From 3eb08950c826cb97316dc915afc112fc3803cb44 Mon Sep 17 00:00:00 2001
From: "ci.datadog-api-spec" <packages@datadoghq.com>
Date: Fri, 7 Feb 2025 12:33:55 +0000
Subject: [PATCH] Regenerate client from commit 6e838a18 of spec repo

---
 .apigentools-info                             |   8 +-
 .generator/schemas/v2/openapi.yaml            |  94 +++++++++-
 ...eateSecurityMonitoringRule_1965169892.java |  76 ++++++++
 .../api/client/v2/api/ConfluentCloudApi.java  |  64 +++----
 .../api/client/v2/model/JobDefinition.java    |  37 ++++
 .../v2/model/SecurityMonitoringRuleCase.java  |  43 ++++-
 .../SecurityMonitoringRuleCaseAction.java     | 173 ++++++++++++++++++
 ...curityMonitoringRuleCaseActionOptions.java | 138 ++++++++++++++
 .../SecurityMonitoringRuleCaseActionType.java |  62 +++++++
 .../SecurityMonitoringRuleCaseCreate.java     |  44 ++++-
 .../SecurityMonitoringRuleUpdatePayload.java  |  37 ++++
 ...tyMonitoringStandardRuleCreatePayload.java |  39 ++++
 ...SecurityMonitoringStandardRulePayload.java |  37 ++++
 ...ecurityMonitoringStandardRuleResponse.java |  38 ++++
 ...rityMonitoringStandardRuleTestPayload.java |  39 ++++
 ...cation_security_returns_OK_response.freeze |   1 +
 ...lication_security_returns_OK_response.json |  58 ++++++
 .../client/v2/api/security_monitoring.feature |  10 +
 18 files changed, 957 insertions(+), 41 deletions(-)
 create mode 100644 examples/v2/security-monitoring/CreateSecurityMonitoringRule_1965169892.java
 create mode 100644 src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseAction.java
 create mode 100644 src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseActionOptions.java
 create mode 100644 src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseActionType.java
 create mode 100644 src/test/resources/cassettes/features/v2/Create_a_detection_rule_with_type_application_security_returns_OK_response.freeze
 create mode 100644 src/test/resources/cassettes/features/v2/Create_a_detection_rule_with_type_application_security_returns_OK_response.json

