Add siem_12mo_retention and siem_6mo_retention to usage API

.generator/schemas/v1/openapi.yaml

@@ -4884,6 +4884,8 @@ components:
         - sds_scanned_bytes_usage
         - serverless_apps_usage
         - serverless_apps_apm_usage
+        - siem_12mo_retention_usage
+        - siem_6mo_retention_usage
         - siem_analyzed_logs_add_on_usage
         - siem_ingested_bytes_usage
         - snmp_usage
@@ -4973,6 +4975,8 @@ components:
         - SDS_SCANNED_BYTES_USAGE
         - SERVERLESS_APPS_USAGE
         - SERVERLESS_APPS_APM_USAGE
+        - SIEM_12MO_RETENTION_USAGE
+        - SIEM_6MO_RETENTION_USAGE
         - SIEM_ANALYZED_LOGS_ADD_ON_USAGE
         - SIEM_INGESTED_BYTES_USAGE
         - SNMP_USAGE
@@ -9229,19 +9233,11 @@ components:
           description: The monitor `CRITICAL` threshold.
           format: double
           type: number
-        critical_query:
-          description: Query evaluated as a dynamic `CRITICAL` threshold. Only supported on metric monitors with a formula query and options['variables']. Cannot be combined with static thresholds. This field is in preview.
-          example: 'formula("2 * query1").rollup("avg").last("6mo")'
-          type: string
         critical_recovery:
           description: The monitor `CRITICAL` recovery threshold.
           format: double
           nullable: true
           type: number
-        critical_recovery_query:
-          description: Query evaluated as a dynamic `CRITICAL` recovery threshold. Only supported on metric monitors with a formula query and options['variables']. Cannot be combined with static thresholds. This field is in preview.
-          example: 'formula("1.5 * query1").rollup("avg").last("3mo")'
-          type: string
         ok:
           description: The monitor `OK` threshold.
           format: double
@@ -9605,6 +9601,10 @@ components:
         - rum_browser_mobile_sessions_percentage
         - ingested_spans_bytes_usage
         - ingested_spans_bytes_percentage
+        - siem_12mo_retention_usage
+        - siem_12mo_retention_percentage
+        - siem_6mo_retention_usage
+        - siem_6mo_retention_percentage
         - siem_analyzed_logs_add_on_usage
         - siem_analyzed_logs_add_on_percentage
         - siem_ingested_bytes_usage
@@ -9774,6 +9774,10 @@ components:
         - RUM_BROWSER_MOBILE_SESSIONS_PERCENTAGE
         - INGESTED_SPANS_BYTES_USAGE
         - INGESTED_SPANS_BYTES_PERCENTAGE
+        - SIEM_12MO_RETENTION_USAGE
+        - SIEM_12MO_RETENTION_PERCENTAGE
+        - SIEM_6MO_RETENTION_USAGE
+        - SIEM_6MO_RETENTION_PERCENTAGE
         - SIEM_ANALYZED_LOGS_ADD_ON_USAGE
         - SIEM_ANALYZED_LOGS_ADD_ON_PERCENTAGE
         - SIEM_INGESTED_BYTES_USAGE
@@ -10403,6 +10407,22 @@ components:
           description: The total Serverless Apps usage by tag(s).
           format: double
           type: number
+        siem_12mo_retention_percentage:
+          description: The percentage of Cloud SIEM Indexed Logs (12-month retention) usage by tag(s).
+          format: double
+          type: number
+        siem_12mo_retention_usage:
+          description: The Cloud SIEM Indexed Logs (12-month retention) usage by tag(s).
+          format: double
+          type: number
+        siem_6mo_retention_percentage:
+          description: The percentage of Cloud SIEM Indexed Logs (6-month retention) usage by tag(s).
+          format: double
+          type: number
+        siem_6mo_retention_usage:
+          description: The Cloud SIEM Indexed Logs (6-month retention) usage by tag(s).
+          format: double
+          type: number
         siem_analyzed_logs_add_on_percentage:
           description: The percentage of log events analyzed by Cloud SIEM usage by tag(s).
           format: double
@@ -22467,6 +22487,10 @@ components:
           description: Shows the sum of all Cloud Security Information and Event Management events over all hours in the current date for the given org.
           format: int64
           type: integer
+        cloud_siem_indexed_logs_sum:
+          description: Shows the sum of all Cloud SIEM Indexed Logs over all hours in the current date for the given org.
+          format: int64
+          type: integer
         code_analysis_sa_committers_hwm:
           description: Shows the high-water mark of all Static Analysis committers over all hours in the current date for the given org.
           format: int64
@@ -23231,6 +23255,14 @@ components:
           description: Shows the average number of Serverless Apps for Azure and Google Cloud for the given date and given org.
           format: int64
           type: integer
+        siem_12mo_retention_sum:
+          description: Shows the sum of Cloud SIEM Indexed Logs (12-month retention) over all hours in the current date for the given org.
+          format: int64
+          type: integer
+        siem_6mo_retention_sum:
+          description: Shows the sum of Cloud SIEM Indexed Logs (6-month retention) over all hours in the current date for the given org.
+          format: int64
+          type: integer
         siem_analyzed_logs_add_on_count_sum:
           description: Shows the sum of all log events analyzed by Cloud SIEM over all hours in the current date for the given org.
           format: int64
@@ -23480,6 +23512,10 @@ components:
           description: Shows the sum of all Cloud Security Information and Event Management events over all hours in the current date for the given org.
           format: int64
           type: integer
+        cloud_siem_indexed_logs_sum:
+          description: Shows the sum of all Cloud SIEM Indexed Logs over all hours in the current date for the given org.
+          format: int64
+          type: integer
         code_analysis_sa_committers_hwm:
           description: Shows the high-water mark of all Static Analysis committers over all hours in the current date for the given org.
           format: int64
@@ -24256,6 +24292,14 @@ components:
           description: Shows the average number of Serverless Apps for Azure and Google Cloud for the given date and given org.
           format: int64
           type: integer
+        siem_12mo_retention_sum:
+          description: Shows the sum of Cloud SIEM Indexed Logs (12-month retention) over all hours in the current date for the given org.
+          format: int64
+          type: integer
+        siem_6mo_retention_sum:
+          description: Shows the sum of Cloud SIEM Indexed Logs (6-month retention) over all hours in the current date for the given org.
+          format: int64
+          type: integer
         siem_analyzed_logs_add_on_count_sum:
           description: Shows the sum of all log events analyzed by Cloud SIEM over all hours in the current date for the given org.
           format: int64
@@ -24503,6 +24547,10 @@ components:
           description: Shows the sum of all Cloud Security Information and Event Management events over all hours in the current month for all organizations.
           format: int64
           type: integer
+        cloud_siem_indexed_logs_agg_sum:
+          description: Shows the sum of all Cloud SIEM Indexed Logs over all hours in the current month for all organizations.
+          format: int64
+          type: integer
         code_analysis_sa_committers_hwm_sum:
           description: Shows the high-water mark of all Static Analysis committers over all hours in the current month for all organizations.
           format: int64
@@ -25299,6 +25347,14 @@ components:
           description: Sum of the average number of Serverless Apps for Azure and Google Cloud in the current month for all organizations.
           format: int64
           type: integer
+        siem_12mo_retention_agg_sum:
+          description: Shows the sum of Cloud SIEM Indexed Logs (12-month retention) over all hours in the current month for all organizations.
+          format: int64
+          type: integer
+        siem_6mo_retention_agg_sum:
+          description: Shows the sum of Cloud SIEM Indexed Logs (6-month retention) over all hours in the current month for all organizations.
+          format: int64
+          type: integer
         siem_analyzed_logs_add_on_count_agg_sum:
           description: Shows the sum of all log events analyzed by Cloud SIEM over all hours in the current month for all organizations.
           format: int64
@@ -33708,10 +33764,6 @@ paths:
         - `operator`: <, <=, >, >=, ==, or !=
         - `#`: an integer or decimal number used to set the threshold
 
