From 48013f19030bdfbd57f9a291c62a9b061848a99d Mon Sep 17 00:00:00 2001 From: "ci.datadog-api-spec" Date: Wed, 2 Sep 2026 09:11:51 +0000 Subject: [PATCH] Regenerate client from commit a72df82 of spec repo --- .../en/api/v2/csm-threats/examples.json | 60 ++++++-- .../en/api/v2/feature-flags/examples.json | 34 +---- hugo/data/api/v2/CodeExamples.json | 5 - hugo/data/api/v2/full_spec.yaml | 140 +++--------------- 4 files changed, 66 insertions(+), 173 deletions(-) diff --git a/hugo/content/en/api/v2/csm-threats/examples.json b/hugo/content/en/api/v2/csm-threats/examples.json index 31fe07b57ce..e3803865fc2 100644 --- a/hugo/content/en/api/v2/csm-threats/examples.json +++ b/hugo/content/en/api/v2/csm-threats/examples.json @@ -8,6 +8,7 @@ "attributes": { "actions": [ { + "disabled": false, "filter": "string", "hash": { "field": "string" @@ -37,6 +38,7 @@ } ], "agentConstraint": "string", + "agent_version": ">=7.62", "blocking": [], "category": "Process Activity", "creationAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", @@ -49,8 +51,10 @@ "description": "My Agent rule", "disabled": [], "enabled": true, + "every": 60000000000, "expression": "exec.file.name == \"sh\"", "filters": [], + "group_id": "group_id", "monitoring": [], "name": "my_agent_rule", "product_tags": [], @@ -69,7 +73,7 @@ } ] }, - "html": "
\n
\n
\n
\n

data

\n
\n

[object]

\n

A list of Agent rules objects

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

[object]

\n

A list of Agent rules objects

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

disabled

\n
\n

boolean

\n

Whether the action is disabled

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

agent_version

\n
\n

string

\n

The version constraint of the Datadog Agent the rule applies to

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

every

\n
\n

int64

\n

The rate limiting duration of the Agent rule, in nanoseconds

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

group_id

\n
\n

string

\n

The group of rules the Agent rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" }, "403": { "json": { @@ -102,6 +106,7 @@ "attributes": { "actions": [ { + "disabled": false, "filter": "string", "hash": { "field": "string" @@ -131,6 +136,7 @@ } ], "agentConstraint": "string", + "agent_version": ">=7.62", "blocking": [], "category": "Process Activity", "creationAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", @@ -143,8 +149,10 @@ "description": "My Agent rule", "disabled": [], "enabled": true, + "every": 60000000000, "expression": "exec.file.name == \"sh\"", "filters": [], + "group_id": "group_id", "monitoring": [], "name": "my_agent_rule", "product_tags": [], @@ -162,7 +170,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

disabled

\n
\n

boolean

\n

Whether the action is disabled

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

agent_version

\n
\n

string

\n

The version constraint of the Datadog Agent the rule applies to

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

every

\n
\n

int64

\n

The rate limiting duration of the Agent rule, in nanoseconds

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

group_id

\n
\n

string

\n

The group of rules the Agent rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" }, "400": { "json": { @@ -212,6 +220,7 @@ "attributes": { "actions": [ { + "disabled": false, "filter": "string", "hash": { "field": "string" @@ -256,7 +265,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Create a new Cloud Workload Security Agent rule.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agent_version

\n
\n

string

\n

Constrain the rule to specific versions of the Datadog Agent.

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to.

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to.

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

The SECL expression of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on.

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

policy_id

\n
\n

string

\n

The ID of the policy where the Agent rule is saved.

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule.

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Create a new Cloud Workload Security Agent rule.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

disabled

\n
\n

boolean

\n

Whether the action is disabled

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agent_version

\n
\n

string

\n

Constrain the rule to specific versions of the Datadog Agent.

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to.

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to.

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

The SECL expression of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on.

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

policy_id

\n
\n

string

\n

The ID of the policy where the Agent rule is saved.

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule.