diff --git a/.apigentools-info b/.apigentools-info
index 80b4cf85273..815b338d647 100644
--- a/.apigentools-info
+++ b/.apigentools-info
@@ -4,13 +4,13 @@
     "spec_versions": {
         "v1": {
             "apigentools_version": "1.6.6",
-            "regenerated": "2025-02-06 17:59:36.285895",
-            "spec_repo_commit": "b89b292b"
+            "regenerated": "2025-02-07 12:32:00.355763",
+            "spec_repo_commit": "6e838a18"
         },
         "v2": {
             "apigentools_version": "1.6.6",
-            "regenerated": "2025-02-06 17:59:36.301562",
-            "spec_repo_commit": "b89b292b"
+            "regenerated": "2025-02-07 12:32:00.370791",
+            "spec_repo_commit": "6e838a18"
         }
     }
 }
\ No newline at end of file
diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml
index 194508f81c8..2c9a695f445 100644
--- a/.generator/schemas/v2/openapi.yaml
+++ b/.generator/schemas/v2/openapi.yaml
@@ -193,7 +193,7 @@ components:
       schema:
         type: string
     ConfluentAccountID:
-      description: Confluent Account id.
+      description: Confluent Account ID.
       in: path
       name: account_id
       required: true
@@ -15657,6 +15657,15 @@ components:
           example: 1729843470000
           format: int64
           type: integer
+        groupSignalsBy:
+          description: Additional grouping to perform on top of the existing groups
+            in the query section. Must be a subset of the existing groups.
+          example:
+          - service
+          items:
+            description: Field to group by.
+            type: string
+          type: array
         index:
           description: Index used to load the data.
           example: cloud_siem
@@ -24242,6 +24251,11 @@ components:
     SecurityMonitoringRuleCase:
       description: Case when signal is generated.
       properties:
+        actions:
+          description: Action to perform for each rule case.
+          items:
+            $ref: '#/components/schemas/SecurityMonitoringRuleCaseAction'
+          type: array
         condition:
           description: 'A rule case contains logical operations (`>`,`>=`, `&&`, `||`)
             to determine if a signal should be generated
@@ -24260,9 +24274,42 @@ components:
         status:
           $ref: '#/components/schemas/SecurityMonitoringRuleSeverity'
       type: object
+    SecurityMonitoringRuleCaseAction:
+      description: Action to perform when a signal is triggered. Only available for
+        Application Security rule type.
+      properties:
+        options:
+          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptions'
+        type:
+          $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionType'
+      type: object
+    SecurityMonitoringRuleCaseActionOptions:
+      description: Options for the rule action
+      properties:
+        duration:
+          description: Duration of the action in seconds. 0 indicates no expiration.
+          example: 0
+          format: int64
+          minimum: 0
+          type: integer
+      type: object
+    SecurityMonitoringRuleCaseActionType:
+      description: The action type.
+      enum:
+      - block_ip
+      - block_user
+      type: string
+      x-enum-varnames:
+      - BLOCK_IP
+      - BLOCK_USER
     SecurityMonitoringRuleCaseCreate:
       description: Case when signal is generated.
       properties:
+        actions:
+          description: Action to perform for each rule case.
+          items:
+            $ref: '#/components/schemas/SecurityMonitoringRuleCaseAction'
+          type: array
         condition:
           description: 'A case contains logical operations (`>`,`>=`, `&&`, `||`)
             to determine if a signal should be generated
@@ -24724,6 +24771,15 @@ components:
           items:
             $ref: '#/components/schemas/SecurityMonitoringFilter'
           type: array
+        groupSignalsBy:
+          description: Additional grouping to perform on top of the existing groups
+            in the query section. Must be a subset of the existing groups.
+          example:
+          - service
+          items:
+            description: Field to group by.
+            type: string
+          type: array
         hasExtendedTitle:
           description: Whether the notifications include the triggering group-by values
             in their title.
@@ -25429,6 +25485,15 @@ components:
           items:
             $ref: '#/components/schemas/SecurityMonitoringFilter'
           type: array
+        groupSignalsBy:
+          description: Additional grouping to perform on top of the existing groups
+            in the query section. Must be a subset of the existing groups.
+          example:
+          - service
+          items:
+            description: Field to group by.
+            type: string
+          type: array
         hasExtendedTitle:
           description: Whether the notifications include the triggering group-by values
             in their title.
@@ -25501,6 +25566,15 @@ components:
           items:
             $ref: '#/components/schemas/SecurityMonitoringFilter'
           type: array
+        groupSignalsBy:
+          description: Additional grouping to perform on top of the existing groups
+            in the query section. Must be a subset of the existing groups.
+          example:
+          - service
+          items:
+            description: Field to group by.
+            type: string
+          type: array
         hasExtendedTitle:
           description: Whether the notifications include the triggering group-by values
             in their title.
@@ -25642,6 +25716,15 @@ components:
           items:
             $ref: '#/components/schemas/SecurityMonitoringFilter'
           type: array
+        groupSignalsBy:
+          description: Additional grouping to perform on top of the existing groups
+            in the query section. Must be a subset of the existing groups.
+          example:
+          - service
+          items:
+            description: Field to group by.
+            type: string
+          type: array
         hasExtendedTitle:
           description: Whether the notifications include the triggering group-by values
             in their title.
@@ -25719,6 +25802,15 @@ components:
           items:
             $ref: '#/components/schemas/SecurityMonitoringFilter'
           type: array
+        groupSignalsBy:
+          description: Additional grouping to perform on top of the existing groups
+            in the query section. Must be a subset of the existing groups.
+          example:
+          - service
+          items:
+            description: Field to group by.
+            type: string
+          type: array
         hasExtendedTitle:
           description: Whether the notifications include the triggering group-by values
             in their title.
diff --git a/examples/v2/security-monitoring/CreateSecurityMonitoringRule_1965169892.java b/examples/v2/security-monitoring/CreateSecurityMonitoringRule_1965169892.java
new file mode 100644
index 00000000000..5b2083afe26
--- /dev/null
+++ b/examples/v2/security-monitoring/CreateSecurityMonitoringRule_1965169892.java
@@ -0,0 +1,76 @@
+// Create a detection rule with type 'application_security 'returns "OK" response
+
+import com.datadog.api.client.ApiClient;
+import com.datadog.api.client.ApiException;
+import com.datadog.api.client.v2.api.SecurityMonitoringApi;
+import com.datadog.api.client.v2.model.SecurityMonitoringRuleCaseAction;
+import com.datadog.api.client.v2.model.SecurityMonitoringRuleCaseActionOptions;
+import com.datadog.api.client.v2.model.SecurityMonitoringRuleCaseActionType;
+import com.datadog.api.client.v2.model.SecurityMonitoringRuleCaseCreate;
+import com.datadog.api.client.v2.model.SecurityMonitoringRuleCreatePayload;
+import com.datadog.api.client.v2.model.SecurityMonitoringRuleDetectionMethod;
+import com.datadog.api.client.v2.model.SecurityMonitoringRuleEvaluationWindow;
+import com.datadog.api.client.v2.model.SecurityMonitoringRuleKeepAlive;
+import com.datadog.api.client.v2.model.SecurityMonitoringRuleMaxSignalDuration;
+import com.datadog.api.client.v2.model.SecurityMonitoringRuleOptions;
+import com.datadog.api.client.v2.model.SecurityMonitoringRuleQueryAggregation;
+import com.datadog.api.client.v2.model.SecurityMonitoringRuleResponse;
+import com.datadog.api.client.v2.model.SecurityMonitoringRuleSeverity;
+import com.datadog.api.client.v2.model.SecurityMonitoringRuleTypeCreate;
+import com.datadog.api.client.v2.model.SecurityMonitoringStandardRuleCreatePayload;
+import com.datadog.api.client.v2.model.SecurityMonitoringStandardRuleQuery;
+import java.util.Arrays;
+import java.util.Collections;
+
+public class Example {
+  public static void main(String[] args) {
+    ApiClient defaultClient = ApiClient.getDefaultApiClient();
+    SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient);
+
+    SecurityMonitoringRuleCreatePayload body =
+        new SecurityMonitoringRuleCreatePayload(
+            new SecurityMonitoringStandardRuleCreatePayload()
+                .type(SecurityMonitoringRuleTypeCreate.APPLICATION_SECURITY)
+                .name("Example-Security-Monitoring_appsec_rule")
+                .queries(
+                    Collections.singletonList(
+                        new SecurityMonitoringStandardRuleQuery()
+                            .query("@appsec.security_activity:business_logic.users.login.failure")
+                            .aggregation(SecurityMonitoringRuleQueryAggregation.COUNT)
+                            .groupByFields(Arrays.asList("service", "@http.client_ip"))))
+                .cases(
+                    Collections.singletonList(
+                        new SecurityMonitoringRuleCaseCreate()
+                            .name("")
+                            .status(SecurityMonitoringRuleSeverity.INFO)
+                            .condition("a > 100000")
+                            .actions(
+                                Collections.singletonList(
+                                    new SecurityMonitoringRuleCaseAction()
+                                        .type(SecurityMonitoringRuleCaseActionType.BLOCK_IP)
+                                        .options(
+                                            new SecurityMonitoringRuleCaseActionOptions()
+                                                .duration(900L))))))
+                .options(
+                    new SecurityMonitoringRuleOptions()
+                        .keepAlive(SecurityMonitoringRuleKeepAlive.ONE_HOUR)
+                        .maxSignalDuration(SecurityMonitoringRuleMaxSignalDuration.ONE_DAY)
+                        .evaluationWindow(SecurityMonitoringRuleEvaluationWindow.FIFTEEN_MINUTES)
+                        .detectionMethod(SecurityMonitoringRuleDetectionMethod.THRESHOLD))
+                .isEnabled(true)
+                .message("Test rule")
+                .groupSignalsBy(Collections.singletonList("service")));
+
+    try {
+      SecurityMonitoringRuleResponse result = apiInstance.createSecurityMonitoringRule(body);
+      System.out.println(result);
+    } catch (ApiException e) {
+      System.err.println(
+          "Exception when calling SecurityMonitoringApi#createSecurityMonitoringRule");
+      System.err.println("Status code: " + e.getCode());
+      System.err.println("Reason: " + e.getResponseBody());
+      System.err.println("Response headers: " + e.getResponseHeaders());
+      e.printStackTrace();
+    }
+  }
+}
diff --git a/src/main/java/com/datadog/api/client/v2/api/ConfluentCloudApi.java b/src/main/java/com/datadog/api/client/v2/api/ConfluentCloudApi.java
index 4b106e7caf3..e3b695ddf1c 100644
--- a/src/main/java/com/datadog/api/client/v2/api/ConfluentCloudApi.java
+++ b/src/main/java/com/datadog/api/client/v2/api/ConfluentCloudApi.java
@@ -188,7 +188,7 @@ public ApiResponse<ConfluentAccountResponse> createConfluentAccountWithHttpInfo(
    *
    * <p>See {@link #createConfluentResourceWithHttpInfo}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param body Confluent payload (required)
    * @return ConfluentResourceResponse
    * @throws ApiException if fails to make API call
@@ -203,7 +203,7 @@ public ConfluentResourceResponse createConfluentResource(
    *
    * <p>See {@link #createConfluentResourceWithHttpInfoAsync}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param body Confluent payload (required)
    * @return CompletableFuture&lt;ConfluentResourceResponse&gt;
    */
@@ -219,7 +219,7 @@ public CompletableFuture<ConfluentResourceResponse> createConfluentResourceAsync
   /**
    * Create a Confluent resource for the account associated with the provided ID.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param body Confluent payload (required)
    * @return ApiResponse&lt;ConfluentResourceResponse&gt;
    * @throws ApiException if fails to make API call
@@ -281,7 +281,7 @@ public ApiResponse<ConfluentResourceResponse> createConfluentResourceWithHttpInf
    *
    * <p>See {@link #createConfluentResourceWithHttpInfo}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param body Confluent payload (required)
    * @return CompletableFuture&lt;ApiResponse&lt;ConfluentResourceResponse&gt;&gt;
    */
@@ -346,7 +346,7 @@ public ApiResponse<ConfluentResourceResponse> createConfluentResourceWithHttpInf
    *
    * <p>See {@link #deleteConfluentAccountWithHttpInfo}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @throws ApiException if fails to make API call
    */
   public void deleteConfluentAccount(String accountId) throws ApiException {
@@ -358,7 +358,7 @@ public void deleteConfluentAccount(String accountId) throws ApiException {
    *
    * <p>See {@link #deleteConfluentAccountWithHttpInfoAsync}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @return CompletableFuture
    */
   public CompletableFuture<Void> deleteConfluentAccountAsync(String accountId) {
@@ -372,7 +372,7 @@ public CompletableFuture<Void> deleteConfluentAccountAsync(String accountId) {
   /**
    * Delete a Confluent account with the provided account ID.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @return ApiResponse&lt;Void&gt;
    * @throws ApiException if fails to make API call
    * @http.response.details
@@ -427,7 +427,7 @@ public ApiResponse<Void> deleteConfluentAccountWithHttpInfo(String accountId)
    *
    * <p>See {@link #deleteConfluentAccountWithHttpInfo}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @return CompletableFuture&lt;ApiResponse&lt;Void&gt;&gt;
    */
   public CompletableFuture<ApiResponse<Void>> deleteConfluentAccountWithHttpInfoAsync(
@@ -482,7 +482,7 @@ public CompletableFuture<ApiResponse<Void>> deleteConfluentAccountWithHttpInfoAs
    *
    * <p>See {@link #deleteConfluentResourceWithHttpInfo}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param resourceId Confluent Account Resource ID. (required)
    * @throws ApiException if fails to make API call
    */
@@ -495,7 +495,7 @@ public void deleteConfluentResource(String accountId, String resourceId) throws
    *
    * <p>See {@link #deleteConfluentResourceWithHttpInfoAsync}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param resourceId Confluent Account Resource ID. (required)
    * @return CompletableFuture
    */
@@ -511,7 +511,7 @@ public CompletableFuture<Void> deleteConfluentResourceAsync(String accountId, St
    * Delete a Confluent resource with the provided resource id for the account associated with the
    * provided account ID.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param resourceId Confluent Account Resource ID. (required)
    * @return ApiResponse&lt;Void&gt;
    * @throws ApiException if fails to make API call
@@ -575,7 +575,7 @@ public ApiResponse<Void> deleteConfluentResourceWithHttpInfo(String accountId, S
    *
    * <p>See {@link #deleteConfluentResourceWithHttpInfo}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param resourceId Confluent Account Resource ID. (required)
    * @return CompletableFuture&lt;ApiResponse&lt;Void&gt;&gt;
    */
@@ -643,7 +643,7 @@ public CompletableFuture<ApiResponse<Void>> deleteConfluentResourceWithHttpInfoA
    *
    * <p>See {@link #getConfluentAccountWithHttpInfo}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @return ConfluentAccountResponse
    * @throws ApiException if fails to make API call
    */
@@ -656,7 +656,7 @@ public ConfluentAccountResponse getConfluentAccount(String accountId) throws Api
    *
    * <p>See {@link #getConfluentAccountWithHttpInfoAsync}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @return CompletableFuture&lt;ConfluentAccountResponse&gt;
    */
   public CompletableFuture<ConfluentAccountResponse> getConfluentAccountAsync(String accountId) {
@@ -670,7 +670,7 @@ public CompletableFuture<ConfluentAccountResponse> getConfluentAccountAsync(Stri
   /**
    * Get the Confluent account with the provided account ID.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @return ApiResponse&lt;ConfluentAccountResponse&gt;
    * @throws ApiException if fails to make API call
    * @http.response.details
@@ -725,7 +725,7 @@ public ApiResponse<ConfluentAccountResponse> getConfluentAccountWithHttpInfo(Str
    *
    * <p>See {@link #getConfluentAccountWithHttpInfo}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @return CompletableFuture&lt;ApiResponse&lt;ConfluentAccountResponse&gt;&gt;
    */
   public CompletableFuture<ApiResponse<ConfluentAccountResponse>>
@@ -779,7 +779,7 @@ public ApiResponse<ConfluentAccountResponse> getConfluentAccountWithHttpInfo(Str
    *
    * <p>See {@link #getConfluentResourceWithHttpInfo}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param resourceId Confluent Account Resource ID. (required)
    * @return ConfluentResourceResponse
    * @throws ApiException if fails to make API call
@@ -794,7 +794,7 @@ public ConfluentResourceResponse getConfluentResource(String accountId, String r
    *
    * <p>See {@link #getConfluentResourceWithHttpInfoAsync}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param resourceId Confluent Account Resource ID. (required)
    * @return CompletableFuture&lt;ConfluentResourceResponse&gt;
    */
@@ -811,7 +811,7 @@ public CompletableFuture<ConfluentResourceResponse> getConfluentResourceAsync(
    * Get a Confluent resource with the provided resource id for the account associated with the
    * provided account ID.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param resourceId Confluent Account Resource ID. (required)
    * @return ApiResponse&lt;ConfluentResourceResponse&gt;
    * @throws ApiException if fails to make API call
@@ -875,7 +875,7 @@ public ApiResponse<ConfluentResourceResponse> getConfluentResourceWithHttpInfo(
    *
    * <p>See {@link #getConfluentResourceWithHttpInfo}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param resourceId Confluent Account Resource ID. (required)
    * @return CompletableFuture&lt;ApiResponse&lt;ConfluentResourceResponse&gt;&gt;
    */
@@ -1055,7 +1055,7 @@ public ApiResponse<ConfluentAccountsResponse> listConfluentAccountWithHttpInfo()
    *
    * <p>See {@link #listConfluentResourceWithHttpInfo}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @return ConfluentResourcesResponse
    * @throws ApiException if fails to make API call
    */
@@ -1068,7 +1068,7 @@ public ConfluentResourcesResponse listConfluentResource(String accountId) throws
    *
    * <p>See {@link #listConfluentResourceWithHttpInfoAsync}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @return CompletableFuture&lt;ConfluentResourcesResponse&gt;
    */
   public CompletableFuture<ConfluentResourcesResponse> listConfluentResourceAsync(
@@ -1083,7 +1083,7 @@ public CompletableFuture<ConfluentResourcesResponse> listConfluentResourceAsync(
   /**
    * Get a Confluent resource for the account associated with the provided ID.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @return ApiResponse&lt;ConfluentResourcesResponse&gt;
    * @throws ApiException if fails to make API call
    * @http.response.details
@@ -1138,7 +1138,7 @@ public ApiResponse<ConfluentResourcesResponse> listConfluentResourceWithHttpInfo
    *
    * <p>See {@link #listConfluentResourceWithHttpInfo}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @return CompletableFuture&lt;ApiResponse&lt;ConfluentResourcesResponse&gt;&gt;
    */
   public CompletableFuture<ApiResponse<ConfluentResourcesResponse>>
@@ -1193,7 +1193,7 @@ public ApiResponse<ConfluentResourcesResponse> listConfluentResourceWithHttpInfo
    *
    * <p>See {@link #updateConfluentAccountWithHttpInfo}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param body Confluent payload (required)
    * @return ConfluentAccountResponse
    * @throws ApiException if fails to make API call
@@ -1208,7 +1208,7 @@ public ConfluentAccountResponse updateConfluentAccount(
    *
    * <p>See {@link #updateConfluentAccountWithHttpInfoAsync}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param body Confluent payload (required)
    * @return CompletableFuture&lt;ConfluentAccountResponse&gt;
    */
@@ -1224,7 +1224,7 @@ public CompletableFuture<ConfluentAccountResponse> updateConfluentAccountAsync(
   /**
    * Update the Confluent account with the provided account ID.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param body Confluent payload (required)
    * @return ApiResponse&lt;ConfluentAccountResponse&gt;
    * @throws ApiException if fails to make API call
@@ -1286,7 +1286,7 @@ public ApiResponse<ConfluentAccountResponse> updateConfluentAccountWithHttpInfo(
    *
    * <p>See {@link #updateConfluentAccountWithHttpInfo}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param body Confluent payload (required)
    * @return CompletableFuture&lt;ApiResponse&lt;ConfluentAccountResponse&gt;&gt;
    */
@@ -1352,7 +1352,7 @@ public ApiResponse<ConfluentAccountResponse> updateConfluentAccountWithHttpInfo(
    *
    * <p>See {@link #updateConfluentResourceWithHttpInfo}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param resourceId Confluent Account Resource ID. (required)
    * @param body Confluent payload (required)
    * @return ConfluentResourceResponse
@@ -1368,7 +1368,7 @@ public ConfluentResourceResponse updateConfluentResource(
    *
    * <p>See {@link #updateConfluentResourceWithHttpInfoAsync}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param resourceId Confluent Account Resource ID. (required)
    * @param body Confluent payload (required)
    * @return CompletableFuture&lt;ConfluentResourceResponse&gt;
@@ -1386,7 +1386,7 @@ public CompletableFuture<ConfluentResourceResponse> updateConfluentResourceAsync
    * Update a Confluent resource with the provided resource id for the account associated with the
    * provided account ID.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param resourceId Confluent Account Resource ID. (required)
    * @param body Confluent payload (required)
    * @return ApiResponse&lt;ConfluentResourceResponse&gt;
@@ -1457,7 +1457,7 @@ public ApiResponse<ConfluentResourceResponse> updateConfluentResourceWithHttpInf
    *
    * <p>See {@link #updateConfluentResourceWithHttpInfo}.
    *
-   * @param accountId Confluent Account id. (required)
+   * @param accountId Confluent Account ID. (required)
    * @param resourceId Confluent Account Resource ID. (required)
    * @param body Confluent payload (required)
    * @return CompletableFuture&lt;ApiResponse&lt;ConfluentResourceResponse&gt;&gt;
diff --git a/src/main/java/com/datadog/api/client/v2/model/JobDefinition.java b/src/main/java/com/datadog/api/client/v2/model/JobDefinition.java
index f91a1e767ac..29057415d42 100644
--- a/src/main/java/com/datadog/api/client/v2/model/JobDefinition.java
+++ b/src/main/java/com/datadog/api/client/v2/model/JobDefinition.java
@@ -24,6 +24,7 @@
   JobDefinition.JSON_PROPERTY_CALCULATED_FIELDS,
   JobDefinition.JSON_PROPERTY_CASES,
   JobDefinition.JSON_PROPERTY_FROM,
+  JobDefinition.JSON_PROPERTY_GROUP_SIGNALS_BY,
   JobDefinition.JSON_PROPERTY_INDEX,
   JobDefinition.JSON_PROPERTY_MESSAGE,
   JobDefinition.JSON_PROPERTY_NAME,
@@ -48,6 +49,9 @@ public class JobDefinition {
   public static final String JSON_PROPERTY_FROM = "from";
   private Long from;
 
