From a2005a15f2eb027a48f8340e135c55c56b5a94c6 Mon Sep 17 00:00:00 2001 From: "ci.datadog-api-spec" Date: Fri, 12 Sep 2025 18:28:56 +0000 Subject: [PATCH] Regenerate client from commit f93c9c2 of spec repo --- .../api/v2/security-monitoring/examples.json | 270 +- ...eateSecurityMonitoringRule_2899714190.json | 62 + ...dateSecurityMonitoringRule_4152369508.json | 64 + data/api/v2/CodeExamples.json | 10 + data/api/v2/full_spec.yaml | 47 + data/api/v2/full_spec_deref.json | 7276 ++++++++++++++++- static/resources/json/full_spec_v2.json | 7276 ++++++++++++++++- 7 files changed, 14738 insertions(+), 267 deletions(-) create mode 100644 content/en/api/v2/security-monitoring/request.CreateSecurityMonitoringRule_2899714190.json create mode 100644 content/en/api/v2/security-monitoring/request.ValidateSecurityMonitoringRule_4152369508.json diff --git a/content/en/api/v2/security-monitoring/examples.json b/content/en/api/v2/security-monitoring/examples.json index 272083ec28b2b..104d3dcfd8e54 100644 --- a/content/en/api/v2/security-monitoring/examples.json +++ b/content/en/api/v2/security-monitoring/examples.json @@ -2919,6 +2919,22 @@ "learningMethod": "string", "learningThreshold": "integer" }, + "sequenceDetectionOptions": { + "stepTransitions": [ + { + "child": "string", + "evaluationWindow": "integer", + "parent": "string" + } + ], + "steps": [ + { + "condition": "string", + "evaluationWindow": "integer", + "name": "string" + } + ] + }, "thirdPartyRuleOptions": { "defaultNotifications": [], "defaultStatus": "critical", @@ -2974,7 +2990,7 @@ ], "type": "string" }, - "html": "
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Create a new rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: api_security,application_security,log_detection,workload_security

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

Create a new signal correlation rule.

\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting signals which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId [required]

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

Create a new cloud configuration rule.

\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Description of generated findings and signals (severity and channels to be notified in case of a signal). Must contain exactly one item.

\n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions [required]

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message in markdown format for generated findings and signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options on cloud configuration rules.

\n
\n
\n
\n
\n
\n

complianceRuleOptions [required]

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated findings and signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: cloud_configuration

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Create a new rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: api_security,application_security,log_detection,workload_security

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

Create a new signal correlation rule.

\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting signals which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId [required]

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

Create a new cloud configuration rule.

\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Description of generated findings and signals (severity and channels to be notified in case of a signal). Must contain exactly one item.

\n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions [required]

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message in markdown format for generated findings and signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options on cloud configuration rules.

\n
\n
\n
\n
\n
\n

complianceRuleOptions [required]

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated findings and signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: cloud_configuration

\n
\n \n
\n
\n
\n
" } }, "GetSuppressionsAffectingRule": { @@ -3384,6 +3400,22 @@ "learningMethod": "string", "learningThreshold": "integer" }, + "sequenceDetectionOptions": { + "stepTransitions": [ + { + "child": "string", + "evaluationWindow": "integer", + "parent": "string" + } + ], + "steps": [ + { + "condition": "string", + "evaluationWindow": "integer", + "name": "string" + } + ] + }, "thirdPartyRuleOptions": { "defaultNotifications": [], "defaultStatus": "critical", @@ -3448,7 +3480,7 @@ } } }, - "html": "
\n
\n
\n
\n

data

\n
\n

[ <oneOf>]

\n

Array containing the list of rules.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

defaultTags

\n
\n

[string]

\n

Default Tags for default rules (included in tags)

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: log_detection,infrastructure_configuration,workload_security,cloud_configuration,application_security,api_security

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

The date the rule was last updated, in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to correlate by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

defaultRuleId

\n
\n

string

\n

Default Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Object describing meta attributes of response.

\n
\n
\n
\n
\n
\n

page

\n
\n

object

\n

Pagination object.

\n
\n
\n
\n
\n
\n

total_count

\n
\n

int64

\n

Total count.

\n
\n \n
\n
\n
\n
\n
\n

total_filtered_count

\n
\n

int64

\n

Total count of elements matched by the filter.

\n
\n \n
\n
\n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

[ <oneOf>]

\n

Array containing the list of rules.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

defaultTags

\n
\n

[string]

\n

Default Tags for default rules (included in tags)

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: log_detection,infrastructure_configuration,workload_security,cloud_configuration,application_security,api_security

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

The date the rule was last updated, in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to correlate by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

defaultRuleId

\n
\n

string

\n

Default Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Object describing meta attributes of response.

\n
\n
\n
\n
\n
\n

page

\n
\n

object

\n

Pagination object.

\n
\n
\n
\n
\n
\n

total_count

\n
\n

int64

\n

Total count.

\n
\n \n
\n
\n
\n
\n
\n

total_filtered_count

\n
\n

int64

\n

Total count of elements matched by the filter.

\n
\n \n
\n
\n
\n
\n
\n
" }, "400": { "json": { @@ -3559,6 +3591,22 @@ "learningMethod": "string", "learningThreshold": "integer" }, + "sequenceDetectionOptions": { + "stepTransitions": [ + { + "child": "string", + "evaluationWindow": "integer", + "parent": "string" + } + ], + "steps": [ + { + "condition": "string", + "evaluationWindow": "integer", + "name": "string" + } + ] + }, "thirdPartyRuleOptions": { "defaultNotifications": [], "defaultStatus": "critical", @@ -3615,7 +3663,7 @@ "updatedAt": "integer", "version": "integer" }, - "html": "
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

defaultTags

\n
\n

[string]

\n

Default Tags for default rules (included in tags)

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: log_detection,infrastructure_configuration,workload_security,cloud_configuration,application_security,api_security

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

The date the rule was last updated, in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to correlate by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

defaultRuleId

\n
\n

string

\n

Default Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

defaultTags

\n
\n

[string]

\n

Default Tags for default rules (included in tags)

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: log_detection,infrastructure_configuration,workload_security,cloud_configuration,application_security,api_security

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

The date the rule was last updated, in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to correlate by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

defaultRuleId

\n
\n

string

\n

Default Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
" }, "400": { "json": { @@ -3737,6 +3785,22 @@ "learningMethod": "string", "learningThreshold": "integer" }, + "sequenceDetectionOptions": { + "stepTransitions": [ + { + "child": "string", + "evaluationWindow": "integer", + "parent": "string" + } + ], + "steps": [ + { + "condition": "string", + "evaluationWindow": "integer", + "name": "string" + } + ] + }, "thirdPartyRuleOptions": { "defaultNotifications": [], "defaultStatus": "critical", @@ -3792,7 +3856,7 @@ ], "type": "string" }, - "html": "
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Create a new rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: api_security,application_security,log_detection,workload_security

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

Create a new signal correlation rule.

\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting signals which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId [required]

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

Create a new cloud configuration rule.

\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Description of generated findings and signals (severity and channels to be notified in case of a signal). Must contain exactly one item.

\n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions [required]

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message in markdown format for generated findings and signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options on cloud configuration rules.

\n
\n
\n
\n
\n
\n

complianceRuleOptions [required]

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated findings and signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: cloud_configuration

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Create a new rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: api_security,application_security,log_detection,workload_security

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

Create a new signal correlation rule.

\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting signals which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId [required]

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

Create a new cloud configuration rule.

\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Description of generated findings and signals (severity and channels to be notified in case of a signal). Must contain exactly one item.

\n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions [required]

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message in markdown format for generated findings and signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options on cloud configuration rules.

