The data object for a severity modifier rule create or update request.
attributes [required]
object
Attributes for creating or updating a severity modifier rule.
action [required]
<oneOf>
The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one rank.
A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace.
Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
<type=set>
object
Sets matched findings to a fixed severity.
description
string
An optional free-form explanation for the severity change.
severity [required]
enum
The severity to assign to matched findings. info_none is not supported for the iac_misconfiguration, runtime_code_vulnerability, secret, or static_code_vulnerability finding types.
Allowed enum values: info_none,low,medium,high,critical
type [required]
enum
The type of a severity modifier rule action that sets a fixed severity.
Allowed enum values: set
<type=shift>
object
Shifts matched findings up or down by one severity rank.
description
string
An optional free-form explanation for the severity change.
severity_delta [required]
enum
The direction in which to shift the severity of matched findings by one rank.
Allowed enum values: up_one,down_one
type [required]
enum
The type of a severity modifier rule action that shifts the severity by one rank.
Allowed enum values: shift
enabled
boolean
Whether the severity modifier rule is enabled.
name [required]
string
The name of the severity modifier rule.
rule [required]
object
Defines the scope of findings to which the automation rule applies.
finding_types [required]
[string]
The list of security finding types that the automation rule applies to.
query
string
A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
type [required]
enum
The JSON:API type for severity modifier rules.
Allowed enum values: severity_modifier_rules
{"data":{"attributes":{"action":{"description":"Lower severity for dev environment noise","severity":"low","type":"set"},"enabled":true,"name":"Downgrade misconfigurations in dev","rule":{"finding_types":["misconfiguration"],"query":"env:prod team:platform"}},"type":"severity_modifier_rules"}}
The data object for a severity modifier rule as returned by the API.
attributes [required]
object
Attributes of a severity modifier rule as returned by the API.
action [required]
<oneOf>
The action to take when a severity modifier rule matches a finding. This is a discriminated union on type: set assigns a fixed severity, while shift moves the severity up or down by one rank.
A severity modifier rule's rule.query must not filter on @severity or on the @severity_details.user_adjusted.* namespace.
Use @severity_details.adjusted.value instead, which reflects the severity before user-defined adjustments.
<type=set>
object
Sets matched findings to a fixed severity.
description
string
An optional free-form explanation for the severity change.
severity [required]
enum
The severity to assign to matched findings. info_none is not supported for the iac_misconfiguration, runtime_code_vulnerability, secret, or static_code_vulnerability finding types.
Allowed enum values: info_none,low,medium,high,critical
type [required]
enum
The type of a severity modifier rule action that sets a fixed severity.
Allowed enum values: set
<type=shift>
object
Shifts matched findings up or down by one severity rank.
description
string
An optional free-form explanation for the severity change.
severity_delta [required]
enum
The direction in which to shift the severity of matched findings by one rank.
Allowed enum values: up_one,down_one
type [required]
enum
The type of a severity modifier rule action that shifts the severity by one rank.
Allowed enum values: shift
created_at [required]
int64
The Unix timestamp in milliseconds when the rule was created.
created_by [required]
object
The user or Datadog system who created the rule.
id [required]
string
The actor's identifier (a user UUID or a system identifier).
name [required]
string
The name of the actor.
type [required]
enum
Whether the actor is a user or the Datadog system.
Allowed enum values: user,system
enabled [required]
boolean
Whether the severity modifier rule is enabled.
modified_at [required]
int64
The Unix timestamp in milliseconds when the rule was last modified.
modified_by [required]
object
The user or Datadog system who last modified the rule.
id [required]
string
The actor's identifier (a user UUID or a system identifier).
name [required]
string
The name of the actor.
type [required]
enum
Whether the actor is a user or the Datadog system.
Allowed enum values: user,system
name [required]
string
The name of the severity modifier rule.
rule [required]
object
Defines the scope of findings to which the automation rule applies.
finding_types [required]
[string]
The list of security finding types that the automation rule applies to.
query
string
A search query to further filter the findings matched by this rule. The @workflow.* namespace and @status fields are not permitted. For a reference of available fields, see the Security Findings schema documentation.
id [required]
uuid
The ID of the severity modifier rule.
type [required]
enum
The JSON:API type for severity modifier rules.
