@@ -62654,23 +62654,19 @@ components:
6265462654 - DONE
6265562655 - TIMEOUT
6265662656 SecurityMonitoringContentPackActivation:
62657- description: The activation status of a content pack.
62657+ description: The activation status of a content pack
6265862658 enum:
6265962659 - never_activated
6266062660 - activated
6266162661 - deactivated
6266262662 example: activated
6266362663 type: string
62664- x-enum-descriptions:
62665- - Pack has never been activated for this organization.
62666- - Pack is currently activated.
62667- - Pack was previously activated but has since been deactivated.
6266862664 x-enum-varnames:
6266962665 - NEVER_ACTIVATED
6267062666 - ACTIVATED
6267162667 - DEACTIVATED
6267262668 SecurityMonitoringContentPackIntegrationStatus:
62673- description: The installation status of the related integration.
62669+ description: The installation status of the related integration
6267462670 enum:
6267562671 - installed
6267662672 - available
@@ -62679,12 +62675,6 @@ components:
6267962675 - error
6268062676 example: installed
6268162677 type: string
62682- x-enum-descriptions:
62683- - Integration is fully installed.
62684- - Integration exists in the catalog but is not installed.
62685- - Integration is only partially configured.
62686- - Integration detected (for example, logs are flowing) but not explicitly installed.
62687- - Integration is in an error state.
6268862678 x-enum-varnames:
6268962679 - INSTALLED
6269062680 - AVAILABLE
@@ -62701,17 +62691,15 @@ components:
6270162691 cp_activation:
6270262692 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
6270362693 filters_configured_for_logs:
62704- description: |-
62705- Whether filters (Security Filters or Index Query depending on the pricing model) are
62706- present and correctly configured to route logs into Cloud SIEM.
62694+ description: Whether filters (Security Filters or Index Query depending on the pricing model) are configured for logs
6270762695 example: true
6270862696 type: boolean
6270962697 integration_installed_status:
6271062698 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
6271162699 logs_last_collected:
6271262700 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
6271362701 logs_seen_from_any_index:
62714- description: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
62702+ description: Whether logs have been seen from any index
6271562703 example: true
6271662704 type: boolean
6271762705 state:
@@ -62776,7 +62764,7 @@ components:
6277662764 - meta
6277762765 type: object
6277862766 SecurityMonitoringContentPackStatus:
62779- description: The current operational status of a content pack.
62767+ description: The current status of a content pack
6278062768 enum:
6278162769 - install
6278262770 - activate
@@ -62786,13 +62774,6 @@ components:
6278662774 - broken
6278762775 example: active
6278862776 type: string
62789- x-enum-descriptions:
62790- - Not activated; no logs detected in the last 72 hours.
62791- - Not activated; logs are flowing into a Datadog index but not yet routed through Cloud SIEM.
62792- - Activated; awaiting first log ingestion.
62793- - Activated; logs received within the last 24 hours.
62794- - Activated; integration not installed or logs last seen 24 to 72 hours ago.
62795- - Activated; no logs for over 72 hours, filter missing, or Cloud SIEM index incorrectly ordered.
6279662777 x-enum-varnames:
6279762778 - INSTALL
6279862779 - ACTIVATE
@@ -62801,7 +62782,7 @@ components:
6280162782 - WARNING
6280262783 - BROKEN
6280362784 SecurityMonitoringContentPackTimestampBucket:
62804- description: Timestamp bucket indicating when logs were last collected.
62785+ description: Timestamp bucket indicating when logs were last collected
6280562786 enum:
6280662787 - not_seen
6280762788 - within_24_hours
@@ -62810,12 +62791,6 @@ components:
6281062791 - over_30d
6281162792 example: within_24_hours
6281262793 type: string
62813- x-enum-descriptions:
62814- - No logs observed.
62815- - Logs received within the last 24 hours.
62816- - Logs last seen 24 to 72 hours ago.
62817- - Logs last seen 3 to 30 days ago.
62818- - Logs last seen more than 30 days ago.
6281962794 x-enum-varnames:
6282062795 - NOT_SEEN
6282162796 - WITHIN_24_HOURS
@@ -63906,7 +63881,7 @@ components:
6390663881 - $ref: "#/components/schemas/SecurityMonitoringSignalRulePayload"
6390763882 - $ref: "#/components/schemas/CloudConfigurationRulePayload"
6390863883 SecurityMonitoringSKU:
63909- description: The Cloud SIEM pricing model (SKU) for the organization.
63884+ description: The SIEM pricing model (SKU) for the organization
6391063885 enum:
6391163886 - per_gb_analyzed
6391263887 - per_event_in_siem_index_2023
@@ -93370,6 +93345,7 @@ paths:
9337093345 - ap2.datadoghq.com
9337193346 - datadoghq.eu
9337293347 - ddog-gov.com
93348+ - us2.fed.dog
9337393349 subdomain:
9337493350 default: event-management-intake
9337593351 description: The subdomain where the API is deployed.
