diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml
index 840ac4eef97..92bd2709b5f 100644
--- a/.generator/schemas/v2/openapi.yaml
+++ b/.generator/schemas/v2/openapi.yaml
@@ -53721,6 +53721,310 @@ components:
       required:
       - data
       type: object
+    SecurityMonitoringSignalInvestigationFeedbackMetric:
+      description: A feedback metric containing user response.
+      properties:
+        placeholder:
+          description: Placeholder text for the metric.
+          example: Enter your feedback here
+          type: string
+        prompt:
+          description: The question or prompt.
+          example: How helpful was this investigation?
+          type: string
+        response:
+          description: The user's response.
+          example: Very helpful
+          type: string
+        type:
+          description: The type of metric.
+          example: sentiment
+          type: string
+      required:
+      - type
+      - prompt
+      - response
+      type: object
+    SecurityMonitoringSignalInvestigationFeedbackRequest:
+      description: Request body for submitting investigation feedback.
+      properties:
+        data:
+          $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationFeedbackRequestData'
+      required:
+      - data
+      type: object
+    SecurityMonitoringSignalInvestigationFeedbackRequestAttributes:
+      description: Attributes for investigation feedback.
+      properties:
+        feedback:
+          description: The feedback text.
+          example: positive
+          type: string
+        feedback_content:
+          description: Structured feedback content.
+          items:
+            $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationFeedbackSection'
+          type: array
+        incomplete:
+          description: Whether the feedback is incomplete.
+          example: false
+          type: boolean
+        rating:
+          description: The rating value.
+          example: positive
+          type: string
+        signal_id:
+          description: The unique ID of the security signal.
+          example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
+          type: string
+        type:
+          description: The type of feedback.
+          example: metrics
+          type: string
+      required:
+      - signal_id
+      - feedback
+      type: object
+    SecurityMonitoringSignalInvestigationFeedbackRequestData:
+      description: Data for submitting investigation feedback.
+      properties:
+        attributes:
+          $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationFeedbackRequestAttributes'
+        type:
+          $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationFeedbackType'
+      required:
+      - type
+      - attributes
+      type: object
+    SecurityMonitoringSignalInvestigationFeedbackResponse:
+      description: Response containing investigation feedback.
+      properties:
+        data:
+          $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationFeedbackResponseData'
+      required:
+      - data
+      type: object
+    SecurityMonitoringSignalInvestigationFeedbackResponseAttributes:
+      description: Attributes of investigation feedback.
+      properties:
+        feedback:
+          description: The feedback text.
+          example: positive
+          type: string
+        feedback_content:
+          description: Structured feedback content.
+          items:
+            $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationFeedbackSection'
+          type: array
+        investigation_id:
+          description: The unique ID of the investigation.
+          example: 550e8400-e29b-41d4-a716-446655440001
+          type: string
+        rating:
+          description: The rating value.
+          example: positive
+          type: string
+        signal_id:
+          description: The unique ID of the security signal.
+          example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
+          type: string
+      required:
+      - feedback
+      - signal_id
+      - investigation_id
+      type: object
+    SecurityMonitoringSignalInvestigationFeedbackResponseData:
+      description: Data containing investigation feedback.
+      properties:
+        attributes:
+          $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationFeedbackResponseAttributes'
+        id:
+          description: The unique ID of the investigation.
+          example: 550e8400-e29b-41d4-a716-446655440001
+          type: string
+        type:
+          $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationFeedbackType'
+      required:
+      - id
+      - type
+      - attributes
+      type: object
+    SecurityMonitoringSignalInvestigationFeedbackSection:
+      description: A feedback section containing metrics.
+      properties:
+        id:
+          description: The section identifier.
+          example: section-1
+          type: string
+        metrics:
+          description: Array of feedback metrics.
+          items:
+            $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationFeedbackMetric'
+          type: array
+        title:
+          description: The section title.
+          example: Investigation Quality
+          type: string
+      required:
+      - id
+      - title
+      - metrics
+      type: object
+    SecurityMonitoringSignalInvestigationFeedbackType:
+      description: The type of feedback.
+      enum:
+      - investigation_feedback
+      example: investigation_feedback
+      type: string
+      x-enum-varnames:
+      - INVESTIGATION_FEEDBACK
+    SecurityMonitoringSignalInvestigationRequest:
+      description: Request body for creating a security signal investigation.
+      properties:
+        data:
+          $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationRequestData'
+      required:
+      - data
+      type: object
+    SecurityMonitoringSignalInvestigationRequestAttributes:
+      description: Attributes for creating a signal investigation.
+      properties:
+        deployment:
+          description: Optional deployment override for the investigation.
+          example: live
+          type: string
+        signal_id:
+          description: The unique ID of the security signal.
+          example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
+          type: string
+      required:
+      - signal_id
+      type: object
+    SecurityMonitoringSignalInvestigationRequestData:
+      description: Data for creating a signal investigation.
+      properties:
+        attributes:
+          $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationRequestAttributes'
+        type:
+          $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationType'
+      required:
+      - type
+      - attributes
+      type: object
+    SecurityMonitoringSignalInvestigationResponse:
+      description: Response containing investigation details for a security signal.
+      properties:
+        data:
+          $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationResponseData'
+      required:
+      - data
+      type: object
+    SecurityMonitoringSignalInvestigationResponseAttributes:
+      description: Attributes of a signal investigation response.
+      properties:
+        investigation_id:
+          description: The unique ID of the investigation.
+          example: 550e8400-e29b-41d4-a716-446655440001
+          type: string
+        rule_id:
+          description: The ID of the rule that triggered the signal.
+          example: def-000-an8
+          type: string
+        signal_id:
+          description: The unique ID of the security signal.
+          example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
+          type: string
+        state:
+          $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationState'
+        step:
+          $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationStep'
+      required:
+      - signal_id
+      - rule_id
+      - investigation_id
+      type: object
+    SecurityMonitoringSignalInvestigationResponseData:
+      description: Data containing the investigation details.
+      properties:
+        attributes:
+          $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationResponseAttributes'
+        id:
+          description: The unique ID of the investigation.
+          example: 550e8400-e29b-41d4-a716-446655440001
+          type: string
+        type:
+          $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationType'
+      required:
+      - id
+      - type
+      - attributes
+      type: object
+    SecurityMonitoringSignalInvestigationState:
+      description: The state of the investigation.
+      enum:
+      - investigating
+      - completed
+      example: completed
+      type: string
+      x-enum-varnames:
+      - INVESTIGATING
+      - COMPLETED
+    SecurityMonitoringSignalInvestigationStep:
+      description: Information about an investigation step.
+      properties:
+        stepOutputs:
+          description: Array of step outputs.
+          items:
+            $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationStepOutput'
+          type: array
+      required:
+      - stepOutputs
+      type: object
+    SecurityMonitoringSignalInvestigationStepOutput:
+      description: Output from an investigation step.
+      properties:
+        currentStepAnalysisOneliner:
+          description: A one-line summary of the step analysis.
+          example: This appears to be a potential security threat.
+          type: string
+        currentStepAnalysisSummary:
+          description: A detailed summary of the step analysis.
+          example: The analysis indicates unusual access patterns that warrant further
+            investigation.
+          type: string
+        name:
+          description: The name of the investigation step.
+          example: startStep
+          type: string
+        verdict:
+          $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationStepOutputVerdict'
+      required:
+      - name
+      - currentStepAnalysisSummary
+      - verdict
+      type: object
+    SecurityMonitoringSignalInvestigationStepOutputVerdict:
+      description: The verdict from the investigation step.
+      enum:
+      - unspecified
+      - benign
+      - suspicious
+      - inconclusive
+      example: benign
+      type: string
+      x-enum-varnames:
+      - UNSPECIFIED
+      - BENIGN
+      - SUSPICIOUS
+      - INCONCLUSIVE
+    SecurityMonitoringSignalInvestigationType:
+      description: The type of investigation signal.