-        To use a dynamic threshold on a metric monitor with a formula query, replace `#` with the `threshold` keyword
-        (for example, `... > threshold`) and provide the threshold as a query via `critical_query` on `options.thresholds`.
-        This feature is in preview.
-
         If you are using the `_change_` or `_pct_change_` time aggregator, instead use `change_aggr(time_aggr(time_window),
         timeshift):space_aggr:metric{tags} [by {key}] operator #` with:
 

src/datadog_api_client/v1/api/monitors_api.py

@@ -425,10 +425,6 @@ def create_monitor(
         * ``operator`` : <, <=, >, >=, ==, or !=
         * ``#`` : an integer or decimal number used to set the threshold
 
-        To use a dynamic threshold on a metric monitor with a formula query, replace ``#`` with the ``threshold`` keyword
-        (for example, ``... > threshold`` ) and provide the threshold as a query via ``critical_query`` on ``options.thresholds``.
-        This feature is in preview.
-
         If you are using the ``_change_`` or ``_pct_change_`` time aggregator, instead use ``change_aggr(time_aggr(time_window),
         timeshift):space_aggr:metric{tags} [by {key}] operator #`` with:
 

src/datadog_api_client/v1/model/hourly_usage_attribution_usage_type.py

@@ -17,7 +17,7 @@ class HourlyUsageAttributionUsageType(ModelSimple):
     Supported products for hourly usage attribution requests. Usage types are in the format `<usage_type>_usage`.
         To obtain the complete list of valid usage types, make a request to the [Get usage attribution types API](https://docs.datadoghq.com/api/latest/usage-metering/#get-usage-attribution-types).
 
