Add field attribute to the Workload Protection hash action

.generator/schemas/v2/openapi.yaml

@@ -10243,6 +10243,10 @@ components:
           description: Whether the policy is pinned
           example: false
           type: boolean
+        policyType:
+          description: The type of the policy
+          example: policy
+          type: string
         policyVersion:
           description: The version of the policy
           example: '1'
@@ -10421,11 +10425,11 @@ components:
     CloudWorkloadSecurityAgentPolicyVersion:
       description: The versions of the policy
       properties:
-        Date:
+        date:
           description: The date and time the version was created
           nullable: true
           type: string
-        Name:
+        name:
           description: The version of the policy
           example: 1.47.0-rc2
           type: string
@@ -10452,8 +10456,11 @@ components:
           $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionSet'
       type: object
     CloudWorkloadSecurityAgentRuleActionHash:
-      additionalProperties: {}
-      description: An empty object indicating the hash action
+      description: Hash file specified by the field attribute
+      properties:
+        field:
+          description: The field of the hash action
+          type: string
       type: object
     CloudWorkloadSecurityAgentRuleActionMetadata:
       description: The metadata action applied on the scope matching the rule
@@ -10501,9 +10508,14 @@ components:
           format: int64
           type: integer
         value:
-          description: The value of the set action
-          type: string
+          $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionSetValue'
       type: object
+    CloudWorkloadSecurityAgentRuleActionSetValue:
+      description: The value of the set action
+      oneOf:
+      - type: string
+      - type: integer
+      - type: boolean
     CloudWorkloadSecurityAgentRuleActions:
       description: The array of actions the rule can perform if triggered
       items:

docs/datadog_api_client.v2.model.rst

@@ -4064,6 +4064,13 @@ datadog\_api\_client.v2.model.cloud\_workload\_security\_agent\_rule\_action\_se
    :members:
    :show-inheritance:
 
+datadog\_api\_client.v2.model.cloud\_workload\_security\_agent\_rule\_action\_set\_value module
+-----------------------------------------------------------------------------------------------
+
+.. automodule:: datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_set_value
+   :members:
+   :show-inheritance:
+
 datadog\_api\_client.v2.model.cloud\_workload\_security\_agent\_rule\_attributes module
 ---------------------------------------------------------------------------------------
 

examples/v2/csm-threats/CreateCSMThreatsAgentRule_1295653933.py

@@ -46,7 +46,9 @@
                     ),
                 ),
                 CloudWorkloadSecurityAgentRuleAction(
-                    hash=CloudWorkloadSecurityAgentRuleActionHash(),
+                    hash=CloudWorkloadSecurityAgentRuleActionHash(
+                        field="exec.file",
+                    ),
                 ),
             ],
         ),

examples/v2/csm-threats/CreateCSMThreatsAgentRule_1363354233.py

@@ -37,7 +37,7 @@
                 CloudWorkloadSecurityAgentRuleAction(
                     set=CloudWorkloadSecurityAgentRuleActionSet(
                         name="test_set",
-                        expression="open.file.path",
+                        expression="exec.file.path",
                         default_value="/dev/null",
                         scope="process",
                     ),

src/datadog_api_client/v2/model/cloud_workload_security_agent_policy_attributes.py

@@ -58,6 +58,7 @@ def openapi_types(_):
             "monitoring_rules_count": (int,),
             "name": (str,),
             "pinned": (bool,),
+            "policy_type": (str,),
             "policy_version": (str,),
             "priority": (int,),
             "rule_count": (int,),
@@ -78,6 +79,7 @@ def openapi_types(_):
         "monitoring_rules_count": "monitoringRulesCount",
         "name": "name",
         "pinned": "pinned",
+        "policy_type": "policyType",
         "policy_version": "policyVersion",
         "priority": "priority",
         "rule_count": "ruleCount",
@@ -99,6 +101,7 @@ def __init__(
         monitoring_rules_count: Union[int, UnsetType] = unset,
         name: Union[str, UnsetType] = unset,
         pinned: Union[bool, UnsetType] = unset,
+        policy_type: Union[str, UnsetType] = unset,
         policy_version: Union[str, UnsetType] = unset,
         priority: Union[int, UnsetType] = unset,
         rule_count: Union[int, UnsetType] = unset,
@@ -141,6 +144,9 @@ def __init__(
         :param pinned: Whether the policy is pinned
         :type pinned: bool, optional
 
+        :param policy_type: The type of the policy
+        :type policy_type: str, optional
+
         :param policy_version: The version of the policy
         :type policy_version: str, optional
 
