@pulumi/datadog 5.4.0-alpha.1780123105 → 5.4.0

package/types/output.d.ts

@@ -63533,6 +63533,10 @@ export interface GetSecurityMonitoringRulesRuleOptionsImpossibleTravelOptions {
      * If true, signals are suppressed for the first 24 hours. During that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.
      */
     baselineUserLocations?: boolean;
+    /**
+     * The duration in days during which Datadog learns a user's access locations before generating signals. Only applicable when `baselineUserLocations` is `true`. Defaults to `1` if unset.
+     */
+    baselineUserLocationsDuration: number;
 }
 export interface GetSecurityMonitoringRulesRuleOptionsNewValueOptions {
     /**
@@ -65699,10 +65703,18 @@ export interface MonitorMonitorThresholds {
      * The monitor `CRITICAL` threshold. Must be a number.
      */
     critical?: string;
+    /**
+     * Query evaluated as a dynamic `CRITICAL` threshold. Only supported on metric monitors with a formula query and `options['variables']`. Cannot be combined with static thresholds. This field is in preview.
+     */
+    criticalQuery?: string;
     /**
      * The monitor `CRITICAL` recovery threshold. Must be a number.
      */
     criticalRecovery?: string;
+    /**
+     * Query evaluated as a dynamic `CRITICAL` recovery threshold. Only supported on metric monitors with a formula query and `options['variables']`. Cannot be combined with static thresholds. This field is in preview.
+     */
+    criticalRecoveryQuery?: string;
     /**
      * The monitor `OK` threshold. Only supported in monitor type `service check`. Must be a number.
      */
@@ -65799,6 +65811,14 @@ export interface MonitorSchedulingOptionsEvaluationWindow {
     timezone?: string;
 }
 export interface MonitorVariables {
+    /**
+     * Aggregate-augmented composite query variables (reference table augment joined to a metrics or events base query).
+     */
+    aggregateAugmentedQueries?: outputs.MonitorVariablesAggregateAugmentedQuery[];
+    /**
+     * Aggregate-filtered composite query variables (filter base query results using a reference table or events filter query).
+     */
+    aggregateFilteredQueries?: outputs.MonitorVariablesAggregateFilteredQuery[];
     /**
      * The Cloud Cost query using formulas and functions.
      */
@@ -65816,6 +65836,638 @@ export interface MonitorVariables {
      */
     eventQueries?: outputs.MonitorVariablesEventQuery[];
 }
+export interface MonitorVariablesAggregateAugmentedQuery {
+    /**
+     * Events augment query. Do not set `augmentReferenceTable` in the same block.
+     */
+    augmentEventQuery?: outputs.MonitorVariablesAggregateAugmentedQueryAugmentEventQuery;
+    /**
+     * Reference table augment query. Do not set `augmentEventQuery` in the same block.
+     */
+    augmentReferenceTable?: outputs.MonitorVariablesAggregateAugmentedQueryAugmentReferenceTable;
+    /**
+     * Events base query. Do not set `baseMetricsQuery` in the same block.
+     */
+    baseEventQuery?: outputs.MonitorVariablesAggregateAugmentedQueryBaseEventQuery;
+    /**
+     * Metrics base query. Do not set `baseEventQuery` in the same block.
+     */
+    baseMetricsQuery?: outputs.MonitorVariablesAggregateAugmentedQueryBaseMetricsQuery;
+    /**
+     * Compute aggregations for the aggregate-augmented query.
+     */
+    computes: outputs.MonitorVariablesAggregateAugmentedQueryCompute[];
+    /**
+     * The data source for aggregate-augmented composite queries. Must be `aggregateAugmentedQuery`. Valid values are `aggregateAugmentedQuery`.
+     */
+    dataSource: string;
+    /**
+     * Group by options for the aggregate-augmented query. At least one block is required.
+     */
+    groupBies: outputs.MonitorVariablesAggregateAugmentedQueryGroupBy[];
+    /**
+     * Join condition between augment and base queries.
+     */
+    joinCondition: outputs.MonitorVariablesAggregateAugmentedQueryJoinCondition;
+    /**
+     * Name of the query for use in formulas.
+     */
+    name?: string;
+}
+export interface MonitorVariablesAggregateAugmentedQueryAugmentEventQuery {
+    /**
+     * The compute options.
+     */
+    computes: outputs.MonitorVariablesAggregateAugmentedQueryAugmentEventQueryCompute[];
+    /**
+     * The data source for event platform-based queries. Valid values are `rum`, `ciPipelines`, `ciTests`, `audit`, `events`, `logs`, `spans`, `databaseQueries`, `network`, `networkPath`.
+     */
+    dataSource: string;
+    /**
+     * Group by options.
+     */
+    groupBies?: outputs.MonitorVariablesAggregateAugmentedQueryAugmentEventQueryGroupBy[];
+    /**
+     * An array of index names to query in the stream.
+     */
+    indexes?: string[];
+    /**
+     * The name of query for use in formulas.
+     */
+    name: string;
+    /**
+     * The search options.
+     */
+    search: outputs.MonitorVariablesAggregateAugmentedQueryAugmentEventQuerySearch;
+}
+export interface MonitorVariablesAggregateAugmentedQueryAugmentEventQueryCompute {
+    /**
+     * The aggregation methods for event platform queries. Valid values are `count`, `cardinality`, `median`, `pc75`, `pc90`, `pc95`, `pc98`, `pc99`, `sum`, `min`, `max`, `avg`.
+     */
+    aggregation: string;
+    /**
+     * A time interval in milliseconds.
+     */
+    interval?: number;
+    /**
+     * The measurable attribute to compute.
+     */
+    metric?: string;
+    /**
+     * The name assigned to this aggregation when multiple aggregations are defined for a query.
+     */
+    name?: string;
+}
+export interface MonitorVariablesAggregateAugmentedQueryAugmentEventQueryGroupBy {
+    /**
+     * The event facet.
+     */
+    facet: string;
+    /**
+     * The number of groups to return.
+     */
+    limit?: number;
+    /**
+     * The options for sorting group by results.
+     */
+    sort?: outputs.MonitorVariablesAggregateAugmentedQueryAugmentEventQueryGroupBySort;
+    /**
+     * For composite aggregate-augmented queries, identifies which sub-query this group-by facet refers to (for example `filterQuery`).
+     */
+    source?: string;
+}
+export interface MonitorVariablesAggregateAugmentedQueryAugmentEventQueryGroupBySort {
+    /**
+     * The aggregation methods for the event platform queries. Valid values are `count`, `cardinality`, `median`, `pc75`, `pc90`, `pc95`, `pc98`, `pc99`, `sum`, `min`, `max`, `avg`.
+     */
+    aggregation: string;
+    /**
+     * The metric used for sorting group by results.
+     */
+    metric?: string;
+    /**
+     * Direction of sort. Valid values are `asc`, `desc`.
+     */
+    order?: string;
+}
+export interface MonitorVariablesAggregateAugmentedQueryAugmentEventQuerySearch {
+    /**
+     * The events search string.
+     */
+    query: string;
+}
+export interface MonitorVariablesAggregateAugmentedQueryAugmentReferenceTable {
+    /**
+     * Columns to retrieve from the reference table.
+     */
+    columns?: outputs.MonitorVariablesAggregateAugmentedQueryAugmentReferenceTableColumn[];
+    /**
+     * Must be `referenceTable`. Valid values are `referenceTable`.
+     */
+    dataSource: string;
+    /**
+     * Name of the augment sub-query.
+     */
+    name?: string;
+    /**
+     * Optional filter expression for the reference table query.
+     */
+    queryFilter?: string;
+    /**
+     * Name of the reference table.
+     */
+    tableName: string;
+}
+export interface MonitorVariablesAggregateAugmentedQueryAugmentReferenceTableColumn {
+    /**
+     * Optional alias for the column.