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" } }, "DeleteCSMThreatsAgentRule": { @@ -300,6 +309,7 @@ "attributes": { "actions": [ { + "disabled": false, "filter": "string", "hash": { "field": "string" @@ -329,6 +339,7 @@ } ], "agentConstraint": "string", + "agent_version": ">=7.62", "blocking": [], "category": "Process Activity", "creationAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", @@ -341,8 +352,10 @@ "description": "My Agent rule", "disabled": [], "enabled": true, + "every": 60000000000, "expression": "exec.file.name == \"sh\"", "filters": [], + "group_id": "group_id", "monitoring": [], "name": "my_agent_rule", "product_tags": [], @@ -360,7 +373,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

disabled

\n
\n

boolean

\n

Whether the action is disabled

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

agent_version

\n
\n

string

\n

The version constraint of the Datadog Agent the rule applies to

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

every

\n
\n

int64

\n

The rate limiting duration of the Agent rule, in nanoseconds

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

group_id

\n
\n

string

\n

The group of rules the Agent rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" }, "403": { "json": { @@ -401,6 +414,7 @@ "attributes": { "actions": [ { + "disabled": false, "filter": "string", "hash": { "field": "string" @@ -430,6 +444,7 @@ } ], "agentConstraint": "string", + "agent_version": ">=7.62", "blocking": [], "category": "Process Activity", "creationAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", @@ -442,8 +457,10 @@ "description": "My Agent rule", "disabled": [], "enabled": true, + "every": 60000000000, "expression": "exec.file.name == \"sh\"", "filters": [], + "group_id": "group_id", "monitoring": [], "name": "my_agent_rule", "product_tags": [], @@ -461,7 +478,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

disabled

\n
\n

boolean

\n

Whether the action is disabled

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

agent_version

\n
\n

string

\n

The version constraint of the Datadog Agent the rule applies to

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

every

\n
\n

int64

\n

The rate limiting duration of the Agent rule, in nanoseconds

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

group_id

\n
\n

string

\n

The group of rules the Agent rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" }, "400": { "json": { @@ -516,6 +533,7 @@ "attributes": { "actions": [ { + "disabled": false, "filter": "string", "hash": { "field": "string" @@ -559,7 +577,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Update an existing Cloud Workload Security Agent rule

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agent_version

\n
\n

string

\n

Constrain the rule to specific versions of the Datadog Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

policy_id

\n
\n

string

\n

The ID of the policy where the Agent rule is saved

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Update an existing Cloud Workload Security Agent rule

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

disabled

\n
\n

boolean

\n

Whether the action is disabled

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agent_version

\n
\n

string

\n

Constrain the rule to specific versions of the Datadog Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

policy_id

\n
\n

string

\n

The ID of the policy where the Agent rule is saved

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" } }, "ListCSMThreatsAgentPolicies": { @@ -995,6 +1013,7 @@ "attributes": { "actions": [ { + "disabled": false, "filter": "string", "hash": { "field": "string" @@ -1024,6 +1043,7 @@ } ], "agentConstraint": "string", + "agent_version": ">=7.62", "blocking": [], "category": "Process Activity", "creationAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", @@ -1036,8 +1056,10 @@ "description": "My Agent rule", "disabled": [], "enabled": true, + "every": 60000000000, "expression": "exec.file.name == \"sh\"", "filters": [], + "group_id": "group_id", "monitoring": [], "name": "my_agent_rule", "product_tags": [], @@ -1056,7 +1078,7 @@ } ] }, - "html": "
\n
\n
\n
\n

data

\n
\n

[object]

\n

A list of Agent rules objects

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

[object]

