Align ListSecurityMonitoringRules responses with the API

.generator/schemas/v2/openapi.yaml

@@ -101484,6 +101484,9 @@ components:
           $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations'
         baselineUserLocationsDuration:
           $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocationsDuration'
+        detectIpTransition:
+          description: Whether to detect transitions between IP addresses.
+          type: boolean
       type: object
     SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations:
       description: "If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access."
@@ -101564,13 +101567,34 @@ components:
         - SIX_HOURS
         - TWELVE_HOURS
         - ONE_DAY
+    SecurityMonitoringRuleMetadata:
+      description: Metadata associated with the rule.
+      properties:
+        entities:
+          description: Entities associated with the rule, or null when metadata is not requested.
+          items: {}
+          nullable: true
+          type: array
+        sources:
+          description: Sources associated with the rule, or null when metadata is not requested.
+          items:
+            description: A source.
+            type: string
+          nullable: true
+          type: array
+      type: object
     SecurityMonitoringRuleNewValueOptions:
       description: Options on new value detection method.
       properties:
         forgetAfter:
           $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter'
         instantaneousBaseline:
           $ref: '#/components/schemas/SecurityMonitoringRuleInstantaneousBaseline'
+        instantaneousBaselineTimeoutMinutes:
+          description: Timeout in minutes for constructing the instantaneous baseline.
+          format: int32
+          maximum: 2147483647
+          type: integer
         learningDuration:
           $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration'
         learningMethod:
@@ -101635,8 +101659,17 @@ components:
           $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration'
         newValueOptions:
           $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions'
+        relatedSignalsFields:
+          description: Fields used to identify related signals.
+          items:
+            description: A field name.
+            type: string
+          type: array
         sequenceDetectionOptions:
           $ref: '#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions'
+        signalTitleTemplate:
+          description: A template for the signal title.
+          type: string
         thirdPartyRuleOptions:
           $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions'
       type: object
@@ -101708,7 +101741,7 @@ components:
           type: string
       type: object
     SecurityMonitoringRuleResponse:
-      description: Create a new rule.
+      description: A security monitoring rule.
       oneOf:
         - $ref: '#/components/schemas/SecurityMonitoringStandardRuleResponse'
         - $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponse'
@@ -101965,6 +101998,16 @@ components:
           maximum: 2147483647
           type: integer
       type: object
+    SecurityMonitoringRuleUser:
+      description: The user who created or last updated the rule.
+      properties:
+        handle:
+          description: The user handle. Empty for a default rule with no user.
+          type: string
+        name:
+          description: The user name. Empty for a default rule with no user.
+          type: string
+      type: object
     SecurityMonitoringRuleValidatePayload:
       description: Validate a rule.
       oneOf:
@@ -102424,6 +102467,9 @@ components:
     SecurityMonitoringSignalRuleResponse:
       description: Rule.
       properties:
+        blocking:
+          description: Whether the rule blocks attackers.
+          type: boolean
         cases:
           description: Cases for generating signals.
           items:
@@ -102437,12 +102483,23 @@ components:
           description: User ID of the user who created the rule.
           format: int64
           type: integer
+        creator:
+          $ref: '#/components/schemas/SecurityMonitoringRuleUser'
         customMessage:
           description: Custom/Overridden message for generated signals (used in case of Default rule update).
           type: string
         customName:
           description: Custom/Overridden name of the rule (used in case of Default rule update).
           type: string
+        defaultRuleId:
+          description: The ID of the corresponding default rule.
+          type: string
+        defaultTags:
+          description: Default tags for default rules, included in tags.
+          items:
+            description: A default tag.
+            type: string
+          type: array
         deprecationDate:
           description: When the rule will be deprecated, timestamp in milliseconds.
           format: int64
@@ -102458,18 +102515,29 @@ components:
         id:
           description: The ID of the rule.
           type: string
+        isBeta:
+          description: Whether the rule is in beta.
+          type: boolean
         isDefault:
           description: Whether the rule is included by default.
           type: boolean
         isDeleted:
           description: Whether the rule has been deleted.
           type: boolean
+        isDeprecated:
+          description: Whether the rule is deprecated.
+          type: boolean
         isEnabled:
           description: Whether the rule is enabled.
           type: boolean
+        isPartner:
+          description: Whether the rule is provided by a partner.
+          type: boolean
         message:
           description: Message for generated signals.
           type: string
+        metadata:
+          $ref: '#/components/schemas/SecurityMonitoringRuleMetadata'
         name:
           description: The name of the rule.
           type: string
@@ -102492,6 +102560,12 @@ components:
           description: User ID of the user who updated the rule.
           format: int64
           type: integer
+        updatedAt:
+          description: The date the rule was last updated, in milliseconds.
+          format: int64
+          type: integer
+        updater:
+          $ref: '#/components/schemas/SecurityMonitoringRuleUser'
         version:
           description: The version of the rule.
           format: int64
@@ -102529,6 +102603,10 @@ components:
             description: Field.
             type: string
           type: array
+        hasOptionalGroupByFields:
+          description: Whether events with missing group-by fields are processed with a replacement value.
+          example: false