+     */
+    alias?: string;
+    /**
+     * Reference table column name.
+     */
+    name: string;
+}
+export interface MonitorVariablesAggregateAugmentedQueryBaseEventQuery {
+    /**
+     * The compute options.
+     */
+    computes: outputs.MonitorVariablesAggregateAugmentedQueryBaseEventQueryCompute[];
+    /**
+     * The data source for event platform-based queries. Valid values are `rum`, `ciPipelines`, `ciTests`, `audit`, `events`, `logs`, `spans`, `databaseQueries`, `network`, `networkPath`.
+     */
+    dataSource: string;
+    /**
+     * Group by options.
+     */
+    groupBies?: outputs.MonitorVariablesAggregateAugmentedQueryBaseEventQueryGroupBy[];
+    /**
+     * An array of index names to query in the stream.
+     */
+    indexes?: string[];
+    /**
+     * The name of query for use in formulas.
+     */
+    name: string;
+    /**
+     * The search options.
+     */
+    search: outputs.MonitorVariablesAggregateAugmentedQueryBaseEventQuerySearch;
+}
+export interface MonitorVariablesAggregateAugmentedQueryBaseEventQueryCompute {
+    /**
+     * The aggregation methods for event platform queries. Valid values are `count`, `cardinality`, `median`, `pc75`, `pc90`, `pc95`, `pc98`, `pc99`, `sum`, `min`, `max`, `avg`.
+     */
+    aggregation: string;
+    /**
+     * A time interval in milliseconds.
+     */
+    interval?: number;
+    /**
+     * The measurable attribute to compute.
+     */
+    metric?: string;
+    /**
+     * The name assigned to this aggregation when multiple aggregations are defined for a query.
+     */
+    name?: string;
+}
+export interface MonitorVariablesAggregateAugmentedQueryBaseEventQueryGroupBy {
+    /**
+     * The event facet.
+     */
+    facet: string;
+    /**
+     * The number of groups to return.
+     */
+    limit?: number;
+    /**
+     * The options for sorting group by results.
+     */
+    sort?: outputs.MonitorVariablesAggregateAugmentedQueryBaseEventQueryGroupBySort;
+    /**
+     * For composite aggregate-augmented queries, identifies which sub-query this group-by facet refers to (for example `filterQuery`).
+     */
+    source?: string;
+}
+export interface MonitorVariablesAggregateAugmentedQueryBaseEventQueryGroupBySort {
+    /**
+     * The aggregation methods for the event platform queries. Valid values are `count`, `cardinality`, `median`, `pc75`, `pc90`, `pc95`, `pc98`, `pc99`, `sum`, `min`, `max`, `avg`.
+     */
+    aggregation: string;
+    /**
+     * The metric used for sorting group by results.
+     */
+    metric?: string;
+    /**
+     * Direction of sort. Valid values are `asc`, `desc`.
+     */
+    order?: string;
+}
+export interface MonitorVariablesAggregateAugmentedQueryBaseEventQuerySearch {
+    /**
+     * The events search string.
+     */
+    query: string;
+}
+export interface MonitorVariablesAggregateAugmentedQueryBaseMetricsQuery {
+    /**
+     * The aggregation method for metrics queries. Valid values are `avg`, `min`, `max`, `sum`, `last`, `mean`, `area`, `l2norm`, `percentile`, `stddev`, `countUnique`.
+     */
+    aggregator?: string;
+    /**
+     * The data source for metrics queries. Valid values are `metrics`, `cloudCost`, `datadogUsage`.
+     */
+    dataSource: string;
+    /**
+     * The name of the query for use in formulas.
+     */
+    name?: string;
+    /**
+     * The metrics query definition.
+     */
+    query: string;
+}
+export interface MonitorVariablesAggregateAugmentedQueryCompute {
+    /**
+     * The aggregation methods for compute steps. Valid values are `count`, `cardinality`, `median`, `pc75`, `pc90`, `pc95`, `pc98`, `pc99`, `sum`, `min`, `max`, `avg`.
+     */
+    aggregation: string;
+    /**
+     * A time interval in milliseconds.
+     */
+    interval?: number;
+    /**
+     * The measurable attribute to compute.
+     */
+    metric?: string;
+    /**
+     * The name assigned to this aggregation when multiple aggregations are defined.
+     */
+    name?: string;
+}
+export interface MonitorVariablesAggregateAugmentedQueryGroupBy {
+    /**
+     * The facet to group by.
+     */
+    facet: string;
+    /**
+     * The number of groups to return.
+     */
+    limit?: number;
+    /**
+     * Sort options for group by.
+     */
+    sort?: outputs.MonitorVariablesAggregateAugmentedQueryGroupBySort;
+    /**
+     * Identifies which sub-query this facet refers to (for example `filterQuery`).
+     */
+    source?: string;
+}
+export interface MonitorVariablesAggregateAugmentedQueryGroupBySort {
+    /**
+     * The aggregation methods for sorting. Valid values are `count`, `cardinality`, `median`, `pc75`, `pc90`, `pc95`, `pc98`, `pc99`, `sum`, `min`, `max`, `avg`.
+     */
+    aggregation: string;
+    /**
+     * The metric used for sorting group by results.
+     */
+    metric?: string;
+    /**
+     * Direction of sort. Valid values are `asc`, `desc`.
+     */
+    order?: string;
+}
+export interface MonitorVariablesAggregateAugmentedQueryJoinCondition {
+    /**
+     * Attribute from the augment query to join on.
+     */
+    augmentAttribute: string;
+    /**
+     * Attribute from the base query to join on.
+     */
+    baseAttribute: string;
+    /**
+     * Join type (for example `inner`). Valid values are `inner`, `left`.
+     */
+    joinType: string;
+}
+export interface MonitorVariablesAggregateFilteredQuery {
+    /**
+     * Events base query. Do not set `baseMetricsQuery` in the same block.
+     */
+    baseEventQuery?: outputs.MonitorVariablesAggregateFilteredQueryBaseEventQuery;
+    /**
+     * Metrics base query. Do not set `baseEventQuery` in the same block.
+     */
+    baseMetricsQuery?: outputs.MonitorVariablesAggregateFilteredQueryBaseMetricsQuery;
+    /**
+     * Optional compute aggregations for the aggregate-filtered query.
+     */
+    computes?: outputs.MonitorVariablesAggregateFilteredQueryCompute[];
+    /**
+     * The data source for aggregate-filtered composite queries. Must be `aggregateFilteredQuery`. Valid values are `aggregateFilteredQuery`.
+     */
+    dataSource: string;
+    /**
+     * Events filter query. Do not set `filterReferenceTable` in the same block.
+     */
+    filterEventQuery?: outputs.MonitorVariablesAggregateFilteredQueryFilterEventQuery;
+    /**
+     * Reference table filter query. Do not set `filterEventQuery` in the same block.
+     */
+    filterReferenceTable?: outputs.MonitorVariablesAggregateFilteredQueryFilterReferenceTable;
+    /**
+     * Filter conditions mapping base query attributes to filter query attributes.
+     */
+    filters: outputs.MonitorVariablesAggregateFilteredQueryFilter[];
+    /**
+     * Optional group by options for the aggregate-filtered query.
+     */
+    groupBies?: outputs.MonitorVariablesAggregateFilteredQueryGroupBy[];
+    /**
+     * Name of the query for use in formulas.
+     */
+    name?: string;
+}
+export interface MonitorVariablesAggregateFilteredQueryBaseEventQuery {
+    /**
+     * The compute options.
+     */
+    computes: outputs.MonitorVariablesAggregateFilteredQueryBaseEventQueryCompute[];
+    /**
+     * The data source for event platform-based queries. Valid values are `rum`, `ciPipelines`, `ciTests`, `audit`, `events`, `logs`, `spans`, `databaseQueries`, `network`, `networkPath`.