@@ -182,6 +188,8 @@ def __init__(
             kwargs["name"] = name
         if pinned is not unset:
             kwargs["pinned"] = pinned
+        if policy_type is not unset:
+            kwargs["policy_type"] = policy_type
         if policy_version is not unset:
             kwargs["policy_version"] = policy_version
         if priority is not unset:

src/datadog_api_client/v2/model/cloud_workload_security_agent_policy_version.py

@@ -23,8 +23,8 @@ def openapi_types(_):
         }
 
     attribute_map = {
-        "date": "Date",
-        "name": "Name",
+        "date": "date",
+        "name": "name",
     }
 
     def __init__(self_, date: Union[str, none_type, UnsetType] = unset, name: Union[str, UnsetType] = unset, **kwargs):

src/datadog_api_client/v2/model/cloud_workload_security_agent_rule_action.py

@@ -73,7 +73,7 @@ def __init__(
         :param filter: SECL expression used to target the container to apply the action on
         :type filter: str, optional
 
-        :param hash: An empty object indicating the hash action
+        :param hash: Hash file specified by the field attribute
         :type hash: CloudWorkloadSecurityAgentRuleActionHash, optional
 
         :param kill: Kill system call applied on the container matching the rule

src/datadog_api_client/v2/model/cloud_workload_security_agent_rule_action_hash.py

@@ -3,15 +3,34 @@
 # Copyright 2019-Present Datadog, Inc.
 from __future__ import annotations
 
+from typing import Union
 
 from datadog_api_client.model_utils import (
     ModelNormal,
+    cached_property,
+    unset,
+    UnsetType,
 )
 
 
 class CloudWorkloadSecurityAgentRuleActionHash(ModelNormal):
-    def __init__(self_, **kwargs):
+    @cached_property
+    def openapi_types(_):
+        return {
+            "field": (str,),
+        }
+
+    attribute_map = {
+        "field": "field",
+    }
+
+    def __init__(self_, field: Union[str, UnsetType] = unset, **kwargs):
         """
-        An empty object indicating the hash action
+        Hash file specified by the field attribute
+
+        :param field: The field of the hash action
+        :type field: str, optional
         """
+        if field is not unset:
+            kwargs["field"] = field
         super().__init__(kwargs)

src/datadog_api_client/v2/model/cloud_workload_security_agent_rule_action_set.py

@@ -3,7 +3,7 @@
 # Copyright 2019-Present Datadog, Inc.
 from __future__ import annotations
 
-from typing import Union
+from typing import Union, TYPE_CHECKING
 
 from datadog_api_client.model_utils import (
     ModelNormal,
@@ -13,9 +13,19 @@
 )
 
 
+if TYPE_CHECKING:
+    from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_set_value import (
+        CloudWorkloadSecurityAgentRuleActionSetValue,
+    )
+
+
 class CloudWorkloadSecurityAgentRuleActionSet(ModelNormal):
     @cached_property
     def openapi_types(_):
+        from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_set_value import (
+            CloudWorkloadSecurityAgentRuleActionSetValue,
+        )
+
         return {
             "append": (bool,),
             "default_value": (str,),
@@ -26,7 +36,7 @@ def openapi_types(_):
             "scope": (str,),
             "size": (int,),
             "ttl": (int,),
-            "value": (str,),
+            "value": (CloudWorkloadSecurityAgentRuleActionSetValue,),
         }
 
     attribute_map = {
@@ -53,7 +63,7 @@ def __init__(
         scope: Union[str, UnsetType] = unset,
         size: Union[int, UnsetType] = unset,
         ttl: Union[int, UnsetType] = unset,
-        value: Union[str, UnsetType] = unset,
+        value: Union[CloudWorkloadSecurityAgentRuleActionSetValue, str, int, bool, UnsetType] = unset,
         **kwargs,
     ):
         """
@@ -87,7 +97,7 @@ def __init__(
         :type ttl: int, optional
 
         :param value: The value of the set action
-        :type value: str, optional
+        :type value: CloudWorkloadSecurityAgentRuleActionSetValue, optional
         """
         if append is not unset:
             kwargs["append"] = append

src/datadog_api_client/v2/model/cloud_workload_security_agent_rule_action_set_value.py

@@ -0,0 +1,35 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+# This product includes software developed at Datadog (https://www.datadoghq.com/).
+# Copyright 2019-Present Datadog, Inc.
+from __future__ import annotations
+
+
+from datadog_api_client.model_utils import (
+    ModelComposed,
+    cached_property,
+)
+
+
+class CloudWorkloadSecurityAgentRuleActionSetValue(ModelComposed):
+    def __init__(self, **kwargs):
+        """
+        The value of the set action
+        """
+        super().__init__(kwargs)
+
+    @cached_property
+    def _composed_schemas(_):
+        # we need this here to make our import statements work
+        # we must store _composed_schemas in here so the code is only run
+        # when we invoke this method. If we kept this at the class
+        # level we would get an error because the class level
+        # code would be run when this module is imported, and these composed
+        # classes don't exist yet because their module has not finished
+        # loading
+        return {
+            "oneOf": [
+                str,
+                int,
+                bool,
+            ],
+        }

