Class: DatadogAPIClient::V2::ThreatIntelligenceAPI

Inherits:
Object
  • Object
show all
Defined in:
lib/datadog_api_client/v2/api/threat_intelligence_api.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(api_client = DatadogAPIClient::APIClient.default) ⇒ ThreatIntelligenceAPI

Returns a new instance of ThreatIntelligenceAPI.



22
23
24
 
# File 'lib/datadog_api_client/v2/api/threat_intelligence_api.rb', line 22

def initialize(api_client = DatadogAPIClient::APIClient.default)
  @api_client = api_client
end

Instance Attribute Details

#api_client ⇒ Object

Returns the value of attribute api_client.



20
21
22
 
# File 'lib/datadog_api_client/v2/api/threat_intelligence_api.rb', line 20

def api_client
  @api_client
end

Instance Method Details

#add_stix_threat_intel(ti_vendor, body, opts = {}) ⇒ Object

Ingest STIX threat intelligence.

See Also:



29
30
31
32
 
# File 'lib/datadog_api_client/v2/api/threat_intelligence_api.rb', line 29

def add_stix_threat_intel(ti_vendor, body, opts = {})
  data, _status_code, _headers = add_stix_threat_intel_with_http_info(ti_vendor, body, opts)
  data
end

#add_stix_threat_intel_with_http_info(ti_vendor, body, opts = {}) ⇒ Array<(STIXIngestResponse, Integer, Hash)>

Ingest STIX threat intelligence.

Ingest a STIX 2.1 bundle containing threat intelligence indicators. Only indicator objects are processed. Supported indicator patterns contain IPv4 addresses, IPv6 addresses, domain names, or SHA-256 file hashes.

Non-indicator objects are ignored and are not included in the response counters. Indicator objects with unsupported STIX versions or patterns that produce no supported observable values increment the unsupported counter. Patterns that cannot be parsed increment the invalid counter. Processing is best effort, so valid supported indicators in the same bundle are still added.

A successful response means ingestion has completed. Reference-table materialization and enrichment happen asynchronously. Requests are limited to 50 MB as received, 100 MB after decompression, and 10 requests per second per API key. Gzip-compressed request bodies are supported.

Parameters:

  • ti_vendor (String) —

    Vendor identifier for the feed. The value must not exceed 10 characters. Datadog normalizes the accepted value to lowercase, converts non-alphanumeric characters to underscores, and trims leading and trailing underscores.

  • body (STIXBundleRequest) —

    A STIX 2.1 bundle containing indicator objects. The request body must not exceed 50 MB as received or 100 MB after decompression.

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :content_encoding (STIXContentEncoding) —

    Content encoding for the request body. Use gzip for a compressed STIX bundle.

Returns:

  • (Array<(STIXIngestResponse, Integer, Hash)>) —

    STIXIngestResponse data, response status code and response headers



47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
 
# File 'lib/datadog_api_client/v2/api/threat_intelligence_api.rb', line 47

def add_stix_threat_intel_with_http_info(ti_vendor, body, opts = {})
  unstable_enabled = @api_client.config.unstable_operations["v2.add_stix_threat_intel".to_sym]
  if unstable_enabled
    @api_client.config.logger.warn format("Using unstable operation '%s'", "v2.add_stix_threat_intel")
  else
    raise DatadogAPIClient::APIError.new(message: format("Unstable operation '%s' is disabled", "v2.add_stix_threat_intel"))
  end

  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: ThreatIntelligenceAPI.add_stix_threat_intel ...'
  end
  # verify the required parameter 'ti_vendor' is set
  if @api_client.config.client_side_validation && ti_vendor.nil?
    fail ArgumentError, "Missing the required parameter 'ti_vendor' when calling ThreatIntelligenceAPI.add_stix_threat_intel"
  end
  if @api_client.config.client_side_validation && ti_vendor.to_s.length > 10
    fail ArgumentError, 'invalid value for "ti_vendor" when calling ThreatIntelligenceAPI.add_stix_threat_intel, the character length must be smaller than or equal to 10.'
  end
  if @api_client.config.client_side_validation && ti_vendor.to_s.length < 1
    fail ArgumentError, 'invalid value for "ti_vendor" when calling ThreatIntelligenceAPI.add_stix_threat_intel, the character length must be great than or equal to 1.'
  end
  allowable_values = ['gzip']
  if @api_client.config.client_side_validation && opts[:'content_encoding'] && !allowable_values.include?(opts[:'content_encoding'])
    fail ArgumentError, "invalid value for \"content_encoding\", must be one of #{allowable_values}"
  end
  # verify the required parameter 'body' is set
  if @api_client.config.client_side_validation && body.nil?
    fail ArgumentError, "Missing the required parameter 'body' when calling ThreatIntelligenceAPI.add_stix_threat_intel"
  end
  # resource path
  local_var_path = '/api/v2/security/threat-intel/stix'

  # query parameters
  query_params = opts[:query_params] || {}

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])
  # HTTP header 'Content-Type'
  header_params['Content-Type'] = @api_client.select_header_content_type(['application/json'])
  header_params['ti_vendor'] = ti_vendor
  header_params['Content-Encoding'] = opts[:'content_encoding'] if !opts[:'content_encoding'].nil?

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body] || @api_client.object_to_http_body(body)

  # return_type
  return_type = opts[:debug_return_type] || 'STIXIngestResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || [:apiKeyAuth, :appKeyAuth]

  new_options = opts.merge(
    :operation => :add_stix_threat_intel,
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type,
    :api_version => "V2"
  )

  data, status_code, headers = @api_client.call_api(Net::HTTP::Post, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: ThreatIntelligenceAPI#add_stix_threat_intel\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end