@@ -62654,23 +62654,19 @@ components:
6265462654 - DONE
6265562655 - TIMEOUT
6265662656 SecurityMonitoringContentPackActivation:
62657- description: The activation status of a content pack.
62657+ description: The activation status of a content pack
6265862658 enum:
6265962659 - never_activated
6266062660 - activated
6266162661 - deactivated
6266262662 example: activated
6266362663 type: string
62664- x-enum-descriptions:
62665- - Pack has never been activated for this organization.
62666- - Pack is currently activated.
62667- - Pack was previously activated but has since been deactivated.
6266862664 x-enum-varnames:
6266962665 - NEVER_ACTIVATED
6267062666 - ACTIVATED
6267162667 - DEACTIVATED
6267262668 SecurityMonitoringContentPackIntegrationStatus:
62673- description: The installation status of the related integration.
62669+ description: The installation status of the related integration
6267462670 enum:
6267562671 - installed
6267662672 - available
@@ -62679,12 +62675,6 @@ components:
6267962675 - error
6268062676 example: installed
6268162677 type: string
62682- x-enum-descriptions:
62683- - Integration is fully installed.
62684- - Integration exists in the catalog but is not installed.
62685- - Integration is only partially configured.
62686- - Integration detected (for example, logs are flowing) but not explicitly installed.
62687- - Integration is in an error state.
6268862678 x-enum-varnames:
6268962679 - INSTALLED
6269062680 - AVAILABLE
@@ -62701,17 +62691,15 @@ components:
6270162691 cp_activation:
6270262692 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
6270362693 filters_configured_for_logs:
62704- description: |-
62705- Whether filters (Security Filters or Index Query depending on the pricing model) are
62706- present and correctly configured to route logs into Cloud SIEM.
62694+ description: Whether filters (Security Filters or Index Query depending on the pricing model) are configured for logs
6270762695 example: true
6270862696 type: boolean
6270962697 integration_installed_status:
6271062698 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
6271162699 logs_last_collected:
6271262700 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
6271362701 logs_seen_from_any_index:
62714- description: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
62702+ description: Whether logs have been seen from any index
6271562703 example: true
6271662704 type: boolean
6271762705 state:
@@ -62776,7 +62764,7 @@ components:
6277662764 - meta
6277762765 type: object
6277862766 SecurityMonitoringContentPackStatus:
62779- description: The current operational status of a content pack.
62767+ description: The current status of a content pack
6278062768 enum:
6278162769 - install
6278262770 - activate
@@ -62786,13 +62774,6 @@ components:
6278662774 - broken
6278762775 example: active
6278862776 type: string
62789- x-enum-descriptions:
62790- - Not activated; no logs detected in the last 72 hours.
62791- - Not activated; logs are flowing into a Datadog index but not yet routed through Cloud SIEM.
62792- - Activated; awaiting first log ingestion.
62793- - Activated; logs received within the last 24 hours.
62794- - Activated; integration not installed or logs last seen 24 to 72 hours ago.
62795- - Activated; no logs for over 72 hours, filter missing, or Cloud SIEM index incorrectly ordered.
6279662777 x-enum-varnames:
6279762778 - INSTALL
6279862779 - ACTIVATE
@@ -62801,7 +62782,7 @@ components:
6280162782 - WARNING
6280262783 - BROKEN
6280362784 SecurityMonitoringContentPackTimestampBucket:
62804- description: Timestamp bucket indicating when logs were last collected.
62785+ description: Timestamp bucket indicating when logs were last collected
6280562786 enum:
6280662787 - not_seen
6280762788 - within_24_hours
@@ -62810,12 +62791,6 @@ components:
6281062791 - over_30d
6281162792 example: within_24_hours
6281262793 type: string
62813- x-enum-descriptions:
62814- - No logs observed.
62815- - Logs received within the last 24 hours.
62816- - Logs last seen 24 to 72 hours ago.
62817- - Logs last seen 3 to 30 days ago.
62818- - Logs last seen more than 30 days ago.
6281962794 x-enum-varnames:
6282062795 - NOT_SEEN
6282162796 - WITHIN_24_HOURS
@@ -63906,7 +63881,7 @@ components:
6390663881 - $ref: "#/components/schemas/SecurityMonitoringSignalRulePayload"
6390763882 - $ref: "#/components/schemas/CloudConfigurationRulePayload"
6390863883 SecurityMonitoringSKU:
63909- description: The Cloud SIEM pricing model (SKU) for the organization.
63884+ description: The SIEM pricing model (SKU) for the organization
6391063885 enum:
6391163886 - per_gb_analyzed
6391263887 - per_event_in_siem_index_2023
@@ -88880,11 +88855,11 @@ paths:
8888088855 - **PERCENT**: Allocates fixed percentages to specific tags. Requires: allocated_by (array of percentage allocations).
8888188856
8888288857 **Filter Conditions:**
88883- - Use **value** for single-value conditions: "is", "is not", "contains", "does not contain", " =", "!=", "like", "not like", "is all values", "is untagged "
88858+ - Use **value** for single-value conditions: "is", "is not", "contains", "=", "!=", "like", "not like"
8888488859 - Use **values** for multi-value conditions: "in", "not in"
8888588860 - Cannot use both value and values simultaneously.