src/datadog_api_client/v2/models/__init__.py

@@ -781,6 +781,9 @@
 from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_set import (
     CloudWorkloadSecurityAgentRuleActionSet,
 )
+from datadog_api_client.v2.model.cloud_workload_security_agent_rule_action_set_value import (
+    CloudWorkloadSecurityAgentRuleActionSetValue,
+)
 from datadog_api_client.v2.model.cloud_workload_security_agent_rule_attributes import (
     CloudWorkloadSecurityAgentRuleAttributes,
 )
@@ -5660,6 +5663,7 @@
     "CloudWorkloadSecurityAgentRuleActionHash",
     "CloudWorkloadSecurityAgentRuleActionMetadata",
     "CloudWorkloadSecurityAgentRuleActionSet",
+    "CloudWorkloadSecurityAgentRuleActionSetValue",
     "CloudWorkloadSecurityAgentRuleAttributes",
     "CloudWorkloadSecurityAgentRuleCreateAttributes",
     "CloudWorkloadSecurityAgentRuleCreateData",

tests/v2/cassettes/test_scenarios/test_create_a_workload_protection_agent_rule_returns_bad_request_response.frozen

@@ -1 +1 @@
-2025-10-10T15:20:39.566Z
+2025-12-11T16:09:12.949Z

tests/v2/cassettes/test_scenarios/test_create_a_workload_protection_agent_rule_returns_bad_request_response.yaml

@@ -1,6 +1,6 @@
 interactions:
 - request:
-    body: '{"data":{"attributes":{"description":"My agent policy","enabled":true,"hostTags":["env:staging"],"name":"testcreateaworkloadprotectionagentrulereturnsbadrequestresponse1760109639"},"type":"policy"}}'
+    body: '{"data":{"attributes":{"description":"My agent policy","enabled":true,"hostTags":["env:staging"],"name":"testcreateaworkloadprotectionagentrulereturnsbadrequestresponse1765469352"},"type":"policy"}}'
     headers:
       accept:
       - application/json
@@ -10,16 +10,16 @@ interactions:
     uri: https://api.datadoghq.com/api/v2/remote_config/products/cws/policy
   response:
     body:
-      string: '{"data":{"id":"sr5-i0h-lty","type":"policy","attributes":{"blockingRulesCount":0,"datadogManaged":false,"description":"My
-        agent policy","disabledRulesCount":1,"enabled":true,"hostTagsLists":[["env:staging"]],"monitoringRulesCount":7,"name":"testcreateaworkloadprotectionagentrulereturnsbadrequestresponse1760109639","pinned":false,"policyVersion":"1","ruleCount":8,"updateDate":1760109639958,"updater":{"name":"frog","handle":"frog@datadoghq.com"}}}}'
+      string: '{"data":{"id":"0w7-waz-oev","type":"policy","attributes":{"blockingRulesCount":0,"datadogManaged":false,"description":"My
+        agent policy","disabledRulesCount":1,"enabled":true,"hostTagsLists":[["env:staging"]],"monitoringRulesCount":7,"name":"testcreateaworkloadprotectionagentrulereturnsbadrequestresponse1765469352","pinned":false,"policyVersion":"1","ruleCount":8,"updateDate":1765469353329,"updater":{"name":"frog","handle":"frog@datadoghq.com"}}}}'
     headers:
       content-type:
       - application/json
     status:
       code: 200
       message: OK
 - request:
-    body: '{"data":{"attributes":{"description":"My Agent rule","enabled":true,"expression":"exec.file.name","filters":[],"name":"my_agent_rule","policy_id":"sr5-i0h-lty","product_tags":[]},"type":"agent_rule"}}'
+    body: '{"data":{"attributes":{"description":"My Agent rule","enabled":true,"expression":"exec.file.name","filters":[],"name":"my_agent_rule","policy_id":"0w7-waz-oev","product_tags":[]},"type":"agent_rule"}}'
     headers:
       accept:
       - application/json
@@ -29,8 +29,8 @@ interactions:
     uri: https://api.datadoghq.com/api/v2/remote_config/products/cws/agent_rules
   response:
     body:
-      string: '{"errors":["input_validation_error(Field ''name'' is invalid: the name
-        ''my_agent_rule'' is already used by a custom rule)"]}'
+      string: '{"errors":["input_validation_error(Field ''expression'' is invalid:
+        rule `my_agent_rule` error: rule syntax error: bool expected: 1:1: exec.file.name\n^)"]}'
     headers:
       content-type:
       - application/json
@@ -43,7 +43,7 @@ interactions:
       accept:
       - '*/*'
     method: DELETE
-    uri: https://api.datadoghq.com/api/v2/remote_config/products/cws/policy/sr5-i0h-lty
+    uri: https://api.datadoghq.com/api/v2/remote_config/products/cws/policy/0w7-waz-oev
   response:
     body:
       string: ''

tests/v2/cassettes/test_scenarios/test_create_a_workload_protection_agent_rule_returns_ok_response.frozen

@@ -1 +1 @@
-2025-10-10T15:20:41.757Z
+2025-12-11T16:09:15.376Z