重大度修飾子ルールを更新してください

Note: This endpoint is in Preview and is subject to change. If you have any feedback, contact Datadog support.

PUT https://api.ap1.datadoghq.com/api/v2/security/findings/automation/severity_modifier_rules/{rule_id}https://api.ap2.datadoghq.com/api/v2/security/findings/automation/severity_modifier_rules/{rule_id}https://api.datadoghq.eu/api/v2/security/findings/automation/severity_modifier_rules/{rule_id}https://api.ddog-gov.com/api/v2/security/findings/automation/severity_modifier_rules/{rule_id}https://api.us2.ddog-gov.com/api/v2/security/findings/automation/severity_modifier_rules/{rule_id}https://api.uk1.datadoghq.com/api/v2/security/findings/automation/severity_modifier_rules/{rule_id}https://api.datadoghq.com/api/v2/security/findings/automation/severity_modifier_rules/{rule_id}https://api.us3.datadoghq.com/api/v2/security/findings/automation/severity_modifier_rules/{rule_id}https://api.us5.datadoghq.com/api/v2/security/findings/automation/severity_modifier_rules/{rule_id}

概要

Update a severity modifier rule by ID. This endpoint requires the security_pipelines_write permission.

引数

パスパラメーター

名前

タイプ

説明

rule_id [required]

string

The ID of the severity modifier rule.

リクエスト

Body Data (required)

Expand All

フィールド

タイプ

説明

data [required]

object

The data object for a severity modifier rule create or update request.

attributes [required]

object

Attributes for creating or updating a severity modifier rule.

action [required]

 <oneOf>

The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one rank.

A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace.

Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.

<type=set>

object

Sets matched findings to a fixed severity.

description

string

An optional free-form explanation for the severity change.

severity [required]

enum

The severity to assign to matched findings. info_none is not supported for the iac_misconfiguration, runtime_code_vulnerability, secret, or static_code_vulnerability finding types. Allowed enum values: info_none,low,medium,high,critical

type [required]

enum

The type of a severity modifier rule action that sets a fixed severity. Allowed enum values: set

<type=shift>

object

Shifts matched findings up or down by one severity rank.

description

string

An optional free-form explanation for the severity change.

severity_delta [required]

enum

The direction in which to shift the severity of matched findings by one rank. Allowed enum values: up_one,down_one

type [required]

enum

The type of a severity modifier rule action that shifts the severity by one rank. Allowed enum values: shift

enabled

boolean

Whether the severity modifier rule is enabled.

name [required]

string

The name of the severity modifier rule.

rule [required]

object

Defines the scope of findings to which the automation rule applies.

finding_types [required]

[string]

The list of security finding types that the automation rule applies to.

query

string

A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.

type [required]

enum

The JSON:API type for severity modifier rules. Allowed enum values: severity_modifier_rules

{
  "data": {
    "attributes": {
      "action": {
        "description": "Lower severity for dev environment noise",
        "severity": "low",
        "type": "set"
      },
      "enabled": true,
      "name": "Downgrade misconfigurations in dev",
      "rule": {
        "finding_types": [
          "misconfiguration"
        ],
        "query": "env:prod team:platform"
      }
    },
    "type": "severity_modifier_rules"
  }
}

応答

Successfully updated the severity modifier rule

A single severity modifier rule response.

Expand All

フィールド

タイプ

説明

data [required]

object

The data object for a severity modifier rule as returned by the API.

attributes [required]

object

Attributes of a severity modifier rule as returned by the API.

action [required]

 <oneOf>

The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one rank.

A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace.

Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.

