From cbac966a3549df9d9cc08fa62c8d85bf99224f40 Mon Sep 17 00:00:00 2001 From: "ci.datadog-api-spec" Date: Thu, 30 Jul 2026 12:54:59 +0000 Subject: [PATCH] Regenerate client from commit f78c3c2 of spec repo --- .generator/schemas/v2/openapi.yaml | 333 ++++++++++++++++++ .../frozen.json | 1 + .../recording.har | 72 ++++ features/v2/threat_intelligence.feature | 37 ++ features/v2/undo.json | 6 + packages/datadog-api-client/README.md | 1 + .../src/support/scenarios_model_mapping.ts | 15 + services/threat_intelligence/.yarnrc.yml | 1 + services/threat_intelligence/README.md | 44 +++ services/threat_intelligence/package.json | 43 +++ services/threat_intelligence/src/index.ts | 3 + .../src/v2/ThreatIntelligenceApi.ts | 253 +++++++++++++ services/threat_intelligence/src/v2/index.ts | 17 + .../src/v2/models/APIErrorResponse.ts | 45 +++ .../src/v2/models/STIXBundleRequest.ts | 75 ++++ .../src/v2/models/STIXBundleType.ts | 7 + .../src/v2/models/STIXContentEncoding.ts | 7 + .../src/v2/models/STIXIndicatorObject.ts | 181 ++++++++++ .../src/v2/models/STIXIndicatorType.ts | 7 + .../src/v2/models/STIXIngestResponse.ts | 47 +++ .../v2/models/STIXIngestResponseAttributes.ts | 66 ++++ .../src/v2/models/STIXIngestResponseData.ts | 66 ++++ .../src/v2/models/STIXIngestResponseType.ts | 9 + .../src/v2/models/STIXPatternType.ts | 7 + .../src/v2/models/STIXSpecVersion.ts | 7 + .../src/v2/models/TypingInfo.ts | 28 ++ services/threat_intelligence/tsconfig.json | 28 ++ yarn.lock | 9 + 28 files changed, 1415 insertions(+) create mode 100644 cassettes/v2/Threat-Intelligence_463494544/Ingest-STIX-threat-intelligence-returns-OK-response_1012538104/frozen.json create mode 100644 cassettes/v2/Threat-Intelligence_463494544/Ingest-STIX-threat-intelligence-returns-OK-response_1012538104/recording.har create mode 100644 features/v2/threat_intelligence.feature create mode 100644 services/threat_intelligence/.yarnrc.yml create mode 100644 services/threat_intelligence/README.md create mode 100644 services/threat_intelligence/package.json create mode 100644 services/threat_intelligence/src/index.ts create mode 100644 services/threat_intelligence/src/v2/ThreatIntelligenceApi.ts create mode 100644 services/threat_intelligence/src/v2/index.ts create mode 100644 services/threat_intelligence/src/v2/models/APIErrorResponse.ts create mode 100644 services/threat_intelligence/src/v2/models/STIXBundleRequest.ts create mode 100644 services/threat_intelligence/src/v2/models/STIXBundleType.ts create mode 100644 services/threat_intelligence/src/v2/models/STIXContentEncoding.ts create mode 100644 services/threat_intelligence/src/v2/models/STIXIndicatorObject.ts create mode 100644 services/threat_intelligence/src/v2/models/STIXIndicatorType.ts create mode 100644 services/threat_intelligence/src/v2/models/STIXIngestResponse.ts create mode 100644 services/threat_intelligence/src/v2/models/STIXIngestResponseAttributes.ts create mode 100644 services/threat_intelligence/src/v2/models/STIXIngestResponseData.ts create mode 100644 services/threat_intelligence/src/v2/models/STIXIngestResponseType.ts create mode 100644 services/threat_intelligence/src/v2/models/STIXPatternType.ts create mode 100644 services/threat_intelligence/src/v2/models/STIXSpecVersion.ts create mode 100644 services/threat_intelligence/src/v2/models/TypingInfo.ts create mode 100644 services/threat_intelligence/tsconfig.json diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml index 93f9955949ca..82d06afee8bd 100644 --- a/.generator/schemas/v2/openapi.yaml +++ b/.generator/schemas/v2/openapi.yaml @@ -86990,6 +86990,229 @@ components: example: "report_id" type: string type: object + STIXBundleRequest: + additionalProperties: {} + description: A STIX 2.1 bundle containing threat intelligence indicator objects. + properties: + id: + description: The STIX bundle identifier. + example: bundle--11111111-1111-4111-8111-111111111111 + type: string + objects: + description: The indicator objects included in the bundle. + example: + - created: "2026-07-22T12:00:00Z" + id: indicator--22222222-2222-4222-8222-222222222222 + modified: "2026-07-22T12:00:00Z" + pattern: "[ipv4-addr:value = '198.51.100.42']" + pattern_type: stix + spec_version: "2.1" + type: indicator + valid_from: "2026-07-22T12:00:00Z" + items: + $ref: "#/components/schemas/STIXIndicatorObject" + type: array + spec_version: + $ref: "#/components/schemas/STIXSpecVersion" + type: + $ref: "#/components/schemas/STIXBundleType" + required: + - type + - id + - objects + type: object + STIXBundleType: + description: The STIX object type for a bundle. + enum: + - bundle + example: bundle + type: string + x-enum-varnames: + - BUNDLE + STIXContentEncoding: + description: The content encoding applied to the request body. + enum: + - gzip + example: gzip + type: string + x-enum-varnames: + - GZIP + STIXIndicatorObject: + additionalProperties: {} + description: A STIX 2.1 indicator object. + properties: + confidence: + description: The confidence in the correctness of the indicator, from 0 through 100. + example: 80 + format: int32 + maximum: 100 + minimum: 0 + type: integer + created: + description: The time when the indicator was created. + example: "2026-07-22T12:00:00Z" + format: date-time + type: string + external_references: + description: Optional external reference metadata preserved with the indicator but not interpreted during ingestion. + items: + $ref: "#/components/schemas/STIXMetadataObject" + type: array + id: + description: The STIX indicator identifier. + example: indicator--22222222-2222-4222-8222-222222222222 + type: string + indicator_types: + description: The open vocabulary terms that categorize the indicator. + example: + - malicious-activity + items: + type: string + type: array + kill_chain_phases: + description: Optional kill chain metadata preserved with the indicator but not interpreted during ingestion. + items: + $ref: "#/components/schemas/STIXMetadataObject" + type: array + labels: + description: Labels associated with the indicator. + example: + - synthetic + items: + type: string + type: array + modified: + description: The time when the indicator was last modified. + example: "2026-07-22T12:00:00Z" + format: date-time + type: string + object_marking_refs: + description: References to marking definition objects that apply to the indicator. + example: + - marking-definition--33333333-3333-4333-8333-333333333333 + items: + type: string + type: array + pattern: + description: The STIX pattern that identifies the observable. + example: "[ipv4-addr:value = '198.51.100.42']" + type: string + pattern_type: + $ref: "#/components/schemas/STIXPatternType" + revoked: + description: Whether the indicator has been revoked. + example: false + type: boolean + spec_version: + $ref: "#/components/schemas/STIXSpecVersion" + type: + $ref: "#/components/schemas/STIXIndicatorType" + valid_from: + description: The time from which the indicator is considered valid. + example: "2026-07-22T12:00:00Z" + format: date-time + type: string + valid_until: + description: The time until which the indicator is considered valid. + example: "2027-07-22T12:00:00Z" + format: date-time + type: string + required: + - type + - id + - spec_version + - created + - modified + - pattern + - pattern_type + - valid_from + type: object + STIXIndicatorType: + description: The STIX object type for an indicator. + enum: + - indicator + example: indicator + type: string + x-enum-varnames: + - INDICATOR + STIXIngestResponse: + description: The response from a completed STIX ingestion request. + properties: + data: + $ref: "#/components/schemas/STIXIngestResponseData" + required: + - data + type: object + STIXIngestResponseAttributes: + description: Counters describing the result of the STIX ingestion request. + properties: + added: + description: The number of supported indicators added. + example: 1 + format: int64 + minimum: 0 + type: integer + invalid: + description: The number of indicators with patterns that could not be parsed. + example: 0 + format: int64 + minimum: 0 + type: integer + unsupported: + description: The number of unsupported objects or patterns. + example: 0 + format: int64 + minimum: 0 + type: integer + required: + - added + - unsupported + - invalid + type: object + STIXIngestResponseData: + description: The JSON:API resource describing the completed STIX ingestion request. + properties: + attributes: + $ref: "#/components/schemas/STIXIngestResponseAttributes" + id: + description: The normalized vendor identifier. + example: acme + type: string + type: + $ref: "#/components/schemas/STIXIngestResponseType" + required: + - type + - id + - attributes + type: object + STIXIngestResponseType: + description: The STIX ingestion resource type. + enum: + - threat-intel-stix-ingest + example: threat-intel-stix-ingest + type: string + x-enum-varnames: + - THREAT_INTEL_STIX_INGEST + STIXMetadataObject: + additionalProperties: {} + description: An opaque STIX metadata object. + type: object + STIXPatternType: + description: The supported STIX pattern language. + enum: + - stix + example: stix + type: string + x-enum-varnames: + - STIX + STIXSpecVersion: + description: The supported STIX specification version. + enum: + - "2.1" + example: "2.1" + type: string + x-enum-varnames: + - VERSION_2_1 SalesforceIncidentsOrganizationResponseAttributes: description: Attributes of a Salesforce organization connected to the Datadog Salesforce integration. properties: @@ -183557,6 +183780,114 @@ paths: operator: OR permissions: - security_monitoring_notification_profiles_write + /api/v2/security/threat-intel/stix: + post: + description: |- + Ingest a STIX 2.1 bundle containing threat intelligence indicators. Only indicator objects are supported. Supported indicator patterns contain IPv4 addresses, IPv6 addresses, domain names, or SHA-256 file hashes. + + Unsupported objects and patterns increment the `unsupported` counter. Patterns that cannot be parsed increment the `invalid` counter. Processing is best effort, so valid supported indicators in the same bundle are still added. + + A successful response means ingestion has completed. Reference-table materialization and enrichment happen asynchronously. Requests are limited to 50 MB and 10 requests per second per API key. Gzip-compressed request bodies are supported. + operationId: IngestStixThreatIntel + parameters: + - description: >- + Vendor identifier for the feed. The value must not exceed 10 characters. Datadog normalizes the accepted value to lowercase, converts non-alphanumeric characters to underscores, and trims leading and trailing underscores. + example: acme + in: header + name: ti_vendor + required: true + schema: + maxLength: 10 + minLength: 1 + type: string + - description: Content encoding for the request body. Use gzip for a compressed STIX bundle. + in: header + name: Content-Encoding + required: false + schema: + $ref: "#/components/schemas/STIXContentEncoding" + requestBody: + content: + application/json: + examples: + default: + value: + id: bundle--11111111-1111-4111-8111-111111111111 + objects: + - created: "2026-07-22T12:00:00Z" + id: indicator--22222222-2222-4222-8222-222222222222 + modified: "2026-07-22T12:00:00Z" + pattern: "[ipv4-addr:value = '198.51.100.42']" + pattern_type: stix + spec_version: "2.1" + type: indicator + valid_from: "2026-07-22T12:00:00Z" + spec_version: "2.1" + type: bundle + schema: + $ref: "#/components/schemas/STIXBundleRequest" + description: >- + A STIX 2.1 bundle containing indicator objects. The maximum request size is 50 MB. When `Content-Encoding: gzip` is used, the limit applies to the compressed bytes received. + required: true + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + attributes: + added: 1 + invalid: 0 + unsupported: 0 + id: acme + type: threat-intel-stix-ingest + schema: + $ref: "#/components/schemas/STIXIngestResponse" + description: OK + "400": + $ref: "#/components/responses/BadRequestResponse" + "401": + $ref: "#/components/responses/UnauthorizedResponse" + "403": + $ref: "#/components/responses/ForbiddenResponse" + "413": + content: + application/json: + schema: + $ref: "#/components/schemas/APIErrorResponse" + description: Payload Too Large + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + "502": + content: + application/json: + schema: + $ref: "#/components/schemas/APIErrorResponse" + description: Bad Gateway + "503": + content: + application/json: + schema: + $ref: "#/components/schemas/APIErrorResponse" + description: Service Unavailable + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - reference_tables_write + summary: Ingest STIX threat intelligence + tags: + - Threat Intelligence + x-codegen-request-body-name: body + x-permission: + operator: OR + permissions: + - reference_tables_write + x-unstable: |- + **Note**: This endpoint is in preview and is subject to change. + If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/vulnerabilities: get: deprecated: true @@ -206730,6 +207061,8 @@ tags: - description: |- Search and manage flaky tests through Test Optimization. See the [Test Optimization page](https://docs.datadoghq.com/tests/) for more information. name: Test Optimization + - description: Ingest and manage threat intelligence