\n
\n
\n
\n
\n
\n

complianceRuleOptions [required]

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated findings and signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: cloud_configuration

\n
\n \n
\n
\n
\n
" } }, "ConvertSecurityMonitoringRuleFromJSONToTerraform": { @@ -3941,6 +4005,22 @@ "learningMethod": "string", "learningThreshold": "integer" }, + "sequenceDetectionOptions": { + "stepTransitions": [ + { + "child": "string", + "evaluationWindow": "integer", + "parent": "string" + } + ], + "steps": [ + { + "condition": "string", + "evaluationWindow": "integer", + "name": "string" + } + ] + }, "thirdPartyRuleOptions": { "defaultNotifications": [], "defaultStatus": "critical", @@ -3996,7 +4076,7 @@ ], "type": "string" }, - "html": "
\n
\n
\n
\n

Option 1

\n
\n

object

\n

The payload of a rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: api_security,application_security,log_detection,workload_security

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

The payload of a signal correlation rule.

\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting signals which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId [required]

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

Option 1

\n
\n

object

\n

The payload of a rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: api_security,application_security,log_detection,workload_security

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

The payload of a signal correlation rule.

\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting signals which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId [required]

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
" } }, "TestSecurityMonitoringRule": { @@ -4146,6 +4226,22 @@ "learningMethod": "string", "learningThreshold": "integer" }, + "sequenceDetectionOptions": { + "stepTransitions": [ + { + "child": "string", + "evaluationWindow": "integer", + "parent": "string" + } + ], + "steps": [ + { + "condition": "string", + "evaluationWindow": "integer", + "name": "string" + } + ] + }, "thirdPartyRuleOptions": { "defaultNotifications": [], "defaultStatus": "critical", @@ -4215,7 +4311,7 @@ } ] }, - "html": "
\n
\n
\n
\n

rule

\n
\n

 <oneOf>

\n

Test a rule.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

The payload of a rule to test

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: log_detection

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

ruleQueryPayloads

\n
\n

[object]

\n

Data payloads used to test rules query with the expected result.

\n
\n
\n
\n
\n
\n

expectedResult

\n
\n

boolean

\n

Expected result of the test.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

int64

\n

Index of the query under test.

\n
\n \n
\n
\n
\n
\n
\n

payload

\n
\n

object

\n

Payload used to test the rule query.

\n
\n
\n
\n
\n
\n

ddsource

\n
\n

string

\n

Source of the payload.

\n
\n \n
\n
\n
\n
\n
\n

ddtags

\n
\n

string

\n

Tags associated with your data.

\n
\n \n
\n
\n
\n
\n
\n

hostname

\n
\n

string

\n

The name of the originating host of the log.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

The message of the payload.

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The name of the application or service generating the data.

\n
\n \n
\n
\n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

rule

\n
\n

 <oneOf>

\n

Test a rule.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

The payload of a rule to test

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: log_detection

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

ruleQueryPayloads

\n
\n

[object]

\n

Data payloads used to test rules query with the expected result.

\n
\n
\n
\n
\n
\n

expectedResult

\n
\n

boolean

\n

Expected result of the test.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

int64

\n

Index of the query under test.

\n
\n \n
\n
\n
\n
\n
\n

payload

\n
\n

object

\n

Payload used to test the rule query.

\n
\n
\n
\n
\n
\n

ddsource

\n
\n

string

\n

Source of the payload.

\n
\n \n
\n
\n
\n
\n
\n

ddtags

\n
\n

string

\n

Tags associated with your data.

\n
\n \n
\n
\n
\n
\n
\n

hostname

\n
\n

string

\n

The name of the originating host of the log.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

The message of the payload.

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The name of the application or service generating the data.

\n
\n \n
\n
\n
\n
\n
\n
" } }, "ValidateSecurityMonitoringRule": { @@ -4342,6 +4438,22 @@ "learningMethod": "string", "learningThreshold": "integer" }, + "sequenceDetectionOptions": { + "stepTransitions": [ + { + "child": "string", + "evaluationWindow": "integer", + "parent": "string" + } + ], + "steps": [ + { + "condition": "string", + "evaluationWindow": "integer", + "name": "string" + } + ] + }, "thirdPartyRuleOptions": { "defaultNotifications": [], "defaultStatus": "critical", @@ -4397,7 +4509,7 @@ ], "type": "string" }, - "html": "
\n
\n
\n
\n

Option 1

\n
\n

object

\n

The payload of a rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: api_security,application_security,log_detection,workload_security

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

The payload of a signal correlation rule.

\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting signals which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId [required]

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

The payload of a cloud configuration rule.

\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Description of generated findings and signals (severity and channels to be notified in case of a signal). Must contain exactly one item.

\n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions [required]

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message in markdown format for generated findings and signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options on cloud configuration rules.

\n
\n
\n
\n
\n
\n

complianceRuleOptions [required]

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated findings and signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: cloud_configuration

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

Option 1

\n
\n

object

\n

The payload of a rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: api_security,application_security,log_detection,workload_security

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

The payload of a signal correlation rule.

\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting signals which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId [required]

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 3

\n
\n

object

\n

The payload of a cloud configuration rule.

\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Description of generated findings and signals (severity and channels to be notified in case of a signal). Must contain exactly one item.

\n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions [required]

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message in markdown format for generated findings and signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options on cloud configuration rules.

\n
\n
\n
\n
\n
\n

complianceRuleOptions [required]

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated findings and signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: cloud_configuration

\n
\n \n
\n
\n
\n
" } }, "DeleteSecurityMonitoringRule": { @@ -4519,6 +4631,22 @@ "learningMethod": "string", "learningThreshold": "integer" }, + "sequenceDetectionOptions": { + "stepTransitions": [ + { + "child": "string", + "evaluationWindow": "integer", + "parent": "string" + } + ], + "steps": [ + { + "condition": "string", + "evaluationWindow": "integer", + "name": "string" + } + ] + }, "thirdPartyRuleOptions": { "defaultNotifications": [], "defaultStatus": "critical", @@ -4575,7 +4703,7 @@ "updatedAt": "integer", "version": "integer" }, - "html": "
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

defaultTags

\n
\n

[string]

\n

Default Tags for default rules (included in tags)

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: log_detection,infrastructure_configuration,workload_security,cloud_configuration,application_security,api_security

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

The date the rule was last updated, in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to correlate by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

defaultRuleId

\n
\n

string

\n

Default Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

defaultTags

\n
\n

[string]

\n

Default Tags for default rules (included in tags)

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: log_detection,infrastructure_configuration,workload_security,cloud_configuration,application_security,api_security

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

The date the rule was last updated, in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to correlate by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

defaultRuleId

\n
\n

string

\n

Default Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
" }, "404": { "json": { @@ -4686,6 +4814,22 @@ "learningMethod": "string", "learningThreshold": "integer" }, + "sequenceDetectionOptions": { + "stepTransitions": [ + { + "child": "string", + "evaluationWindow": "integer", + "parent": "string" + } + ], + "steps": [ + { + "condition": "string", + "evaluationWindow": "integer", + "name": "string" + } + ] + }, "thirdPartyRuleOptions": { "defaultNotifications": [], "defaultStatus": "critical", @@ -4742,7 +4886,7 @@ "updatedAt": "integer", "version": "integer" }, - "html": "
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

defaultTags

\n
\n

[string]

\n

Default Tags for default rules (included in tags)

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: log_detection,infrastructure_configuration,workload_security,cloud_configuration,application_security,api_security

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

The date the rule was last updated, in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to correlate by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

defaultRuleId

\n
\n

string

\n

Default Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

defaultTags

\n
\n

[string]

\n

Default Tags for default rules (included in tags)

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: log_detection,infrastructure_configuration,workload_security,cloud_configuration,application_security,api_security

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

The date the rule was last updated, in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to correlate by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

defaultRuleId

\n
\n

string

\n

Default Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
" }, "400": { "json": { @@ -4879,6 +5023,22 @@ "learningMethod": "string", "learningThreshold": "integer" }, + "sequenceDetectionOptions": { + "stepTransitions": [ + { + "child": "string", + "evaluationWindow": "integer", + "parent": "string" + } + ], + "steps": [ + { + "condition": "string", + "evaluationWindow": "integer", + "name": "string" + } + ] + }, "thirdPartyRuleOptions": { "defaultNotifications": [], "defaultStatus": "critical", @@ -4932,7 +5092,7 @@ ], "version": 1 }, - "html": "
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden Message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[ <oneOf>]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Query for matching rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

Query for matching rule on signals.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId [required]

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int32

\n

The version of the rule being updated.

