security_monitoring - Add indexes to deprecate index in ruleQuery

.generator/schemas/v2/openapi.yaml

@@ -43891,6 +43891,14 @@ components:
             for scheduled rules - in other words, when the `schedulingOptions` field
             is present in the rule payload.'
           type: string
+        indexes:
+          description: List of indexes to query when the `dataSource` is `logs`. Only
+            used for scheduled rules, such as when the `schedulingOptions` field is
+            present in the rule payload.
+          items:
+            description: Index.
+            type: string
+          type: array
         metric:
           deprecated: true
           description: '(Deprecated) The target field to aggregate over when using

examples/v2/security-monitoring/CreateSecurityMonitoringRule_868881438.java

@@ -32,7 +32,7 @@ public static void main(String[] args) {
                         new SecurityMonitoringStandardRuleQuery()
                             .query("@test:true")
                             .aggregation(SecurityMonitoringRuleQueryAggregation.COUNT)
-                            .index("main")))
+                            .indexes(Collections.singletonList("main"))))
                 .cases(
                     Collections.singletonList(
                         new SecurityMonitoringRuleCaseCreate()

src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringStandardRuleQuery.java

@@ -27,6 +27,7 @@
   SecurityMonitoringStandardRuleQuery.JSON_PROPERTY_GROUP_BY_FIELDS,
   SecurityMonitoringStandardRuleQuery.JSON_PROPERTY_HAS_OPTIONAL_GROUP_BY_FIELDS,
   SecurityMonitoringStandardRuleQuery.JSON_PROPERTY_INDEX,
+  SecurityMonitoringStandardRuleQuery.JSON_PROPERTY_INDEXES,
   SecurityMonitoringStandardRuleQuery.JSON_PROPERTY_METRIC,
   SecurityMonitoringStandardRuleQuery.JSON_PROPERTY_METRICS,
   SecurityMonitoringStandardRuleQuery.JSON_PROPERTY_NAME,
@@ -59,6 +60,9 @@ public class SecurityMonitoringStandardRuleQuery {
   public static final String JSON_PROPERTY_INDEX = "index";
   private String index;
 
+  public static final String JSON_PROPERTY_INDEXES = "indexes";
+  private List<String> indexes = null;
+
   public static final String JSON_PROPERTY_METRIC = "metric";
   private String metric;
 
@@ -249,6 +253,37 @@ public void setIndex(String index) {
     this.index = index;
   }
 
+  public SecurityMonitoringStandardRuleQuery indexes(List<String> indexes) {
+    this.indexes = indexes;
+    return this;
+  }
+
+  public SecurityMonitoringStandardRuleQuery addIndexesItem(String indexesItem) {
+    if (this.indexes == null) {
+      this.indexes = new ArrayList<>();
+    }
+    this.indexes.add(indexesItem);
+    return this;
+  }
+
+  /**
+   * List of indexes to query when the <code>dataSource</code> is <code>logs</code>. Only used for
+   * scheduled rules, such as when the <code>schedulingOptions</code> field is present in the rule
+   * payload.
+   *
+   * @return indexes
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_INDEXES)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public List<String> getIndexes() {
+    return indexes;
+  }
+
+  public void setIndexes(List<String> indexes) {
+    this.indexes = indexes;
+  }
+
   public SecurityMonitoringStandardRuleQuery metric(String metric) {
     this.metric = metric;
     return this;
@@ -414,6 +449,7 @@ public boolean equals(Object o) {
             this.hasOptionalGroupByFields,
             securityMonitoringStandardRuleQuery.hasOptionalGroupByFields)
         && Objects.equals(this.index, securityMonitoringStandardRuleQuery.index)
+        && Objects.equals(this.indexes, securityMonitoringStandardRuleQuery.indexes)
         && Objects.equals(this.metric, securityMonitoringStandardRuleQuery.metric)
         && Objects.equals(this.metrics, securityMonitoringStandardRuleQuery.metrics)
         && Objects.equals(this.name, securityMonitoringStandardRuleQuery.name)
@@ -432,6 +468,7 @@ public int hashCode() {
         groupByFields,
         hasOptionalGroupByFields,
         index,
+        indexes,
         metric,
         metrics,
         name,
@@ -454,6 +491,7 @@ public String toString() {
         .append(toIndentedString(hasOptionalGroupByFields))
         .append("\n");
     sb.append("    index: ").append(toIndentedString(index)).append("\n");
+    sb.append("    indexes: ").append(toIndentedString(indexes)).append("\n");
     sb.append("    metric: ").append(toIndentedString(metric)).append("\n");
     sb.append("    metrics: ").append(toIndentedString(metrics)).append("\n");
     sb.append("    name: ").append(toIndentedString(name)).append("\n");

src/test/resources/cassettes/features/v2/Create_a_scheduled_detection_rule_returns_OK_response.freeze