+      enum:
+      - investigation_signal
+      example: investigation_signal
+      type: string
+      x-enum-varnames:
+      - INVESTIGATION_SIGNAL
     SecurityMonitoringSignalListRequest:
       description: The request for a security signal list.
       properties:
@@ -93882,6 +94186,157 @@ paths:
         operator: OR
         permissions:
         - security_monitoring_signals_read
+  /api/v2/security_monitoring/signals/investigation:
+    post:
+      description: Create an investigation for a security signal using AI-powered
+        analysis.
+      operationId: CreateSignalInvestigation
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationRequest'
+        required: true
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationResponse'
+          description: OK
+        '400':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/JSONAPIErrorResponse'
+          description: Bad Request
+        '403':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/JSONAPIErrorResponse'
+          description: Forbidden
+        '404':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/JSONAPIErrorResponse'
+          description: Not Found
+        '429':
+          $ref: '#/components/responses/TooManyRequestsResponse'
+      security:
+      - apiKeyAuth: []
+        appKeyAuth: []
+      - AuthZ:
+        - security_monitoring_signals_read
+      summary: Create a security signal investigation
+      tags:
+      - Security Monitoring
+      x-codegen-request-body-name: body
+      x-permission:
+        operator: OR
+        permissions:
+        - security_monitoring_signals_read
+      x-unstable: '**Note**: This endpoint is in preview and is subject to change.
+
+        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
+  /api/v2/security_monitoring/signals/investigation/feedback:
+    put:
+      description: Provide feedback on a security signal investigation.
+      operationId: UpdateInvestigationFeedback
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationFeedbackRequest'
+        required: true
+      responses:
+        '200':
+          description: OK
+        '400':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/JSONAPIErrorResponse'
+          description: Bad Request
+        '403':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/JSONAPIErrorResponse'
+          description: Forbidden
+        '404':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/JSONAPIErrorResponse'
+          description: Not Found
+        '429':
+          $ref: '#/components/responses/TooManyRequestsResponse'
+      security:
+      - apiKeyAuth: []
+        appKeyAuth: []
+      - AuthZ:
+        - security_monitoring_signals_read
+      summary: Update investigation feedback
+      tags:
+      - Security Monitoring
+      x-codegen-request-body-name: body
+      x-permission:
+        operator: OR
+        permissions:
+        - security_monitoring_signals_read
+      x-unstable: '**Note**: This endpoint is in preview and is subject to change.
+
+        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
+  /api/v2/security_monitoring/signals/investigation/feedback/{signal_id}:
+    get:
+      description: Retrieve feedback for a security signal investigation.
+      operationId: GetInvestigationFeedback
+      parameters:
+      - $ref: '#/components/parameters/SignalID'
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SecurityMonitoringSignalInvestigationFeedbackResponse'
+          description: OK
+        '400':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/JSONAPIErrorResponse'
+          description: Bad Request
+        '403':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/JSONAPIErrorResponse'
+          description: Forbidden
+        '404':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/JSONAPIErrorResponse'
+          description: Not Found
+        '429':
+          $ref: '#/components/responses/TooManyRequestsResponse'
+      security:
+      - apiKeyAuth: []
+        appKeyAuth: []
+      - AuthZ:
+        - security_monitoring_signals_read
+      summary: Get investigation feedback
+      tags:
+      - Security Monitoring
+      x-permission:
+        operator: OR
+        permissions:
+        - security_monitoring_signals_read
+      x-unstable: '**Note**: This endpoint is in preview and is subject to change.
+
+        If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
   /api/v2/security_monitoring/signals/search:
     post:
       description: 'Returns security signals that match a search query.
diff --git a/examples/v2/security-monitoring/CreateSignalInvestigation.rb b/examples/v2/security-monitoring/CreateSignalInvestigation.rb
new file mode 100644
index 00000000000..bc0c6808117
--- /dev/null
+++ b/examples/v2/security-monitoring/CreateSignalInvestigation.rb
@@ -0,0 +1,18 @@
+# Create a security signal investigation returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.create_signal_investigation".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+body = DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationRequest.new({
+  data: DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationRequestData.new({
+    attributes: DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationRequestAttributes.new({
+      deployment: "live",
+      signal_id: "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA",
+    }),
+    type: DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationType::INVESTIGATION_SIGNAL,
+  }),
+})
+p api_instance.create_signal_investigation(body)
diff --git a/examples/v2/security-monitoring/GetInvestigationFeedback.rb b/examples/v2/security-monitoring/GetInvestigationFeedback.rb
new file mode 100644
index 00000000000..91426ee195f
--- /dev/null
+++ b/examples/v2/security-monitoring/GetInvestigationFeedback.rb
@@ -0,0 +1,8 @@
+# Get investigation feedback returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.get_investigation_feedback".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+p api_instance.get_investigation_feedback("signal_id")
diff --git a/examples/v2/security-monitoring/UpdateInvestigationFeedback.rb b/examples/v2/security-monitoring/UpdateInvestigationFeedback.rb
new file mode 100644
index 00000000000..d0b9869a18b
--- /dev/null
+++ b/examples/v2/security-monitoring/UpdateInvestigationFeedback.rb
@@ -0,0 +1,35 @@
+# Update investigation feedback returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.unstable_operations["v2.update_investigation_feedback".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
+
+body = DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationFeedbackRequest.new({
+  data: DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationFeedbackRequestData.new({
+    attributes: DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationFeedbackRequestAttributes.new({
+      feedback: "positive",
+      feedback_content: [
+        DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationFeedbackSection.new({
+          id: "section-1",
+          metrics: [
+            DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationFeedbackMetric.new({
+              placeholder: "Enter your feedback here",
+              prompt: "How helpful was this investigation?",
+              response: "Very helpful",
+              type: "sentiment",
+            }),
+          ],
+          title: "Investigation Quality",
+        }),
+      ],
+      incomplete: false,
+      rating: "positive",
+      signal_id: "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA",
+      type: "metrics",
+    }),
+    type: DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationFeedbackType::INVESTIGATION_FEEDBACK,
+  }),
+})
+p api_instance.update_investigation_feedback(body)
diff --git a/features/scenarios_model_mapping.rb b/features/scenarios_model_mapping.rb
index 754dcc7c06b..86464656e64 100644
--- a/features/scenarios_model_mapping.rb
+++ b/features/scenarios_model_mapping.rb
@@ -1660,6 +1660,15 @@
             "page_cursor" => "String",
             "page_limit" => "Integer",
     },
+    "v2.CreateSignalInvestigation" => {
+            "body" => "SecurityMonitoringSignalInvestigationRequest",
+    },
+    "v2.UpdateInvestigationFeedback" => {
+            "body" => "SecurityMonitoringSignalInvestigationFeedbackRequest",
+    },
+    "v2.GetInvestigationFeedback" => {
+            "signal_id" => "String",
+    },
     "v2.SearchSecurityMonitoringSignals" => {
             "body" => "SecurityMonitoringSignalListRequest",
     },
diff --git a/features/v2/security_monitoring.feature b/features/v2/security_monitoring.feature
index ccc027734e2..f5c5e55c0e5 100644
--- a/features/v2/security_monitoring.feature
+++ b/features/v2/security_monitoring.feature
@@ -578,6 +578,30 @@ Feature: Security Monitoring
     And the response "data.attributes.exclusion_filters[0].name" is equal to "Exclude staging"
     And the response "data.attributes.exclusion_filters[0].query" is equal to "source:staging"
 
+  @generated @skip @team:DataDog/k9-cloud-security-platform
+  Scenario: Create a security signal investigation returns "Bad Request" response
+    Given operation "CreateSignalInvestigation" enabled
+    And new "CreateSignalInvestigation" request
+    And body with value {"data": {"attributes": {"deployment": "live", "signal_id": "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA"}, "type": "investigation_signal"}}
+    When the request is sent
+    Then the response status is 400 Bad Request
+
+  @generated @skip @team:DataDog/k9-cloud-security-platform
+  Scenario: Create a security signal investigation returns "Not Found" response
+    Given operation "CreateSignalInvestigation" enabled
+    And new "CreateSignalInvestigation" request
+    And body with value {"data": {"attributes": {"deployment": "live", "signal_id": "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA"}, "type": "investigation_signal"}}
+    When the request is sent
+    Then the response status is 404 Not Found
+
+  @generated @skip @team:DataDog/k9-cloud-security-platform
+  Scenario: Create a security signal investigation returns "OK" response
+    Given operation "CreateSignalInvestigation" enabled
+    And new "CreateSignalInvestigation" request
+    And body with value {"data": {"attributes": {"deployment": "live", "signal_id": "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA"}, "type": "investigation_signal"}}
+    When the request is sent
+    Then the response status is 200 OK
+
   @generated @skip @team:DataDog/k9-cloud-security-platform
   Scenario: Create a suppression rule returns "Bad Request" response
     Given new "CreateSecurityMonitoringSuppression" request
@@ -1284,6 +1308,30 @@ Feature: Security Monitoring
     When the request is sent
     Then the response status is 200 Notification rule details.
