[SEC-14142]evaluationWindow and keepAlive doc (#2617)

Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
Co-authored-by: api-clients-generation-pipeline[bot] <54105614+api-clients-generation-pipeline[bot]@users.noreply.github.com>

Author: api-clients-generation-pipeline[bot]

.apigentools-info

@@ -4,13 +4,13 @@
     "spec_versions": {
         "v1": {
             "apigentools_version": "1.6.6",
-            "regenerated": "2024-08-08 20:00:57.407569",
-            "spec_repo_commit": "643e3eaf"
+            "regenerated": "2024-08-09 12:06:43.748610",
+            "spec_repo_commit": "a21ba287"
         },
         "v2": {
             "apigentools_version": "1.6.6",
-            "regenerated": "2024-08-08 20:00:57.430814",
-            "spec_repo_commit": "643e3eaf"
+            "regenerated": "2024-08-09 12:06:43.767554",
+            "spec_repo_commit": "a21ba287"
         }
     }
 }

.generator/schemas/v2/openapi.yaml

@@ -18054,8 +18054,7 @@ components:
       description: 'A time window is specified to match when at least one of the cases
         matches true. This is a sliding window
 
-        and evaluates in real time. For third party rules, it should equal max signal
-        duration.'
+        and evaluates in real time. For third party rules, this field is not used.'
       enum:
       - 0
       - 60
@@ -18100,7 +18099,7 @@ components:
     SecurityMonitoringRuleKeepAlive:
       description: "Once a signal is generated, the signal will remain \u201Copen\u201D
         if a case is matched at least once within\nthis keep alive window. For third
-        party rules, it should equal max signal duration."
+        party rules, this field is not used."
       enum:
       - 0
       - 60

api/datadogV2/model_security_monitoring_rule_evaluation_window.go

@@ -11,7 +11,7 @@ import (
 )
 
 // SecurityMonitoringRuleEvaluationWindow A time window is specified to match when at least one of the cases matches true. This is a sliding window
-// and evaluates in real time. For third party rules, it should equal max signal duration.
+// and evaluates in real time. For third party rules, this field is not used.
 type SecurityMonitoringRuleEvaluationWindow int32
 
 // List of SecurityMonitoringRuleEvaluationWindow.

api/datadogV2/model_security_monitoring_rule_keep_alive.go

@@ -11,7 +11,7 @@ import (
 )
 
 // SecurityMonitoringRuleKeepAlive Once a signal is generated, the signal will remain “open” if a case is matched at least once within
-// this keep alive window. For third party rules, it should equal max signal duration.
+// this keep alive window. For third party rules, this field is not used.
 type SecurityMonitoringRuleKeepAlive int32
 
 // List of SecurityMonitoringRuleKeepAlive.

api/datadogV2/model_security_monitoring_rule_options.go

@@ -21,14 +21,14 @@ type SecurityMonitoringRuleOptions struct {
 	// The detection method.
 	DetectionMethod *SecurityMonitoringRuleDetectionMethod `json:"detectionMethod,omitempty"`
 	// A time window is specified to match when at least one of the cases matches true. This is a sliding window
-	// and evaluates in real time. For third party rules, it should equal max signal duration.
+	// and evaluates in real time. For third party rules, this field is not used.
 	EvaluationWindow *SecurityMonitoringRuleEvaluationWindow `json:"evaluationWindow,omitempty"`
 	// Hardcoded evaluator type.
 	HardcodedEvaluatorType *SecurityMonitoringRuleHardcodedEvaluatorType `json:"hardcodedEvaluatorType,omitempty"`
 	// Options on impossible travel rules.
 	ImpossibleTravelOptions *SecurityMonitoringRuleImpossibleTravelOptions `json:"impossibleTravelOptions,omitempty"`
 	// Once a signal is generated, the signal will remain “open” if a case is matched at least once within
-	// this keep alive window. For third party rules, it should equal max signal duration.
+	// this keep alive window. For third party rules, this field is not used.
 	KeepAlive *SecurityMonitoringRuleKeepAlive `json:"keepAlive,omitempty"`
 	// A signal will “close” regardless of the query being matched once the time exceeds the maximum duration.
 	// This time is calculated from the first seen timestamp.