Microsoft Sentinel Public API support

.apigentools-info

@@ -4,13 +4,13 @@
     "spec_versions": {
         "v1": {
             "apigentools_version": "1.6.6",
-            "regenerated": "2025-06-23 07:59:29.359544",
-            "spec_repo_commit": "74866a53"
+            "regenerated": "2025-06-23 13:26:55.053403",
+            "spec_repo_commit": "2e491415"
         },
         "v2": {
             "apigentools_version": "1.6.6",
-            "regenerated": "2025-06-23 07:59:29.376654",
-            "spec_repo_commit": "74866a53"
+            "regenerated": "2025-06-23 13:26:55.068995",
+            "spec_repo_commit": "2e491415"
         }
     }
 }

.generator/schemas/v2/openapi.yaml

@@ -10590,6 +10590,7 @@ components:
       - $ref: '#/components/schemas/CustomDestinationForwardDestinationHttp'
       - $ref: '#/components/schemas/CustomDestinationForwardDestinationSplunk'
       - $ref: '#/components/schemas/CustomDestinationForwardDestinationElasticsearch'
+      - $ref: '#/components/schemas/CustomDestinationForwardDestinationMicrosoftSentinel'
     CustomDestinationForwardDestinationElasticsearch:
       description: The Elasticsearch destination.
       properties:
@@ -10674,6 +10675,49 @@ components:
       type: string
       x-enum-varnames:
       - HTTP
+    CustomDestinationForwardDestinationMicrosoftSentinel:
+      description: The Microsoft Sentinel destination.
+      properties:
+        client_id:
+          description: Client ID from the Datadog Azure integration.
+          example: 9a2f4d83-2b5e-429e-a35a-2b3c4182db71
+          type: string
+        data_collection_endpoint:
+          description: Azure data collection endpoint.
+          example: https://my-dce-5kyl.eastus-1.ingest.monitor.azure.com
+          type: string
+        data_collection_rule_id:
+          description: Azure data collection rule ID.
+          example: dcr-000a00a000a00000a000000aa000a0aa
+          type: string
+        stream_name:
+          description: Azure stream name.
+          example: Custom-MyTable
+          type: string
+          writeOnly: true
+        tenant_id:
+          description: Tenant ID from the Datadog Azure integration.
+          example: f3c9a8a1-4c2e-4d2e-b911-9f3c28c3c8b2
+          type: string
+        type:
+          $ref: '#/components/schemas/CustomDestinationForwardDestinationMicrosoftSentinelType'
+      required:
+      - type
+      - tenant_id
+      - client_id
+      - data_collection_endpoint
+      - data_collection_rule_id
+      - stream_name
+      type: object
+    CustomDestinationForwardDestinationMicrosoftSentinelType:
+      default: microsoft_sentinel
+      description: Type of the Microsoft Sentinel destination.
+      enum:
+      - microsoft_sentinel
+      example: microsoft_sentinel
+      type: string
+      x-enum-varnames:
+      - MICROSOFT_SENTINEL
     CustomDestinationForwardDestinationSplunk:
       description: The Splunk HTTP Event Collector (HEC) destination.
       properties:
@@ -10849,6 +10893,7 @@ components:
       - $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationHttp'
       - $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationSplunk'
       - $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationElasticsearch'
+      - $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationMicrosoftSentinel'
     CustomDestinationResponseForwardDestinationElasticsearch:
       description: The Elasticsearch destination.
       properties:
@@ -10933,6 +10978,49 @@ components:
       type: string
       x-enum-varnames:
       - HTTP
+    CustomDestinationResponseForwardDestinationMicrosoftSentinel:
+      description: The Microsoft Sentinel destination.
+      properties:
+        client_id:
+          description: Client ID from the Datadog Azure integration.
+          example: 9a2f4d83-2b5e-429e-a35a-2b3c4182db71
+          type: string
+        data_collection_endpoint:
+          description: Azure data collection endpoint.
+          example: https://my-dce-5kyl.eastus-1.ingest.monitor.azure.com
+          type: string
+        data_collection_rule_id:
+          description: Azure data collection rule ID.
+          example: dcr-000a00a000a00000a000000aa000a0aa
+          type: string
+        stream_name:
+          description: Azure stream name.
+          example: Custom-MyTable
+          type: string
+          writeOnly: true
+        tenant_id:
+          description: Tenant ID from the Datadog Azure integration.
+          example: f3c9a8a1-4c2e-4d2e-b911-9f3c28c3c8b2
+          type: string
+        type:
+          $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationMicrosoftSentinelType'
+      required:
+      - type
+      - tenant_id
+      - client_id
+      - data_collection_endpoint
+      - data_collection_rule_id
+      - stream_name
+      type: object
+    CustomDestinationResponseForwardDestinationMicrosoftSentinelType:
+      default: microsoft_sentinel
+      description: Type of the Microsoft Sentinel destination.
+      enum:
+      - microsoft_sentinel
+      example: microsoft_sentinel
+      type: string
+      x-enum-varnames:
+      - MICROSOFT_SENTINEL
     CustomDestinationResponseForwardDestinationSplunk:
       description: The Splunk HTTP Event Collector (HEC) destination.
       properties:

api/datadogV2/model_custom_destination_forward_destination.go

@@ -10,9 +10,10 @@ import (
 
 // CustomDestinationForwardDestination - A custom destination's location to forward logs.
 type CustomDestinationForwardDestination struct {
-	CustomDestinationForwardDestinationHttp          *CustomDestinationForwardDestinationHttp
-	CustomDestinationForwardDestinationSplunk        *CustomDestinationForwardDestinationSplunk
-	CustomDestinationForwardDestinationElasticsearch *CustomDestinationForwardDestinationElasticsearch
+	CustomDestinationForwardDestinationHttp              *CustomDestinationForwardDestinationHttp
+	CustomDestinationForwardDestinationSplunk            *CustomDestinationForwardDestinationSplunk
+	CustomDestinationForwardDestinationElasticsearch     *CustomDestinationForwardDestinationElasticsearch
+	CustomDestinationForwardDestinationMicrosoftSentinel *CustomDestinationForwardDestinationMicrosoftSentinel
 
 	// UnparsedObject contains the raw value of the object if there was an error when deserializing into the struct
 	UnparsedObject interface{}
@@ -33,6 +34,11 @@ func CustomDestinationForwardDestinationElasticsearchAsCustomDestinationForwardD
 	return CustomDestinationForwardDestination{CustomDestinationForwardDestinationElasticsearch: v}
 }
 
+// CustomDestinationForwardDestinationMicrosoftSentinelAsCustomDestinationForwardDestination is a convenience function that returns CustomDestinationForwardDestinationMicrosoftSentinel wrapped in CustomDestinationForwardDestination.
+func CustomDestinationForwardDestinationMicrosoftSentinelAsCustomDestinationForwardDestination(v *CustomDestinationForwardDestinationMicrosoftSentinel) CustomDestinationForwardDestination {
+	return CustomDestinationForwardDestination{CustomDestinationForwardDestinationMicrosoftSentinel: v}
+}
+
 // UnmarshalJSON turns data into one of the pointers in the struct.
 func (obj *CustomDestinationForwardDestination) UnmarshalJSON(data []byte) error {
 	var err error
@@ -88,11 +94,29 @@ func (obj *CustomDestinationForwardDestination) UnmarshalJSON(data []byte) error
 		obj.CustomDestinationForwardDestinationElasticsearch = nil
 	}
 
+	// try to unmarshal data into CustomDestinationForwardDestinationMicrosoftSentinel
+	err = datadog.Unmarshal(data, &obj.CustomDestinationForwardDestinationMicrosoftSentinel)
+	if err == nil {
+		if obj.CustomDestinationForwardDestinationMicrosoftSentinel != nil && obj.CustomDestinationForwardDestinationMicrosoftSentinel.UnparsedObject == nil {
+			jsonCustomDestinationForwardDestinationMicrosoftSentinel, _ := datadog.Marshal(obj.CustomDestinationForwardDestinationMicrosoftSentinel)
+			if string(jsonCustomDestinationForwardDestinationMicrosoftSentinel) == "{}" { // empty struct
+				obj.CustomDestinationForwardDestinationMicrosoftSentinel = nil
+			} else {
+				match++
+			}
+		} else {
+			obj.CustomDestinationForwardDestinationMicrosoftSentinel = nil
+		}
+	} else {
+		obj.CustomDestinationForwardDestinationMicrosoftSentinel = nil
+	}
+
 	if match != 1 { // more than 1 match
 		// reset to nil
 		obj.CustomDestinationForwardDestinationHttp = nil
 		obj.CustomDestinationForwardDestinationSplunk = nil
 		obj.CustomDestinationForwardDestinationElasticsearch = nil
+		obj.CustomDestinationForwardDestinationMicrosoftSentinel = nil
 		return datadog.Unmarshal(data, &obj.UnparsedObject)
 	}
 	return nil // exactly one match
@@ -112,6 +136,10 @@ func (obj CustomDestinationForwardDestination) MarshalJSON() ([]byte, error) {
 		return datadog.Marshal(&obj.CustomDestinationForwardDestinationElasticsearch)
 	}
 
+	if obj.CustomDestinationForwardDestinationMicrosoftSentinel != nil {
+		return datadog.Marshal(&obj.CustomDestinationForwardDestinationMicrosoftSentinel)
+	}
+
 	if obj.UnparsedObject != nil {
 		return datadog.Marshal(obj.UnparsedObject)
 	}
@@ -132,6 +160,10 @@ func (obj *CustomDestinationForwardDestination) GetActualInstance() interface{}
 		return obj.CustomDestinationForwardDestinationElasticsearch
 	}
 
+	if obj.CustomDestinationForwardDestinationMicrosoftSentinel != nil {
+		return obj.CustomDestinationForwardDestinationMicrosoftSentinel
+	}
+
 	// all schemas are nil
 	return nil
 }