[SEC-37056] Document security signal search response fields

.generator/schemas/v2/openapi.yaml

@@ -103550,9 +103550,21 @@ components:
       additionalProperties: {}
       description: "The object containing all signal attributes and their\nassociated values."
       properties:
+        attributes:
+          additionalProperties: {}
+          description: A JSON object of attributes in the security signal, returned when listing or searching signals.
+          example:
+            workflow:
+              first_seen: "2020-06-23T14:46:01.000Z"
+              last_seen: "2020-06-23T14:46:49.000Z"
+              rule:
+                id: 0f5-e0c-805
+                name: "Brute Force Attack Grouped By User"
+                version: 12
+          type: object
         custom:
           additionalProperties: {}
-          description: A JSON object of attributes in the security signal.
+          description: A JSON object of attributes in the security signal, returned when retrieving a single signal.
           example:
             workflow:
               first_seen: "2020-06-23T14:46:01.000Z"
@@ -104385,8 +104397,21 @@ components:
     SecurityMonitoringSignalsListResponseMeta:
       description: Meta attributes.
       properties:
+        elapsed:
+          description: The time elapsed in milliseconds.
+          example: 132
+          format: int64
+          type: integer
         page:
           $ref: '#/components/schemas/SecurityMonitoringSignalsListResponseMetaPage'
+        request_id:
+          description: The unique identifier of the request.
+          example: example-request-id
+          type: string
+        status:
+          description: The status of the response.
+          example: done
+          type: string
       type: object
     SecurityMonitoringSignalsListResponseMetaPage:
       description: Paging attributes.
@@ -209115,15 +209140,24 @@ paths:
                   value:
                     data:
                       - attributes:
+                          attributes:
+                            workflow:
+                              rule:
+                                id: 0f5-e0c-805
+                                name: "Brute Force Attack Grouped By User"
+                                version: 12
                           tags:
                             - "source:cloudtrail"
                         id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
                         type: signal
                     links:
                       next: ""
                     meta:
+                      elapsed: 132
                       page:
                         after: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
+                      request_id: example-request-id
+                      status: done
               schema:
                 $ref: '#/components/schemas/SecurityMonitoringSignalsListResponse'
           description: OK

examples/v2/security-monitoring/SearchSecurityMonitoringSignals.py

@@ -2,6 +2,8 @@
 Get a list of security signals returns "OK" response
 """
 
+from datetime import datetime
+from dateutil.relativedelta import relativedelta
 from datadog_api_client import ApiClient, Configuration
 from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
 from datadog_api_client.v2.model.security_monitoring_signal_list_request import SecurityMonitoringSignalListRequest
@@ -12,17 +14,14 @@
     SecurityMonitoringSignalListRequestPage,
 )
 from datadog_api_client.v2.model.security_monitoring_signals_sort import SecurityMonitoringSignalsSort
-from datetime import datetime
-from dateutil.tz import tzutc
 
 body = SecurityMonitoringSignalListRequest(
     filter=SecurityMonitoringSignalListRequestFilter(
-        _from=datetime(2019, 1, 2, 9, 42, 36, 320000, tzinfo=tzutc()),
+        _from=(datetime.now() + relativedelta(minutes=-15)),
         query="security:attack status:high",
-        to=datetime(2019, 1, 3, 9, 42, 36, 320000, tzinfo=tzutc()),
+        to=datetime.now(),
     ),
     page=SecurityMonitoringSignalListRequestPage(
-        cursor="eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==",
         limit=25,
     ),
     sort=SecurityMonitoringSignalsSort.TIMESTAMP_ASCENDING,

src/datadog_api_client/v2/model/security_monitoring_signal_attributes.py

@@ -21,6 +21,22 @@ class SecurityMonitoringSignalAttributes(ModelNormal):
     @cached_property
     def openapi_types(_):
         return {
+            "attributes": (
+                {
+                    str: (
+                        bool,
+                        date,
+                        datetime,
+                        dict,
+                        float,
+                        int,
+                        list,
+                        str,
+                        UUID,
+                        none_type,
+                    )
+                },
+            ),
             "custom": (
                 {
                     str: (
@@ -43,6 +59,7 @@ def openapi_types(_):
         }
 