data for security enrichment and investigation. + name: Threat Intelligence - description: |- The usage metering API allows you to get hourly, daily, and monthly usage across multiple facets of Datadog. diff --git a/cassettes/v2/Threat-Intelligence_463494544/Ingest-STIX-threat-intelligence-returns-OK-response_1012538104/frozen.json b/cassettes/v2/Threat-Intelligence_463494544/Ingest-STIX-threat-intelligence-returns-OK-response_1012538104/frozen.json new file mode 100644 index 000000000000..fad08fc9cf71 --- /dev/null +++ b/cassettes/v2/Threat-Intelligence_463494544/Ingest-STIX-threat-intelligence-returns-OK-response_1012538104/frozen.json @@ -0,0 +1 @@ +"2026-07-24T13:40:34.989Z" diff --git a/cassettes/v2/Threat-Intelligence_463494544/Ingest-STIX-threat-intelligence-returns-OK-response_1012538104/recording.har b/cassettes/v2/Threat-Intelligence_463494544/Ingest-STIX-threat-intelligence-returns-OK-response_1012538104/recording.har new file mode 100644 index 000000000000..9c23a69ddf02 --- /dev/null +++ b/cassettes/v2/Threat-Intelligence_463494544/Ingest-STIX-threat-intelligence-returns-OK-response_1012538104/recording.har @@ -0,0 +1,72 @@ +{ + "log": { + "_recordingName": "Threat Intelligence/Ingest STIX threat intelligence returns \"OK\" response", + "creator": { + "comment": "persister:fs", + "name": "Polly.JS", + "version": "6.0.5" + }, + "entries": [ + { + "_id": "58a1d097671e244074458fc1e14fa3f0", + "_order": 0, + "cache": {}, + "request": { + "bodySize": 372, + "cookies": [], + "headers": [ + { + "_fromType": "array", + "name": "accept", + "value": "application/json" + }, + { + "_fromType": "array", + "name": "content-type", + "value": "application/json" + }, + { + "_fromType": "array", + "name": "ti_vendor", + "value": "Acme-Inc" + } + ], + "headersSize": 624, + "httpVersion": "HTTP/1.1", + "method": "POST", + "postData": { + "mimeType": "application/json", + "params": [], + "text": "{\"id\":\"bundle--44444444-4444-4444-8444-444444444444\",\"objects\":[{\"created\":\"2026-07-22T12:00:00Z\",\"id\":\"indicator--55555555-5555-4555-8555-555555555555\",\"modified\":\"2026-07-22T12:00:00Z\",\"pattern\":\"[ipv4-addr:value = '198.51.100.42']\",\"pattern_type\":\"stix\",\"spec_version\":\"2.1\",\"type\":\"indicator\",\"valid_from\":\"2026-07-22T12:00:00Z\"}],\"spec_version\":\"2.1\",\"type\":\"bundle\"}" + }, + "queryString": [], + "url": "https://api.datadoghq.com/api/v2/security/threat-intel/stix" + }, + "response": { + "bodySize": 113, + "content": { + "mimeType": "application/vnd.api+json", + "size": 113, + "text": "{\"data\":{\"id\":\"acme_inc\",\"type\":\"threat-intel-stix-ingest\",\"attributes\":{\"added\":1,\"invalid\":0,\"unsupported\":0}}}" + }, + "cookies": [], + "headers": [ + { + "name": "content-type", + "value": "application/vnd.api+json" + } + ], + "headersSize": 523, + "httpVersion": "HTTP/1.1", + "redirectURL": "", + "status": 200, + "statusText": "OK" + }, + "startedDateTime": "2026-07-24T13:40:34.997Z", + "time": 429 + } + ], + "pages": [], + "version": "1.2" + } +} diff --git a/features/v2/threat_intelligence.feature b/features/v2/threat_intelligence.feature new file mode 100644 index 000000000000..22385a31f555 --- /dev/null +++ b/features/v2/threat_intelligence.feature @@ -0,0 +1,37 @@ +@endpoint(threat-intelligence) @endpoint(threat-intelligence-v2) +Feature: Threat Intelligence + Ingest and manage threat intelligence data for security enrichment and + investigation. + + Background: + Given a valid "apiKeyAuth" key in the system + And a valid "appKeyAuth" key in the system + And an instance of "ThreatIntelligence" API + And operation "IngestStixThreatIntel" enabled + And new "IngestStixThreatIntel" request + + @generated @skip @team:DataDog/cloud-siem + Scenario: Ingest STIX threat intelligence returns "Bad Request" response + Given body with value {"id": "bundle--11111111-1111-4111-8111-111111111111", "objects": [{"created": "2026-07-22T12:00:00Z", "id": "indicator--22222222-2222-4222-8222-222222222222", "modified": "2026-07-22T12:00:00Z", "pattern": "[ipv4-addr:value = '198.51.100.42']", "pattern_type": "stix", "spec_version": "2.1", "type": "indicator", "valid_from": "2026-07-22T12:00:00Z"}], "spec_version": "2.1", "type": "bundle"} + And request contains "ti_vendor" parameter from "REPLACE.ME" + When the request is sent + Then the response status is 400 Bad Request + + @replay-only @team:DataDog/cloud-siem + Scenario: Ingest STIX threat intelligence returns "OK" response + Given request contains "ti_vendor" parameter with value "Acme-Inc" + And body with value {"id": "bundle--44444444-4444-4444-8444-444444444444", "objects": [{"created": "2026-07-22T12:00:00Z", "id": "indicator--55555555-5555-4555-8555-555555555555", "modified": "2026-07-22T12:00:00Z", "pattern": "[ipv4-addr:value = '198.51.100.42']", "pattern_type": "stix", "spec_version": "2.1", "type": "indicator", "valid_from": "2026-07-22T12:00:00Z"}], "spec_version": "2.1", "type": "bundle"} + When the request is sent + Then the response status is 200 OK + And the response "data.type" is equal to "threat-intel-stix-ingest" + And the response "data.id" is equal to "acme_inc" + And the response "data.attributes.added" is equal to 1 + And the response "data.attributes.unsupported" is equal to 0 + And the response "data.attributes.invalid" is equal to 0 + + @skip @team:DataDog/cloud-siem + Scenario: Ingest STIX threat intelligence returns "Payload Too Large" response + Given request contains "ti_vendor" parameter with value "Acme-Inc" + And body with value {"id": "bundle--66666666-6666-4666-8666-666666666666", "objects": [{"created": "2026-07-22T12:00:00Z", "id": "indicator--77777777-7777-4777-8777-777777777777", "modified": "2026-07-22T12:00:00Z", "pattern": "[ipv4-addr:value = '198.51.100.42']", "pattern_type": "stix", "spec_version": "2.1", "type": "indicator", "valid_from": "2026-07-22T12:00:00Z"}], "spec_version": "2.1", "type": "bundle"} + When the request is sent + Then the response status is 413 Payload Too Large diff --git a/features/v2/undo.json b/features/v2/undo.json index 3e0cca0a0be8..a57bad935a8d 100644 --- a/features/v2/undo.json +++ b/features/v2/undo.json @@ -7658,6 +7658,12 @@ "type": "idempotent" } }, + "IngestStixThreatIntel": { + "tag": "Threat Intelligence", + "undo": { + "type": "safe" + } + }, "ListVulnerabilities": { "tag": "Security Monitoring", "undo": { diff --git a/packages/datadog-api-client/README.md b/packages/datadog-api-client/README.md index 501cbe931844..4a441a7c2d91 100644 --- a/packages/datadog-api-client/README.md +++ b/packages/datadog-api-client/README.md @@ -492,6 +492,7 @@ apiInstance | Tags | @datadog/datadog-api-client-tags | [README.md](../../services/tags/README.md) | | Teams | @datadog/datadog-api-client-teams | [README.md](../../services/teams/README.md) | | Test Optimization | @datadog/datadog-api-client-test-optimization | [README.md](../../services/test-optimization/README.md) | +| Threat Intelligence | @datadog/datadog-api-client-threat-intelligence | [README.md](../../services/threat-intelligence/README.md) | | Usage Metering | @datadog/datadog-api-client-usage-metering | [README.md](../../services/usage-metering/README.md) | | User Authorized Clients | @datadog/datadog-api-client-user-authorized-clients | [README.md](../../services/user-authorized-clients/README.md) | | Users | @datadog/datadog-api-client-users | [README.md](../../services/users/README.md) | diff --git a/private/bdd_runner/src/support/scenarios_model_mapping.ts b/private/bdd_runner/src/support/scenarios_model_mapping.ts index 8a958fda6a2c..a71b7beeb768 100644 --- a/private/bdd_runner/src/support/scenarios_model_mapping.ts +++ b/private/bdd_runner/src/support/scenarios_model_mapping.ts @@ -15627,6 +15627,21 @@ export const ScenariosModelMappings: { [key: string]: OperationMapping } = { }, operationResponseType: "SecurityEntityRiskScoreResponse", }, + "ThreatIntelligenceApi.V2.IngestStixThreatIntel": { + tiVendor: { + type: "string", + format: "", + }, + contentEncoding: { + type: "STIXContentEncoding", + format: "", + }, + body: { + type: "STIXBundleRequest", + format: "", + }, + operationResponseType: "STIXIngestResponse", + }, "SensitiveDataScannerApi.V2.ListScanningGroups": { operationResponseType: "SensitiveDataScannerGetConfigResponse", }, diff --git a/services/threat_intelligence/.yarnrc.yml b/services/threat_intelligence/.yarnrc.yml new file mode 100644 index 000000000000..3186f3f0795a --- /dev/null +++ b/services/threat_intelligence/.yarnrc.yml @@ -0,0 +1 @@ +nodeLinker: node-modules diff --git a/services/threat_intelligence/README.md b/services/threat_intelligence/README.md new file mode 100644 index 000000000000..63341c92d89a --- /dev/null +++ b/services/threat_intelligence/README.md @@ -0,0 +1,44 @@ +# @datadog/datadog-api-client-threat-intelligence + +## Description + +Ingest and manage threat intelligence data for security enrichment and investigation. + +## Navigation + +- [Installation](#installation) +- [Getting Started](#getting-started) + +## Installation + +```sh +# NPM +npm install @datadog/datadog-api-client-threat-intelligence +# Yarn +yarn add @datadog/datadog-api-client-threat-intelligence +``` + +## Getting Started +```ts +import { createConfiguration } from "@datadog/datadog-api-client"; +import { ThreatIntelligenceApiV2 } from "@datadog/datadog-api-client-threat-intelligence"; +import { v2 } from "@datadog/datadog-api-client-threat-intelligence"; + +const configuration = createConfiguration(); +// Enable unstable operations +const configurationOpts = { + unstableOperations: { + "ThreatIntelligenceApi.v2.ingestStixThreatIntel": true + } +} + +const configuration = createConfiguration(configurationOpts); +const apiInstance = new ThreatIntelligenceApiV2(configuration); +const params = {/* parameters */}; + +apiInstance.ingestStixThreatIntel(params).then((data) => { + console.log("API called successfully. Returned data: " + JSON.stringify(data)); +}).catch((error) => { + console.error("Error calling API: " + error); +}); +``` \ No newline at end of file diff --git a/services/threat_intelligence/package.json b/services/threat_intelligence/package.json new file mode 100644 index 000000000000..ec800e1fc7ad --- /dev/null +++ b/services/threat_intelligence/package.json @@ -0,0 +1,43 @@ +{ + "name": "@datadog/datadog-api-client-threat-intelligence", + "description": "", + "author": "", + "keywords": [ + "api", + "fetch", + "typescript" + ], + "license": "Apache-2.0", + "licenses": [ + { + "type": "Apache-2.0", + "url": "http://www.apache.org/licenses/LICENSE-2.0" + } + ], + "repository": { + "type": "git", + "url": "https://github.com/DataDog/datadog-api-client-typescript.git", + "directory": "services/threat-intelligence" + }, + "files": [ + "dist/**/*" + ], + "main": "./dist/index.js", + "typings": "./dist/index.d.ts", + "scripts": { + "prepack": "yarn workspace @datadog/datadog-api-client build && yarn build", + "build": "yarn generate-version-files && tsc", + "generate-version-files": "node -p \"'export const version = ' + JSON.stringify(require('./package.json').version)\" > src/version.ts" + }, + "dependencies": { + "@datadog/datadog-api-client": "^2.0.0-beta.2" + }, + "devDependencies": { + "typescript": "5.8.3" + }, + "engines": { + "node": ">=18.0.0" + }, + "version": "0.0.1", + "packageManager": "yarn@4.9.1" +} diff --git a/services/threat_intelligence/src/index.ts b/services/threat_intelligence/src/index.ts new file mode 100644 index 000000000000..444c925ae4e0 --- /dev/null +++ b/services/threat_intelligence/src/index.ts @@ -0,0 +1,3 @@ +export * as v2 from "./v2"; + +export { ThreatIntelligenceApi as ThreatIntelligenceApiV2 } from "./v2/ThreatIntelligenceApi"; diff --git a/services/threat_intelligence/src/v2/ThreatIntelligenceApi.ts b/services/threat_intelligence/src/v2/ThreatIntelligenceApi.ts new file mode 100644 index 000000000000..41bc2798faa0 --- /dev/null +++ b/services/threat_intelligence/src/v2/ThreatIntelligenceApi.ts @@ -0,0 +1,253 @@ +import { + ApiException, + BaseAPIRequestFactory, + BaseServerConfiguration, + buildUserAgent, + Configuration, + createConfiguration, + deserialize, + getPreferredMediaType, + HttpMethod, + isBrowser, + logger, + normalizeMediaType, + parse, + RequiredError, + RequestContext, + ResponseContext, + serialize, + ServerConfiguration, + stringify, + applySecurityAuthentication, +} from "@datadog/datadog-api-client"; + +import { TypingInfo } from "./models/TypingInfo"; +import { APIErrorResponse } from "./models/APIErrorResponse"; +import { STIXBundleRequest } from "./models/STIXBundleRequest"; +import { STIXContentEncoding } from "./models/STIXContentEncoding"; +import { STIXIngestResponse } from "./models/STIXIngestResponse"; +import { version } from "../version"; + +export class ThreatIntelligenceApiRequestFactory extends BaseAPIRequestFactory { + public userAgent: string | undefined; + + public constructor(configuration: Configuration) { + super(configuration); + if (!isBrowser) { + this.userAgent = buildUserAgent("threat-intelligence", version); + } + } + public async ingestStixThreatIntel( + tiVendor: string, + body: STIXBundleRequest, + contentEncoding?: STIXContentEncoding, + _options?: Configuration, + ): Promise { + const _config = _options || this.configuration; + + if ( + !