@@ -89430,6 +89430,57 @@ components:
8943089430 - NEVER_ACTIVATED
8943189431 - ACTIVATED
8943289432 - DEACTIVATED
89433+ SecurityMonitoringContentPackAppSecDetails:
89434+ description: Details for an Application Security content pack.
89435+ properties:
89436+ type:
89437+ $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetailsType"
89438+ required:
89439+ - type
89440+ type: object
89441+ SecurityMonitoringContentPackAppSecDetailsType:
89442+ description: Type for Application Security content pack details.
89443+ enum:
89444+ - appsec
89445+ example: appsec
89446+ type: string
89447+ x-enum-varnames:
89448+ - APPSEC
89449+ SecurityMonitoringContentPackAuditDetails:
89450+ description: Details for an audit trail content pack.
89451+ properties:
89452+ type:
89453+ $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetailsType"
89454+ required:
89455+ - type
89456+ type: object
89457+ SecurityMonitoringContentPackAuditDetailsType:
89458+ description: Type for audit trail content pack details.
89459+ enum:
89460+ - audit
89461+ example: audit
89462+ type: string
89463+ x-enum-varnames:
89464+ - AUDIT
89465+ SecurityMonitoringContentPackEntityDetails:
89466+ description: Details for an entity or identity content pack.
89467+ properties:
89468+ cp_activation:
89469+ $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
89470+ type:
89471+ $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetailsType"
89472+ required:
89473+ - type
89474+ - cp_activation
89475+ type: object
89476+ SecurityMonitoringContentPackEntityDetailsType:
89477+ description: Type for entity content pack details.
89478+ enum:
89479+ - entity
89480+ example: entity
89481+ type: string
89482+ x-enum-varnames:
89483+ - ENTITY
8943389484 SecurityMonitoringContentPackIntegrationStatus:
8943489485 description: The installation status of the related integration.
8943589486 enum:
@@ -89452,38 +89503,74 @@ components:
8945289503 - PARTIALLY_INSTALLED
8945389504 - DETECTED
8945489505 - ERROR
89455- SecurityMonitoringContentPackStateAttributes :
89456- description: Attributes of a content pack state
89506+ SecurityMonitoringContentPackLogsDetails :
89507+ description: Details for a logs-based content pack.
8945789508 properties:
89458- cloud_siem_index_incorrect:
89459- description: Whether the cloud SIEM index configuration is incorrect (only applies to certain pricing models)
89460- example: false
89461- type: boolean
8946289509 cp_activation:
8946389510 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
89464- filters_configured_for_logs:
89511+ data_last_seen:
89512+ $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
89513+ filters_configured:
8946589514 description: |-
8946689515 Whether filters (Security Filters or Index Query depending on the pricing model) are
8946789516 present and correctly configured to route logs into Cloud SIEM.
8946889517 example: true
8946989518 type: boolean
8947089519 integration_installed_status:
8947189520 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
89472- logs_last_collected:
89473- $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
8947489521 logs_seen_from_any_index:
89475- description: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
89522+ description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
8947689523 example: true
8947789524 type: boolean
89478- state:
89479- $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
89525+ siem_index_incorrect:
89526+ description: Whether the Cloud SIEM index configuration is incorrect (only applies to certain pricing models).
89527+ example: false
89528+ type: boolean
89529+ type:
89530+ $ref: "#/components/schemas/SecurityFilterFilteredDataType"
8948089531 required:
89481- - state
89532+ - type
8948289533 - cp_activation
89534+ - data_last_seen
89535+ - integration_installed_status
89536+ - filters_configured
8948389537 - logs_seen_from_any_index
89484- - logs_last_collected
89485- - cloud_siem_index_incorrect
89486- - filters_configured_for_logs
89538+ - siem_index_incorrect
89539+ type: object
89540+ SecurityMonitoringContentPackOnboardingDetails:
89541+ description: |-
89542+ Content pack details returned when Cloud SIEM is inactive for the requesting organization.
89543+ properties:
89544+ integration_installed_status:
89545+ $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
89546+ logs_seen_from_any_index:
89547+ description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
89548+ example: true
89549+ type: boolean
89550+ type:
89551+ $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetailsType"
89552+ required:
89553+ - type
89554+ - logs_seen_from_any_index
89555+ type: object
89556+ SecurityMonitoringContentPackOnboardingDetailsType:
89557+ description: Type for onboarding content pack details.
89558+ enum:
89559+ - onboarding
89560+ example: onboarding
89561+ type: string
89562+ x-enum-varnames:
89563+ - ONBOARDING
89564+ SecurityMonitoringContentPackStateAttributes:
89565+ description: Attributes of a content pack state.
89566+ properties:
89567+ details:
89568+ $ref: "#/components/schemas/SecurityMonitoringContentPackStateDetails"
89569+ status:
89570+ $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
89571+ required:
89572+ - status
89573+ - details
8948789574 type: object
8948889575 SecurityMonitoringContentPackStateData:
8948989576 description: Content pack state data.
@@ -89501,13 +89588,42 @@ components:
8950189588 - type
8950289589 - attributes
8950389590 type: object
89591+ SecurityMonitoringContentPackStateDetails:
89592+ description: |-
89593+ Type-specific details for a content pack state. The set of fields present depends
89594+ on the content pack's `type`. When Cloud SIEM is inactive for the requesting organization, `onboarding` is returned instead of the content pack's usual type, such as `logs` or `vulnerability`.`
89595+ discriminator:
89596+ mapping:
89597+ appsec: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
89598+ audit: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
89599+ entity: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
89600+ logs: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
89601+ onboarding: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
89602+ threat_intel: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
89603+ vulnerability: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
89604+ propertyName: type
89605+ oneOf:
89606+ - $ref: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
89607+ - $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
89608+ - $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
89609+ - $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
89610+ - $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
89611+ - $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
89612+ - $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
8950489613 SecurityMonitoringContentPackStateMeta:
89505- description: Metadata for content pack states
89614+ description: Metadata for content pack states.