8888688861
88887- **Supported operators**: is, is not, is all values, is untagged, contains, does not contain , in, not in, =, !=, like, not like
88862+ **Supported operators**: is, is not, contains, in, not in, =, !=, like, not like
8888888863 operationId: CreateCustomAllocationRule
8888988864 requestBody:
8889088865 content:
@@ -89052,11 +89027,11 @@ paths:
8905289027 - **USAGE_METRIC**: Allocates based on usage metrics (implementation varies).
8905389028
8905489029 **Filter Conditions:**
89055- - Use **value** for single-value conditions: "is", "is not", "contains", "does not contain", " =", "!=", "like", "not like", "is all values", "is untagged "
89030+ - Use **value** for single-value conditions: "is", "is not", "contains", "=", "!=", "like", "not like"
8905689031 - Use **values** for multi-value conditions: "in", "not in"
8905789032 - Cannot use both value and values simultaneously.
8905889033
89059- **Supported operators**: is, is not, is all values, is untagged, contains, does not contain , in, not in, =, !=, like, not like
89034+ **Supported operators**: is, is not, contains, in, not in, =, !=, like, not like
8906089035 operationId: UpdateCustomAllocationRule
8906189036 parameters:
8906289037 - description: The unique identifier of the custom allocation rule
@@ -118729,8 +118704,9 @@ paths:
118729118704 /api/v2/security_monitoring/content_packs/states:
118730118705 get:
118731118706 description: |-
118732- Get the activation state, integration status, and log collection status
118733- for all Cloud SIEM content packs.
118707+ Get the activation and configuration states for all security monitoring content packs.
118708+ This endpoint returns status information about each content pack including activation state,
118709+ integration status, and log collection status.
118734118710 operationId: GetContentPacksStates
118735118711 responses:
118736118712 "200":
@@ -118753,31 +118729,21 @@ paths:
118753118729 description: Not Found
118754118730 "429":
118755118731 $ref: "#/components/responses/TooManyRequestsResponse"
118756- security:
118757- - apiKeyAuth: []
118758- appKeyAuth: []
118759- - AuthZ:
118760- - security_monitoring_filters_read
118761118732 summary: Get content pack states
118762118733 tags:
118763118734 - Security Monitoring
118764- "x-permission":
118765- operator: OR
118766- permissions:
118767- - security_monitoring_filters_read
118768- - logs_read_index_data
118769118735 x-unstable: |-
118770118736 **Note**: This endpoint is in preview and is subject to change.
118771118737 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
118772118738 /api/v2/security_monitoring/content_packs/{content_pack_id}/activate:
118773118739 put:
118774118740 description: |-
118775- Activate a Cloud SIEM content pack. This operation configures the necessary
118741+ Activate a security monitoring content pack. This operation configures the necessary
118776118742 log filters or security filters depending on the pricing model and updates the content
118777118743 pack activation state.
118778118744 operationId: ActivateContentPack
118779118745 parameters:
118780- - description: The ID of the content pack to activate (for example, `aws-cloudtrail`) .
118746+ - description: The ID of the content pack to activate.
118781118747 in: path
118782118748 name: content_pack_id
118783118749 required: true
@@ -118801,30 +118767,20 @@ paths:
118801118767 description: Not Found
118802118768 "429":
118803118769 $ref: "#/components/responses/TooManyRequestsResponse"
118804- security:
118805- - apiKeyAuth: []
118806- appKeyAuth: []
118807- - AuthZ:
118808- - security_monitoring_filters_write
118809118770 summary: Activate content pack
118810118771 tags:
118811118772 - Security Monitoring
118812- "x-permission":
118813- operator: OR
118814- permissions:
118815- - security_monitoring_filters_write
118816- - logs_modify_indexes
118817118773 x-unstable: |-
118818118774 **Note**: This endpoint is in preview and is subject to change.
118819118775 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
118820118776 /api/v2/security_monitoring/content_packs/{content_pack_id}/deactivate:
118821118777 put:
118822118778 description: |-
118823- Deactivate a Cloud SIEM content pack. This operation removes the content pack's
118779+ Deactivate a security monitoring content pack. This operation removes the content pack's
118824118780 configuration from log filters or security filters and updates the content pack activation state.
118825118781 operationId: DeactivateContentPack
118826118782 parameters:
118827- - description: The ID of the content pack to deactivate (for example, `aws-cloudtrail`) .
118783+ - description: The ID of the content pack to deactivate.
118828118784 in: path
118829118785 name: content_pack_id
118830118786 required: true
@@ -118848,19 +118804,9 @@ paths:
118848118804 description: Not Found
118849118805 "429":
118850118806 $ref: "#/components/responses/TooManyRequestsResponse"
118851- security:
118852- - apiKeyAuth: []
118853- appKeyAuth: []
118854- - AuthZ:
118855- - security_monitoring_filters_write
118856118807 summary: Deactivate content pack
118857118808 tags:
118858118809 - Security Monitoring
118859- "x-permission":
118860- operator: OR
118861- permissions:
118862- - security_monitoring_filters_write
118863- - logs_modify_indexes
118864118810 x-unstable: |-
118865118811 **Note**: This endpoint is in preview and is subject to change.
118866118812 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
0 commit comments