Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
94 changes: 21 additions & 73 deletions .generator/schemas/v2/openapi.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -37853,7 +37853,7 @@ components:
$ref: "#/components/schemas/LLMObsAnnotationItem"
type: array
content_id:
description: Identifier of the content for this interaction.
description: Identifier of the content (trace ID or session ID) for this interaction.
example: "trace-abc-123"
type: string
id:
Expand Down Expand Up @@ -38052,7 +38052,7 @@ components:
description: A single interaction to add to an annotation queue.
properties:
content_id:
description: Identifier of the content (such as trace ID) for this interaction.
description: Identifier of the content (trace ID or session ID) for this interaction.
example: "trace-abc-123"
type: string
type:
Expand All @@ -38069,7 +38069,7 @@ components:
example: false
type: boolean
content_id:
description: Identifier of the content for this interaction.
description: Identifier of the content (trace ID or session ID) for this interaction.
example: "trace-abc-123"
type: string
id:
Expand Down Expand Up @@ -39516,11 +39516,13 @@ components:
enum:
- trace
- experiment_trace
- session
example: trace
type: string
x-enum-varnames:
- TRACE
- EXPERIMENT_TRACE
- SESSION
LLMObsMetricAssessment:
description: Assessment result for an LLM Observability experiment metric.
enum:
Expand Down Expand Up @@ -62654,23 +62656,19 @@ components:
- DONE
- TIMEOUT
SecurityMonitoringContentPackActivation:
description: The activation status of a content pack.
description: The activation status of a content pack
enum:
- never_activated
- activated
- deactivated
example: activated
type: string
x-enum-descriptions:
- Pack has never been activated for this organization.
- Pack is currently activated.
- Pack was previously activated but has since been deactivated.
x-enum-varnames:
- NEVER_ACTIVATED
- ACTIVATED
- DEACTIVATED
SecurityMonitoringContentPackIntegrationStatus:
description: The installation status of the related integration.
description: The installation status of the related integration
enum:
- installed
- available
Expand All @@ -62679,12 +62677,6 @@ components:
- error
example: installed
type: string
x-enum-descriptions:
- Integration is fully installed.
- Integration exists in the catalog but is not installed.
- Integration is only partially configured.
- Integration detected (for example, logs are flowing) but not explicitly installed.
- Integration is in an error state.
x-enum-varnames:
- INSTALLED
- AVAILABLE
Expand All @@ -62701,17 +62693,15 @@ components:
cp_activation:
$ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
filters_configured_for_logs:
description: |-
Whether filters (Security Filters or Index Query depending on the pricing model) are
present and correctly configured to route logs into Cloud SIEM.
description: Whether filters (Security Filters or Index Query depending on the pricing model) are configured for logs
example: true
type: boolean
integration_installed_status:
$ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
logs_last_collected:
$ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
logs_seen_from_any_index:
description: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
description: Whether logs have been seen from any index
example: true
type: boolean
state:
Expand Down Expand Up @@ -62776,7 +62766,7 @@ components:
- meta
type: object
SecurityMonitoringContentPackStatus:
description: The current operational status of a content pack.
description: The current status of a content pack
enum:
- install
- activate
Expand All @@ -62786,13 +62776,6 @@ components:
- broken
example: active
type: string
x-enum-descriptions:
- Not activated; no logs detected in the last 72 hours.
- Not activated; logs are flowing into a Datadog index but not yet routed through Cloud SIEM.
- Activated; awaiting first log ingestion.
- Activated; logs received within the last 24 hours.
- Activated; integration not installed or logs last seen 24 to 72 hours ago.
- Activated; no logs for over 72 hours, filter missing, or Cloud SIEM index incorrectly ordered.
x-enum-varnames:
- INSTALL
- ACTIVATE
Expand All @@ -62801,7 +62784,7 @@ components:
- WARNING
- BROKEN
SecurityMonitoringContentPackTimestampBucket:
description: Timestamp bucket indicating when logs were last collected.
description: Timestamp bucket indicating when logs were last collected
enum:
- not_seen
- within_24_hours
Expand All @@ -62810,12 +62793,6 @@ components:
- over_30d
example: within_24_hours
type: string
x-enum-descriptions:
- No logs observed.
- Logs received within the last 24 hours.
- Logs last seen 24 to 72 hours ago.
- Logs last seen 3 to 30 days ago.
- Logs last seen more than 30 days ago.
x-enum-varnames:
- NOT_SEEN
