@@ -52434,6 +52434,153 @@ components:
5243452434 x-enum-varnames:
5243552435 - DONE
5243652436 - TIMEOUT
52437+ SecurityMonitoringContentPackActivation:
52438+ description: The activation status of a content pack
52439+ enum:
52440+ - never_activated
52441+ - activated
52442+ - deactivated
52443+ example: activated
52444+ type: string
52445+ x-enum-varnames:
52446+ - NEVER_ACTIVATED
52447+ - ACTIVATED
52448+ - DEACTIVATED
52449+ SecurityMonitoringContentPackIntegrationStatus:
52450+ description: The installation status of the related integration
52451+ enum:
52452+ - installed
52453+ - available
52454+ - partially_installed
52455+ - detected
52456+ - error
52457+ example: installed
52458+ type: string
52459+ x-enum-varnames:
52460+ - INSTALLED
52461+ - AVAILABLE
52462+ - PARTIALLY_INSTALLED
52463+ - DETECTED
52464+ - ERROR
52465+ SecurityMonitoringContentPackStateAttributes:
52466+ description: Attributes of a content pack state
52467+ properties:
52468+ cloud_siem_index_incorrect:
52469+ description: Whether the cloud SIEM index configuration is incorrect (only
52470+ applicable with the Cloud SIEM with index pricing model)
52471+ example: false
52472+ type: boolean
52473+ cp_activation:
52474+ $ref: '#/components/schemas/SecurityMonitoringContentPackActivation'
52475+ filters_configured_for_logs:
52476+ description: Whether filters (Security Filters or Index Query depending
52477+ on the pricing model) are configured for logs
52478+ example: true
52479+ type: boolean
52480+ integration_installed_status:
52481+ $ref: '#/components/schemas/SecurityMonitoringContentPackIntegrationStatus'
52482+ logs_last_collected:
52483+ $ref: '#/components/schemas/SecurityMonitoringContentPackTimestampBucket'
52484+ logs_seen_from_any_index:
52485+ description: Whether logs have been seen from any index
52486+ example: true
52487+ type: boolean
52488+ state:
52489+ $ref: '#/components/schemas/SecurityMonitoringContentPackStatus'
52490+ required:
52491+ - state
52492+ - cp_activation
52493+ - logs_seen_from_any_index
52494+ - logs_last_collected
52495+ - cloud_siem_index_incorrect
52496+ - filters_configured_for_logs
52497+ type: object
52498+ SecurityMonitoringContentPackStateData:
52499+ description: Content pack state data.
52500+ properties:
52501+ attributes:
52502+ $ref: '#/components/schemas/SecurityMonitoringContentPackStateAttributes'
52503+ id:
52504+ description: The content pack identifier.
52505+ example: aws-cloudtrail
52506+ type: string
52507+ type:
52508+ $ref: '#/components/schemas/SecurityMonitoringContentPackStateType'
52509+ required:
52510+ - id
52511+ - type
52512+ - attributes
52513+ type: object
52514+ SecurityMonitoringContentPackStateMeta:
52515+ description: Metadata for content pack states
52516+ properties:
52517+ cloud_siem_index_incorrect:
52518+ description: Whether the cloud SIEM index configuration is incorrect at
52519+ the organization level
52520+ example: false
52521+ type: boolean
52522+ sku:
52523+ $ref: '#/components/schemas/SecurityMonitoringSKU'
52524+ required:
52525+ - cloud_siem_index_incorrect
52526+ - sku
52527+ type: object
52528+ SecurityMonitoringContentPackStateType:
52529+ description: Type for content pack state object
52530+ enum:
52531+ - content_pack_state
52532+ example: content_pack_state
52533+ type: string
52534+ x-enum-varnames:
52535+ - CONTENT_PACK_STATE
52536+ SecurityMonitoringContentPackStatesResponse:
52537+ description: Response containing content pack states.
52538+ properties:
52539+ data:
52540+ description: Array of content pack states.
52541+ items:
52542+ $ref: '#/components/schemas/SecurityMonitoringContentPackStateData'
52543+ type: array
52544+ meta:
52545+ $ref: '#/components/schemas/SecurityMonitoringContentPackStateMeta'
52546+ required:
52547+ - data
52548+ - meta
52549+ type: object
52550+ SecurityMonitoringContentPackStatus:
52551+ description: The current status of a content pack
52552+ enum:
52553+ - install
52554+ - activate
52555+ - initializing
52556+ - active
52557+ - warning
52558+ - broken
52559+ example: active
52560+ type: string
52561+ x-enum-varnames:
52562+ - INSTALL
52563+ - ACTIVATE
52564+ - INITIALIZING
52565+ - ACTIVE
52566+ - WARNING
52567+ - BROKEN
52568+ SecurityMonitoringContentPackTimestampBucket:
52569+ description: Timestamp bucket indicating when logs were last collected
52570+ enum:
52571+ - not_seen
52572+ - within_24_hours
52573+ - within_24_to_72_hours
52574+ - over_72h_to_30d
52575+ - over_30d
52576+ example: within_24_hours
52577+ type: string
52578+ x-enum-varnames:
52579+ - NOT_SEEN
52580+ - WITHIN_24_HOURS
52581+ - WITHIN_24_TO_72_HOURS
52582+ - OVER_72H_TO_30D
52583+ - OVER_30D
5243752584 SecurityMonitoringCriticalAsset:
5243852585 description: The critical asset's properties.
