Add user behavior case actions in API spec (#2327)

Co-authored-by: ci.datadog-api-spec <[email protected]>

Author: api-clients-generation-pipeline[bot]

.apigentools-info

@@ -4,13 +4,13 @@
     "spec_versions": {
         "v1": {
             "apigentools_version": "1.6.6",
-            "regenerated": "2025-04-10 11:41:57.737818",
-            "spec_repo_commit": "7f98e0a9"
+            "regenerated": "2025-04-10 18:01:24.451821",
+            "spec_repo_commit": "c0a45137"
         },
         "v2": {
             "apigentools_version": "1.6.6",
-            "regenerated": "2025-04-10 11:41:57.752970",
-            "spec_repo_commit": "7f98e0a9"
+            "regenerated": "2025-04-10 18:01:24.467888",
+            "spec_repo_commit": "c0a45137"
         }
     }
 }

.generator/schemas/v2/openapi.yaml

@@ -27215,6 +27215,7 @@ components:
           $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionType'
       type: object
     SecurityMonitoringRuleCaseActionOptions:
+      additionalProperties: {}
       description: Options for the rule action
       properties:
         duration:
@@ -27223,16 +27224,24 @@ components:
           format: int64
           minimum: 0
           type: integer
+        userBehaviorName:
+          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsUserBehaviorName'
       type: object
+    SecurityMonitoringRuleCaseActionOptionsUserBehaviorName:
+      description: Used with the case action of type 'user_behavior'. The value specified
+        in this field is applied as a risk tag to all users affected by the rule.
+      type: string
     SecurityMonitoringRuleCaseActionType:
       description: The action type.
       enum:
       - block_ip
       - block_user
+      - user_behavior
       type: string
       x-enum-varnames:
       - BLOCK_IP
       - BLOCK_USER
+      - USER_BEHAVIOR
     SecurityMonitoringRuleCaseCreate:
       description: Case when signal is generated.
       properties:

cassettes/features/v2/security_monitoring/Create-a-detection-rule-with-type-application-security-returns-OK-response.frozen

@@ -1 +1 @@
-2025-02-06T16:50:39.787Z
+2025-04-09T15:02:05.047Z

cassettes/features/v2/security_monitoring/Create-a-detection-rule-with-type-application-security-returns-OK-response.yml

@@ -31,6 +31,12 @@
             duration: 900,
           }),
         }),
+        DatadogAPIClient::V2::SecurityMonitoringRuleCaseAction.new({
+          type: DatadogAPIClient::V2::SecurityMonitoringRuleCaseActionType::USER_BEHAVIOR,
+          options: DatadogAPIClient::V2::SecurityMonitoringRuleCaseActionOptions.new({
+            user_behavior_name: "behavior",
+          }),
+        }),
       ],
     }),
   ],

examples/v2/security-monitoring/CreateSecurityMonitoringRule_1965169892.rb

@@ -203,7 +203,7 @@ Feature: Security Monitoring
   @skip-validation @team:DataDog/k9-cloud-security-platform
   Scenario: Create a detection rule with type 'application_security 'returns "OK" response
     Given new "CreateSecurityMonitoringRule" request
-    And body with value {"type":"application_security","name":"{{unique}}_appsec_rule","queries":[{"query":"@appsec.security_activity:business_logic.users.login.failure","aggregation":"count","groupByFields":["service","@http.client_ip"],"distinctFields":[]}],"filters":[],"cases":[{"name":"","status":"info","notifications":[],"condition":"a > 100000","actions":[{"type":"block_ip","options":{"duration":900}}]}],"options":{"keepAlive":3600,"maxSignalDuration":86400,"evaluationWindow":900,"detectionMethod":"threshold"},"isEnabled":true,"message":"Test rule","tags":[],"groupSignalsBy":["service"]}
+    And body with value {"type":"application_security","name":"{{unique}}_appsec_rule","queries":[{"query":"@appsec.security_activity:business_logic.users.login.failure","aggregation":"count","groupByFields":["service","@http.client_ip"],"distinctFields":[]}],"filters":[],"cases":[{"name":"","status":"info","notifications":[],"condition":"a > 100000","actions":[{"type":"block_ip","options":{"duration":900}}, {"type":"user_behavior","options":{"userBehaviorName":"behavior"}}]}],"options":{"keepAlive":3600,"maxSignalDuration":86400,"evaluationWindow":900,"detectionMethod":"threshold"},"isEnabled":true,"message":"Test rule","tags":[],"groupSignalsBy":["service"]}
     When the request is sent
     Then the response status is 200 OK
     And the response "name" is equal to "{{ unique }}_appsec_rule"

features/v2/security_monitoring.feature

@@ -24,21 +24,26 @@ class SecurityMonitoringRuleCaseActionOptions
     # Duration of the action in seconds. 0 indicates no expiration.
     attr_reader :duration
 
+    # Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule.
+    attr_accessor :user_behavior_name
+
     attr_accessor :additional_properties
 
     # Attribute mapping from ruby-style variable name to JSON key.
     # @!visibility private
     def self.attribute_map
       {
-        :'duration' => :'duration'
+        :'duration' => :'duration',
+        :'user_behavior_name' => :'userBehaviorName'
       }
     end
 
     # Attribute type mapping.
     # @!visibility private
     def self.openapi_types
       {
-        :'duration' => :'Integer'
+        :'duration' => :'Integer',
+        :'user_behavior_name' => :'String'
       }
     end
 
@@ -63,6 +68,10 @@ def initialize(attributes = {})
       if attributes.key?(:'duration')
         self.duration = attributes[:'duration']
       end
+
+      if attributes.key?(:'user_behavior_name')
+        self.user_behavior_name = attributes[:'user_behavior_name']
+      end
     end
 
     # Check to see if the all the properties in the model are valid
@@ -110,14 +119,15 @@ def ==(o)
       return true if self.equal?(o)
       self.class == o.class &&
           duration == o.duration &&
+          user_behavior_name == o.user_behavior_name &&
           additional_properties == o.additional_properties
     end
 
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     # @!visibility private
     def hash
-      [duration, additional_properties].hash
+      [duration, user_behavior_name, additional_properties].hash
     end
   end
 end

lib/datadog_api_client/v2/models/security_monitoring_rule_case_action_options.rb

@@ -23,5 +23,6 @@ class SecurityMonitoringRuleCaseActionType
 
     BLOCK_IP = "block_ip".freeze
     BLOCK_USER = "block_user".freeze
+    USER_BEHAVIOR = "user_behavior".freeze
   end
 end