Rule is the Schema for the Rules API. Provides a Datadog Security Monitoring Rule API resource. This can be used to create and manage Datadog security monitoring rules. To change settings for a default rule use datadog_security_default_rule instead.
Type
CRD
Group
securitymonitoring.datadog.upbound.io
Version
v1alpha1
apiVersion: securitymonitoring.datadog.upbound.io/v1alpha1
kind: Rule
RuleSpec defines the desired state of Rule
No description provided.
(Block List, Max: 10) Cases for generating signals. (see below for nested schema) Cases for generating signals.
(List of String) Notification targets for each rule case. Notification targets for each rule case.
(Block List, Max: 1) Options on rules. (see below for nested schema) Options on rules.
(Block List, Max: 1) Options for rules using the impossible travel detection method. (see below for nested schema) Options for rules using the impossible travel detection method.
(Block List, Max: 1) New value rules specific options. (see below for nested schema) New value rules specific options.
party detection method. (see below for nested schema) Options for rules using the third-party detection method.
party cases match. Notification targets for the default rule case, when none of the third-party cases match.
party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert. (see below for nested schema) Queries to be combined with third-party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
(List of String) Fields to group by. If empty, each log triggers a signal. Fields to group by. If empty, each log triggers a signal.
(Block List) Queries for selecting logs which are part of the rule. (see below for nested schema) Queries for selecting logs which are part of the rule.
(Block List, Deprecated) Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource. (see below for nested schema) Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource.
(List of String) Field for which the cardinality is measured. Sent as an array. Field for which the cardinality is measured. Sent as an array.
(List of String) Fields to group by. If empty, each log triggers a signal. Fields to group by.
(List of String) Group of target fields to aggregate over when using the sum, max, geo_data, or new_value aggregations. The sum, max, and geo_data aggregations only accept one value in this list, whereas the new_value aggregation accepts up to five values. Group of target fields to aggregate over when using the sum, max, geo_data, or new_value aggregations. The sum, max, and geo_data aggregations only accept one value in this list, whereas the new_value aggregation accepts up to five values.
(Block List) Queries for selecting logs which are part of the rule. (see below for nested schema) Queries for selecting logs which are part of the rule.
(List of String) Fields to correlate by. Fields to correlate by.
(Set of String) Tags for generated signals. Tags for generated signals.
party rules. Only required and accepted for third-party rules (see below for nested schema) Cases for generating signals for third-party rules. Only required and accepted for third-party rules
(List of String) Notification targets for each rule case. Notification targets for each rule case.
THIS IS A BETA FIELD. It will be honored unless the Management Policies feature flag is disabled. InitProvider holds the same fields as ForProvider, with the exception of Identifier and other resource reference fields. The fields that are in InitProvider are merged into ForProvider when the resource is created. The same fields are also added to the terraform ignore_changes hook, to avoid updating them after creation. This is useful for fields that are required on creation, but we do not desire to update them after creation, for example because of an external controller is managing them, like an autoscaler.
(Block List, Max: 10) Cases for generating signals. (see below for nested schema) Cases for generating signals.
(List of String) Notification targets for each rule case. Notification targets for each rule case.
(Block List, Max: 1) Options on rules. (see below for nested schema) Options on rules.
(Block List, Max: 1) Options for rules using the impossible travel detection method. (see below for nested schema) Options for rules using the impossible travel detection method.
(Block List, Max: 1) New value rules specific options. (see below for nested schema) New value rules specific options.
party detection method. (see below for nested schema) Options for rules using the third-party detection method.
party cases match. Notification targets for the default rule case, when none of the third-party cases match.
party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert. (see below for nested schema) Queries to be combined with third-party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
(List of String) Fields to group by. If empty, each log triggers a signal. Fields to group by. If empty, each log triggers a signal.
(Block List) Queries for selecting logs which are part of the rule. (see below for nested schema) Queries for selecting logs which are part of the rule.
(Block List, Deprecated) Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource. (see below for nested schema) Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource.
(List of String) Field for which the cardinality is measured. Sent as an array. Field for which the cardinality is measured. Sent as an array.
(List of String) Fields to group by. If empty, each log triggers a signal. Fields to group by.
(List of String) Group of target fields to aggregate over when using the sum, max, geo_data, or new_value aggregations. The sum, max, and geo_data aggregations only accept one value in this list, whereas the new_value aggregation accepts up to five values. Group of target fields to aggregate over when using the sum, max, geo_data, or new_value aggregations. The sum, max, and geo_data aggregations only accept one value in this list, whereas the new_value aggregation accepts up to five values.