 
+  @generated @skip @team:DataDog/k9-cloud-security-platform
+  Scenario: Get investigation feedback returns "Bad Request" response
+    Given operation "GetInvestigationFeedback" enabled
+    And new "GetInvestigationFeedback" request
+    And request contains "signal_id" parameter from "REPLACE.ME"
+    When the request is sent
+    Then the response status is 400 Bad Request
+
+  @generated @skip @team:DataDog/k9-cloud-security-platform
+  Scenario: Get investigation feedback returns "Not Found" response
+    Given operation "GetInvestigationFeedback" enabled
+    And new "GetInvestigationFeedback" request
+    And request contains "signal_id" parameter from "REPLACE.ME"
+    When the request is sent
+    Then the response status is 404 Not Found
+
+  @generated @skip @team:DataDog/k9-cloud-security-platform
+  Scenario: Get investigation feedback returns "OK" response
+    Given operation "GetInvestigationFeedback" enabled
+    And new "GetInvestigationFeedback" request
+    And request contains "signal_id" parameter from "REPLACE.ME"
+    When the request is sent
+    Then the response status is 200 OK
+
   @skip-go @skip-java @skip-ruby @team:DataDog/k9-cloud-security-platform
   Scenario: Get rule version history returns "OK" response
     Given operation "GetRuleVersionHistory" enabled
@@ -2007,6 +2055,30 @@ Feature: Security Monitoring
     And the response "name" is equal to "{{ unique }}-Updated"
     And the response "id" has the same value as "security_rule.id"
 
+  @generated @skip @team:DataDog/k9-cloud-security-platform
+  Scenario: Update investigation feedback returns "Bad Request" response
+    Given operation "UpdateInvestigationFeedback" enabled
+    And new "UpdateInvestigationFeedback" request
+    And body with value {"data": {"attributes": {"feedback": "positive", "feedback_content": [{"id": "section-1", "metrics": [{"placeholder": "Enter your feedback here", "prompt": "How helpful was this investigation?", "response": "Very helpful", "type": "sentiment"}], "title": "Investigation Quality"}], "incomplete": false, "rating": "positive", "signal_id": "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA", "type": "metrics"}, "type": "investigation_feedback"}}
+    When the request is sent
+    Then the response status is 400 Bad Request
+
+  @generated @skip @team:DataDog/k9-cloud-security-platform
+  Scenario: Update investigation feedback returns "Not Found" response
+    Given operation "UpdateInvestigationFeedback" enabled
+    And new "UpdateInvestigationFeedback" request
+    And body with value {"data": {"attributes": {"feedback": "positive", "feedback_content": [{"id": "section-1", "metrics": [{"placeholder": "Enter your feedback here", "prompt": "How helpful was this investigation?", "response": "Very helpful", "type": "sentiment"}], "title": "Investigation Quality"}], "incomplete": false, "rating": "positive", "signal_id": "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA", "type": "metrics"}, "type": "investigation_feedback"}}
+    When the request is sent
+    Then the response status is 404 Not Found
+
+  @generated @skip @team:DataDog/k9-cloud-security-platform
+  Scenario: Update investigation feedback returns "OK" response
+    Given operation "UpdateInvestigationFeedback" enabled
+    And new "UpdateInvestigationFeedback" request
+    And body with value {"data": {"attributes": {"feedback": "positive", "feedback_content": [{"id": "section-1", "metrics": [{"placeholder": "Enter your feedback here", "prompt": "How helpful was this investigation?", "response": "Very helpful", "type": "sentiment"}], "title": "Investigation Quality"}], "incomplete": false, "rating": "positive", "signal_id": "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA", "type": "metrics"}, "type": "investigation_feedback"}}
+    When the request is sent
+    Then the response status is 200 OK
+
   @team:DataDog/k9-cloud-security-platform
   Scenario: Update resource filters returns "Bad Request" response
     Given new "UpdateResourceEvaluationFilters" request
diff --git a/features/v2/undo.json b/features/v2/undo.json
index 41fa31182a8..4fbc7c857d7 100644
--- a/features/v2/undo.json
+++ b/features/v2/undo.json
@@ -4579,6 +4579,24 @@
       "type": "safe"
     }
   },
+  "CreateSignalInvestigation": {
+    "tag": "Security Monitoring",
+    "undo": {
+      "type": "safe"
+    }
+  },
+  "UpdateInvestigationFeedback": {
+    "tag": "Security Monitoring",
+    "undo": {
+      "type": "idempotent"
+    }
+  },
+  "GetInvestigationFeedback": {
+    "tag": "Security Monitoring",
+    "undo": {
+      "type": "safe"
+    }
+  },
   "SearchSecurityMonitoringSignals": {
     "tag": "Security Monitoring",
     "undo": {
diff --git a/lib/datadog_api_client/configuration.rb b/lib/datadog_api_client/configuration.rb
index f2cdbcd8b56..4f2823b5683 100644
--- a/lib/datadog_api_client/configuration.rb
+++ b/lib/datadog_api_client/configuration.rb
@@ -210,8 +210,10 @@ def initialize
             "v2.update_open_api": false,
             "v2.cancel_threat_hunting_job": false,
             "v2.convert_job_result_to_signal": false,
+            "v2.create_signal_investigation": false,
             "v2.delete_threat_hunting_job": false,
             "v2.get_finding": false,
+            "v2.get_investigation_feedback": false,
             "v2.get_rule_version_history": false,
             "v2.get_secrets_rules": false,
             "v2.get_security_monitoring_histsignal": false,
@@ -227,6 +229,7 @@ def initialize
             "v2.mute_findings": false,
             "v2.run_threat_hunting_job": false,
             "v2.search_security_monitoring_histsignals": false,
+            "v2.update_investigation_feedback": false,
             "v2.create_dataset": false,
             "v2.delete_dataset": false,
             "v2.get_all_datasets": false,
diff --git a/lib/datadog_api_client/inflector.rb b/lib/datadog_api_client/inflector.rb
index 1c12eeb3b6e..652c4983d37 100644
--- a/lib/datadog_api_client/inflector.rb
+++ b/lib/datadog_api_client/inflector.rb
@@ -4341,6 +4341,26 @@ def overrides
           "v2.security_monitoring_signal_incidents_update_attributes" => "SecurityMonitoringSignalIncidentsUpdateAttributes",
           "v2.security_monitoring_signal_incidents_update_data" => "SecurityMonitoringSignalIncidentsUpdateData",
           "v2.security_monitoring_signal_incidents_update_request" => "SecurityMonitoringSignalIncidentsUpdateRequest",
+          "v2.security_monitoring_signal_investigation_feedback_metric" => "SecurityMonitoringSignalInvestigationFeedbackMetric",
+          "v2.security_monitoring_signal_investigation_feedback_request" => "SecurityMonitoringSignalInvestigationFeedbackRequest",
+          "v2.security_monitoring_signal_investigation_feedback_request_attributes" => "SecurityMonitoringSignalInvestigationFeedbackRequestAttributes",
+          "v2.security_monitoring_signal_investigation_feedback_request_data" => "SecurityMonitoringSignalInvestigationFeedbackRequestData",
+          "v2.security_monitoring_signal_investigation_feedback_response" => "SecurityMonitoringSignalInvestigationFeedbackResponse",
+          "v2.security_monitoring_signal_investigation_feedback_response_attributes" => "SecurityMonitoringSignalInvestigationFeedbackResponseAttributes",
+          "v2.security_monitoring_signal_investigation_feedback_response_data" => "SecurityMonitoringSignalInvestigationFeedbackResponseData",
+          "v2.security_monitoring_signal_investigation_feedback_section" => "SecurityMonitoringSignalInvestigationFeedbackSection",
+          "v2.security_monitoring_signal_investigation_feedback_type" => "SecurityMonitoringSignalInvestigationFeedbackType",
+          "v2.security_monitoring_signal_investigation_request" => "SecurityMonitoringSignalInvestigationRequest",
+          "v2.security_monitoring_signal_investigation_request_attributes" => "SecurityMonitoringSignalInvestigationRequestAttributes",
+          "v2.security_monitoring_signal_investigation_request_data" => "SecurityMonitoringSignalInvestigationRequestData",
+          "v2.security_monitoring_signal_investigation_response" => "SecurityMonitoringSignalInvestigationResponse",
