[pull] master from DataDog:master

.generator/schemas/v2/openapi.yaml

@@ -43891,6 +43891,14 @@ components:
             for scheduled rules - in other words, when the `schedulingOptions` field
             is present in the rule payload.'
           type: string
+        indexes:
+          description: List of indexes to query when the `dataSource` is `logs`. Only
+            used for scheduled rules, such as when the `schedulingOptions` field is
+            present in the rule payload.
+          items:
+            description: Index.
+            type: string
+          type: array
         metric:
           deprecated: true
           description: '(Deprecated) The target field to aggregate over when using
@@ -75602,7 +75610,7 @@ paths:
         appKeyAuth: []
       - AuthZ:
         - cloud_cost_management_read
-      summary: Get ruleset
+      summary: Get a tag pipeline ruleset
       tags:
       - Cloud Cost Management
     patch:

cassettes/features/v2/cloud_cost_management/Get-a-tag-pipeline-ruleset-returns-OK-response.frozen

@@ -0,0 +1 @@
+2025-10-14T20:06:56.512Z

cassettes/features/v2/security_monitoring/Create-a-scheduled-detection-rule-returns-OK-response.frozen

@@ -1 +1 @@
-2025-07-31T07:48:27.113Z
+2025-10-13T21:11:45.641Z

cassettes/features/v2/security_monitoring/Create-a-scheduled-rule-without-rrule-returns-Bad-Request-response.frozen

@@ -1 +1 @@
-2025-07-31T07:49:14.474Z
+2025-10-13T21:12:46.212Z

examples/v2/cloud-cost-management/GetTagPipelinesRuleset.rb

@@ -1,5 +1,5 @@
-# Get ruleset returns "OK" response
+# Get a tag pipeline ruleset returns "OK" response
 
 require "datadog_api_client"
 api_instance = DatadogAPIClient::V2::CloudCostManagementAPI.new
-p api_instance.get_tag_pipelines_ruleset("ruleset_id")
+p api_instance.get_tag_pipelines_ruleset("a1e9de9b-b88e-41c6-a0cd-cc0ebd7092de")

examples/v2/security-monitoring/CreateSecurityMonitoringRule_868881438.rb

@@ -11,7 +11,9 @@
       aggregation: DatadogAPIClient::V2::SecurityMonitoringRuleQueryAggregation::COUNT,
       group_by_fields: [],
       distinct_fields: [],
-      index: "main",
+      indexes: [
+        "main",
+      ],
     }),
   ],
   filters: [],

features/v2/cloud_cost_management.feature

@@ -262,6 +262,15 @@ Feature: Cloud Cost Management
     When the request is sent
     Then the response status is 200 OK
 
+  @replay-only @team:DataDog/cloud-cost-management
+  Scenario: Get a tag pipeline ruleset returns "OK" response
+    Given new "GetTagPipelinesRuleset" request
+    And request contains "ruleset_id" parameter with value "a1e9de9b-b88e-41c6-a0cd-cc0ebd7092de"
+    When the request is sent
+    Then the response status is 200 OK
+    And the response "data.type" is equal to "ruleset"
+    And the response "data.attributes.name" is equal to "EVP Cost Tags"
+
   @replay-only @team:DataDog/cloud-cost-management
   Scenario: Get cost AWS CUR config returns "OK" response
     Given new "GetCostAWSCURConfig" request
@@ -288,22 +297,6 @@ Feature: Cloud Cost Management
     When the request is sent
     Then the response status is 200 OK
 
-  @generated @skip @team:DataDog/cloud-cost-management
-  Scenario: Get ruleset returns "OK" response
-    Given new "GetTagPipelinesRuleset" request
-    And request contains "ruleset_id" parameter from "REPLACE.ME"
-    When the request is sent
-    Then the response status is 200 OK
-
-  @replay-only @team:DataDog/cloud-cost-management
-  Scenario: Get tag pipeline ruleset returns "OK" response
-    Given new "GetTagPipelinesRuleset" request
-    And request contains "ruleset_id" parameter with value "ee10c3ff-312f-464c-b4f6-46adaa6d00a1"
-    When the request is sent
-    Then the response status is 200 OK
-    And the response "data.type" is equal to "ruleset"
-    And the response "data.attributes.name" is equal to "New Ruleset"
-
   @replay-only @team:DataDog/cloud-cost-management
   Scenario: List Cloud Cost Management AWS CUR configs returns "OK" response
     Given new "ListCostAWSCURConfigs" request