- WITHIN_24_HOURS
Expand Down Expand Up @@ -63906,7 +63883,7 @@ components:
- $ref: "#/components/schemas/SecurityMonitoringSignalRulePayload"
- $ref: "#/components/schemas/CloudConfigurationRulePayload"
SecurityMonitoringSKU:
description: The Cloud SIEM pricing model (SKU) for the organization.
description: The SIEM pricing model (SKU) for the organization
enum:
- per_gb_analyzed
- per_event_in_siem_index_2023
Expand Down Expand Up @@ -101142,7 +101119,7 @@ paths:
If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
/api/v2/llm-obs/v1/annotation-queues/{queue_id}/annotated-interactions:
get:
description: Retrieve all interactions and their annotations for a given annotation queue.
description: Retrieve all interactions (traces and sessions) and their annotations for a given annotation queue.
operationId: GetLLMObsAnnotatedInteractions
parameters:
- $ref: "#/components/parameters/LLMObsAnnotationQueueIDPathParameter"
Expand Down Expand Up @@ -101191,7 +101168,7 @@ paths:
/api/v2/llm-obs/v1/annotation-queues/{queue_id}/interactions:
post:
description: |-
Add one or more interactions (traces) to an annotation queue.
Add one or more interactions (traces or sessions) to an annotation queue.
At least one interaction must be provided.
operationId: CreateLLMObsAnnotationQueueInteractions
parameters:
Expand Down Expand Up @@ -118729,8 +118706,9 @@ paths:
/api/v2/security_monitoring/content_packs/states:
get:
description: |-
Get the activation state, integration status, and log collection status
for all Cloud SIEM content packs.
Get the activation and configuration states for all security monitoring content packs.
This endpoint returns status information about each content pack including activation state,
integration status, and log collection status.
operationId: GetContentPacksStates
responses:
"200":
Expand All @@ -118753,31 +118731,21 @@ paths:
description: Not Found
"429":
$ref: "#/components/responses/TooManyRequestsResponse"
security:
- apiKeyAuth: []
appKeyAuth: []
- AuthZ:
- security_monitoring_filters_read
summary: Get content pack states
tags:
- Security Monitoring
"x-permission":
operator: OR
permissions:
- security_monitoring_filters_read
- logs_read_index_data
x-unstable: |-
**Note**: This endpoint is in preview and is subject to change.
If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
/api/v2/security_monitoring/content_packs/{content_pack_id}/activate:
put:
description: |-
Activate a Cloud SIEM content pack. This operation configures the necessary
Activate a security monitoring content pack. This operation configures the necessary
log filters or security filters depending on the pricing model and updates the content
pack activation state.
operationId: ActivateContentPack
parameters:
- description: The ID of the content pack to activate (for example, `aws-cloudtrail`).
- description: The ID of the content pack to activate.
in: path
name: content_pack_id
required: true
Expand All @@ -118801,30 +118769,20 @@ paths:
description: Not Found
"429":
$ref: "#/components/responses/TooManyRequestsResponse"
security:
- apiKeyAuth: []
appKeyAuth: []
- AuthZ:
- security_monitoring_filters_write
summary: Activate content pack
tags:
- Security Monitoring
"x-permission":
operator: OR
permissions:
- security_monitoring_filters_write
- logs_modify_indexes
x-unstable: |-
**Note**: This endpoint is in preview and is subject to change.
If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
/api/v2/security_monitoring/content_packs/{content_pack_id}/deactivate:
put:
description: |-
Deactivate a Cloud SIEM content pack. This operation removes the content pack's
Deactivate a security monitoring content pack. This operation removes the content pack's
configuration from log filters or security filters and updates the content pack activation state.
operationId: DeactivateContentPack
parameters:
- description: The ID of the content pack to deactivate (for example, `aws-cloudtrail`).
- description: The ID of the content pack to deactivate.
in: path
name: content_pack_id
required: true
Expand All @@ -118848,19 +118806,9 @@ paths:
description: Not Found
"429":
$ref: "#/components/responses/TooManyRequestsResponse"
security:
- apiKeyAuth: []
appKeyAuth: []
- AuthZ:
- security_monitoring_filters_write
summary: Deactivate content pack
tags:
- Security Monitoring
"x-permission":
operator: OR
permissions:
- security_monitoring_filters_write
- logs_modify_indexes
x-unstable: |-
**Note**: This endpoint is in preview and is subject to change.
If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
Expand Down
4 changes: 2 additions & 2 deletions lib/datadog_api_client/v2/api/llm_observability_api.rb
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,7 @@ def create_llm_obs_annotation_queue_interactions(queue_id, body, opts = {})