+          "v2.security_monitoring_signal_investigation_response_attributes" => "SecurityMonitoringSignalInvestigationResponseAttributes",
+          "v2.security_monitoring_signal_investigation_response_data" => "SecurityMonitoringSignalInvestigationResponseData",
+          "v2.security_monitoring_signal_investigation_state" => "SecurityMonitoringSignalInvestigationState",
+          "v2.security_monitoring_signal_investigation_step" => "SecurityMonitoringSignalInvestigationStep",
+          "v2.security_monitoring_signal_investigation_step_output" => "SecurityMonitoringSignalInvestigationStepOutput",
+          "v2.security_monitoring_signal_investigation_step_output_verdict" => "SecurityMonitoringSignalInvestigationStepOutputVerdict",
+          "v2.security_monitoring_signal_investigation_type" => "SecurityMonitoringSignalInvestigationType",
           "v2.security_monitoring_signal_list_request" => "SecurityMonitoringSignalListRequest",
           "v2.security_monitoring_signal_list_request_filter" => "SecurityMonitoringSignalListRequestFilter",
           "v2.security_monitoring_signal_list_request_page" => "SecurityMonitoringSignalListRequestPage",
diff --git a/lib/datadog_api_client/v2/api/security_monitoring_api.rb b/lib/datadog_api_client/v2/api/security_monitoring_api.rb
index 442daffdb1e..2b33465720a 100644
--- a/lib/datadog_api_client/v2/api/security_monitoring_api.rb
+++ b/lib/datadog_api_client/v2/api/security_monitoring_api.rb
@@ -995,6 +995,79 @@ def create_security_monitoring_suppression_with_http_info(body, opts = {})
       return data, status_code, headers
     end
 
+    # Create a security signal investigation.
+    #
+    # @see #create_signal_investigation_with_http_info
+    def create_signal_investigation(body, opts = {})
+      data, _status_code, _headers = create_signal_investigation_with_http_info(body, opts)
+      data
+    end
+
+    # Create a security signal investigation.
+    #
+    # Create an investigation for a security signal using AI-powered analysis.
+    #
+    # @param body [SecurityMonitoringSignalInvestigationRequest] 
+    # @param opts [Hash] the optional parameters
+    # @return [Array<(SecurityMonitoringSignalInvestigationResponse, Integer, Hash)>] SecurityMonitoringSignalInvestigationResponse data, response status code and response headers
+    def create_signal_investigation_with_http_info(body, opts = {})
+      unstable_enabled = @api_client.config.unstable_operations["v2.create_signal_investigation".to_sym]
+      if unstable_enabled
+        @api_client.config.logger.warn format("Using unstable operation '%s'", "v2.create_signal_investigation")
+      else
+        raise DatadogAPIClient::APIError.new(message: format("Unstable operation '%s' is disabled", "v2.create_signal_investigation"))
+      end
+
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: SecurityMonitoringAPI.create_signal_investigation ...'
+      end
+      # verify the required parameter 'body' is set
+      if @api_client.config.client_side_validation && body.nil?
+        fail ArgumentError, "Missing the required parameter 'body' when calling SecurityMonitoringAPI.create_signal_investigation"
+      end
+      # resource path
+      local_var_path = '/api/v2/security_monitoring/signals/investigation'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+      # HTTP header 'Content-Type'
+      header_params['Content-Type'] = @api_client.select_header_content_type(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(body)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'SecurityMonitoringSignalInvestigationResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || [:apiKeyAuth, :appKeyAuth, :AuthZ]
+
+      new_options = opts.merge(
+        :operation => :create_signal_investigation,
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type,
+        :api_version => "V2"
+      )
+
+      data, status_code, headers = @api_client.call_api(Net::HTTP::Post, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: SecurityMonitoringAPI#create_signal_investigation\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Create a new signal-based notification rule.
     #
     # @see #create_signal_notification_rule_with_http_info
@@ -2155,6 +2228,77 @@ def get_finding_with_http_info(finding_id, opts = {})
       return data, status_code, headers
     end
 
+    # Get investigation feedback.
+    #
+    # @see #get_investigation_feedback_with_http_info
+    def get_investigation_feedback(signal_id, opts = {})
+      data, _status_code, _headers = get_investigation_feedback_with_http_info(signal_id, opts)
+      data
+    end
+
+    # Get investigation feedback.
+    #
+    # Retrieve feedback for a security signal investigation.
+    #
+    # @param signal_id [String] The ID of the signal.
+    # @param opts [Hash] the optional parameters
+    # @return [Array<(SecurityMonitoringSignalInvestigationFeedbackResponse, Integer, Hash)>] SecurityMonitoringSignalInvestigationFeedbackResponse data, response status code and response headers
+    def get_investigation_feedback_with_http_info(signal_id, opts = {})
+      unstable_enabled = @api_client.config.unstable_operations["v2.get_investigation_feedback".to_sym]
+      if unstable_enabled
+        @api_client.config.logger.warn format("Using unstable operation '%s'", "v2.get_investigation_feedback")
+      else
+        raise DatadogAPIClient::APIError.new(message: format("Unstable operation '%s' is disabled", "v2.get_investigation_feedback"))
+      end
+
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: SecurityMonitoringAPI.get_investigation_feedback ...'
+      end
+      # verify the required parameter 'signal_id' is set
+      if @api_client.config.client_side_validation && signal_id.nil?
+        fail ArgumentError, "Missing the required parameter 'signal_id' when calling SecurityMonitoringAPI.get_investigation_feedback"
+      end
+      # resource path
+      local_var_path = '/api/v2/security_monitoring/signals/investigation/feedback/{signal_id}'.sub('{signal_id}', CGI.escape(signal_id.to_s).gsub('%2F', '/'))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'SecurityMonitoringSignalInvestigationFeedbackResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || [:apiKeyAuth, :appKeyAuth, :AuthZ]
+
+      new_options = opts.merge(
+        :operation => :get_investigation_feedback,
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type,
+        :api_version => "V2"
+      )
+
+      data, status_code, headers = @api_client.call_api(Net::HTTP::Get, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: SecurityMonitoringAPI#get_investigation_feedback\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # List resource filters.
     #
     # @see #get_resource_evaluation_filters_with_http_info
@@ -5728,6 +5872,79 @@ def update_custom_framework_with_http_info(handle, version, body, opts = {})
       return data, status_code, headers
     end
 
+    # Update investigation feedback.
+    #
+    # @see #update_investigation_feedback_with_http_info
+    def update_investigation_feedback(body, opts = {})
+      update_investigation_feedback_with_http_info(body, opts)
+      nil
+    end
+
+    # Update investigation feedback.
+    #
+    # Provide feedback on a security signal investigation.
+    #
+    # @param body [SecurityMonitoringSignalInvestigationFeedbackRequest] 
+    # @param opts [Hash] the optional parameters
+    # @return [Array<(nil, Integer, Hash)>] nil, response status code and response headers
+    def update_investigation_feedback_with_http_info(body, opts = {})
+      unstable_enabled = @api_client.config.unstable_operations["v2.update_investigation_feedback".to_sym]
+      if unstable_enabled
+        @api_client.config.logger.warn format("Using unstable operation '%s'", "v2.update_investigation_feedback")
+      else
+        raise DatadogAPIClient::APIError.new(message: format("Unstable operation '%s' is disabled", "v2.update_investigation_feedback"))
+      end
+
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: SecurityMonitoringAPI.update_investigation_feedback ...'