\n

A list of Agent rules objects

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

disabled

\n
\n

boolean

\n

Whether the action is disabled

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

agent_version

\n
\n

string

\n

The version constraint of the Datadog Agent the rule applies to

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

every

\n
\n

int64

\n

The rate limiting duration of the Agent rule, in nanoseconds

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

group_id

\n
\n

string

\n

The group of rules the Agent rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" }, "403": { "json": { @@ -1089,6 +1111,7 @@ "attributes": { "actions": [ { + "disabled": false, "filter": "string", "hash": { "field": "string" @@ -1118,6 +1141,7 @@ } ], "agentConstraint": "string", + "agent_version": ">=7.62", "blocking": [], "category": "Process Activity", "creationAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", @@ -1130,8 +1154,10 @@ "description": "My Agent rule", "disabled": [], "enabled": true, + "every": 60000000000, "expression": "exec.file.name == \"sh\"", "filters": [], + "group_id": "group_id", "monitoring": [], "name": "my_agent_rule", "product_tags": [], @@ -1149,7 +1175,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

disabled

\n
\n

boolean

\n

Whether the action is disabled

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

agent_version

\n
\n

string

\n

The version constraint of the Datadog Agent the rule applies to

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

every

\n
\n

int64

\n

The rate limiting duration of the Agent rule, in nanoseconds

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

group_id

\n
\n

string

\n

The group of rules the Agent rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" }, "400": { "json": { @@ -1199,6 +1225,7 @@ "attributes": { "actions": [ { + "disabled": false, "filter": "string", "hash": { "field": "string" @@ -1243,7 +1270,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Create a new Cloud Workload Security Agent rule.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agent_version

\n
\n

string

\n

Constrain the rule to specific versions of the Datadog Agent.

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to.

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to.

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

The SECL expression of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on.

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

policy_id

\n
\n

string

\n

The ID of the policy where the Agent rule is saved.

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule.

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Create a new Cloud Workload Security Agent rule.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

disabled

\n
\n

boolean

\n

Whether the action is disabled

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agent_version

\n
\n

string

\n

Constrain the rule to specific versions of the Datadog Agent.

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to.

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to.

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

The SECL expression of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on.

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

policy_id

\n
\n

string

\n

The ID of the policy where the Agent rule is saved.

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule.

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" } }, "DeleteCloudWorkloadSecurityAgentRule": { @@ -1287,6 +1314,7 @@ "attributes": { "actions": [ { + "disabled": false, "filter": "string", "hash": { "field": "string" @@ -1316,6 +1344,7 @@ } ], "agentConstraint": "string", + "agent_version": ">=7.62", "blocking": [], "category": "Process Activity", "creationAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", @@ -1328,8 +1357,10 @@ "description": "My Agent rule", "disabled": [], "enabled": true, + "every": 60000000000, "expression": "exec.file.name == \"sh\"", "filters": [], + "group_id": "group_id", "monitoring": [], "name": "my_agent_rule", "product_tags": [], @@ -1347,7 +1378,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

disabled

\n
\n

boolean

\n

Whether the action is disabled

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

agent_version

\n
\n

string

\n

The version constraint of the Datadog Agent the rule applies to

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

every

\n
\n

int64

\n

The rate limiting duration of the Agent rule, in nanoseconds

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

group_id

\n
\n

string

\n

The group of rules the Agent rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" }, "403": { "json": { @@ -1388,6 +1419,7 @@ "attributes": { "actions": [ { + "disabled": false, "filter": "string", "hash": { "field": "string" @@ -1417,6 +1449,7 @@ } ], "agentConstraint": "string", + "agent_version": ">=7.62", "blocking": [], "category": "Process Activity", "creationAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", @@ -1429,8 +1462,10 @@ "description": "My Agent rule", "disabled": [], "enabled": true, + "every": 60000000000, "expression": "exec.file.name == \"sh\"", "filters": [], + "group_id": "group_id", "monitoring": [], "name": "my_agent_rule", "product_tags": [], @@ -1448,7 +1483,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

disabled

\n
\n

boolean

\n

Whether the action is disabled

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

agent_version

\n
\n

string

\n

The version constraint of the Datadog Agent the rule applies to

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

every

\n
\n

int64

\n

The rate limiting duration of the Agent rule, in nanoseconds

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

group_id

\n
\n

string

\n

The group of rules the Agent rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" }, "400": { "json": { @@ -1503,6 +1538,7 @@ "attributes": { "actions": [ { + "disabled": false, "filter": "string", "hash": { "field": "string" @@ -1546,7 +1582,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Update an existing Cloud Workload Security Agent rule

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agent_version

\n
\n

string

\n

Constrain the rule to specific versions of the Datadog Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

policy_id

\n
\n

string

\n

The ID of the policy where the Agent rule is saved

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Update an existing Cloud Workload Security Agent rule

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

disabled

\n
\n

boolean

\n

Whether the action is disabled

\n
\n \n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

hash

\n
\n

object

\n

Hash file specified by the field attribute

\n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the hash action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field.

