@@ -88412,6 +88412,57 @@ components:
8841288412 - NEVER_ACTIVATED
8841388413 - ACTIVATED
8841488414 - DEACTIVATED
88415+ SecurityMonitoringContentPackAppSecDetails:
88416+ description: Details for an Application Security content pack.
88417+ properties:
88418+ type:
88419+ $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetailsType"
88420+ required:
88421+ - type
88422+ type: object
88423+ SecurityMonitoringContentPackAppSecDetailsType:
88424+ description: Type for Application Security content pack details.
88425+ enum:
88426+ - appsec
88427+ example: appsec
88428+ type: string
88429+ x-enum-varnames:
88430+ - APPSEC
88431+ SecurityMonitoringContentPackAuditDetails:
88432+ description: Details for an audit trail content pack.
88433+ properties:
88434+ type:
88435+ $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetailsType"
88436+ required:
88437+ - type
88438+ type: object
88439+ SecurityMonitoringContentPackAuditDetailsType:
88440+ description: Type for audit trail content pack details.
88441+ enum:
88442+ - audit
88443+ example: audit
88444+ type: string
88445+ x-enum-varnames:
88446+ - AUDIT
88447+ SecurityMonitoringContentPackEntityDetails:
88448+ description: Details for an entity or identity content pack.
88449+ properties:
88450+ cp_activation:
88451+ $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
88452+ type:
88453+ $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetailsType"
88454+ required:
88455+ - type
88456+ - cp_activation
88457+ type: object
88458+ SecurityMonitoringContentPackEntityDetailsType:
88459+ description: Type for entity content pack details.
88460+ enum:
88461+ - entity
88462+ example: entity
88463+ type: string
88464+ x-enum-varnames:
88465+ - ENTITY
8841588466 SecurityMonitoringContentPackIntegrationStatus:
8841688467 description: The installation status of the related integration.
8841788468 enum:
@@ -88434,38 +88485,75 @@ components:
8843488485 - PARTIALLY_INSTALLED
8843588486 - DETECTED
8843688487 - ERROR
88437- SecurityMonitoringContentPackStateAttributes :
88438- description: Attributes of a content pack state
88488+ SecurityMonitoringContentPackLogsDetails :
88489+ description: Details for a logs-based content pack.
8843988490 properties:
88440- cloud_siem_index_incorrect:
88441- description: Whether the cloud SIEM index configuration is incorrect (only applies to certain pricing models)
88442- example: false
88443- type: boolean
8844488491 cp_activation:
8844588492 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
88446- filters_configured_for_logs:
88493+ data_last_seen:
88494+ $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
88495+ filters_configured:
8844788496 description: |-
8844888497 Whether filters (Security Filters or Index Query depending on the pricing model) are
8844988498 present and correctly configured to route logs into Cloud SIEM.
8845088499 example: true
8845188500 type: boolean
8845288501 integration_installed_status:
8845388502 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
88454- logs_last_collected:
88455- $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
8845688503 logs_seen_from_any_index:
8845788504 description: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
8845888505 example: true
8845988506 type: boolean
88460- state:
88461- $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
88507+ siem_index_incorrect:
88508+ description: Whether the cloud SIEM index configuration is incorrect (only applies to certain pricing models).
88509+ example: false
88510+ type: boolean
88511+ type:
88512+ $ref: "#/components/schemas/SecurityFilterFilteredDataType"
8846288513 required:
88463- - state
88514+ - type
8846488515 - cp_activation
88516+ - data_last_seen
88517+ - integration_installed_status
88518+ - filters_configured
8846588519 - logs_seen_from_any_index
88466- - logs_last_collected
88467- - cloud_siem_index_incorrect
88468- - filters_configured_for_logs
88520+ - siem_index_incorrect
88521+ type: object
88522+ SecurityMonitoringContentPackOnboardingDetails:
88523+ description: |-
88524+ Details for a content pack returned when the Cloud SIEM product is inactive
88525+ for the requesting organization.
88526+ properties:
88527+ integration_installed_status:
88528+ $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
88529+ logs_seen_from_any_index:
88530+ description: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
88531+ example: true
88532+ type: boolean
88533+ type:
88534+ $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetailsType"
88535+ required:
88536+ - type
88537+ - logs_seen_from_any_index
88538+ type: object
88539+ SecurityMonitoringContentPackOnboardingDetailsType:
88540+ description: Type for onboarding content pack details.
88541+ enum:
88542+ - onboarding
88543+ example: onboarding
88544+ type: string
88545+ x-enum-varnames:
88546+ - ONBOARDING
88547+ SecurityMonitoringContentPackStateAttributes:
88548+ description: Attributes of a content pack state.
88549+ properties:
88550+ details:
88551+ $ref: "#/components/schemas/SecurityMonitoringContentPackStateDetails"
88552+ status:
88553+ $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
88554+ required:
88555+ - status
88556+ - details
8846988557 type: object
8847088558 SecurityMonitoringContentPackStateData:
8847188559 description: Content pack state data.
@@ -88483,13 +88571,45 @@ components:
8848388571 - type
8848488572 - attributes
8848588573 type: object
88574+ SecurityMonitoringContentPackStateDetails:
88575+ description: |-
88576+ Type-specific details for a content pack state. The set of fields present depends
88577+ on the content pack's `type`. `onboarding` is returned instead of the content pack's
88578+ usual type (for example `logs` or `vulnerability`) when the Cloud SIEM product is
88579+ inactive for the requesting organization.