_config.unstableOperations[ + "ThreatIntelligenceApi.v2.ingestStixThreatIntel" + ] + ) { + throw new Error( + "Unstable operation 'ingestStixThreatIntel' is disabled. Enable it by setting `configuration.unstableOperations['ThreatIntelligenceApi.v2.ingestStixThreatIntel'] = true`", + ); + } + + // verify required parameter 'tiVendor' is not null or undefined + if (tiVendor === null || tiVendor === undefined) { + throw new RequiredError("tiVendor", "ingestStixThreatIntel"); + } + + // verify required parameter 'body' is not null or undefined + if (body === null || body === undefined) { + throw new RequiredError("body", "ingestStixThreatIntel"); + } + + // Path Params + const localVarPath = "/api/v2/security/threat-intel/stix"; + + // Make Request Context + const { server, overrides } = _config.getServerAndOverrides( + "ThreatIntelligenceApi.v2.ingestStixThreatIntel", + ThreatIntelligenceApi.operationServers, + ); + const requestContext = server.makeRequestContext( + localVarPath, + HttpMethod.POST, + overrides, + ); + requestContext.setHeaderParam("Accept", "application/json"); + requestContext.setHttpConfig(_config.httpConfig); + + // Set User-Agent + if (this.userAgent) { + requestContext.setHeaderParam("User-Agent", this.userAgent); + } + + // Header Params + if (tiVendor !== undefined) { + requestContext.setHeaderParam( + "ti_vendor", + serialize(tiVendor, TypingInfo, "string", ""), + ); + } + if (contentEncoding !== undefined) { + requestContext.setHeaderParam( + "Content-Encoding", + serialize(contentEncoding, TypingInfo, "STIXContentEncoding", ""), + ); + } + + // Body Params + const contentType = getPreferredMediaType(["application/json"]); + requestContext.setHeaderParam("Content-Type", contentType); + const serializedBody = stringify( + serialize(body, TypingInfo, "STIXBundleRequest", ""), + contentType, + ); + requestContext.setBody(serializedBody); + + // Apply auth methods + applySecurityAuthentication(_config, requestContext, [ + "apiKeyAuth", + "appKeyAuth", + "AuthZ", + ]); + + return requestContext; + } +} + +export class ThreatIntelligenceApiResponseProcessor { + /** + * Unwraps the actual response sent by the server from the response context and deserializes the response content + * to the expected objects + * + * @params response Response returned by the server for a request to ingestStixThreatIntel + * @throws ApiException if the response code was not in [200, 299] + */ + public async ingestStixThreatIntel( + response: ResponseContext, + ): Promise { + const contentType = normalizeMediaType(response.headers["content-type"]); + if (response.httpStatusCode === 200) { + const body: STIXIngestResponse = deserialize( + parse(await response.body.text(), contentType), + TypingInfo, + "STIXIngestResponse", + ) as STIXIngestResponse; + return body; + } + if ( + response.httpStatusCode === 400 || + response.httpStatusCode === 401 || + response.httpStatusCode === 403 || + response.httpStatusCode === 413 || + response.httpStatusCode === 429 || + response.httpStatusCode === 502 || + response.httpStatusCode === 503 + ) { + const bodyText = parse(await response.body.text(), contentType); + let body: APIErrorResponse; + try { + body = deserialize( + bodyText, + TypingInfo, + "APIErrorResponse", + ) as APIErrorResponse; + } catch (error) { + logger.debug(`Got error deserializing error: ${error}`); + throw new ApiException( + response.httpStatusCode, + bodyText, + ); + } + throw new ApiException(response.httpStatusCode, body); + } + + // Work around for missing responses in specification, e.g. for petstore.yaml + if (response.httpStatusCode >= 200 && response.httpStatusCode <= 299) { + const body: STIXIngestResponse = deserialize( + parse(await response.body.text(), contentType), + TypingInfo, + "STIXIngestResponse", + "", + ) as STIXIngestResponse; + return body; + } + + const body = (await response.body.text()) || ""; + throw new ApiException( + response.httpStatusCode, + 'Unknown API Status Code!\nBody: "' + body + '"', + ); + } +} + +export interface ThreatIntelligenceApiIngestStixThreatIntelRequest { + /** + * Vendor identifier for the feed. The value must not exceed 10 characters. Datadog normalizes the accepted value to lowercase, converts non-alphanumeric characters to underscores, and trims leading and trailing underscores. + * @type string + */ + tiVendor: string; + /** + * A STIX 2.1 bundle containing indicator objects. The maximum request size is 50 MB. When `Content-Encoding: gzip` is used, the limit applies to the compressed bytes received. + * @type STIXBundleRequest + */ + body: STIXBundleRequest; + /** + * Content encoding for the request body. Use gzip for a compressed STIX bundle. + * @type STIXContentEncoding + */ + contentEncoding?: STIXContentEncoding; +} + +export class ThreatIntelligenceApi { + private requestFactory: ThreatIntelligenceApiRequestFactory; + private responseProcessor: ThreatIntelligenceApiResponseProcessor; + private configuration: Configuration; + + static operationServers: { [key: string]: BaseServerConfiguration[] } = {}; + + public constructor( + configuration?: Configuration, + requestFactory?: ThreatIntelligenceApiRequestFactory, + responseProcessor?: ThreatIntelligenceApiResponseProcessor, + ) { + this.configuration = configuration || createConfiguration(); + this.requestFactory = + requestFactory || + new ThreatIntelligenceApiRequestFactory(this.configuration); + this.responseProcessor = + responseProcessor || new ThreatIntelligenceApiResponseProcessor(); + } + + /** + * Ingest a STIX 2.1 bundle containing threat intelligence indicators. Only indicator objects are supported. Supported indicator patterns contain IPv4 addresses, IPv6 addresses, domain names, or SHA-256 file hashes. + * + * Unsupported objects and patterns increment the `unsupported` counter. Patterns that cannot be parsed increment the `invalid` counter. Processing is best effort, so valid supported indicators in the same bundle are still added. + * + * A successful response means ingestion has completed. Reference-table materialization and enrichment happen asynchronously. Requests are limited to 50 MB and 10 requests per second per API key. Gzip-compressed request bodies are supported. + * @param param The request object + */ + public ingestStixThreatIntel( + param: ThreatIntelligenceApiIngestStixThreatIntelRequest, + options?: Configuration, + ): Promise { + const requestContextPromise = this.requestFactory.ingestStixThreatIntel( + param.tiVendor, + param.body, + param.contentEncoding, + options, + ); + return requestContextPromise.then((requestContext) => { + return