\n
\n \n
\n
\n
\n
\n
\n

default_value

\n
\n

string

\n

The default value of the set action

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The expression of the set action.

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

inherited

\n
\n

boolean

\n

Whether the value should be inherited.

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action.

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action.

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action.

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

 <oneOf>

\n

The value of the set action

\n
\n
\n
\n
\n
\n

Object 1

\n
\n

string

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 2

\n
\n

int32

\n
\n
\n \n
\n
\n
\n
\n
\n

Object 3

\n
\n

boolean

\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agent_version

\n
\n

string

\n

Constrain the rule to specific versions of the Datadog Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

policy_id

\n
\n

string

\n

The ID of the policy where the Agent rule is saved

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

silent

\n
\n

boolean

\n

Whether the rule is silent.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" } } } \ No newline at end of file diff --git a/hugo/content/en/api/v2/feature-flags/examples.json b/hugo/content/en/api/v2/feature-flags/examples.json index c73080ead5e..9098214b397 100644 --- a/hugo/content/en/api/v2/feature-flags/examples.json +++ b/hugo/content/en/api/v2/feature-flags/examples.json @@ -185,13 +185,6 @@ "description": "This is an example feature flag for demonstration", "key": "feature-flag-abc123", "name": "Feature Flag ABC123", - "rule_targets": [ - { - "configuration": {}, - "type": "SLACK_CHANNEL", - "version": 1 - } - ], "value_type": "BOOLEAN", "variants": [ { @@ -212,31 +205,6 @@ "json_schema": "{\"type\": \"object\", \"properties\": {\"enabled\": {\"type\": \"boolean\"}}}", "key": "feature-flag-abc123", "name": "Feature Flag ABC123", - "notification_rule_query": "notification_type:rollout_started OR notification_type:targeting_rule_updated", - "rule_targets": [ - { - "configuration": { - "channel": "#feature-flags", - "channel_id": "C0123456789", - "channel_name": "Feature Flags", - "connector_name": "datadog-connector", - "recipient": { - "email": "user@example.com" - }, - "service_name": "feature-flags-oncall", - "team_id": "19:abcdef0123456789@thread.tacv2", - "team_name": "Engineering", - "tenant_id": "72f988bf-86f1-41af-91ab-2d7cd011db47", - "tenant_name": "Datadog", - "username": "jane.doe", - "webhook_name": "feature-flags-webhook", - "workspace": "datadoghq", - "workspace_id": "T0123456789" - }, - "type": "SLACK_CHANNEL", - "version": 1 - } - ], "value_type": "BOOLEAN", "variants": [ { @@ -249,7 +217,7 @@ "type": "feature-flags" } }, - "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Data for creating a new feature flag.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Attributes for creating a new feature flag.

\n
\n
\n
\n
\n
\n

default_variant_key

\n
\n

string

\n

The key of the default variant.

\n
\n \n
\n
\n
\n
\n
\n

description [required]

\n
\n

string

\n

The description of the feature flag.

\n
\n \n
\n
\n
\n
\n
\n

json_schema

\n
\n

string

\n

JSON schema for validation when value_type is JSON.

\n
\n \n
\n
\n
\n
\n
\n

key [required]

\n
\n

string

\n

The unique key of the feature flag.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the feature flag.

\n
\n \n
\n
\n
\n
\n
\n

notification_rule_query

\n
\n

string

\n

Query used to determine which change events on this feature flag trigger notifications\nto rule_targets. Uses Datadog log search syntax (AND, OR, NOT, parentheses) to\nmatch against the notification_type facet.

