(body)

data/examples/v2/security-monitoring/ListThreatHuntingJobs.rb

@@ -0,0 +1,8 @@
+# List threat hunting jobs returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.list_threat_hunting_jobs".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+p api_instance.list_threat_hunting_jobs()

data/examples/v2/security-monitoring/ListThreatHuntingJobs_1365512061.rb

@@ -0,0 +1,15 @@
+# List historical jobs returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.list_threat_hunting_jobs".to_sym] = true
+  config.unstable_operations["v2.run_threat_hunting_job".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+# there is a valid "threat_hunting_job" in the system
+THREAT_HUNTING_JOB_DATA_ID = ENV["THREAT_HUNTING_JOB_DATA_ID"]
+opts = {
+  filter_query: "id:string",
+}
+p api_instance.list_threat_hunting_jobs(opts)