@@ -1140,9 +1140,9 @@ components:
11401140 schema:
11411141 type: string
11421142 PersonalAccessTokenID:
1143- description: The UUID of the personal access token.
1143+ description: The ID of the personal access token.
11441144 in: path
1145- name: pat_uuid
1145+ name: pat_id
11461146 required: true
11471147 schema:
11481148 example: "00000000-0000-1234-0000-000000000000"
@@ -29180,11 +29180,6 @@ components:
2918029180 FullPersonalAccessTokenAttributes:
2918129181 description: Attributes of a full personal access token, including the token key.
2918229182 properties:
29183- alias:
29184- description: The alias (short identifier) of the personal access token.
29185- example: "2H9MCNMBM8FQjQ16YucXkX"
29186- readOnly: true
29187- type: string
2918829183 created_at:
2918929184 description: Creation date of the personal access token.
2919029185 example: "2024-01-01T00:00:00+00:00"
@@ -53415,11 +53410,6 @@ components:
5341553410 PersonalAccessTokenAttributes:
5341653411 description: Attributes of a personal access token.
5341753412 properties:
53418- alias:
53419- description: The alias (short identifier) of the personal access token.
53420- example: "2H9MCNMBM8FQjQ16YucXkX"
53421- readOnly: true
53422- type: string
5342353413 created_at:
5342453414 description: Creation date of the personal access token.
5342553415 example: "2024-01-01T00:00:00+00:00"
@@ -62654,23 +62644,19 @@ components:
6265462644 - DONE
6265562645 - TIMEOUT
6265662646 SecurityMonitoringContentPackActivation:
62657- description: The activation status of a content pack.
62647+ description: The activation status of a content pack
6265862648 enum:
6265962649 - never_activated
6266062650 - activated
6266162651 - deactivated
6266262652 example: activated
6266362653 type: string
62664- x-enum-descriptions:
62665- - Pack has never been activated for this organization.
62666- - Pack is currently activated.
62667- - Pack was previously activated but has since been deactivated.
6266862654 x-enum-varnames:
6266962655 - NEVER_ACTIVATED
6267062656 - ACTIVATED
6267162657 - DEACTIVATED
6267262658 SecurityMonitoringContentPackIntegrationStatus:
62673- description: The installation status of the related integration.
62659+ description: The installation status of the related integration
6267462660 enum:
6267562661 - installed
6267662662 - available
@@ -62679,12 +62665,6 @@ components:
6267962665 - error
6268062666 example: installed
6268162667 type: string
62682- x-enum-descriptions:
62683- - Integration is fully installed.
62684- - Integration exists in the catalog but is not installed.
62685- - Integration is only partially configured.
62686- - Integration detected (for example, logs are flowing) but not explicitly installed.
62687- - Integration is in an error state.
6268862668 x-enum-varnames:
6268962669 - INSTALLED
6269062670 - AVAILABLE
@@ -62701,17 +62681,15 @@ components:
6270162681 cp_activation:
6270262682 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
6270362683 filters_configured_for_logs:
62704- description: |-
62705- Whether filters (Security Filters or Index Query depending on the pricing model) are
62706- present and correctly configured to route logs into Cloud SIEM.
62684+ description: Whether filters (Security Filters or Index Query depending on the pricing model) are configured for logs
6270762685 example: true
6270862686 type: boolean
6270962687 integration_installed_status:
6271062688 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
6271162689 logs_last_collected:
6271262690 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
6271362691 logs_seen_from_any_index:
62714- description: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
62692+ description: Whether logs have been seen from any index
6271562693 example: true
6271662694 type: boolean
6271762695 state:
@@ -62776,7 +62754,7 @@ components:
6277662754 - meta
6277762755 type: object
6277862756 SecurityMonitoringContentPackStatus:
62779- description: The current operational status of a content pack.
62757+ description: The current status of a content pack
6278062758 enum:
6278162759 - install
6278262760 - activate
@@ -62786,13 +62764,6 @@ components:
6278662764 - broken
6278762765 example: active
6278862766 type: string
62789- x-enum-descriptions:
62790- - Not activated; no logs detected in the last 72 hours.
62791- - Not activated; logs are flowing into a Datadog index but not yet routed through Cloud SIEM.
62792- - Activated; awaiting first log ingestion.
62793- - Activated; logs received within the last 24 hours.
62794- - Activated; integration not installed or logs last seen 24 to 72 hours ago.
62795- - Activated; no logs for over 72 hours, filter missing, or Cloud SIEM index incorrectly ordered.
6279662767 x-enum-varnames:
6279762768 - INSTALL
6279862769 - ACTIVATE
@@ -62801,7 +62772,7 @@ components:
6280162772 - WARNING
6280262773 - BROKEN
6280362774 SecurityMonitoringContentPackTimestampBucket:
62804- description: Timestamp bucket indicating when logs were last collected.
62775+ description: Timestamp bucket indicating when logs were last collected
6280562776 enum:
6280662777 - not_seen
6280762778 - within_24_hours
@@ -62810,12 +62781,6 @@ components:
6281062781 - over_30d
6281162782 example: within_24_hours
6281262783 type: string
62813- x-enum-descriptions:
62814- - No logs observed.
62815- - Logs received within the last 24 hours.
62816- - Logs last seen 24 to 72 hours ago.
62817- - Logs last seen 3 to 30 days ago.
62818- - Logs last seen more than 30 days ago.
6281962784 x-enum-varnames:
6282062785 - NOT_SEEN
6282162786 - WITHIN_24_HOURS
@@ -63906,7 +63871,7 @@ components:
6390663871 - $ref: "#/components/schemas/SecurityMonitoringSignalRulePayload"
6390763872 - $ref: "#/components/schemas/CloudConfigurationRulePayload"
6390863873 SecurityMonitoringSKU:
63909- description: The Cloud SIEM pricing model (SKU) for the organization.
63874+ description: The SIEM pricing model (SKU) for the organization
6391063875 enum:
6391163876 - per_gb_analyzed
6391263877 - per_event_in_siem_index_2023
@@ -77965,6 +77930,10 @@ components:
7796577930 description: Title of the user.
7796677931 nullable: true
7796777932 type: string
77933+ uuid:
77934+ description: UUID of the user.
77935+ readOnly: true
77936+ type: string
7796877937 verified:
7796977938 description: Whether the user is verified.
7797077939 type: boolean
@@ -109511,7 +109480,7 @@ paths:
109511109480 operator: OR
109512109481 permissions:
109513109482 - user_app_keys
109514- /api/v2/personal_access_tokens/{pat_uuid }:
109483+ /api/v2/personal_access_tokens/{pat_id }:
109515109484 delete:
109516109485 description: Revoke a specific personal access token.
109517109486 operationId: RevokePersonalAccessToken
@@ -118729,8 +118698,9 @@ paths:
118729118698 /api/v2/security_monitoring/content_packs/states:
118730118699 get:
118731118700 description: |-
118732- Get the activation state, integration status, and log collection status
118733- for all Cloud SIEM content packs.
118701+ Get the activation and configuration states for all security monitoring content packs.
118702+ This endpoint returns status information about each content pack including activation state,
118703+ integration status, and log collection status.
118734118704 operationId: GetContentPacksStates
118735118705 responses:
118736118706 "200":
@@ -118753,31 +118723,21 @@ paths:
118753118723 description: Not Found
118754118724 "429":
118755118725 $ref: "#/components/responses/TooManyRequestsResponse"
118756- security:
118757- - apiKeyAuth: []
118758- appKeyAuth: []
118759- - AuthZ:
118760- - security_monitoring_filters_read
118761118726 summary: Get content pack states
118762118727 tags:
118763118728 - Security Monitoring
118764- "x-permission":
118765- operator: OR
118766- permissions:
118767- - security_monitoring_filters_read
118768- - logs_read_index_data
118769118729 x-unstable: |-
118770118730 **Note**: This endpoint is in preview and is subject to change.
118771118731 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
118772118732 /api/v2/security_monitoring/content_packs/{content_pack_id}/activate:
118773118733 put:
118774118734 description: |-
118775- Activate a Cloud SIEM content pack. This operation configures the necessary
118735+ Activate a security monitoring content pack. This operation configures the necessary
118776118736 log filters or security filters depending on the pricing model and updates the content
118777118737 pack activation state.
118778118738 operationId: ActivateContentPack
118779118739 parameters:
118780- - description: The ID of the content pack to activate (for example, `aws-cloudtrail`) .
118740+ - description: The ID of the content pack to activate.
118781118741 in: path
118782118742 name: content_pack_id
118783118743 required: true
@@ -118801,30 +118761,20 @@ paths:
118801118761 description: Not Found
118802118762 "429":
118803118763 $ref: "#/components/responses/TooManyRequestsResponse"
118804- security:
118805- - apiKeyAuth: []
118806- appKeyAuth: []
118807- - AuthZ:
118808- - security_monitoring_filters_write
118809118764 summary: Activate content pack
118810118765 tags:
118811118766 - Security Monitoring
118812- "x-permission":
118813- operator: OR
118814- permissions:
118815- - security_monitoring_filters_write
118816- - logs_modify_indexes
118817118767 x-unstable: |-
118818118768 **Note**: This endpoint is in preview and is subject to change.
118819118769 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
118820118770 /api/v2/security_monitoring/content_packs/{content_pack_id}/deactivate:
118821118771 put:
118822118772 description: |-
118823- Deactivate a Cloud SIEM content pack. This operation removes the content pack's
118773+ Deactivate a security monitoring content pack. This operation removes the content pack's
118824118774 configuration from log filters or security filters and updates the content pack activation state.
118825118775 operationId: DeactivateContentPack
118826118776 parameters:
118827- - description: The ID of the content pack to deactivate (for example, `aws-cloudtrail`) .
118777+ - description: The ID of the content pack to deactivate.
118828118778 in: path
118829118779 name: content_pack_id
118830118780 required: true
@@ -118848,19 +118798,9 @@ paths:
118848118798 description: Not Found
118849118799 "429":
118850118800 $ref: "#/components/responses/TooManyRequestsResponse"
118851- security:
118852- - apiKeyAuth: []
118853- appKeyAuth: []
118854- - AuthZ:
118855- - security_monitoring_filters_write
118856118801 summary: Deactivate content pack
118857118802 tags:
118858118803 - Security Monitoring
118859- "x-permission":
118860- operator: OR
118861- permissions:
118862- - security_monitoring_filters_write
118863- - logs_modify_indexes
118864118804 x-unstable: |-
118865118805 **Note**: This endpoint is in preview and is subject to change.
118866118806 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
@@ -120937,7 +120877,7 @@ paths:
120937120877 operator: OR
120938120878 permissions:
120939120879 - service_account_write
120940- /api/v2/service_accounts/{service_account_id}/access_tokens/{pat_uuid }:
120880+ /api/v2/service_accounts/{service_account_id}/access_tokens/{pat_id }:
120941120881 delete:
120942120882 description: Revoke a specific access token for a service account.
120943120883 operationId: RevokeServiceAccountAccessToken
0 commit comments