+     */
+    dataSource: string;
+    /**
+     * Group by options.
+     */
+    groupBies?: outputs.MonitorVariablesAggregateFilteredQueryBaseEventQueryGroupBy[];
+    /**
+     * An array of index names to query in the stream.
+     */
+    indexes?: string[];
+    /**
+     * The name of query for use in formulas.
+     */
+    name: string;
+    /**
+     * The search options.
+     */
+    search: outputs.MonitorVariablesAggregateFilteredQueryBaseEventQuerySearch;
+}
+export interface MonitorVariablesAggregateFilteredQueryBaseEventQueryCompute {
+    /**
+     * The aggregation methods for event platform queries. Valid values are `count`, `cardinality`, `median`, `pc75`, `pc90`, `pc95`, `pc98`, `pc99`, `sum`, `min`, `max`, `avg`.
+     */
+    aggregation: string;
+    /**
+     * A time interval in milliseconds.
+     */
+    interval?: number;
+    /**
+     * The measurable attribute to compute.
+     */
+    metric?: string;
+    /**
+     * The name assigned to this aggregation when multiple aggregations are defined for a query.
+     */
+    name?: string;
+}
+export interface MonitorVariablesAggregateFilteredQueryBaseEventQueryGroupBy {
+    /**
+     * The event facet.
+     */
+    facet: string;
+    /**
+     * The number of groups to return.
+     */
+    limit?: number;
+    /**
+     * The options for sorting group by results.
+     */
+    sort?: outputs.MonitorVariablesAggregateFilteredQueryBaseEventQueryGroupBySort;
+    /**
+     * For composite aggregate-augmented queries, identifies which sub-query this group-by facet refers to (for example `filterQuery`).
+     */
+    source?: string;
+}
+export interface MonitorVariablesAggregateFilteredQueryBaseEventQueryGroupBySort {
+    /**
+     * The aggregation methods for the event platform queries. Valid values are `count`, `cardinality`, `median`, `pc75`, `pc90`, `pc95`, `pc98`, `pc99`, `sum`, `min`, `max`, `avg`.
+     */
+    aggregation: string;
+    /**
+     * The metric used for sorting group by results.
+     */
+    metric?: string;
+    /**
+     * Direction of sort. Valid values are `asc`, `desc`.
+     */
+    order?: string;
+}
+export interface MonitorVariablesAggregateFilteredQueryBaseEventQuerySearch {
+    /**
+     * The events search string.
+     */
+    query: string;
+}
+export interface MonitorVariablesAggregateFilteredQueryBaseMetricsQuery {
+    /**
+     * The aggregation method for metrics queries. Valid values are `avg`, `min`, `max`, `sum`, `last`, `mean`, `area`, `l2norm`, `percentile`, `stddev`, `countUnique`.
+     */
+    aggregator?: string;
+    /**
+     * The data source for metrics queries. Valid values are `metrics`, `cloudCost`, `datadogUsage`.
+     */
+    dataSource: string;
+    /**
+     * The name of the query for use in formulas.
+     */
+    name?: string;
+    /**
+     * The metrics query definition.
+     */
+    query: string;
+}
+export interface MonitorVariablesAggregateFilteredQueryCompute {
+    /**
+     * The aggregation methods for compute steps. Valid values are `count`, `cardinality`, `median`, `pc75`, `pc90`, `pc95`, `pc98`, `pc99`, `sum`, `min`, `max`, `avg`.
+     */
+    aggregation: string;
+    /**
+     * A time interval in milliseconds.
+     */
+    interval?: number;
+    /**
+     * The measurable attribute to compute.
+     */
+    metric?: string;
+    /**
+     * The name assigned to this aggregation when multiple aggregations are defined.
+     */
+    name?: string;
+}
+export interface MonitorVariablesAggregateFilteredQueryFilter {
+    /**
+     * Attribute from the base query to filter on.
+     */
+    baseAttribute: string;
+    /**
+     * When true, exclude matching records instead of including them.
+     */
+    exclude?: boolean;
+    /**
+     * Attribute from the filter query to match against.
+     */
+    filterAttribute: string;
+}
+export interface MonitorVariablesAggregateFilteredQueryFilterEventQuery {
+    /**
+     * The compute options.
+     */
+    computes: outputs.MonitorVariablesAggregateFilteredQueryFilterEventQueryCompute[];
+    /**
+     * The data source for event platform-based queries. Valid values are `rum`, `ciPipelines`, `ciTests`, `audit`, `events`, `logs`, `spans`, `databaseQueries`, `network`, `networkPath`.
+     */
+    dataSource: string;
+    /**
+     * Group by options.
+     */
+    groupBies?: outputs.MonitorVariablesAggregateFilteredQueryFilterEventQueryGroupBy[];
+    /**
+     * An array of index names to query in the stream.
+     */
+    indexes?: string[];
+    /**
+     * The name of query for use in formulas.
+     */
+    name: string;
+    /**
+     * The search options.
+     */
+    search: outputs.MonitorVariablesAggregateFilteredQueryFilterEventQuerySearch;
+}
+export interface MonitorVariablesAggregateFilteredQueryFilterEventQueryCompute {
+    /**
+     * The aggregation methods for event platform queries. Valid values are `count`, `cardinality`, `median`, `pc75`, `pc90`, `pc95`, `pc98`, `pc99`, `sum`, `min`, `max`, `avg`.
+     */
+    aggregation: string;
+    /**
+     * A time interval in milliseconds.
+     */
+    interval?: number;
+    /**
+     * The measurable attribute to compute.
+     */
+    metric?: string;
+    /**
+     * The name assigned to this aggregation when multiple aggregations are defined for a query.
+     */
+    name?: string;
+}
+export interface MonitorVariablesAggregateFilteredQueryFilterEventQueryGroupBy {
+    /**
+     * The event facet.
+     */
+    facet: string;
+    /**
+     * The number of groups to return.
+     */
+    limit?: number;
+    /**
+     * The options for sorting group by results.
+     */
+    sort?: outputs.MonitorVariablesAggregateFilteredQueryFilterEventQueryGroupBySort;
+    /**
+     * For composite aggregate-augmented queries, identifies which sub-query this group-by facet refers to (for example `filterQuery`).
+     */
+    source?: string;
+}
+export interface MonitorVariablesAggregateFilteredQueryFilterEventQueryGroupBySort {
+    /**
+     * The aggregation methods for the event platform queries. Valid values are `count`, `cardinality`, `median`, `pc75`, `pc90`, `pc95`, `pc98`, `pc99`, `sum`, `min`, `max`, `avg`.
+     */
+    aggregation: string;
+    /**
+     * The metric used for sorting group by results.
+     */
+    metric?: string;
+    /**
+     * Direction of sort. Valid values are `asc`, `desc`.
+     */
+    order?: string;
+}
+export interface MonitorVariablesAggregateFilteredQueryFilterEventQuerySearch {
+    /**
+     * The events search string.
+     */
+    query: string;
+}
+export interface MonitorVariablesAggregateFilteredQueryFilterReferenceTable {
+    /**
+     * Columns to retrieve from the reference table.
+     */
+    columns?: outputs.MonitorVariablesAggregateFilteredQueryFilterReferenceTableColumn[];
+    /**
+     * Must be `referenceTable`. Valid values are `referenceTable`.
+     */
+    dataSource: string;
+    /**
+     * Name of the filter sub-query.
+     */
+    name?: string;
+    /**
+     * Optional filter expression for the reference table query.
+     */
+    queryFilter?: string;
+    /**
+     * Name of the reference table.
+     */
+    tableName: string;
+}
+export interface MonitorVariablesAggregateFilteredQueryFilterReferenceTableColumn {
+    /**
+     * Optional alias for the column.
+     */
+    alias?: string;
+    /**
+     * Reference table column name.
+     */
+    name: string;
+}
+export interface MonitorVariablesAggregateFilteredQueryGroupBy {
+    /**
+     * The facet to group by.