Supported notification_type values for a feature flag are: flag_enabled_disabled,\nflag_archived, flag_approval_required, rollout_started, rollout_scheduled,\nrollout_step_started, rollout_paused_guardrail, rollout_paused_user,\nrollout_aborted_guardrail, rollout_aborted_user, targeting_rule_created,\ntargeting_rule_updated, targeting_rule_updated_via_filter, and\ntargeting_rule_deleted.

\n
\n \n
\n
\n
\n
\n
\n

rule_targets

\n
\n

[object]

\n

Targets to notify about changes to this feature flag that match notification_rule_query.

\n
\n
\n
\n
\n
\n

configuration [required]

\n
\n

object

\n

Configuration for a notification target. Which fields apply depends on the target's type.

\n
\n
\n
\n
\n
\n

channel

\n
\n

string

\n

Slack channel name, for a SLACK_CHANNEL target.

\n
\n \n
\n
\n
\n
\n
\n

channel_id

\n
\n

string

\n

Slack channel ID for a SLACK_CHANNEL target, or Microsoft Teams channel ID\nfor an MS_TEAMS_CHANNEL target.

\n
\n \n
\n
\n
\n
\n
\n

channel_name

\n
\n

string

\n

Microsoft Teams channel name, for an MS_TEAMS_CHANNEL target.

\n
\n \n
\n
\n
\n
\n
\n

connector_name

\n
\n

string

\n

Microsoft Teams connector name, for an MS_TEAMS_CHANNEL target.

\n
\n \n
\n
\n
\n
\n
\n

recipient

\n
\n

object

\n

Recipient for an EMAIL target.

\n
\n
\n
\n
\n
\n

email

\n
\n

string

\n

Email address to notify.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

service_name

\n
\n

string

\n

PagerDuty service name, for a PAGERDUTY_SERVICE target.

\n
\n \n
\n
\n
\n
\n
\n

team_id

\n
\n

string

\n

Microsoft Teams team ID, for an MS_TEAMS_CHANNEL target.

\n
\n \n
\n
\n
\n
\n
\n

team_name

\n
\n

string

\n

Microsoft Teams team name, for an MS_TEAMS_CHANNEL target.

\n
\n \n
\n
\n
\n
\n
\n

tenant_id

\n
\n

string

\n

Microsoft Teams tenant ID, for an MS_TEAMS_CHANNEL target.

\n
\n \n
\n
\n
\n
\n
\n

tenant_name

\n
\n

string

\n

Microsoft Teams tenant name, for an MS_TEAMS_CHANNEL target.

\n
\n \n
\n
\n
\n
\n
\n

username

\n
\n

string

\n

Slack username, for a SLACK_USER target.

\n
\n \n
\n
\n
\n
\n
\n

webhook_name

\n
\n

string

\n

Name of the configured webhook, for a WEBHOOK target.

\n
\n \n
\n
\n
\n
\n
\n

workspace

\n
\n

string

\n

Slack workspace name, for a SLACK_CHANNEL or SLACK_USER target.

\n
\n \n
\n
\n
\n
\n
\n

workspace_id

\n
\n

string

\n

Slack workspace ID, for a SLACK_CHANNEL target.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of notification target. \nAllowed enum values: EMAIL,SLACK_CHANNEL,SLACK_USER,WEBHOOK,PAGERDUTY_SERVICE,MS_TEAMS_CHANNEL

\n
\n \n
\n
\n
\n
\n
\n

version [required]

\n
\n

int64

\n

Schema version of configuration.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

value_type [required]

\n
\n

enum

\n

The type of values for the feature flag variants. \nAllowed enum values: BOOLEAN,INTEGER,NUMERIC,STRING,JSON

\n
\n \n
\n
\n
\n
\n
\n

variants [required]

\n
\n

[object]

\n

The variants of the feature flag.

\n
\n
\n
\n
\n
\n

key [required]

\n
\n

string

\n

The unique key of the variant.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the variant.

