Remove deprecated AgentRule field in Security Rules API for CWS

.apigentools-info

@@ -13,4 +13,4 @@
             "spec_repo_commit": "d1e8471"
         }
     }
-}
+}

.generator/schemas/v2/openapi.yaml

@@ -4695,8 +4695,6 @@ components:
     SecurityMonitoringRuleQuery:
       description: Query for matching rule.
       properties:
-        agentRule:
-          $ref: '#/components/schemas/SecurityMonitoringRuntimeAgentRule'
         aggregation:
           $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
         distinctFields:
@@ -4741,8 +4739,6 @@ components:
     SecurityMonitoringRuleQueryCreate:
       description: Query for matching rule.
       properties:
-        agentRule:
-          $ref: '#/components/schemas/SecurityMonitoringRuntimeAgentRule'
         aggregation:
           $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
         distinctFields:
@@ -4925,24 +4921,6 @@ components:
           maximum: 2147483647
           type: integer
       type: object
-    SecurityMonitoringRuntimeAgentRule:
-      description: The Agent rule.
-      properties:
-        agentRuleId:
-          description: The Agent rule ID. Must be unique within the rule.
-          example: etc_shadow
-          type: string
-        expression:
-          description: 'A Runtime Security expression determines what activity should
-            be collected by the Datadog Agent.
-
-            These logical expressions can use predefined operators and attributes.
-            Tags cannot be used in Runtime
-
-            Security expressions. Instead, allow or deny based on tags under the advanced
-            option.'
-          type: string
-      type: object
     SecurityMonitoringSignal:
       description: Object description of a security signal.
       properties:

examples/v2/security-monitoring/CreateSecurityMonitoringRule_498211763.py

@@ -20,7 +20,6 @@
 from datadog_api_client.v2.model.security_monitoring_rule_query_create import SecurityMonitoringRuleQueryCreate
 from datadog_api_client.v2.model.security_monitoring_rule_severity import SecurityMonitoringRuleSeverity
 from datadog_api_client.v2.model.security_monitoring_rule_type_create import SecurityMonitoringRuleTypeCreate
-from datadog_api_client.v2.model.security_monitoring_runtime_agent_rule import SecurityMonitoringRuntimeAgentRule
 
 body = SecurityMonitoringRuleCreatePayload(
     name="Example-Create_a_detection_rule_with_type_workload_security_returns_OK_response",
@@ -31,10 +30,6 @@
             group_by_fields=[],
             distinct_fields=[],
             metric="",
-            agent_rule=SecurityMonitoringRuntimeAgentRule(
-                agent_rule_id="kernel_module_unlink_2",
-                expression="(open.flags & ((O_CREAT|O_RDWR|O_WRONLY|O_TRUNC)) > 0)",
-            ),
         )
     ],
     filters=[],

tests/v2/cassettes/test_scenarios/test_create_a_detection_rule_with_type_workload_security_returns_ok_response.frozen

@@ -1 +1 @@
-2021-08-16T07:49:00.464Z
+2021-12-22T16:20:11.758Z

tests/v2/cassettes/test_scenarios/test_create_a_detection_rule_with_type_workload_security_returns_ok_response.yaml