features/v2/security_monitoring.feature

@@ -308,7 +308,7 @@ Feature: Security Monitoring
   @team:DataDog/k9-cloud-security-platform
   Scenario: Create a scheduled detection rule returns "OK" response
     Given new "CreateSecurityMonitoringRule" request
-    And body with value {"name":"{{ unique }}", "queries":[{"query":"@test:true","aggregation":"count","groupByFields":[],"distinctFields":[],"index":"main"}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test rule","tags":[],"isEnabled":true, "type":"log_detection", "schedulingOptions": {"rrule": "FREQ=HOURLY;INTERVAL=2;", "start": "2025-06-18T12:00:00", "timezone": "Europe/Paris"}}
+    And body with value {"name":"{{ unique }}", "queries":[{"query":"@test:true","aggregation":"count","groupByFields":[],"distinctFields":[],"indexes":["main"]}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test rule","tags":[],"isEnabled":true, "type":"log_detection", "schedulingOptions": {"rrule": "FREQ=HOURLY;INTERVAL=2;", "start": "2025-06-18T12:00:00", "timezone": "Europe/Paris"}}
     When the request is sent
     Then the response status is 200 OK
     And the response "name" is equal to "{{ unique }}"
@@ -319,7 +319,7 @@ Feature: Security Monitoring
   @team:DataDog/k9-cloud-security-platform
   Scenario: Create a scheduled rule without rrule returns "Bad Request" response
     Given new "CreateSecurityMonitoringRule" request
-    And body with value {"name":"{{ unique }}", "queries":[{"query":"@test:true","aggregation":"count","groupByFields":[],"distinctFields":[],"index":"main"}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test rule","tags":[],"isEnabled":true, "type":"log_detection", "schedulingOptions": {"start": "2025-06-18T12:00:00", "timezone": "Europe/Paris"}}
+    And body with value {"name":"{{ unique }}", "queries":[{"query":"@test:true","aggregation":"count","groupByFields":[],"distinctFields":[],"indexes":["main"]}],"filters":[],"cases":[{"name":"","status":"info","condition":"a > 0","notifications":[]}],"options":{"evaluationWindow":900,"keepAlive":3600,"maxSignalDuration":86400},"message":"Test rule","tags":[],"isEnabled":true, "type":"log_detection", "schedulingOptions": {"start": "2025-06-18T12:00:00", "timezone": "Europe/Paris"}}
     When the request is sent
     Then the response status is 400 Bad Request
 

lib/datadog_api_client/v2/api/cloud_cost_management_api.rb

@@ -1215,15 +1215,15 @@ def get_custom_costs_file_with_http_info(file_id, opts = {})
       return data, status_code, headers
     end
 
-    # Get ruleset.
+    # Get a tag pipeline ruleset.
     #
     # @see #get_tag_pipelines_ruleset_with_http_info
     def get_tag_pipelines_ruleset(ruleset_id, opts = {})
       data, _status_code, _headers = get_tag_pipelines_ruleset_with_http_info(ruleset_id, opts)
       data
     end
 
-    # Get ruleset.
+    # Get a tag pipeline ruleset.
     #
     # Get a specific tag pipeline ruleset - Retrieve a specific tag pipeline ruleset by its ID
     #

lib/datadog_api_client/v2/models/security_monitoring_standard_rule_query.rb

@@ -43,6 +43,9 @@ class SecurityMonitoringStandardRuleQuery
     # The index to run the query on, if the `dataSource` is `logs`. Only used for scheduled rules - in other words, when the `schedulingOptions` field is present in the rule payload.
     attr_accessor :index
 
+    # List of indexes to query when the `dataSource` is `logs`. Only used for scheduled rules, such as when the `schedulingOptions` field is present in the rule payload.
+    attr_accessor :indexes
+
     # (Deprecated) The target field to aggregate over when using the sum or max
     # aggregations. `metrics` field should be used instead.
     attr_accessor :metric
@@ -69,6 +72,7 @@ def self.attribute_map
         :'group_by_fields' => :'groupByFields',
         :'has_optional_group_by_fields' => :'hasOptionalGroupByFields',
         :'index' => :'index',
+        :'indexes' => :'indexes',
         :'metric' => :'metric',
         :'metrics' => :'metrics',
         :'name' => :'name',
@@ -87,6 +91,7 @@ def self.openapi_types
         :'group_by_fields' => :'Array<String>',
         :'has_optional_group_by_fields' => :'Boolean',
         :'index' => :'String',
+        :'indexes' => :'Array<String>',
         :'metric' => :'String',
         :'metrics' => :'Array<String>',
         :'name' => :'String',
@@ -144,6 +149,12 @@ def initialize(attributes = {})
         self.index = attributes[:'index']
       end
 
+      if attributes.key?(:'indexes')
+        if (value = attributes[:'indexes']).is_a?(Array)
+          self.indexes = value
+        end
+      end
+
       if attributes.key?(:'metric')
         self.metric = attributes[:'metric']
       end
@@ -196,6 +207,7 @@ def ==(o)
           group_by_fields == o.group_by_fields &&
           has_optional_group_by_fields == o.has_optional_group_by_fields &&
           index == o.index &&
+          indexes == o.indexes &&
           metric == o.metric &&
           metrics == o.metrics &&
           name == o.name &&
@@ -207,7 +219,7 @@ def ==(o)
     # @return [Integer] Hash code
     # @!visibility private
     def hash
-      [aggregation, custom_query_extension, data_source, distinct_fields, group_by_fields, has_optional_group_by_fields, index, metric, metrics, name, query, additional_properties].hash
+      [aggregation, custom_query_extension, data_source, distinct_fields, group_by_fields, has_optional_group_by_fields, index, indexes, metric, metrics, name, query, additional_properties].hash
     end
   end
 end