@@ -89626,6 +89626,57 @@ components:
8962689626 - NEVER_ACTIVATED
8962789627 - ACTIVATED
8962889628 - DEACTIVATED
89629+ SecurityMonitoringContentPackAppSecDetails:
89630+ description: Details for an Application Security content pack.
89631+ properties:
89632+ type:
89633+ $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetailsType"
89634+ required:
89635+ - type
89636+ type: object
89637+ SecurityMonitoringContentPackAppSecDetailsType:
89638+ description: Type for Application Security content pack details.
89639+ enum:
89640+ - appsec
89641+ example: appsec
89642+ type: string
89643+ x-enum-varnames:
89644+ - APPSEC
89645+ SecurityMonitoringContentPackAuditDetails:
89646+ description: Details for an audit trail content pack.
89647+ properties:
89648+ type:
89649+ $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetailsType"
89650+ required:
89651+ - type
89652+ type: object
89653+ SecurityMonitoringContentPackAuditDetailsType:
89654+ description: Type for audit trail content pack details.
89655+ enum:
89656+ - audit
89657+ example: audit
89658+ type: string
89659+ x-enum-varnames:
89660+ - AUDIT
89661+ SecurityMonitoringContentPackEntityDetails:
89662+ description: Details for an entity or identity content pack.
89663+ properties:
89664+ cp_activation:
89665+ $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
89666+ type:
89667+ $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetailsType"
89668+ required:
89669+ - type
89670+ - cp_activation
89671+ type: object
89672+ SecurityMonitoringContentPackEntityDetailsType:
89673+ description: Type for entity content pack details.
89674+ enum:
89675+ - entity
89676+ example: entity
89677+ type: string
89678+ x-enum-varnames:
89679+ - ENTITY
8962989680 SecurityMonitoringContentPackIntegrationStatus:
8963089681 description: The installation status of the related integration.
8963189682 enum:
@@ -89648,38 +89699,74 @@ components:
8964889699 - PARTIALLY_INSTALLED
8964989700 - DETECTED
8965089701 - ERROR
89651- SecurityMonitoringContentPackStateAttributes :
89652- description: Attributes of a content pack state
89702+ SecurityMonitoringContentPackLogsDetails :
89703+ description: Details for a logs-based content pack.
8965389704 properties:
89654- cloud_siem_index_incorrect:
89655- description: Whether the cloud SIEM index configuration is incorrect (only applies to certain pricing models)
89656- example: false
89657- type: boolean
8965889705 cp_activation:
8965989706 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
89660- filters_configured_for_logs:
89707+ data_last_seen:
89708+ $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
89709+ filters_configured:
8966189710 description: |-
8966289711 Whether filters (Security Filters or Index Query depending on the pricing model) are
8966389712 present and correctly configured to route logs into Cloud SIEM.
8966489713 example: true
8966589714 type: boolean
8966689715 integration_installed_status:
8966789716 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
89668- logs_last_collected:
89669- $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
8967089717 logs_seen_from_any_index:
89671- description: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
89718+ description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
8967289719 example: true
8967389720 type: boolean
89674- state:
89675- $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
89721+ siem_index_incorrect:
89722+ description: Whether the Cloud SIEM index configuration is incorrect (only applies to certain pricing models).
89723+ example: false
89724+ type: boolean
89725+ type:
89726+ $ref: "#/components/schemas/SecurityFilterFilteredDataType"
8967689727 required:
89677- - state
89728+ - type
8967889729 - cp_activation
89730+ - data_last_seen
89731+ - integration_installed_status
89732+ - filters_configured
8967989733 - logs_seen_from_any_index
89680- - logs_last_collected
89681- - cloud_siem_index_incorrect
89682- - filters_configured_for_logs
89734+ - siem_index_incorrect
89735+ type: object
89736+ SecurityMonitoringContentPackOnboardingDetails:
89737+ description: |-
89738+ Content pack details returned when Cloud SIEM is inactive for the requesting organization.
89739+ properties:
89740+ integration_installed_status:
89741+ $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
89742+ logs_seen_from_any_index:
89743+ description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
89744+ example: true
89745+ type: boolean
89746+ type:
89747+ $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetailsType"
89748+ required:
89749+ - type
89750+ - logs_seen_from_any_index
89751+ type: object
89752+ SecurityMonitoringContentPackOnboardingDetailsType:
89753+ description: Type for onboarding content pack details.
89754+ enum:
89755+ - onboarding
89756+ example: onboarding
89757+ type: string
89758+ x-enum-varnames:
89759+ - ONBOARDING
89760+ SecurityMonitoringContentPackStateAttributes:
89761+ description: Attributes of a content pack state.
89762+ properties:
89763+ details:
89764+ $ref: "#/components/schemas/SecurityMonitoringContentPackStateDetails"
89765+ status:
89766+ $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
89767+ required:
89768+ - status
89769+ - details
8968389770 type: object
8968489771 SecurityMonitoringContentPackStateData:
8968589772 description: Content pack state data.
@@ -89697,13 +89784,42 @@ components:
8969789784 - type
8969889785 - attributes
8969989786 type: object
89787+ SecurityMonitoringContentPackStateDetails:
89788+ description: |-
89789+ Type-specific details for a content pack state. The set of fields present depends
89790+ on the content pack's `type`. When Cloud SIEM is inactive for the requesting organization, `onboarding` is returned instead of the content pack's usual type, such as `logs` or `vulnerability`.`
89791+ discriminator:
89792+ mapping:
89793+ appsec: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
89794+ audit: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
89795+ entity: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
89796+ logs: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
89797+ onboarding: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
89798+ threat_intel: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
89799+ vulnerability: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
89800+ propertyName: type
89801+ oneOf:
89802+ - $ref: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
89803+ - $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
89804+ - $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
89805+ - $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
89806+ - $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
89807+ - $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
89808+ - $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
8970089809 SecurityMonitoringContentPackStateMeta:
89701- description: Metadata for content pack states
89810+ description: Metadata for content pack states.