8950689615 properties:
8950789616 cloud_siem_index_incorrect:
89508- description: Whether the cloud SIEM index configuration is incorrect at the organization level
89617+ description: Whether the Cloud SIEM index configuration is incorrect for the organization.
8950989618 example: false
8951089619 type: boolean
89620+ retention_months:
89621+ description: |-
89622+ The number of months that standard logs are retained for organizations on the standalone_indexed` pricing model. This field is omitted for other pricing models.
89623+ example: 15
89624+ format: int32
89625+ maximum: 60
89626+ type: integer
8951189627 sku:
8951289628 $ref: "#/components/schemas/SecurityMonitoringSKU"
8951389629 required:
@@ -89545,6 +89661,7 @@ components:
8954589661 - active
8954689662 - warning
8954789663 - broken
89664+ - not_configured
8954889665 example: active
8954989666 type: string
8955089667 x-enum-descriptions:
@@ -89554,13 +89671,40 @@ components:
8955489671 - Activated; logs received within the last 24 hours.
8955589672 - Activated; integration not installed or logs last seen 24 to 72 hours ago.
8955689673 - Activated; no logs for over 72 hours, filter missing, or Cloud SIEM index incorrectly ordered.
89674+ - Activated, but no credentials are configured (entity content packs only).
8955789675 x-enum-varnames:
8955889676 - INSTALL
8955989677 - ACTIVATE
8956089678 - INITIALIZING
8956189679 - ACTIVE
8956289680 - WARNING
8956389681 - BROKEN
89682+ - NOT_CONFIGURED
89683+ SecurityMonitoringContentPackThreatIntelDetails:
89684+ description: Details for a threat intelligence content pack.
89685+ properties:
89686+ cp_activation:
89687+ $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
89688+ data_last_seen:
89689+ $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
89690+ integration_installed_status:
89691+ $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
89692+ type:
89693+ $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetailsType"
89694+ required:
89695+ - type
89696+ - cp_activation
89697+ - data_last_seen
89698+ - integration_installed_status
89699+ type: object
89700+ SecurityMonitoringContentPackThreatIntelDetailsType:
89701+ description: Type for threat intelligence content pack details.
89702+ enum:
89703+ - threat_intel
89704+ example: threat_intel
89705+ type: string
89706+ x-enum-varnames:
89707+ - THREAT_INTEL
8956489708 SecurityMonitoringContentPackTimestampBucket:
8956589709 description: Timestamp bucket indicating when logs were last collected.
8956689710 enum:
@@ -89583,6 +89727,31 @@ components:
8958389727 - WITHIN_24_TO_72_HOURS
8958489728 - OVER_72H_TO_30D
8958589729 - OVER_30D
89730+ SecurityMonitoringContentPackVulnerabilityDetails:
89731+ description: Details for a vulnerability content pack.
89732+ properties:
89733+ cp_activation:
89734+ $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
89735+ data_last_seen:
89736+ $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
89737+ integration_installed_status:
89738+ $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
89739+ type:
89740+ $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetailsType"
89741+ required:
89742+ - type
89743+ - cp_activation
89744+ - data_last_seen
89745+ - integration_installed_status
89746+ type: object
89747+ SecurityMonitoringContentPackVulnerabilityDetailsType:
89748+ description: Type for vulnerability content pack details.
89749+ enum:
89750+ - vulnerability
89751+ example: vulnerability
89752+ type: string
89753+ x-enum-varnames:
89754+ - VULNERABILITY
8958689755 SecurityMonitoringCriticalAsset:
8958789756 description: The critical asset's properties.
8958889757 properties:
@@ -91954,12 +92123,16 @@ components:
9195492123 - per_gb_analyzed
9195592124 - per_event_in_siem_index_2023
9195692125 - add_on_2024
92126+ - standalone_indexed
92127+ - unknown
9195792128 example: add_on_2024
9195892129 type: string
9195992130 x-enum-varnames:
9196092131 - PER_GB_ANALYZED
9196192132 - PER_EVENT_IN_SIEM_INDEX_2023
9196292133 - ADD_ON_2024
92134+ - STANDALONE_INDEXED
92135+ - UNKNOWN
9196392136 SecurityMonitoringSchedulingOptions:
9196492137 description: Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
9196592138 nullable: true
@@ -183928,12 +184101,15 @@ paths:
183928184101 value:
183929184102 data:
183930184103 - attributes:
183931- cloud_siem_index_incorrect: false
183932- cp_activation: activated
183933- filters_configured_for_logs: true
183934- logs_last_collected: within_24_hours
183935- logs_seen_from_any_index: true
183936- state: active
184104+ details:
184105+ cp_activation: activated
184106+ data_last_seen: within_24_hours
184107+ filters_configured: true
184108+ integration_installed_status: installed
184109+ logs_seen_from_any_index: true
184110+ siem_index_incorrect: false
184111+ type: logs
184112+ status: active
183937184113 id: aws-cloudtrail
183938184114 type: content_pack_state
183939184115 meta:
0 commit comments