-    :param value: Must be one of ["api_usage", "apm_fargate_usage", "apm_host_usage", "apm_usm_usage", "appsec_fargate_usage", "appsec_usage", "asm_serverless_traced_invocations_usage", "asm_serverless_traced_invocations_percentage", "bits_ai_investigations_usage", "browser_usage", "ci_code_coverage_committers_percentage", "ci_code_coverage_committers_usage", "ci_pipeline_indexed_spans_usage", "ci_test_indexed_spans_usage", "ci_visibility_itr_usage", "cloud_siem_usage", "code_security_host_usage", "container_excl_agent_usage", "container_usage", "cspm_containers_usage", "cspm_hosts_usage", "custom_event_usage", "custom_ingested_timeseries_usage", "custom_timeseries_usage", "cws_containers_usage", "cws_fargate_task_usage", "cws_hosts_usage", "data_jobs_monitoring_usage", "data_stream_monitoring_usage", "dbm_hosts_usage", "dbm_queries_usage", "error_tracking_usage", "error_tracking_percentage", "estimated_indexed_spans_usage", "estimated_ingested_spans_usage", "fargate_usage", "flex_logs_starter", "flex_stored_logs", "functions_usage", "incident_management_monthly_active_users_usage", "indexed_spans_usage", "infra_host_usage", "infra_host_basic_usage", "ingested_logs_bytes_usage", "ingested_spans_bytes_usage", "invocations_usage", "lambda_traced_invocations_usage", "llm_observability_usage", "llm_spans_usage", "logs_indexed_15day_usage", "logs_indexed_180day_usage", "logs_indexed_1day_usage", "logs_indexed_30day_usage", "logs_indexed_360day_usage", "logs_indexed_3day_usage", "logs_indexed_45day_usage", "logs_indexed_60day_usage", "logs_indexed_7day_usage", "logs_indexed_90day_usage", "logs_indexed_custom_retention_usage", "mobile_app_testing_usage", "ndm_netflow_usage", "npm_host_usage", "network_device_wireless_usage", "obs_pipeline_bytes_usage", "obs_pipelines_vcpu_usage", "online_archive_usage", "product_analytics_session_usage", "profiled_container_usage", "profiled_fargate_usage", "profiled_host_usage", "published_app", "rum_browser_mobile_sessions_usage", "rum_ingested_usage", "rum_investigate_usage", "rum_replay_sessions_usage", "rum_session_replay_add_on_usage", "sca_fargate_usage", "sds_scanned_bytes_usage", "serverless_apps_usage", "serverless_apps_apm_usage", "siem_analyzed_logs_add_on_usage", "siem_ingested_bytes_usage", "snmp_usage", "universal_service_monitoring_usage", "vuln_management_hosts_usage", "workflow_executions_usage"].
+    :param value: Must be one of ["api_usage", "apm_fargate_usage", "apm_host_usage", "apm_usm_usage", "appsec_fargate_usage", "appsec_usage", "asm_serverless_traced_invocations_usage", "asm_serverless_traced_invocations_percentage", "bits_ai_investigations_usage", "browser_usage", "ci_code_coverage_committers_percentage", "ci_code_coverage_committers_usage", "ci_pipeline_indexed_spans_usage", "ci_test_indexed_spans_usage", "ci_visibility_itr_usage", "cloud_siem_usage", "code_security_host_usage", "container_excl_agent_usage", "container_usage", "cspm_containers_usage", "cspm_hosts_usage", "custom_event_usage", "custom_ingested_timeseries_usage", "custom_timeseries_usage", "cws_containers_usage", "cws_fargate_task_usage", "cws_hosts_usage", "data_jobs_monitoring_usage", "data_stream_monitoring_usage", "dbm_hosts_usage", "dbm_queries_usage", "error_tracking_usage", "error_tracking_percentage", "estimated_indexed_spans_usage", "estimated_ingested_spans_usage", "fargate_usage", "flex_logs_starter", "flex_stored_logs", "functions_usage", "incident_management_monthly_active_users_usage", "indexed_spans_usage", "infra_host_usage", "infra_host_basic_usage", "ingested_logs_bytes_usage", "ingested_spans_bytes_usage", "invocations_usage", "lambda_traced_invocations_usage", "llm_observability_usage", "llm_spans_usage", "logs_indexed_15day_usage", "logs_indexed_180day_usage", "logs_indexed_1day_usage", "logs_indexed_30day_usage", "logs_indexed_360day_usage", "logs_indexed_3day_usage", "logs_indexed_45day_usage", "logs_indexed_60day_usage", "logs_indexed_7day_usage", "logs_indexed_90day_usage", "logs_indexed_custom_retention_usage", "mobile_app_testing_usage", "ndm_netflow_usage", "npm_host_usage", "network_device_wireless_usage", "obs_pipeline_bytes_usage", "obs_pipelines_vcpu_usage", "online_archive_usage", "product_analytics_session_usage", "profiled_container_usage", "profiled_fargate_usage", "profiled_host_usage", "published_app", "rum_browser_mobile_sessions_usage", "rum_ingested_usage", "rum_investigate_usage", "rum_replay_sessions_usage", "rum_session_replay_add_on_usage", "sca_fargate_usage", "sds_scanned_bytes_usage", "serverless_apps_usage", "serverless_apps_apm_usage", "siem_12mo_retention_usage", "siem_6mo_retention_usage", "siem_analyzed_logs_add_on_usage", "siem_ingested_bytes_usage", "snmp_usage", "universal_service_monitoring_usage", "vuln_management_hosts_usage", "workflow_executions_usage"].
     :type value: str
     """
 