\n
\n \n
\n
" + "html": "
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden Message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[ <oneOf>]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Query for matching rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

Query for matching rule on signals.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId [required]

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int32

\n

The version of the rule being updated.

\n
\n \n
\n
" } }, "ConvertExistingSecurityMonitoringRule": { @@ -5129,6 +5289,22 @@ "learningMethod": "string", "learningThreshold": "integer" }, + "sequenceDetectionOptions": { + "stepTransitions": [ + { + "child": "string", + "evaluationWindow": "integer", + "parent": "string" + } + ], + "steps": [ + { + "condition": "string", + "evaluationWindow": "integer", + "name": "string" + } + ] + }, "thirdPartyRuleOptions": { "defaultNotifications": [], "defaultStatus": "critical", @@ -5198,7 +5374,7 @@ } ] }, - "html": "
\n
\n
\n
\n

rule

\n
\n

 <oneOf>

\n

Test a rule.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

The payload of a rule to test

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: log_detection

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

ruleQueryPayloads

\n
\n

[object]

\n

Data payloads used to test rules query with the expected result.

\n
\n
\n
\n
\n
\n

expectedResult

\n
\n

boolean

\n

Expected result of the test.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

int64

\n

Index of the query under test.

\n
\n \n
\n
\n
\n
\n
\n

payload

\n
\n

object

\n

Payload used to test the rule query.

\n
\n
\n
\n
\n
\n

ddsource

\n
\n

string

\n

Source of the payload.

\n
\n \n
\n
\n
\n
\n
\n

ddtags

\n
\n

string

\n

Tags associated with your data.

\n
\n \n
\n
\n
\n
\n
\n

hostname

\n
\n

string

\n

The name of the originating host of the log.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

The message of the payload.

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The name of the application or service generating the data.

\n
\n \n
\n
\n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

rule

\n
\n

 <oneOf>

\n

Test a rule.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

The payload of a rule to test

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled [required]

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options [required]

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: log_detection

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

ruleQueryPayloads

\n
\n

[object]

\n

Data payloads used to test rules query with the expected result.

\n
\n
\n
\n
\n
\n

expectedResult

\n
\n

boolean

\n

Expected result of the test.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

int64

\n

Index of the query under test.

\n
\n \n
\n
\n
\n
\n
\n

payload

\n
\n

object

\n

Payload used to test the rule query.

\n
\n
\n
\n
\n
\n

ddsource

\n
\n

string

\n

Source of the payload.

\n
\n \n
\n
\n
\n
\n
\n

ddtags

\n
\n

string

\n

Tags associated with your data.

\n
\n \n
\n
\n
\n
\n
\n

hostname

\n
\n

string

\n

The name of the originating host of the log.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

The message of the payload.

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The name of the application or service generating the data.

\n
\n \n
\n
\n
\n
\n
\n
" } }, "GetRuleVersionHistory": { @@ -5300,6 +5476,22 @@ "learningMethod": "string", "learningThreshold": "integer" }, + "sequenceDetectionOptions": { + "stepTransitions": [ + { + "child": "string", + "evaluationWindow": "integer", + "parent": "string" + } + ], + "steps": [ + { + "condition": "string", + "evaluationWindow": "integer", + "name": "string" + } + ] + }, "thirdPartyRuleOptions": { "defaultNotifications": [], "defaultStatus": "critical", @@ -5363,7 +5555,7 @@ "type": "string" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Data for the rule version history.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

Response object containing the version history of a rule.

\n
\n
\n
\n
\n
\n

count

\n
\n

int32

\n

The number of rule versions.

\n
\n \n
\n
\n
\n
\n
\n

data

\n
\n

object

\n

The RuleVersionHistory data.

\n
\n
\n
\n
\n
\n

<any-key>

\n
\n

object

\n

A rule version with a list of updates.

\n
\n
\n
\n
\n
\n

changes

\n
\n

[object]

\n

A list of changes.

\n
\n
\n
\n
\n
\n

change

\n
\n

string

\n

The new value of the field.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field that was changed.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of change. \nAllowed enum values: create,update,delete

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

rule

\n
\n

 <oneOf>

\n

Create a new rule.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

defaultTags

\n
\n

[string]

\n

Default Tags for default rules (included in tags)

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: log_detection,infrastructure_configuration,workload_security,cloud_configuration,application_security,api_security

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

The date the rule was last updated, in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to correlate by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

defaultRuleId

\n
\n

string

\n

Default Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

Type of data. \nAllowed enum values: GetRuleVersionHistoryResponse

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Data for the rule version history.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

Response object containing the version history of a rule.

\n
\n
\n
\n
\n
\n

count

\n
\n

int32

\n

The number of rule versions.

\n
\n \n
\n
\n
\n
\n
\n

data

\n
\n

object

\n

The RuleVersionHistory data.

\n
\n
\n
\n
\n
\n

<any-key>

\n
\n

object

\n

A rule version with a list of updates.

\n
\n
\n
\n
\n
\n

changes

\n
\n

[object]

\n

A list of changes.

\n
\n
\n
\n
\n
\n

change

\n
\n

string

\n

The new value of the field.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field that was changed.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of change. \nAllowed enum values: create,update,delete

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

rule

\n
\n

 <oneOf>

\n

Create a new rule.

\n
\n
\n
\n
\n
\n

Option 1

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

complianceSignalOptions

\n
\n

object

\n

How to generate compliance signals. Useful for cloud_configuration rules only.

\n
\n
\n
\n
\n
\n

defaultActivationStatus

\n
\n

boolean

\n

The default activation status.

\n
\n \n
\n
\n
\n
\n
\n

defaultGroupByFields

\n
\n

[string]

\n

The default group by fields.

\n
\n \n
\n
\n
\n
\n
\n

userActivationStatus

\n
\n

boolean

\n

Whether signals will be sent.

\n
\n \n
\n
\n
\n
\n
\n

userGroupByFields

\n
\n

[string]

\n

Fields to use to group findings by when sending signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

defaultTags

\n
\n

[string]

\n

Default Tags for default rules (included in tags)

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

customQueryExtension

\n
\n

string

\n

Query extension to append to the logs query.

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

index

\n
\n

string

\n

This field is currently unstable and might be removed in a minor version upgrade.\nThe index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

\n
\n \n
\n
\n
\n
\n
\n

metric

\n
\n

string

\n

DEPRECATED: (Deprecated) The target field to aggregate over when using the sum or max\naggregations. metrics field should be used instead.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables for the rule.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

schedulingOptions

\n
\n

object

\n

Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.

\n
\n
\n
\n
\n
\n

rrule

\n
\n

string

\n

Schedule for the rule queries, written in RRULE syntax. See RFC for syntax reference.

\n
\n \n
\n
\n
\n
\n
\n

start

\n
\n

string

\n

Start date for the schedule, in ISO 8601 format without timezone.

\n
\n \n
\n
\n
\n
\n
\n

timezone

\n
\n

string

\n

Time zone of the start date, in the tz database format.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating signals from third-party rules. Only available for third-party rules.

\n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: log_detection,infrastructure_configuration,workload_security,cloud_configuration,application_security,api_security

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

The date the rule was last updated, in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

Option 2

\n
\n

object

\n

Rule.

\n
\n
\n
\n
\n
\n

cases

\n
\n

[object]

\n

Cases for generating signals.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

customStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each rule case.

\n
\n \n
\n
\n
\n
\n
\n

status

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

createdAt

\n
\n

int64

\n

When the rule was created, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorId

\n
\n

int64

\n

User ID of the user who created the rule.

\n
\n \n
\n
\n
\n
\n
\n

customMessage

\n
\n

string

\n

Custom/Overridden message for generated signals (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

customName

\n
\n

string

\n

Custom/Overridden name of the rule (used in case of Default rule update).

