Add support for Datadog Events as a data source for rules (#670)

Co-authored-by: ci.datadog-api-spec <[email protected]>

Author: api-clients-generation-pipeline[bot]

.apigentools-info

@@ -4,13 +4,13 @@
     "spec_versions": {
         "v1": {
             "apigentools_version": "1.6.6",
-            "regenerated": "2025-05-26 12:46:02.005102",
-            "spec_repo_commit": "a6954c1c"
+            "regenerated": "2025-05-27 10:37:41.623695",
+            "spec_repo_commit": "c75940cb"
         },
         "v2": {
             "apigentools_version": "1.6.6",
-            "regenerated": "2025-05-26 12:46:02.021792",
-            "spec_repo_commit": "a6954c1c"
+            "regenerated": "2025-05-27 10:37:41.639599",
+            "spec_repo_commit": "c75940cb"
         }
     }
 }

.generator/schemas/v2/openapi.yaml

@@ -33669,14 +33669,15 @@ components:
       - TIMESTAMP_DESCENDING
     SecurityMonitoringStandardDataSource:
       default: logs
-      description: Source of events, either logs or audit trail.
+      description: Source of events, either logs, audit trail, or Datadog events.
       enum:
       - logs
       - audit
       - app_sec_spans
       - spans
       - security_runtime
       - network
+      - events
       example: logs
       type: string
       x-enum-varnames:
@@ -33686,6 +33687,7 @@ components:
       - SPANS
       - SECURITY_RUNTIME
       - NETWORK
+      - EVENTS
     SecurityMonitoringStandardRuleCreatePayload:
       description: Create a new rule.
       properties:

src/datadogV2/model/model_historical_job_query.rs

@@ -14,7 +14,7 @@ pub struct HistoricalJobQuery {
     /// The aggregation type.
     #[serde(rename = "aggregation")]
     pub aggregation: Option<crate::datadogV2::model::SecurityMonitoringRuleQueryAggregation>,
-    /// Source of events, either logs or audit trail.
+    /// Source of events, either logs, audit trail, or Datadog events.
     #[serde(rename = "dataSource")]
     pub data_source: Option<crate::datadogV2::model::SecurityMonitoringStandardDataSource>,
     /// Field for which the cardinality is measured. Sent as an array.

src/datadogV2/model/model_security_monitoring_standard_data_source.rs

@@ -13,6 +13,7 @@ pub enum SecurityMonitoringStandardDataSource {
     SPANS,
     SECURITY_RUNTIME,
     NETWORK,
+    EVENTS,
     UnparsedObject(crate::datadog::UnparsedObject),
 }
 
@@ -25,6 +26,7 @@ impl ToString for SecurityMonitoringStandardDataSource {
             Self::SPANS => String::from("spans"),
             Self::SECURITY_RUNTIME => String::from("security_runtime"),
             Self::NETWORK => String::from("network"),
+            Self::EVENTS => String::from("events"),
             Self::UnparsedObject(v) => v.value.to_string(),
         }
     }
@@ -55,6 +57,7 @@ impl<'de> Deserialize<'de> for SecurityMonitoringStandardDataSource {
             "spans" => Self::SPANS,
             "security_runtime" => Self::SECURITY_RUNTIME,
             "network" => Self::NETWORK,
+            "events" => Self::EVENTS,
             _ => Self::UnparsedObject(crate::datadog::UnparsedObject {
                 value: serde_json::Value::String(s.into()),
             }),

src/datadogV2/model/model_security_monitoring_standard_rule_query.rs

@@ -14,7 +14,7 @@ pub struct SecurityMonitoringStandardRuleQuery {
     /// The aggregation type.
     #[serde(rename = "aggregation")]
     pub aggregation: Option<crate::datadogV2::model::SecurityMonitoringRuleQueryAggregation>,
-    /// Source of events, either logs or audit trail.
+    /// Source of events, either logs, audit trail, or Datadog events.
     #[serde(rename = "dataSource")]
     pub data_source: Option<crate::datadogV2::model::SecurityMonitoringStandardDataSource>,
     /// Field for which the cardinality is measured. Sent as an array.