[datadog_security_monitoring_rule] Add group_signals_by and case actions

datadog/resource_datadog_security_monitoring_rule.go

@@ -63,6 +63,36 @@ func datadogSecurityMonitoringRuleSchema(includeValidate bool) map[string]*schem
 						Required:         true,
 						Description:      "Severity of the Security Signal.",
 					},
+					"action": {
+						Type:        schema.TypeList,
+						Optional:    true,
+						Description: "Action to perform when the case trigger",
+						Elem: &schema.Resource{
+							Schema: map[string]*schema.Schema{
+								"type": {
+									Type:             schema.TypeString,
+									ValidateDiagFunc: validators.ValidateEnumValue(datadogV2.NewSecurityMonitoringRuleCaseActionTypeFromValue),
+									Required:         true,
+									Description:      "Type of action to perform when the case triggers.",
+								},
+								"options": {
+									Type:        schema.TypeList,
+									Optional:    true,
+									Description: "Options for the action.",
+									MaxItems:    1,
+									Elem: &schema.Resource{
+										Schema: map[string]*schema.Schema{
+											"duration": {
+												Type:        schema.TypeInt,
+												Optional:    true,
+												Description: "Duration of the action in seconds.",
+											},
+										},
+									},
+								},
+							},
+						},
+					},
 				},
 			},
 		},
@@ -481,6 +511,12 @@ func datadogSecurityMonitoringRuleSchema(includeValidate bool) map[string]*schem
 				},
 			},
 		},
+		"group_signals_by": {
+			Type:        schema.TypeList,
+			Optional:    true,
+			Description: "Additional grouping to perform on top of the query grouping.",
+			Elem:        &schema.Schema{Type: schema.TypeString},
+		},
 	}
 	if includeValidate {
 		basicSchema["validate"] = &schema.Schema{
@@ -685,6 +721,10 @@ func buildCreateStandardPayload(d utils.Resource) (*datadogV2.SecurityMonitoring
 		payload.SetReferenceTables(buildPayloadReferenceTables(tfReferenceTables))
 	}
 
+	if v, ok := d.GetOk("group_signals_by"); ok {
+		payload.SetGroupSignalsBy(parseStringArray(v.([]interface{})))
+	}
+
 	return &payload, nil
 }
 
@@ -712,6 +752,10 @@ func buildStandardPayload(d utils.Resource) (*datadogV2.SecurityMonitoringStanda
 		payload.SetReferenceTables(buildPayloadReferenceTables(tfReferenceTables))
 	}
 
+	if v, ok := d.GetOk("group_signals_by"); ok {
+		payload.SetGroupSignalsBy(parseStringArray(v.([]interface{})))
+	}
+
 	return &payload, nil
 }
 
@@ -776,6 +820,9 @@ func buildCreatePayloadCases(d utils.Resource) []datadogV2.SecurityMonitoringRul
 		if v, ok := ruleCase["notifications"]; ok {
 			structRuleCase.SetNotifications(parseStringArray(v.([]interface{})))
 		}
+		if action, ok := ruleCase["action"]; ok && len(action.([]interface{})) > 0 {
+			structRuleCase.SetActions(buildPayloadCaseActions(action.([]interface{})))
+		}
 		payloadCases[idx] = *structRuleCase
 	}
 	return payloadCases
@@ -1091,6 +1138,28 @@ func buildPayloadReferenceTables(tfReferenceTables []interface{}) []datadogV2.Se
 	return payloadReferenceTables
 }
 
+func buildPayloadCaseActions(tfActions []any) []datadogV2.SecurityMonitoringRuleCaseAction {
+	payloadActions := make([]datadogV2.SecurityMonitoringRuleCaseAction, len(tfActions))
+	for actionIdx, actionIf := range tfActions {
+		action := actionIf.(map[string]any)
+		actionType := datadogV2.SecurityMonitoringRuleCaseActionType(action["type"].(string))
+		payloadOptions := datadogV2.NewSecurityMonitoringRuleCaseActionOptions()
+		if tfOptionsList, ok := action["options"]; ok {
+			tfOptions := extractMapFromInterface(tfOptionsList.([]any))
+			for k, v := range tfOptions {
+				if k == "duration" {
+					payloadOptions.SetDuration(int64(v.(int)))
+				}
+			}
+		}
+		payloadActions[actionIdx] = datadogV2.SecurityMonitoringRuleCaseAction{
+			Type:    &actionType,
+			Options: payloadOptions,
+		}
+	}
+	return payloadActions
+}
+
 func resourceDatadogSecurityMonitoringRuleRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	providerConf := meta.(*ProviderConfiguration)
 	apiInstances := providerConf.DatadogApiInstances
@@ -1182,7 +1251,9 @@ func updateStandardResourceDataFromResponse(d *schema.ResourceData, ruleResponse
 		refTables := extractReferenceTables(*referenceTables)
 		d.Set("reference_tables", refTables)
 	}
-
+	if groupSignalsBy, ok := ruleResponse.GetGroupSignalsByOk(); ok {
+		d.Set("group_signals_by", groupSignalsBy)
+	}
 }
 
 func extractStandardRuleQueries(responseRuleQueries []datadogV2.SecurityMonitoringStandardRuleQuery) []map[string]interface{} {
@@ -1293,6 +1364,24 @@ func extractRuleCases(responseRulesCases []datadogV2.SecurityMonitoringRuleCase)
 			ruleCase["notifications"] = *notifications
 		}
 		ruleCase["status"] = responseRuleCase.GetStatus()
+		if actions, ok := responseRuleCase.GetActionsOk(); ok {
+			tfActions := make([]map[string]interface{}, len(*actions))
+			for idx, action := range *actions {
+				tfAction := make(map[string]interface{})
+				tfAction["type"] = action.GetType()
+				if options, ok := action.GetOptionsOk(); ok {
+					tfOptions := make(map[string]interface{})
+					if duration, ok := options.GetDurationOk(); ok {
+						tfOptions["duration"] = duration
+					}
+					if len(tfOptions) > 0 {
+						tfAction["options"] = []any{tfOptions}
+					}
+				}
+				tfActions[idx] = tfAction
+			}
+			ruleCase["action"] = tfActions
+		}
 
 		ruleCases[idx] = ruleCase
 	}
@@ -1450,6 +1539,9 @@ func buildUpdatePayload(d *schema.ResourceData) (*datadogV2.SecurityMonitoringRu
 			if v, ok := ruleCase["notifications"]; ok {
 				structRuleCase.SetNotifications(parseStringArray(v.([]interface{})))
 			}
+			if action, ok := ruleCase["action"]; ok && len(action.([]interface{})) > 0 {
+				structRuleCase.SetActions(buildPayloadCaseActions(action.([]interface{})))
+			}
 			payloadCases[idx] = structRuleCase
 		}
 		payload.SetCases(payloadCases)

datadog/tests/cassettes/TestAccDatadogSecurityMonitoringRule_AppsecRule.freeze

@@ -0,0 +1 @@
+2025-03-10T17:09:05.964675+01:00