\n
\n \n
\n
\n
\n
\n
\n

deprecationDate

\n
\n

int64

\n

When the rule will be deprecated, timestamp in milliseconds.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[object]

\n

Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

The type of filtering action. \nAllowed enum values: require,suppress

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query for selecting logs to apply the filtering action.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

hasExtendedTitle

\n
\n

boolean

\n

Whether the notifications include the triggering group-by values in their title.

\n
\n \n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Whether the rule is included by default.

\n
\n \n
\n
\n
\n
\n
\n

isDeleted

\n
\n

boolean

\n

Whether the rule has been deleted.

\n
\n \n
\n
\n
\n
\n
\n

isEnabled

\n
\n

boolean

\n

Whether the rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

message

\n
\n

string

\n

Message for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the rule.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options.

\n
\n
\n
\n
\n
\n

complianceRuleOptions

\n
\n

object

\n

Options for cloud_configuration rules.\nFields resourceType and regoRule are mandatory when managing custom cloud_configuration rules.

\n
\n
\n
\n
\n
\n

complexRule

\n
\n

boolean

\n

Whether the rule is a complex one.\nMust be set to true if regoRule.resourceTypes contains more than one item. Defaults to false.

\n
\n \n
\n
\n
\n
\n
\n

regoRule

\n
\n

object

\n

Rule details.

\n
\n
\n
\n
\n
\n

policy [required]

\n
\n

string

\n

The policy written in rego, see: https://www.openpolicyagent.org/docs/latest/policy-language/

\n
\n \n
\n
\n
\n
\n
\n

resourceTypes [required]

\n
\n

[string]

\n

List of resource types that will be evaluated upon. Must have at least one element.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

resourceType

\n
\n

string

\n

Main resource type to be checked by the rule. It should be specified again in regoRule.resourceTypes.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

decreaseCriticalityBasedOnEnv

\n
\n

boolean

\n

If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: CRITICAL in production becomes HIGH in non-production, HIGH becomes MEDIUM and so on. INFO remains INFO.\nThe decrement is applied when the environment tag of the signal starts with staging, test or dev.

\n
\n \n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

hardcodedEvaluatorType

\n
\n

enum

\n

Hardcoded evaluator type. \nAllowed enum values: log4shell

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries

\n
\n

[object]

\n

Queries for selecting logs which are part of the rule.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

correlatedByFields

\n
\n

[string]

\n

Fields to correlate by.

\n
\n \n
\n
\n
\n
\n
\n

correlatedQueryIndex

\n
\n

int32

\n

Index of the rule query used to retrieve the correlated field.

\n
\n \n
\n
\n
\n
\n
\n

defaultRuleId

\n
\n

string

\n

Default Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

ruleId

\n
\n

string

\n

Rule ID to match on signals.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The rule type. \nAllowed enum values: signal_correlation

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorId

\n
\n

int64

\n

User ID of the user who updated the rule.

\n
\n \n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the rule.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

Type of data. \nAllowed enum values: GetRuleVersionHistoryResponse

\n
\n \n
\n
\n
\n
" }, "400": { "json": { @@ -6202,6 +6394,22 @@ "learningMethod": "string", "learningThreshold": "integer" }, + "sequenceDetectionOptions": { + "stepTransitions": [ + { + "child": "string", + "evaluationWindow": "integer", + "parent": "string" + } + ], + "steps": [ + { + "condition": "string", + "evaluationWindow": "integer", + "name": "string" + } + ] + }, "thirdPartyRuleOptions": { "defaultNotifications": [], "defaultStatus": "critical", @@ -6259,7 +6467,7 @@ "totalCount": "integer" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

[object]

\n

Array containing the list of historical jobs.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

Historical job attributes.

\n
\n
\n
\n
\n
\n

createdAt

\n
\n

string

\n

Time when the job was created.

\n
\n \n
\n
\n
\n
\n
\n

createdByHandle

\n
\n

string

\n

The handle of the user who created the job.

\n
\n \n
\n
\n
\n
\n
\n

createdByName

\n
\n

string

\n

The name of the user who created the job.

\n
\n \n
\n
\n
\n
\n
\n

createdFromRuleId

\n
\n

string

\n

ID of the rule used to create the job (if it is created from a rule).

\n
\n \n
\n
\n
\n
\n
\n

jobDefinition

\n
\n

object

\n

Definition of a historical job.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases used for generating job results.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

from [required]

\n
\n

int64

\n

Starting time of data analyzed by the job.

\n
\n \n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

index [required]

\n
\n

string

\n

Index used to load the data.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated results.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Job name.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Job options.

\n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs analyzed by the job.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the query. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables used in the queries.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating results from third-party detection method. Only available for third-party detection method.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

to [required]

\n
\n

int64

\n

Ending time of data analyzed by the job.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Job type.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

jobName

\n
\n

string

\n

Job name.

\n
\n \n
\n
\n
\n
\n
\n

jobStatus

\n
\n

string

\n

Job status.

\n
\n \n
\n
\n
\n
\n
\n

modifiedAt

\n
\n

string

\n

Last modification time of the job.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the job.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

Type of payload. \nAllowed enum values: historicalDetectionsJob

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Metadata about the list of jobs.

\n
\n
\n
\n
\n
\n

totalCount

\n
\n

int32

\n

Number of jobs in the list.

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

[object]

\n

Array containing the list of historical jobs.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

Historical job attributes.

\n
\n
\n
\n
\n
\n

createdAt

\n
\n

string

\n

Time when the job was created.

\n
\n \n
\n
\n
\n
\n
\n

createdByHandle

\n
\n

string

\n

The handle of the user who created the job.

\n
\n \n
\n
\n
\n
\n
\n

createdByName

\n
\n

string

\n

The name of the user who created the job.

\n
\n \n
\n
\n
\n
\n
\n

createdFromRuleId

\n
\n

string

\n

ID of the rule used to create the job (if it is created from a rule).

\n
\n \n
\n
\n
\n
\n
\n

jobDefinition

\n
\n

object

\n

Definition of a historical job.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases used for generating job results.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

from [required]

\n
\n

int64

\n

Starting time of data analyzed by the job.

\n
\n \n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

index [required]

\n
\n

string

\n

Index used to load the data.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated results.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Job name.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Job options.

\n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs analyzed by the job.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the query. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables used in the queries.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating results from third-party detection method. Only available for third-party detection method.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

to [required]

\n
\n

int64

\n

Ending time of data analyzed by the job.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Job type.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

jobName

\n
\n

string

\n

Job name.

\n
\n \n
\n
\n
\n
\n
\n

jobStatus

\n
\n

string

\n

Job status.

\n
\n \n
\n
\n
\n
\n
\n

modifiedAt

\n
\n

string

\n

Last modification time of the job.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the job.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

Type of payload. \nAllowed enum values: historicalDetectionsJob

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Metadata about the list of jobs.

\n
\n
\n
\n
\n
\n

totalCount

\n
\n

int32

\n

Number of jobs in the list.

\n
\n \n
\n
\n
\n
" }, "400": { "json": { @@ -6442,6 +6650,22 @@ "learningMethod": "string", "learningThreshold": "integer" }, + "sequenceDetectionOptions": { + "stepTransitions": [ + { + "child": "string", + "evaluationWindow": "integer", + "parent": "string" + } + ], + "steps": [ + { + "condition": "string", + "evaluationWindow": "integer", + "name": "string" + } + ] + }, "thirdPartyRuleOptions": { "defaultNotifications": [], "defaultStatus": "critical", @@ -6491,7 +6715,7 @@ "type": "string" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Data for running a historical job request.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

Run a historical job request.

\n
\n
\n
\n
\n
\n

fromRule

\n
\n

object

\n

Definition of a historical job based on a security monitoring rule.

\n
\n
\n
\n
\n
\n

from [required]

\n
\n

int64

\n

Starting time of data analyzed by the job.

\n
\n \n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

ID of the detection rule used to create the job.

\n
\n \n
\n
\n
\n
\n
\n

index [required]

\n
\n

string

\n

Index used to load the data.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notifications sent when the job is completed.

\n
\n \n
\n
\n
\n
\n
\n

to [required]

\n
\n

int64

\n

Ending time of data analyzed by the job.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

Request ID.