\n
\n \n
\n
\n
\n
\n
\n

value [required]

\n
\n

string

\n

The value of the variant as a string.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The resource type. \nAllowed enum values: feature-flags

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Data for creating a new feature flag.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Attributes for creating a new feature flag.

\n
\n
\n
\n
\n
\n

default_variant_key

\n
\n

string

\n

The key of the default variant.

\n
\n \n
\n
\n
\n
\n
\n

description [required]

\n
\n

string

\n

The description of the feature flag.

\n
\n \n
\n
\n
\n
\n
\n

json_schema

\n
\n

string

\n

JSON schema for validation when value_type is JSON.

\n
\n \n
\n
\n
\n
\n
\n

key [required]

\n
\n

string

\n

The unique key of the feature flag.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the feature flag.

\n
\n \n
\n
\n
\n
\n
\n

value_type [required]

\n
\n

enum

\n

The type of values for the feature flag variants. \nAllowed enum values: BOOLEAN,INTEGER,NUMERIC,STRING,JSON

\n
\n \n
\n
\n
\n
\n
\n

variants [required]

\n
\n

[object]

\n

The variants of the feature flag.

\n
\n
\n
\n
\n
\n

key [required]

\n
\n

string

\n

The unique key of the variant.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the variant.

\n
\n \n
\n
\n
\n
\n
\n

value [required]

\n
\n

string

\n

The value of the variant as a string.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The resource type. \nAllowed enum values: feature-flags