Allowed enum values: severity_modifier_rules
{"data":{"attributes":{"action":{"description":"Lower severity for dev environment noise","severity":"low","type":"set"},"created_at":1722439510282,"created_by":{"id":"00000000-0000-0000-0000-000000000000","name":"Jane Doe","type":"user"},"enabled":true,"modified_at":1722439510282,"modified_by":{"id":"00000000-0000-0000-0000-000000000000","name":"Jane Doe","type":"user"},"name":"Downgrade misconfigurations in dev","rule":{"finding_types":["misconfiguration"],"query":"env:prod team:platform"}},"id":"00000000-0000-0000-0000-000000000000","type":"severity_modifier_rules"}}
// Update a severity modifier rule returns "Successfully updated the severity modifier rule" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2""github.com/google/uuid")funcmain(){// there is a valid "valid_severity_modifier_rule" in the systemValidSeverityModifierRuleDataID:=uuid.MustParse(os.Getenv("VALID_SEVERITY_MODIFIER_RULE_DATA_ID"))body:=datadogV2.SeverityModifierRuleUpdateRequest{Data:datadogV2.SeverityModifierRuleDataCreate{Attributes:datadogV2.SeverityModifierRuleAttributesCreate{Action:datadogV2.SeverityModifierRuleAction{SeverityModifierRuleSetAction:&datadogV2.SeverityModifierRuleSetAction{Description:datadog.PtrString("Lower severity for dev environment noise"),Severity:datadogV2.SEVERITYMODIFIERSEVERITY_LOW,Type:datadogV2.SEVERITYMODIFIERRULESETACTIONTYPE_SET,}},Enabled:datadog.PtrBool(true),Name:"Downgrade misconfigurations in dev",Rule:datadogV2.AutomationRuleScope{FindingTypes:[]datadogV2.SecurityFindingType{datadogV2.SECURITYFINDINGTYPE_MISCONFIGURATION,},Query:datadog.PtrString("env:prod team:platform"),},},Type:datadogV2.SEVERITYMODIFIERRULETYPE_SEVERITY_MODIFIER_RULES,},}ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()configuration.SetUnstableOperationEnabled("v2.UpdateSecurityFindingsAutomationSeverityModifierRule",true)apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.UpdateSecurityFindingsAutomationSeverityModifierRule(ctx,ValidSeverityModifierRuleDataID,body)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.UpdateSecurityFindingsAutomationSeverityModifierRule`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.UpdateSecurityFindingsAutomationSeverityModifierRule`:\n%s\n",responseContent)}
// Update a severity modifier rule returns "Successfully updated the severity modifier rule"// responseimportcom.datadog.api.client.ApiClient;importcom.datadog.api.client.ApiException;importcom.datadog.api.client.v2.api.SecurityMonitoringApi;importcom.datadog.api.client.v2.model.AutomationRuleScope;importcom.datadog.api.client.v2.model.SecurityFindingType;importcom.datadog.api.client.v2.model.SeverityModifierRuleAction;importcom.datadog.api.client.v2.model.SeverityModifierRuleAttributesCreate;importcom.datadog.api.client.v2.model.SeverityModifierRuleDataCreate;importcom.datadog.api.client.v2.model.SeverityModifierRuleResponse;importcom.datadog.api.client.v2.model.SeverityModifierRuleSetAction;importcom.datadog.api.client.v2.model.SeverityModifierRuleSetActionType;importcom.datadog.api.client.v2.model.SeverityModifierRuleType;importcom.datadog.api.client.v2.model.SeverityModifierRuleUpdateRequest;importcom.datadog.api.client.v2.model.SeverityModifierSeverity;importjava.util.Collections;importjava.util.UUID;publicclassExample{publicstaticvoidmain(String[]args){ApiClientdefaultClient=ApiClient.getDefaultApiClient();defaultClient.setUnstableOperationEnabled("v2.updateSecurityFindingsAutomationSeverityModifierRule",true);SecurityMonitoringApiapiInstance=newSecurityMonitoringApi(defaultClient);// there is a valid "valid_severity_modifier_rule" in the systemUUIDVALID_SEVERITY_MODIFIER_RULE_DATA_ID=null;try{VALID_SEVERITY_MODIFIER_RULE_DATA_ID=UUID.fromString(System.getenv("VALID_SEVERITY_MODIFIER_RULE_DATA_ID"));}catch(IllegalArgumentExceptione){System.err.println("Error