\n
\n \n
\n
\n
\n
\n
\n

jobDefinition

\n
\n

object

\n

Definition of a historical job.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases used for generating job results.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

from [required]

\n
\n

int64

\n

Starting time of data analyzed by the job.

\n
\n \n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

index [required]

\n
\n

string

\n

Index used to load the data.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated results.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Job name.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Job options.

\n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs analyzed by the job.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the query. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables used in the queries.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating results from third-party detection method. Only available for third-party detection method.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

to [required]

\n
\n

int64

\n

Ending time of data analyzed by the job.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Job type.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

Type of data. \nAllowed enum values: historicalDetectionsJobCreate

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Data for running a historical job request.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

Run a historical job request.

\n
\n
\n
\n
\n
\n

fromRule

\n
\n

object

\n

Definition of a historical job based on a security monitoring rule.

\n
\n
\n
\n
\n
\n

from [required]

\n
\n

int64

\n

Starting time of data analyzed by the job.

\n
\n \n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

ID of the detection rule used to create the job.

\n
\n \n
\n
\n
\n
\n
\n

index [required]

\n
\n

string

\n

Index used to load the data.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notifications sent when the job is completed.

\n
\n \n
\n
\n
\n
\n
\n

to [required]

\n
\n

int64

\n

Ending time of data analyzed by the job.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

Request ID.

\n
\n \n
\n
\n
\n
\n
\n

jobDefinition

\n
\n

object

\n

Definition of a historical job.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases used for generating job results.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

from [required]

\n
\n

int64

\n

Starting time of data analyzed by the job.

\n
\n \n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

index [required]

\n
\n

string

\n

Index used to load the data.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated results.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Job name.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Job options.

\n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs analyzed by the job.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the query. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables used in the queries.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating results from third-party detection method. Only available for third-party detection method.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

to [required]

\n
\n

int64

\n

Ending time of data analyzed by the job.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Job type.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

Type of data. \nAllowed enum values: historicalDetectionsJobCreate

\n
\n \n
\n
\n
\n
" } }, "ConvertJobResultToSignal": { @@ -6684,6 +6908,22 @@ "learningMethod": "string", "learningThreshold": "integer" }, + "sequenceDetectionOptions": { + "stepTransitions": [ + { + "child": "string", + "evaluationWindow": "integer", + "parent": "string" + } + ], + "steps": [ + { + "condition": "string", + "evaluationWindow": "integer", + "name": "string" + } + ] + }, "thirdPartyRuleOptions": { "defaultNotifications": [], "defaultStatus": "critical", @@ -6737,7 +6977,7 @@ "type": "string" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Historical job response data.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

Historical job attributes.

\n
\n
\n
\n
\n
\n

createdAt

\n
\n

string

\n

Time when the job was created.

\n
\n \n
\n
\n
\n
\n
\n

createdByHandle

\n
\n

string

\n

The handle of the user who created the job.

\n
\n \n
\n
\n
\n
\n
\n

createdByName

\n
\n

string

\n

The name of the user who created the job.

\n
\n \n
\n
\n
\n
\n
\n

createdFromRuleId

\n
\n

string

\n

ID of the rule used to create the job (if it is created from a rule).

\n
\n \n
\n
\n
\n
\n
\n

jobDefinition

\n
\n

object

\n

Definition of a historical job.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases used for generating job results.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

from [required]

\n
\n

int64

\n

Starting time of data analyzed by the job.

\n
\n \n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

index [required]

\n
\n

string

\n

Index used to load the data.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated results.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Job name.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Job options.

\n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs analyzed by the job.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the query. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables used in the queries.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating results from third-party detection method. Only available for third-party detection method.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

to [required]

\n
\n

int64

\n

Ending time of data analyzed by the job.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Job type.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

jobName

\n
\n

string

\n

Job name.

\n
\n \n
\n
\n
\n
\n
\n

jobStatus

\n
\n

string

\n

Job status.

\n
\n \n
\n
\n
\n
\n
\n

modifiedAt

\n
\n

string

\n

Last modification time of the job.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the job.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

Type of payload. \nAllowed enum values: historicalDetectionsJob

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Historical job response data.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

Historical job attributes.

\n
\n
\n
\n
\n
\n

createdAt

\n
\n

string

\n

Time when the job was created.

\n
\n \n
\n
\n
\n
\n
\n

createdByHandle

\n
\n

string

\n

The handle of the user who created the job.

\n
\n \n
\n
\n
\n
\n
\n

createdByName

\n
\n

string

\n

The name of the user who created the job.

\n
\n \n
\n
\n
\n
\n
\n

createdFromRuleId

\n
\n

string

\n

ID of the rule used to create the job (if it is created from a rule).

\n
\n \n
\n
\n
\n
\n
\n

jobDefinition

\n
\n

object

\n

Definition of a historical job.

\n
\n
\n
\n
\n
\n

calculatedFields

\n
\n

[object]

\n

Calculated fields.

\n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

Expression.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Field name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

cases [required]

\n
\n

[object]

\n

Cases used for generating job results.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

Action to perform for each rule case.

\n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the rule action

\n
\n
\n
\n
\n
\n

duration

\n
\n

int64

\n

Duration of the action in seconds. 0 indicates no expiration.

\n
\n \n
\n
\n
\n
\n
\n

flaggedIPType

\n
\n

enum

\n

Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. \nAllowed enum values: SUSPICIOUS,FLAGGED

\n
\n \n
\n
\n
\n
\n
\n

userBehaviorName

\n
\n

string

\n

Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The action type. \nAllowed enum values: block_ip,block_user,user_behavior,flag_ip

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

A case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated\nbased on the event counts in the previously defined queries.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

from [required]

\n
\n

int64

\n

Starting time of data analyzed by the job.

\n
\n \n
\n
\n
\n
\n
\n

groupSignalsBy

\n
\n

[string]

\n

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

\n
\n \n
\n
\n
\n
\n
\n

index [required]

\n
\n

string

\n

Index used to load the data.

\n
\n \n
\n
\n
\n
\n
\n

message [required]

\n
\n

string

\n

Message for generated results.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

Job name.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Job options.

\n
\n
\n
\n
\n
\n

detectionMethod

\n
\n

enum

\n

The detection method. \nAllowed enum values: threshold,new_value,anomaly_detection,impossible_travel,hardcoded,third_party,anomaly_threshold,sequence_detection

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

impossibleTravelOptions

\n
\n

object

\n

Options on impossible travel detection method.

\n
\n
\n
\n
\n
\n

baselineUserLocations

\n
\n

boolean

\n

If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

keepAlive

\n
\n

enum

\n

Once a signal is generated, the signal will remain "open" if a case is matched at least once within\nthis keep alive window. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

maxSignalDuration

\n
\n

enum

\n

A signal will "close" regardless of the query being matched once the time exceeds the maximum duration.\nThis time is calculated from the first seen timestamp. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

newValueOptions

\n
\n

object

\n

Options on new value detection method.

\n
\n
\n
\n
\n
\n

forgetAfter

\n
\n

enum

\n

The duration in days after which a learned value is forgotten. \nAllowed enum values: 1,2,7,14,21,28

\n
\n \n
\n
\n
\n
\n
\n

learningDuration

\n
\n

enum

\n

The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. \nAllowed enum values: 0,1,7

\n
\n \n
\n
\n
\n
\n
\n

learningMethod

\n
\n

enum

\n

The learning method used to determine when signals should be generated for values that weren't learned. \nAllowed enum values: duration,threshold

default: duration

\n
\n \n
\n
\n
\n
\n
\n

learningThreshold

\n
\n

enum

\n

A number of occurrences after which signals will be generated for values that weren't learned. \nAllowed enum values: 0,1

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

sequenceDetectionOptions

\n
\n

object

\n

Options on sequence detection method.

\n
\n
\n
\n
\n
\n

stepTransitions

\n
\n

[object]

\n

Transitions defining the allowed order of steps and their evaluation windows.

\n
\n
\n
\n
\n
\n

child

\n
\n

string

\n

Name of the child step.

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

parent

\n
\n

string

\n

Name of the parent step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

steps

\n
\n

[object]

\n

Steps that define the conditions to be matched in sequence.