(Block List) Queries for selecting logs which are part of the rule. (see below for nested schema) Queries for selecting logs which are part of the rule.
(List of String) Fields to correlate by. Fields to correlate by.
(Set of String) Tags for generated signals. Tags for generated signals.
party rules. Only required and accepted for third-party rules (see below for nested schema) Cases for generating signals for third-party rules. Only required and accepted for third-party rules
(List of String) Notification targets for each rule case. Notification targets for each rule case.
THIS IS A BETA FIELD. It is on by default but can be opted out through a Crossplane feature flag. ManagementPolicies specify the array of actions Crossplane is allowed to take on the managed and external resources. This field is planned to replace the DeletionPolicy field in a future release. Currently, both could be set independently and non-default values would be honored if the feature flag is enabled. If both are custom, the DeletionPolicy field will be ignored. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md
ProviderConfigReference specifies how the provider that will be used to create, observe, update, and delete this managed resource should be configured.
Policies for referencing.
PublishConnectionDetailsTo specifies the connection secret config which contains a name, metadata and a reference to secret store config to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource.
WriteConnectionSecretToReference specifies the namespace and name of a Secret to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource. This field is planned to be replaced in a future release in favor of PublishConnectionDetailsTo. Currently, both could be set independently and connection details would be published to both without affecting each other.
RuleStatus defines the observed state of Rule.
No description provided.
(Block List, Max: 10) Cases for generating signals. (see below for nested schema) Cases for generating signals.
(List of String) Notification targets for each rule case. Notification targets for each rule case.
(Block List, Max: 1) Options on rules. (see below for nested schema) Options on rules.
(Block List, Max: 1) Options for rules using the impossible travel detection method. (see below for nested schema) Options for rules using the impossible travel detection method.
(Block List, Max: 1) New value rules specific options. (see below for nested schema) New value rules specific options.
party detection method. (see below for nested schema) Options for rules using the third-party detection method.
party cases match. Notification targets for the default rule case, when none of the third-party cases match.
party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert. (see below for nested schema) Queries to be combined with third-party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
(List of String) Fields to group by. If empty, each log triggers a signal. Fields to group by. If empty, each log triggers a signal.
(Block List) Queries for selecting logs which are part of the rule. (see below for nested schema) Queries for selecting logs which are part of the rule.
(Block List, Deprecated) Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource. (see below for nested schema) Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource.
(List of String) Field for which the cardinality is measured. Sent as an array. Field for which the cardinality is measured. Sent as an array.
(List of String) Fields to group by. If empty, each log triggers a signal. Fields to group by.
(List of String) Group of target fields to aggregate over when using the sum, max, geo_data, or new_value aggregations. The sum, max, and geo_data aggregations only accept one value in this list, whereas the new_value aggregation accepts up to five values. Group of target fields to aggregate over when using the sum, max, geo_data, or new_value aggregations. The sum, max, and geo_data aggregations only accept one value in this list, whereas the new_value aggregation accepts up to five values.
(Block List) Queries for selecting logs which are part of the rule. (see below for nested schema) Queries for selecting logs which are part of the rule.
(List of String) Fields to correlate by. Fields to correlate by.
(Set of String) Tags for generated signals. Tags for generated signals.
party rules. Only required and accepted for third-party rules (see below for nested schema) Cases for generating signals for third-party rules. Only required and accepted for third-party rules
(List of String) Notification targets for each rule case. Notification targets for each rule case.
Conditions of the resource.
myrule
apiVersion: securitymonitoring.datadog.upbound.io/v1alpha1
kind: Rule
metadata:
annotations:
meta.upbound.io/example-id: securitymonitoring/v1alpha1/rule
labels:
testing.upbound.io/example-name: myrule
name: myrule
spec:
forProvider:
case:
- condition: errors > 3 && warnings > 10
notifications:
- "@user"
status: high
enabled: true
message: The rule has triggered.
name: My rule
options:
- evaluationWindow: 300
keepAlive: 600
maxSignalDuration: 900
query:
- aggregation: count
groupByFields:
- host
name: errors
query: status:error
- aggregation: count
groupByFields:
- host
name: warnings
query: status:warning
tags:
- type:dos