[SEC-19484] Add datasource to rule model

.apigentools-info

@@ -4,13 +4,13 @@
     "spec_versions": {
         "v1": {
             "apigentools_version": "1.6.6",
-            "regenerated": "2025-03-11 16:30:31.555356",
-            "spec_repo_commit": "baf04a80"
+            "regenerated": "2025-03-13 09:11:27.618467",
+            "spec_repo_commit": "a1fc1148"
         },
         "v2": {
             "apigentools_version": "1.6.6",
-            "regenerated": "2025-03-11 16:30:31.570839",
-            "spec_repo_commit": "baf04a80"
+            "regenerated": "2025-03-13 09:11:27.634732",
+            "spec_repo_commit": "a1fc1148"
         }
     }
 }

.generator/schemas/v2/openapi.yaml

@@ -27642,6 +27642,17 @@ components:
       x-enum-varnames:
       - TIMESTAMP_ASCENDING
       - TIMESTAMP_DESCENDING
+    SecurityMonitoringStandardDataSource:
+      default: logs
+      description: Source of events, either logs or audit trail.
+      enum:
+      - logs
+      - audit
+      example: logs
+      type: string
+      x-enum-varnames:
+      - LOGS
+      - AUDIT
     SecurityMonitoringStandardRuleCreatePayload:
       description: Create a new rule.
       properties:
@@ -27809,6 +27820,8 @@ components:
       properties:
         aggregation:
           $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation'
+        dataSource:
+          $ref: '#/components/schemas/SecurityMonitoringStandardDataSource'
         distinctFields:
           description: Field for which the cardinality is measured. Sent as an array.
           items:

lib/datadog_api_client/inflector.rb

@@ -2643,6 +2643,7 @@ def overrides
           "v2.security_monitoring_signal_triage_update_data" => "SecurityMonitoringSignalTriageUpdateData",
           "v2.security_monitoring_signal_triage_update_response" => "SecurityMonitoringSignalTriageUpdateResponse",
           "v2.security_monitoring_signal_type" => "SecurityMonitoringSignalType",
+          "v2.security_monitoring_standard_data_source" => "SecurityMonitoringStandardDataSource",
           "v2.security_monitoring_standard_rule_create_payload" => "SecurityMonitoringStandardRuleCreatePayload",
           "v2.security_monitoring_standard_rule_payload" => "SecurityMonitoringStandardRulePayload",
           "v2.security_monitoring_standard_rule_query" => "SecurityMonitoringStandardRuleQuery",

lib/datadog_api_client/v2/models/security_monitoring_standard_data_source.rb

@@ -0,0 +1,27 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: [email protected]
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Source of events, either logs or audit trail.
+  class SecurityMonitoringStandardDataSource
+    include BaseEnumModel
+
+    LOGS = "logs".freeze
+    AUDIT = "audit".freeze
+  end
+end

lib/datadog_api_client/v2/models/security_monitoring_standard_rule_query.rb

@@ -24,6 +24,9 @@ class SecurityMonitoringStandardRuleQuery
     # The aggregation type.
     attr_accessor :aggregation
 
+    # Source of events, either logs or audit trail.
+    attr_accessor :data_source
+
     # Field for which the cardinality is measured. Sent as an array.
     attr_accessor :distinct_fields
 
@@ -53,6 +56,7 @@ class SecurityMonitoringStandardRuleQuery
     def self.attribute_map
       {
         :'aggregation' => :'aggregation',
+        :'data_source' => :'dataSource',
         :'distinct_fields' => :'distinctFields',
         :'group_by_fields' => :'groupByFields',
         :'has_optional_group_by_fields' => :'hasOptionalGroupByFields',
@@ -68,6 +72,7 @@ def self.attribute_map
     def self.openapi_types
       {
         :'aggregation' => :'SecurityMonitoringRuleQueryAggregation',
+        :'data_source' => :'SecurityMonitoringStandardDataSource',
         :'distinct_fields' => :'Array<String>',
         :'group_by_fields' => :'Array<String>',
         :'has_optional_group_by_fields' => :'Boolean',
@@ -100,6 +105,10 @@ def initialize(attributes = {})
         self.aggregation = attributes[:'aggregation']
       end
 
+      if attributes.key?(:'data_source')
+        self.data_source = attributes[:'data_source']
+      end
+
       if attributes.key?(:'distinct_fields')
         if (value = attributes[:'distinct_fields']).is_a?(Array)
           self.distinct_fields = value
@@ -162,6 +171,7 @@ def ==(o)
       return true if self.equal?(o)
       self.class == o.class &&
           aggregation == o.aggregation &&
+          data_source == o.data_source &&
           distinct_fields == o.distinct_fields &&
           group_by_fields == o.group_by_fields &&
           has_optional_group_by_fields == o.has_optional_group_by_fields &&
@@ -176,7 +186,7 @@ def ==(o)
     # @return [Integer] Hash code
     # @!visibility private
     def hash
-      [aggregation, distinct_fields, group_by_fields, has_optional_group_by_fields, metric, metrics, name, query, additional_properties].hash
+      [aggregation, data_source, distinct_fields, group_by_fields, has_optional_group_by_fields, metric, metrics, name, query, additional_properties].hash
     end
   end
 end