     attribute_map = {
+        "attributes": "attributes",
         "custom": "custom",
         "message": "message",
         "tags": "tags",
@@ -51,6 +68,7 @@ def openapi_types(_):
 
     def __init__(
         self_,
+        attributes: Union[Dict[str, Any], UnsetType] = unset,
         custom: Union[Dict[str, Any], UnsetType] = unset,
         message: Union[str, UnsetType] = unset,
         tags: Union[List[str], UnsetType] = unset,
@@ -61,7 +79,10 @@ def __init__(
         The object containing all signal attributes and their
         associated values.
 
-        :param custom: A JSON object of attributes in the security signal.
+        :param attributes: A JSON object of attributes in the security signal, returned when listing or searching signals.
+        :type attributes: {str: (bool, date, datetime, dict, float, int, list, str, UUID, none_type,)}, optional
+
+        :param custom: A JSON object of attributes in the security signal, returned when retrieving a single signal.
         :type custom: {str: (bool, date, datetime, dict, float, int, list, str, UUID, none_type,)}, optional
 
         :param message: The message in the security signal defined by the rule that generated the signal.
@@ -73,6 +94,8 @@ def __init__(
         :param timestamp: The timestamp of the security signal.
         :type timestamp: datetime, optional
         """
+        if attributes is not unset:
+            kwargs["attributes"] = attributes
         if custom is not unset:
             kwargs["custom"] = custom
         if message is not unset:

src/datadog_api_client/v2/model/security_monitoring_signals_list_response_meta.py

@@ -27,20 +27,48 @@ def openapi_types(_):
         )
 
         return {
+            "elapsed": (int,),
             "page": (SecurityMonitoringSignalsListResponseMetaPage,),
+            "request_id": (str,),
+            "status": (str,),
         }
 
     attribute_map = {
+        "elapsed": "elapsed",
         "page": "page",
+        "request_id": "request_id",
+        "status": "status",
     }
 
-    def __init__(self_, page: Union[SecurityMonitoringSignalsListResponseMetaPage, UnsetType] = unset, **kwargs):
+    def __init__(
+        self_,
+        elapsed: Union[int, UnsetType] = unset,
+        page: Union[SecurityMonitoringSignalsListResponseMetaPage, UnsetType] = unset,
+        request_id: Union[str, UnsetType] = unset,
+        status: Union[str, UnsetType] = unset,
+        **kwargs,
+    ):
         """
         Meta attributes.
 
+        :param elapsed: The time elapsed in milliseconds.
+        :type elapsed: int, optional
+
         :param page: Paging attributes.
         :type page: SecurityMonitoringSignalsListResponseMetaPage, optional
+
+        :param request_id: The unique identifier of the request.
+        :type request_id: str, optional
+
+        :param status: The status of the response.
+        :type status: str, optional
         """
+        if elapsed is not unset:
+            kwargs["elapsed"] = elapsed
         if page is not unset:
             kwargs["page"] = page
+        if request_id is not unset:
+            kwargs["request_id"] = request_id
+        if status is not unset:
+            kwargs["status"] = status
         super().__init__(kwargs)

tests/generated-test/test-runner-data/manifest.json

@@ -9737,6 +9737,13 @@
       "scenario": "Get a job's details returns \"OK\" response",
       "version": "v2"
     },
+    {
+      "feature": "Security Monitoring",
+      "feature_file": "../../v2/features/security_monitoring.feature",
+      "file": "v2/security-monitoring/get-a-list-of-security-signals-returns-ok-response.json",
+      "scenario": "Get a list of security signals returns \"OK\" response",
+      "version": "v2"
+    },
     {
       "feature": "Security Monitoring",
       "feature_file": "../../v2/features/security_monitoring.feature",

tests/generated-test/test-runner-data/v2/security-monitoring/get-a-list-of-security-signals-returns-ok-response.json