<type=set>

object

Sets matched findings to a fixed severity.

description

string

An optional free-form explanation for the severity change.

severity [required]

enum

The severity to assign to matched findings. info_none is not supported for the iac_misconfiguration, runtime_code_vulnerability, secret, or static_code_vulnerability finding types. Allowed enum values: info_none,low,medium,high,critical

type [required]

enum

The type of a severity modifier rule action that sets a fixed severity. Allowed enum values: set

<type=shift>

object

Shifts matched findings up or down by one severity rank.

description

string

An optional free-form explanation for the severity change.

severity_delta [required]

enum

The direction in which to shift the severity of matched findings by one rank. Allowed enum values: up_one,down_one

type [required]

enum

The type of a severity modifier rule action that shifts the severity by one rank. Allowed enum values: shift

created_at [required]

int64

The Unix timestamp in milliseconds when the rule was created.

created_by [required]

object

The user or Datadog system who created the rule.

id [required]

string

The actor's identifier (a user UUID or a system identifier).

name [required]

string

The name of the actor.

type [required]

enum

Whether the actor is a user or the Datadog system. Allowed enum values: user,system

enabled [required]

boolean

Whether the severity modifier rule is enabled.

modified_at [required]

int64

The Unix timestamp in milliseconds when the rule was last modified.

modified_by [required]

object

The user or Datadog system who last modified the rule.

id [required]

string

The actor's identifier (a user UUID or a system identifier).

name [required]

string

The name of the actor.

type [required]

enum

Whether the actor is a user or the Datadog system. Allowed enum values: user,system

name [required]

string

The name of the severity modifier rule.

rule [required]

object

Defines the scope of findings to which the automation rule applies.

finding_types [required]

[string]

The list of security finding types that the automation rule applies to.

query

string

A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.

id [required]

uuid

The ID of the severity modifier rule.

type [required]

enum

The JSON:API type for severity modifier rules. Allowed enum values: severity_modifier_rules

{
  "data": {
    "attributes": {
      "action": {
        "description": "Lower severity for dev environment noise",
        "severity": "low",
        "type": "set"
      },
      "created_at": 1722439510282,
      "created_by": {
        "id": "00000000-0000-0000-0000-000000000000",
        "name": "Jane Doe",
        "type": "user"
      },
      "enabled": true,
      "modified_at": 1722439510282,
      "modified_by": {
        "id": "00000000-0000-0000-0000-000000000000",
        "name": "Jane Doe",
        "type": "user"
      },
      "name": "Downgrade misconfigurations in dev",
      "rule": {
        "finding_types": [
          "misconfiguration"
        ],
        "query": "env:prod team:platform"
      }
    },
    "id": "00000000-0000-0000-0000-000000000000",
    "type": "severity_modifier_rules"
  }
}

Bad Request

API error response.

Expand All

フィールド

タイプ

説明

errors [required]

[object]

A list of errors.

detail

string

A human-readable explanation specific to this occurrence of the error.

meta

object

Non-standard meta-information about the error

source

object

References to the source of the error.

header

string

A string indicating the name of a single request header which caused the error.

parameter

string

A string indicating which URI query parameter caused the error.

pointer

string

A JSON pointer to the value in the request document that caused the error.

status

string

Status code of the response.

title

string

Short human-readable summary of the error.

{
  "errors": [
    {
      "detail": "Missing required attribute in body",
      "meta": {},
      "source": {
        "header": "Authorization",
        "parameter": "limit",
        "pointer": "/data/attributes/title"
      },
      "status": "400",
      "title": "Bad Request"
    }
  ]
}

Forbidden

API error response.

Expand All

フィールド

タイプ

説明

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Not Found

API error response.

Expand All

フィールド

タイプ

説明

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Unprocessable Entity

API error response.

Expand All

フィールド

タイプ

説明

errors [required]

[object]

A list of errors.

detail

string

A human-readable explanation specific to this occurrence of the error.

meta

object

Non-standard meta-information about the error

source

object

References to the source of the error.

header

string

A string indicating the name of a single request header which caused the error.

parameter

string

A string indicating which URI query parameter caused the error.

pointer

string

A JSON pointer to the value in the request document that caused the error.

status

string

Status code of the response.

title

string

Short human-readable summary of the error.