parsing UUID: "+e.getMessage());}SeverityModifierRuleUpdateRequestbody=newSeverityModifierRuleUpdateRequest().data(newSeverityModifierRuleDataCreate().attributes(newSeverityModifierRuleAttributesCreate().action(newSeverityModifierRuleAction(newSeverityModifierRuleSetAction().description("Lower severity for dev environment noise").severity(SeverityModifierSeverity.LOW).type(SeverityModifierRuleSetActionType.SET))).enabled(true).name("Downgrade misconfigurations in dev").rule(newAutomationRuleScope().findingTypes(Collections.singletonList(SecurityFindingType.MISCONFIGURATION)).query("env:prod team:platform"))).type(SeverityModifierRuleType.SEVERITY_MODIFIER_RULES));try{SeverityModifierRuleResponseresult=apiInstance.updateSecurityFindingsAutomationSeverityModifierRule(VALID_SEVERITY_MODIFIER_RULE_DATA_ID,body);System.out.println(result);}catch(ApiExceptione){System.err.println("Exception when calling"+" SecurityMonitoringApi#updateSecurityFindingsAutomationSeverityModifierRule");System.err.println("Status code: "+e.getCode());System.err.println("Reason: "+e.getResponseBody());System.err.println("Response headers: "+e.getResponseHeaders());e.printStackTrace();}}}
"""
Update a severity modifier rule returns "Successfully updated the severity modifier rule" response
"""fromosimportenvironfromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApifromdatadog_api_client.v2.model.automation_rule_scopeimportAutomationRuleScopefromdatadog_api_client.v2.model.security_finding_typeimportSecurityFindingTypefromdatadog_api_client.v2.model.severity_modifier_rule_attributes_createimportSeverityModifierRuleAttributesCreatefromdatadog_api_client.v2.model.severity_modifier_rule_data_createimportSeverityModifierRuleDataCreatefromdatadog_api_client.v2.model.severity_modifier_rule_set_actionimportSeverityModifierRuleSetActionfromdatadog_api_client.v2.model.severity_modifier_rule_set_action_typeimportSeverityModifierRuleSetActionTypefromdatadog_api_client.v2.model.severity_modifier_rule_typeimportSeverityModifierRuleTypefromdatadog_api_client.v2.model.severity_modifier_rule_update_requestimportSeverityModifierRuleUpdateRequestfromdatadog_api_client.v2.model.severity_modifier_severityimportSeverityModifierSeverity# there is a valid "valid_severity_modifier_rule" in the systemVALID_SEVERITY_MODIFIER_RULE_DATA_ID=environ["VALID_SEVERITY_MODIFIER_RULE_DATA_ID"]body=SeverityModifierRuleUpdateRequest(data=SeverityModifierRuleDataCreate(attributes=SeverityModifierRuleAttributesCreate(action=SeverityModifierRuleSetAction(description="Lower severity for dev environment noise",severity=SeverityModifierSeverity.LOW,type=SeverityModifierRuleSetActionType.SET,),enabled=True,name="Downgrade misconfigurations in dev",rule=AutomationRuleScope(finding_types=[SecurityFindingType.MISCONFIGURATION,],query="env:prod team:platform",),),type=SeverityModifierRuleType.SEVERITY_MODIFIER_RULES,),)configuration=Configuration()configuration.unstable_operations["update_security_findings_automation_severity_modifier_rule"]=TruewithApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.update_security_findings_automation_severity_modifier_rule(rule_id=VALID_SEVERITY_MODIFIER_RULE_DATA_ID,body=body)print(response)
# Update a severity modifier rule returns "Successfully updated the severity modifier rule" responserequire"datadog_api_client"DatadogAPIClient.configuredo|config|config.unstable_operations["v2.update_security_findings_automation_severity_modifier_rule".to_sym]=trueendapi_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.new# there is a valid "valid_severity_modifier_rule" in the systemVALID_SEVERITY_MODIFIER_RULE_DATA_ID=ENV["VALID_SEVERITY_MODIFIER_RULE_DATA_ID"]body=DatadogAPIClient::V2::SeverityModifierRuleUpdateRequest.new({data:DatadogAPIClient::V2::SeverityModifierRuleDataCreate.new({attributes:DatadogAPIClient::V2::SeverityModifierRuleAttributesCreate.new({action:DatadogAPIClient::V2::SeverityModifierRuleSetAction.new({description:"Lower