Document CSM Threats agent rule action fields

.generator/schemas/v2/openapi.yaml

@@ -19559,6 +19559,8 @@ components:
     CloudWorkloadSecurityAgentRuleAction:
       description: "The action the rule can perform if triggered"
       properties:
+        coredump:
+          $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleActionCoreDump"
         disabled:
           description: "Whether the action is disabled"
           example: false
@@ -19570,17 +19572,51 @@ components:
           $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleActionHash"
         kill:
           $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleKill"
+        log:
+          $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleActionLog"
         metadata:
           $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleActionMetadata"
+        network_filter:
+          $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleActionNetworkFilter"
         set:
           $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleActionSet"
       type: object
+    CloudWorkloadSecurityAgentRuleActionCoreDump:
+      description: "The core dump action applied on the process matching the rule."
+      properties:
+        dentry:
+          description: "Whether the directory entry information is included in the core dump."
+          type: boolean
+        mount:
+          description: "Whether the mount information is included in the core dump."
+          type: boolean
+        no_compression:
+          description: "Whether the core dump is left uncompressed."
+          type: boolean
+        process:
+          description: "Whether the process memory is included in the core dump."
+          type: boolean
+      type: object
     CloudWorkloadSecurityAgentRuleActionHash:
       description: "Hash file specified by the field attribute"
       properties:
         field:
           description: "The field of the hash action"
           type: string
+        max_file_size:
+          description: "The maximum size of the files to hash, in bytes."
+          format: int64
+          type: integer
+      type: object
+    CloudWorkloadSecurityAgentRuleActionLog:
+      description: "The log action applied when the rule is triggered."
+      properties:
+        level:
+          description: "The level of the log action."
+          type: string
+        message:
+          description: "The message of the log action."
+          type: string
       type: object
     CloudWorkloadSecurityAgentRuleActionMetadata:
       description: "The metadata action applied on the scope matching the rule"
@@ -19595,6 +19631,19 @@ components:
           description: "The short image of the metadata action"
           type: string
       type: object
+    CloudWorkloadSecurityAgentRuleActionNetworkFilter:
+      description: "The network filter action applied on the network traffic matching the rule."
+      properties:
+        filter:
+          description: "The filter expression of the network filter action."
+          type: string
+        policy:
+          description: "The policy of the network filter action."
+          type: string
+        scope:
+          description: "The scope of the network filter action."
+          type: string
+      type: object
     CloudWorkloadSecurityAgentRuleActionSet:
       description: "The set action applied on the scope matching the rule"
       properties:
@@ -19616,9 +19665,15 @@ components:
         name:
           description: "The name of the set action"
           type: string
+        private:
+          description: "Whether the value of the set action is private."
+          type: boolean
         scope:
           description: "The scope of the set action."
           type: string
+        scope_field:
+          description: "The scope field of the set action."
+          type: string
         size:
           description: "The size of the set action."
           format: int64
@@ -19873,6 +19928,15 @@ components:
     CloudWorkloadSecurityAgentRuleKill:
       description: "Kill system call applied on the container matching the rule"
       properties:
+        disable_container_disarmer:
+          description: "Whether the automatic container safeguard of the kill action is disabled."
+          type: boolean
+        disable_executable_disarmer:
+          description: "Whether the automatic executable safeguard of the kill action is disabled."
+          type: boolean
+        scope:
+          description: "The scope of the kill action."
+          type: string
         signal:
           description: "Supported signals for the kill system call"
           type: string