\n
\n \n
\n
\n
\n
" } }, "ListFeatureFlagsEnvironments": { diff --git a/hugo/data/api/v2/CodeExamples.json b/hugo/data/api/v2/CodeExamples.json index 312916faeec..b48c81e3496 100644 --- a/hugo/data/api/v2/CodeExamples.json +++ b/hugo/data/api/v2/CodeExamples.json @@ -801,11 +801,6 @@ "group": "feature_flags", "suffix": "", "description": "Create a feature flag returns \"Created\" response" - }, - { - "group": "feature_flags", - "suffix": "_2426084719", - "description": "Create a feature flag with notification rule targets returns \"Created\" response" } ], "CreateAllocationsForFeatureFlagInEnvironment": [ diff --git a/hugo/data/api/v2/full_spec.yaml b/hugo/data/api/v2/full_spec.yaml index 8a9e72a83b0..8c2052594b8 100644 --- a/hugo/data/api/v2/full_spec.yaml +++ b/hugo/data/api/v2/full_spec.yaml @@ -19330,6 +19330,10 @@ components: CloudWorkloadSecurityAgentRuleAction: description: "The action the rule can perform if triggered" properties: + disabled: + description: "Whether the action is disabled" + example: false + type: boolean filter: description: "SECL expression used to target the container to apply the action on" type: string @@ -19419,6 +19423,10 @@ components: agentConstraint: description: "The version of the Agent" type: string + agent_version: + description: "The version constraint of the Datadog Agent the rule applies to" + example: ">=7.62" + type: string blocking: description: "The blocking policies that the rule belongs to" items: @@ -19458,6 +19466,11 @@ components: description: "Whether the Agent rule is enabled" example: true type: boolean + every: + description: "The rate limiting duration of the Agent rule, in nanoseconds" + example: 60000000000 + format: int64 + type: integer expression: description: "The SECL expression of the Agent rule" example: 'exec.file.name == "sh"' @@ -19468,6 +19481,10 @@ components: description: "A platform filter that the Agent rule is supported on." type: string type: array + group_id: + description: "The group of rules the Agent rule belongs to" + example: "group_id" + type: string monitoring: description: "The monitoring policies that the rule belongs to" items: @@ -24865,26 +24882,6 @@ components: description: The name of the feature flag. example: "Feature Flag ABC123" type: string - notification_rule_query: - description: |- - Query used to determine which change events on this feature flag trigger notifications - to `rule_targets`. Uses Datadog log search syntax (`AND`, `OR`, `NOT`, parentheses) to - match against the `notification_type` facet. - - Supported `notification_type` values for a feature flag are: `flag_enabled_disabled`, - `flag_archived`, `flag_approval_required`, `rollout_started`, `rollout_scheduled`, - `rollout_step_started`, `rollout_paused_guardrail`, `rollout_paused_user`, - `rollout_aborted_guardrail`, `rollout_aborted_user`, `targeting_rule_created`, - `targeting_rule_updated`, `targeting_rule_updated_via_filter`, and - `targeting_rule_deleted`. - example: "notification_type:rollout_started OR notification_type:targeting_rule_updated" - nullable: true - type: string - rule_targets: - description: Targets to notify about changes to this feature flag that match `notification_rule_query`. - items: - $ref: "#/components/schemas/NotificationRuleTarget" - type: array value_type: $ref: "#/components/schemas/ValueType" variants: @@ -71983,109 +71980,6 @@ components: type: string x-enum-varnames: - MANUAL - NotificationRuleTarget: - description: A notification target that receives change alerts for a feature flag. - properties: - configuration: - $ref: "#/components/schemas/NotificationRuleTargetConfiguration" - type: - $ref: "#/components/schemas/NotificationRuleTargetType" - version: - description: Schema version of `configuration`. - example: 1 - format: int64 - type: integer - required: - - type - - version - - configuration - type: object - NotificationRuleTargetConfiguration: - description: "Configuration for a notification target. Which fields apply depends on the target's `type`." - properties: - channel: - description: Slack channel name, for a `SLACK_CHANNEL` target. - example: "#feature-flags" - type: string - channel_id: - description: |- - Slack channel ID for a `SLACK_CHANNEL` target, or Microsoft Teams channel ID - for an `MS_TEAMS_CHANNEL` target. - example: "C0123456789" - type: string - channel_name: - description: Microsoft Teams channel name, for an `MS_TEAMS_CHANNEL` target. - example: "Feature Flags" - type: string - connector_name: - description: Microsoft Teams connector name, for an `MS_TEAMS_CHANNEL` target. - example: "datadog-connector" - type: string - recipient: - $ref: "#/components/schemas/NotificationRuleTargetConfigurationRecipient" - service_name: - description: PagerDuty service name, for a `PAGERDUTY_SERVICE` target. - example: "feature-flags-oncall" - type: string - team_id: - description: Microsoft Teams team ID, for an `MS_TEAMS_CHANNEL` target. - example: "19:abcdef0123456789@thread.tacv2" - type: string - team_name: - description: Microsoft Teams team name, for an `MS_TEAMS_CHANNEL` target. - example: "Engineering" - type: string - tenant_id: - description: Microsoft Teams tenant ID, for an `MS_TEAMS_CHANNEL` target. - example: "72f988bf-86f1-41af-91ab-2d7cd011db47" - type: string - tenant_name: - description: Microsoft Teams tenant name, for an `MS_TEAMS_CHANNEL` target. - example: "Datadog" - type: string - username: - description: Slack username, for a `SLACK_USER` target. - example: "jane.doe" - type: string - webhook_name: - description: Name of the configured webhook, for a `WEBHOOK` target. - example: "feature-flags-webhook" - type: string - workspace: - description: Slack workspace name, for a `SLACK_CHANNEL` or `SLACK_USER` target. - example: "datadoghq" - type: string - workspace_id: - description: Slack workspace ID, for a `SLACK_CHANNEL` target. - example: "T0123456789" - type: string - type: object - NotificationRuleTargetConfigurationRecipient: - description: Recipient for an `EMAIL` target. - properties: - email: - description: Email address to notify. - example: "user@example.com" - type: string - type: object - NotificationRuleTargetType: - description: The type of notification target. - enum: - - "EMAIL" - - "SLACK_CHANNEL" - - "SLACK_USER" - - "WEBHOOK" - - "PAGERDUTY_SERVICE" - - "MS_TEAMS_CHANNEL" - example: "SLACK_CHANNEL" - type: string - x-enum-varnames: - - EMAIL - - SLACK_CHANNEL - - SLACK_USER - - WEBHOOK - - PAGERDUTY_SERVICE - - MS_TEAMS_CHANNEL NotificationRulesListResponse: description: The list of notification rules. properties: