Add support for Datadog Events as a data source for rules (#2578)

Co-authored-by: ci.datadog-api-spec <[email protected]>

Author: api-clients-generation-pipeline[bot]

.apigentools-info

@@ -4,13 +4,13 @@
     "spec_versions": {
         "v1": {
             "apigentools_version": "1.6.6",
-            "regenerated": "2025-05-26 12:46:05.900228",
-            "spec_repo_commit": "a6954c1c"
+            "regenerated": "2025-05-27 10:37:47.296878",
+            "spec_repo_commit": "c75940cb"
         },
         "v2": {
             "apigentools_version": "1.6.6",
-            "regenerated": "2025-05-26 12:46:05.916628",
-            "spec_repo_commit": "a6954c1c"
+            "regenerated": "2025-05-27 10:37:47.323956",
+            "spec_repo_commit": "c75940cb"
         }
     }
 }

.generator/schemas/v2/openapi.yaml

@@ -33669,14 +33669,15 @@ components:
       - TIMESTAMP_DESCENDING
     SecurityMonitoringStandardDataSource:
       default: logs
-      description: Source of events, either logs or audit trail.
+      description: Source of events, either logs, audit trail, or Datadog events.
       enum:
       - logs
       - audit
       - app_sec_spans
       - spans
       - security_runtime
       - network
+      - events
       example: logs
       type: string
       x-enum-varnames:
@@ -33686,6 +33687,7 @@ components:
       - SPANS
       - SECURITY_RUNTIME
       - NETWORK
+      - EVENTS
     SecurityMonitoringStandardRuleCreatePayload:
       description: Create a new rule.
       properties:

src/datadog_api_client/v2/model/historical_job_query.py

@@ -75,7 +75,7 @@ def __init__(
         :param aggregation: The aggregation type.
         :type aggregation: SecurityMonitoringRuleQueryAggregation, optional
 
-        :param data_source: Source of events, either logs or audit trail.
+        :param data_source: Source of events, either logs, audit trail, or Datadog events.
         :type data_source: SecurityMonitoringStandardDataSource, optional
 
         :param distinct_fields: Field for which the cardinality is measured. Sent as an array.

src/datadog_api_client/v2/model/security_monitoring_rule_query.py

@@ -18,7 +18,7 @@ def __init__(self, **kwargs):
         :param aggregation: The aggregation type.
         :type aggregation: SecurityMonitoringRuleQueryAggregation, optional
 
-        :param data_source: Source of events, either logs or audit trail.
+        :param data_source: Source of events, either logs, audit trail, or Datadog events.
         :type data_source: SecurityMonitoringStandardDataSource, optional
 
         :param distinct_fields: Field for which the cardinality is measured. Sent as an array.

src/datadog_api_client/v2/model/security_monitoring_standard_data_source.py

@@ -14,9 +14,9 @@
 
 class SecurityMonitoringStandardDataSource(ModelSimple):
     """
-    Source of events, either logs or audit trail.
+    Source of events, either logs, audit trail, or Datadog events.
 
-    :param value: If omitted defaults to "logs". Must be one of ["logs", "audit", "app_sec_spans", "spans", "security_runtime", "network"].
+    :param value: If omitted defaults to "logs". Must be one of ["logs", "audit", "app_sec_spans", "spans", "security_runtime", "network", "events"].
     :type value: str
     """
 
@@ -27,13 +27,15 @@ class SecurityMonitoringStandardDataSource(ModelSimple):
         "spans",
         "security_runtime",
         "network",
+        "events",
     }
     LOGS: ClassVar["SecurityMonitoringStandardDataSource"]
     AUDIT: ClassVar["SecurityMonitoringStandardDataSource"]
     APP_SEC_SPANS: ClassVar["SecurityMonitoringStandardDataSource"]
     SPANS: ClassVar["SecurityMonitoringStandardDataSource"]
     SECURITY_RUNTIME: ClassVar["SecurityMonitoringStandardDataSource"]
     NETWORK: ClassVar["SecurityMonitoringStandardDataSource"]
+    EVENTS: ClassVar["SecurityMonitoringStandardDataSource"]
 
     @cached_property
     def openapi_types(_):
@@ -48,3 +50,4 @@ def openapi_types(_):
 SecurityMonitoringStandardDataSource.SPANS = SecurityMonitoringStandardDataSource("spans")
 SecurityMonitoringStandardDataSource.SECURITY_RUNTIME = SecurityMonitoringStandardDataSource("security_runtime")
 SecurityMonitoringStandardDataSource.NETWORK = SecurityMonitoringStandardDataSource("network")
+SecurityMonitoringStandardDataSource.EVENTS = SecurityMonitoringStandardDataSource("events")

src/datadog_api_client/v2/model/security_monitoring_standard_rule_query.py

@@ -78,7 +78,7 @@ def __init__(
         :param aggregation: The aggregation type.
         :type aggregation: SecurityMonitoringRuleQueryAggregation, optional
 
-        :param data_source: Source of events, either logs or audit trail.
+        :param data_source: Source of events, either logs, audit trail, or Datadog events.
         :type data_source: SecurityMonitoringStandardDataSource, optional
 
         :param distinct_fields: Field for which the cardinality is measured. Sent as an array.