src/datadog_api_client/v2/model/cloud_workload_security_agent_rule_action.py

@@ -14,13 +14,22 @@
 
 
 if TYPE_CHECKING:
+    from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_core_dump import (
+        CloudWorkloadSecurityAgentRuleActionCoreDump,
+    )
     from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_hash import (
         CloudWorkloadSecurityAgentRuleActionHash,
     )
     from datadog_api_client.v2.model.cloud_workload_security_agent_rule_kill import CloudWorkloadSecurityAgentRuleKill
+    from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_log import (
+        CloudWorkloadSecurityAgentRuleActionLog,
+    )
     from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_metadata import (
         CloudWorkloadSecurityAgentRuleActionMetadata,
     )
+    from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_network_filter import (
+        CloudWorkloadSecurityAgentRuleActionNetworkFilter,
+    )
     from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_set import (
         CloudWorkloadSecurityAgentRuleActionSet,
     )
@@ -29,50 +38,71 @@
 class CloudWorkloadSecurityAgentRuleAction(ModelNormal):
     @cached_property
     def openapi_types(_):
+        from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_core_dump import (
+            CloudWorkloadSecurityAgentRuleActionCoreDump,
+        )
         from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_hash import (
             CloudWorkloadSecurityAgentRuleActionHash,
         )
         from datadog_api_client.v2.model.cloud_workload_security_agent_rule_kill import (
             CloudWorkloadSecurityAgentRuleKill,
         )
+        from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_log import (
+            CloudWorkloadSecurityAgentRuleActionLog,
+        )
         from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_metadata import (
             CloudWorkloadSecurityAgentRuleActionMetadata,
         )
+        from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_network_filter import (
+            CloudWorkloadSecurityAgentRuleActionNetworkFilter,
+        )
         from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_set import (
             CloudWorkloadSecurityAgentRuleActionSet,
         )
 
         return {
+            "coredump": (CloudWorkloadSecurityAgentRuleActionCoreDump,),
             "disabled": (bool,),
             "filter": (str,),
             "hash": (CloudWorkloadSecurityAgentRuleActionHash,),
             "kill": (CloudWorkloadSecurityAgentRuleKill,),
+            "log": (CloudWorkloadSecurityAgentRuleActionLog,),
             "metadata": (CloudWorkloadSecurityAgentRuleActionMetadata,),
+            "network_filter": (CloudWorkloadSecurityAgentRuleActionNetworkFilter,),
             "set": (CloudWorkloadSecurityAgentRuleActionSet,),
         }
 
     attribute_map = {
+        "coredump": "coredump",
         "disabled": "disabled",
         "filter": "filter",
         "hash": "hash",
         "kill": "kill",
+        "log": "log",
         "metadata": "metadata",
+        "network_filter": "network_filter",
         "set": "set",
     }
 
     def __init__(
         self_,
+        coredump: Union[CloudWorkloadSecurityAgentRuleActionCoreDump, UnsetType] = unset,
         disabled: Union[bool, UnsetType] = unset,
         filter: Union[str, UnsetType] = unset,
         hash: Union[CloudWorkloadSecurityAgentRuleActionHash, UnsetType] = unset,
         kill: Union[CloudWorkloadSecurityAgentRuleKill, UnsetType] = unset,
+        log: Union[CloudWorkloadSecurityAgentRuleActionLog, UnsetType] = unset,
         metadata: Union[CloudWorkloadSecurityAgentRuleActionMetadata, UnsetType] = unset,
+        network_filter: Union[CloudWorkloadSecurityAgentRuleActionNetworkFilter, UnsetType] = unset,
         set: Union[CloudWorkloadSecurityAgentRuleActionSet, UnsetType] = unset,
         **kwargs,
     ):
         """
         The action the rule can perform if triggered
 
+        :param coredump: The core dump action applied on the process matching the rule.
+        :type coredump: CloudWorkloadSecurityAgentRuleActionCoreDump, optional
+
         :param disabled: Whether the action is disabled
         :type disabled: bool, optional
 
@@ -85,12 +115,20 @@ def __init__(
         :param kill: Kill system call applied on the container matching the rule
         :type kill: CloudWorkloadSecurityAgentRuleKill, optional
 
+        :param log: The log action applied when the rule is triggered.
+        :type log: CloudWorkloadSecurityAgentRuleActionLog, optional
+
         :param metadata: The metadata action applied on the scope matching the rule
         :type metadata: CloudWorkloadSecurityAgentRuleActionMetadata, optional
 
+        :param network_filter: The network filter action applied on the network traffic matching the rule.
+        :type network_filter: CloudWorkloadSecurityAgentRuleActionNetworkFilter, optional
+
         :param set: The set action applied on the scope matching the rule
         :type set: CloudWorkloadSecurityAgentRuleActionSet, optional
         """
+        if coredump is not unset:
+            kwargs["coredump"] = coredump
         if disabled is not unset:
             kwargs["disabled"] = disabled
         if filter is not unset:
@@ -99,8 +137,12 @@ def __init__(
             kwargs["hash"] = hash
         if kill is not unset:
             kwargs["kill"] = kill
+        if log is not unset:
+            kwargs["log"] = log
         if metadata is not unset:
             kwargs["metadata"] = metadata
+        if network_filter is not unset:
+            kwargs["network_filter"] = network_filter
         if set is not unset:
             kwargs["set"] = set
         super().__init__(kwargs)

src/datadog_api_client/v2/model/cloud_workload_security_agent_rule_action_core_dump.py

