Skip to content

Rename historical job API endpoints to threat hunting #2912

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Rename historical job API endpoints to threat hunting #2912

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
399 changes: 200 additions & 199 deletions .generator/schemas/v2/openapi.yaml
View file
Open in desktop

Large diffs are not rendered by default.

136 changes: 68 additions & 68 deletions docs/datadog_api_client.v2.model.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9195,55 +9195,6 @@ datadog\_api\_client.v2.model.group\_tags module
:members:
:show-inheritance:

datadog\_api\_client.v2.model.historical\_job\_data\_type module
----------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.historical_job_data_type
:members:
:show-inheritance:

datadog\_api\_client.v2.model.historical\_job\_list\_meta module
----------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.historical_job_list_meta
:members:
:show-inheritance:

datadog\_api\_client.v2.model.historical\_job\_options module
-------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.historical_job_options
:members:
:show-inheritance:

datadog\_api\_client.v2.model.historical\_job\_query module
-----------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.historical_job_query
:members:
:show-inheritance:

datadog\_api\_client.v2.model.historical\_job\_response module
--------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.historical_job_response
:members:
:show-inheritance:

datadog\_api\_client.v2.model.historical\_job\_response\_attributes module
--------------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.historical_job_response_attributes
:members:
:show-inheritance:

datadog\_api\_client.v2.model.historical\_job\_response\_data module
--------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.historical_job_response_data
:members:
:show-inheritance:

datadog\_api\_client.v2.model.hourly\_usage module
--------------------------------------------------

Expand Down Expand Up @@ -11617,13 +11568,6 @@ datadog\_api\_client.v2.model.list\_findings\_response module
:members:
:show-inheritance:

datadog\_api\_client.v2.model.list\_historical\_jobs\_response module
---------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.list_historical_jobs_response
:members:
:show-inheritance:

datadog\_api\_client.v2.model.list\_kind\_catalog\_response module
------------------------------------------------------------------

Expand Down Expand Up @@ -11722,6 +11666,13 @@ datadog\_api\_client.v2.model.list\_teams\_sort module
:members:
:show-inheritance:

datadog\_api\_client.v2.model.list\_threat\_hunting\_jobs\_response module
--------------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.list_threat_hunting_jobs_response
:members:
:show-inheritance:

datadog\_api\_client.v2.model.list\_vulnerabilities\_response module
--------------------------------------------------------------------

Expand Down Expand Up @@ -18281,31 +18232,31 @@ datadog\_api\_client.v2.model.rum\_warning module
:members:
:show-inheritance:

datadog\_api\_client.v2.model.run\_historical\_job\_request module
------------------------------------------------------------------
datadog\_api\_client.v2.model.run\_threat\_hunting\_job\_request module
-----------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.run_historical_job_request
.. automodule:: datadog_api_client.v2.model.run_threat_hunting_job_request
:members:
:show-inheritance:

datadog\_api\_client.v2.model.run\_historical\_job\_request\_attributes module
------------------------------------------------------------------------------
datadog\_api\_client.v2.model.run\_threat\_hunting\_job\_request\_attributes module
-----------------------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.run_historical_job_request_attributes
.. automodule:: datadog_api_client.v2.model.run_threat_hunting_job_request_attributes
:members:
:show-inheritance:

datadog\_api\_client.v2.model.run\_historical\_job\_request\_data module
------------------------------------------------------------------------
datadog\_api\_client.v2.model.run\_threat\_hunting\_job\_request\_data module
-----------------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.run_historical_job_request_data
.. automodule:: datadog_api_client.v2.model.run_threat_hunting_job_request_data
:members:
:show-inheritance:

datadog\_api\_client.v2.model.run\_historical\_job\_request\_data\_type module
------------------------------------------------------------------------------
datadog\_api\_client.v2.model.run\_threat\_hunting\_job\_request\_data\_type module
-----------------------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.run_historical_job_request_data_type
.. automodule:: datadog_api_client.v2.model.run_threat_hunting_job_request_data_type
:members:
:show-inheritance:

Expand Down Expand Up @@ -22047,6 +21998,55 @@ datadog\_api\_client.v2.model.teams\_response\_meta\_pagination module
:members:
:show-inheritance:

datadog\_api\_client.v2.model.threat\_hunting\_job\_data\_type module
---------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.threat_hunting_job_data_type
:members:
:show-inheritance:

datadog\_api\_client.v2.model.threat\_hunting\_job\_list\_meta module
---------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.threat_hunting_job_list_meta
:members:
:show-inheritance:

datadog\_api\_client.v2.model.threat\_hunting\_job\_options module
------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.threat_hunting_job_options
:members:
:show-inheritance:

datadog\_api\_client.v2.model.threat\_hunting\_job\_query module
----------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.threat_hunting_job_query
:members:
:show-inheritance:

datadog\_api\_client.v2.model.threat\_hunting\_job\_response module
-------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.threat_hunting_job_response
:members:
:show-inheritance:

datadog\_api\_client.v2.model.threat\_hunting\_job\_response\_attributes module
-------------------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.threat_hunting_job_response_attributes
:members:
:show-inheritance:

datadog\_api\_client.v2.model.threat\_hunting\_job\_response\_data module
-------------------------------------------------------------------------