+      end
+      # verify the required parameter 'body' is set
+      if @api_client.config.client_side_validation && body.nil?
+        fail ArgumentError, "Missing the required parameter 'body' when calling SecurityMonitoringAPI.update_investigation_feedback"
+      end
+      # resource path
+      local_var_path = '/api/v2/security_monitoring/signals/investigation/feedback'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['*/*'])
+      # HTTP header 'Content-Type'
+      header_params['Content-Type'] = @api_client.select_header_content_type(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(body)
+
+      # return_type
+      return_type = opts[:debug_return_type]
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || [:apiKeyAuth, :appKeyAuth, :AuthZ]
+
+      new_options = opts.merge(
+        :operation => :update_investigation_feedback,
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type,
+        :api_version => "V2"
+      )
+
+      data, status_code, headers = @api_client.call_api(Net::HTTP::Put, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: SecurityMonitoringAPI#update_investigation_feedback\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Update resource filters.
     #
     # @see #update_resource_evaluation_filters_with_http_info
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_metric.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_metric.rb
new file mode 100644
index 00000000000..ce76e8fe14f
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_metric.rb
@@ -0,0 +1,175 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # A feedback metric containing user response.
+  class SecurityMonitoringSignalInvestigationFeedbackMetric
+    include BaseGenericModel
+
+    # Placeholder text for the metric.
+    attr_accessor :placeholder
+
+    # The question or prompt.
+    attr_reader :prompt
+
+    # The user's response.
+    attr_reader :response
+
+    # The type of metric.
+    attr_reader :type
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'placeholder' => :'placeholder',
+        :'prompt' => :'prompt',
+        :'response' => :'response',
+        :'type' => :'type'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'placeholder' => :'String',
+        :'prompt' => :'String',
+        :'response' => :'String',
+        :'type' => :'String'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationFeedbackMetric` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'placeholder')
+        self.placeholder = attributes[:'placeholder']
+      end
+
+      if attributes.key?(:'prompt')
+        self.prompt = attributes[:'prompt']
+      end
+
+      if attributes.key?(:'response')
+        self.response = attributes[:'response']
+      end
+
+      if attributes.key?(:'type')
+        self.type = attributes[:'type']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @prompt.nil?
+      return false if @response.nil?
+      return false if @type.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param prompt [Object] Object to be assigned
+    # @!visibility private
+    def prompt=(prompt)
+      if prompt.nil?
+        fail ArgumentError, 'invalid value for "prompt", prompt cannot be nil.'
+      end
+      @prompt = prompt
+    end
+
+    # Custom attribute writer method with validation
+    # @param response [Object] Object to be assigned
+    # @!visibility private
+    def response=(response)
+      if response.nil?
+        fail ArgumentError, 'invalid value for "response", response cannot be nil.'
+      end
+      @response = response
+    end
+
+    # Custom attribute writer method with validation
+    # @param type [Object] Object to be assigned
+    # @!visibility private
+    def type=(type)
+      if type.nil?
+        fail ArgumentError, 'invalid value for "type", type cannot be nil.'
+      end
+      @type = type
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          placeholder == o.placeholder &&
+          prompt == o.prompt &&
+          response == o.response &&
+          type == o.type &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [placeholder, prompt, response, type, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_request.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_request.rb
new file mode 100644
index 00000000000..19839ef356a
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_request.rb
@@ -0,0 +1,123 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Request body for submitting investigation feedback.
+  class SecurityMonitoringSignalInvestigationFeedbackRequest
+    include BaseGenericModel
+
+    # Data for submitting investigation feedback.
+    attr_reader :data
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'data' => :'data'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'data' => :'SecurityMonitoringSignalInvestigationFeedbackRequestData'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationFeedbackRequest` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'data')
+        self.data = attributes[:'data']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @data.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param data [Object] Object to be assigned
+    # @!visibility private
+    def data=(data)
+      if data.nil?
+        fail ArgumentError, 'invalid value for "data", data cannot be nil.'
+      end
+      @data = data
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          data == o.data &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [data, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_request_attributes.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_request_attributes.rb
new file mode 100644
index 00000000000..b6046437ad8
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_request_attributes.rb
@@ -0,0 +1,186 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Attributes for investigation feedback.
+  class SecurityMonitoringSignalInvestigationFeedbackRequestAttributes
+    include BaseGenericModel
+
+    # The feedback text.
+    attr_reader :feedback
+
+    # Structured feedback content.
+    attr_accessor :feedback_content
+
+    # Whether the feedback is incomplete.
+    attr_accessor :incomplete
+
+    # The rating value.
+    attr_accessor :rating
+
+    # The unique ID of the security signal.
+    attr_reader :signal_id
+
+    # The type of feedback.
+    attr_accessor :type
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'feedback' => :'feedback',
+        :'feedback_content' => :'feedback_content',
+        :'incomplete' => :'incomplete',
+        :'rating' => :'rating',
+        :'signal_id' => :'signal_id',
+        :'type' => :'type'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'feedback' => :'String',
+        :'feedback_content' => :'Array<SecurityMonitoringSignalInvestigationFeedbackSection>',
+        :'incomplete' => :'Boolean',
+        :'rating' => :'String',
+        :'signal_id' => :'String',
+        :'type' => :'String'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationFeedbackRequestAttributes` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'feedback')
+        self.feedback = attributes[:'feedback']
+      end
+
+      if attributes.key?(:'feedback_content')
+        if (value = attributes[:'feedback_content']).is_a?(Array)
+          self.feedback_content = value
+        end
+      end
+
+      if attributes.key?(:'incomplete')
+        self.incomplete = attributes[:'incomplete']
+      end
+
+      if attributes.key?(:'rating')
+        self.rating = attributes[:'rating']
+      end
+
+      if attributes.key?(:'signal_id')
+        self.signal_id = attributes[:'signal_id']
+      end
+
+      if attributes.key?(:'type')
+        self.type = attributes[:'type']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @feedback.nil?
+      return false if @signal_id.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param feedback [Object] Object to be assigned
+    # @!visibility private
+    def feedback=(feedback)
+      if feedback.nil?
+        fail ArgumentError, 'invalid value for "feedback", feedback cannot be nil.'
+      end
+      @feedback = feedback
+    end
+
+    # Custom attribute writer method with validation
+    # @param signal_id [Object] Object to be assigned
+    # @!visibility private
+    def signal_id=(signal_id)
+      if signal_id.nil?
+        fail ArgumentError, 'invalid value for "signal_id", signal_id cannot be nil.'
+      end
+      @signal_id = signal_id
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          feedback == o.feedback &&
+          feedback_content == o.feedback_content &&
+          incomplete == o.incomplete &&
+          rating == o.rating &&
+          signal_id == o.signal_id &&
+          type == o.type &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [feedback, feedback_content, incomplete, rating, signal_id, type, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_request_data.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_request_data.rb
new file mode 100644
index 00000000000..ba35b34d727
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_request_data.rb
@@ -0,0 +1,144 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Data for submitting investigation feedback.
+  class SecurityMonitoringSignalInvestigationFeedbackRequestData
+    include BaseGenericModel
+
+    # Attributes for investigation feedback.
+    attr_reader :attributes
+
+    # The type of feedback.
+    attr_reader :type
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'attributes' => :'attributes',
+        :'type' => :'type'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'attributes' => :'SecurityMonitoringSignalInvestigationFeedbackRequestAttributes',
+        :'type' => :'SecurityMonitoringSignalInvestigationFeedbackType'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationFeedbackRequestData` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'attributes')
+        self.attributes = attributes[:'attributes']
+      end
+
+      if attributes.key?(:'type')
+        self.type = attributes[:'type']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @attributes.nil?
+      return false if @type.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param attributes [Object] Object to be assigned
+    # @!visibility private
+    def attributes=(attributes)
+      if attributes.nil?
+        fail ArgumentError, 'invalid value for "attributes", attributes cannot be nil.'
