[SEC-37056] Document security signal search response fields

.generator/schemas/v2/openapi.yaml

@@ -102133,9 +102133,21 @@ components:
       additionalProperties: {}
       description: "The object containing all signal attributes and their\nassociated values."
       properties:
+        attributes:
+          additionalProperties: {}
+          description: A JSON object of attributes in the security signal, returned when listing or searching signals.
+          example:
+            workflow:
+              first_seen: "2020-06-23T14:46:01.000Z"
+              last_seen: "2020-06-23T14:46:49.000Z"
+              rule:
+                id: 0f5-e0c-805
+                name: "Brute Force Attack Grouped By User"
+                version: 12
+          type: object
         custom:
           additionalProperties: {}
-          description: A JSON object of attributes in the security signal.
+          description: A JSON object of attributes in the security signal, returned when retrieving a single signal.
           example:
             workflow:
               first_seen: "2020-06-23T14:46:01.000Z"
@@ -102968,8 +102980,21 @@ components:
     SecurityMonitoringSignalsListResponseMeta:
       description: Meta attributes.
       properties:
+        elapsed:
+          description: The time elapsed in milliseconds.
+          example: 132
+          format: int64
+          type: integer
         page:
           $ref: '#/components/schemas/SecurityMonitoringSignalsListResponseMetaPage'
+        request_id:
+          description: The unique identifier of the request.
+          example: example-request-id
+          type: string
+        status:
+          description: The status of the response.
+          example: done
+          type: string
       type: object
     SecurityMonitoringSignalsListResponseMetaPage:
       description: Paging attributes.
@@ -205487,15 +205512,24 @@ paths:
                   value:
                     data:
                       - attributes:
+                          attributes:
+                            workflow:
+                              rule:
+                                id: 0f5-e0c-805
+                                name: "Brute Force Attack Grouped By User"
+                                version: 12
                           tags:
                             - "source:cloudtrail"
                         id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
                         type: signal
                     links:
                       next: ""
                     meta:
+                      elapsed: 132
                       page:
                         after: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
+                      request_id: example-request-id
+                      status: done
               schema:
                 $ref: '#/components/schemas/SecurityMonitoringSignalsListResponse'
           description: OK

examples/v2/security-monitoring/SearchSecurityMonitoringSignals.ts

@@ -10,13 +10,11 @@ const apiInstance = new v2.SecurityMonitoringApi(configuration);
 const params: v2.SecurityMonitoringApiSearchSecurityMonitoringSignalsRequest = {
   body: {
     filter: {
-      from: new Date(2019, 1, 2, 9, 42, 36, 320000),
+      from: new Date(new Date().getTime() + -15 * 60 * 1000),
       query: "security:attack status:high",
-      to: new Date(2019, 1, 3, 9, 42, 36, 320000),
+      to: new Date(),
     },
     page: {
-      cursor:
-        "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==",
       limit: 25,
     },
     sort: "timestamp",

features/generated-test/test-runner-data/manifest.json

@@ -9730,6 +9730,13 @@
       "scenario": "Get a job's details returns \"OK\" response",
       "version": "v2"
     },
+    {
+      "feature": "Security Monitoring",
+      "feature_file": "../../v2/security_monitoring.feature",
+      "file": "v2/security-monitoring/get-a-list-of-security-signals-returns-ok-response.json",
+      "scenario": "Get a list of security signals returns \"OK\" response",
+      "version": "v2"
+    },
     {
       "feature": "Security Monitoring",
       "feature_file": "../../v2/security_monitoring.feature",

features/generated-test/test-runner-data/v2/security-monitoring/get-a-list-of-security-signals-returns-ok-response.json

@@ -0,0 +1,28 @@
+{
+  "api": "SecurityMonitoring",
+  "expected_status": 200,
+  "feature": "Security Monitoring",
+  "id": "v2/Security Monitoring/Get a list of security signals returns \"OK\" response",
+  "operation_id": "SearchSecurityMonitoringSignals",
+  "request": {
+    "body": {
+      "schema": {
+        "format": null,
+        "ref": "SecurityMonitoringSignalListRequest",
+        "type": "object"
+      },
+      "source": "inline",
+      "value": {
+        "$openapi_transformer_template": "{\"filter\": {\"from\": \"{{ timeISO(\"now-15m\") }}\", \"query\": \"security:attack status:high\", \"to\": \"{{ timeISO(\"now\") }}\"}, \"page\": {\"limit\": 25}, \"sort\": \"timestamp\"}"
+      }
+    },
+    "content_type": "application/json",
+    "method": "POST",
+    "pagination": false,
+    "parameters": [],
+    "path": "/api/v2/security_monitoring/signals/search"
+  },
+  "scenario": "Get a list of security signals returns \"OK\" response",
+  "schema_version": 1,
+  "version": "v2"
+}