.. automodule:: datadog_api_client.v2.model.threat_hunting_job_response_data
:members:
:show-inheritance:

datadog\_api\_client.v2.model.time\_restriction module
------------------------------------------------------

Expand Down
14 changes: 14 additions & 0 deletions examples/v2/security-monitoring/CancelThreatHuntingJob.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
"""
Cancel a threat hunting job returns "OK" response
"""

from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi

configuration = Configuration()
configuration.unstable_operations["cancel_threat_hunting_job"] = True
with ApiClient(configuration) as api_client:
api_instance = SecurityMonitoringApi(api_client)
api_instance.cancel_threat_hunting_job(
job_id="job_id",
)
12 changes: 6 additions & 6 deletions ...ecurity-monitoring/CancelHistoricalJob.py → ...ring/CancelThreatHuntingJob_1945505845.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,14 @@
from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi

# there is a valid "historical_job" in the system
HISTORICAL_JOB_DATA_ID = environ["HISTORICAL_JOB_DATA_ID"]
# there is a valid "threat_hunting_job" in the system
THREAT_HUNTING_JOB_DATA_ID = environ["THREAT_HUNTING_JOB_DATA_ID"]

configuration = Configuration()
configuration.unstable_operations["cancel_historical_job"] = True
configuration.unstable_operations["run_historical_job"] = True
configuration.unstable_operations["cancel_threat_hunting_job"] = True
configuration.unstable_operations["run_threat_hunting_job"] = True
with ApiClient(configuration) as api_client:
api_instance = SecurityMonitoringApi(api_client)
api_instance.cancel_historical_job(
job_id=HISTORICAL_JOB_DATA_ID,
api_instance.cancel_threat_hunting_job(
job_id=THREAT_HUNTING_JOB_DATA_ID,
)
4 changes: 2 additions & 2 deletions ...ecurity-monitoring/DeleteHistoricalJob.py → ...rity-monitoring/DeleteThreatHuntingJob.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,9 @@
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi

configuration = Configuration()
configuration.unstable_operations["delete_historical_job"] = True
configuration.unstable_operations["delete_threat_hunting_job"] = True
with ApiClient(configuration) as api_client:
api_instance = SecurityMonitoringApi(api_client)
api_instance.delete_historical_job(
api_instance.delete_threat_hunting_job(
job_id="job_id",
)
12 changes: 6 additions & 6 deletions ...2/security-monitoring/GetHistoricalJob.py → ...ecurity-monitoring/GetThreatHuntingJob.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,16 +6,16 @@
from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi

# there is a valid "historical_job" in the system
HISTORICAL_JOB_DATA_ID = environ["HISTORICAL_JOB_DATA_ID"]
# there is a valid "threat_hunting_job" in the system
THREAT_HUNTING_JOB_DATA_ID = environ["THREAT_HUNTING_JOB_DATA_ID"]

configuration = Configuration()
configuration.unstable_operations["get_historical_job"] = True
configuration.unstable_operations["run_historical_job"] = True
configuration.unstable_operations["get_threat_hunting_job"] = True
configuration.unstable_operations["run_threat_hunting_job"] = True
with ApiClient(configuration) as api_client:
api_instance = SecurityMonitoringApi(api_client)
response = api_instance.get_historical_job(
job_id=HISTORICAL_JOB_DATA_ID,
response = api_instance.get_threat_hunting_job(
job_id=THREAT_HUNTING_JOB_DATA_ID,
)

print(response)
14 changes: 14 additions & 0 deletions examples/v2/security-monitoring/ListThreatHuntingJobs.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
"""
List threat hunting jobs returns "OK" response
"""

from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi

configuration = Configuration()
configuration.unstable_operations["list_threat_hunting_jobs"] = True
with ApiClient(configuration) as api_client:
api_instance = SecurityMonitoringApi(api_client)
response = api_instance.list_threat_hunting_jobs()

print(response)
10 changes: 5 additions & 5 deletions ...security-monitoring/ListHistoricalJobs.py → ...oring/ListThreatHuntingJobs_1365512061.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,15 @@
from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi

# there is a valid "historical_job" in the system
HISTORICAL_JOB_DATA_ID = environ["HISTORICAL_JOB_DATA_ID"]
# there is a valid "threat_hunting_job" in the system
THREAT_HUNTING_JOB_DATA_ID = environ["THREAT_HUNTING_JOB_DATA_ID"]

configuration = Configuration()
configuration.unstable_operations["list_historical_jobs"] = True
configuration.unstable_operations["run_historical_job"] = True
configuration.unstable_operations["list_threat_hunting_jobs"] = True
configuration.unstable_operations["run_threat_hunting_job"] = True
with ApiClient(configuration) as api_client:
api_instance = SecurityMonitoringApi(api_client)
response = api_instance.list_historical_jobs(
response = api_instance.list_threat_hunting_jobs(
filter_query="id:string",
)