+  public static final String JSON_PROPERTY_GROUP_SIGNALS_BY = "groupSignalsBy";
+  private List<String> groupSignalsBy = null;
+
   public static final String JSON_PROPERTY_INDEX = "index";
   private String index;
 
@@ -182,6 +186,36 @@ public void setFrom(Long from) {
     this.from = from;
   }
 
+  public JobDefinition groupSignalsBy(List<String> groupSignalsBy) {
+    this.groupSignalsBy = groupSignalsBy;
+    return this;
+  }
+
+  public JobDefinition addGroupSignalsByItem(String groupSignalsByItem) {
+    if (this.groupSignalsBy == null) {
+      this.groupSignalsBy = new ArrayList<>();
+    }
+    this.groupSignalsBy.add(groupSignalsByItem);
+    return this;
+  }
+
+  /**
+   * Additional grouping to perform on top of the existing groups in the query section. Must be a
+   * subset of the existing groups.
+   *
+   * @return groupSignalsBy
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_GROUP_SIGNALS_BY)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public List<String> getGroupSignalsBy() {
+    return groupSignalsBy;
+  }
+
+  public void setGroupSignalsBy(List<String> groupSignalsBy) {
+    this.groupSignalsBy = groupSignalsBy;
+  }
+
   public JobDefinition index(String index) {
     this.index = index;
     return this;
@@ -492,6 +526,7 @@ public boolean equals(Object o) {
     return Objects.equals(this.calculatedFields, jobDefinition.calculatedFields)
         && Objects.equals(this.cases, jobDefinition.cases)
         && Objects.equals(this.from, jobDefinition.from)
+        && Objects.equals(this.groupSignalsBy, jobDefinition.groupSignalsBy)
         && Objects.equals(this.index, jobDefinition.index)
         && Objects.equals(this.message, jobDefinition.message)
         && Objects.equals(this.name, jobDefinition.name)
@@ -511,6 +546,7 @@ public int hashCode() {
         calculatedFields,
         cases,
         from,
+        groupSignalsBy,
         index,
         message,
         name,
@@ -531,6 +567,7 @@ public String toString() {
     sb.append("    calculatedFields: ").append(toIndentedString(calculatedFields)).append("\n");
     sb.append("    cases: ").append(toIndentedString(cases)).append("\n");
     sb.append("    from: ").append(toIndentedString(from)).append("\n");
+    sb.append("    groupSignalsBy: ").append(toIndentedString(groupSignalsBy)).append("\n");
     sb.append("    index: ").append(toIndentedString(index)).append("\n");
     sb.append("    message: ").append(toIndentedString(message)).append("\n");
     sb.append("    name: ").append(toIndentedString(name)).append("\n");
diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCase.java b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCase.java
index ba004ae289a..7797826424b 100644
--- a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCase.java
+++ b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCase.java
@@ -20,6 +20,7 @@
 
