@@ -87258,6 +87258,38 @@ components:
8725887258 x-enum-varnames:
8725987259 - DONE
8726087260 - TIMEOUT
87261+ SecurityMonitoringAzureAppRegistration:
87262+ description: An Azure App Registration discovered for the organization.
87263+ properties:
87264+ client_id:
87265+ description: The client ID of the App Registration.
87266+ example: 66666666-7777-8888-9999-000000000000
87267+ type: string
87268+ error_count:
87269+ description: The number of errors encountered while crawling resources for this App Registration.
87270+ example: 0
87271+ format: int64
87272+ type: integer
87273+ resource_collection_enabled:
87274+ description: Whether resource collection is enabled for this App Registration.
87275+ example: true
87276+ type: boolean
87277+ subscription_count:
87278+ description: The number of Azure subscriptions associated with this App Registration.
87279+ example: 3
87280+ format: int64
87281+ type: integer
87282+ tenant_id:
87283+ description: The Azure tenant ID of the App Registration.
87284+ example: 11111111-2222-3333-4444-555555555555
87285+ type: string
87286+ required:
87287+ - tenant_id
87288+ - client_id
87289+ - resource_collection_enabled
87290+ - subscription_count
87291+ - error_count
87292+ type: object
8726187293 SecurityMonitoringContentPackActivation:
8726287294 description: The activation status of a content pack.
8726387295 enum:
@@ -88153,6 +88185,68 @@ components:
8815388185 (for example, `siem_entity_identity` for identities). Defaults to `entity` when the kind is unknown.
8815488186 example: siem_entity_identity
8815588187 type: string
88188+ SecurityMonitoringEntraIdAzureAppRegistrationsAttributes:
88189+ description: The attributes of the Entra ID Azure App Registration prerequisites.
88190+ properties:
88191+ azure_app_registrations:
88192+ description: The Azure App Registrations discovered for the organization.
88193+ items:
88194+ $ref: "#/components/schemas/SecurityMonitoringAzureAppRegistration"
88195+ type: array
88196+ has_valid_prerequisite:
88197+ description: Whether at least one Azure App Registration has resource collection enabled.
88198+ example: true
88199+ type: boolean
88200+ integration_id:
88201+ description: The ID of the Entra ID integration configuration, if one exists.
88202+ example: 11111111-2222-3333-4444-555555555555
88203+ type: string
88204+ is_enabled:
88205+ description: Whether the Entra ID integration configuration is enabled, if one exists.
88206+ example: true
88207+ type: boolean
88208+ subscribed_at:
88209+ description: The time at which the Entra ID integration configuration was created, if one exists.
88210+ example: "2026-05-01T12:00:00Z"
88211+ format: date-time
88212+ type: string
88213+ required:
88214+ - azure_app_registrations
88215+ - has_valid_prerequisite
88216+ type: object
88217+ SecurityMonitoringEntraIdAzureAppRegistrationsData:
88218+ description: The Azure App Registration prerequisites for the Entra ID integration.
88219+ properties:
88220+ attributes:
88221+ $ref: "#/components/schemas/SecurityMonitoringEntraIdAzureAppRegistrationsAttributes"
88222+ id:
88223+ description: The ID of the organization the Azure App Registrations belong to.
88224+ example: "123456"
88225+ type: string
88226+ type:
88227+ $ref: "#/components/schemas/SecurityMonitoringEntraIdAzureAppRegistrationsResourceType"
88228+ required:
88229+ - id
88230+ - type
88231+ - attributes
88232+ type: object
88233+ SecurityMonitoringEntraIdAzureAppRegistrationsResourceType:
88234+ default: entra_id_azure_app_registrations
88235+ description: The type of the resource. The value should always be `entra_id_azure_app_registrations`.
88236+ enum:
88237+ - entra_id_azure_app_registrations
88238+ example: entra_id_azure_app_registrations
88239+ type: string
88240+ x-enum-varnames:
88241+ - ENTRA_ID_AZURE_APP_REGISTRATIONS
88242+ SecurityMonitoringEntraIdAzureAppRegistrationsResponse:
88243+ description: Response containing the Azure App Registration prerequisites for the Entra ID integration.
88244+ properties:
88245+ data:
88246+ $ref: "#/components/schemas/SecurityMonitoringEntraIdAzureAppRegistrationsData"
88247+ required:
88248+ - data
88249+ type: object
8815688250 SecurityMonitoringFilter:
8815788251 description: The rule's suppression filter.
8815888252 properties:
@@ -88171,6 +88265,43 @@ components:
8817188265 x-enum-varnames:
8817288266 - REQUIRE
8817388267 - SUPPRESS
88268+ SecurityMonitoringIntegrationActivateAttributes:
88269+ description: Overrides applied when activating the integration. All fields are optional.
88270+ properties:
88271+ domain:
88272+ description: The domain associated with the external entity source.