\n
\n
\n
\n
\n
\n

condition

\n
\n

string

\n

Condition referencing rule queries (e.g., a > 0).

\n
\n \n
\n
\n
\n
\n
\n

evaluationWindow

\n
\n

enum

\n

A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used. \nAllowed enum values: 0,60,300,600,900,1800,3600,7200,10800,21600,43200,86400

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Unique name identifying the step.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

thirdPartyRuleOptions

\n
\n

object

\n

Options on third party detection method.

\n
\n
\n
\n
\n
\n

defaultNotifications

\n
\n

[string]

\n

Notification targets for the logs that do not correspond to any of the cases.

\n
\n \n
\n
\n
\n
\n
\n

defaultStatus

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n

rootQueries

\n
\n

[object]

\n

Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.

\n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

signalTitleTemplate

\n
\n

string

\n

A template for the signal title; if omitted, the title is generated based on the case name.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

queries [required]

\n
\n

[object]

\n

Queries for selecting logs analyzed by the job.

\n
\n
\n
\n
\n
\n

aggregation

\n
\n

enum

\n

The aggregation type. \nAllowed enum values: count,cardinality,sum,max,new_value,geo_data,event_count,none

\n
\n \n
\n
\n
\n
\n
\n

dataSource

\n
\n

enum

\n

Source of events, either logs, audit trail, or Datadog events. \nAllowed enum values: logs,audit,app_sec_spans,spans,security_runtime,network,events

default: logs

\n
\n \n
\n
\n
\n
\n
\n

distinctFields

\n
\n

[string]

\n

Field for which the cardinality is measured. Sent as an array.

\n
\n \n
\n
\n
\n
\n
\n

groupByFields

\n
\n

[string]

\n

Fields to group by.

\n
\n \n
\n
\n
\n
\n
\n

hasOptionalGroupByFields

\n
\n

boolean

\n

When false, events without a group-by value are ignored by the query. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

\n
\n \n
\n
\n
\n
\n
\n

metrics

\n
\n

[string]

\n

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the query.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

Query to run on logs.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

referenceTables

\n
\n

[object]

\n

Reference tables used in the queries.

\n
\n
\n
\n
\n
\n

checkPresence

\n
\n

boolean

\n

Whether to include or exclude the matched values.

\n
\n \n
\n
\n
\n
\n
\n

columnName

\n
\n

string

\n

The name of the column in the reference table.

\n
\n \n
\n
\n
\n
\n
\n

logFieldPath

\n
\n

string

\n

The field in the log to match against the reference table.

\n
\n \n
\n
\n
\n
\n
\n

ruleQueryName

\n
\n

string

\n

The name of the query to apply the reference table to.

\n
\n \n
\n
\n
\n
\n
\n

tableName

\n
\n

string

\n

The name of the reference table.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags

\n
\n

[string]

\n

Tags for generated signals.

\n
\n \n
\n
\n
\n
\n
\n

thirdPartyCases

\n
\n

[object]

\n

Cases for generating results from third-party detection method. Only available for third-party detection method.

\n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

Name of the case.

\n
\n \n
\n
\n
\n
\n
\n

notifications

\n
\n

[string]

\n

Notification targets for each case.

\n
\n \n
\n
\n
\n
\n
\n

query

\n
\n

string

\n

A query to map a third party event to this case.

\n
\n \n
\n
\n
\n
\n
\n

status [required]

\n
\n

enum

\n

Severity of the Security Signal. \nAllowed enum values: info,low,medium,high,critical

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

to [required]

\n
\n

int64

\n

Ending time of data analyzed by the job.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

Job type.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

jobName

\n
\n

string

\n

Job name.

\n
\n \n
\n
\n
\n
\n
\n

jobStatus

\n
\n

string

\n

Job status.

\n
\n \n
\n
\n
\n
\n
\n

modifiedAt

\n
\n

string

\n

Last modification time of the job.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