 /** Case when signal is generated. */
 @JsonPropertyOrder({
+  SecurityMonitoringRuleCase.JSON_PROPERTY_ACTIONS,
   SecurityMonitoringRuleCase.JSON_PROPERTY_CONDITION,
   SecurityMonitoringRuleCase.JSON_PROPERTY_NAME,
   SecurityMonitoringRuleCase.JSON_PROPERTY_NOTIFICATIONS,
@@ -29,6 +30,9 @@
     value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator")
 public class SecurityMonitoringRuleCase {
   @JsonIgnore public boolean unparsed = false;
+  public static final String JSON_PROPERTY_ACTIONS = "actions";
+  private List<SecurityMonitoringRuleCaseAction> actions = null;
+
   public static final String JSON_PROPERTY_CONDITION = "condition";
   private String condition;
 
@@ -41,6 +45,39 @@ public class SecurityMonitoringRuleCase {
   public static final String JSON_PROPERTY_STATUS = "status";
   private SecurityMonitoringRuleSeverity status;
 
+  public SecurityMonitoringRuleCase actions(List<SecurityMonitoringRuleCaseAction> actions) {
+    this.actions = actions;
+    for (SecurityMonitoringRuleCaseAction item : actions) {
+      this.unparsed |= item.unparsed;
+    }
+    return this;
+  }
+
+  public SecurityMonitoringRuleCase addActionsItem(SecurityMonitoringRuleCaseAction actionsItem) {
+    if (this.actions == null) {
+      this.actions = new ArrayList<>();
+    }
+    this.actions.add(actionsItem);
+    this.unparsed |= actionsItem.unparsed;
+    return this;
+  }
+
+  /**
+   * Action to perform for each rule case.
+   *
+   * @return actions
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_ACTIONS)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public List<SecurityMonitoringRuleCaseAction> getActions() {
+    return actions;
+  }
+
+  public void setActions(List<SecurityMonitoringRuleCaseAction> actions) {
+    this.actions = actions;
+  }
+
   public SecurityMonitoringRuleCase condition(String condition) {
     this.condition = condition;
     return this;
@@ -195,7 +232,8 @@ public boolean equals(Object o) {
       return false;
     }
     SecurityMonitoringRuleCase securityMonitoringRuleCase = (SecurityMonitoringRuleCase) o;
-    return Objects.equals(this.condition, securityMonitoringRuleCase.condition)
+    return Objects.equals(this.actions, securityMonitoringRuleCase.actions)
+        && Objects.equals(this.condition, securityMonitoringRuleCase.condition)
         && Objects.equals(this.name, securityMonitoringRuleCase.name)
         && Objects.equals(this.notifications, securityMonitoringRuleCase.notifications)
         && Objects.equals(this.status, securityMonitoringRuleCase.status)
@@ -205,13 +243,14 @@ public boolean equals(Object o) {
 
   @Override
   public int hashCode() {
-    return Objects.hash(condition, name, notifications, status, additionalProperties);
+    return Objects.hash(actions, condition, name, notifications, status, additionalProperties);
   }
 
   @Override
   public String toString() {
     StringBuilder sb = new StringBuilder();
     sb.append("class SecurityMonitoringRuleCase {\n");
+    sb.append("    actions: ").append(toIndentedString(actions)).append("\n");
     sb.append("    condition: ").append(toIndentedString(condition)).append("\n");
     sb.append("    name: ").append(toIndentedString(name)).append("\n");
     sb.append("    notifications: ").append(toIndentedString(notifications)).append("\n");
diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseAction.java b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseAction.java
new file mode 100644
index 00000000000..6137f82945b
--- /dev/null
+++ b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseAction.java
@@ -0,0 +1,173 @@
+/*
+ * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ * This product includes software developed at Datadog (https://www.datadoghq.com/).
+ * Copyright 2019-Present Datadog, Inc.
+ */
+
+package com.datadog.api.client.v2.model;
+
+import com.fasterxml.jackson.annotation.JsonAnyGetter;
+import com.fasterxml.jackson.annotation.JsonAnySetter;
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonPropertyOrder;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Objects;
+
+/**
+ * Action to perform when a signal is triggered. Only available for Application Security rule type.
+ */
+@JsonPropertyOrder({
+  SecurityMonitoringRuleCaseAction.JSON_PROPERTY_OPTIONS,
+  SecurityMonitoringRuleCaseAction.JSON_PROPERTY_TYPE
+})
+@jakarta.annotation.Generated(
+    value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator")
+public class SecurityMonitoringRuleCaseAction {
+  @JsonIgnore public boolean unparsed = false;
+  public static final String JSON_PROPERTY_OPTIONS = "options";
+  private SecurityMonitoringRuleCaseActionOptions options;
+
+  public static final String JSON_PROPERTY_TYPE = "type";
+  private SecurityMonitoringRuleCaseActionType type;
+
+  public SecurityMonitoringRuleCaseAction options(SecurityMonitoringRuleCaseActionOptions options) {
+    this.options = options;
+    this.unparsed |= options.unparsed;
+    return this;
+  }
+
+  /**
+   * Options for the rule action
+   *
+   * @return options
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_OPTIONS)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public SecurityMonitoringRuleCaseActionOptions getOptions() {
+    return options;
+  }
+
+  public void setOptions(SecurityMonitoringRuleCaseActionOptions options) {
+    this.options = options;
+  }
+
+  public SecurityMonitoringRuleCaseAction type(SecurityMonitoringRuleCaseActionType type) {
+    this.type = type;
+    this.unparsed |= !type.isValid();
+    return this;
+  }
+
+  /**
+   * The action type.
+   *
+   * @return type
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_TYPE)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public SecurityMonitoringRuleCaseActionType getType() {
+    return type;
+  }
+
+  public void setType(SecurityMonitoringRuleCaseActionType type) {
+    if (!type.isValid()) {
+      this.unparsed = true;
+    }
+    this.type = type;
+  }
+
+  /**
+   * A container for additional, undeclared properties. This is a holder for any undeclared
+   * properties as specified with the 'additionalProperties' keyword in the OAS document.
+   */
+  private Map<String, Object> additionalProperties;
+
+  /**
+   * Set the additional (undeclared) property with the specified name and value. If the property
+   * does not already exist, create it otherwise replace it.
+   *
+   * @param key The arbitrary key to set
+   * @param value The associated value
+   * @return SecurityMonitoringRuleCaseAction
+   */
+  @JsonAnySetter
+  public SecurityMonitoringRuleCaseAction putAdditionalProperty(String key, Object value) {
+    if (this.additionalProperties == null) {
+      this.additionalProperties = new HashMap<String, Object>();
+    }
+    this.additionalProperties.put(key, value);
+    return this;
+  }
+
+  /**
+   * Return the additional (undeclared) property.
+   *
+   * @return The additional properties
+   */
+  @JsonAnyGetter
+  public Map<String, Object> getAdditionalProperties() {
+    return additionalProperties;
+  }
+
+  /**
+   * Return the additional (undeclared) property with the specified name.
+   *
+   * @param key The arbitrary key to get
+   * @return The specific additional property for the given key
+   */
+  public Object getAdditionalProperty(String key) {
+    if (this.additionalProperties == null) {
+      return null;
+    }
+    return this.additionalProperties.get(key);
+  }
+
+  /** Return true if this SecurityMonitoringRuleCaseAction object is equal to o. */
+  @Override
+  public boolean equals(Object o) {
+    if (this == o) {
+      return true;
+    }
+    if (o == null || getClass() != o.getClass()) {
+      return false;
+    }
+    SecurityMonitoringRuleCaseAction securityMonitoringRuleCaseAction =
+        (SecurityMonitoringRuleCaseAction) o;
+    return Objects.equals(this.options, securityMonitoringRuleCaseAction.options)
+        && Objects.equals(this.type, securityMonitoringRuleCaseAction.type)
+        && Objects.equals(
+            this.additionalProperties, securityMonitoringRuleCaseAction.additionalProperties);
+  }
+
+  @Override
+  public int hashCode() {
+    return Objects.hash(options, type, additionalProperties);
+  }
+
+  @Override
+  public String toString() {
+    StringBuilder sb = new StringBuilder();
+    sb.append("class SecurityMonitoringRuleCaseAction {\n");
+    sb.append("    options: ").append(toIndentedString(options)).append("\n");
+    sb.append("    type: ").append(toIndentedString(type)).append("\n");
+    sb.append("    additionalProperties: ")
+        .append(toIndentedString(additionalProperties))
+        .append("\n");
+    sb.append('}');
+    return sb.toString();
+  }
+
+  /**
+   * Convert the given object to string with each line indented by 4 spaces (except the first line).
+   */
+  private String toIndentedString(Object o) {
+    if (o == null) {
+      return "null";
+    }
+    return o.toString().replace("\n", "\n    ");
+  }
+}
diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseActionOptions.java b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseActionOptions.java
new file mode 100644
index 00000000000..b23ff933674
--- /dev/null
+++ b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseActionOptions.java
@@ -0,0 +1,138 @@
+/*
+ * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ * This product includes software developed at Datadog (https://www.datadoghq.com/).
+ * Copyright 2019-Present Datadog, Inc.
+ */
+
+package com.datadog.api.client.v2.model;
+
+import com.fasterxml.jackson.annotation.JsonAnyGetter;
+import com.fasterxml.jackson.annotation.JsonAnySetter;
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonPropertyOrder;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Objects;
+
+/** Options for the rule action */
+@JsonPropertyOrder({SecurityMonitoringRuleCaseActionOptions.JSON_PROPERTY_DURATION})
+@jakarta.annotation.Generated(
+    value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator")
+public class SecurityMonitoringRuleCaseActionOptions {
+  @JsonIgnore public boolean unparsed = false;
+  public static final String JSON_PROPERTY_DURATION = "duration";
+  private Long duration;
+
+  public SecurityMonitoringRuleCaseActionOptions duration(Long duration) {
+    this.duration = duration;
+    return this;
+  }
+
+  /**
+   * Duration of the action in seconds. 0 indicates no expiration. minimum: 0
+   *
+   * @return duration
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_DURATION)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public Long getDuration() {
+    return duration;
+  }
+
+  public void setDuration(Long duration) {
+    this.duration = duration;
+  }
+
+  /**
+   * A container for additional, undeclared properties. This is a holder for any undeclared
+   * properties as specified with the 'additionalProperties' keyword in the OAS document.
+   */
+  private Map<String, Object> additionalProperties;
+
+  /**
+   * Set the additional (undeclared) property with the specified name and value. If the property
+   * does not already exist, create it otherwise replace it.
+   *
+   * @param key The arbitrary key to set
+   * @param value The associated value
+   * @return SecurityMonitoringRuleCaseActionOptions
+   */
+  @JsonAnySetter
+  public SecurityMonitoringRuleCaseActionOptions putAdditionalProperty(String key, Object value) {
+    if (this.additionalProperties == null) {
+      this.additionalProperties = new HashMap<String, Object>();
+    }
+    this.additionalProperties.put(key, value);
+    return this;
+  }
+
+  /**
+   * Return the additional (undeclared) property.
+   *
+   * @return The additional properties
+   */
+  @JsonAnyGetter
+  public Map<String, Object> getAdditionalProperties() {
+    return additionalProperties;
+  }
+
+  /**
+   * Return the additional (undeclared) property with the specified name.
+   *
+   * @param key The arbitrary key to get
+   * @return The specific additional property for the given key
+   */
+  public Object getAdditionalProperty(String key) {
+    if (this.additionalProperties == null) {
+      return null;
+    }
+    return this.additionalProperties.get(key);
+  }
+
+  /** Return true if this SecurityMonitoringRuleCaseActionOptions object is equal to o. */
+  @Override
+  public boolean equals(Object o) {
+    if (this == o) {
+      return true;
+    }
+    if (o == null || getClass() != o.getClass()) {
+      return false;
+    }
+    SecurityMonitoringRuleCaseActionOptions securityMonitoringRuleCaseActionOptions =
+        (SecurityMonitoringRuleCaseActionOptions) o;
+    return Objects.equals(this.duration, securityMonitoringRuleCaseActionOptions.duration)
+        && Objects.equals(
+            this.additionalProperties,
+            securityMonitoringRuleCaseActionOptions.additionalProperties);
+  }
+
+  @Override
+  public int hashCode() {
+    return Objects.hash(duration, additionalProperties);
+  }
+
+  @Override
+  public String toString() {
+    StringBuilder sb = new StringBuilder();
+    sb.append("class SecurityMonitoringRuleCaseActionOptions {\n");
+    sb.append("    duration: ").append(toIndentedString(duration)).append("\n");
+    sb.append("    additionalProperties: ")
+        .append(toIndentedString(additionalProperties))
+        .append("\n");
+    sb.append('}');
+    return sb.toString();
+  }
+
+  /**
+   * Convert the given object to string with each line indented by 4 spaces (except the first line).
+   */
+  private String toIndentedString(Object o) {
+    if (o == null) {
+      return "null";
+    }
+    return o.toString().replace("\n", "\n    ");
+  }
+}
diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseActionType.java b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseActionType.java
new file mode 100644
index 00000000000..704cbe550b5
--- /dev/null
+++ b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseActionType.java
@@ -0,0 +1,62 @@
+/*
+ * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ * This product includes software developed at Datadog (https://www.datadoghq.com/).
+ * Copyright 2019-Present Datadog, Inc.
+ */
+
+package com.datadog.api.client.v2.model;
+
+import com.datadog.api.client.ModelEnum;
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+import com.fasterxml.jackson.databind.ser.std.StdSerializer;
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
+/** The action type. */
+@JsonSerialize(
+    using =
+        SecurityMonitoringRuleCaseActionType.SecurityMonitoringRuleCaseActionTypeSerializer.class)
+public class SecurityMonitoringRuleCaseActionType extends ModelEnum<String> {
+
+  private static final Set<String> allowedValues =
+      new HashSet<String>(Arrays.asList("block_ip", "block_user"));
+
+  public static final SecurityMonitoringRuleCaseActionType BLOCK_IP =
+      new SecurityMonitoringRuleCaseActionType("block_ip");
+  public static final SecurityMonitoringRuleCaseActionType BLOCK_USER =
+      new SecurityMonitoringRuleCaseActionType("block_user");
+
+  SecurityMonitoringRuleCaseActionType(String value) {
+    super(value, allowedValues);
+  }
+
+  public static class SecurityMonitoringRuleCaseActionTypeSerializer
+      extends StdSerializer<SecurityMonitoringRuleCaseActionType> {
+    public SecurityMonitoringRuleCaseActionTypeSerializer(
+        Class<SecurityMonitoringRuleCaseActionType> t) {
+      super(t);
+    }
+
+    public SecurityMonitoringRuleCaseActionTypeSerializer() {
+      this(null);
+    }
+
+    @Override
+    public void serialize(
+        SecurityMonitoringRuleCaseActionType value, JsonGenerator jgen, SerializerProvider provider)
+        throws IOException, JsonProcessingException {
+      jgen.writeObject(value.value);
+    }
+  }
+
+  @JsonCreator
+  public static SecurityMonitoringRuleCaseActionType fromValue(String value) {
+    return new SecurityMonitoringRuleCaseActionType(value);
+  }
+}
diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseCreate.java b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseCreate.java
index 41f52793a8f..3216360dac7 100644
--- a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseCreate.java
+++ b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleCaseCreate.java
@@ -21,6 +21,7 @@
 