this.configuration.httpApi + .send(requestContext) + .then((responseContext) => { + return this.responseProcessor.ingestStixThreatIntel(responseContext); + }); + }); + } +} diff --git a/services/threat_intelligence/src/v2/index.ts b/services/threat_intelligence/src/v2/index.ts new file mode 100644 index 000000000000..4754b5fd87b1 --- /dev/null +++ b/services/threat_intelligence/src/v2/index.ts @@ -0,0 +1,17 @@ +export { + ThreatIntelligenceApiIngestStixThreatIntelRequest, + ThreatIntelligenceApi, +} from "./ThreatIntelligenceApi"; + +export { APIErrorResponse } from "./models/APIErrorResponse"; +export { STIXBundleRequest } from "./models/STIXBundleRequest"; +export { STIXBundleType } from "./models/STIXBundleType"; +export { STIXContentEncoding } from "./models/STIXContentEncoding"; +export { STIXIndicatorObject } from "./models/STIXIndicatorObject"; +export { STIXIndicatorType } from "./models/STIXIndicatorType"; +export { STIXIngestResponse } from "./models/STIXIngestResponse"; +export { STIXIngestResponseAttributes } from "./models/STIXIngestResponseAttributes"; +export { STIXIngestResponseData } from "./models/STIXIngestResponseData"; +export { STIXIngestResponseType } from "./models/STIXIngestResponseType"; +export { STIXPatternType } from "./models/STIXPatternType"; +export { STIXSpecVersion } from "./models/STIXSpecVersion"; diff --git a/services/threat_intelligence/src/v2/models/APIErrorResponse.ts b/services/threat_intelligence/src/v2/models/APIErrorResponse.ts new file mode 100644 index 000000000000..58d6c35b80f0 --- /dev/null +++ b/services/threat_intelligence/src/v2/models/APIErrorResponse.ts @@ -0,0 +1,45 @@ +import { AttributeTypeMap } from "@datadog/datadog-api-client"; + +/** + * API error response. + */ +export class APIErrorResponse { + /** + * A list of errors. + */ + "errors": Array; + /** + * A container for additional, undeclared properties. + * This is a holder for any undeclared properties as specified with + * the 'additionalProperties' keyword in the OAS document. + */ + "additionalProperties"?: { [key: string]: any }; + /** + * @ignore + */ + "_unparsed"?: boolean; + + /** + * @ignore + */ + static readonly attributeTypeMap: AttributeTypeMap = { + errors: { + baseName: "errors", + type: "Array", + required: true, + }, + additionalProperties: { + baseName: "additionalProperties", + type: "{ [key: string]: any; }", + }, + }; + + /** + * @ignore + */ + static getAttributeTypeMap(): AttributeTypeMap { + return APIErrorResponse.attributeTypeMap; + } + + public constructor() {} +} diff --git a/services/threat_intelligence/src/v2/models/STIXBundleRequest.ts b/services/threat_intelligence/src/v2/models/STIXBundleRequest.ts new file mode 100644 index 000000000000..1c412805e88b --- /dev/null +++ b/services/threat_intelligence/src/v2/models/STIXBundleRequest.ts @@ -0,0 +1,75 @@ +import { AttributeTypeMap } from "@datadog/datadog-api-client"; + +import { STIXBundleType } from "./STIXBundleType"; +import { STIXIndicatorObject } from "./STIXIndicatorObject"; +import { STIXSpecVersion } from "./STIXSpecVersion"; + +/** + * A STIX 2.1 bundle containing threat intelligence indicator objects. + */ +export class STIXBundleRequest { + /** + * The STIX bundle identifier. + */ + "id": string; + /** + * The indicator objects included in the bundle. + */ + "objects": Array; + /** + * The supported STIX specification version. + */ + "specVersion"?: STIXSpecVersion; + /** + * The STIX object type for a bundle. + */ + "type": STIXBundleType; + /** + * A container for additional, undeclared properties. + * This is a holder for any undeclared properties as specified with + * the 'additionalProperties' keyword in the OAS document. + */ + "additionalProperties"?: { [key: string]: any }; + /** + * @ignore + */ + "_unparsed"?: boolean; + + /** + * @ignore + */ + static readonly attributeTypeMap: AttributeTypeMap = { + id: { + baseName: "id", + type: "string", + required: true, + }, + objects: { + baseName: "objects", + type: "Array", + required: true, + }, + specVersion: { + baseName: "spec_version", + type: "STIXSpecVersion", + }, + type: { + baseName: "type", + type: "STIXBundleType", + required: true, + }, + additionalProperties: { + baseName: "additionalProperties", + type: "{ [key: string]: any; }", + }, + }; + + /** + * @ignore + */ + static getAttributeTypeMap(): AttributeTypeMap { + return STIXBundleRequest.attributeTypeMap; + } + + public constructor() {} +} diff --git a/services/threat_intelligence/src/v2/models/STIXBundleType.ts b/services/threat_intelligence/src/v2/models/STIXBundleType.ts new file mode 100644 index 000000000000..8c4907fa615f --- /dev/null +++ b/services/threat_intelligence/src/v2/models/STIXBundleType.ts @@ -0,0 +1,7 @@ +import { UnparsedObject } from "@datadog/datadog-api-client"; + +/** + * The STIX object type for a bundle. + */ +export type STIXBundleType = typeof BUNDLE | UnparsedObject; +export const BUNDLE = "bundle"; diff --git a/services/threat_intelligence/src/v2/models/STIXContentEncoding.ts b/services/threat_intelligence/src/v2/models/STIXContentEncoding.ts new file mode 100644 index 000000000000..3997d3937f95 --- /dev/null +++ b/services/threat_intelligence/src/v2/models/STIXContentEncoding.ts @@ -0,0 +1,7 @@ +import { UnparsedObject } from "@datadog/datadog-api-client"; + +/** + * The content encoding applied to the request body. + */ +export type STIXContentEncoding = typeof GZIP | UnparsedObject; +export const GZIP = "gzip"; diff --git a/services/threat_intelligence/src/v2/models/STIXIndicatorObject.ts b/services/threat_intelligence/src/v2/models/STIXIndicatorObject.ts new file mode 100644 index 000000000000..261e7089d60b --- /dev/null +++ b/services/threat_intelligence/src/v2/models/STIXIndicatorObject.ts @@ -0,0 +1,181 @@ +import { AttributeTypeMap } from "@datadog/datadog-api-client"; + +import { STIXIndicatorType } from "./STIXIndicatorType"; +import { STIXPatternType } from "./STIXPatternType"; +import { STIXSpecVersion } from "./STIXSpecVersion"; + +/** + * A STIX 2.1 indicator object. + */ +export class STIXIndicatorObject { + /** + * The confidence in the correctness of the indicator, from 0 through 100. + */ + "confidence"?: number; + /** + * The time when the indicator was created. + */ + "created": Date; + /** + * Optional external reference metadata preserved with the indicator but not interpreted during ingestion. + */ + "externalReferences"?: Array<{ [key: string]: any }>; + /** + * The STIX indicator identifier. + */ + "id": string; + /** + * The open vocabulary terms that categorize the indicator. + */ + "indicatorTypes"?: Array; + /** + * Optional kill chain metadata preserved with the indicator but not interpreted during ingestion. + */ + "killChainPhases"?: Array<{ [key: string]: any }>; + /** + * Labels associated with the indicator. + */ + "labels"?: Array; + /** + * The time when the indicator was last modified. + */ + "modified": Date; + /** + * References to marking definition objects that apply to the indicator. + */ + "objectMarkingRefs"?: Array; + /** + * The STIX pattern that identifies the observable. + */ + "pattern": string; + /** + * The supported STIX pattern language. + */ + "patternType": STIXPatternType; + /** + * Whether the indicator has been revoked. + */ + "revoked"?: boolean; + /** + * The supported STIX specification version. + */ + "specVersion": STIXSpecVersion; + /** + * The STIX object type for an indicator. + */ + "type": STIXIndicatorType; + /** + * The time from which the indicator is considered valid. + */ + "validFrom": Date; + /** + * The time until which the indicator is considered valid. + */ + "validUntil"?: Date; + /** + * A container for additional, undeclared properties. + * This is a holder for any undeclared properties as specified with + * the 'additionalProperties' keyword in the OAS document. + */ + "additionalProperties"?: { [key: string]: any }; + /** + * @ignore + */ + "_unparsed"?: boolean; + + /** + * @ignore + */ + static readonly attributeTypeMap: AttributeTypeMap = { + confidence: { + baseName: "confidence", + type: "number", + format: "int32", + }, + created: { + baseName: "created", + type: "Date", + required: true, + format: "date-time", + }, + externalReferences: { + baseName: "external_references", + type: "Array<{ [key: string]: any; }>", + }, + id: { + baseName: "id", + type: "string", + required: true, + }, + indicatorTypes: { + baseName: "indicator_types", + type: "Array", + }, + killChainPhases: { + baseName: "kill_chain_phases", + type: "Array<{ [key: string]: any; }>", + }, + labels: { + baseName: "labels", + type: "Array", + }, + modified: { + baseName: "modified", + type: "Date", + required: true, + format: "date-time", + }, + objectMarkingRefs: { + baseName: "object_marking_refs", + type: "Array", + }, + pattern: { + baseName: "pattern", + type: "string", + required: true, + }, + patternType: { + baseName: "pattern_type", + type: "STIXPatternType", + required: true, + }, + revoked: { + baseName: "revoked", + type: "boolean", + }, + specVersion: { + baseName: "spec_version", + type: "STIXSpecVersion", + required: true, + }, + type: { + baseName: "type", + type: "STIXIndicatorType", + required: true, + }, + validFrom: { + baseName: "valid_from", + type: "Date", + required: true, + format: "date-time", + }, + validUntil: { + baseName: "valid_until", + type: "Date", + format: "date-time", + }, + additionalProperties: { + baseName: "additionalProperties", + type: "{ [key: string]: any; }", + }, + }; + + /** + * @ignore + */ + static getAttributeTypeMap(): AttributeTypeMap { + return STIXIndicatorObject.attributeTypeMap; + } + + public constructor() {} +} diff --git a/services/threat_intelligence/src/v2/models/STIXIndicatorType.ts b/services/threat_intelligence/src/v2/models/STIXIndicatorType.ts new file mode 100644 index 000000000000..581b5301ecc8 --- /dev/null +++ b/services/threat_intelligence/src/v2/models/STIXIndicatorType.ts @@ -0,0 +1,7 @@ +import { UnparsedObject } from "@datadog/datadog-api-client"; + +/** + * The STIX object type for an indicator. + */ +export type STIXIndicatorType = typeof INDICATOR | UnparsedObject; +export const INDICATOR = "indicator"; diff --git a/services/threat_intelligence/src/v2/models/STIXIngestResponse.ts b/services/threat_intelligence/src/v2/models/STIXIngestResponse.ts new file mode 100644 index 000000000000..6dd1d74ae1bc --- /dev/null +++ b/services/threat_intelligence/src/v2/models/STIXIngestResponse.ts @@ -0,0 +1,47 @@ +import { AttributeTypeMap } from "@datadog/datadog-api-client"; + +import { STIXIngestResponseData } from "./STIXIngestResponseData"; + +/** + * The response from a completed STIX ingestion request. + */ +export class STIXIngestResponse { + /** + * The JSON:API resource describing the completed STIX ingestion request. + */ + "data": STIXIngestResponseData; + /** + * A container for additional, undeclared properties. + * This is a holder for any undeclared properties as specified with + * the 'additionalProperties' keyword in the OAS document. + */ + "additionalProperties"?: { [key: string]: any }; + /** + * @ignore + */ + "_unparsed"?: boolean; + + /** + * @ignore + */ + static readonly attributeTypeMap: AttributeTypeMap = { + data: { + baseName: "data", + type: "STIXIngestResponseData", + required: true, + }, + additionalProperties: { + baseName: "additionalProperties", + type: "{ [key: string]: any; }", + }, + }; + + /** + * @ignore + */ + static getAttributeTypeMap(): AttributeTypeMap { + return STIXIngestResponse.attributeTypeMap; + } + + public constructor() {} +} diff --git a/services/threat_intelligence/src/v2/models/STIXIngestResponseAttributes.ts b/services/threat_intelligence/src/v2/models/STIXIngestResponseAttributes.ts new file mode 100644 index 000000000000..94abd874fd85 --- /dev/null +++ b/services/threat_intelligence/src/v2/models/STIXIngestResponseAttributes.ts @@ -0,0 +1,66 @@ +import { AttributeTypeMap } from "@datadog/datadog-api-client"; + +/** + * Counters describing the result of the STIX ingestion request. + */ +export class STIXIngestResponseAttributes { + /** + * The number of supported indicators added. + */ + "added": number; + /** + * The number of indicators with patterns that could not be parsed. + */ + "invalid": number; + /** + * The number of unsupported objects or patterns. + */ + "unsupported": number; + /** + * A container for additional, undeclared properties. + * This is a holder for any undeclared properties as specified with + * the 'additionalProperties' keyword in the OAS document. + */ + "additionalProperties"?: { [key: string]: any }; + /** + * @ignore + */ + "_unparsed"?: boolean; + + /** + * @ignore + */ + static readonly attributeTypeMap: AttributeTypeMap = { + added: { + baseName: "added", + type: "number", + required: true, + format: "int64", + }, + invalid: { + baseName: "invalid", + type: "number", + required: true, + format: "int64", + }, + unsupported: { + baseName: "unsupported", + type: "number", + required: true, + format: "int64", + }, + additionalProperties: { + baseName: "additionalProperties", + type: "{ [key: string]: any; }", + }, + }; + + /** + * @ignore + */ + static getAttributeTypeMap(): AttributeTypeMap { + return