@@ -1,34 +1,31 @@
 interactions:
 - request:
     body: '{"cases":[{"condition":"a > 0","name":"","notifications":[],"status":"info"}],"filters":[],"isEnabled":true,"message":"Test
-      rule","name":"Test-Create_a_detection_rule_with_type_workload_security_returns_OK_response-1629100140","options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"queries":[{"agentRule":{"agentRuleId":"kernel_module_unlink_2","expression":"(open.flags
-      & ((O_CREAT|O_RDWR|O_WRONLY|O_TRUNC)) > 0)"},"aggregation":"count","distinctFields":[],"groupByFields":[],"metric":"","query":"@test:true"}],"tags":[],"type":"workload_security"}'
+      rule","name":"Test-Create_a_detection_rule_with_type_workload_security_returns_OK_response-1640190011","options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"queries":[{"aggregation":"count","distinctFields":[],"groupByFields":[],"metric":"","query":"@test:true"}],"tags":[],"type":"workload_security"}'
     headers:
       accept:
-      - application/json, */*;q=0.8
+      - '*/*'
       connection:
       - close
       content-length:
-      - '573'
+      - '450'
       content-type:
       - application/json
       host:
       - api.datadoghq.com
       user-agent:
-      - datadog-api-client-typescript/1.0.0-beta.4 (node 14.17.4; os Linux; arch x64)
+      - datadog-api-spec/scripts/bdd-runner
       x-datadog-parent-id:
-      - '6698455153852476541'
+      - '8108364429224444138'
       x-datadog-trace-id:
-      - '1792726140053302697'
+      - '2704165638157319877'
     method: POST
     uri: https://api.datadoghq.com/api/v2/security_monitoring/rules
   response:
     body:
       string: '{"creationAuthorId":1445416,"tags":[],"isEnabled":true,"hasExtendedTitle":false,"message":"Test
-        rule","options":{"detectionMethod":"threshold","evaluationWindow":900,"maxSignalDuration":86400,"keepAlive":3600},"version":1,"createdAt":1629100140907,"filters":[],"queries":[{"distinctFields":[],"name":"","metric":"","aggregation":"count","groupByFields":[],"query":"@agent.rule_id:(Test_Create_a_detection_rule_with_type_workload_security_returns_OK_response_1629100140_kernel_module_unlink_2
-        OR kernel_module_unlink_2)","agentRule":{"expression":"(open.flags & ((O_CREAT|O_RDWR|O_WRONLY|O_TRUNC))
-        > 0)","agentRuleId":"kernel_module_unlink_2"}}],"isDeleted":false,"cases":[{"status":"info","notifications":[],"name":"","condition":"a
-        > 0"}],"type":"workload_security","id":"csl-lpm-o3j","isDefault":false,"name":"Test-Create_a_detection_rule_with_type_workload_security_returns_OK_response-1629100140"}'
+        rule","options":{"detectionMethod":"threshold","evaluationWindow":900,"maxSignalDuration":86400,"keepAlive":3600},"version":1,"createdAt":1640190012032,"filters":[],"queries":[{"distinctFields":[],"name":"","metric":"","aggregation":"count","groupByFields":[],"query":"@test:true"}],"isDeleted":false,"cases":[{"status":"info","notifications":[],"name":"","condition":"a
+        > 0"}],"type":"workload_security","id":"h4i-5nf-xci","isDefault":false,"name":"Test-Create_a_detection_rule_with_type_workload_security_returns_OK_response-1640190011"}'
     headers:
       cache-control:
       - no-cache
@@ -37,13 +34,13 @@ interactions:
       content-disposition:
       - inline
       content-length:
-      - '901'
+      - '635'
       content-security-policy:
       - frame-ancestors 'self'; report-uri https://api.datadoghq.com/csp-report
       content-type:
       - application/json;charset=utf-8
       date:
-      - Mon, 16 Aug 2021 07:49:00 GMT
+      - Wed, 22 Dec 2021 16:20:12 GMT
       pragma:
       - no-cache
       strict-transport-security:
@@ -55,33 +52,33 @@ interactions:
       x-frame-options:
       - SAMEORIGIN
       x-ratelimit-limit:
-      - '600'
+      - '1000'
       x-ratelimit-period:
-      - '60'
+      - '10'
       x-ratelimit-remaining:
-      - '599'
+      - '999'
       x-ratelimit-reset:
-      - '60'
+      - '8'
     status:
       code: 200
       message: OK
 - request:
     body: null
     headers:
       accept:
-      - application/json, */*;q=0.8
+      - '*/*'
       connection:
       - close
       host:
       - api.datadoghq.com
       user-agent:
-      - datadog-api-client-typescript/1.0.0-beta.4 (node 14.17.4; os Linux; arch x64)
+      - datadog-api-spec/scripts/bdd-runner
       x-datadog-parent-id:
-      - '2468041391897675304'
+      - '7513683422594914900'
       x-datadog-trace-id:
-      - '1792726140053302697'
+      - '2704165638157319877'
     method: DELETE
-    uri: https://api.datadoghq.com/api/v2/security_monitoring/rules/csl-lpm-o3j
+    uri: https://api.datadoghq.com/api/v2/security_monitoring/rules/h4i-5nf-xci
   response:
     body:
       string: ''
@@ -92,28 +89,28 @@ interactions:
       - close
       content-disposition:
       - inline
-      content-length:
-      - '0'
       content-security-policy:
       - frame-ancestors 'self'; report-uri https://api.datadoghq.com/csp-report
       date:
-      - Mon, 16 Aug 2021 07:49:01 GMT
+      - Wed, 22 Dec 2021 16:20:12 GMT
       pragma:
       - no-cache
       strict-transport-security:
       - max-age=15724800;
+      vary:
+      - Accept-Encoding
       x-content-type-options:
       - nosniff
       x-frame-options:
       - SAMEORIGIN
       x-ratelimit-limit:
-      - '600'
+      - '1000'
       x-ratelimit-period:
-      - '60'
+      - '10'
       x-ratelimit-remaining:
-      - '598'
+      - '998'
       x-ratelimit-reset:
-      - '59'
+      - '8'
     status:
       code: 204
       message: No Content