 /** Case when signal is generated. */
 @JsonPropertyOrder({
+  SecurityMonitoringRuleCaseCreate.JSON_PROPERTY_ACTIONS,
   SecurityMonitoringRuleCaseCreate.JSON_PROPERTY_CONDITION,
   SecurityMonitoringRuleCaseCreate.JSON_PROPERTY_NAME,
   SecurityMonitoringRuleCaseCreate.JSON_PROPERTY_NOTIFICATIONS,
@@ -30,6 +31,9 @@
     value = "https://github.com/DataDog/datadog-api-client-java/blob/master/.generator")
 public class SecurityMonitoringRuleCaseCreate {
   @JsonIgnore public boolean unparsed = false;
+  public static final String JSON_PROPERTY_ACTIONS = "actions";
+  private List<SecurityMonitoringRuleCaseAction> actions = null;
+
   public static final String JSON_PROPERTY_CONDITION = "condition";
   private String condition;
 
@@ -52,6 +56,40 @@ public SecurityMonitoringRuleCaseCreate(
     this.unparsed |= !status.isValid();
   }
 
+  public SecurityMonitoringRuleCaseCreate actions(List<SecurityMonitoringRuleCaseAction> actions) {
+    this.actions = actions;
+    for (SecurityMonitoringRuleCaseAction item : actions) {
+      this.unparsed |= item.unparsed;
+    }
+    return this;
+  }
+
+  public SecurityMonitoringRuleCaseCreate addActionsItem(
+      SecurityMonitoringRuleCaseAction actionsItem) {
+    if (this.actions == null) {
+      this.actions = new ArrayList<>();
+    }
+    this.actions.add(actionsItem);
+    this.unparsed |= actionsItem.unparsed;
+    return this;
+  }
+
+  /**
+   * Action to perform for each rule case.
+   *
+   * @return actions
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_ACTIONS)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public List<SecurityMonitoringRuleCaseAction> getActions() {
+    return actions;
+  }
+
+  public void setActions(List<SecurityMonitoringRuleCaseAction> actions) {
+    this.actions = actions;
+  }
+
   public SecurityMonitoringRuleCaseCreate condition(String condition) {
     this.condition = condition;
     return this;
@@ -206,7 +244,8 @@ public boolean equals(Object o) {
     }
     SecurityMonitoringRuleCaseCreate securityMonitoringRuleCaseCreate =
         (SecurityMonitoringRuleCaseCreate) o;
-    return Objects.equals(this.condition, securityMonitoringRuleCaseCreate.condition)
+    return Objects.equals(this.actions, securityMonitoringRuleCaseCreate.actions)
+        && Objects.equals(this.condition, securityMonitoringRuleCaseCreate.condition)
         && Objects.equals(this.name, securityMonitoringRuleCaseCreate.name)
         && Objects.equals(this.notifications, securityMonitoringRuleCaseCreate.notifications)
         && Objects.equals(this.status, securityMonitoringRuleCaseCreate.status)
@@ -216,13 +255,14 @@ public boolean equals(Object o) {
 
   @Override
   public int hashCode() {
-    return Objects.hash(condition, name, notifications, status, additionalProperties);
+    return Objects.hash(actions, condition, name, notifications, status, additionalProperties);
   }
 