@@ -0,0 +1,64 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+# This product includes software developed at Datadog (https://www.datadoghq.com/).
+# Copyright 2019-Present Datadog, Inc.
+from __future__ import annotations
+
+from typing import Union
+
+from datadog_api_client.model_utils import (
+    ModelNormal,
+    cached_property,
+    unset,
+    UnsetType,
+)
+
+
+class CloudWorkloadSecurityAgentRuleActionCoreDump(ModelNormal):
+    @cached_property
+    def openapi_types(_):
+        return {
+            "dentry": (bool,),
+            "mount": (bool,),
+            "no_compression": (bool,),
+            "process": (bool,),
+        }
+
+    attribute_map = {
+        "dentry": "dentry",
+        "mount": "mount",
+        "no_compression": "no_compression",
+        "process": "process",
+    }
+
+    def __init__(
+        self_,
+        dentry: Union[bool, UnsetType] = unset,
+        mount: Union[bool, UnsetType] = unset,
+        no_compression: Union[bool, UnsetType] = unset,
+        process: Union[bool, UnsetType] = unset,
+        **kwargs,
+    ):
+        """
+        The core dump action applied on the process matching the rule.
+
+        :param dentry: Whether the directory entry information is included in the core dump.
+        :type dentry: bool, optional
+
+        :param mount: Whether the mount information is included in the core dump.
+        :type mount: bool, optional
+
+        :param no_compression: Whether the core dump is left uncompressed.
+        :type no_compression: bool, optional
+
+        :param process: Whether the process memory is included in the core dump.
+        :type process: bool, optional
+        """
+        if dentry is not unset:
+            kwargs["dentry"] = dentry
+        if mount is not unset:
+            kwargs["mount"] = mount
+        if no_compression is not unset:
+            kwargs["no_compression"] = no_compression
+        if process is not unset:
+            kwargs["process"] = process
+        super().__init__(kwargs)

src/datadog_api_client/v2/model/cloud_workload_security_agent_rule_action_hash.py

@@ -18,19 +18,26 @@ class CloudWorkloadSecurityAgentRuleActionHash(ModelNormal):
     def openapi_types(_):
         return {
             "field": (str,),
+            "max_file_size": (int,),
         }
 
     attribute_map = {
         "field": "field",
+        "max_file_size": "max_file_size",
     }
 
-    def __init__(self_, field: Union[str, UnsetType] = unset, **kwargs):
+    def __init__(self_, field: Union[str, UnsetType] = unset, max_file_size: Union[int, UnsetType] = unset, **kwargs):
         """
         Hash file specified by the field attribute
 
         :param field: The field of the hash action
         :type field: str, optional
+
+        :param max_file_size: The maximum size of the files to hash, in bytes.
+        :type max_file_size: int, optional
         """
         if field is not unset:
             kwargs["field"] = field
+        if max_file_size is not unset:
+            kwargs["max_file_size"] = max_file_size
         super().__init__(kwargs)

src/datadog_api_client/v2/model/cloud_workload_security_agent_rule_action_log.py

@@ -0,0 +1,43 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+# This product includes software developed at Datadog (https://www.datadoghq.com/).
+# Copyright 2019-Present Datadog, Inc.
+from __future__ import annotations
+
+from typing import Union
+
+from datadog_api_client.model_utils import (
+    ModelNormal,
+    cached_property,
+    unset,
+    UnsetType,
+)
+
+
+class CloudWorkloadSecurityAgentRuleActionLog(ModelNormal):
+    @cached_property
+    def openapi_types(_):
+        return {
+            "level": (str,),
+            "message": (str,),
+        }
+
+    attribute_map = {
+        "level": "level",
+        "message": "message",
+    }
+
+    def __init__(self_, level: Union[str, UnsetType] = unset, message: Union[str, UnsetType] = unset, **kwargs):
+        """
+        The log action applied when the rule is triggered.
+
+        :param level: The level of the log action.
+        :type level: str, optional
+
+        :param message: The message of the log action.
+        :type message: str, optional
+        """
+        if level is not unset:
+            kwargs["level"] = level
+        if message is not unset:
+            kwargs["message"] = message
+        super().__init__(kwargs)