@@ -103,6 +103,8 @@ class HourlyUsageAttributionUsageType(ModelSimple):
         "sds_scanned_bytes_usage",
         "serverless_apps_usage",
         "serverless_apps_apm_usage",
+        "siem_12mo_retention_usage",
+        "siem_6mo_retention_usage",
         "siem_analyzed_logs_add_on_usage",
         "siem_ingested_bytes_usage",
         "snmp_usage",
@@ -191,6 +193,8 @@ class HourlyUsageAttributionUsageType(ModelSimple):
     SDS_SCANNED_BYTES_USAGE: ClassVar["HourlyUsageAttributionUsageType"]
     SERVERLESS_APPS_USAGE: ClassVar["HourlyUsageAttributionUsageType"]
     SERVERLESS_APPS_APM_USAGE: ClassVar["HourlyUsageAttributionUsageType"]
+    SIEM_12MO_RETENTION_USAGE: ClassVar["HourlyUsageAttributionUsageType"]
+    SIEM_6MO_RETENTION_USAGE: ClassVar["HourlyUsageAttributionUsageType"]
     SIEM_ANALYZED_LOGS_ADD_ON_USAGE: ClassVar["HourlyUsageAttributionUsageType"]
     SIEM_INGESTED_BYTES_USAGE: ClassVar["HourlyUsageAttributionUsageType"]
     SNMP_USAGE: ClassVar["HourlyUsageAttributionUsageType"]
@@ -326,6 +330,8 @@ def openapi_types(_):
 HourlyUsageAttributionUsageType.SDS_SCANNED_BYTES_USAGE = HourlyUsageAttributionUsageType("sds_scanned_bytes_usage")
 HourlyUsageAttributionUsageType.SERVERLESS_APPS_USAGE = HourlyUsageAttributionUsageType("serverless_apps_usage")
 HourlyUsageAttributionUsageType.SERVERLESS_APPS_APM_USAGE = HourlyUsageAttributionUsageType("serverless_apps_apm_usage")
+HourlyUsageAttributionUsageType.SIEM_12MO_RETENTION_USAGE = HourlyUsageAttributionUsageType("siem_12mo_retention_usage")
+HourlyUsageAttributionUsageType.SIEM_6MO_RETENTION_USAGE = HourlyUsageAttributionUsageType("siem_6mo_retention_usage")
 HourlyUsageAttributionUsageType.SIEM_ANALYZED_LOGS_ADD_ON_USAGE = HourlyUsageAttributionUsageType(
     "siem_analyzed_logs_add_on_usage"
 )

src/datadog_api_client/v1/model/monitor_thresholds.py

@@ -19,9 +19,7 @@ class MonitorThresholds(ModelNormal):
     def openapi_types(_):
         return {
             "critical": (float,),
-            "critical_query": (str,),
             "critical_recovery": (float, none_type),
-            "critical_recovery_query": (str,),
             "ok": (float, none_type),
             "unknown": (float, none_type),
             "warning": (float, none_type),
@@ -30,9 +28,7 @@ def openapi_types(_):
 
     attribute_map = {
         "critical": "critical",
-        "critical_query": "critical_query",
         "critical_recovery": "critical_recovery",
-        "critical_recovery_query": "critical_recovery_query",
         "ok": "ok",
         "unknown": "unknown",
         "warning": "warning",
@@ -42,9 +38,7 @@ def openapi_types(_):
     def __init__(
         self_,
         critical: Union[float, UnsetType] = unset,
-        critical_query: Union[str, UnsetType] = unset,
         critical_recovery: Union[float, none_type, UnsetType] = unset,
-        critical_recovery_query: Union[str, UnsetType] = unset,
         ok: Union[float, none_type, UnsetType] = unset,
         unknown: Union[float, none_type, UnsetType] = unset,
         warning: Union[float, none_type, UnsetType] = unset,
@@ -57,15 +51,9 @@ def __init__(
         :param critical: The monitor ``CRITICAL`` threshold.
         :type critical: float, optional
 
-        :param critical_query: Query evaluated as a dynamic ``CRITICAL`` threshold. Only supported on metric monitors with a formula query and options['variables']. Cannot be combined with static thresholds. This field is in preview.
-        :type critical_query: str, optional
-
         :param critical_recovery: The monitor ``CRITICAL`` recovery threshold.
         :type critical_recovery: float, none_type, optional
 
-        :param critical_recovery_query: Query evaluated as a dynamic ``CRITICAL`` recovery threshold. Only supported on metric monitors with a formula query and options['variables']. Cannot be combined with static thresholds. This field is in preview.
-        :type critical_recovery_query: str, optional
-
         :param ok: The monitor ``OK`` threshold.
         :type ok: float, none_type, optional
 
@@ -80,12 +68,8 @@ def __init__(
         """
         if critical is not unset:
             kwargs["critical"] = critical
-        if critical_query is not unset:
-            kwargs["critical_query"] = critical_query
         if critical_recovery is not unset:
             kwargs["critical_recovery"] = critical_recovery
-        if critical_recovery_query is not unset:
-            kwargs["critical_recovery_query"] = critical_recovery_query
         if ok is not unset:
             kwargs["ok"] = ok
         if unknown is not unset: