diff --git a/.apigentools-info b/.apigentools-info
index 97cf1394ea32..a89b0e858ab5 100644
--- a/.apigentools-info
+++ b/.apigentools-info
@@ -4,13 +4,13 @@
     "spec_versions": {
         "v1": {
             "apigentools_version": "1.6.2",
-            "regenerated": "2022-07-19 16:28:25.621288",
-            "spec_repo_commit": "448d6aae"
+            "regenerated": "2022-07-20 11:53:28.416228",
+            "spec_repo_commit": "a82be8f8"
         },
         "v2": {
             "apigentools_version": "1.6.2",
-            "regenerated": "2022-07-19 16:28:25.640110",
-            "spec_repo_commit": "448d6aae"
+            "regenerated": "2022-07-20 11:53:28.429749",
+            "spec_repo_commit": "a82be8f8"
         }
     }
 }
\ No newline at end of file
diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml
index dce734d240dc..0783e1106125 100644
--- a/.generator/schemas/v2/openapi.yaml
+++ b/.generator/schemas/v2/openapi.yaml
@@ -6669,6 +6669,13 @@ components:
 
             aggregations.'
           type: string
+        metrics:
+          description: Group of target fields to aggregate over when using the new
+            value aggregations.
+          items:
+            description: Field.
+            type: string
+          type: array
         name:
           description: Name of the query.
           type: string
@@ -6715,6 +6722,13 @@ components:
 
             aggregations.'
           type: string
+        metrics:
+          description: Group of target fields to aggregate over when using the new
+            value aggregations.
+          items:
+            description: Field.
+            type: string
+          type: array
         name:
           description: Name of the query.
           type: string
diff --git a/examples/v2/security-monitoring/UpdateSecurityMonitoringRule.rb b/examples/v2/security-monitoring/UpdateSecurityMonitoringRule.rb
index 904f6b410395..8df2cdecb87d 100644
--- a/examples/v2/security-monitoring/UpdateSecurityMonitoringRule.rb
+++ b/examples/v2/security-monitoring/UpdateSecurityMonitoringRule.rb
@@ -38,6 +38,7 @@
       aggregation: DatadogAPIClient::V2::SecurityMonitoringRuleQueryAggregation::COUNT,
       distinct_fields: [],
       group_by_fields: [],
+      metrics: [],
     }),
   ],
   tags: [],
diff --git a/features/v2/security_monitoring.feature b/features/v2/security_monitoring.feature
index cf7388bcb541..b08bad9ca1f4 100644
--- a/features/v2/security_monitoring.feature
+++ b/features/v2/security_monitoring.feature
@@ -298,7 +298,7 @@ Feature: Security Monitoring
   Scenario: Update an existing rule returns "Bad Request" response
     Given new "UpdateSecurityMonitoringRule" request
     And request contains "rule_id" parameter from "REPLACE.ME"
-    And body with value {"cases": [{"notifications": [], "status": "critical"}], "filters": [{"action": "require"}], "hasExtendedTitle": true, "options": {"decreaseCriticalityBasedOnEnv": false, "detectionMethod": "threshold", "evaluationWindow": 0, "hardcodedEvaluatorType": "log4shell", "impossibleTravelOptions": {"baselineUserLocations": true}, "keepAlive": 0, "maxSignalDuration": 0, "newValueOptions": {"forgetAfter": 1, "learningDuration": 0, "learningMethod": "duration", "learningThreshold": 0}}, "queries": [{"aggregation": "count", "distinctFields": [], "groupByFields": []}], "tags": [], "version": 1}
+    And body with value {"cases": [{"notifications": [], "status": "critical"}], "filters": [{"action": "require"}], "hasExtendedTitle": true, "options": {"decreaseCriticalityBasedOnEnv": false, "detectionMethod": "threshold", "evaluationWindow": 0, "hardcodedEvaluatorType": "log4shell", "impossibleTravelOptions": {"baselineUserLocations": true}, "keepAlive": 0, "maxSignalDuration": 0, "newValueOptions": {"forgetAfter": 1, "learningDuration": 0, "learningMethod": "duration", "learningThreshold": 0}}, "queries": [{"aggregation": "count", "distinctFields": [], "groupByFields": [], "metrics": []}], "tags": [], "version": 1}
     When the request is sent
     Then the response status is 400 Bad Request
 
@@ -306,7 +306,7 @@ Feature: Security Monitoring
   Scenario: Update an existing rule returns "Not Found" response
     Given new "UpdateSecurityMonitoringRule" request
     And request contains "rule_id" parameter from "REPLACE.ME"
-    And body with value {"cases": [{"notifications": [], "status": "critical"}], "filters": [{"action": "require"}], "hasExtendedTitle": true, "options": {"decreaseCriticalityBasedOnEnv": false, "detectionMethod": "threshold", "evaluationWindow": 0, "hardcodedEvaluatorType": "log4shell", "impossibleTravelOptions": {"baselineUserLocations": true}, "keepAlive": 0, "maxSignalDuration": 0, "newValueOptions": {"forgetAfter": 1, "learningDuration": 0, "learningMethod": "duration", "learningThreshold": 0}}, "queries": [{"aggregation": "count", "distinctFields": [], "groupByFields": []}], "tags": [], "version": 1}
+    And body with value {"cases": [{"notifications": [], "status": "critical"}], "filters": [{"action": "require"}], "hasExtendedTitle": true, "options": {"decreaseCriticalityBasedOnEnv": false, "detectionMethod": "threshold", "evaluationWindow": 0, "hardcodedEvaluatorType": "log4shell", "impossibleTravelOptions": {"baselineUserLocations": true}, "keepAlive": 0, "maxSignalDuration": 0, "newValueOptions": {"forgetAfter": 1, "learningDuration": 0, "learningMethod": "duration", "learningThreshold": 0}}, "queries": [{"aggregation": "count", "distinctFields": [], "groupByFields": [], "metrics": []}], "tags": [], "version": 1}
     When the request is sent
     Then the response status is 404 Not Found
 
@@ -314,6 +314,6 @@ Feature: Security Monitoring
   Scenario: Update an existing rule returns "OK" response
     Given new "UpdateSecurityMonitoringRule" request
     And request contains "rule_id" parameter from "REPLACE.ME"
-    And body with value {"cases": [{"notifications": [], "status": "critical"}], "filters": [{"action": "require"}], "hasExtendedTitle": true, "options": {"decreaseCriticalityBasedOnEnv": false, "detectionMethod": "threshold", "evaluationWindow": 0, "hardcodedEvaluatorType": "log4shell", "impossibleTravelOptions": {"baselineUserLocations": true}, "keepAlive": 0, "maxSignalDuration": 0, "newValueOptions": {"forgetAfter": 1, "learningDuration": 0, "learningMethod": "duration", "learningThreshold": 0}}, "queries": [{"aggregation": "count", "distinctFields": [], "groupByFields": []}], "tags": [], "version": 1}
+    And body with value {"cases": [{"notifications": [], "status": "critical"}], "filters": [{"action": "require"}], "hasExtendedTitle": true, "options": {"decreaseCriticalityBasedOnEnv": false, "detectionMethod": "threshold", "evaluationWindow": 0, "hardcodedEvaluatorType": "log4shell", "impossibleTravelOptions": {"baselineUserLocations": true}, "keepAlive": 0, "maxSignalDuration": 0, "newValueOptions": {"forgetAfter": 1, "learningDuration": 0, "learningMethod": "duration", "learningThreshold": 0}}, "queries": [{"aggregation": "count", "distinctFields": [], "groupByFields": [], "metrics": []}], "tags": [], "version": 1}
     When the request is sent
     Then the response status is 200 OK
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_rule_query.rb b/lib/datadog_api_client/v2/models/security_monitoring_rule_query.rb
index 4e47a9f49494..a2a4b4d878e8 100644
--- a/lib/datadog_api_client/v2/models/security_monitoring_rule_query.rb
+++ b/lib/datadog_api_client/v2/models/security_monitoring_rule_query.rb
@@ -38,6 +38,9 @@ class SecurityMonitoringRuleQuery
     # aggregations.
     attr_accessor :metric
 
+    # Group of target fields to aggregate over when using the new value aggregations.
+    attr_accessor :metrics
+
     # Name of the query.
     attr_accessor :name
 
@@ -52,6 +55,7 @@ def self.attribute_map
         :'distinct_fields' => :'distinctFields',
         :'group_by_fields' => :'groupByFields',
         :'metric' => :'metric',
+        :'metrics' => :'metrics',
         :'name' => :'name',
         :'query' => :'query'
       }
@@ -71,6 +75,7 @@ def self.openapi_types
         :'distinct_fields' => :'Array<String>',
         :'group_by_fields' => :'Array<String>',
         :'metric' => :'String',
+        :'metrics' => :'Array<String>',
         :'name' => :'String',
         :'query' => :'String'
       }
@@ -119,6 +124,12 @@ def initialize(attributes = {})
         self.metric = attributes[:'metric']
       end
 
+      if attributes.key?(:'metrics')
+        if (value = attributes[:'metrics']).is_a?(Array)
+          self.metrics = value
+        end
+      end
+
       if attributes.key?(:'name')
         self.name = attributes[:'name']
       end
@@ -145,6 +156,7 @@ def ==(o)
           distinct_fields == o.distinct_fields &&
           group_by_fields == o.group_by_fields &&
           metric == o.metric &&
+          metrics == o.metrics &&
           name == o.name &&
           query == o.query
     end
@@ -160,7 +172,7 @@ def eql?(o)
     # @return [Integer] Hash code
     # @!visibility private
     def hash
-      [aggregation, distinct_fields, group_by_fields, metric, name, query].hash
+      [aggregation, distinct_fields, group_by_fields, metric, metrics, name, query].hash
     end
   end
 end
diff --git a/lib/datadog_api_client/v2/models/security_monitoring_rule_query_create.rb b/lib/datadog_api_client/v2/models/security_monitoring_rule_query_create.rb
index bba4b7658eb0..21c6696c5dcf 100644
--- a/lib/datadog_api_client/v2/models/security_monitoring_rule_query_create.rb
+++ b/lib/datadog_api_client/v2/models/security_monitoring_rule_query_create.rb
@@ -38,6 +38,9 @@ class SecurityMonitoringRuleQueryCreate
     # aggregations.
     attr_accessor :metric
 
+    # Group of target fields to aggregate over when using the new value aggregations.
+    attr_accessor :metrics
+
     # Name of the query.
     attr_accessor :name
 
@@ -52,6 +55,7 @@ def self.attribute_map
         :'distinct_fields' => :'distinctFields',
         :'group_by_fields' => :'groupByFields',
         :'metric' => :'metric',
+        :'metrics' => :'metrics',
         :'name' => :'name',
         :'query' => :'query'
       }
@@ -71,6 +75,7 @@ def self.openapi_types
         :'distinct_fields' => :'Array<String>',
         :'group_by_fields' => :'Array<String>',
         :'metric' => :'String',
+        :'metrics' => :'Array<String>',
         :'name' => :'String',
         :'query' => :'String'
       }
@@ -119,6 +124,12 @@ def initialize(attributes = {})
         self.metric = attributes[:'metric']
       end
 
+      if attributes.key?(:'metrics')
+        if (value = attributes[:'metrics']).is_a?(Array)
+          self.metrics = value
+        end
+      end
+
       if attributes.key?(:'name')
         self.name = attributes[:'name']
       end
@@ -156,6 +167,7 @@ def ==(o)
           distinct_fields == o.distinct_fields &&
           group_by_fields == o.group_by_fields &&
           metric == o.metric &&
+          metrics == o.metrics &&
           name == o.name &&
           query == o.query
     end
@@ -171,7 +183,7 @@ def eql?(o)
     # @return [Integer] Hash code
     # @!visibility private
     def hash
-      [aggregation, distinct_fields, group_by_fields, metric, name, query].hash
+      [aggregation, distinct_fields, group_by_fields, metric, metrics, name, query].hash
     end
   end
 end