88273+ example: default
88274+ type: string
88275+ name:
88276+ description: The display name for the entity context sync configuration.
88277+ example: My Entra ID Integration
88278+ type: string
88279+ settings:
88280+ $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigSettings"
88281+ type: object
88282+ SecurityMonitoringIntegrationActivateData:
88283+ description: The configuration overrides for the integration to activate.
88284+ properties:
88285+ attributes:
88286+ $ref: "#/components/schemas/SecurityMonitoringIntegrationActivateAttributes"
88287+ type:
88288+ $ref: "#/components/schemas/SecurityMonitoringIntegrationActivateResourceType"
88289+ type: object
88290+ SecurityMonitoringIntegrationActivateRequest:
88291+ description: Request body to activate an entity context sync integration for a source type that does not require secrets.
88292+ properties:
88293+ data:
88294+ $ref: "#/components/schemas/SecurityMonitoringIntegrationActivateData"
88295+ type: object
88296+ SecurityMonitoringIntegrationActivateResourceType:
88297+ default: activate_entra_id_request
88298+ description: The type of the resource. The value should always be `activate_entra_id_request`.
88299+ enum:
88300+ - activate_entra_id_request
88301+ example: activate_entra_id_request
88302+ type: string
88303+ x-enum-varnames:
88304+ - ACTIVATE_ENTRA_ID_REQUEST
8817488305 SecurityMonitoringIntegrationConfigAttributes:
8817588306 description: The attributes of an entity context sync configuration as returned by the API.
8817688307 properties:
@@ -88228,7 +88359,6 @@ components:
8822888359 - integration_type
8822988360 - domain
8823088361 - name
88231- - secrets
8823288362 type: object
8823388363 SecurityMonitoringIntegrationConfigCreateData:
8823488364 description: The entity context sync configuration to create.
@@ -88284,7 +88414,9 @@ components:
8828488414 type: object
8828588415 SecurityMonitoringIntegrationConfigSecrets:
8828688416 additionalProperties: {}
88287- description: The secrets used to authenticate against the external entity source. The accepted keys depend on the source type (for example, `admin_email` for Google Workspace).
88417+ description: |-
88418+ The secrets used to authenticate against the external entity source. The accepted keys depend on the source type
88419+ (for example, `admin_email` for Google Workspace). Not required for source types that do not use secrets (for example, `ENTRA_ID`).
8828888420 example:
8828988421 admin_email: test@example.com
8829088422 type: object
@@ -88372,7 +88504,6 @@ components:
8837288504 required:
8837388505 - integration_type
8837488506 - domain
88375- - secrets
8837688507 type: object
8837788508 SecurityMonitoringIntegrationCredentialsValidateData:
8837888509 description: The credentials to validate.
@@ -178092,6 +178223,54 @@ paths:
178092178223 x-unstable: |-
178093178224 **Note**: This endpoint is in preview and is subject to change.
178094178225 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
178226+ /api/v2/security_monitoring/configuration/integration_config/entra_id/azure_app_registrations:
178227+ get:
178228+ description: |-
178229+ Get the Azure App Registrations discovered for the organization and whether at least one of them has
178230+ resource collection enabled, which is a prerequisite for activating the Entra ID entity context sync integration.
178231+ operationId: GetEntraIdAzureAppRegistrations
178232+ responses:
178233+ "200":
178234+ content:
178235+ application/json:
178236+ examples:
178237+ default:
178238+ value:
178239+ data:
178240+ attributes:
178241+ azure_app_registrations:
178242+ - client_id: 66666666-7777-8888-9999-000000000000
178243+ error_count: 0
178244+ resource_collection_enabled: true
178245+ subscription_count: 3
178246+ tenant_id: 11111111-2222-3333-4444-555555555555
178247+ has_valid_prerequisite: true
178248+ integration_id: 11111111-2222-3333-4444-555555555555
178249+ is_enabled: true
178250+ subscribed_at: "2026-05-01T12:00:00Z"
178251+ id: "123456"
178252+ type: entra_id_azure_app_registrations
178253+ schema:
178254+ $ref: "#/components/schemas/SecurityMonitoringEntraIdAzureAppRegistrationsResponse"
178255+ description: OK
178256+ "403":
178257+ $ref: "#/components/responses/NotAuthorizedResponse"
178258+ "429":
178259+ $ref: "#/components/responses/TooManyRequestsResponse"
178260+ security:
178261+ - apiKeyAuth: []
178262+ appKeyAuth: []
178263+ - AuthZ:
178264+ - integrations_read
178265+ summary: Get Entra ID Azure App Registration prerequisites
178266+ tags: ["Security Monitoring"]
178267+ x-permission:
178268+ operator: OR
178269+ permissions:
178270+ - integrations_read
178271+ x-unstable: |-
178272+ **Note**: This endpoint is in preview and is subject to change.