+     */
+    facet: string;
+    /**
+     * The number of groups to return.
+     */
+    limit?: number;
+    /**
+     * Sort options for group by.
+     */
+    sort?: outputs.MonitorVariablesAggregateFilteredQueryGroupBySort;
+    /**
+     * Identifies which sub-query this facet refers to (for example `filterQuery`).
+     */
+    source?: string;
+}
+export interface MonitorVariablesAggregateFilteredQueryGroupBySort {
+    /**
+     * The aggregation methods for sorting. Valid values are `count`, `cardinality`, `median`, `pc75`, `pc90`, `pc95`, `pc98`, `pc99`, `sum`, `min`, `max`, `avg`.
+     */
+    aggregation: string;
+    /**
+     * The metric used for sorting group by results.
+     */
+    metric?: string;
+    /**
+     * Direction of sort. Valid values are `asc`, `desc`.
+     */
+    order?: string;
+}
 export interface MonitorVariablesCloudCostQuery {
     /**
      * The aggregation methods available for cloud cost queries. Valid values are `avg`, `sum`, `max`, `min`, `last`, `area`, `l2norm`, `percentile`, `stddev`.
@@ -65947,6 +66599,10 @@ export interface MonitorVariablesEventQueryCompute {
      * The measurable attribute to compute.
      */
     metric?: string;
+    /**
+     * The name assigned to this aggregation when multiple aggregations are defined for a query.
+     */
+    name?: string;
 }
 export interface MonitorVariablesEventQueryGroupBy {
     /**
@@ -65961,6 +66617,10 @@ export interface MonitorVariablesEventQueryGroupBy {
      * The options for sorting group by results.
      */
     sort?: outputs.MonitorVariablesEventQueryGroupBySort;
+    /**
+     * For composite aggregate-augmented queries, identifies which sub-query this group-by facet refers to (for example `filterQuery`).
+     */
+    source?: string;
 }
 export interface MonitorVariablesEventQueryGroupBySort {
     /**
@@ -66268,6 +66928,10 @@ export interface ObservabilityPipelineConfigDestinationAmazonS3Generic {
      * S3 bucket name.
      */
     bucket: string;
+    /**
+     * Configuration for buffer settings on destination components. Exactly one of `disk` or `memory` must be specified.
+     */
+    buffer?: outputs.ObservabilityPipelineConfigDestinationAmazonS3GenericBuffer;
     /**
      * Compression configuration.
      */
@@ -66313,6 +66977,40 @@ export interface ObservabilityPipelineConfigDestinationAmazonS3GenericBatchSetti
      */
     timeoutSecs?: number;
 }
+export interface ObservabilityPipelineConfigDestinationAmazonS3GenericBuffer {
+    /**
+     * Options for configuring a disk buffer. Cannot be used with `memory`.
+     */
+    disk?: outputs.ObservabilityPipelineConfigDestinationAmazonS3GenericBufferDisk;
+    /**
+     * Options for configuring a memory buffer. Cannot be used with `disk`.
+     */
+    memory?: outputs.ObservabilityPipelineConfigDestinationAmazonS3GenericBufferMemory;
+}
+export interface ObservabilityPipelineConfigDestinationAmazonS3GenericBufferDisk {
+    /**
+     * Maximum size of the disk buffer (in bytes).
+     */
+    maxSize?: number;
+    /**
+     * Behavior when the buffer is full. Valid values are `block` or `dropNewest`. Defaults to `"block"`.
+     */
+    whenFull: string;
+}
+export interface ObservabilityPipelineConfigDestinationAmazonS3GenericBufferMemory {
+    /**
+     * Maximum events for the memory buffer.
+     */
+    maxEvents?: number;
+    /**
+     * Maximum size of the memory buffer (in bytes).
+     */
+    maxSize?: number;
+    /**
+     * Behavior when the buffer is full. Valid values are `block` or `dropNewest`. Defaults to `"block"`.
+     */
+    whenFull: string;
+}
 export interface ObservabilityPipelineConfigDestinationAmazonS3GenericCompression {
     /**
      * Compression algorithm. Valid values are `gzip`, `zstd`, `snappy`.
@@ -66474,11 +67172,49 @@ export interface ObservabilityPipelineConfigDestinationAzureStorageBufferMemory
     whenFull: string;
 }
 export interface ObservabilityPipelineConfigDestinationCloudPrem {
+    /**
+     * Configuration for buffer settings on destination components. Exactly one of `disk` or `memory` must be specified.
+     */
+    buffer?: outputs.ObservabilityPipelineConfigDestinationCloudPremBuffer;
     /**
      * Name of the environment variable or secret that holds the endpoint URL.
      */
     endpointUrlKey?: string;
 }
+export interface ObservabilityPipelineConfigDestinationCloudPremBuffer {
+    /**
+     * Options for configuring a disk buffer. Cannot be used with `memory`.
+     */
+    disk?: outputs.ObservabilityPipelineConfigDestinationCloudPremBufferDisk;
+    /**
+     * Options for configuring a memory buffer. Cannot be used with `disk`.
+     */
+    memory?: outputs.ObservabilityPipelineConfigDestinationCloudPremBufferMemory;
+}
+export interface ObservabilityPipelineConfigDestinationCloudPremBufferDisk {
+    /**
+     * Maximum size of the disk buffer (in bytes).
+     */
+    maxSize?: number;
+    /**
+     * Behavior when the buffer is full. Valid values are `block` or `dropNewest`. Defaults to `"block"`.
+     */
+    whenFull: string;
+}
+export interface ObservabilityPipelineConfigDestinationCloudPremBufferMemory {
+    /**
+     * Maximum events for the memory buffer.
+     */
+    maxEvents?: number;
+    /**
+     * Maximum size of the memory buffer (in bytes).
+     */
+    maxSize?: number;
+    /**
+     * Behavior when the buffer is full. Valid values are `block` or `dropNewest`. Defaults to `"block"`.
+     */
+    whenFull: string;
+}
 export interface ObservabilityPipelineConfigDestinationCrowdstrikeNextGenSiem {
     /**
      * Configuration for buffer settings on destination components. Exactly one of `disk` or `memory` must be specified.
@@ -67080,6 +67816,10 @@ export interface ObservabilityPipelineConfigDestinationHttpClient {
      * HTTP authentication strategy. Valid values are `none`, `basic`, `bearer`.
      */
     authStrategy?: string;
+    /**
+     * Configuration for buffer settings on destination components. Exactly one of `disk` or `memory` must be specified.
+     */
+    buffer?: outputs.ObservabilityPipelineConfigDestinationHttpClientBuffer;
     /**
      * Compression configuration for HTTP requests.
      */
@@ -67109,6 +67849,40 @@ export interface ObservabilityPipelineConfigDestinationHttpClient {
      */
     usernameKey?: string;
 }
+export interface ObservabilityPipelineConfigDestinationHttpClientBuffer {
+    /**
+     * Options for configuring a disk buffer. Cannot be used with `memory`.
+     */
+    disk?: outputs.ObservabilityPipelineConfigDestinationHttpClientBufferDisk;
+    /**
+     * Options for configuring a memory buffer. Cannot be used with `disk`.
+     */
+    memory?: outputs.ObservabilityPipelineConfigDestinationHttpClientBufferMemory;
+}
+export interface ObservabilityPipelineConfigDestinationHttpClientBufferDisk {
+    /**
+     * Maximum size of the disk buffer (in bytes).
+     */
+    maxSize?: number;
+    /**
+     * Behavior when the buffer is full. Valid values are `block` or `dropNewest`. Defaults to `"block"`.
+     */
+    whenFull: string;
+}
+export interface ObservabilityPipelineConfigDestinationHttpClientBufferMemory {
+    /**
+     * Maximum events for the memory buffer.
