@@ -15657,6 +15657,15 @@ components:
1565715657 example: 1729843470000
1565815658 format: int64
1565915659 type: integer
15660+ groupSignalsBy:
15661+ description: Additional grouping to perform on top of the existing groups
15662+ in the query section. Must be a subset of the existing groups
15663+ example:
15664+ - service
15665+ items:
15666+ description: Field to group by.
15667+ type: string
15668+ type: array
1566015669 index:
1566115670 description: Index used to load the data.
1566215671 example: cloud_siem
@@ -23184,16 +23193,15 @@ components:
2318423193 x-enum-varnames:
2318523194 - RULE
2318623195 RuleTypes:
23187- description: Security rule types used to filter signals and vulnerabilities
23188- generating notifications.
23196+ description: Security rule types used as filters in security rules.
2318923197 example:
2319023198 - misconfiguration
2319123199 - attack_path
2319223200 items:
2319323201 $ref: '#/components/schemas/RuleTypesItems'
2319423202 type: array
2319523203 RuleTypesItems:
23196- description: 'Security rule types which can be used in notification rules.
23204+ description: 'Security rule type which can be used in security rules.
2319723205
2319823206 Signal-based notification rules can filter signals based on rule types application_security,
2319923207 log_detection,
@@ -24243,6 +24251,11 @@ components:
2424324251 SecurityMonitoringRuleCase:
2424424252 description: Case when signal is generated.
2424524253 properties:
24254+ actions:
24255+ description: Action to perform for each rule case.
24256+ items:
24257+ $ref: '#/components/schemas/SecurityMonitoringRuleCaseAction'
24258+ type: array
2424624259 condition:
2424724260 description: 'A rule case contains logical operations (`>`,`>=`, `&&`, `||`)
2424824261 to determine if a signal should be generated
@@ -24261,9 +24274,42 @@ components:
2426124274 status:
2426224275 $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
2426324276 type: object
24277+ SecurityMonitoringRuleCaseAction:
24278+ description: Action to perform when a signals trigger. Only available for Application
24279+ Security rule type
24280+ properties:
24281+ options:
24282+ $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptions'
24283+ type:
24284+ $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionType'
24285+ type: object
24286+ SecurityMonitoringRuleCaseActionOptions:
24287+ description: Options for the rule action
24288+ properties:
24289+ duration:
24290+ description: Duration of the action in seconds. 0 means no expiration
24291+ example: 0
24292+ format: int64
24293+ minimum: 0
24294+ type: integer
24295+ type: object
24296+ SecurityMonitoringRuleCaseActionType:
24297+ description: Type of the action
24298+ enum:
24299+ - block_ip
24300+ - block_user
24301+ type: string
24302+ x-enum-varnames:
24303+ - BLOCK_IP
24304+ - BLOCK_USER
2426424305 SecurityMonitoringRuleCaseCreate:
2426524306 description: Case when signal is generated.
2426624307 properties:
24308+ actions:
24309+ description: Action to perform for each rule case.
24310+ items:
24311+ $ref: '#/components/schemas/SecurityMonitoringRuleCaseAction'
24312+ type: array
2426724313 condition:
2426824314 description: 'A case contains logical operations (`>`,`>=`, `&&`, `||`)
2426924315 to determine if a signal should be generated
@@ -24725,6 +24771,15 @@ components:
2472524771 items:
2472624772 $ref: '#/components/schemas/SecurityMonitoringFilter'
2472724773 type: array
24774+ groupSignalsBy:
24775+ description: Additional grouping to perform on top of the existing groups
24776+ in the query section. Must be a subset of the existing groups
24777+ example:
24778+ - service
24779+ items:
24780+ description: Field to group by.
24781+ type: string
24782+ type: array
2472824783 hasExtendedTitle:
2472924784 description: Whether the notifications include the triggering group-by values
2473024785 in their title.
@@ -25430,6 +25485,15 @@ components:
2543025485 items:
2543125486 $ref: '#/components/schemas/SecurityMonitoringFilter'
2543225487 type: array
25488+ groupSignalsBy:
25489+ description: Additional grouping to perform on top of the existing groups
25490+ in the query section. Must be a subset of the existing groups
25491+ example:
25492+ - service
25493+ items:
25494+ description: Field to group by.
25495+ type: string
25496+ type: array
2543325497 hasExtendedTitle:
2543425498 description: Whether the notifications include the triggering group-by values
2543525499 in their title.
@@ -25502,6 +25566,15 @@ components:
2550225566 items:
2550325567 $ref: '#/components/schemas/SecurityMonitoringFilter'
2550425568 type: array
25569+ groupSignalsBy:
25570+ description: Additional grouping to perform on top of the existing groups
25571+ in the query section. Must be a subset of the existing groups
25572+ example:
25573+ - service
25574+ items:
25575+ description: Field to group by.
25576+ type: string
25577+ type: array
2550525578 hasExtendedTitle:
2550625579 description: Whether the notifications include the triggering group-by values
2550725580 in their title.