+      end
+      @attributes = attributes
+    end
+
+    # Custom attribute writer method with validation
+    # @param type [Object] Object to be assigned
+    # @!visibility private
+    def type=(type)
+      if type.nil?
+        fail ArgumentError, 'invalid value for "type", type cannot be nil.'
+      end
+      @type = type
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          attributes == o.attributes &&
+          type == o.type &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [attributes, type, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_response.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_response.rb
new file mode 100644
index 00000000000..7e25c56fccc
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_response.rb
@@ -0,0 +1,123 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Response containing investigation feedback.
+  class SecurityMonitoringSignalInvestigationFeedbackResponse
+    include BaseGenericModel
+
+    # Data containing investigation feedback.
+    attr_reader :data
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'data' => :'data'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'data' => :'SecurityMonitoringSignalInvestigationFeedbackResponseData'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationFeedbackResponse` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'data')
+        self.data = attributes[:'data']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @data.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param data [Object] Object to be assigned
+    # @!visibility private
+    def data=(data)
+      if data.nil?
+        fail ArgumentError, 'invalid value for "data", data cannot be nil.'
+      end
+      @data = data
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          data == o.data &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [data, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_response_attributes.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_response_attributes.rb
new file mode 100644
index 00000000000..b8748faf662
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_response_attributes.rb
@@ -0,0 +1,187 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Attributes of investigation feedback.
+  class SecurityMonitoringSignalInvestigationFeedbackResponseAttributes
+    include BaseGenericModel
+
+    # The feedback text.
+    attr_reader :feedback
+
+    # Structured feedback content.
+    attr_accessor :feedback_content
+
+    # The unique ID of the investigation.
+    attr_reader :investigation_id
+
+    # The rating value.
+    attr_accessor :rating
+
+    # The unique ID of the security signal.
+    attr_reader :signal_id
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'feedback' => :'feedback',
+        :'feedback_content' => :'feedback_content',
+        :'investigation_id' => :'investigation_id',
+        :'rating' => :'rating',
+        :'signal_id' => :'signal_id'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'feedback' => :'String',
+        :'feedback_content' => :'Array<SecurityMonitoringSignalInvestigationFeedbackSection>',
+        :'investigation_id' => :'String',
+        :'rating' => :'String',
+        :'signal_id' => :'String'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationFeedbackResponseAttributes` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'feedback')
+        self.feedback = attributes[:'feedback']
+      end
+
+      if attributes.key?(:'feedback_content')
+        if (value = attributes[:'feedback_content']).is_a?(Array)
+          self.feedback_content = value
+        end
+      end
+
+      if attributes.key?(:'investigation_id')
+        self.investigation_id = attributes[:'investigation_id']
+      end
+
+      if attributes.key?(:'rating')
+        self.rating = attributes[:'rating']
+      end
+
+      if attributes.key?(:'signal_id')
+        self.signal_id = attributes[:'signal_id']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @feedback.nil?
+      return false if @investigation_id.nil?
+      return false if @signal_id.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param feedback [Object] Object to be assigned
+    # @!visibility private
+    def feedback=(feedback)
+      if feedback.nil?
+        fail ArgumentError, 'invalid value for "feedback", feedback cannot be nil.'
+      end
+      @feedback = feedback
+    end
+
+    # Custom attribute writer method with validation
+    # @param investigation_id [Object] Object to be assigned
+    # @!visibility private
+    def investigation_id=(investigation_id)
+      if investigation_id.nil?
+        fail ArgumentError, 'invalid value for "investigation_id", investigation_id cannot be nil.'
+      end
+      @investigation_id = investigation_id
+    end
+
+    # Custom attribute writer method with validation
+    # @param signal_id [Object] Object to be assigned
+    # @!visibility private
+    def signal_id=(signal_id)
+      if signal_id.nil?
+        fail ArgumentError, 'invalid value for "signal_id", signal_id cannot be nil.'
+      end
+      @signal_id = signal_id
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          feedback == o.feedback &&
+          feedback_content == o.feedback_content &&
+          investigation_id == o.investigation_id &&
+          rating == o.rating &&
+          signal_id == o.signal_id &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [feedback, feedback_content, investigation_id, rating, signal_id, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_response_data.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_response_data.rb
new file mode 100644
index 00000000000..6a17941247f
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_response_data.rb
@@ -0,0 +1,165 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Data containing investigation feedback.
+  class SecurityMonitoringSignalInvestigationFeedbackResponseData
+    include BaseGenericModel
+
+    # Attributes of investigation feedback.
+    attr_reader :attributes
+
+    # The unique ID of the investigation.
+    attr_reader :id
+
+    # The type of feedback.
+    attr_reader :type
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'attributes' => :'attributes',
+        :'id' => :'id',
+        :'type' => :'type'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'attributes' => :'SecurityMonitoringSignalInvestigationFeedbackResponseAttributes',
+        :'id' => :'String',
+        :'type' => :'SecurityMonitoringSignalInvestigationFeedbackType'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationFeedbackResponseData` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'attributes')
+        self.attributes = attributes[:'attributes']
+      end
+
+      if attributes.key?(:'id')
+        self.id = attributes[:'id']
+      end
+
+      if attributes.key?(:'type')
+        self.type = attributes[:'type']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @attributes.nil?
+      return false if @id.nil?
+      return false if @type.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param attributes [Object] Object to be assigned
+    # @!visibility private
+    def attributes=(attributes)
+      if attributes.nil?
+        fail ArgumentError, 'invalid value for "attributes", attributes cannot be nil.'
+      end
+      @attributes = attributes
+    end
+
+    # Custom attribute writer method with validation
+    # @param id [Object] Object to be assigned
+    # @!visibility private
+    def id=(id)
+      if id.nil?
+        fail ArgumentError, 'invalid value for "id", id cannot be nil.'
+      end
+      @id = id
+    end
+
+    # Custom attribute writer method with validation
+    # @param type [Object] Object to be assigned
+    # @!visibility private
+    def type=(type)
+      if type.nil?
+        fail ArgumentError, 'invalid value for "type", type cannot be nil.'
+      end
+      @type = type
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          attributes == o.attributes &&
+          id == o.id &&
+          type == o.type &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [attributes, id, type, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_section.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_section.rb
new file mode 100644
index 00000000000..efa516d054c
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_section.rb
@@ -0,0 +1,167 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # A feedback section containing metrics.
+  class SecurityMonitoringSignalInvestigationFeedbackSection
+    include BaseGenericModel
+
+    # The section identifier.
+    attr_reader :id
+
+    # Array of feedback metrics.
+    attr_reader :metrics
+
+    # The section title.
+    attr_reader :title
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'id' => :'id',
+        :'metrics' => :'metrics',
+        :'title' => :'title'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'id' => :'String',
+        :'metrics' => :'Array<SecurityMonitoringSignalInvestigationFeedbackMetric>',
+        :'title' => :'String'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationFeedbackSection` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'id')
+        self.id = attributes[:'id']
+      end
+
+      if attributes.key?(:'metrics')
+        if (value = attributes[:'metrics']).is_a?(Array)
+          self.metrics = value
+        end
+      end
+
+      if attributes.key?(:'title')
+        self.title = attributes[:'title']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @id.nil?
+      return false if @metrics.nil?
+      return false if @title.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param id [Object] Object to be assigned
+    # @!visibility private
+    def id=(id)
+      if id.nil?
+        fail ArgumentError, 'invalid value for "id", id cannot be nil.'
+      end
+      @id = id
+    end
+
+    # Custom attribute writer method with validation
+    # @param metrics [Object] Object to be assigned
+    # @!visibility private
+    def metrics=(metrics)
+      if metrics.nil?
+        fail ArgumentError, 'invalid value for "metrics", metrics cannot be nil.'
+      end
+      @metrics = metrics
+    end
+
+    # Custom attribute writer method with validation
+    # @param title [Object] Object to be assigned
+    # @!visibility private
+    def title=(title)
+      if title.nil?
+        fail ArgumentError, 'invalid value for "title", title cannot be nil.'