+     */
+    maxEvents?: number;
+    /**
+     * Maximum size of the memory buffer (in bytes).
+     */
+    maxSize?: number;
+    /**
+     * Behavior when the buffer is full. Valid values are `block` or `dropNewest`. Defaults to `"block"`.
+     */
+    whenFull: string;
+}
 export interface ObservabilityPipelineConfigDestinationHttpClientCompression {
     /**
      * Compression algorithm. Valid values are `gzip`.
@@ -67138,6 +67912,10 @@ export interface ObservabilityPipelineConfigDestinationKafka {
      * Name of the environment variable or secret that holds the Kafka bootstrap servers.
      */
     bootstrapServersKey?: string;
+    /**
+     * Configuration for buffer settings on destination components. Exactly one of `disk` or `memory` must be specified.
+     */
+    buffer?: outputs.ObservabilityPipelineConfigDestinationKafkaBuffer;
     /**
      * Compression codec for Kafka messages. Valid values are `none`, `gzip`, `snappy`, `lz4`, `zstd`.
      */
@@ -67187,6 +67965,40 @@ export interface ObservabilityPipelineConfigDestinationKafka {
      */
     topic: string;
 }
+export interface ObservabilityPipelineConfigDestinationKafkaBuffer {
+    /**
+     * Options for configuring a disk buffer. Cannot be used with `memory`.
+     */
+    disk?: outputs.ObservabilityPipelineConfigDestinationKafkaBufferDisk;
+    /**
+     * Options for configuring a memory buffer. Cannot be used with `disk`.
+     */
+    memory?: outputs.ObservabilityPipelineConfigDestinationKafkaBufferMemory;
+}
+export interface ObservabilityPipelineConfigDestinationKafkaBufferDisk {
+    /**
+     * Maximum size of the disk buffer (in bytes).
+     */
+    maxSize?: number;
+    /**
+     * Behavior when the buffer is full. Valid values are `block` or `dropNewest`. Defaults to `"block"`.
+     */
+    whenFull: string;
+}
+export interface ObservabilityPipelineConfigDestinationKafkaBufferMemory {
+    /**
+     * Maximum events for the memory buffer.
+     */
+    maxEvents?: number;
+    /**
+     * Maximum size of the memory buffer (in bytes).
+     */
+    maxSize?: number;
+    /**
+     * Behavior when the buffer is full. Valid values are `block` or `dropNewest`. Defaults to `"block"`.
+     */
+    whenFull: string;
+}
 export interface ObservabilityPipelineConfigDestinationKafkaLibrdkafkaOption {
     /**
      * The name of the librdkafka configuration option.
@@ -68912,27 +69724,31 @@ export interface ObservabilityPipelineConfigSourceFluentBit {
      */
     addressKey?: string;
     /**
-     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     * Configuration for enabling TLS encryption between the pipeline component and external connecting clients.
      */
     tls?: outputs.ObservabilityPipelineConfigSourceFluentBitTls;
 }
 export interface ObservabilityPipelineConfigSourceFluentBitTls {
     /**
-     * Path to the Certificate Authority (CA) file used to validate the server's TLS certificate.
+     * Path to the Certificate Authority (CA) file used to validate connecting clients' TLS certificates.
      */
     caFile?: string;
     /**
-     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     * Path to the TLS server certificate file used to identify the pipeline component to connecting clients.
      */
     crtFile: string;
     /**
-     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     * Path to the private key file associated with the TLS server certificate.
      */
     keyFile?: string;
     /**
      * Name of the environment variable or secret that holds the passphrase for the private key file.
      */
     keyPassKey?: string;
+    /**
+     * When `true`, requires client connections to present a valid certificate, enabling mutual TLS authentication.
+     */
+    verifyCertificate?: boolean;
 }
 export interface ObservabilityPipelineConfigSourceFluentd {
     /**
@@ -68940,27 +69756,31 @@ export interface ObservabilityPipelineConfigSourceFluentd {
      */
     addressKey?: string;
     /**
-     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     * Configuration for enabling TLS encryption between the pipeline component and external connecting clients.
      */
     tls?: outputs.ObservabilityPipelineConfigSourceFluentdTls;
 }
 export interface ObservabilityPipelineConfigSourceFluentdTls {
     /**
-     * Path to the Certificate Authority (CA) file used to validate the server's TLS certificate.
+     * Path to the Certificate Authority (CA) file used to validate connecting clients' TLS certificates.
      */
     caFile?: string;
     /**
-     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     * Path to the TLS server certificate file used to identify the pipeline component to connecting clients.
      */
     crtFile: string;
     /**
-     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     * Path to the private key file associated with the TLS server certificate.
      */
     keyFile?: string;
     /**
      * Name of the environment variable or secret that holds the passphrase for the private key file.
      */
     keyPassKey?: string;
+    /**
+     * When `true`, requires client connections to present a valid certificate, enabling mutual TLS authentication.
+     */
+    verifyCertificate?: boolean;
 }
 export interface ObservabilityPipelineConfigSourceGooglePubsub {
     /**
@@ -69086,31 +69906,77 @@ export interface ObservabilityPipelineConfigSourceHttpServer {
      */
     passwordKey?: string;
     /**
-     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     * Configuration for enabling TLS encryption between the pipeline component and external connecting clients.
      */
     tls?: outputs.ObservabilityPipelineConfigSourceHttpServerTls;
     /**
      * Name of the environment variable or secret that holds the username.
      */
     usernameKey?: string;
+    /**
+     * A token accepted for authenticating incoming HTTP requests. Cannot be combined with the `plain` auth strategy.
+     */
+    validTokens?: outputs.ObservabilityPipelineConfigSourceHttpServerValidToken[];
 }
 export interface ObservabilityPipelineConfigSourceHttpServerTls {
     /**
-     * Path to the Certificate Authority (CA) file used to validate the server's TLS certificate.
+     * Path to the Certificate Authority (CA) file used to validate connecting clients' TLS certificates.
      */
     caFile?: string;
     /**
-     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     * Path to the TLS server certificate file used to identify the pipeline component to connecting clients.
      */
     crtFile: string;
     /**
-     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     * Path to the private key file associated with the TLS server certificate.
      */
     keyFile?: string;
     /**
      * Name of the environment variable or secret that holds the passphrase for the private key file.
      */
     keyPassKey?: string;
+    /**
+     * When `true`, requires client connections to present a valid certificate, enabling mutual TLS authentication.
+     */
+    verifyCertificate?: boolean;
+}
+export interface ObservabilityPipelineConfigSourceHttpServerValidToken {
+    /**
+     * Whether this token is currently accepted. Defaults to `true`.
+     */
+    enabled: boolean;
+    /**
+     * An optional metadata field attached to every event authenticated by the token. Both `key` and `value` must match `^[A-Za-z0-9_]+$`.
+     */
+    fieldToAdd?: outputs.ObservabilityPipelineConfigSourceHttpServerValidTokenFieldToAdd;
+    /**
+     * Specifies where the worker extracts the token from the incoming HTTP request. Set either `location` for a built-in source or `header` to read it from a request header.
+     */
+    pathToToken?: outputs.ObservabilityPipelineConfigSourceHttpServerValidTokenPathToToken;
+    /**
+     * Name of the environment variable or secret that holds the expected token value.
+     */
+    tokenKey: string;
+}
+export interface ObservabilityPipelineConfigSourceHttpServerValidTokenFieldToAdd {
+    /**
+     * The metadata field name to add to incoming events.
+     */
+    key: string;
+    /**
+     * The metadata field value to add to incoming events.
+     */
+    value: string;
+}
+export interface ObservabilityPipelineConfigSourceHttpServerValidTokenPathToToken {
+    /**
+     * The name of the HTTP header that carries the token.
+     */
+    header?: string;
+    /**
+     * Built-in token location on the incoming HTTP request. One of `path`, `address`. Valid values are `path`, `address`.