@@ -1 +1 @@
-2025-07-31T07:48:27.113Z
+2025-10-13T21:11:45.641Z

src/test/resources/cassettes/features/v2/Create_a_scheduled_detection_rule_returns_OK_response.json

@@ -3,7 +3,7 @@
     "httpRequest": {
       "body": {
         "type": "JSON",
-        "json": "{\"cases\":[{\"condition\":\"a > 0\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"isEnabled\":true,\"message\":\"Test rule\",\"name\":\"Test-Create_a_scheduled_detection_rule_returns_OK_response-1753948107\",\"options\":{\"evaluationWindow\":900,\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[],\"index\":\"main\",\"query\":\"@test:true\"}],\"schedulingOptions\":{\"rrule\":\"FREQ=HOURLY;INTERVAL=2;\",\"start\":\"2025-06-18T12:00:00\",\"timezone\":\"Europe/Paris\"},\"tags\":[],\"type\":\"log_detection\"}"
+        "json": "{\"cases\":[{\"condition\":\"a > 0\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"isEnabled\":true,\"message\":\"Test rule\",\"name\":\"Test-Create_a_scheduled_detection_rule_returns_OK_response-1760389905\",\"options\":{\"evaluationWindow\":900,\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[],\"indexes\":[\"main\"],\"query\":\"@test:true\"}],\"schedulingOptions\":{\"rrule\":\"FREQ=HOURLY;INTERVAL=2;\",\"start\":\"2025-06-18T12:00:00\",\"timezone\":\"Europe/Paris\"},\"tags\":[],\"type\":\"log_detection\"}"
       },
       "headers": {},
       "method": "POST",
@@ -12,7 +12,7 @@
       "secure": true
     },
     "httpResponse": {
-      "body": "{\"name\":\"Test-Create_a_scheduled_detection_rule_returns_OK_response-1753948107\",\"createdAt\":1753948107557,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isBeta\":false,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"@test:true\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\",\"dataSource\":\"logs\",\"index\":\"main\"}],\"options\":{\"evaluationWindow\":900,\"detectionMethod\":\"threshold\",\"maxSignalDuration\":86400,\"keepAlive\":3600},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a \\u003e 0\"}],\"message\":\"Test rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"log_detection\",\"filters\":[],\"version\":1,\"id\":\"8dd-els-oyn\",\"blocking\":false,\"metadata\":{\"entities\":null,\"sources\":null},\"creationAuthorId\":1445416,\"creator\":{\"handle\":\"frog@datadoghq.com\",\"name\":\"frog\"},\"updater\":{\"handle\":\"\",\"name\":\"\"},\"schedulingOptions\":{\"rrule\":\"FREQ=HOURLY;INTERVAL=2;\",\"start\":\"2025-06-18T12:00:00\",\"timezone\":\"Europe/Paris\"}}",
+      "body": "{\"name\":\"Test-Create_a_scheduled_detection_rule_returns_OK_response-1760389905\",\"createdAt\":1760389906051,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isBeta\":false,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"@test:true\",\"groupByFields\":[],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\",\"dataSource\":\"logs\",\"index\":\"main\",\"indexes\":[\"main\"]}],\"options\":{\"evaluationWindow\":900,\"detectionMethod\":\"threshold\",\"maxSignalDuration\":86400,\"keepAlive\":3600},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a \\u003e 0\"}],\"message\":\"Test rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"log_detection\",\"filters\":[],\"version\":1,\"id\":\"vgs-rrg-orf\",\"blocking\":false,\"metadata\":{\"entities\":null,\"sources\":null},\"creationAuthorId\":1445416,\"creator\":{\"handle\":\"frog@datadoghq.com\",\"name\":\"frog\"},\"updater\":{\"handle\":\"\",\"name\":\"\"},\"schedulingOptions\":{\"rrule\":\"FREQ=HOURLY;INTERVAL=2;\",\"start\":\"2025-06-18T12:00:00\",\"timezone\":\"Europe/Paris\"}}",
       "headers": {
         "Content-Type": [
           "application/json"
@@ -27,13 +27,13 @@
     "timeToLive": {
       "unlimited": true
     },
-    "id": "65e5fd9c-f3ea-d6c4-2b6c-2fecaf3465a1"
+    "id": "9e554439-1b54-c57a-6309-6e4100546bfd"
   },
   {
     "httpRequest": {
       "headers": {},
       "method": "DELETE",
-      "path": "/api/v2/security_monitoring/rules/8dd-els-oyn",
+      "path": "/api/v2/security_monitoring/rules/vgs-rrg-orf",
       "keepAlive": false,
       "secure": true
     },
@@ -48,6 +48,6 @@
     "timeToLive": {
       "unlimited": true
     },
-    "id": "9ba28a92-1a04-dada-8d9d-8beaa90e5bf7"
+    "id": "3f90a9ee-1856-1d23-8f2f-54a61f8a9e13"
   }
 ]

src/test/resources/cassettes/features/v2/Create_a_scheduled_rule_without_rrule_returns_Bad_Request_response.freeze