   @Override
   public String toString() {
     StringBuilder sb = new StringBuilder();
     sb.append("class SecurityMonitoringRuleCaseCreate {\n");
+    sb.append("    actions: ").append(toIndentedString(actions)).append("\n");
     sb.append("    condition: ").append(toIndentedString(condition)).append("\n");
     sb.append("    name: ").append(toIndentedString(name)).append("\n");
     sb.append("    notifications: ").append(toIndentedString(notifications)).append("\n");
diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleUpdatePayload.java b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleUpdatePayload.java
index ce0c9545ab1..0d660c9b825 100644
--- a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleUpdatePayload.java
+++ b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringRuleUpdatePayload.java
@@ -23,6 +23,7 @@
   SecurityMonitoringRuleUpdatePayload.JSON_PROPERTY_CASES,
   SecurityMonitoringRuleUpdatePayload.JSON_PROPERTY_COMPLIANCE_SIGNAL_OPTIONS,
   SecurityMonitoringRuleUpdatePayload.JSON_PROPERTY_FILTERS,
+  SecurityMonitoringRuleUpdatePayload.JSON_PROPERTY_GROUP_SIGNALS_BY,
   SecurityMonitoringRuleUpdatePayload.JSON_PROPERTY_HAS_EXTENDED_TITLE,
   SecurityMonitoringRuleUpdatePayload.JSON_PROPERTY_IS_ENABLED,
   SecurityMonitoringRuleUpdatePayload.JSON_PROPERTY_MESSAGE,
@@ -47,6 +48,9 @@ public class SecurityMonitoringRuleUpdatePayload {
   public static final String JSON_PROPERTY_FILTERS = "filters";
   private List<SecurityMonitoringFilter> filters = null;
 
+  public static final String JSON_PROPERTY_GROUP_SIGNALS_BY = "groupSignalsBy";
+  private List<String> groupSignalsBy = null;
+
   public static final String JSON_PROPERTY_HAS_EXTENDED_TITLE = "hasExtendedTitle";
   private Boolean hasExtendedTitle;
 
@@ -168,6 +172,36 @@ public void setFilters(List<SecurityMonitoringFilter> filters) {
     this.filters = filters;
   }
 
+  public SecurityMonitoringRuleUpdatePayload groupSignalsBy(List<String> groupSignalsBy) {
+    this.groupSignalsBy = groupSignalsBy;
+    return this;
+  }
+
+  public SecurityMonitoringRuleUpdatePayload addGroupSignalsByItem(String groupSignalsByItem) {
+    if (this.groupSignalsBy == null) {
+      this.groupSignalsBy = new ArrayList<>();
+    }
+    this.groupSignalsBy.add(groupSignalsByItem);
+    return this;
+  }
+
+  /**
+   * Additional grouping to perform on top of the existing groups in the query section. Must be a
+   * subset of the existing groups.
+   *
+   * @return groupSignalsBy
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_GROUP_SIGNALS_BY)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public List<String> getGroupSignalsBy() {
+    return groupSignalsBy;
+  }
+
+  public void setGroupSignalsBy(List<String> groupSignalsBy) {
+    this.groupSignalsBy = groupSignalsBy;
+  }
+
   public SecurityMonitoringRuleUpdatePayload hasExtendedTitle(Boolean hasExtendedTitle) {
     this.hasExtendedTitle = hasExtendedTitle;
     return this;
@@ -490,6 +524,7 @@ public boolean equals(Object o) {
             this.complianceSignalOptions,
             securityMonitoringRuleUpdatePayload.complianceSignalOptions)
         && Objects.equals(this.filters, securityMonitoringRuleUpdatePayload.filters)
+        && Objects.equals(this.groupSignalsBy, securityMonitoringRuleUpdatePayload.groupSignalsBy)
         && Objects.equals(
             this.hasExtendedTitle, securityMonitoringRuleUpdatePayload.hasExtendedTitle)
         && Objects.equals(this.isEnabled, securityMonitoringRuleUpdatePayload.isEnabled)
@@ -511,6 +546,7 @@ public int hashCode() {
         cases,
         complianceSignalOptions,
         filters,
+        groupSignalsBy,
         hasExtendedTitle,
         isEnabled,
         message,
@@ -533,6 +569,7 @@ public String toString() {
         .append(toIndentedString(complianceSignalOptions))
         .append("\n");
     sb.append("    filters: ").append(toIndentedString(filters)).append("\n");
+    sb.append("    groupSignalsBy: ").append(toIndentedString(groupSignalsBy)).append("\n");
     sb.append("    hasExtendedTitle: ").append(toIndentedString(hasExtendedTitle)).append("\n");
     sb.append("    isEnabled: ").append(toIndentedString(isEnabled)).append("\n");
     sb.append("    message: ").append(toIndentedString(message)).append("\n");
diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringStandardRuleCreatePayload.java b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringStandardRuleCreatePayload.java
index 3663b123ec9..d19be324bee 100644
--- a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringStandardRuleCreatePayload.java
+++ b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringStandardRuleCreatePayload.java
@@ -23,6 +23,7 @@
 @JsonPropertyOrder({
   SecurityMonitoringStandardRuleCreatePayload.JSON_PROPERTY_CASES,
   SecurityMonitoringStandardRuleCreatePayload.JSON_PROPERTY_FILTERS,
+  SecurityMonitoringStandardRuleCreatePayload.JSON_PROPERTY_GROUP_SIGNALS_BY,
   SecurityMonitoringStandardRuleCreatePayload.JSON_PROPERTY_HAS_EXTENDED_TITLE,
   SecurityMonitoringStandardRuleCreatePayload.JSON_PROPERTY_IS_ENABLED,
   SecurityMonitoringStandardRuleCreatePayload.JSON_PROPERTY_MESSAGE,
@@ -44,6 +45,9 @@ public class SecurityMonitoringStandardRuleCreatePayload {
   public static final String JSON_PROPERTY_FILTERS = "filters";
   private List<SecurityMonitoringFilter> filters = null;
 
+  public static final String JSON_PROPERTY_GROUP_SIGNALS_BY = "groupSignalsBy";
+  private List<String> groupSignalsBy = null;
+
   public static final String JSON_PROPERTY_HAS_EXTENDED_TITLE = "hasExtendedTitle";
   private Boolean hasExtendedTitle;
 
@@ -163,6 +167,37 @@ public void setFilters(List<SecurityMonitoringFilter> filters) {
     this.filters = filters;
   }
 
+  public SecurityMonitoringStandardRuleCreatePayload groupSignalsBy(List<String> groupSignalsBy) {
+    this.groupSignalsBy = groupSignalsBy;
+    return this;
+  }
+
+  public SecurityMonitoringStandardRuleCreatePayload addGroupSignalsByItem(
+      String groupSignalsByItem) {
+    if (this.groupSignalsBy == null) {
+      this.groupSignalsBy = new ArrayList<>();
+    }
+    this.groupSignalsBy.add(groupSignalsByItem);
+    return this;
+  }
+
+  /**
+   * Additional grouping to perform on top of the existing groups in the query section. Must be a
+   * subset of the existing groups.
+   *
+   * @return groupSignalsBy
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_GROUP_SIGNALS_BY)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public List<String> getGroupSignalsBy() {
+    return groupSignalsBy;
+  }
+
+  public void setGroupSignalsBy(List<String> groupSignalsBy) {
+    this.groupSignalsBy = groupSignalsBy;
+  }
+
   public SecurityMonitoringStandardRuleCreatePayload hasExtendedTitle(Boolean hasExtendedTitle) {
     this.hasExtendedTitle = hasExtendedTitle;
     return this;
@@ -481,6 +516,8 @@ public boolean equals(Object o) {
         (SecurityMonitoringStandardRuleCreatePayload) o;
     return Objects.equals(this.cases, securityMonitoringStandardRuleCreatePayload.cases)
         && Objects.equals(this.filters, securityMonitoringStandardRuleCreatePayload.filters)
+        && Objects.equals(
+            this.groupSignalsBy, securityMonitoringStandardRuleCreatePayload.groupSignalsBy)
         && Objects.equals(
             this.hasExtendedTitle, securityMonitoringStandardRuleCreatePayload.hasExtendedTitle)
         && Objects.equals(this.isEnabled, securityMonitoringStandardRuleCreatePayload.isEnabled)
@@ -504,6 +541,7 @@ public int hashCode() {
     return Objects.hash(
         cases,
         filters,
+        groupSignalsBy,
         hasExtendedTitle,
         isEnabled,
         message,
@@ -523,6 +561,7 @@ public String toString() {
     sb.append("class SecurityMonitoringStandardRuleCreatePayload {\n");
     sb.append("    cases: ").append(toIndentedString(cases)).append("\n");
     sb.append("    filters: ").append(toIndentedString(filters)).append("\n");
+    sb.append("    groupSignalsBy: ").append(toIndentedString(groupSignalsBy)).append("\n");
     sb.append("    hasExtendedTitle: ").append(toIndentedString(hasExtendedTitle)).append("\n");
     sb.append("    isEnabled: ").append(toIndentedString(isEnabled)).append("\n");
     sb.append("    message: ").append(toIndentedString(message)).append("\n");
diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringStandardRulePayload.java b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringStandardRulePayload.java
index 0aba4152777..06eb67af181 100644
--- a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringStandardRulePayload.java
+++ b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringStandardRulePayload.java
@@ -23,6 +23,7 @@
 @JsonPropertyOrder({
   SecurityMonitoringStandardRulePayload.JSON_PROPERTY_CASES,
   SecurityMonitoringStandardRulePayload.JSON_PROPERTY_FILTERS,
+  SecurityMonitoringStandardRulePayload.JSON_PROPERTY_GROUP_SIGNALS_BY,
   SecurityMonitoringStandardRulePayload.JSON_PROPERTY_HAS_EXTENDED_TITLE,
   SecurityMonitoringStandardRulePayload.JSON_PROPERTY_IS_ENABLED,
   SecurityMonitoringStandardRulePayload.JSON_PROPERTY_MESSAGE,
@@ -44,6 +45,9 @@ public class SecurityMonitoringStandardRulePayload {
   public static final String JSON_PROPERTY_FILTERS = "filters";
   private List<SecurityMonitoringFilter> filters = null;
 