Expand Down
30 changes: 15 additions & 15 deletions ...2/security-monitoring/RunHistoricalJob.py → ...ecurity-monitoring/RunThreatHuntingJob.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,14 @@
"""
Run a historical job returns "Status created" response
Run a threat hunting job returns "Status created" response
"""

from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
from datadog_api_client.v2.model.historical_job_options import HistoricalJobOptions
from datadog_api_client.v2.model.historical_job_query import HistoricalJobQuery
from datadog_api_client.v2.model.job_definition import JobDefinition
from datadog_api_client.v2.model.run_historical_job_request import RunHistoricalJobRequest
from datadog_api_client.v2.model.run_historical_job_request_attributes import RunHistoricalJobRequestAttributes
from datadog_api_client.v2.model.run_historical_job_request_data import RunHistoricalJobRequestData
from datadog_api_client.v2.model.run_historical_job_request_data_type import RunHistoricalJobRequestDataType
from datadog_api_client.v2.model.run_threat_hunting_job_request import RunThreatHuntingJobRequest
from datadog_api_client.v2.model.run_threat_hunting_job_request_attributes import RunThreatHuntingJobRequestAttributes
from datadog_api_client.v2.model.run_threat_hunting_job_request_data import RunThreatHuntingJobRequestData
from datadog_api_client.v2.model.run_threat_hunting_job_request_data_type import RunThreatHuntingJobRequestDataType
from datadog_api_client.v2.model.security_monitoring_rule_case_create import SecurityMonitoringRuleCaseCreate
from datadog_api_client.v2.model.security_monitoring_rule_evaluation_window import (
SecurityMonitoringRuleEvaluationWindow,
Expand All @@ -23,16 +21,18 @@
SecurityMonitoringRuleQueryAggregation,
)
from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity
from datadog_api_client.v2.model.threat_hunting_job_options import ThreatHuntingJobOptions
from datadog_api_client.v2.model.threat_hunting_job_query import ThreatHuntingJobQuery

body = RunHistoricalJobRequest(
data=RunHistoricalJobRequestData(
type=RunHistoricalJobRequestDataType.HISTORICALDETECTIONSJOBCREATE,
attributes=RunHistoricalJobRequestAttributes(
body = RunThreatHuntingJobRequest(
data=RunThreatHuntingJobRequestData(
type=RunThreatHuntingJobRequestDataType.HISTORICALDETECTIONSJOBCREATE,
attributes=RunThreatHuntingJobRequestAttributes(
job_definition=JobDefinition(
type="log_detection",
name="Excessive number of failed attempts.",
queries=[
HistoricalJobQuery(
ThreatHuntingJobQuery(
query="source:non_existing_src_weekend",
aggregation=SecurityMonitoringRuleQueryAggregation.COUNT,
group_by_fields=[],
Expand All @@ -47,7 +47,7 @@
condition="a > 1",
),
],
options=HistoricalJobOptions(
options=ThreatHuntingJobOptions(
keep_alive=SecurityMonitoringRuleKeepAlive.ONE_HOUR,
max_signal_duration=SecurityMonitoringRuleMaxSignalDuration.ONE_DAY,
evaluation_window=SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES,
Expand All @@ -63,9 +63,9 @@
)

configuration = Configuration()
configuration.unstable_operations["run_historical_job"] = True
configuration.unstable_operations["run_threat_hunting_job"] = True
with ApiClient(configuration) as api_client:
api_instance = SecurityMonitoringApi(api_client)
response = api_instance.run_historical_job(body=body)
response = api_instance.run_threat_hunting_job(body=body)

print(response)
10 changes: 5 additions & 5 deletions src/datadog_api_client/configuration.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -245,24 +245,24 @@ def __init__(
"v2.get_open_api": False,
"v2.list_apis": False,
"v2.update_open_api": False,
"v2.cancel_historical_job": False,
"v2.cancel_threat_hunting_job": False,
"v2.convert_job_result_to_signal": False,
"v2.delete_historical_job": False,
"v2.delete_threat_hunting_job": False,
"v2.get_finding": False,
"v2.get_historical_job": False,
"v2.get_rule_version_history": False,
"v2.get_sbom": False,
"v2.get_security_monitoring_histsignal": False,
"v2.get_security_monitoring_histsignals_by_job_id": False,
"v2.get_threat_hunting_job": False,
"v2.list_assets_sbo_ms": False,
"v2.list_findings": False,
"v2.list_historical_jobs": False,
"v2.list_scanned_assets_metadata": False,
"v2.list_security_monitoring_histsignals": False,
"v2.list_threat_hunting_jobs": False,
"v2.list_vulnerabilities": False,
"v2.list_vulnerable_assets": False,
"v2.mute_findings": False,
"v2.run_historical_job": False,
"v2.run_threat_hunting_job": False,
"v2.search_security_monitoring_histsignals": False,
"v2.create_dataset": False,
"v2.delete_dataset": False,
Expand Down
Loading