severity for dev environment noise",severity:DatadogAPIClient::V2::SeverityModifierSeverity::LOW,type:DatadogAPIClient::V2::SeverityModifierRuleSetActionType::SET,}),enabled:true,name:"Downgrade misconfigurations in dev",rule:DatadogAPIClient::V2::AutomationRuleScope.new({finding_types:[DatadogAPIClient::V2::SecurityFindingType::MISCONFIGURATION,],query:"env:prod team:platform",}),}),type:DatadogAPIClient::V2::SeverityModifierRuleType::SEVERITY_MODIFIER_RULES,}),})papi_instance.update_security_findings_automation_severity_modifier_rule(VALID_SEVERITY_MODIFIER_RULE_DATA_ID,body)
// Update a severity modifier rule returns "Successfully updated the severity
// modifier rule" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;usedatadog_api_client::datadogV2::model::AutomationRuleScope;usedatadog_api_client::datadogV2::model::SecurityFindingType;usedatadog_api_client::datadogV2::model::SeverityModifierRuleAction;usedatadog_api_client::datadogV2::model::SeverityModifierRuleAttributesCreate;usedatadog_api_client::datadogV2::model::SeverityModifierRuleDataCreate;usedatadog_api_client::datadogV2::model::SeverityModifierRuleSetAction;usedatadog_api_client::datadogV2::model::SeverityModifierRuleSetActionType;usedatadog_api_client::datadogV2::model::SeverityModifierRuleType;usedatadog_api_client::datadogV2::model::SeverityModifierRuleUpdateRequest;usedatadog_api_client::datadogV2::model::SeverityModifierSeverity;#[tokio::main]asyncfnmain(){// there is a valid "valid_severity_modifier_rule" in the system
letvalid_severity_modifier_rule_data_id=uuid::Uuid::parse_str(&std::env::var("VALID_SEVERITY_MODIFIER_RULE_DATA_ID").unwrap()).expect("Invalid UUID");letbody=SeverityModifierRuleUpdateRequest::new(SeverityModifierRuleDataCreate::new(SeverityModifierRuleAttributesCreate::new(SeverityModifierRuleAction::SeverityModifierRuleSetAction(Box::new(SeverityModifierRuleSetAction::new(SeverityModifierSeverity::LOW,SeverityModifierRuleSetActionType::SET,).description("Lower severity for dev environment noise".to_string()),)),"Downgrade misconfigurations in dev".to_string(),AutomationRuleScope::new(vec![SecurityFindingType::MISCONFIGURATION]).query("env:prod team:platform".to_string()),).enabled(true),SeverityModifierRuleType::SEVERITY_MODIFIER_RULES,));letmutconfiguration=datadog::Configuration::new();configuration.set_unstable_operation_enabled("v2.UpdateSecurityFindingsAutomationSeverityModifierRule",true,);letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.update_security_findings_automation_severity_modifier_rule(valid_severity_modifier_rule_data_id.clone(),body,).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Update a severity modifier rule returns "Successfully updated the severity modifier rule" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();configuration.unstableOperations["v2.updateSecurityFindingsAutomationSeverityModifierRule"]=true;constapiInstance=newv2.SecurityMonitoringApi(configuration);// there is a valid "valid_severity_modifier_rule" in the system
constVALID_SEVERITY_MODIFIER_RULE_DATA_ID=process.env.VALID_SEVERITY_MODIFIER_RULE_DATA_IDasstring;constparams: v2.SecurityMonitoringApiUpdateSecurityFindingsAutomationSeverityModifierRuleRequest={body:{data:{attributes:{action:{description:"Lower severity for dev environment noise",severity:"low",type:"set",},enabled: true,name:"Downgrade misconfigurations in dev",rule:{findingTypes:["misconfiguration"],query:"env:prod team:platform",},},type:"severity_modifier_rules",},},ruleId: VALID_SEVERITY_MODIFIER_RULE_DATA_ID,};apiInstance.updateSecurityFindingsAutomationSeverityModifierRule(params).then((data: v2.SeverityModifierRuleResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));