@@ -0,0 +1,28 @@
+{
+  "api": "SecurityMonitoring",
+  "expected_status": 200,
+  "feature": "Security Monitoring",
+  "id": "v2/Security Monitoring/Get a list of security signals returns \"OK\" response",
+  "operation_id": "SearchSecurityMonitoringSignals",
+  "request": {
+    "body": {
+      "schema": {
+        "format": null,
+        "ref": "SecurityMonitoringSignalListRequest",
+        "type": "object"
+      },
+      "source": "inline",
+      "value": {
+        "$openapi_transformer_template": "{\"filter\": {\"from\": \"{{ timeISO(\"now-15m\") }}\", \"query\": \"security:attack status:high\", \"to\": \"{{ timeISO(\"now\") }}\"}, \"page\": {\"limit\": 25}, \"sort\": \"timestamp\"}"
+      }
+    },
+    "content_type": "application/json",
+    "method": "POST",
+    "pagination": false,
+    "parameters": [],
+    "path": "/api/v2/security_monitoring/signals/search"
+  },
+  "scenario": "Get a list of security signals returns \"OK\" response",
+  "schema_version": 1,
+  "version": "v2"
+}

tests/generated-test/test-server-data/v2/security-monitoring.json

@@ -6315,6 +6315,47 @@
       "scenario": "Get a job's details returns \"OK\" response",
       "version": "v2"
     },
+    {
+      "feature": "Security Monitoring",
+      "frozen_at": "2026-09-07T11:46:49.362Z",
+      "interactions": [
+        {
+          "request": {
+            "body": {
+              "type": "json",
+              "value": {
+                "filter": {
+                  "from": "2026-09-07T11:31:49.362Z",
+                  "query": "security:attack status:high",
+                  "to": "2026-09-07T11:46:49.362Z"
+                },
+                "page": {
+                  "limit": 25
+                },
+                "sort": "timestamp"
+              }
+            },
+            "content_type": "application/json",
+            "method": "POST",
+            "path": "/api/v2/security_monitoring/signals/search",
+            "query": []
+          },
+          "response": {
+            "body": {
+              "encoding": "text",
+              "value": "{\"data\":[],\"meta\":{\"elapsed\":24,\"request_id\":\"pddv1ChZqcnNodVBJQ1RWQ3Z2c3ZWNk16b1hnIiwKHEcyOE2iTY5xAPH0dcTcAYFseqFJt4YjCHkKmO4SDDns4KG5VTag-ijkzg\",\"status\":\"done\"}}"
+            },
+            "headers": {
+              "content-type": "application/json"
+            },
+            "reason": "OK",
+            "status": 200
+          }
+        }
+      ],
+      "scenario": "Get a list of security signals returns \"OK\" response",
+      "version": "v2"
+    },
     {
       "feature": "Security Monitoring",
       "frozen_at": "2022-04-13T11:32:57.080Z",

tests/v2/features/security_monitoring.feature

@@ -1787,12 +1787,15 @@ Feature: Security Monitoring
     When the request is sent
     Then the response status is 400 Bad Request
 
-  @generated @skip @team:DataDog/cloud-siem
+  @team:DataDog/cloud-siem
   Scenario: Get a list of security signals returns "OK" response
     Given new "SearchSecurityMonitoringSignals" request
-    And body with value {"filter": {"from": "2019-01-02T09:42:36.320Z", "query": "security:attack status:high", "to": "2019-01-03T09:42:36.320Z"}, "page": {"cursor": "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==", "limit": 25}, "sort": "timestamp"}
+    And body with value {"filter": {"from": "{{ timeISO("now-15m") }}", "query": "security:attack status:high", "to": "{{ timeISO("now") }}"}, "page": {"limit": 25}, "sort": "timestamp"}
     When the request is sent
     Then the response status is 200 OK
+    And the response "meta" has field "elapsed"
+    And the response "meta" has field "request_id"
+    And the response "meta.status" is equal to "done"
 
   @replay-only @skip-validation @team:DataDog/cloud-siem @with-pagination
   Scenario: Get a list of security signals returns "OK" response with pagination