@@ -102542,6 +102518,7 @@ paths:
102542102518 - ap2.datadoghq.com
102543102519 - datadoghq.eu
102544102520 - ddog-gov.com
102521+ - us2.fed.dog
102545102522 subdomain:
102546102523 default: http-intake.logs
102547102524 description: The subdomain where the API is deployed.
@@ -118729,8 +118706,9 @@ paths:
118729118706 /api/v2/security_monitoring/content_packs/states:
118730118707 get:
118731118708 description: |-
118732- Get the activation state, integration status, and log collection status
118733- for all Cloud SIEM content packs.
118709+ Get the activation and configuration states for all security monitoring content packs.
118710+ This endpoint returns status information about each content pack including activation state,
118711+ integration status, and log collection status.
118734118712 operationId: GetContentPacksStates
118735118713 responses:
118736118714 "200":
@@ -118753,31 +118731,21 @@ paths:
118753118731 description: Not Found
118754118732 "429":
118755118733 $ref: "#/components/responses/TooManyRequestsResponse"
118756- security:
118757- - apiKeyAuth: []
118758- appKeyAuth: []
118759- - AuthZ:
118760- - security_monitoring_filters_read
118761118734 summary: Get content pack states
118762118735 tags:
118763118736 - Security Monitoring
118764- "x-permission":
118765- operator: OR
118766- permissions:
118767- - security_monitoring_filters_read
118768- - logs_read_index_data
118769118737 x-unstable: |-
118770118738 **Note**: This endpoint is in preview and is subject to change.
118771118739 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
118772118740 /api/v2/security_monitoring/content_packs/{content_pack_id}/activate:
118773118741 put:
118774118742 description: |-
118775- Activate a Cloud SIEM content pack. This operation configures the necessary
118743+ Activate a security monitoring content pack. This operation configures the necessary
118776118744 log filters or security filters depending on the pricing model and updates the content
118777118745 pack activation state.
118778118746 operationId: ActivateContentPack
118779118747 parameters:
118780- - description: The ID of the content pack to activate (for example, `aws-cloudtrail`) .
118748+ - description: The ID of the content pack to activate.
118781118749 in: path
118782118750 name: content_pack_id
118783118751 required: true
@@ -118801,30 +118769,20 @@ paths:
118801118769 description: Not Found
118802118770 "429":
118803118771 $ref: "#/components/responses/TooManyRequestsResponse"
118804- security:
118805- - apiKeyAuth: []
118806- appKeyAuth: []
118807- - AuthZ:
118808- - security_monitoring_filters_write
118809118772 summary: Activate content pack
118810118773 tags:
118811118774 - Security Monitoring
118812- "x-permission":
118813- operator: OR
118814- permissions:
118815- - security_monitoring_filters_write
118816- - logs_modify_indexes
118817118775 x-unstable: |-
118818118776 **Note**: This endpoint is in preview and is subject to change.
118819118777 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
118820118778 /api/v2/security_monitoring/content_packs/{content_pack_id}/deactivate:
118821118779 put:
118822118780 description: |-
118823- Deactivate a Cloud SIEM content pack. This operation removes the content pack's
118781+ Deactivate a security monitoring content pack. This operation removes the content pack's
118824118782 configuration from log filters or security filters and updates the content pack activation state.
118825118783 operationId: DeactivateContentPack
118826118784 parameters:
118827- - description: The ID of the content pack to deactivate (for example, `aws-cloudtrail`) .
118785+ - description: The ID of the content pack to deactivate.
118828118786 in: path
118829118787 name: content_pack_id
118830118788 required: true
@@ -118848,19 +118806,9 @@ paths:
118848118806 description: Not Found
118849118807 "429":
118850118808 $ref: "#/components/responses/TooManyRequestsResponse"
118851- security:
118852- - apiKeyAuth: []
118853- appKeyAuth: []
118854- - AuthZ:
118855- - security_monitoring_filters_write
118856118809 summary: Deactivate content pack
118857118810 tags:
118858118811 - Security Monitoring
118859- "x-permission":
118860- operator: OR
118861- permissions:
118862- - security_monitoring_filters_write
118863- - logs_modify_indexes
118864118812 x-unstable: |-
118865118813 **Note**: This endpoint is in preview and is subject to change.
118866118814 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
@@ -129839,6 +129787,7 @@ servers:
129839129787 - ap2.datadoghq.com
129840129788 - datadoghq.eu
129841129789 - ddog-gov.com
129790+ - us2.fed.dog
129842129791 subdomain:
129843129792 default: api
129844129793 description: The subdomain where the API is deployed.
0 commit comments