5243952586 properties:
@@ -53561,6 +53708,18 @@ components:
5356153708 - $ref: '#/components/schemas/SecurityMonitoringStandardRulePayload'
5356253709 - $ref: '#/components/schemas/SecurityMonitoringSignalRulePayload'
5356353710 - $ref: '#/components/schemas/CloudConfigurationRulePayload'
53711+ SecurityMonitoringSKU:
53712+ description: The SIEM pricing model (SKU) for the organization
53713+ enum:
53714+ - per_gb_analyzed
53715+ - per_event_in_siem_index_2023
53716+ - add_on_2024
53717+ example: add_on_2024
53718+ type: string
53719+ x-enum-varnames:
53720+ - PER_GB_ANALYZED
53721+ - PER_EVENT_IN_SIEM_INDEX_2023
53722+ - ADD_ON_2024
5356453723 SecurityMonitoringSchedulingOptions:
5356553724 description: Options for scheduled rules. When this field is present, the rule
5356653725 runs based on the schedule. When absent, it runs real-time on ingested logs.
@@ -93367,6 +93526,123 @@ paths:
9336793526 summary: Get a suppression's version history
9336893527 tags:
9336993528 - Security Monitoring
93529+ /api/v2/security_monitoring/content_packs/states:
93530+ get:
93531+ description: 'Get the activation and configuration states for all security monitoring
93532+ content packs.
93533+
93534+ This endpoint returns status information about each content pack including
93535+ activation state,
93536+
93537+ integration status, and log collection status.'
93538+ operationId: GetContentPacksStates
93539+ responses:
93540+ '200':
93541+ content:
93542+ application/json:
93543+ schema:
93544+ $ref: '#/components/schemas/SecurityMonitoringContentPackStatesResponse'
93545+ description: OK
93546+ '403':
93547+ content:
93548+ application/json:
93549+ schema:
93550+ $ref: '#/components/schemas/JSONAPIErrorResponse'
93551+ description: Forbidden
93552+ '404':
93553+ content:
93554+ application/json:
93555+ schema:
93556+ $ref: '#/components/schemas/JSONAPIErrorResponse'
93557+ description: Not Found
93558+ '429':
93559+ $ref: '#/components/responses/TooManyRequestsResponse'
93560+ summary: Get content pack states
93561+ tags:
93562+ - Security Monitoring
93563+ x-unstable: '**Note**: This endpoint is in preview and is subject to change.
93564+
93565+ If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
93566+ /api/v2/security_monitoring/content_packs/{content_pack_id}/activate:
93567+ put:
93568+ description: 'Activate a security monitoring content pack. This operation configures
93569+ the necessary
93570+
93571+ log filters or security filters depending on the pricing model and updates
93572+ the content
93573+
93574+ pack activation state.'
93575+ operationId: ActivateContentPack
93576+ parameters:
93577+ - description: The ID of the content pack to activate.
93578+ in: path
93579+ name: content_pack_id
93580+ required: true
93581+ schema:
93582+ example: aws-cloudtrail
93583+ type: string
93584+ responses:
93585+ '202':
93586+ description: Accepted
93587+ '403':
93588+ content:
93589+ application/json:
93590+ schema:
93591+ $ref: '#/components/schemas/JSONAPIErrorResponse'
93592+ description: Forbidden
93593+ '404':
93594+ content:
93595+ application/json:
93596+ schema:
93597+ $ref: '#/components/schemas/JSONAPIErrorResponse'
93598+ description: Not Found
93599+ '429':
93600+ $ref: '#/components/responses/TooManyRequestsResponse'
93601+ summary: Activate content pack
93602+ tags:
93603+ - Security Monitoring
93604+ x-unstable: '**Note**: This endpoint is in preview and is subject to change.
93605+
93606+ If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
93607+ /api/v2/security_monitoring/content_packs/{content_pack_id}/deactivate:
93608+ put:
93609+ description: 'Deactivate a security monitoring content pack. This operation
93610+ removes the content pack''s
93611+
93612+ configuration from log filters or security filters and updates the content
93613+ pack activation state.'
93614+ operationId: DeactivateContentPack
93615+ parameters:
93616+ - description: The ID of the content pack to deactivate.
93617+ in: path
93618+ name: content_pack_id
93619+ required: true
93620+ schema:
93621+ example: aws-cloudtrail
93622+ type: string
93623+ responses:
93624+ '202':
93625+ description: Accepted
93626+ '403':
93627+ content:
93628+ application/json:
93629+ schema:
93630+ $ref: '#/components/schemas/JSONAPIErrorResponse'
93631+ description: Forbidden
93632+ '404':
93633+ content:
93634+ application/json:
93635+ schema:
93636+ $ref: '#/components/schemas/JSONAPIErrorResponse'
93637+ description: Not Found
93638+ '429':
93639+ $ref: '#/components/responses/TooManyRequestsResponse'
93640+ summary: Deactivate content pack
93641+ tags:
93642+ - Security Monitoring
93643+ x-unstable: '**Note**: This endpoint is in preview and is subject to change.
93644+
93645+ If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
9337093646 /api/v2/security_monitoring/rules:
9337193647 get:
9337293648 description: List rules.
0 commit comments