178273+ If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
178095178274 /api/v2/security_monitoring/configuration/integration_config/validate:
178096178275 post:
178097178276 description: |-
@@ -178317,6 +178496,132 @@ paths:
178317178496 x-unstable: |-
178318178497 **Note**: This endpoint is in preview and is subject to change.
178319178498 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
178499+ /api/v2/security_monitoring/configuration/integration_config/{integration_type}/activate:
178500+ post:
178501+ description: |-
178502+ Activate an entity context sync integration for a source type that does not require manually
178503+ supplied credentials (for example, Entra ID). If an integration of this type already exists,
178504+ it is returned (re-enabling it first if it was disabled) instead of creating a duplicate.
178505+ operationId: ActivateIntegration
178506+ parameters:
178507+ - description: The integration type to activate (for example, `entra_id`).
178508+ in: path
178509+ name: integration_type
178510+ required: true
178511+ schema:
178512+ example: entra_id
178513+ type: string
178514+ requestBody:
178515+ content:
178516+ application/json:
178517+ examples:
178518+ default:
178519+ value:
178520+ data:
178521+ attributes:
178522+ name: My Entra ID Integration
178523+ type: activate_entra_id_request
178524+ schema:
178525+ $ref: "#/components/schemas/SecurityMonitoringIntegrationActivateRequest"
178526+ description: Optional configuration overrides for the integration to activate.
178527+ required: false
178528+ responses:
178529+ "200":
178530+ content:
178531+ application/json:
178532+ examples:
178533+ default:
178534+ value:
178535+ data:
178536+ attributes:
178537+ created_at: "2026-05-01T12:00:00Z"
178538+ domain: default
178539+ enabled: true
178540+ integration_type: ENTRA_ID
178541+ modified_at: "2026-05-01T12:00:00Z"
178542+ name: My Entra ID Integration
178543+ state: valid
178544+ id: 11111111-2222-3333-4444-555555555555
178545+ type: integration_config
178546+ schema:
178547+ $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigResponse"
178548+ description: OK
178549+ "400":
178550+ $ref: "#/components/responses/BadRequestResponse"
178551+ "403":
178552+ $ref: "#/components/responses/NotAuthorizedResponse"
178553+ "404":
178554+ $ref: "#/components/responses/NotFoundResponse"
178555+ "429":
178556+ $ref: "#/components/responses/TooManyRequestsResponse"
178557+ security:
178558+ - apiKeyAuth: []
178559+ appKeyAuth: []
178560+ - AuthZ:
178561+ - manage_integrations
178562+ summary: Activate an entity context sync integration
178563+ tags: ["Security Monitoring"]
178564+ x-codegen-request-body-name: body
178565+ x-permission:
178566+ operator: OR
178567+ permissions:
178568+ - manage_integrations
178569+ x-unstable: |-
178570+ **Note**: This endpoint is in preview and is subject to change.
178571+ If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
178572+ /api/v2/security_monitoring/configuration/integration_config/{integration_type}/deactivate:
178573+ post:
178574+ description: Deactivate all active entity context sync integrations of the given source type (for example, Entra ID).
178575+ operationId: DeactivateIntegration
178576+ parameters:
178577+ - description: The integration type to deactivate (for example, `entra_id`).
178578+ in: path
178579+ name: integration_type
178580+ required: true
178581+ schema:
178582+ example: entra_id
178583+ type: string
178584+ responses:
178585+ "200":
178586+ content:
178587+ application/json:
178588+ examples:
178589+ default:
178590+ value:
178591+ data:
178592+ attributes:
178593+ created_at: "2026-05-01T12:00:00Z"
178594+ domain: default
178595+ enabled: false
178596+ integration_type: ENTRA_ID
178597+ modified_at: "2026-05-08T12:00:00Z"
178598+ name: My Entra ID Integration
178599+ state: valid
178600+ id: 11111111-2222-3333-4444-555555555555
178601+ type: integration_config
178602+ schema:
178603+ $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigResponse"
178604+ description: OK
178605+ "403":
178606+ $ref: "#/components/responses/NotAuthorizedResponse"
178607+ "404":
178608+ $ref: "#/components/responses/NotFoundResponse"
178609+ "429":
178610+ $ref: "#/components/responses/TooManyRequestsResponse"
178611+ security:
178612+ - apiKeyAuth: []
178613+ appKeyAuth: []
178614+ - AuthZ:
178615+ - manage_integrations
178616+ summary: Deactivate an entity context sync integration
178617+ tags: ["Security Monitoring"]
178618+ x-permission:
178619+ operator: OR
178620+ permissions:
178621+ - manage_integrations
178622+ x-unstable: |-
178623+ **Note**: This endpoint is in preview and is subject to change.
178624+ If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
178320178625 /api/v2/security_monitoring/configuration/notification_rules/send_notification_preview:
178321178626 post:
178322178627 description: Send a notification preview to test that a notification rule's targets are properly configured.
0 commit comments