+     */
+    location?: string;
 }
 export interface ObservabilityPipelineConfigSourceKafka {
     /**
@@ -69186,27 +70052,31 @@ export interface ObservabilityPipelineConfigSourceLogstash {
      */
     addressKey?: string;
     /**
-     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     * Configuration for enabling TLS encryption between the pipeline component and external connecting clients.
      */
     tls?: outputs.ObservabilityPipelineConfigSourceLogstashTls;
 }
 export interface ObservabilityPipelineConfigSourceLogstashTls {
     /**
-     * Path to the Certificate Authority (CA) file used to validate the server's TLS certificate.
+     * Path to the Certificate Authority (CA) file used to validate connecting clients' TLS certificates.
      */
     caFile?: string;
     /**
-     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     * Path to the TLS server certificate file used to identify the pipeline component to connecting clients.
      */
     crtFile: string;
     /**
-     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     * Path to the private key file associated with the TLS server certificate.
      */
     keyFile?: string;
     /**
      * Name of the environment variable or secret that holds the passphrase for the private key file.
      */
     keyPassKey?: string;
+    /**
+     * When `true`, requires client connections to present a valid certificate, enabling mutual TLS authentication.
+     */
+    verifyCertificate?: boolean;
 }
 export interface ObservabilityPipelineConfigSourceOpentelemetry {
     /**
@@ -69218,27 +70088,31 @@ export interface ObservabilityPipelineConfigSourceOpentelemetry {
      */
     httpAddressKey?: string;
     /**
-     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     * Configuration for enabling TLS encryption between the pipeline component and external connecting clients.
      */
     tls?: outputs.ObservabilityPipelineConfigSourceOpentelemetryTls;
 }
 export interface ObservabilityPipelineConfigSourceOpentelemetryTls {
     /**
-     * Path to the Certificate Authority (CA) file used to validate the server's TLS certificate.
+     * Path to the Certificate Authority (CA) file used to validate connecting clients' TLS certificates.
      */
     caFile?: string;
     /**
-     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     * Path to the TLS server certificate file used to identify the pipeline component to connecting clients.
      */
     crtFile: string;
     /**
-     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     * Path to the private key file associated with the TLS server certificate.
      */
     keyFile?: string;
     /**
      * Name of the environment variable or secret that holds the passphrase for the private key file.
      */
     keyPassKey?: string;
+    /**
+     * When `true`, requires client connections to present a valid certificate, enabling mutual TLS authentication.
+     */
+    verifyCertificate?: boolean;
 }
 export interface ObservabilityPipelineConfigSourceRsyslog {
     /**
@@ -69250,27 +70124,31 @@ export interface ObservabilityPipelineConfigSourceRsyslog {
      */
     mode?: string;
     /**
-     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     * Configuration for enabling TLS encryption between the pipeline component and external connecting clients.
      */
     tls?: outputs.ObservabilityPipelineConfigSourceRsyslogTls;
 }
 export interface ObservabilityPipelineConfigSourceRsyslogTls {
     /**
-     * Path to the Certificate Authority (CA) file used to validate the server's TLS certificate.
+     * Path to the Certificate Authority (CA) file used to validate connecting clients' TLS certificates.
      */
     caFile?: string;
     /**
-     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     * Path to the TLS server certificate file used to identify the pipeline component to connecting clients.
      */
     crtFile: string;
     /**
-     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     * Path to the private key file associated with the TLS server certificate.
      */
     keyFile?: string;
     /**
      * Name of the environment variable or secret that holds the passphrase for the private key file.
      */
     keyPassKey?: string;
+    /**
+     * When `true`, requires client connections to present a valid certificate, enabling mutual TLS authentication.
+     */
+    verifyCertificate?: boolean;
 }
 export interface ObservabilityPipelineConfigSourceSocket {
     /**
@@ -69286,7 +70164,7 @@ export interface ObservabilityPipelineConfigSourceSocket {
      */
     mode: string;
     /**
-     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     * Configuration for enabling TLS encryption between the pipeline component and external connecting clients.
      */
     tls?: outputs.ObservabilityPipelineConfigSourceSocketTls;
 }
@@ -69308,21 +70186,25 @@ export interface ObservabilityPipelineConfigSourceSocketFramingCharacterDelimite
 }
 export interface ObservabilityPipelineConfigSourceSocketTls {
     /**
-     * Path to the Certificate Authority (CA) file used to validate the server's TLS certificate.
+     * Path to the Certificate Authority (CA) file used to validate connecting clients' TLS certificates.
      */
     caFile?: string;
     /**
-     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     * Path to the TLS server certificate file used to identify the pipeline component to connecting clients.
      */
     crtFile: string;
     /**
-     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     * Path to the private key file associated with the TLS server certificate.
      */
     keyFile?: string;
     /**
      * Name of the environment variable or secret that holds the passphrase for the private key file.
      */
     keyPassKey?: string;
+    /**
+     * When `true`, requires client connections to present a valid certificate, enabling mutual TLS authentication.
+     */
+    verifyCertificate?: boolean;
 }
 export interface ObservabilityPipelineConfigSourceSplunkHec {
     /**
@@ -69334,27 +70216,59 @@ export interface ObservabilityPipelineConfigSourceSplunkHec {
      */
     storeHecToken?: boolean;
     /**
-     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     * Configuration for enabling TLS encryption between the pipeline component and external connecting clients.
      */
     tls?: outputs.ObservabilityPipelineConfigSourceSplunkHecTls;
+    /**
+     * A HEC token accepted for authenticating incoming Splunk HEC requests.
+     */
+    validTokens?: outputs.ObservabilityPipelineConfigSourceSplunkHecValidToken[];
 }
 export interface ObservabilityPipelineConfigSourceSplunkHecTls {
     /**
-     * Path to the Certificate Authority (CA) file used to validate the server's TLS certificate.
+     * Path to the Certificate Authority (CA) file used to validate connecting clients' TLS certificates.
      */
     caFile?: string;
     /**
-     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     * Path to the TLS server certificate file used to identify the pipeline component to connecting clients.
      */
     crtFile: string;
     /**
-     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     * Path to the private key file associated with the TLS server certificate.
      */
     keyFile?: string;
     /**
      * Name of the environment variable or secret that holds the passphrase for the private key file.
      */
     keyPassKey?: string;
+    /**
+     * When `true`, requires client connections to present a valid certificate, enabling mutual TLS authentication.
+     */
+    verifyCertificate?: boolean;
+}
+export interface ObservabilityPipelineConfigSourceSplunkHecValidToken {
+    /**
+     * Whether this token is currently accepted. Defaults to `true`.
+     */
+    enabled: boolean;
+    /**
+     * An optional metadata field attached to every event authenticated by the token. Both `key` and `value` must match `^[A-Za-z0-9_]+$`.
+     */
+    fieldToAdd?: outputs.ObservabilityPipelineConfigSourceSplunkHecValidTokenFieldToAdd;
+    /**
+     * Name of the environment variable or secret that holds the expected HEC token value.
+     */
+    tokenKey: string;
+}
+export interface ObservabilityPipelineConfigSourceSplunkHecValidTokenFieldToAdd {
+    /**
+     * The metadata field name to add to incoming events.
+     */
+    key: string;
+    /**
+     * The metadata field value to add to incoming events.
+     */
+    value: string;
 }
 export interface ObservabilityPipelineConfigSourceSplunkTcp {
     /**
@@ -69362,27 +70276,31 @@ export interface ObservabilityPipelineConfigSourceSplunkTcp {
      */
     addressKey?: string;
     /**
-     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     * Configuration for enabling TLS encryption between the pipeline component and external connecting clients.
      */
     tls?: outputs.ObservabilityPipelineConfigSourceSplunkTcpTls;
 }
 export interface ObservabilityPipelineConfigSourceSplunkTcpTls {
     /**
-     * Path to the Certificate Authority (CA) file used to validate the server's TLS certificate.