+  public static final String JSON_PROPERTY_GROUP_SIGNALS_BY = "groupSignalsBy";
+  private List<String> groupSignalsBy = null;
+
   public static final String JSON_PROPERTY_HAS_EXTENDED_TITLE = "hasExtendedTitle";
   private Boolean hasExtendedTitle;
 
@@ -161,6 +165,36 @@ public void setFilters(List<SecurityMonitoringFilter> filters) {
     this.filters = filters;
   }
 
+  public SecurityMonitoringStandardRulePayload groupSignalsBy(List<String> groupSignalsBy) {
+    this.groupSignalsBy = groupSignalsBy;
+    return this;
+  }
+
+  public SecurityMonitoringStandardRulePayload addGroupSignalsByItem(String groupSignalsByItem) {
+    if (this.groupSignalsBy == null) {
+      this.groupSignalsBy = new ArrayList<>();
+    }
+    this.groupSignalsBy.add(groupSignalsByItem);
+    return this;
+  }
+
+  /**
+   * Additional grouping to perform on top of the existing groups in the query section. Must be a
+   * subset of the existing groups.
+   *
+   * @return groupSignalsBy
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_GROUP_SIGNALS_BY)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public List<String> getGroupSignalsBy() {
+    return groupSignalsBy;
+  }
+
+  public void setGroupSignalsBy(List<String> groupSignalsBy) {
+    this.groupSignalsBy = groupSignalsBy;
+  }
+
   public SecurityMonitoringStandardRulePayload hasExtendedTitle(Boolean hasExtendedTitle) {
     this.hasExtendedTitle = hasExtendedTitle;
     return this;
@@ -477,6 +511,7 @@ public boolean equals(Object o) {
         (SecurityMonitoringStandardRulePayload) o;
     return Objects.equals(this.cases, securityMonitoringStandardRulePayload.cases)
         && Objects.equals(this.filters, securityMonitoringStandardRulePayload.filters)
+        && Objects.equals(this.groupSignalsBy, securityMonitoringStandardRulePayload.groupSignalsBy)
         && Objects.equals(
             this.hasExtendedTitle, securityMonitoringStandardRulePayload.hasExtendedTitle)
         && Objects.equals(this.isEnabled, securityMonitoringStandardRulePayload.isEnabled)
@@ -499,6 +534,7 @@ public int hashCode() {
     return Objects.hash(
         cases,
         filters,
+        groupSignalsBy,
         hasExtendedTitle,
         isEnabled,
         message,
@@ -518,6 +554,7 @@ public String toString() {
     sb.append("class SecurityMonitoringStandardRulePayload {\n");
     sb.append("    cases: ").append(toIndentedString(cases)).append("\n");
     sb.append("    filters: ").append(toIndentedString(filters)).append("\n");
+    sb.append("    groupSignalsBy: ").append(toIndentedString(groupSignalsBy)).append("\n");
     sb.append("    hasExtendedTitle: ").append(toIndentedString(hasExtendedTitle)).append("\n");
     sb.append("    isEnabled: ").append(toIndentedString(isEnabled)).append("\n");
     sb.append("    message: ").append(toIndentedString(message)).append("\n");
diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringStandardRuleResponse.java b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringStandardRuleResponse.java
index 379c063d57a..c35f915c4a6 100644
--- a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringStandardRuleResponse.java
+++ b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringStandardRuleResponse.java
@@ -27,6 +27,7 @@
   SecurityMonitoringStandardRuleResponse.JSON_PROPERTY_DEFAULT_TAGS,
   SecurityMonitoringStandardRuleResponse.JSON_PROPERTY_DEPRECATION_DATE,
   SecurityMonitoringStandardRuleResponse.JSON_PROPERTY_FILTERS,
+  SecurityMonitoringStandardRuleResponse.JSON_PROPERTY_GROUP_SIGNALS_BY,
   SecurityMonitoringStandardRuleResponse.JSON_PROPERTY_HAS_EXTENDED_TITLE,
   SecurityMonitoringStandardRuleResponse.JSON_PROPERTY_ID,
   SecurityMonitoringStandardRuleResponse.JSON_PROPERTY_IS_DEFAULT,
@@ -69,6 +70,9 @@ public class SecurityMonitoringStandardRuleResponse {
   public static final String JSON_PROPERTY_FILTERS = "filters";
   private List<SecurityMonitoringFilter> filters = null;
 
+  public static final String JSON_PROPERTY_GROUP_SIGNALS_BY = "groupSignalsBy";
+  private List<String> groupSignalsBy = null;
+
   public static final String JSON_PROPERTY_HAS_EXTENDED_TITLE = "hasExtendedTitle";
   private Boolean hasExtendedTitle;
 
@@ -301,6 +305,36 @@ public void setFilters(List<SecurityMonitoringFilter> filters) {
     this.filters = filters;
   }
 
+  public SecurityMonitoringStandardRuleResponse groupSignalsBy(List<String> groupSignalsBy) {
+    this.groupSignalsBy = groupSignalsBy;
+    return this;
+  }
+
+  public SecurityMonitoringStandardRuleResponse addGroupSignalsByItem(String groupSignalsByItem) {
+    if (this.groupSignalsBy == null) {
+      this.groupSignalsBy = new ArrayList<>();
+    }
+    this.groupSignalsBy.add(groupSignalsByItem);
+    return this;
+  }
+
+  /**
+   * Additional grouping to perform on top of the existing groups in the query section. Must be a
+   * subset of the existing groups.
+   *
+   * @return groupSignalsBy
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_GROUP_SIGNALS_BY)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public List<String> getGroupSignalsBy() {
+    return groupSignalsBy;
+  }
+
+  public void setGroupSignalsBy(List<String> groupSignalsBy) {
+    this.groupSignalsBy = groupSignalsBy;
+  }
+
   public SecurityMonitoringStandardRuleResponse hasExtendedTitle(Boolean hasExtendedTitle) {
     this.hasExtendedTitle = hasExtendedTitle;
     return this;
@@ -760,6 +794,8 @@ public boolean equals(Object o) {
         && Objects.equals(
             this.deprecationDate, securityMonitoringStandardRuleResponse.deprecationDate)
         && Objects.equals(this.filters, securityMonitoringStandardRuleResponse.filters)
+        && Objects.equals(
+            this.groupSignalsBy, securityMonitoringStandardRuleResponse.groupSignalsBy)
         && Objects.equals(
             this.hasExtendedTitle, securityMonitoringStandardRuleResponse.hasExtendedTitle)
         && Objects.equals(this.id, securityMonitoringStandardRuleResponse.id)
@@ -794,6 +830,7 @@ public int hashCode() {
         defaultTags,
         deprecationDate,
         filters,
+        groupSignalsBy,
         hasExtendedTitle,
         id,
         isDefault,
@@ -826,6 +863,7 @@ public String toString() {
     sb.append("    defaultTags: ").append(toIndentedString(defaultTags)).append("\n");
     sb.append("    deprecationDate: ").append(toIndentedString(deprecationDate)).append("\n");
     sb.append("    filters: ").append(toIndentedString(filters)).append("\n");
+    sb.append("    groupSignalsBy: ").append(toIndentedString(groupSignalsBy)).append("\n");
     sb.append("    hasExtendedTitle: ").append(toIndentedString(hasExtendedTitle)).append("\n");
     sb.append("    id: ").append(toIndentedString(id)).append("\n");
     sb.append("    isDefault: ").append(toIndentedString(isDefault)).append("\n");
diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringStandardRuleTestPayload.java b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringStandardRuleTestPayload.java
index 1a814912da2..d0bab74404b 100644
--- a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringStandardRuleTestPayload.java
+++ b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringStandardRuleTestPayload.java
@@ -23,6 +23,7 @@
 @JsonPropertyOrder({
   SecurityMonitoringStandardRuleTestPayload.JSON_PROPERTY_CASES,
   SecurityMonitoringStandardRuleTestPayload.JSON_PROPERTY_FILTERS,
+  SecurityMonitoringStandardRuleTestPayload.JSON_PROPERTY_GROUP_SIGNALS_BY,
   SecurityMonitoringStandardRuleTestPayload.JSON_PROPERTY_HAS_EXTENDED_TITLE,
   SecurityMonitoringStandardRuleTestPayload.JSON_PROPERTY_IS_ENABLED,
   SecurityMonitoringStandardRuleTestPayload.JSON_PROPERTY_MESSAGE,
@@ -44,6 +45,9 @@ public class SecurityMonitoringStandardRuleTestPayload {
   public static final String JSON_PROPERTY_FILTERS = "filters";
   private List<SecurityMonitoringFilter> filters = null;
 
+  public static final String JSON_PROPERTY_GROUP_SIGNALS_BY = "groupSignalsBy";
+  private List<String> groupSignalsBy = null;
+
   public static final String JSON_PROPERTY_HAS_EXTENDED_TITLE = "hasExtendedTitle";
   private Boolean hasExtendedTitle;
 
@@ -162,6 +166,37 @@ public void setFilters(List<SecurityMonitoringFilter> filters) {
     this.filters = filters;
   }
 