@@ -25643,6 +25716,15 @@ components:
2564325716 items:
2564425717 $ref: '#/components/schemas/SecurityMonitoringFilter'
2564525718 type: array
25719+ groupSignalsBy:
25720+ description: Additional grouping to perform on top of the existing groups
25721+ in the query section. Must be a subset of the existing groups
25722+ example:
25723+ - service
25724+ items:
25725+ description: Field to group by.
25726+ type: string
25727+ type: array
2564625728 hasExtendedTitle:
2564725729 description: Whether the notifications include the triggering group-by values
2564825730 in their title.
@@ -25720,6 +25802,15 @@ components:
2572025802 items:
2572125803 $ref: '#/components/schemas/SecurityMonitoringFilter'
2572225804 type: array
25805+ groupSignalsBy:
25806+ description: Additional grouping to perform on top of the existing groups
25807+ in the query section. Must be a subset of the existing groups
25808+ example:
25809+ - service
25810+ items:
25811+ description: Field to group by.
25812+ type: string
25813+ type: array
2572325814 hasExtendedTitle:
2572425815 description: Whether the notifications include the triggering group-by values
2572525816 in their title.
@@ -44078,7 +44169,7 @@ paths:
4407844169 appKeyAuth: []
4407944170 - AuthZ:
4408044171 - security_monitoring_notification_profiles_read
44081- summary: Get the list of signal-based rules
44172+ summary: Get the list of signal-based notification rules
4408244173 tags:
4408344174 - Security Monitoring
4408444175 x-permission:
@@ -44120,7 +44211,7 @@ paths:
4412044211 appKeyAuth: []
4412144212 - AuthZ:
4412244213 - security_monitoring_notification_profiles_write
44123- summary: Create a new signal-based rule
44214+ summary: Create a new signal-based notification rule
4412444215 tags:
4412544216 - Security Monitoring
4412644217 x-codegen-request-body-name: body
@@ -44153,7 +44244,7 @@ paths:
4415344244 appKeyAuth: []
4415444245 - AuthZ:
4415544246 - security_monitoring_notification_profiles_write
44156- summary: Delete a signal-based rule
44247+ summary: Delete a signal-based notification rule
4415744248 tags:
4415844249 - Security Monitoring
4415944250 x-permission:
@@ -44190,7 +44281,7 @@ paths:
4419044281 appKeyAuth: []
4419144282 - AuthZ:
4419244283 - security_monitoring_notification_profiles_read
44193- summary: Get details of a signal-based rule
44284+ summary: Get details of a signal-based notification rule
4419444285 tags:
4419544286 - Security Monitoring
4419644287 x-permission:
@@ -44236,7 +44327,7 @@ paths:
4423644327 appKeyAuth: []
4423744328 - AuthZ:
4423844329 - security_monitoring_notification_profiles_write
44239- summary: Patch a signal-based rule
44330+ summary: Patch a signal-based notification rule
4424044331 tags:
4424144332 - Security Monitoring
4424244333 x-codegen-request-body-name: body
@@ -44636,7 +44727,7 @@ paths:
4463644727 appKeyAuth: []
4463744728 - AuthZ:
4463844729 - security_monitoring_notification_profiles_read
44639- summary: Get the list of vulnerability-based rules
44730+ summary: Get the list of vulnerability notification rules
4464044731 tags:
4464144732 - Security Monitoring
4464244733 x-permission:
@@ -44678,7 +44769,7 @@ paths:
4467844769 appKeyAuth: []
4467944770 - AuthZ:
4468044771 - security_monitoring_notification_profiles_write
44681- summary: Create a new vulnerability-based rule
44772+ summary: Create a new vulnerability-based notification rule
4468244773 tags:
4468344774 - Security Monitoring
4468444775 x-codegen-request-body-name: body
@@ -44711,7 +44802,7 @@ paths:
4471144802 appKeyAuth: []
4471244803 - AuthZ:
4471344804 - security_monitoring_notification_profiles_write
44714- summary: Delete a vulnerability-based rule
44805+ summary: Delete a vulnerability-based notification rule
4471544806 tags:
4471644807 - Security Monitoring
4471744808 x-permission:
@@ -44748,7 +44839,7 @@ paths:
4474844839 appKeyAuth: []
4474944840 - AuthZ:
4475044841 - security_monitoring_notification_profiles_read
44751- summary: Get details of a vulnerability-based rule
44842+ summary: Get details of a vulnerability notification rule
4475244843 tags:
4475344844 - Security Monitoring
4475444845 x-permission:
@@ -44794,7 +44885,7 @@ paths:
4479444885 appKeyAuth: []
4479544886 - AuthZ:
4479644887 - security_monitoring_notification_profiles_write
44797- summary: Patch a vulnerability-based rule
44888+ summary: Patch a vulnerability-based notification rule
4479844889 tags:
4479944890 - Security Monitoring
4480044891 x-codegen-request-body-name: body
0 commit comments