features/generated-test/test-server-data/v2/security-monitoring.json

@@ -6315,6 +6315,47 @@
       "scenario": "Get a job's details returns \"OK\" response",
       "version": "v2"
     },
+    {
+      "feature": "Security Monitoring",
+      "frozen_at": "2026-09-07T11:46:49.362Z",
+      "interactions": [
+        {
+          "request": {
+            "body": {
+              "type": "json",
+              "value": {
+                "filter": {
+                  "from": "2026-09-07T11:31:49.362Z",
+                  "query": "security:attack status:high",
+                  "to": "2026-09-07T11:46:49.362Z"
+                },
+                "page": {
+                  "limit": 25
+                },
+                "sort": "timestamp"
+              }
+            },
+            "content_type": "application/json",
+            "method": "POST",
+            "path": "/api/v2/security_monitoring/signals/search",
+            "query": []
+          },
+          "response": {
+            "body": {
+              "encoding": "text",
+              "value": "{\"data\":[],\"meta\":{\"elapsed\":24,\"request_id\":\"pddv1ChZqcnNodVBJQ1RWQ3Z2c3ZWNk16b1hnIiwKHEcyOE2iTY5xAPH0dcTcAYFseqFJt4YjCHkKmO4SDDns4KG5VTag-ijkzg\",\"status\":\"done\"}}"
+            },
+            "headers": {
+              "content-type": "application/json"
+            },
+            "reason": "OK",
+            "status": 200
+          }
+        }
+      ],
+      "scenario": "Get a list of security signals returns \"OK\" response",
+      "version": "v2"
+    },
     {
       "feature": "Security Monitoring",
       "frozen_at": "2022-04-13T11:32:57.080Z",

features/v2/security_monitoring.feature

@@ -1787,12 +1787,15 @@ Feature: Security Monitoring
     When the request is sent
     Then the response status is 400 Bad Request
 
-  @generated @skip @team:DataDog/cloud-siem
+  @team:DataDog/cloud-siem
   Scenario: Get a list of security signals returns "OK" response
     Given new "SearchSecurityMonitoringSignals" request
-    And body with value {"filter": {"from": "2019-01-02T09:42:36.320Z", "query": "security:attack status:high", "to": "2019-01-03T09:42:36.320Z"}, "page": {"cursor": "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==", "limit": 25}, "sort": "timestamp"}
+    And body with value {"filter": {"from": "{{ timeISO("now-15m") }}", "query": "security:attack status:high", "to": "{{ timeISO("now") }}"}, "page": {"limit": 25}, "sort": "timestamp"}
     When the request is sent
     Then the response status is 200 OK
+    And the response "meta" has field "elapsed"
+    And the response "meta" has field "request_id"
+    And the response "meta.status" is equal to "done"
 
   @replay-only @skip-validation @team:DataDog/cloud-siem @with-pagination
   Scenario: Get a list of security signals returns "OK" response with pagination

packages/datadog-api-client-v2/models/SecurityMonitoringSignalAttributes.ts

@@ -12,7 +12,11 @@ import { AttributeTypeMap } from "../../datadog-api-client-common/util";
  */
 export class SecurityMonitoringSignalAttributes {
   /**
-   * A JSON object of attributes in the security signal.
+   * A JSON object of attributes in the security signal, returned when listing or searching signals.
+   */
+  "attributes"?: { [key: string]: any };
+  /**
+   * A JSON object of attributes in the security signal, returned when retrieving a single signal.
    */
   "custom"?: { [key: string]: any };
   /**
@@ -44,6 +48,10 @@ export class SecurityMonitoringSignalAttributes {
    * @ignore
    */
   static readonly attributeTypeMap: AttributeTypeMap = {
+    attributes: {
+      baseName: "attributes",
+      type: "{ [key: string]: any; }",
+    },
     custom: {
       baseName: "custom",
       type: "{ [key: string]: any; }",

packages/datadog-api-client-v2/models/SecurityMonitoringSignalsListResponseMeta.ts

@@ -11,10 +11,22 @@ import { AttributeTypeMap } from "../../datadog-api-client-common/util";
  * Meta attributes.
  */
 export class SecurityMonitoringSignalsListResponseMeta {
+  /**
+   * The time elapsed in milliseconds.
+   */
+  "elapsed"?: number;
   /**
    * Paging attributes.
    */
   "page"?: SecurityMonitoringSignalsListResponseMetaPage;
+  /**
+   * The unique identifier of the request.
+   */
+  "requestId"?: string;
+  /**
+   * The status of the response.
+   */
+  "status"?: string;
 
   /**
    * A container for additional, undeclared properties.
@@ -32,10 +44,23 @@ export class SecurityMonitoringSignalsListResponseMeta {
    * @ignore
    */
   static readonly attributeTypeMap: AttributeTypeMap = {
+    elapsed: {
+      baseName: "elapsed",
+      type: "number",
+      format: "int64",
+    },
     page: {
       baseName: "page",
       type: "SecurityMonitoringSignalsListResponseMetaPage",
     },
+    requestId: {
+      baseName: "request_id",
+      type: "string",
+    },
+    status: {
+      baseName: "status",
+      type: "string",
+    },
     additionalProperties: {
       baseName: "additionalProperties",
       type: "{ [key: string]: any; }",