+     * Path to the Certificate Authority (CA) file used to validate connecting clients' TLS certificates.
      */
     caFile?: string;
     /**
-     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     * Path to the TLS server certificate file used to identify the pipeline component to connecting clients.
      */
     crtFile: string;
     /**
-     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     * Path to the private key file associated with the TLS server certificate.
      */
     keyFile?: string;
     /**
      * Name of the environment variable or secret that holds the passphrase for the private key file.
      */
     keyPassKey?: string;
+    /**
+     * When `true`, requires client connections to present a valid certificate, enabling mutual TLS authentication.
+     */
+    verifyCertificate?: boolean;
 }
 export interface ObservabilityPipelineConfigSourceSumoLogic {
     /**
@@ -69400,27 +70318,31 @@ export interface ObservabilityPipelineConfigSourceSyslogNg {
      */
     mode?: string;
     /**
-     * Configuration for enabling TLS encryption between the pipeline component and external services.
+     * Configuration for enabling TLS encryption between the pipeline component and external connecting clients.
      */
     tls?: outputs.ObservabilityPipelineConfigSourceSyslogNgTls;
 }
 export interface ObservabilityPipelineConfigSourceSyslogNgTls {
     /**
-     * Path to the Certificate Authority (CA) file used to validate the server's TLS certificate.
+     * Path to the Certificate Authority (CA) file used to validate connecting clients' TLS certificates.
      */
     caFile?: string;
     /**
-     * Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services.
+     * Path to the TLS server certificate file used to identify the pipeline component to connecting clients.
      */
     crtFile: string;
     /**
-     * Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication.
+     * Path to the private key file associated with the TLS server certificate.
      */
     keyFile?: string;
     /**
      * Name of the environment variable or secret that holds the passphrase for the private key file.
      */
     keyPassKey?: string;
+    /**
+     * When `true`, requires client connections to present a valid certificate, enabling mutual TLS authentication.
+     */
+    verifyCertificate?: boolean;
 }
 export interface OnCallEscalationPolicyStep {
     /**
@@ -123672,6 +124594,10 @@ export interface SecurityMonitoringRuleOptionsImpossibleTravelOptions {
      * If true, signals are suppressed for the first 24 hours. During that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access. Defaults to `false`.
      */
     baselineUserLocations: boolean;
+    /**
+     * The duration in days during which Datadog learns a user's access locations before generating signals. Only applicable when `baselineUserLocations` is `true`. Defaults to `1` if unset. . Value must be between 1 and 30.
+     */
+    baselineUserLocationsDuration: number;
 }
 export interface SecurityMonitoringRuleOptionsNewValueOptions {
     /**
@@ -124283,7 +125209,7 @@ export interface SyntheticsTestApiStep {
      */
     subtestPublicId?: string;
     /**
-     * The subtype of the Synthetic multistep API test step. Valid values are `http`, `grpc`, `ssl`, `dns`, `tcp`, `udp`, `icmp`, `websocket`, `wait`, `playSubTest`. Defaults to `"http"`.
+     * The subtype of the Synthetic multistep API test step. Valid values are `http`, `grpc`, `ssl`, `dns`, `tcp`, `udp`, `icmp`, `websocket`, `mcp`, `wait`, `playSubTest`. Defaults to `"http"`.
      */
     subtype?: string;
     /**
@@ -124308,6 +125234,10 @@ export interface SyntheticsTestApiStepAssertion {
      * Expected value. **Note:** Depends on the assertion type. Refer to `config.assertions` in the [Datadog API reference](https://docs.datadoghq.com/api/latest/synthetics/#create-an-api-test).
      */
     target?: string;
+    /**
+     * Expected MCP server capabilities if `type` is `mcpServerCapabilities`. Exactly one nested block is allowed with the structure below.
+     */
+    targetMcpCapabilities?: outputs.SyntheticsTestApiStepAssertionTargetMcpCapabilities;
     /**
      * Expected structure if `operator` is `validatesJSONPath`. Exactly one nested block is allowed with the structure below.
      */
@@ -124325,10 +125255,16 @@ export interface SyntheticsTestApiStepAssertion {
      */
     timingsScope?: string;
     /**
-     * Type of assertion. **Note:** Only some combinations of `type` and `operator` are valid. For API tests, refer to `config.assertions` in the [Datadog API reference](https://docs.datadoghq.com/api/latest/synthetics/#create-an-api-test). For Network Path tests, refer to `config.assertions` in the [Datadog API reference](https://docs.datadoghq.com/api/latest/synthetics/#create-a-network-path-test). Valid values are `body`, `header`, `statusCode`, `certificate`, `responseTime`, `property`, `recordEvery`, `recordSome`, `tlsVersion`, `minTlsVersion`, `latency`, `packetLossPercentage`, `packetsReceived`, `networkHop`, `receivedMessage`, `grpcHealthcheckStatus`, `grpcMetadata`, `grpcProto`, `connection`, `multiNetworkHop`, `jitter`, `bodyHash`, `javascript`.
+     * Type of assertion. **Note:** Only some combinations of `type` and `operator` are valid. For API tests, refer to `config.assertions` in the [Datadog API reference](https://docs.datadoghq.com/api/latest/synthetics/#create-an-api-test). For Network Path tests, refer to `config.assertions` in the [Datadog API reference](https://docs.datadoghq.com/api/latest/synthetics/#create-a-network-path-test). Valid values are `body`, `header`, `statusCode`, `certificate`, `responseTime`, `property`, `recordEvery`, `recordSome`, `tlsVersion`, `minTlsVersion`, `latency`, `packetLossPercentage`, `packetsReceived`, `networkHop`, `receivedMessage`, `grpcHealthcheckStatus`, `grpcMetadata`, `grpcProto`, `connection`, `multiNetworkHop`, `jitter`, `mcpToolNameLength`, `mcpToolCount`, `bodyHash`, `javascript`, `mcpRespectsSpecification`, `mcpServerCapabilities`.
      */
     type: string;
 }
+export interface SyntheticsTestApiStepAssertionTargetMcpCapabilities {
+    /**
+     * List of MCP server capabilities to assert against.
+     */
+    capabilities: string[];
+}
 export interface SyntheticsTestApiStepAssertionTargetjsonpath {
     /**
      * The element from the list of results to assert on. Select from `firstElementMatches` (the first element in the list), `everyElementMatches` (every element in the list), `atLeastOneElementMatches` (at least one element in the list), or `serializationMatches` (the serialized value of the list). Defaults to `"firstElementMatches"`.
@@ -124509,7 +125445,7 @@ export interface SyntheticsTestApiStepRequestDefinition {
      */
     bodyType?: string;
     /**
-     * The type of gRPC call to perform. Valid values are `healthcheck`, `unary`.
+     * The type of gRPC call to perform, or the MCP step call (`init`, `toolList`, `toolCall`). Valid values are `healthcheck`, `unary`, `init`, `toolList`, `toolCall`.
      */
     callType?: string;
     /**
@@ -124566,6 +125502,10 @@ export interface SyntheticsTestApiStepRequestDefinition {
      * For Network Path tests, the maximum time-to-live (max number of hops) used in outgoing probe packets.
      */
     maxTtl?: number;
+    /**
+     * For MCP API steps, the MCP protocol version used by the request.
+     */
+    mcpProtocolVersion?: string;
     /**
      * For gRPC, UDP, and Websocket tests, message to send with the request.
      */
@@ -124624,6 +125564,14 @@ export interface SyntheticsTestApiStepRequestDefinition {
      * Timeout in seconds for the test.
      */
     timeout?: number;
+    /**
+     * For MCP API steps, the JSON-encoded arguments to pass to the tool when `callType` is `toolCall`.
+     */
+    toolArgs?: string;
+    /**
+     * For MCP API steps, the name of the tool to call. Required when `callType` is `toolCall`.