# Add annotation queue interactions.
#
# Add one or more interactions (traces) to an annotation queue.
# Add one or more interactions (traces or sessions) to an annotation queue.
# At least one interaction must be provided.
#
# @param queue_id [String] The ID of the LLM Observability annotation queue.
Expand Down Expand Up @@ -1098,7 +1098,7 @@ def get_llm_obs_annotated_interactions(queue_id, opts = {})

# Get annotated queue interactions.
#
# Retrieve all interactions and their annotations for a given annotation queue.
# Retrieve all interactions (traces and sessions) and their annotations for a given annotation queue.
#
# @param queue_id [String] The ID of the LLM Observability annotation queue.
# @param opts [Hash] the optional parameters
Expand Down
19 changes: 10 additions & 9 deletions lib/datadog_api_client/v2/api/security_monitoring_api.rb
Original file line number Diff line number Diff line change
Expand Up @@ -33,11 +33,11 @@ def activate_content_pack(content_pack_id, opts = {})

# Activate content pack.
#
# Activate a Cloud SIEM content pack. This operation configures the necessary
# Activate a security monitoring content pack. This operation configures the necessary
# log filters or security filters depending on the pricing model and updates the content
# pack activation state.
#
# @param content_pack_id [String] The ID of the content pack to activate (for example, `aws-cloudtrail`).
# @param content_pack_id [String] The ID of the content pack to activate.
# @param opts [Hash] the optional parameters
# @return [Array<(nil, Integer, Hash)>] nil, response status code and response headers
def activate_content_pack_with_http_info(content_pack_id, opts = {})
Expand Down Expand Up @@ -76,7 +76,7 @@ def activate_content_pack_with_http_info(content_pack_id, opts = {})
return_type = opts[:debug_return_type]

# auth_names
auth_names = opts[:debug_auth_names] || [:apiKeyAuth, :appKeyAuth, :AuthZ]
auth_names = opts[:debug_auth_names] || [:apiKeyAuth, :appKeyAuth]

new_options = opts.merge(
:operation => :activate_content_pack,
Expand Down Expand Up @@ -1587,10 +1587,10 @@ def deactivate_content_pack(content_pack_id, opts = {})

# Deactivate content pack.
#
# Deactivate a Cloud SIEM content pack. This operation removes the content pack's
# Deactivate a security monitoring content pack. This operation removes the content pack's
# configuration from log filters or security filters and updates the content pack activation state.
#
# @param content_pack_id [String] The ID of the content pack to deactivate (for example, `aws-cloudtrail`).
# @param content_pack_id [String] The ID of the content pack to deactivate.
# @param opts [Hash] the optional parameters
# @return [Array<(nil, Integer, Hash)>] nil, response status code and response headers
def deactivate_content_pack_with_http_info(content_pack_id, opts = {})
Expand Down Expand Up @@ -1629,7 +1629,7 @@ def deactivate_content_pack_with_http_info(content_pack_id, opts = {})
return_type = opts[:debug_return_type]

# auth_names
auth_names = opts[:debug_auth_names] || [:apiKeyAuth, :appKeyAuth, :AuthZ]
auth_names = opts[:debug_auth_names] || [:apiKeyAuth, :appKeyAuth]

new_options = opts.merge(
:operation => :deactivate_content_pack,
Expand Down Expand Up @@ -2629,8 +2629,9 @@ def get_content_packs_states(opts = {})

# Get content pack states.
#
# Get the activation state, integration status, and log collection status
# for all Cloud SIEM content packs.
# Get the activation and configuration states for all security monitoring content packs.
# This endpoint returns status information about each content pack including activation state,
# integration status, and log collection status.
#
# @param opts [Hash] the optional parameters
# @return [Array<(SecurityMonitoringContentPackStatesResponse, Integer, Hash)>] SecurityMonitoringContentPackStatesResponse data, response status code and response headers
Expand Down Expand Up @@ -2666,7 +2667,7 @@ def get_content_packs_states_with_http_info(opts = {})
return_type = opts[:debug_return_type] || 'SecurityMonitoringContentPackStatesResponse'

# auth_names
auth_names = opts[:debug_auth_names] || [:apiKeyAuth, :appKeyAuth, :AuthZ]
auth_names = opts[:debug_auth_names] || [:apiKeyAuth, :appKeyAuth]

new_options = opts.merge(
:operation => :get_content_packs_states,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ class LLMObsAnnotatedInteractionItem
# List of annotations for this interaction.
attr_reader :annotations

# Identifier of the content for this interaction.
# Identifier of the content (trace ID or session ID) for this interaction.
attr_reader :content_id

# Unique identifier of the interaction.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ module DatadogAPIClient::V2
class LLMObsAnnotationQueueInteractionItem
include BaseGenericModel

# Identifier of the content (such as trace ID) for this interaction.
# Identifier of the content (trace ID or session ID) for this interaction.
attr_reader :content_id

# Type of interaction in an annotation queue.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ class LLMObsAnnotationQueueInteractionResponseItem
# Whether this interaction already existed in the queue.
attr_reader :already_existed

# Identifier of the content for this interaction.
# Identifier of the content (trace ID or session ID) for this interaction.
attr_reader :content_id

# Unique identifier of the interaction.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -23,5 +23,6 @@ class LLMObsInteractionType

TRACE = "trace".freeze
EXPERIMENT_TRACE = "experiment_trace".freeze
SESSION = "session".freeze
end
end
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
require 'time'

module DatadogAPIClient::V2
# The activation status of a content pack.
# The activation status of a content pack
class SecurityMonitoringContentPackActivation
include BaseEnumModel

Expand Down
Loading
Loading