security_monitoring - Add indexes to deprecate index in ruleQuery

.generator/schemas/v2/openapi.yaml

@@ -43891,6 +43891,14 @@ components:
             for scheduled rules - in other words, when the `schedulingOptions` field
             is present in the rule payload.'
           type: string
+        indexes:
+          description: List of indexes to query when the `dataSource` is `logs`. Only
+            used for scheduled rules, such as when the `schedulingOptions` field is
+            present in the rule payload.
+          items:
+            description: Index.
+            type: string
+          type: array
         metric:
           deprecated: true
           description: '(Deprecated) The target field to aggregate over when using

cassettes/features/v2/security_monitoring/Create-a-scheduled-detection-rule-returns-OK-response.frozen

@@ -1 +1 @@
-2025-07-31T07:48:27.113Z
+2025-10-13T21:11:45.641Z

cassettes/features/v2/security_monitoring/Create-a-scheduled-rule-without-rrule-returns-Bad-Request-response.frozen

@@ -1 +1 @@
-2025-07-31T07:49:14.474Z
+2025-10-13T21:12:46.212Z

examples/v2/security-monitoring/CreateSecurityMonitoringRule_868881438.rb

@@ -11,7 +11,9 @@
       aggregation: DatadogAPIClient::V2::SecurityMonitoringRuleQueryAggregation::COUNT,
       group_by_fields: [],
       distinct_fields: [],
-      index: "main",
+      indexes: [
+        "main",
+      ],
     }),
   ],
   filters: [],

features/v2/security_monitoring.feature

@@ -308,7 +308,7 @@ Feature: Security Monitoring
   @team:DataDog/k9-cloud-security-platform
   Scenario: Create a scheduled detection rule returns "OK" response
     Given new "CreateSecurityMonitoringRule" request
-    And body with value {"name":"{{ unique }}", "queries":[{"query":"@test:true","aggregation":"count","groupByFields":[],"distinctFields":[],"index":"main"}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test rule","tags":[],"isEnabled":true, "type":"log_detection", "schedulingOptions": {"rrule": "FREQ=HOURLY;INTERVAL=2;", "start": "2025-06-18T12:00:00", "timezone": "Europe/Paris"}}
+    And body with value {"name":"{{ unique }}", "queries":[{"query":"@test:true","aggregation":"count","groupByFields":[],"distinctFields":[],"indexes":["main"]}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test rule","tags":[],"isEnabled":true, "type":"log_detection", "schedulingOptions": {"rrule": "FREQ=HOURLY;INTERVAL=2;", "start": "2025-06-18T12:00:00", "timezone": "Europe/Paris"}}
     When the request is sent
     Then the response status is 200 OK
     And the response "name" is equal to "{{ unique }}"
@@ -319,7 +319,7 @@ Feature: Security Monitoring
   @team:DataDog/k9-cloud-security-platform
   Scenario: Create a scheduled rule without rrule returns "Bad Request" response
     Given new "CreateSecurityMonitoringRule" request
-    And body with value {"name":"{{ unique }}", "queries":[{"query":"@test:true","aggregation":"count","groupByFields":[],"distinctFields":[],"index":"main"}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test rule","tags":[],"isEnabled":true, "type":"log_detection", "schedulingOptions": {"start": "2025-06-18T12:00:00", "timezone": "Europe/Paris"}}
+    And body with value {"name":"{{ unique }}", "queries":[{"query":"@test:true","aggregation":"count","groupByFields":[],"distinctFields":[],"indexes":["main"]}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test rule","tags":[],"isEnabled":true, "type":"log_detection", "schedulingOptions": {"start": "2025-06-18T12:00:00", "timezone": "Europe/Paris"}}
     When the request is sent
     Then the response status is 400 Bad Request
 

lib/datadog_api_client/v2/models/security_monitoring_standard_rule_query.rb

@@ -43,6 +43,9 @@ class SecurityMonitoringStandardRuleQuery
     # The index to run the query on, if the `dataSource` is `logs`. Only used for scheduled rules - in other words, when the `schedulingOptions` field is present in the rule payload.
     attr_accessor :index
 
+    # List of indexes to query when the `dataSource` is `logs`. Only used for scheduled rules, such as when the `schedulingOptions` field is present in the rule payload.
+    attr_accessor :indexes
+
     # (Deprecated) The target field to aggregate over when using the sum or max
     # aggregations. `metrics` field should be used instead.
     attr_accessor :metric
@@ -69,6 +72,7 @@ def self.attribute_map
         :'group_by_fields' => :'groupByFields',
         :'has_optional_group_by_fields' => :'hasOptionalGroupByFields',
         :'index' => :'index',
+        :'indexes' => :'indexes',
         :'metric' => :'metric',
         :'metrics' => :'metrics',
         :'name' => :'name',
@@ -87,6 +91,7 @@ def self.openapi_types
         :'group_by_fields' => :'Array<String>',
         :'has_optional_group_by_fields' => :'Boolean',
         :'index' => :'String',
+        :'indexes' => :'Array<String>',
         :'metric' => :'String',
         :'metrics' => :'Array<String>',
         :'name' => :'String',
@@ -144,6 +149,12 @@ def initialize(attributes = {})
         self.index = attributes[:'index']
       end
 
+      if attributes.key?(:'indexes')
+        if (value = attributes[:'indexes']).is_a?(Array)
+          self.indexes = value
+        end
+      end
+
       if attributes.key?(:'metric')
         self.metric = attributes[:'metric']
       end
@@ -196,6 +207,7 @@ def ==(o)
           group_by_fields == o.group_by_fields &&
           has_optional_group_by_fields == o.has_optional_group_by_fields &&
           index == o.index &&
+          indexes == o.indexes &&
           metric == o.metric &&
           metrics == o.metrics &&
           name == o.name &&
@@ -207,7 +219,7 @@ def ==(o)
     # @return [Integer] Hash code
     # @!visibility private
     def hash
-      [aggregation, custom_query_extension, data_source, distinct_fields, group_by_fields, has_optional_group_by_fields, index, metric, metrics, name, query, additional_properties].hash
+      [aggregation, custom_query_extension, data_source, distinct_fields, group_by_fields, has_optional_group_by_fields, index, indexes, metric, metrics, name, query, additional_properties].hash
     end
   end
 end