From ee7c33bdd5c555f416fd02a5a717dfa5aaa21cb4 Mon Sep 17 00:00:00 2001
From: Zander Mackie <zander.mackie@datadoghq.com>
Date: Fri, 22 May 2026 13:21:53 -0400
Subject: [PATCH] Add common acronyms and brand nouns to SIEM-Names namecase
 exceptions

Adds Anthropic, API, Claude, CLI, DNS, IP, MFA, RBAC, SSO, URL to the
exceptions list. These appear unmodified in scores of production SIEM
detection rule names today and need to be allowed by the namecase
check so that new rule authoring is consistent with established
convention.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 styles/SIEM-Names/namecase.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/styles/SIEM-Names/namecase.yml b/styles/SIEM-Names/namecase.yml
index f377a24..9182922 100644
--- a/styles/SIEM-Names/namecase.yml
+++ b/styles/SIEM-Names/namecase.yml
@@ -8,6 +8,8 @@ exceptions:
   - Autoscaling Group
   - Amazon EC2 Instance
   - Amazon S3
+  - Anthropic
+  - API
   - API calls
   - Auth0 Attack Protection
   - Auth0 Breached Password Detection
@@ -32,11 +34,14 @@ exceptions:
   - Azure AD Identity Protection
   - Azure AD Privileged Identity Management
   - Check Point Quantum Firewall
+  - Claude
+  - CLI
   - CloudTrail
   - Cloudflare
   - Cloudflare CASB Finding
   - Cloudflare L7 DDOS
   - CrowdStrike Alerts
+  - DNS
   - Enterprise Organization
   - GitHub
   - GitHub Advanced Security
@@ -56,8 +61,10 @@ exceptions:
   - IdP configuration changed
   - Impossible Travel Auth0
   - IoC
+  - IP
   - Jamf Protect
   - JumpCloud
+  - MFA
   - Microsoft 365 Application Impersonation
   - Microsoft 365 Default or Anonymous
   - Microsoft 365 E-Discovery
@@ -73,9 +80,12 @@ exceptions:
   - Okta
   - Okta Identity Provider
   - Palo Alto Networks Firewall
+  - RBAC
   - RDS Snapshot
   - Scout Suite
   - Sqreen
+  - SSO
   - Tor
   - TruffleHog
+  - URL
   - Zendesk Automatic Redaction