8970289811 properties:
8970389812 cloud_siem_index_incorrect:
89704- description: Whether the cloud SIEM index configuration is incorrect at the organization level
89813+ description: Whether the Cloud SIEM index configuration is incorrect for the organization.
8970589814 example: false
8970689815 type: boolean
89816+ retention_months:
89817+ description: |-
89818+ The number of months that standard logs are retained for organizations on the standalone_indexed` pricing model. This field is omitted for other pricing models.
89819+ example: 15
89820+ format: int32
89821+ maximum: 60
89822+ type: integer
8970789823 sku:
8970889824 $ref: "#/components/schemas/SecurityMonitoringSKU"
8970989825 required:
@@ -89741,6 +89857,7 @@ components:
8974189857 - active
8974289858 - warning
8974389859 - broken
89860+ - not_configured
8974489861 example: active
8974589862 type: string
8974689863 x-enum-descriptions:
@@ -89750,13 +89867,40 @@ components:
8975089867 - Activated; logs received within the last 24 hours.
8975189868 - Activated; integration not installed or logs last seen 24 to 72 hours ago.
8975289869 - Activated; no logs for over 72 hours, filter missing, or Cloud SIEM index incorrectly ordered.
89870+ - Activated, but no credentials are configured (entity content packs only).
8975389871 x-enum-varnames:
8975489872 - INSTALL
8975589873 - ACTIVATE
8975689874 - INITIALIZING
8975789875 - ACTIVE
8975889876 - WARNING
8975989877 - BROKEN
89878+ - NOT_CONFIGURED
89879+ SecurityMonitoringContentPackThreatIntelDetails:
89880+ description: Details for a threat intelligence content pack.
89881+ properties:
89882+ cp_activation:
89883+ $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
89884+ data_last_seen:
89885+ $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
89886+ integration_installed_status:
89887+ $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
89888+ type:
89889+ $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetailsType"
89890+ required:
89891+ - type
89892+ - cp_activation
89893+ - data_last_seen
89894+ - integration_installed_status
89895+ type: object
89896+ SecurityMonitoringContentPackThreatIntelDetailsType:
89897+ description: Type for threat intelligence content pack details.
89898+ enum:
89899+ - threat_intel
89900+ example: threat_intel
89901+ type: string
89902+ x-enum-varnames:
89903+ - THREAT_INTEL
8976089904 SecurityMonitoringContentPackTimestampBucket:
8976189905 description: Timestamp bucket indicating when logs were last collected.
8976289906 enum:
@@ -89779,6 +89923,31 @@ components:
8977989923 - WITHIN_24_TO_72_HOURS
8978089924 - OVER_72H_TO_30D
8978189925 - OVER_30D
89926+ SecurityMonitoringContentPackVulnerabilityDetails:
89927+ description: Details for a vulnerability content pack.
89928+ properties:
89929+ cp_activation:
89930+ $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
89931+ data_last_seen:
89932+ $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
89933+ integration_installed_status:
89934+ $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
89935+ type:
89936+ $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetailsType"
89937+ required:
89938+ - type
89939+ - cp_activation
89940+ - data_last_seen
89941+ - integration_installed_status
89942+ type: object
89943+ SecurityMonitoringContentPackVulnerabilityDetailsType:
89944+ description: Type for vulnerability content pack details.
89945+ enum:
89946+ - vulnerability
89947+ example: vulnerability
89948+ type: string
89949+ x-enum-varnames:
89950+ - VULNERABILITY
8978289951 SecurityMonitoringCriticalAsset:
8978389952 description: The critical asset's properties.
8978489953 properties:
@@ -92150,12 +92319,16 @@ components:
9215092319 - per_gb_analyzed
9215192320 - per_event_in_siem_index_2023
9215292321 - add_on_2024
92322+ - standalone_indexed
92323+ - unknown
9215392324 example: add_on_2024
9215492325 type: string
9215592326 x-enum-varnames:
9215692327 - PER_GB_ANALYZED
9215792328 - PER_EVENT_IN_SIEM_INDEX_2023
9215892329 - ADD_ON_2024
92330+ - STANDALONE_INDEXED
92331+ - UNKNOWN
9215992332 SecurityMonitoringSchedulingOptions:
9216092333 description: Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
9216192334 nullable: true
@@ -184119,12 +184292,15 @@ paths:
184119184292 value:
184120184293 data:
184121184294 - attributes:
184122- cloud_siem_index_incorrect: false
184123- cp_activation: activated
184124- filters_configured_for_logs: true
184125- logs_last_collected: within_24_hours
184126- logs_seen_from_any_index: true
184127- state: active
184295+ details:
184296+ cp_activation: activated
184297+ data_last_seen: within_24_hours
184298+ filters_configured: true
184299+ integration_installed_status: installed
184300+ logs_seen_from_any_index: true
184301+ siem_index_incorrect: false
184302+ type: logs
184303+ status: active
184128184304 id: aws-cloudtrail
184129184305 type: content_pack_state
184130184306 meta:
0 commit comments