{
  "errors": [
    {
      "detail": "Missing required attribute in body",
      "meta": {},
      "source": {
        "header": "Authorization",
        "parameter": "limit",
        "pointer": "/data/attributes/title"
      },
      "status": "400",
      "title": "Bad Request"
    }
  ]
}

Too many requests

API error response.

Expand All

フィールド

タイプ

説明

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

コード例

                          ## default
# 

# Path parameters
export rule_id="00000000-0000-0000-0000-000000000000"
# Curl command
curl -X PUT "https://api.ap1.datadoghq.com"https://api.ap2.datadoghq.com"https://api.datadoghq.eu"https://api.ddog-gov.com"https://api.us2.ddog-gov.com"https://api.uk1.datadoghq.com"https://api.datadoghq.com"https://api.us3.datadoghq.com"https://api.us5.datadoghq.com/api/v2/security/findings/automation/severity_modifier_rules/${rule_id}" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "DD-API-KEY: ${DD_API_KEY}" \ -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \ -d @- << EOF { "data": { "attributes": { "action": { "severity_delta": "down_one", "type": "shift" }, "enabled": false, "name": "Downgrade misconfigurations in dev", "rule": { "finding_types": [ "misconfiguration" ], "query": "env:dev" } }, "type": "severity_modifier_rules" } } EOF
// Update a severity modifier rule returns "Successfully updated the severity modifier rule" response

package main

import (
	"context"
	"encoding/json"
	"fmt"
	"os"

	"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
	"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
	"github.com/google/uuid"
)

func main() {
	// there is a valid "valid_severity_modifier_rule" in the system
	ValidSeverityModifierRuleDataID := uuid.MustParse(os.Getenv("VALID_SEVERITY_MODIFIER_RULE_DATA_ID"))

	body := datadogV2.SeverityModifierRuleUpdateRequest{
		Data: datadogV2.SeverityModifierRuleDataCreate{
			Attributes: datadogV2.SeverityModifierRuleAttributesCreate{
				Action: datadogV2.SeverityModifierRuleAction{
					SeverityModifierRuleSetAction: &datadogV2.SeverityModifierRuleSetAction{
						Description: datadog.PtrString("Lower severity for dev environment noise"),
						Severity:    datadogV2.SEVERITYMODIFIERSEVERITY_LOW,
						Type:        datadogV2.SEVERITYMODIFIERRULESETACTIONTYPE_SET,
					}},
				Enabled: datadog.PtrBool(true),
				Name:    "Downgrade misconfigurations in dev",
				Rule: datadogV2.AutomationRuleScope{
					FindingTypes: []datadogV2.SecurityFindingType{
						datadogV2.SECURITYFINDINGTYPE_MISCONFIGURATION,
					},
					Query: datadog.PtrString("env:prod team:platform"),
				},
			},
			Type: datadogV2.SEVERITYMODIFIERRULETYPE_SEVERITY_MODIFIER_RULES,
		},
	}
	ctx := datadog.NewDefaultContext(context.Background())
	configuration := datadog.NewConfiguration()
	configuration.SetUnstableOperationEnabled("v2.UpdateSecurityFindingsAutomationSeverityModifierRule", true)
	apiClient := datadog.NewAPIClient(configuration)
	api := datadogV2.NewSecurityMonitoringApi(apiClient)
	resp, r, err := api.UpdateSecurityFindingsAutomationSeverityModifierRule(ctx, ValidSeverityModifierRuleDataID, body)

	if err != nil {
		fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.UpdateSecurityFindingsAutomationSeverityModifierRule`: %v\n", err)
		fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
	}

	responseContent, _ := json.MarshalIndent(resp, "", "  ")
	fmt.Fprintf(os.Stdout, "Response from `SecurityMonitoringApi.UpdateSecurityFindingsAutomationSeverityModifierRule`:\n%s\n", responseContent)
}