STIXIngestResponseAttributes.attributeTypeMap; + } + + public constructor() {} +} diff --git a/services/threat_intelligence/src/v2/models/STIXIngestResponseData.ts b/services/threat_intelligence/src/v2/models/STIXIngestResponseData.ts new file mode 100644 index 000000000000..307b243fdd5c --- /dev/null +++ b/services/threat_intelligence/src/v2/models/STIXIngestResponseData.ts @@ -0,0 +1,66 @@ +import { AttributeTypeMap } from "@datadog/datadog-api-client"; + +import { STIXIngestResponseAttributes } from "./STIXIngestResponseAttributes"; +import { STIXIngestResponseType } from "./STIXIngestResponseType"; + +/** + * The JSON:API resource describing the completed STIX ingestion request. + */ +export class STIXIngestResponseData { + /** + * Counters describing the result of the STIX ingestion request. + */ + "attributes": STIXIngestResponseAttributes; + /** + * The normalized vendor identifier. + */ + "id": string; + /** + * The STIX ingestion resource type. + */ + "type": STIXIngestResponseType; + /** + * A container for additional, undeclared properties. + * This is a holder for any undeclared properties as specified with + * the 'additionalProperties' keyword in the OAS document. + */ + "additionalProperties"?: { [key: string]: any }; + /** + * @ignore + */ + "_unparsed"?: boolean; + + /** + * @ignore + */ + static readonly attributeTypeMap: AttributeTypeMap = { + attributes: { + baseName: "attributes", + type: "STIXIngestResponseAttributes", + required: true, + }, + id: { + baseName: "id", + type: "string", + required: true, + }, + type: { + baseName: "type", + type: "STIXIngestResponseType", + required: true, + }, + additionalProperties: { + baseName: "additionalProperties", + type: "{ [key: string]: any; }", + }, + }; + + /** + * @ignore + */ + static getAttributeTypeMap(): AttributeTypeMap { + return STIXIngestResponseData.attributeTypeMap; + } + + public constructor() {} +} diff --git a/services/threat_intelligence/src/v2/models/STIXIngestResponseType.ts b/services/threat_intelligence/src/v2/models/STIXIngestResponseType.ts new file mode 100644 index 000000000000..365cdba6a2e0 --- /dev/null +++ b/services/threat_intelligence/src/v2/models/STIXIngestResponseType.ts @@ -0,0 +1,9 @@ +import { UnparsedObject } from "@datadog/datadog-api-client"; + +/** + * The STIX ingestion resource type. + */ +export type STIXIngestResponseType = + | typeof THREAT_INTEL_STIX_INGEST + | UnparsedObject; +export const THREAT_INTEL_STIX_INGEST = "threat-intel-stix-ingest"; diff --git a/services/threat_intelligence/src/v2/models/STIXPatternType.ts b/services/threat_intelligence/src/v2/models/STIXPatternType.ts new file mode 100644 index 000000000000..641df99a9669 --- /dev/null +++ b/services/threat_intelligence/src/v2/models/STIXPatternType.ts @@ -0,0 +1,7 @@ +import { UnparsedObject } from "@datadog/datadog-api-client"; + +/** + * The supported STIX pattern language. + */ +export type STIXPatternType = typeof STIX | UnparsedObject; +export const STIX = "stix"; diff --git a/services/threat_intelligence/src/v2/models/STIXSpecVersion.ts b/services/threat_intelligence/src/v2/models/STIXSpecVersion.ts new file mode 100644 index 000000000000..8dfb0a7f16b2 --- /dev/null +++ b/services/threat_intelligence/src/v2/models/STIXSpecVersion.ts @@ -0,0 +1,7 @@ +import { UnparsedObject } from "@datadog/datadog-api-client"; + +/** + * The supported STIX specification version. + */ +export type STIXSpecVersion = typeof VERSION_2_1 | UnparsedObject; +export const VERSION_2_1 = "2.1"; diff --git a/services/threat_intelligence/src/v2/models/TypingInfo.ts b/services/threat_intelligence/src/v2/models/TypingInfo.ts new file mode 100644 index 000000000000..94b18fa6a807 --- /dev/null +++ b/services/threat_intelligence/src/v2/models/TypingInfo.ts @@ -0,0 +1,28 @@ +import { ModelTypingInfo } from "@datadog/datadog-api-client"; + +import { APIErrorResponse } from "./APIErrorResponse"; +import { STIXBundleRequest } from "./STIXBundleRequest"; +import { STIXIndicatorObject } from "./STIXIndicatorObject"; +import { STIXIngestResponse } from "./STIXIngestResponse"; +import { STIXIngestResponseAttributes } from "./STIXIngestResponseAttributes"; +import { STIXIngestResponseData } from "./STIXIngestResponseData"; + +export const TypingInfo: ModelTypingInfo = { + enumsMap: { + STIXBundleType: ["bundle"], + STIXContentEncoding: ["gzip"], + STIXIndicatorType: ["indicator"], + STIXIngestResponseType: ["threat-intel-stix-ingest"], + STIXPatternType: ["stix"], + STIXSpecVersion: ["2.1"], + }, + oneOfMap: {}, + typeMap: { + APIErrorResponse: APIErrorResponse, + STIXBundleRequest: STIXBundleRequest, + STIXIndicatorObject: STIXIndicatorObject, + STIXIngestResponse: STIXIngestResponse, + STIXIngestResponseAttributes: STIXIngestResponseAttributes, + STIXIngestResponseData: STIXIngestResponseData, + }, +}; diff --git a/services/threat_intelligence/tsconfig.json b/services/threat_intelligence/tsconfig.json new file mode 100644 index 000000000000..d6c32bfb893c --- /dev/null +++ b/services/threat_intelligence/tsconfig.json @@ -0,0 +1,28 @@ +{ + "compilerOptions": { + "strict": true, + /* Basic Options */ + "target": "es6", + "module": "commonjs", + "moduleResolution": "node", + "declaration": true, + + "esModuleInterop": true, + "resolveJsonModule": true, + + "noImplicitAny": true, + "noImplicitThis": true, + + /* Additional Checks */ + "noUnusedLocals": false /* Report errors on unused locals. */, // TODO: reenable (unused imports!) + "noUnusedParameters": false /* Report errors on unused parameters. */, // TODO: set to true again + "noImplicitReturns": true /* Report error when not all code paths in function return a value. */, + "noFallthroughCasesInSwitch": true /* Report errors for fallthrough cases in switch statement. */, + + "sourceMap": true, + "outDir": "./dist", + "lib": ["es6", "es7"] + }, + "exclude": ["dist", "node_modules", "tests"], + "include": ["src"] +} diff --git a/yarn.lock b/yarn.lock index 6abcd11fad65..d66948c3a9c7 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1630,6 +1630,15 @@ __metadata: languageName: unknown linkType: soft +"@datadog/datadog-api-client-threat-intelligence@workspace:services/threat_intelligence": + version: 0.0.0-use.local + resolution: "@datadog/datadog-api-client-threat-intelligence@workspace:services/threat_intelligence" + dependencies: + "@datadog/datadog-api-client": "npm:^2.0.0-beta.2" + typescript: "npm:5.8.3" + languageName: unknown + linkType: soft + "@datadog/datadog-api-client-usage-metering@workspace:services/usage_metering": version: 0.0.0-use.local resolution: "@datadog/datadog-api-client-usage-metering@workspace:services/usage_metering"