88580+ discriminator:
88581+ mapping:
88582+ appsec: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
88583+ audit: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
88584+ entity: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
88585+ logs: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
88586+ onboarding: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
88587+ threat_intel: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
88588+ vulnerability: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
88589+ propertyName: type
88590+ oneOf:
88591+ - $ref: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
88592+ - $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
88593+ - $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
88594+ - $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
88595+ - $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
88596+ - $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
88597+ - $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
8848688598 SecurityMonitoringContentPackStateMeta:
88487- description: Metadata for content pack states
88599+ description: Metadata for content pack states.
8848888600 properties:
8848988601 cloud_siem_index_incorrect:
88490- description: Whether the cloud SIEM index configuration is incorrect at the organization level
88602+ description: Whether the cloud SIEM index configuration is incorrect at the organization level.
8849188603 example: false
8849288604 type: boolean
88605+ retention_months:
88606+ description: |-
88607+ The standard log retention, in months, for organizations on the `standalone_indexed`
88608+ pricing model. Absent for other pricing models.
88609+ example: 15
88610+ format: int32
88611+ maximum: 60
88612+ type: integer
8849388613 sku:
8849488614 $ref: "#/components/schemas/SecurityMonitoringSKU"
8849588615 required:
@@ -88527,6 +88647,7 @@ components:
8852788647 - active
8852888648 - warning
8852988649 - broken
88650+ - not_configured
8853088651 example: active
8853188652 type: string
8853288653 x-enum-descriptions:
@@ -88536,13 +88657,40 @@ components:
8853688657 - Activated; logs received within the last 24 hours.
8853788658 - Activated; integration not installed or logs last seen 24 to 72 hours ago.
8853888659 - Activated; no logs for over 72 hours, filter missing, or Cloud SIEM index incorrectly ordered.
88660+ - Activated, but no credentials are configured (entity content packs only).
8853988661 x-enum-varnames:
8854088662 - INSTALL
8854188663 - ACTIVATE
8854288664 - INITIALIZING
8854388665 - ACTIVE
8854488666 - WARNING
8854588667 - BROKEN
88668+ - NOT_CONFIGURED
88669+ SecurityMonitoringContentPackThreatIntelDetails:
88670+ description: Details for a threat intelligence content pack.
88671+ properties:
88672+ cp_activation:
88673+ $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
88674+ data_last_seen:
88675+ $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
88676+ integration_installed_status:
88677+ $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
88678+ type:
88679+ $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetailsType"
88680+ required:
88681+ - type
88682+ - cp_activation
88683+ - data_last_seen
88684+ - integration_installed_status
88685+ type: object
88686+ SecurityMonitoringContentPackThreatIntelDetailsType:
88687+ description: Type for threat intelligence content pack details.
88688+ enum:
88689+ - threat_intel
88690+ example: threat_intel
88691+ type: string
88692+ x-enum-varnames:
88693+ - THREAT_INTEL
8854688694 SecurityMonitoringContentPackTimestampBucket:
8854788695 description: Timestamp bucket indicating when logs were last collected.
8854888696 enum:
@@ -88565,6 +88713,31 @@ components:
8856588713 - WITHIN_24_TO_72_HOURS
8856688714 - OVER_72H_TO_30D
8856788715 - OVER_30D
88716+ SecurityMonitoringContentPackVulnerabilityDetails:
88717+ description: Details for a vulnerability content pack.
88718+ properties:
88719+ cp_activation:
88720+ $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
88721+ data_last_seen:
88722+ $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
88723+ integration_installed_status:
88724+ $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
88725+ type:
88726+ $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetailsType"
88727+ required:
88728+ - type
88729+ - cp_activation
88730+ - data_last_seen
88731+ - integration_installed_status
88732+ type: object
88733+ SecurityMonitoringContentPackVulnerabilityDetailsType:
88734+ description: Type for vulnerability content pack details.
88735+ enum:
88736+ - vulnerability
88737+ example: vulnerability
88738+ type: string
88739+ x-enum-varnames:
88740+ - VULNERABILITY
8856888741 SecurityMonitoringCriticalAsset:
8856988742 description: The critical asset's properties.
8857088743 properties:
@@ -90936,12 +91109,16 @@ components:
9093691109 - per_gb_analyzed
9093791110 - per_event_in_siem_index_2023
9093891111 - add_on_2024
91112+ - standalone_indexed
91113+ - unknown
9093991114 example: add_on_2024
9094091115 type: string
9094191116 x-enum-varnames:
9094291117 - PER_GB_ANALYZED
9094391118 - PER_EVENT_IN_SIEM_INDEX_2023
9094491119 - ADD_ON_2024
91120+ - STANDALONE_INDEXED
91121+ - UNKNOWN
9094591122 SecurityMonitoringSchedulingOptions:
9094691123 description: Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
9094791124 nullable: true
@@ -182013,12 +182190,15 @@ paths:
182013182190 value:
182014182191 data:
182015182192 - attributes:
182016- cloud_siem_index_incorrect: false
182017- cp_activation: activated
182018- filters_configured_for_logs: true
182019- logs_last_collected: within_24_hours
182020- logs_seen_from_any_index: true
182021- state: active
182193+ details:
182194+ cp_activation: activated
182195+ data_last_seen: within_24_hours
182196+ filters_configured: true
182197+ integration_installed_status: installed
182198+ logs_seen_from_any_index: true
182199+ siem_index_incorrect: false
182200+ type: logs
182201+ status: active
182022182202 id: aws-cloudtrail
182023182203 type: content_pack_state
182024182204 meta:
0 commit comments