+          type: boolean
         metrics:
           description: Group of target fields to aggregate over.
           items:
@@ -103241,6 +103319,9 @@ components:
     SecurityMonitoringStandardRuleResponse:
       description: Rule.
       properties:
+        blocking:
+          description: Whether the rule blocks attackers.
+          type: boolean
         calculatedFields:
           description: Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined.
           items:
@@ -103261,12 +103342,17 @@ components:
           description: User ID of the user who created the rule.
           format: int64
           type: integer
+        creator:
+          $ref: '#/components/schemas/SecurityMonitoringRuleUser'
         customMessage:
           description: Custom/Overridden message for generated signals (used in case of Default rule update).
           type: string
         customName:
           description: Custom/Overridden name of the rule (used in case of Default rule update).
           type: string
+        defaultRuleId:
+          description: The ID of the corresponding default rule.
+          type: string
         defaultTags:
           description: Default Tags for default rules (included in tags)
           example:
@@ -103275,6 +103361,12 @@ components:
             description: Default Tag.
             type: string
           type: array
+        dependencies:
+          description: IDs of rules that this rule depends on.
+          items:
+            description: A rule ID.
+            type: string
+          type: array
         deprecationDate:
           description: When the rule will be deprecated, timestamp in milliseconds.
           format: int64
@@ -103284,6 +103376,9 @@ components:
           items:
             $ref: '#/components/schemas/SecurityMonitoringFilter'
           type: array
+        findingType:
+          description: The type of findings generated by the rule.
+          type: string
         groupSignalsBy:
           description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.
           example:
@@ -103298,18 +103393,29 @@ components:
         id:
           description: The ID of the rule.
           type: string
+        isBeta:
+          description: Whether the rule is in beta.
+          type: boolean
         isDefault:
           description: Whether the rule is included by default.
           type: boolean
         isDeleted:
           description: Whether the rule has been deleted.
           type: boolean
+        isDeprecated:
+          description: Whether the rule is deprecated.
+          type: boolean
         isEnabled:
           description: Whether the rule is enabled.
           type: boolean
+        isPartner:
+          description: Whether the rule is provided by a partner.
+          type: boolean
         message:
           description: Message for generated signals.
           type: string
+        metadata:
+          $ref: '#/components/schemas/SecurityMonitoringRuleMetadata'
         name:
           description: The name of the rule.
           type: string
@@ -103349,6 +103455,8 @@ components:
           description: The date the rule was last updated, in milliseconds.
           format: int64
           type: integer
+        updater:
+          $ref: '#/components/schemas/SecurityMonitoringRuleUser'
         version:
           description: The version of the rule.
           format: int64
@@ -203960,10 +204068,73 @@ paths:
                 default:
                   value:
                     data:
-                      - id: abc-123
+                      - blocking: false
+                        creator:
+                          handle: security@example.com
+                          name: Security Team
+                        id: abc-123
+                        isBeta: false
+                        isDeprecated: false
                         isEnabled: true
+                        isPartner: false
+                        metadata:
+                          entities:
+                          sources:
                         name: My security monitoring rule.
+                        options:
+                          detectionMethod: threshold
+                          relatedSignalsFields: ["service"]
+                          signalTitleTemplate: Security signal
                         type: log_detection
+                        updater:
+                          handle: security@example.com
+                          name: Security Team
+                    meta: {}
+                impossible_travel:
+                  value:
+                    data:
+                      - id: jkl-012
+                        options:
+                          detectionMethod: impossible_travel
+                          impossibleTravelOptions:
+                            detectIpTransition: true
+                        type: log_detection
+                    meta: {}
+                new_value:
+                  value:
+                    data:
+                      - id: ghi-789
+                        options:
+                          detectionMethod: new_value
+                          newValueOptions:
+                            instantaneousBaselineTimeoutMinutes: 0
+                        type: log_detection
+                    meta: {}
+                signal_correlation:
+                  value:
+                    data:
+                      - blocking: false
+                        creator:
+                          handle: ""
+                          name: ""
+                        defaultRuleId: def-000-abc
+                        defaultTags: ["security:attack"]
+                        id: def-456
+                        isBeta: false
+                        isDeprecated: false
+                        isPartner: false
+                        metadata:
+                          entities:
+                          sources:
+                        queries:
+                          - aggregation: event_count
+                            defaultRuleId: def-000-123
+                            hasOptionalGroupByFields: false
+                        type: signal_correlation
+                        updatedAt: 1750000000000
+                        updater:
+                          handle: ""
+                          name: ""
                     meta: {}
               schema:
                 $ref: '#/components/schemas/SecurityMonitoringListRulesResponse'

src/main/java/com/datadog/api/client/v2/model/RuleVersions.java

@@ -77,7 +77,7 @@ public RuleVersions rule(SecurityMonitoringRuleResponse rule) {
   }
 
   /**
-   * Create a new rule.
+   * A security monitoring rule.
    *
    * @return rule
    */