[SEC-2514]add documentation to keepAlive and evaluationWindow (#2073)

Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com>
Co-authored-by: api-clients-generation-pipeline[bot] <54105614+api-clients-generation-pipeline[bot]@users.noreply.github.com> d0d384d

datadog_api_client.v2.model.html

@@ -32108,7 +32108,7 @@ <h2 id="submodules">Submodules<a class="headerlink" href="#submodules" title="Li
 <em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">SecurityMonitoringRuleEvaluationWindow</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="o"><span class="pre">*</span></span><span class="n"><span class="pre">args</span></span></em>, <em class="sig-param"><span class="o"><span class="pre">**</span></span><span class="n"><span class="pre">kwargs</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#datadog_api_client.v2.model.security_monitoring_rule_evaluation_window.SecurityMonitoringRuleEvaluationWindow" title="Link to this definition">¶</a></dt>
 <dd><p>Bases: <a class="reference internal" href="datadog_api_client.html#datadog_api_client.model_utils.ModelSimple" title="datadog_api_client.model_utils.ModelSimple"><code class="xref py py-class docutils literal notranslate"><span class="pre">ModelSimple</span></code></a></p>
 <dl class="simple">
-<dt>A time window is specified to match when at least one of the cases matches true. This is a sliding window</dt><dd><p>and evaluates in real time.</p>
+<dt>A time window is specified to match when at least one of the cases matches true. This is a sliding window</dt><dd><p>and evaluates in real time. For third party rules, it should equal max signal duration.</p>
 </dd>
 </dl>
 <dl class="field-list simple">
@@ -32180,7 +32180,7 @@ <h2 id="submodules">Submodules<a class="headerlink" href="#submodules" title="Li
 <em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">SecurityMonitoringRuleKeepAlive</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="o"><span class="pre">*</span></span><span class="n"><span class="pre">args</span></span></em>, <em class="sig-param"><span class="o"><span class="pre">**</span></span><span class="n"><span class="pre">kwargs</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#datadog_api_client.v2.model.security_monitoring_rule_keep_alive.SecurityMonitoringRuleKeepAlive" title="Link to this definition">¶</a></dt>
 <dd><p>Bases: <a class="reference internal" href="datadog_api_client.html#datadog_api_client.model_utils.ModelSimple" title="datadog_api_client.model_utils.ModelSimple"><code class="xref py py-class docutils literal notranslate"><span class="pre">ModelSimple</span></code></a></p>
 <dl class="simple">
-<dt>Once a signal is generated, the signal will remain “open” if a case is matched at least once within</dt><dd><p>this keep alive window.</p>
+<dt>Once a signal is generated, the signal will remain “open” if a case is matched at least once within</dt><dd><p>this keep alive window. For third party rules, it should equal max signal duration.</p>
 </dd>
 </dl>
 <dl class="field-list simple">
@@ -32381,11 +32381,11 @@ <h2 id="submodules">Submodules<a class="headerlink" href="#submodules" title="Li
 The decrement is applied when the environment tag of the signal starts with <code class="docutils literal notranslate"><span class="pre">staging</span></code> , <code class="docutils literal notranslate"><span class="pre">test</span></code> or <code class="docutils literal notranslate"><span class="pre">dev</span></code>.</p></li>
 <li><p><strong>detection_method</strong> (<a class="reference internal" href="#datadog_api_client.v2.model.security_monitoring_rule_detection_method.SecurityMonitoringRuleDetectionMethod" title="datadog_api_client.v2.model.security_monitoring_rule_detection_method.SecurityMonitoringRuleDetectionMethod"><em>SecurityMonitoringRuleDetectionMethod</em></a><em>, </em><em>optional</em>) – The detection method.</p></li>
 <li><p><strong>evaluation_window</strong> (<a class="reference internal" href="#datadog_api_client.v2.model.security_monitoring_rule_evaluation_window.SecurityMonitoringRuleEvaluationWindow" title="datadog_api_client.v2.model.security_monitoring_rule_evaluation_window.SecurityMonitoringRuleEvaluationWindow"><em>SecurityMonitoringRuleEvaluationWindow</em></a><em>, </em><em>optional</em>) – A time window is specified to match when at least one of the cases matches true. This is a sliding window
-and evaluates in real time.</p></li>
+and evaluates in real time. For third party rules, it should equal max signal duration.</p></li>
 <li><p><strong>hardcoded_evaluator_type</strong> (<a class="reference internal" href="#datadog_api_client.v2.model.security_monitoring_rule_hardcoded_evaluator_type.SecurityMonitoringRuleHardcodedEvaluatorType" title="datadog_api_client.v2.model.security_monitoring_rule_hardcoded_evaluator_type.SecurityMonitoringRuleHardcodedEvaluatorType"><em>SecurityMonitoringRuleHardcodedEvaluatorType</em></a><em>, </em><em>optional</em>) – Hardcoded evaluator type.</p></li>
 <li><p><strong>impossible_travel_options</strong> (<a class="reference internal" href="#datadog_api_client.v2.model.security_monitoring_rule_impossible_travel_options.SecurityMonitoringRuleImpossibleTravelOptions" title="datadog_api_client.v2.model.security_monitoring_rule_impossible_travel_options.SecurityMonitoringRuleImpossibleTravelOptions"><em>SecurityMonitoringRuleImpossibleTravelOptions</em></a><em>, </em><em>optional</em>) – Options on impossible travel rules.</p></li>
 <li><p><strong>keep_alive</strong> (<a class="reference internal" href="#datadog_api_client.v2.model.security_monitoring_rule_keep_alive.SecurityMonitoringRuleKeepAlive" title="datadog_api_client.v2.model.security_monitoring_rule_keep_alive.SecurityMonitoringRuleKeepAlive"><em>SecurityMonitoringRuleKeepAlive</em></a><em>, </em><em>optional</em>) – Once a signal is generated, the signal will remain “open” if a case is matched at least once within
-this keep alive window.</p></li>
+this keep alive window. For third party rules, it should equal max signal duration.</p></li>
 <li><p><strong>max_signal_duration</strong> (<a class="reference internal" href="#datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration.SecurityMonitoringRuleMaxSignalDuration" title="datadog_api_client.v2.model.security_monitoring_rule_max_signal_duration.SecurityMonitoringRuleMaxSignalDuration"><em>SecurityMonitoringRuleMaxSignalDuration</em></a><em>, </em><em>optional</em>) – A signal will “close” regardless of the query being matched once the time exceeds the maximum duration.
 This time is calculated from the first seen timestamp.</p></li>
 <li><p><strong>new_value_options</strong> (<a class="reference internal" href="#datadog_api_client.v2.model.security_monitoring_rule_new_value_options.SecurityMonitoringRuleNewValueOptions" title="datadog_api_client.v2.model.security_monitoring_rule_new_value_options.SecurityMonitoringRuleNewValueOptions"><em>SecurityMonitoringRuleNewValueOptions</em></a><em>, </em><em>optional</em>) – Options on new value rules.</p></li>