[SEC-37056] Document security signal search response fields

.generator/schemas/v2/openapi.yaml

@@ -102133,9 +102133,21 @@ components:
       additionalProperties: {}
       description: "The object containing all signal attributes and their\nassociated values."
       properties:
+        attributes:
+          additionalProperties: {}
+          description: A JSON object of attributes in the security signal, returned when listing or searching signals.
+          example:
+            workflow:
+              first_seen: "2020-06-23T14:46:01.000Z"
+              last_seen: "2020-06-23T14:46:49.000Z"
+              rule:
+                id: 0f5-e0c-805
+                name: "Brute Force Attack Grouped By User"
+                version: 12
+          type: object
         custom:
           additionalProperties: {}
-          description: A JSON object of attributes in the security signal.
+          description: A JSON object of attributes in the security signal, returned when retrieving a single signal.
           example:
             workflow:
               first_seen: "2020-06-23T14:46:01.000Z"
@@ -102968,8 +102980,21 @@ components:
     SecurityMonitoringSignalsListResponseMeta:
       description: Meta attributes.
       properties:
+        elapsed:
+          description: The time elapsed in milliseconds.
+          example: 132
+          format: int64
+          type: integer
         page:
           $ref: '#/components/schemas/SecurityMonitoringSignalsListResponseMetaPage'
+        request_id:
+          description: The unique identifier of the request.
+          example: example-request-id
+          type: string
+        status:
+          description: The status of the response.
+          example: done
+          type: string
       type: object
     SecurityMonitoringSignalsListResponseMetaPage:
       description: Paging attributes.
@@ -205487,15 +205512,24 @@ paths:
                   value:
                     data:
                       - attributes:
+                          attributes:
+                            workflow:
+                              rule:
+                                id: 0f5-e0c-805
+                                name: "Brute Force Attack Grouped By User"
+                                version: 12
                           tags:
                             - "source:cloudtrail"
                         id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
                         type: signal
                     links:
                       next: ""
                     meta:
+                      elapsed: 132
                       page:
                         after: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
+                      request_id: example-request-id
+                      status: done
               schema:
                 $ref: '#/components/schemas/SecurityMonitoringSignalsListResponse'
           description: OK

examples/v2/security-monitoring/SearchSecurityMonitoringSignals.java

@@ -1,5 +1,4 @@
 // Get a list of security signals returns "OK" response
-
 import com.datadog.api.client.ApiClient;
 import com.datadog.api.client.ApiException;
 import com.datadog.api.client.v2.api.SecurityMonitoringApi;
@@ -20,14 +19,10 @@ public static void main(String[] args) {
         new SecurityMonitoringSignalListRequest()
             .filter(
                 new SecurityMonitoringSignalListRequestFilter()
-                    .from(OffsetDateTime.parse("2019-01-02T09:42:36.320Z"))
+                    .from(OffsetDateTime.now().plusMinutes(-15))
                     .query("security:attack status:high")
-                    .to(OffsetDateTime.parse("2019-01-03T09:42:36.320Z")))
-            .page(
-                new SecurityMonitoringSignalListRequestPage()
-                    .cursor(
-                        "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==")
-                    .limit(25))
+                    .to(OffsetDateTime.now()))
+            .page(new SecurityMonitoringSignalListRequestPage().limit(25))
             .sort(SecurityMonitoringSignalsSort.TIMESTAMP_ASCENDING);
 
     try {

src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringSignalAttributes.java

@@ -21,6 +21,7 @@
 
 /** The object containing all signal attributes and their associated values. */
 @JsonPropertyOrder({
+  SecurityMonitoringSignalAttributes.JSON_PROPERTY_ATTRIBUTES,
   SecurityMonitoringSignalAttributes.JSON_PROPERTY_CUSTOM,
   SecurityMonitoringSignalAttributes.JSON_PROPERTY_MESSAGE,
   SecurityMonitoringSignalAttributes.JSON_PROPERTY_TAGS,
@@ -30,6 +31,9 @@
     value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator")
 public class SecurityMonitoringSignalAttributes {
   @JsonIgnore public boolean unparsed = false;
+  public static final String JSON_PROPERTY_ATTRIBUTES = "attributes";
+  private Map<String, Object> attributes = null;
+
   public static final String JSON_PROPERTY_CUSTOM = "custom";
   private Map<String, Object> custom = null;
 
@@ -42,6 +46,35 @@ public class SecurityMonitoringSignalAttributes {
   public static final String JSON_PROPERTY_TIMESTAMP = "timestamp";
   private OffsetDateTime timestamp;
 
+  public SecurityMonitoringSignalAttributes attributes(Map<String, Object> attributes) {
+    this.attributes = attributes;
+    return this;
+  }
+
+  public SecurityMonitoringSignalAttributes putAttributesItem(String key, Object attributesItem) {
+    if (this.attributes == null) {
+      this.attributes = new HashMap<>();
+    }
+    this.attributes.put(key, attributesItem);
+    return this;
+  }
+
+  /**
+   * A JSON object of attributes in the security signal, returned when listing or searching signals.
+   *
+   * @return attributes
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_ATTRIBUTES)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public Map<String, Object> getAttributes() {
+    return attributes;
+  }
+
+  public void setAttributes(Map<String, Object> attributes) {
+    this.attributes = attributes;
+  }
+
   public SecurityMonitoringSignalAttributes custom(Map<String, Object> custom) {
     this.custom = custom;
     return this;
@@ -56,7 +89,7 @@ public SecurityMonitoringSignalAttributes putCustomItem(String key, Object custo
   }
 
   /**
-   * A JSON object of attributes in the security signal.
+   * A JSON object of attributes in the security signal, returned when retrieving a single signal.
    *
    * @return custom
    */
@@ -199,7 +232,8 @@ public boolean equals(Object o) {
     }
     SecurityMonitoringSignalAttributes securityMonitoringSignalAttributes =
         (SecurityMonitoringSignalAttributes) o;
-    return Objects.equals(this.custom, securityMonitoringSignalAttributes.custom)
+    return Objects.equals(this.attributes, securityMonitoringSignalAttributes.attributes)
+        && Objects.equals(this.custom, securityMonitoringSignalAttributes.custom)
         && Objects.equals(this.message, securityMonitoringSignalAttributes.message)
         && Objects.equals(this.tags, securityMonitoringSignalAttributes.tags)
         && Objects.equals(this.timestamp, securityMonitoringSignalAttributes.timestamp)
@@ -209,13 +243,14 @@ public boolean equals(Object o) {
 
   @Override
   public int hashCode() {
-    return Objects.hash(custom, message, tags, timestamp, additionalProperties);
+    return Objects.hash(attributes, custom, message, tags, timestamp, additionalProperties);
   }
 
   @Override
   public String toString() {
     StringBuilder sb = new StringBuilder();
     sb.append("class SecurityMonitoringSignalAttributes {\n");
+    sb.append("    attributes: ").append(toIndentedString(attributes)).append("\n");
     sb.append("    custom: ").append(toIndentedString(custom)).append("\n");
     sb.append("    message: ").append(toIndentedString(message)).append("\n");
     sb.append("    tags: ").append(toIndentedString(tags)).append("\n");

src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringSignalsListResponseMeta.java

@@ -17,14 +17,49 @@
 import java.util.Objects;
 
 /** Meta attributes. */
-@JsonPropertyOrder({SecurityMonitoringSignalsListResponseMeta.JSON_PROPERTY_PAGE})
+@JsonPropertyOrder({
+  SecurityMonitoringSignalsListResponseMeta.JSON_PROPERTY_ELAPSED,
+  SecurityMonitoringSignalsListResponseMeta.JSON_PROPERTY_PAGE,
+  SecurityMonitoringSignalsListResponseMeta.JSON_PROPERTY_REQUEST_ID,
+  SecurityMonitoringSignalsListResponseMeta.JSON_PROPERTY_STATUS
+})
 @jakarta.annotation.Generated(
     value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator")
 public class SecurityMonitoringSignalsListResponseMeta {
   @JsonIgnore public boolean unparsed = false;
+  public static final String JSON_PROPERTY_ELAPSED = "elapsed";
+  private Long elapsed;
+
   public static final String JSON_PROPERTY_PAGE = "page";
   private SecurityMonitoringSignalsListResponseMetaPage page;
 
+  public static final String JSON_PROPERTY_REQUEST_ID = "request_id";
+  private String requestId;
+
+  public static final String JSON_PROPERTY_STATUS = "status";
+  private String status;
+
+  public SecurityMonitoringSignalsListResponseMeta elapsed(Long elapsed) {
+    this.elapsed = elapsed;
+    return this;
+  }
+
+  /**
+   * The time elapsed in milliseconds.
+   *
+   * @return elapsed
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_ELAPSED)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public Long getElapsed() {
+    return elapsed;
+  }
+
+  public void setElapsed(Long elapsed) {
+    this.elapsed = elapsed;
+  }
+
   public SecurityMonitoringSignalsListResponseMeta page(
       SecurityMonitoringSignalsListResponseMetaPage page) {
     this.page = page;
@@ -51,6 +86,48 @@ public void setPage(SecurityMonitoringSignalsListResponseMetaPage page) {
     }
   }
 
+  public SecurityMonitoringSignalsListResponseMeta requestId(String requestId) {
+    this.requestId = requestId;
+    return this;
+  }
+
+  /**
+   * The unique identifier of the request.
+   *
+   * @return requestId
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_REQUEST_ID)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public String getRequestId() {
+    return requestId;
+  }
+
+  public void setRequestId(String requestId) {
+    this.requestId = requestId;
+  }
+
+  public SecurityMonitoringSignalsListResponseMeta status(String status) {
+    this.status = status;
+    return this;
+  }
+
+  /**
+   * The status of the response.
+   *
+   * @return status
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_STATUS)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public String getStatus() {
+    return status;
+  }
+
+  public void setStatus(String status) {
+    this.status = status;
+  }
+
   /**
    * A container for additional, undeclared properties. This is a holder for any undeclared
    * properties as specified with the 'additionalProperties' keyword in the OAS document.
@@ -108,22 +185,28 @@ public boolean equals(Object o) {
     }
     SecurityMonitoringSignalsListResponseMeta securityMonitoringSignalsListResponseMeta =
         (SecurityMonitoringSignalsListResponseMeta) o;
-    return Objects.equals(this.page, securityMonitoringSignalsListResponseMeta.page)
+    return Objects.equals(this.elapsed, securityMonitoringSignalsListResponseMeta.elapsed)
+        && Objects.equals(this.page, securityMonitoringSignalsListResponseMeta.page)
+        && Objects.equals(this.requestId, securityMonitoringSignalsListResponseMeta.requestId)
+        && Objects.equals(this.status, securityMonitoringSignalsListResponseMeta.status)
         && Objects.equals(
             this.additionalProperties,
             securityMonitoringSignalsListResponseMeta.additionalProperties);
   }
 
   @Override
   public int hashCode() {
-    return Objects.hash(page, additionalProperties);
+    return Objects.hash(elapsed, page, requestId, status, additionalProperties);
   }
 
   @Override
   public String toString() {
     StringBuilder sb = new StringBuilder();
     sb.append("class SecurityMonitoringSignalsListResponseMeta {\n");
+    sb.append("    elapsed: ").append(toIndentedString(elapsed)).append("\n");
     sb.append("    page: ").append(toIndentedString(page)).append("\n");
+    sb.append("    requestId: ").append(toIndentedString(requestId)).append("\n");
+    sb.append("    status: ").append(toIndentedString(status)).append("\n");
     sb.append("    additionalProperties: ")
         .append(toIndentedString(additionalProperties))
         .append("\n");

src/test/resources/com/datadog/api/client/v2/api/security_monitoring.feature

@@ -1787,12 +1787,15 @@ Feature: Security Monitoring
     When the request is sent
     Then the response status is 400 Bad Request
 
-  @generated @skip @team:DataDog/cloud-siem
+  @team:DataDog/cloud-siem
   Scenario: Get a list of security signals returns "OK" response
     Given new "SearchSecurityMonitoringSignals" request
-    And body with value {"filter": {"from": "2019-01-02T09:42:36.320Z", "query": "security:attack status:high", "to": "2019-01-03T09:42:36.320Z"}, "page": {"cursor": "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==", "limit": 25}, "sort": "timestamp"}
+    And body with value {"filter": {"from": "{{ timeISO("now-15m") }}", "query": "security:attack status:high", "to": "{{ timeISO("now") }}"}, "page": {"limit": 25}, "sort": "timestamp"}
     When the request is sent
     Then the response status is 200 OK
+    And the response "meta" has field "elapsed"
+    And the response "meta" has field "request_id"
+    And the response "meta.status" is equal to "done"
 
   @replay-only @skip-validation @team:DataDog/cloud-siem @with-pagination
   Scenario: Get a list of security signals returns "OK" response with pagination

src/test/resources/generated-test/test-runner-data/manifest.json

@@ -9730,6 +9730,13 @@
       "scenario": "Get a job's details returns \"OK\" response",
       "version": "v2"
     },
+    {
+      "feature": "Security Monitoring",
+      "feature_file": "../../com/datadog/api/client/v2/api/security_monitoring.feature",
+      "file": "v2/security-monitoring/get-a-list-of-security-signals-returns-ok-response.json",
+      "scenario": "Get a list of security signals returns \"OK\" response",
+      "version": "v2"
+    },
     {
       "feature": "Security Monitoring",
       "feature_file": "../../com/datadog/api/client/v2/api/security_monitoring.feature",

src/test/resources/generated-test/test-runner-data/v2/security-monitoring/get-a-list-of-security-signals-returns-ok-response.json

@@ -0,0 +1,28 @@
+{
+  "api": "SecurityMonitoring",
+  "expected_status": 200,
+  "feature": "Security Monitoring",
+  "id": "v2/Security Monitoring/Get a list of security signals returns \"OK\" response",
+  "operation_id": "SearchSecurityMonitoringSignals",
+  "request": {
+    "body": {
+      "schema": {
+        "format": null,
+        "ref": "SecurityMonitoringSignalListRequest",
+        "type": "object"
+      },
+      "source": "inline",
+      "value": {
+        "$openapi_transformer_template": "{\"filter\": {\"from\": \"{{ timeISO(\"now-15m\") }}\", \"query\": \"security:attack status:high\", \"to\": \"{{ timeISO(\"now\") }}\"}, \"page\": {\"limit\": 25}, \"sort\": \"timestamp\"}"
+      }
+    },
+    "content_type": "application/json",
+    "method": "POST",
+    "pagination": false,
+    "parameters": [],
+    "path": "/api/v2/security_monitoring/signals/search"
+  },
+  "scenario": "Get a list of security signals returns \"OK\" response",
+  "schema_version": 1,
+  "version": "v2"
+}