+  public SecurityMonitoringStandardRuleTestPayload groupSignalsBy(List<String> groupSignalsBy) {
+    this.groupSignalsBy = groupSignalsBy;
+    return this;
+  }
+
+  public SecurityMonitoringStandardRuleTestPayload addGroupSignalsByItem(
+      String groupSignalsByItem) {
+    if (this.groupSignalsBy == null) {
+      this.groupSignalsBy = new ArrayList<>();
+    }
+    this.groupSignalsBy.add(groupSignalsByItem);
+    return this;
+  }
+
+  /**
+   * Additional grouping to perform on top of the existing groups in the query section. Must be a
+   * subset of the existing groups.
+   *
+   * @return groupSignalsBy
+   */
+  @jakarta.annotation.Nullable
+  @JsonProperty(JSON_PROPERTY_GROUP_SIGNALS_BY)
+  @JsonInclude(value = JsonInclude.Include.USE_DEFAULTS)
+  public List<String> getGroupSignalsBy() {
+    return groupSignalsBy;
+  }
+
+  public void setGroupSignalsBy(List<String> groupSignalsBy) {
+    this.groupSignalsBy = groupSignalsBy;
+  }
+
   public SecurityMonitoringStandardRuleTestPayload hasExtendedTitle(Boolean hasExtendedTitle) {
     this.hasExtendedTitle = hasExtendedTitle;
     return this;
@@ -478,6 +513,8 @@ public boolean equals(Object o) {
         (SecurityMonitoringStandardRuleTestPayload) o;
     return Objects.equals(this.cases, securityMonitoringStandardRuleTestPayload.cases)
         && Objects.equals(this.filters, securityMonitoringStandardRuleTestPayload.filters)
+        && Objects.equals(
+            this.groupSignalsBy, securityMonitoringStandardRuleTestPayload.groupSignalsBy)
         && Objects.equals(
             this.hasExtendedTitle, securityMonitoringStandardRuleTestPayload.hasExtendedTitle)
         && Objects.equals(this.isEnabled, securityMonitoringStandardRuleTestPayload.isEnabled)
@@ -501,6 +538,7 @@ public int hashCode() {
     return Objects.hash(
         cases,
         filters,
+        groupSignalsBy,
         hasExtendedTitle,
         isEnabled,
         message,
@@ -520,6 +558,7 @@ public String toString() {
     sb.append("class SecurityMonitoringStandardRuleTestPayload {\n");
     sb.append("    cases: ").append(toIndentedString(cases)).append("\n");
     sb.append("    filters: ").append(toIndentedString(filters)).append("\n");
+    sb.append("    groupSignalsBy: ").append(toIndentedString(groupSignalsBy)).append("\n");
     sb.append("    hasExtendedTitle: ").append(toIndentedString(hasExtendedTitle)).append("\n");
     sb.append("    isEnabled: ").append(toIndentedString(isEnabled)).append("\n");
     sb.append("    message: ").append(toIndentedString(message)).append("\n");
diff --git a/src/test/resources/cassettes/features/v2/Create_a_detection_rule_with_type_application_security_returns_OK_response.freeze b/src/test/resources/cassettes/features/v2/Create_a_detection_rule_with_type_application_security_returns_OK_response.freeze
new file mode 100644
index 00000000000..7a935c1425b
--- /dev/null
+++ b/src/test/resources/cassettes/features/v2/Create_a_detection_rule_with_type_application_security_returns_OK_response.freeze
@@ -0,0 +1 @@
+2025-02-06T16:50:39.787Z
\ No newline at end of file
diff --git a/src/test/resources/cassettes/features/v2/Create_a_detection_rule_with_type_application_security_returns_OK_response.json b/src/test/resources/cassettes/features/v2/Create_a_detection_rule_with_type_application_security_returns_OK_response.json
new file mode 100644
index 00000000000..19ca3f7ec27
--- /dev/null
+++ b/src/test/resources/cassettes/features/v2/Create_a_detection_rule_with_type_application_security_returns_OK_response.json
@@ -0,0 +1,58 @@
+[
+  {
+    "httpRequest": {
+      "body": {
+        "type": "JSON",
+        "json": "{\"cases\":[{\"actions\":[{\"options\":{\"duration\":900},\"type\":\"block_ip\"}],\"condition\":\"a > 100000\",\"name\":\"\",\"notifications\":[],\"status\":\"info\"}],\"filters\":[],\"groupSignalsBy\":[\"service\"],\"isEnabled\":true,\"message\":\"Test rule\",\"name\":\"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1738860639_appsec_rule\",\"options\":{\"detectionMethod\":\"threshold\",\"evaluationWindow\":900,\"keepAlive\":3600,\"maxSignalDuration\":86400},\"queries\":[{\"aggregation\":\"count\",\"distinctFields\":[],\"groupByFields\":[\"service\",\"@http.client_ip\"],\"query\":\"@appsec.security_activity:business_logic.users.login.failure\"}],\"tags\":[],\"type\":\"application_security\"}"
+      },
+      "headers": {},
+      "method": "POST",
+      "path": "/api/v2/security_monitoring/rules",
+      "keepAlive": false,
+      "secure": true
+    },
+    "httpResponse": {
+      "body": "{\"name\":\"Test-Create_a_detection_rule_with_type_application_security_returns_OK_response-1738860639_appsec_rule\",\"createdAt\":1738860640426,\"isDefault\":false,\"isPartner\":false,\"isEnabled\":true,\"isBeta\":false,\"isDeleted\":false,\"isDeprecated\":false,\"queries\":[{\"query\":\"@appsec.security_activity:business_logic.users.login.failure\",\"groupByFields\":[\"service\",\"@http.client_ip\"],\"hasOptionalGroupByFields\":false,\"distinctFields\":[],\"aggregation\":\"count\",\"name\":\"\",\"dataSource\":\"app_sec_spans\"}],\"options\":{\"evaluationWindow\":900,\"detectionMethod\":\"threshold\",\"maxSignalDuration\":86400,\"keepAlive\":3600},\"cases\":[{\"name\":\"\",\"status\":\"info\",\"notifications\":[],\"condition\":\"a \\u003e 100000\",\"actions\":[{\"type\":\"block_ip\",\"options\":{\"duration\":900}}]}],\"message\":\"Test rule\",\"tags\":[],\"hasExtendedTitle\":false,\"type\":\"application_security\",\"filters\":[],\"version\":1,\"id\":\"rfn-h2v-udr\",\"blocking\":true,\"groupSignalsBy\":[\"service\"],\"casesActions\":[[{\"type\":\"block_ip\",\"options\":{\"duration\":900}}]],\"dependencies\":[\"business_logic.users.login.failure\"],\"metadata\":{\"entities\":null,\"sources\":null},\"creator\":{\"handle\":\"\",\"name\":\"\"},\"updater\":{\"handle\":\"\",\"name\":\"\"}}",
+      "headers": {
+        "Content-Type": [
+          "application/json"
+        ]
+      },
+      "statusCode": 200,
+      "reasonPhrase": "OK"
+    },
+    "times": {
+      "remainingTimes": 1
+    },
+    "timeToLive": {
+      "unlimited": true
+    },
+    "id": "e25ba2dd-2cd8-54ae-985a-97cf9b520975"
+  },
+  {
+    "httpRequest": {
+      "headers": {},
+      "method": "DELETE",
+      "path": "/api/v2/security_monitoring/rules/rfn-h2v-udr",
+      "keepAlive": false,
+      "secure": true
+    },
+    "httpResponse": {
+      "body": "{\"status\":\"404\",\"title\":\"Not Found\"}",
+      "headers": {
+        "Content-Type": [
+          "application/json"
+        ]
+      },
+      "statusCode": 404,
+      "reasonPhrase": "Not Found"
+    },
+    "times": {
+      "remainingTimes": 1
+    },
+    "timeToLive": {
+      "unlimited": true
+    },
+    "id": "d0c7ee9e-7178-f2b7-bb6a-b84e899effed"
+  }
+]
\ No newline at end of file
diff --git a/src/test/resources/com/datadog/api/client/v2/api/security_monitoring.feature b/src/test/resources/com/datadog/api/client/v2/api/security_monitoring.feature
index aaea07a9f8a..ec4c3d3f39d 100644
--- a/src/test/resources/com/datadog/api/client/v2/api/security_monitoring.feature
+++ b/src/test/resources/com/datadog/api/client/v2/api/security_monitoring.feature
@@ -200,6 +200,16 @@ Feature: Security Monitoring
     And the response "options.detectionMethod" is equal to "third_party"
     And the response "thirdPartyCases[0].query" is equal to "status:error"
 
+  @skip-validation @team:DataDog/k9-cloud-security-platform
+  Scenario: Create a detection rule with type 'application_security 'returns "OK" response
+    Given new "CreateSecurityMonitoringRule" request
+    And body with value {"type":"application_security","name":"{{unique}}_appsec_rule","queries":[{"query":"@appsec.security_activity:business_logic.users.login.failure","aggregation":"count","groupByFields":["service","@http.client_ip"],"distinctFields":[]}],"filters":[],"cases":[{"name":"","status":"info","notifications":[],"condition":"a > 100000","actions":[{"type":"block_ip","options":{"duration":900}}]}],"options":{"keepAlive":3600,"maxSignalDuration":86400,"evaluationWindow":900,"detectionMethod":"threshold"},"isEnabled":true,"message":"Test rule","tags":[],"groupSignalsBy":["service"]}
+    When the request is sent
+    Then the response status is 200 OK
+    And the response "name" is equal to "{{ unique }}_appsec_rule"
+    And the response "type" is equal to "application_security"
+    And the response "message" is equal to "Test rule"
+
   @skip-validation @team:DataDog/k9-cloud-security-platform
   Scenario: Create a detection rule with type 'impossible_travel' returns "OK" response
     Given new "CreateSecurityMonitoringRule" request