+     */
+    toolName?: string;
     /**
      * For Network Path tests, the number of traceroute path tracings.
      */
@@ -124702,6 +125650,10 @@ export interface SyntheticsTestAssertion {
      * Expected value. **Note:** Depends on the assertion type. Refer to `config.assertions` in the [Datadog API reference](https://docs.datadoghq.com/api/latest/synthetics/#create-an-api-test).
      */
     target?: string;
+    /**
+     * Expected MCP server capabilities if `type` is `mcpServerCapabilities`. Exactly one nested block is allowed with the structure below.
+     */
+    targetMcpCapabilities?: outputs.SyntheticsTestAssertionTargetMcpCapabilities;
     /**
      * Expected structure if `operator` is `validatesJSONPath`. Exactly one nested block is allowed with the structure below.
      */
@@ -124719,10 +125671,16 @@ export interface SyntheticsTestAssertion {
      */
     timingsScope?: string;
     /**
-     * Type of assertion. **Note:** Only some combinations of `type` and `operator` are valid. For API tests, refer to `config.assertions` in the [Datadog API reference](https://docs.datadoghq.com/api/latest/synthetics/#create-an-api-test). For Network Path tests, refer to `config.assertions` in the [Datadog API reference](https://docs.datadoghq.com/api/latest/synthetics/#create-a-network-path-test). Valid values are `body`, `header`, `statusCode`, `certificate`, `responseTime`, `property`, `recordEvery`, `recordSome`, `tlsVersion`, `minTlsVersion`, `latency`, `packetLossPercentage`, `packetsReceived`, `networkHop`, `receivedMessage`, `grpcHealthcheckStatus`, `grpcMetadata`, `grpcProto`, `connection`, `multiNetworkHop`, `jitter`, `bodyHash`, `javascript`.
+     * Type of assertion. **Note:** Only some combinations of `type` and `operator` are valid. For API tests, refer to `config.assertions` in the [Datadog API reference](https://docs.datadoghq.com/api/latest/synthetics/#create-an-api-test). For Network Path tests, refer to `config.assertions` in the [Datadog API reference](https://docs.datadoghq.com/api/latest/synthetics/#create-a-network-path-test). Valid values are `body`, `header`, `statusCode`, `certificate`, `responseTime`, `property`, `recordEvery`, `recordSome`, `tlsVersion`, `minTlsVersion`, `latency`, `packetLossPercentage`, `packetsReceived`, `networkHop`, `receivedMessage`, `grpcHealthcheckStatus`, `grpcMetadata`, `grpcProto`, `connection`, `multiNetworkHop`, `jitter`, `mcpToolNameLength`, `mcpToolCount`, `bodyHash`, `javascript`, `mcpRespectsSpecification`, `mcpServerCapabilities`.
      */
     type: string;
 }
+export interface SyntheticsTestAssertionTargetMcpCapabilities {
+    /**
+     * List of MCP server capabilities to assert against.
+     */
+    capabilities: string[];
+}
 export interface SyntheticsTestAssertionTargetjsonpath {
     /**
      * The element from the list of results to assert on. Select from `firstElementMatches` (the first element in the list), `everyElementMatches` (every element in the list), `atLeastOneElementMatches` (at least one element in the list), or `serializationMatches` (the serialized value of the list). Defaults to `"firstElementMatches"`.
@@ -125528,7 +126486,7 @@ export interface SyntheticsTestRequestDefinition {
      */
     bodyType?: string;
     /**
-     * The type of gRPC call to perform. Valid values are `healthcheck`, `unary`.
+     * The type of gRPC call to perform, or the MCP step call (`init`, `toolList`, `toolCall`). Valid values are `healthcheck`, `unary`, `init`, `toolList`, `toolCall`.
      */
     callType?: string;
     /**
@@ -125575,6 +126533,10 @@ export interface SyntheticsTestRequestDefinition {
      * For Network Path tests, the maximum time-to-live (max number of hops) used in outgoing probe packets.
      */
     maxTtl?: number;
+    /**
+     * For MCP API steps, the MCP protocol version used by the request.
+     */
+    mcpProtocolVersion?: string;
     /**
      * For gRPC, UDP, and Websocket tests, message to send with the request.
      */
@@ -125633,6 +126595,14 @@ export interface SyntheticsTestRequestDefinition {
      * Timeout in seconds for the test.
      */
     timeout?: number;
+    /**
+     * For MCP API steps, the JSON-encoded arguments to pass to the tool when `callType` is `toolCall`.
+     */
+    toolArgs?: string;
+    /**
+     * For MCP API steps, the name of the tool to call. Required when `callType` is `toolCall`.
+     */
+    toolName?: string;
     /**
      * For Network Path tests, the number of traceroute path tracings.
      */
@@ -125924,6 +126894,31 @@ export declare namespace aws {
          */
         includeOnlies?: string[];
     }
+    interface IntegrationAccountCcmConfigCcmConfig {
+        dataExportConfigs?: outputs.aws.IntegrationAccountCcmConfigCcmConfigDataExportConfig[];
+    }
+    interface IntegrationAccountCcmConfigCcmConfigDataExportConfig {
+        /**
+         * Name of the S3 bucket where the Cost and Usage Report is stored.
+         */
+        bucketName?: string;
+        /**
+         * AWS region of the S3 bucket.
+         */
+        bucketRegion?: string;
+        /**
+         * Name of the Cost and Usage Report.
+         */
+        reportName?: string;
+        /**
+         * S3 prefix where the Cost and Usage Report is stored.
+         */
+        reportPrefix?: string;
+        /**
+         * Type of the Cost and Usage Report.
+         */
+        reportType?: string;
+    }
     interface IntegrationAccountLogsConfig {
         /**
          * Leave empty to omit logs config.
@@ -126049,56 +127044,6 @@ export declare namespace config {
         };
     }
 }
-export declare namespace databricks {
-    interface IntegrationAccountAuthConfig {
-        /**
-         * OAuth (service principal) authentication. Recommended for new deployments. `clientId`, `clientSecret`, and `databricksAccountId` must be provided together.
-         */
-        oauth?: outputs.databricks.IntegrationAccountAuthConfigOauth;
-        /**
-         * Personal Access Token authentication. Deprecated in favor of `oauth`; kept for backwards compatibility.
-         */
-        pat?: outputs.databricks.IntegrationAccountAuthConfigPat;
-    }
-    interface IntegrationAccountAuthConfigOauth {
-        /**
-         * Azure Tenant ID (UUID format) for authenticating via Microsoft Entra ID. Only set when using Azure Entra ID OAuth.
-         */
-        azureTenantId?: string;
-        /**
-         * OAuth Client ID for the Databricks service principal.
-         */
-        clientId?: string;
-        /**
-         * OAuth Client Secret for the Databricks service principal. This value is write-only; changes made outside of Terraform will not be drift-detected.
-         */
-        clientSecret?: string;
-        /**
-         * Databricks Account ID (UUID format). Found in your Databricks profile in the upper-right corner.
-         */
-        databricksAccountId?: string;
-    }
-    interface IntegrationAccountAuthConfigPat {
-        /**
-         * Databricks Personal Access Token (PAT). Generate from Settings > Developer > Access tokens. This value is write-only; changes made outside of Terraform will not be drift-detected.
-         */
-        token?: string;
-    }
-    interface IntegrationAccountPrivateActionRunnerConfiguration {
-        /**
-         * Private Action Runner connection ID.
-         */
-        connectionId?: string;
-        /**
-         * Path to the stored secret holding Databricks credentials inside the Private Action Runner.
-         */
-        secretPath?: string;
-        /**
-         * Service Account UUID used to execute Private Action Runner actions.
-         */
-        userUuid?: string;
-    }
-}
 export declare namespace gcp {
     interface IntegrationMonitoredResourceConfig {
         filters: string[];