ID of the job.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

Type of payload. \nAllowed enum values: historicalDetectionsJob

\n
\n \n
\n
\n
\n
" }, "400": { "json": { diff --git a/content/en/api/v2/security-monitoring/request.CreateSecurityMonitoringRule_2899714190.json b/content/en/api/v2/security-monitoring/request.CreateSecurityMonitoringRule_2899714190.json new file mode 100644 index 0000000000000..2b7b44191793a --- /dev/null +++ b/content/en/api/v2/security-monitoring/request.CreateSecurityMonitoringRule_2899714190.json @@ -0,0 +1,62 @@ +{ + "name": "Example-Security-Monitoring", + "type": "log_detection", + "isEnabled": true, + "queries": [ + { + "aggregation": "count", + "dataSource": "logs", + "distinctFields": [], + "groupByFields": [], + "hasOptionalGroupByFields": false, + "name": "", + "query": "service:logs-rule-reducer source:paul test2" + }, + { + "aggregation": "count", + "dataSource": "logs", + "distinctFields": [], + "groupByFields": [], + "hasOptionalGroupByFields": false, + "name": "", + "query": "service:logs-rule-reducer source:paul test1" + } + ], + "cases": [ + { + "name": "", + "status": "info", + "notifications": [], + "condition": "step_b > 0" + } + ], + "message": "Logs and signals asdf", + "options": { + "detectionMethod": "sequence_detection", + "evaluationWindow": 0, + "keepAlive": 300, + "maxSignalDuration": 600, + "sequenceDetectionOptions": { + "stepTransitions": [ + { + "child": "step_b", + "evaluationWindow": 900, + "parent": "step_a" + } + ], + "steps": [ + { + "condition": "a > 0", + "evaluationWindow": 60, + "name": "step_a" + }, + { + "condition": "b > 0", + "evaluationWindow": 60, + "name": "step_b" + } + ] + } + }, + "tags": [] +} \ No newline at end of file diff --git a/content/en/api/v2/security-monitoring/request.ValidateSecurityMonitoringRule_4152369508.json b/content/en/api/v2/security-monitoring/request.ValidateSecurityMonitoringRule_4152369508.json new file mode 100644 index 0000000000000..4b1603a56efd2 --- /dev/null +++ b/content/en/api/v2/security-monitoring/request.ValidateSecurityMonitoringRule_4152369508.json @@ -0,0 +1,64 @@ +{ + "cases": [ + { + "name": "", + "status": "info", + "notifications": [], + "condition": "step_b > 0" + } + ], + "hasExtendedTitle": true, + "isEnabled": true, + "message": "My security monitoring rule", + "name": "My security monitoring rule", + "options": { + "evaluationWindow": 0, + "keepAlive": 300, + "maxSignalDuration": 600, + "detectionMethod": "sequence_detection", + "sequenceDetectionOptions": { + "stepTransitions": [ + { + "child": "step_b", + "evaluationWindow": 900, + "parent": "step_a" + } + ], + "steps": [ + { + "condition": "a > 0", + "evaluationWindow": 60, + "name": "step_a" + }, + { + "condition": "b > 0", + "evaluationWindow": 60, + "name": "step_b" + } + ] + } + }, + "queries": [ + { + "query": "source:source_here", + "groupByFields": [ + "@userIdentity.assumed_role" + ], + "distinctFields": [], + "aggregation": "count", + "name": "" + }, + { + "query": "source:source_here2", + "groupByFields": [], + "distinctFields": [], + "aggregation": "count", + "name": "" + } + ], + "tags": [ + "env:prod", + "team:security" + ], + "type": "log_detection" +} \ No newline at end of file diff --git a/data/api/v2/CodeExamples.json b/data/api/v2/CodeExamples.json index 7bb42c20d8996..ff57896aa29bd 100644 --- a/data/api/v2/CodeExamples.json +++ b/data/api/v2/CodeExamples.json @@ -1301,6 +1301,11 @@ "suffix": "", "description": "Create a detection rule returns \"OK\" response" }, + { + "group": "security_monitoring", + "suffix": "_2899714190", + "description": "Create a detection rule with detection method 'sequence_detection' returns \"OK\" response" + }, { "group": "security_monitoring", "suffix": "_3367706049", @@ -1473,6 +1478,11 @@ "group": "security_monitoring", "suffix": "", "description": "Validate a detection rule returns \"OK\" response" + }, + { + "group": "security_monitoring", + "suffix": "_4152369508", + "description": "Validate a detection rule with detection method 'sequence_detection' returns \"OK\" response" } ], "ValidateSecurityMonitoringSuppression": [ diff --git a/data/api/v2/full_spec.yaml b/data/api/v2/full_spec.yaml index f72fd6889931a..435c8ce14ff67 100644 --- a/data/api/v2/full_spec.yaml +++ b/data/api/v2/full_spec.yaml @@ -19541,6 +19541,8 @@ components: $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration' newValueOptions: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions' + sequenceDetectionOptions: + $ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions' thirdPartyRuleOptions: $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions' type: object @@ -39719,6 +39721,7 @@ components: - hardcoded - third_party - anomaly_threshold + - sequence_detection type: string x-enum-varnames: - THRESHOLD @@ -39728,6 +39731,7 @@ components: - HARDCODED - THIRD_PARTY - ANOMALY_THRESHOLD + - SEQUENCE_DETECTION SecurityMonitoringRuleEvaluationWindow: description: 'A time window is specified to match when at least one of the cases matches true. This is a sliding window @@ -39941,6 +39945,8 @@ components: $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration' newValueOptions: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions' + sequenceDetectionOptions: + $ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions' thirdPartyRuleOptions: $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions' type: object @@ -40016,6 +40022,47 @@ components: oneOf: - $ref: '#/components/schemas/SecurityMonitoringStandardRuleResponse' - $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponse' + SecurityMonitoringRuleSequenceDetectionOptions: + description: Options on sequence detection method. + properties: + stepTransitions: + description: Transitions defining the allowed order of steps and their evaluation + windows. + items: + $ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionStepTransition' + type: array + steps: + description: Steps that define the conditions to be matched in sequence. + items: + $ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionStep' + type: array + type: object + SecurityMonitoringRuleSequenceDetectionStep: + description: Step definition for sequence detection containing the step name, + condition, and evaluation window. + properties: + condition: + description: Condition referencing rule queries (e.g., `a > 0`). + type: string + evaluationWindow: + $ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow' + name: + description: Unique name identifying the step. + type: string + type: object + SecurityMonitoringRuleSequenceDetectionStepTransition: + description: Transition from a parent step to a child step within a sequence + detection rule. + properties: + child: + description: Name of the child step. + type: string + evaluationWindow: + $ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow' + parent: + description: Name of the parent step. + type: string + type: object SecurityMonitoringRuleSeverity: description: Severity of the Security Signal. enum: diff --git a/data/api/v2/full_spec_deref.json b/data/api/v2/full_spec_deref.json index 7856fc7811f67..8d04c29094412 100644 --- a/data/api/v2/full_spec_deref.json +++ b/data/api/v2/full_spec_deref.json @@ -122788,7 +122788,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -122798,7 +122799,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -122991,6 +122993,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -123588,7 +123698,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -123598,7 +123709,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -123791,6 +123903,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -124403,7 +124623,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -124413,7 +124634,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -124606,6 +124828,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -125203,7 +125533,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -125213,7 +125544,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -125406,6 +125738,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -128999,7 +129439,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -129009,7 +129450,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -129192,6 +129634,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -129549,7 +130099,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -129559,7 +130110,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -129742,6 +130294,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -130240,7 +130900,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -130250,7 +130911,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -130433,6 +131095,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -130914,7 +131684,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -130924,7 +131695,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -131107,6 +131879,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -169636,7 +170516,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -169646,7 +170527,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -169829,6 +170711,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -181327,7 +182317,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -181337,7 +182328,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -181520,6 +182512,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -272485,7 +273585,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -272495,7 +273596,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -272688,6 +273790,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -273285,7 +274495,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -273295,7 +274506,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -273488,6 +274700,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -274101,7 +275421,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -274111,7 +275432,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -274304,6 +275626,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -274901,7 +276331,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -274911,7 +276342,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -275104,6 +276536,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -277849,7 +279389,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -277859,7 +279400,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -278042,6 +279584,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -278556,7 +280206,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -278566,7 +280217,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -278749,6 +280401,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -279250,7 +281010,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -279260,7 +281021,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -279443,6 +281205,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -288024,7 +289894,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -288034,7 +289905,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -288227,6 +290099,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -288824,7 +290804,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -288834,7 +290815,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -289027,6 +291009,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -289860,7 +291950,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -289870,7 +291961,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -290063,6 +292155,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -290600,7 +292800,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -290610,7 +292811,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -290803,6 +293005,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -291232,7 +293542,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -291242,7 +293553,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -291435,6 +293747,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -291964,7 +294384,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -291974,7 +294395,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -292167,6 +294589,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -292548,7 +295078,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -292558,7 +295089,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "SecurityMonitoringRuleEvaluationWindow": { @@ -292879,7 +295411,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -292889,7 +295422,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -293082,6 +295616,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -293768,7 +296410,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -293778,7 +296421,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -293971,6 +296615,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -294568,7 +297320,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -294578,7 +297331,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -294771,6 +297525,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -294953,6 +297815,208 @@ } ] }, + "SecurityMonitoringRuleSequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, + "SecurityMonitoringRuleSequenceDetectionStep": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "SecurityMonitoringRuleSequenceDetectionStepTransition": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, "SecurityMonitoringRuleSeverity": { "description": "Severity of the Security Signal.", "enum": [ @@ -295224,7 +298288,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -295234,7 +298299,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -295427,6 +298493,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -295993,7 +299167,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -296003,7 +299178,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -296196,6 +299372,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -296984,7 +300268,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -296994,7 +300279,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -297187,6 +300473,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -297825,7 +301219,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -297835,7 +301230,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -298028,6 +301424,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -298565,7 +302069,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -298575,7 +302080,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -298768,6 +302274,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -299997,7 +303611,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -300007,7 +303622,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -300200,6 +303816,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -300587,7 +304311,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -300597,7 +304322,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -300790,6 +304516,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -301279,7 +305113,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -301289,7 +305124,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -301482,6 +305318,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -303005,7 +306949,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -303015,7 +306960,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -303208,6 +307154,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -303780,7 +307834,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -303790,7 +307845,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -303983,6 +308039,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -304743,7 +308907,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -304753,7 +308918,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -304946,6 +309112,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -305532,7 +309806,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -305542,7 +309817,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -305735,6 +310011,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -614208,7 +618592,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -614218,7 +618603,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -614411,6 +618797,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -614940,7 +619434,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -614950,7 +619445,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -615143,6 +619639,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -617419,7 +622023,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -617429,7 +622034,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -617622,6 +622228,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -618219,7 +622933,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -618229,7 +622944,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -618422,6 +623138,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -618979,7 +623803,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -618989,7 +623814,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -619182,6 +624008,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -619711,7 +624645,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -619721,7 +624656,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -619914,6 +624850,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -620630,7 +625674,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -620640,7 +625685,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -620833,6 +625879,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -621430,7 +626584,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -621440,7 +626595,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -621633,6 +626789,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -622244,7 +627508,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -622254,7 +627519,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -622447,6 +627713,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -622984,7 +628358,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -622994,7 +628369,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -623187,6 +628563,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -623807,7 +629291,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -623817,7 +629302,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -624010,6 +629496,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -624839,7 +630433,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -624849,7 +630444,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -625042,6 +630638,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -625579,7 +631283,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -625589,7 +631294,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -625782,6 +631488,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -626767,7 +632581,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -626777,7 +632592,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -626970,6 +632786,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -627567,7 +633491,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -627577,7 +633502,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -627770,6 +633696,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -628357,7 +634391,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -628367,7 +634402,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -628560,6 +634596,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -629287,7 +635431,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -629297,7 +635442,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -629490,6 +635636,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -630087,7 +636341,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -630097,7 +636352,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -630290,6 +636546,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -631091,7 +637455,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -631101,7 +637466,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -631294,6 +637660,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -632293,7 +638767,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -632303,7 +638778,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -632496,6 +638972,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -633093,7 +639677,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -633103,7 +639688,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -633296,6 +639882,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -652103,7 +658797,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -652113,7 +658808,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -652296,6 +658992,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -652960,7 +659764,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -652970,7 +659775,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -653153,6 +659959,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -654341,7 +661255,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -654351,7 +661266,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -654534,6 +661450,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { diff --git a/static/resources/json/full_spec_v2.json b/static/resources/json/full_spec_v2.json index 7856fc7811f67..8d04c29094412 100644 --- a/static/resources/json/full_spec_v2.json +++ b/static/resources/json/full_spec_v2.json @@ -122788,7 +122788,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -122798,7 +122799,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -122991,6 +122993,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -123588,7 +123698,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -123598,7 +123709,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -123791,6 +123903,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -124403,7 +124623,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -124413,7 +124634,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -124606,6 +124828,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -125203,7 +125533,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -125213,7 +125544,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -125406,6 +125738,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -128999,7 +129439,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -129009,7 +129450,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -129192,6 +129634,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -129549,7 +130099,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -129559,7 +130110,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -129742,6 +130294,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -130240,7 +130900,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -130250,7 +130911,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -130433,6 +131095,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -130914,7 +131684,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -130924,7 +131695,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -131107,6 +131879,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -169636,7 +170516,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -169646,7 +170527,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -169829,6 +170711,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -181327,7 +182317,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -181337,7 +182328,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -181520,6 +182512,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -272485,7 +273585,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -272495,7 +273596,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -272688,6 +273790,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -273285,7 +274495,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -273295,7 +274506,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -273488,6 +274700,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -274101,7 +275421,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -274111,7 +275432,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -274304,6 +275626,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -274901,7 +276331,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -274911,7 +276342,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -275104,6 +276536,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -277849,7 +279389,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -277859,7 +279400,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -278042,6 +279584,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -278556,7 +280206,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -278566,7 +280217,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -278749,6 +280401,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -279250,7 +281010,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -279260,7 +281021,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -279443,6 +281205,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -288024,7 +289894,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -288034,7 +289905,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -288227,6 +290099,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -288824,7 +290804,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -288834,7 +290815,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -289027,6 +291009,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -289860,7 +291950,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -289870,7 +291961,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -290063,6 +292155,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -290600,7 +292800,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -290610,7 +292811,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -290803,6 +293005,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -291232,7 +293542,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -291242,7 +293553,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -291435,6 +293747,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -291964,7 +294384,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -291974,7 +294395,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -292167,6 +294589,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -292548,7 +295078,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -292558,7 +295089,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "SecurityMonitoringRuleEvaluationWindow": { @@ -292879,7 +295411,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -292889,7 +295422,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -293082,6 +295616,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -293768,7 +296410,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -293778,7 +296421,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -293971,6 +296615,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -294568,7 +297320,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -294578,7 +297331,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -294771,6 +297525,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -294953,6 +297815,208 @@ } ] }, + "SecurityMonitoringRuleSequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, + "SecurityMonitoringRuleSequenceDetectionStep": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "SecurityMonitoringRuleSequenceDetectionStepTransition": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, "SecurityMonitoringRuleSeverity": { "description": "Severity of the Security Signal.", "enum": [ @@ -295224,7 +298288,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -295234,7 +298299,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -295427,6 +298493,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -295993,7 +299167,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -296003,7 +299178,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -296196,6 +299372,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -296984,7 +300268,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -296994,7 +300279,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -297187,6 +300473,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -297825,7 +301219,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -297835,7 +301230,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -298028,6 +301424,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -298565,7 +302069,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -298575,7 +302080,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -298768,6 +302274,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -299997,7 +303611,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -300007,7 +303622,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -300200,6 +303816,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -300587,7 +304311,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -300597,7 +304322,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -300790,6 +304516,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -301279,7 +305113,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -301289,7 +305124,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -301482,6 +305318,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -303005,7 +306949,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -303015,7 +306960,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -303208,6 +307154,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -303780,7 +307834,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -303790,7 +307845,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -303983,6 +308039,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -304743,7 +308907,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -304753,7 +308918,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -304946,6 +309112,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -305532,7 +309806,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -305542,7 +309817,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -305735,6 +310011,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -614208,7 +618592,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -614218,7 +618603,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -614411,6 +618797,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -614940,7 +619434,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -614950,7 +619445,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -615143,6 +619639,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -617419,7 +622023,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -617429,7 +622034,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -617622,6 +622228,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -618219,7 +622933,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -618229,7 +622944,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -618422,6 +623138,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -618979,7 +623803,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -618989,7 +623814,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -619182,6 +624008,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -619711,7 +624645,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -619721,7 +624656,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -619914,6 +624850,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -620630,7 +625674,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -620640,7 +625685,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -620833,6 +625879,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -621430,7 +626584,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -621440,7 +626595,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -621633,6 +626789,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -622244,7 +627508,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -622254,7 +627519,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -622447,6 +627713,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -622984,7 +628358,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -622994,7 +628369,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -623187,6 +628563,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -623807,7 +629291,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -623817,7 +629302,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -624010,6 +629496,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -624839,7 +630433,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -624849,7 +630444,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -625042,6 +630638,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -625579,7 +631283,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -625589,7 +631294,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -625782,6 +631488,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -626767,7 +632581,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -626777,7 +632592,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -626970,6 +632786,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -627567,7 +633491,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -627577,7 +633502,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -627770,6 +633696,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -628357,7 +634391,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -628367,7 +634402,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -628560,6 +634596,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -629287,7 +635431,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -629297,7 +635442,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -629490,6 +635636,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -630087,7 +636341,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -630097,7 +636352,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -630290,6 +636546,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -631091,7 +637455,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -631101,7 +637466,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -631294,6 +637660,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -632293,7 +638767,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -632303,7 +638778,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -632496,6 +638972,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -633093,7 +639677,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -633103,7 +639688,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -633296,6 +639882,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -652103,7 +658797,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -652113,7 +658808,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -652296,6 +658992,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -652960,7 +659764,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -652970,7 +659775,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -653153,6 +659959,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": { @@ -654341,7 +661255,8 @@ "impossible_travel", "hardcoded", "third_party", - "anomaly_threshold" + "anomaly_threshold", + "sequence_detection" ], "type": "string", "x-enum-varnames": [ @@ -654351,7 +661266,8 @@ "IMPOSSIBLE_TRAVEL", "HARDCODED", "THIRD_PARTY", - "ANOMALY_THRESHOLD" + "ANOMALY_THRESHOLD", + "SEQUENCE_DETECTION" ] }, "evaluationWindow": { @@ -654534,6 +661450,114 @@ }, "type": "object" }, + "sequenceDetectionOptions": { + "description": "Options on sequence detection method.", + "properties": { + "stepTransitions": { + "description": "Transitions defining the allowed order of steps and their evaluation windows.", + "items": { + "description": "Transition from a parent step to a child step within a sequence detection rule.", + "properties": { + "child": { + "description": "Name of the child step.", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "parent": { + "description": "Name of the parent step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "steps": { + "description": "Steps that define the conditions to be matched in sequence.", + "items": { + "description": "Step definition for sequence detection containing the step name, condition, and evaluation window.", + "properties": { + "condition": { + "description": "Condition referencing rule queries (e.g., `a > 0`).", + "type": "string" + }, + "evaluationWindow": { + "description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used.", + "enum": [ + 0, + 60, + 300, + 600, + 900, + 1800, + 3600, + 7200, + 10800, + 21600, + 43200, + 86400 + ], + "format": "int32", + "type": "integer", + "x-enum-varnames": [ + "ZERO_MINUTES", + "ONE_MINUTE", + "FIVE_MINUTES", + "TEN_MINUTES", + "FIFTEEN_MINUTES", + "THIRTY_MINUTES", + "ONE_HOUR", + "TWO_HOURS", + "THREE_HOURS", + "SIX_HOURS", + "TWELVE_HOURS", + "ONE_DAY" + ] + }, + "name": { + "description": "Unique name identifying the step.", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, "thirdPartyRuleOptions": { "description": "Options on third party detection method.", "properties": {