@@ -1 +1 @@
-2025-07-31T07:49:14.474Z
+2025-10-13T21:12:46.212Z

src/test/resources/cassettes/features/v2/Create_a_scheduled_rule_without_rrule_returns_Bad_Request_response.json

@@ -3,7 +3,7 @@
     "httpRequest": {
       "body": {
         "type": "JSON",
-        "json": "{\"cases\":[{\"condition\":\"a > 0\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"isEnabled\":true,\"message\":\"Test rule\",\"name\":\"Test-Create_a_scheduled_rule_without_rrule_returns_Bad_Request_response-1753948154\",\"options\":{\"evaluationWindow\":900,\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[],\"index\":\"main\",\"query\":\"@test:true\"}],\"schedulingOptions\":{\"start\":\"2025-06-18T12:00:00\",\"timezone\":\"Europe/Paris\"},\"tags\":[],\"type\":\"log_detection\"}"
+        "json": "{\"cases\":[{\"condition\":\"a > 0\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"isEnabled\":true,\"message\":\"Test rule\",\"name\":\"Test-Create_a_scheduled_rule_without_rrule_returns_Bad_Request_response-1760389966\",\"options\":{\"evaluationWindow\":900,\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[],\"indexes\":[\"main\"],\"query\":\"@test:true\"}],\"schedulingOptions\":{\"start\":\"2025-06-18T12:00:00\",\"timezone\":\"Europe/Paris\"},\"tags\":[],\"type\":\"log_detection\"}"
       },
       "headers": {},
       "method": "POST",
@@ -27,6 +27,6 @@
     "timeToLive": {
       "unlimited": true
     },
-    "id": "d9e00af4-d106-73ad-b787-bc97f2c88023"
+    "id": "cbbd6e4e-af0e-9a07-6e70-f2b3e17abe21"
   }
 ]

src/test/resources/com/datadog/api/client/v2/api/security_monitoring.feature

@@ -308,7 +308,7 @@ Feature: Security Monitoring
   @team:DataDog/k9-cloud-security-platform
   Scenario: Create a scheduled detection rule returns "OK" response
     Given new "CreateSecurityMonitoringRule" request
-    And body with value {"name":"{{ unique }}", "queries":[{"query":"@test:true","aggregation":"count","groupByFields":[],"distinctFields":[],"index":"main"}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test rule","tags":[],"isEnabled":true, "type":"log_detection", "schedulingOptions": {"rrule": "FREQ=HOURLY;INTERVAL=2;", "start": "2025-06-18T12:00:00", "timezone": "Europe/Paris"}}
+    And body with value {"name":"{{ unique }}", "queries":[{"query":"@test:true","aggregation":"count","groupByFields":[],"distinctFields":[],"indexes":["main"]}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test rule","tags":[],"isEnabled":true, "type":"log_detection", "schedulingOptions": {"rrule": "FREQ=HOURLY;INTERVAL=2;", "start": "2025-06-18T12:00:00", "timezone": "Europe/Paris"}}
     When the request is sent
     Then the response status is 200 OK
     And the response "name" is equal to "{{ unique }}"
@@ -319,7 +319,7 @@ Feature: Security Monitoring
   @team:DataDog/k9-cloud-security-platform
   Scenario: Create a scheduled rule without rrule returns "Bad Request" response
     Given new "CreateSecurityMonitoringRule" request
-    And body with value {"name":"{{ unique }}", "queries":[{"query":"@test:true","aggregation":"count","groupByFields":[],"distinctFields":[],"index":"main"}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test rule","tags":[],"isEnabled":true, "type":"log_detection", "schedulingOptions": {"start": "2025-06-18T12:00:00", "timezone": "Europe/Paris"}}
+    And body with value {"name":"{{ unique }}", "queries":[{"query":"@test:true","aggregation":"count","groupByFields":[],"distinctFields":[],"indexes":["main"]}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test rule","tags":[],"isEnabled":true, "type":"log_detection", "schedulingOptions": {"start": "2025-06-18T12:00:00", "timezone": "Europe/Paris"}}
     When the request is sent
     Then the response status is 400 Bad Request