+      end
+      @title = title
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          id == o.id &&
+          metrics == o.metrics &&
+          title == o.title &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [id, metrics, title, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_type.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_type.rb
new file mode 100644
index 00000000000..0cff8388385
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_feedback_type.rb
@@ -0,0 +1,26 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # The type of feedback.
+  class SecurityMonitoringSignalInvestigationFeedbackType
+    include BaseEnumModel
+
+    INVESTIGATION_FEEDBACK = "investigation_feedback".freeze
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_request.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_request.rb
new file mode 100644
index 00000000000..a52654e8bd1
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_request.rb
@@ -0,0 +1,123 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Request body for creating a security signal investigation.
+  class SecurityMonitoringSignalInvestigationRequest
+    include BaseGenericModel
+
+    # Data for creating a signal investigation.
+    attr_reader :data
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'data' => :'data'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'data' => :'SecurityMonitoringSignalInvestigationRequestData'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationRequest` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'data')
+        self.data = attributes[:'data']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @data.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param data [Object] Object to be assigned
+    # @!visibility private
+    def data=(data)
+      if data.nil?
+        fail ArgumentError, 'invalid value for "data", data cannot be nil.'
+      end
+      @data = data
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          data == o.data &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [data, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_request_attributes.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_request_attributes.rb
new file mode 100644
index 00000000000..800f93e0afa
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_request_attributes.rb
@@ -0,0 +1,133 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Attributes for creating a signal investigation.
+  class SecurityMonitoringSignalInvestigationRequestAttributes
+    include BaseGenericModel
+
+    # Optional deployment override for the investigation.
+    attr_accessor :deployment
+
+    # The unique ID of the security signal.
+    attr_reader :signal_id
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'deployment' => :'deployment',
+        :'signal_id' => :'signal_id'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'deployment' => :'String',
+        :'signal_id' => :'String'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationRequestAttributes` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'deployment')
+        self.deployment = attributes[:'deployment']
+      end
+
+      if attributes.key?(:'signal_id')
+        self.signal_id = attributes[:'signal_id']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @signal_id.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param signal_id [Object] Object to be assigned
+    # @!visibility private
+    def signal_id=(signal_id)
+      if signal_id.nil?
+        fail ArgumentError, 'invalid value for "signal_id", signal_id cannot be nil.'
+      end
+      @signal_id = signal_id
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          deployment == o.deployment &&
+          signal_id == o.signal_id &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [deployment, signal_id, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_request_data.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_request_data.rb
new file mode 100644
index 00000000000..e9bcb9ecf45
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_request_data.rb
@@ -0,0 +1,144 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Data for creating a signal investigation.
+  class SecurityMonitoringSignalInvestigationRequestData
+    include BaseGenericModel
+
+    # Attributes for creating a signal investigation.
+    attr_reader :attributes
+
+    # The type of investigation signal.
+    attr_reader :type
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'attributes' => :'attributes',
+        :'type' => :'type'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'attributes' => :'SecurityMonitoringSignalInvestigationRequestAttributes',
+        :'type' => :'SecurityMonitoringSignalInvestigationType'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationRequestData` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'attributes')
+        self.attributes = attributes[:'attributes']
+      end
+
+      if attributes.key?(:'type')
+        self.type = attributes[:'type']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @attributes.nil?
+      return false if @type.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param attributes [Object] Object to be assigned
+    # @!visibility private
+    def attributes=(attributes)
+      if attributes.nil?
+        fail ArgumentError, 'invalid value for "attributes", attributes cannot be nil.'
+      end
+      @attributes = attributes
+    end
+
+    # Custom attribute writer method with validation
+    # @param type [Object] Object to be assigned
+    # @!visibility private
+    def type=(type)
+      if type.nil?
+        fail ArgumentError, 'invalid value for "type", type cannot be nil.'
+      end
+      @type = type
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          attributes == o.attributes &&
+          type == o.type &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [attributes, type, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_response.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_response.rb
new file mode 100644
index 00000000000..72e968e6b20
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_response.rb
@@ -0,0 +1,123 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Response containing investigation details for a security signal.
+  class SecurityMonitoringSignalInvestigationResponse
+    include BaseGenericModel
+
+    # Data containing the investigation details.
+    attr_reader :data
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'data' => :'data'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'data' => :'SecurityMonitoringSignalInvestigationResponseData'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationResponse` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'data')
+        self.data = attributes[:'data']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @data.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param data [Object] Object to be assigned
+    # @!visibility private
+    def data=(data)
+      if data.nil?
+        fail ArgumentError, 'invalid value for "data", data cannot be nil.'
+      end
+      @data = data
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          data == o.data &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [data, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_response_attributes.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_response_attributes.rb
new file mode 100644
index 00000000000..d0f23295f67
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_response_attributes.rb
@@ -0,0 +1,185 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Attributes of a signal investigation response.
+  class SecurityMonitoringSignalInvestigationResponseAttributes
+    include BaseGenericModel
+
+    # The unique ID of the investigation.
+    attr_reader :investigation_id
+
+    # The ID of the rule that triggered the signal.
+    attr_reader :rule_id
+
+    # The unique ID of the security signal.
+    attr_reader :signal_id
+
+    # The state of the investigation.
+    attr_accessor :state
+
+    # Information about an investigation step.
+    attr_accessor :step
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'investigation_id' => :'investigation_id',
+        :'rule_id' => :'rule_id',
+        :'signal_id' => :'signal_id',
+        :'state' => :'state',
+        :'step' => :'step'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'investigation_id' => :'String',
+        :'rule_id' => :'String',
+        :'signal_id' => :'String',
+        :'state' => :'SecurityMonitoringSignalInvestigationState',
+        :'step' => :'SecurityMonitoringSignalInvestigationStep'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationResponseAttributes` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'investigation_id')
+        self.investigation_id = attributes[:'investigation_id']
+      end
+
+      if attributes.key?(:'rule_id')
+        self.rule_id = attributes[:'rule_id']
+      end
+
+      if attributes.key?(:'signal_id')
+        self.signal_id = attributes[:'signal_id']
+      end
+
+      if attributes.key?(:'state')
+        self.state = attributes[:'state']
+      end
+
+      if attributes.key?(:'step')
+        self.step = attributes[:'step']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @investigation_id.nil?
+      return false if @rule_id.nil?
+      return false if @signal_id.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param investigation_id [Object] Object to be assigned
+    # @!visibility private
+    def investigation_id=(investigation_id)
+      if investigation_id.nil?
+        fail ArgumentError, 'invalid value for "investigation_id", investigation_id cannot be nil.'
+      end
+      @investigation_id = investigation_id
+    end
+
+    # Custom attribute writer method with validation
+    # @param rule_id [Object] Object to be assigned
+    # @!visibility private
+    def rule_id=(rule_id)
+      if rule_id.nil?
+        fail ArgumentError, 'invalid value for "rule_id", rule_id cannot be nil.'
+      end
+      @rule_id = rule_id
+    end
+
+    # Custom attribute writer method with validation
+    # @param signal_id [Object] Object to be assigned
+    # @!visibility private
+    def signal_id=(signal_id)
+      if signal_id.nil?
+        fail ArgumentError, 'invalid value for "signal_id", signal_id cannot be nil.'
+      end
+      @signal_id = signal_id
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          investigation_id == o.investigation_id &&
+          rule_id == o.rule_id &&
+          signal_id == o.signal_id &&
+          state == o.state &&
+          step == o.step &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [investigation_id, rule_id, signal_id, state, step, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_response_data.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_response_data.rb
new file mode 100644
index 00000000000..7a30b036ee3
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_response_data.rb
@@ -0,0 +1,165 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Data containing the investigation details.
+  class SecurityMonitoringSignalInvestigationResponseData
+    include BaseGenericModel
+
+    # Attributes of a signal investigation response.
+    attr_reader :attributes
+
+    # The unique ID of the investigation.
+    attr_reader :id
+
+    # The type of investigation signal.
+    attr_reader :type
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'attributes' => :'attributes',
+        :'id' => :'id',
+        :'type' => :'type'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'attributes' => :'SecurityMonitoringSignalInvestigationResponseAttributes',
+        :'id' => :'String',
+        :'type' => :'SecurityMonitoringSignalInvestigationType'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationResponseData` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'attributes')
+        self.attributes = attributes[:'attributes']
+      end
+
+      if attributes.key?(:'id')
+        self.id = attributes[:'id']
+      end
+
+      if attributes.key?(:'type')
+        self.type = attributes[:'type']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @attributes.nil?
