@@ -58459,6 +58459,155 @@ components:
5845958459 description: Version of the updated signal. If server side version is higher, update will be rejected.
5846058460 format: int64
5846158461 type: integer
58462+ SecurityMonitoringSignalsBulkAssigneeUpdateAttributes:
58463+ description: Attributes describing the new assignee for a bulk signal update.
58464+ properties:
58465+ assignee:
58466+ description: UUID of the user to assign to the signal. Use an empty string to unassign.
58467+ example: 773b045d-ccf8-4808-bd3b-955ef6a8c940
58468+ type: string
58469+ version:
58470+ $ref: "#/components/schemas/SecurityMonitoringSignalVersion"
58471+ required:
58472+ - assignee
58473+ type: object
58474+ SecurityMonitoringSignalsBulkAssigneeUpdateData:
58475+ description: Data for a bulk assignee update of a security signal.
58476+ properties:
58477+ attributes:
58478+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkAssigneeUpdateAttributes"
58479+ id:
58480+ description: The unique ID of the security signal.
58481+ example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
58482+ type: string
58483+ type:
58484+ $ref: "#/components/schemas/SecurityMonitoringSignalType"
58485+ required:
58486+ - id
58487+ - attributes
58488+ type: object
58489+ SecurityMonitoringSignalsBulkAssigneeUpdateRequest:
58490+ description: Request body for updating the assignee of multiple security signals.
58491+ properties:
58492+ data:
58493+ description: An array of signal assignee updates.
58494+ items:
58495+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkAssigneeUpdateData"
58496+ maxItems: 199
58497+ type: array
58498+ required:
58499+ - data
58500+ type: object
58501+ SecurityMonitoringSignalsBulkStateUpdateData:
58502+ description: Data for a bulk state update of a security signal.
58503+ properties:
58504+ attributes:
58505+ $ref: "#/components/schemas/SecurityMonitoringSignalStateUpdateAttributes"
58506+ id:
58507+ description: The unique ID of the security signal.
58508+ example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
58509+ type: string
58510+ type:
58511+ $ref: "#/components/schemas/SecurityMonitoringSignalType"
58512+ required:
58513+ - id
58514+ - attributes
58515+ type: object
58516+ SecurityMonitoringSignalsBulkStateUpdateRequest:
58517+ description: Request body for updating the triage state of multiple security signals.
58518+ properties:
58519+ data:
58520+ description: An array of signal state updates.
58521+ items:
58522+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkStateUpdateData"
58523+ maxItems: 199
58524+ type: array
58525+ required:
58526+ - data
58527+ type: object
58528+ SecurityMonitoringSignalsBulkTriageEvent:
58529+ description: A single signal event entry in a bulk triage update response.
58530+ properties:
58531+ event:
58532+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageEventAttributes"
58533+ id:
58534+ description: The unique ID of the security signal.
58535+ example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
58536+ type: string
58537+ required:
58538+ - id
58539+ - event
58540+ type: object
58541+ SecurityMonitoringSignalsBulkTriageEventAttributes:
58542+ description: Triage attributes of a security signal returned in a bulk update response.
58543+ properties:
58544+ archive_comment:
58545+ $ref: "#/components/schemas/SecurityMonitoringSignalArchiveComment"
58546+ archive_comment_timestamp:
58547+ description: Timestamp of the last edit to the archive comment.
58548+ format: int64
58549+ type: integer
58550+ archive_comment_user:
58551+ $ref: "#/components/schemas/SecurityMonitoringTriageUser"
58552+ archive_reason:
58553+ $ref: "#/components/schemas/SecurityMonitoringSignalArchiveReason"
58554+ assignee:
58555+ $ref: "#/components/schemas/SecurityMonitoringTriageUser"
58556+ id:
58557+ description: The unique ID of the security signal.
58558+ example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
58559+ type: string
58560+ incident_ids:
58561+ $ref: "#/components/schemas/SecurityMonitoringSignalIncidentIds"
58562+ state:
58563+ $ref: "#/components/schemas/SecurityMonitoringSignalState"
58564+ state_update_timestamp:
58565+ description: Timestamp of the last state update.
58566+ format: int64
58567+ type: integer
58568+ state_update_user:
58569+ $ref: "#/components/schemas/SecurityMonitoringTriageUser"
58570+ required:
58571+ - id
58572+ - state
58573+ - assignee
58574+ - incident_ids
58575+ type: object
58576+ SecurityMonitoringSignalsBulkTriageUpdateResponse:
58577+ description: Response for a bulk triage update of security signals.
58578+ properties:
58579+ result:
58580+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageUpdateResult"
58581+ status:
58582+ description: The status of the bulk operation.
58583+ example: done
58584+ type: string
58585+ type:
58586+ description: The type of the response.
58587+ example: status
58588+ type: string
58589+ required:
58590+ - type
58591+ - status
58592+ - result
58593+ type: object
58594+ SecurityMonitoringSignalsBulkTriageUpdateResult:
58595+ description: The result payload of a bulk signal triage update.
58596+ properties:
58597+ count:
58598+ description: The number of signals updated.
58599+ example: 2
58600+ format: int64
58601+ type: integer
58602+ events:
58603+ description: The list of updated signals.
58604+ items:
58605+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageEvent"
58606+ type: array
58607+ required:
58608+ - count
58609+ - events
58610+ type: object
5846258611 SecurityMonitoringSignalsListResponse:
5846358612 description: "The response object with all security signals matching the request\nand pagination information."
5846458613 properties:
@@ -102019,6 +102168,94 @@ paths:
102019102168 operator: OR
102020102169 permissions:
102021102170 - security_monitoring_signals_read
102171+ /api/v2/security_monitoring/signals/bulk/assignee:
102172+ patch:
102173+ description: |-
102174+ Change the triage assignee of multiple security signals at once.
102175+ The maximum number of signals that can be updated in a single request is 199.
102176+ operationId: BulkEditSecurityMonitoringSignalsAssignee
102177+ requestBody:
102178+ content:
102179+ application/json:
102180+ schema:
102181+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkAssigneeUpdateRequest"
102182+ description: Attributes describing the signals assignee updates.
102183+ required: true
102184+ responses:
102185+ "200":
102186+ content:
102187+ application/json:
102188+ schema:
102189+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageUpdateResponse"
102190+ description: OK
102191+ "400":
102192+ content:
102193+ application/json:
102194+ schema:
102195+ $ref: "#/components/schemas/JSONAPIErrorResponse"
102196+ description: Bad Request
102197+ "403":
102198+ content:
102199+ application/json:
102200+ schema:
102201+ $ref: "#/components/schemas/JSONAPIErrorResponse"
102202+ description: Forbidden
102203+ "429":
102204+ $ref: "#/components/responses/TooManyRequestsResponse"
102205+ summary: Bulk update triage assignee of security signals
102206+ tags: ["Security Monitoring"]
102207+ x-codegen-request-body-name: body
102208+ "x-permission":
102209+ operator: OR
102210+ permissions:
102211+ - security_monitoring_signals_write
102212+ x-unstable: |-
102213+ **Note**: This endpoint is in preview and is subject to change.
102214+ If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
102215+ /api/v2/security_monitoring/signals/bulk/state:
102216+ patch:
102217+ description: |-
102218+ Change the triage state of multiple security signals at once.
102219+ The maximum number of signals that can be updated in a single request is 199.
102220+ operationId: BulkEditSecurityMonitoringSignalsState
102221+ requestBody:
102222+ content:
102223+ application/json:
102224+ schema:
102225+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkStateUpdateRequest"
102226+ description: Attributes describing the signals state updates.
102227+ required: true
102228+ responses:
102229+ "200":
102230+ content:
102231+ application/json:
102232+ schema:
102233+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageUpdateResponse"
102234+ description: OK
102235+ "400":
102236+ content:
102237+ application/json:
102238+ schema:
102239+ $ref: "#/components/schemas/JSONAPIErrorResponse"
102240+ description: Bad Request
102241+ "403":
102242+ content:
102243+ application/json:
102244+ schema:
102245+ $ref: "#/components/schemas/JSONAPIErrorResponse"
102246+ description: Forbidden
102247+ "429":
102248+ $ref: "#/components/responses/TooManyRequestsResponse"
102249+ summary: Bulk update triage state of security signals
102250+ tags: ["Security Monitoring"]
102251+ x-codegen-request-body-name: body
102252+ "x-permission":
102253+ operator: OR
102254+ permissions:
102255+ - security_monitoring_signals_write
102256+ x-unstable: |-
102257+ **Note**: This endpoint is in preview and is subject to change.
102258+ If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
102022102259 /api/v2/security_monitoring/signals/search:
102023102260 post:
102024102261 description: |-
0 commit comments