Instructions

First install the library and its dependencies and then save the example to main.go and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" go run "main.go"
// Update a severity modifier rule returns "Successfully updated the severity modifier rule"
// response

import com.datadog.api.client.ApiClient;
import com.datadog.api.client.ApiException;
import com.datadog.api.client.v2.api.SecurityMonitoringApi;
import com.datadog.api.client.v2.model.AutomationRuleScope;
import com.datadog.api.client.v2.model.SecurityFindingType;
import com.datadog.api.client.v2.model.SeverityModifierRuleAction;
import com.datadog.api.client.v2.model.SeverityModifierRuleAttributesCreate;
import com.datadog.api.client.v2.model.SeverityModifierRuleDataCreate;
import com.datadog.api.client.v2.model.SeverityModifierRuleResponse;
import com.datadog.api.client.v2.model.SeverityModifierRuleSetAction;
import com.datadog.api.client.v2.model.SeverityModifierRuleSetActionType;
import com.datadog.api.client.v2.model.SeverityModifierRuleType;
import com.datadog.api.client.v2.model.SeverityModifierRuleUpdateRequest;
import com.datadog.api.client.v2.model.SeverityModifierSeverity;
import java.util.Collections;
import java.util.UUID;

public class Example {
  public static void main(String[] args) {
    ApiClient defaultClient = ApiClient.getDefaultApiClient();
    defaultClient.setUnstableOperationEnabled(
        "v2.updateSecurityFindingsAutomationSeverityModifierRule", true);
    SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient);

    // there is a valid "valid_severity_modifier_rule" in the system
    UUID VALID_SEVERITY_MODIFIER_RULE_DATA_ID = null;
    try {
      VALID_SEVERITY_MODIFIER_RULE_DATA_ID =
          UUID.fromString(System.getenv("VALID_SEVERITY_MODIFIER_RULE_DATA_ID"));
    } catch (IllegalArgumentException e) {
      System.err.println("Error parsing UUID: " + e.getMessage());
    }

    SeverityModifierRuleUpdateRequest body =
        new SeverityModifierRuleUpdateRequest()
            .data(
                new SeverityModifierRuleDataCreate()
                    .attributes(
                        new SeverityModifierRuleAttributesCreate()
                            .action(
                                new SeverityModifierRuleAction(
                                    new SeverityModifierRuleSetAction()
                                        .description("Lower severity for dev environment noise")
                                        .severity(SeverityModifierSeverity.LOW)
                                        .type(SeverityModifierRuleSetActionType.SET)))
                            .enabled(true)
                            .name("Downgrade misconfigurations in dev")
                            .rule(
                                new AutomationRuleScope()
                                    .findingTypes(
                                        Collections.singletonList(
                                            SecurityFindingType.MISCONFIGURATION))
                                    .query("env:prod team:platform")))
                    .type(SeverityModifierRuleType.SEVERITY_MODIFIER_RULES));

    try {
      SeverityModifierRuleResponse result =
          apiInstance.updateSecurityFindingsAutomationSeverityModifierRule(
              VALID_SEVERITY_MODIFIER_RULE_DATA_ID, body);
      System.out.println(result);
    } catch (ApiException e) {
      System.err.println(
          "Exception when calling"
              + " SecurityMonitoringApi#updateSecurityFindingsAutomationSeverityModifierRule");
      System.err.println("Status code: " + e.getCode());
      System.err.println("Reason: " + e.getResponseBody());
      System.err.println("Response headers: " + e.getResponseHeaders());
      e.printStackTrace();
    }
  }
}

Instructions

First install the library and its dependencies and then save the example to Example.java and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" java "Example.java"
"""
Update a severity modifier rule returns "Successfully updated the severity modifier rule" response
"""

from os import environ
from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
from datadog_api_client.v2.model.automation_rule_scope import AutomationRuleScope
from datadog_api_client.v2.model.security_finding_type import SecurityFindingType
from datadog_api_client.v2.model.severity_modifier_rule_attributes_create import SeverityModifierRuleAttributesCreate
from datadog_api_client.v2.model.severity_modifier_rule_data_create import SeverityModifierRuleDataCreate
from datadog_api_client.v2.model.severity_modifier_rule_set_action import SeverityModifierRuleSetAction
from datadog_api_client.v2.model.severity_modifier_rule_set_action_type import SeverityModifierRuleSetActionType
from datadog_api_client.v2.model.severity_modifier_rule_type import SeverityModifierRuleType
from datadog_api_client.v2.model.severity_modifier_rule_update_request import SeverityModifierRuleUpdateRequest
from datadog_api_client.v2.model.severity_modifier_severity import SeverityModifierSeverity

# there is a valid "valid_severity_modifier_rule" in the system
VALID_SEVERITY_MODIFIER_RULE_DATA_ID = environ["VALID_SEVERITY_MODIFIER_RULE_DATA_ID"]

body = SeverityModifierRuleUpdateRequest(
    data=SeverityModifierRuleDataCreate(
        attributes=SeverityModifierRuleAttributesCreate(
            action=SeverityModifierRuleSetAction(
                description="Lower severity for dev environment noise",
                severity=SeverityModifierSeverity.LOW,
                type=SeverityModifierRuleSetActionType.SET,
            ),
            enabled=True,
            name="Downgrade misconfigurations in dev",
            rule=AutomationRuleScope(
                finding_types=[
                    SecurityFindingType.MISCONFIGURATION,
                ],
                query="env:prod team:platform",
            ),
        ),
        type=SeverityModifierRuleType.SEVERITY_MODIFIER_RULES,
    ),
)

configuration = Configuration()
configuration.unstable_operations["update_security_findings_automation_severity_modifier_rule"] = True
with ApiClient(configuration) as api_client:
    api_instance = SecurityMonitoringApi(api_client)
    response = api_instance.update_security_findings_automation_severity_modifier_rule(
        rule_id=VALID_SEVERITY_MODIFIER_RULE_DATA_ID, body=body
    )

    print(response)

Instructions

First install the library and its dependencies and then save the example to example.py and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" python3 "example.py"
# Update a severity modifier rule returns "Successfully updated the severity modifier rule" response

require "datadog_api_client"
DatadogAPIClient.configure do |config|
  config.unstable_operations["v2.update_security_findings_automation_severity_modifier_rule".to_sym] = true
end
api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new

# there is a valid "valid_severity_modifier_rule" in the system
VALID_SEVERITY_MODIFIER_RULE_DATA_ID = ENV["VALID_SEVERITY_MODIFIER_RULE_DATA_ID"]

body = DatadogAPIClient::V2::SeverityModifierRuleUpdateRequest.new({
  data: DatadogAPIClient::V2::SeverityModifierRuleDataCreate.new({
    attributes: DatadogAPIClient::V2::SeverityModifierRuleAttributesCreate.new({
      action: DatadogAPIClient::V2::SeverityModifierRuleSetAction.new({
        description: "Lower severity for dev environment noise",
        severity: DatadogAPIClient::V2::SeverityModifierSeverity::LOW,
        type: DatadogAPIClient::V2::SeverityModifierRuleSetActionType::SET,
      }),
      enabled: true,
      name: "Downgrade misconfigurations in dev",
      rule: DatadogAPIClient::V2::AutomationRuleScope.new({
        finding_types: [
          DatadogAPIClient::V2::SecurityFindingType::MISCONFIGURATION,
        ],
        query: "env:prod team:platform",
      }),
    }),
    type: DatadogAPIClient::V2::SeverityModifierRuleType::SEVERITY_MODIFIER_RULES,
  }),
})
p api_instance.update_security_findings_automation_severity_modifier_rule(VALID_SEVERITY_MODIFIER_RULE_DATA_ID, body)

Instructions

First install the library and its dependencies and then save the example to example.rb and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" rb "example.rb"
// Update a severity modifier rule returns "Successfully updated the severity
// modifier rule" response
use datadog_api_client::datadog;
use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;
use datadog_api_client::datadogV2::model::AutomationRuleScope;
use datadog_api_client::datadogV2::model::SecurityFindingType;
use datadog_api_client::datadogV2::model::SeverityModifierRuleAction;
use datadog_api_client::datadogV2::model::SeverityModifierRuleAttributesCreate;
use datadog_api_client::datadogV2::model::SeverityModifierRuleDataCreate;
use datadog_api_client::datadogV2::model::SeverityModifierRuleSetAction;
use datadog_api_client::datadogV2::model::SeverityModifierRuleSetActionType;
use datadog_api_client::datadogV2::model::SeverityModifierRuleType;
use datadog_api_client::datadogV2::model::SeverityModifierRuleUpdateRequest;
use datadog_api_client::datadogV2::model::SeverityModifierSeverity;

#[tokio::main]
async fn main() {
    // there is a valid "valid_severity_modifier_rule" in the system
    let valid_severity_modifier_rule_data_id =
        uuid::Uuid::parse_str(&std::env::var("VALID_SEVERITY_MODIFIER_RULE_DATA_ID").unwrap())
            .expect("Invalid UUID");
    let body = SeverityModifierRuleUpdateRequest::new(SeverityModifierRuleDataCreate::new(
        SeverityModifierRuleAttributesCreate::new(
            SeverityModifierRuleAction::SeverityModifierRuleSetAction(Box::new(
                SeverityModifierRuleSetAction::new(
                    SeverityModifierSeverity::LOW,
                    SeverityModifierRuleSetActionType::SET,
                )
                .description("Lower severity for dev environment noise".to_string()),
            )),
            "Downgrade misconfigurations in dev".to_string(),
            AutomationRuleScope::new(vec![SecurityFindingType::MISCONFIGURATION])
                .query("env:prod team:platform".to_string()),
        )
        .enabled(true),
        SeverityModifierRuleType::SEVERITY_MODIFIER_RULES,
    ));
    let mut configuration = datadog::Configuration::new();
    configuration.set_unstable_operation_enabled(
        "v2.UpdateSecurityFindingsAutomationSeverityModifierRule",
        true,
    );
    let api = SecurityMonitoringAPI::with_config(configuration);
    let resp = api
        .update_security_findings_automation_severity_modifier_rule(
            valid_severity_modifier_rule_data_id.clone(),
            body,
        )
        .await;
    if let Ok(value) = resp {
        println!("{:#?}", value);
    } else {
        println!("{:#?}", resp.unwrap_err());
    }
}

Instructions

First install the library and its dependencies and then save the example to src/main.rs and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo run
/**
 * Update a severity modifier rule returns "Successfully updated the severity modifier rule" response
 */

import { client, v2 } from "@datadog/datadog-api-client";

const configuration = client.createConfiguration();
configuration.unstableOperations[
  "v2.updateSecurityFindingsAutomationSeverityModifierRule"
] = true;
const apiInstance = new v2.SecurityMonitoringApi(configuration);

// there is a valid "valid_severity_modifier_rule" in the system
const VALID_SEVERITY_MODIFIER_RULE_DATA_ID = process.env
  .VALID_SEVERITY_MODIFIER_RULE_DATA_ID as string;

const params: v2.SecurityMonitoringApiUpdateSecurityFindingsAutomationSeverityModifierRuleRequest =
  {
    body: {
      data: {
        attributes: {
          action: {
            description: "Lower severity for dev environment noise",
            severity: "low",
            type: "set",
          },
          enabled: true,
          name: "Downgrade misconfigurations in dev",
          rule: {
            findingTypes: ["misconfiguration"],
            query: "env:prod team:platform",
          },
        },
        type: "severity_modifier_rules",
      },
    },
    ruleId: VALID_SEVERITY_MODIFIER_RULE_DATA_ID,
  };

apiInstance
  .updateSecurityFindingsAutomationSeverityModifierRule(params)
  .then((data: v2.SeverityModifierRuleResponse) => {
    console.log(
      "API called successfully. Returned data: " + JSON.stringify(data)
    );
  })
  .catch((error: any) => console.error(error));

Instructions

First install the library and its dependencies and then save the example to example.ts and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" tsc "example.ts"