+      return false if @id.nil?
+      return false if @type.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param attributes [Object] Object to be assigned
+    # @!visibility private
+    def attributes=(attributes)
+      if attributes.nil?
+        fail ArgumentError, 'invalid value for "attributes", attributes cannot be nil.'
+      end
+      @attributes = attributes
+    end
+
+    # Custom attribute writer method with validation
+    # @param id [Object] Object to be assigned
+    # @!visibility private
+    def id=(id)
+      if id.nil?
+        fail ArgumentError, 'invalid value for "id", id cannot be nil.'
+      end
+      @id = id
+    end
+
+    # Custom attribute writer method with validation
+    # @param type [Object] Object to be assigned
+    # @!visibility private
+    def type=(type)
+      if type.nil?
+        fail ArgumentError, 'invalid value for "type", type cannot be nil.'
+      end
+      @type = type
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          attributes == o.attributes &&
+          id == o.id &&
+          type == o.type &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [attributes, id, type, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_state.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_state.rb
new file mode 100644
index 00000000000..924a99b782d
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_state.rb
@@ -0,0 +1,27 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # The state of the investigation.
+  class SecurityMonitoringSignalInvestigationState
+    include BaseEnumModel
+
+    INVESTIGATING = "investigating".freeze
+    COMPLETED = "completed".freeze
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_step.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_step.rb
new file mode 100644
index 00000000000..2e0d0664d28
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_step.rb
@@ -0,0 +1,125 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Information about an investigation step.
+  class SecurityMonitoringSignalInvestigationStep
+    include BaseGenericModel
+
+    # Array of step outputs.
+    attr_reader :step_outputs
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'step_outputs' => :'stepOutputs'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'step_outputs' => :'Array<SecurityMonitoringSignalInvestigationStepOutput>'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationStep` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'step_outputs')
+        if (value = attributes[:'step_outputs']).is_a?(Array)
+          self.step_outputs = value
+        end
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @step_outputs.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param step_outputs [Object] Object to be assigned
+    # @!visibility private
+    def step_outputs=(step_outputs)
+      if step_outputs.nil?
+        fail ArgumentError, 'invalid value for "step_outputs", step_outputs cannot be nil.'
+      end
+      @step_outputs = step_outputs
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          step_outputs == o.step_outputs &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [step_outputs, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_step_output.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_step_output.rb
new file mode 100644
index 00000000000..fb8373a5c08
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_step_output.rb
@@ -0,0 +1,175 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # Output from an investigation step.
+  class SecurityMonitoringSignalInvestigationStepOutput
+    include BaseGenericModel
+
+    # A one-line summary of the step analysis.
+    attr_accessor :current_step_analysis_oneliner
+
+    # A detailed summary of the step analysis.
+    attr_reader :current_step_analysis_summary
+
+    # The name of the investigation step.
+    attr_reader :name
+
+    # The verdict from the investigation step.
+    attr_reader :verdict
+
+    attr_accessor :additional_properties
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    # @!visibility private
+    def self.attribute_map
+      {
+        :'current_step_analysis_oneliner' => :'currentStepAnalysisOneliner',
+        :'current_step_analysis_summary' => :'currentStepAnalysisSummary',
+        :'name' => :'name',
+        :'verdict' => :'verdict'
+      }
+    end
+
+    # Attribute type mapping.
+    # @!visibility private
+    def self.openapi_types
+      {
+        :'current_step_analysis_oneliner' => :'String',
+        :'current_step_analysis_summary' => :'String',
+        :'name' => :'String',
+        :'verdict' => :'SecurityMonitoringSignalInvestigationStepOutputVerdict'
+      }
+    end
+
+    # Initializes the object
+    # @param attributes [Hash] Model attributes in the form of hash
+    # @!visibility private
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `DatadogAPIClient::V2::SecurityMonitoringSignalInvestigationStepOutput` initialize method"
+      end
+
+      self.additional_properties = {}
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          self.additional_properties[k.to_sym] = v
+        else
+          h[k.to_sym] = v
+        end
+      }
+
+      if attributes.key?(:'current_step_analysis_oneliner')
+        self.current_step_analysis_oneliner = attributes[:'current_step_analysis_oneliner']
+      end
+
+      if attributes.key?(:'current_step_analysis_summary')
+        self.current_step_analysis_summary = attributes[:'current_step_analysis_summary']
+      end
+
+      if attributes.key?(:'name')
+        self.name = attributes[:'name']
+      end
+
+      if attributes.key?(:'verdict')
+        self.verdict = attributes[:'verdict']
+      end
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    # @!visibility private
+    def valid?
+      return false if @current_step_analysis_summary.nil?
+      return false if @name.nil?
+      return false if @verdict.nil?
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param current_step_analysis_summary [Object] Object to be assigned
+    # @!visibility private
+    def current_step_analysis_summary=(current_step_analysis_summary)
+      if current_step_analysis_summary.nil?
+        fail ArgumentError, 'invalid value for "current_step_analysis_summary", current_step_analysis_summary cannot be nil.'
+      end
+      @current_step_analysis_summary = current_step_analysis_summary
+    end
+
+    # Custom attribute writer method with validation
+    # @param name [Object] Object to be assigned
+    # @!visibility private
+    def name=(name)
+      if name.nil?
+        fail ArgumentError, 'invalid value for "name", name cannot be nil.'
+      end
+      @name = name
+    end
+
+    # Custom attribute writer method with validation
+    # @param verdict [Object] Object to be assigned
+    # @!visibility private
+    def verdict=(verdict)
+      if verdict.nil?
+        fail ArgumentError, 'invalid value for "verdict", verdict cannot be nil.'
+      end
+      @verdict = verdict
+    end
+
+    # Returns the object in the form of hash, with additionalProperties support.
+    # @return [Hash] Returns the object in the form of hash
+    # @!visibility private
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      self.additional_properties.each_pair do |attr, value|
+        hash[attr] = value
+      end
+      hash
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param o [Object] Object to be compared
+    # @!visibility private
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          current_step_analysis_oneliner == o.current_step_analysis_oneliner &&
+          current_step_analysis_summary == o.current_step_analysis_summary &&
+          name == o.name &&
+          verdict == o.verdict &&
+          additional_properties == o.additional_properties
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    # @!visibility private
+    def hash
+      [current_step_analysis_oneliner, current_step_analysis_summary, name, verdict, additional_properties].hash
+    end
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_step_output_verdict.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_step_output_verdict.rb
new file mode 100644
index 00000000000..9df541d8d7b
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_step_output_verdict.rb
@@ -0,0 +1,29 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # The verdict from the investigation step.
+  class SecurityMonitoringSignalInvestigationStepOutputVerdict
+    include BaseEnumModel
+
+    UNSPECIFIED = "unspecified".freeze
+    BENIGN = "benign".freeze
+    SUSPICIOUS = "suspicious".freeze
+    INCONCLUSIVE = "inconclusive".freeze
+  end
+end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_type.rb b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_type.rb
new file mode 100644
index 00000000000..ce9f47e9d82
--- /dev/null
+++ b/lib/datadog_api_client/v2/models/security_monitoring_signal_investigation_type.rb
@@ -0,0 +1,26 @@
+=begin
+#Datadog API V2 Collection
+
+#Collection of all Datadog Public endpoints.
+
+The version of the OpenAPI document: 1.0
+Contact: support@datadoghq.com
+Generated by: https://github.com/DataDog/datadog-api-client-ruby/tree/master/.generator
+
+ Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ This product includes software developed at Datadog (https://www.datadoghq.com/).
+ Copyright 2020-Present Datadog, Inc.
+
+=end
+
+require 'date'
+require 'time'
+
+module DatadogAPIClient::V2
+  # The type of investigation signal.
+  class SecurityMonitoringSignalInvestigationType
+    include BaseEnumModel
+
+    INVESTIGATION_SIGNAL = "investigation_signal".freeze
+  end
+end