Skip to content

Update documentation according to new content pack states endpoint response shape#4102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
api-clients-generation-pipeline merged 1 commit into from
Jul 24, 2026
Merged

Update documentation according to new content pack states endpoint response shape #4102

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
224 changes: 200 additions & 24 deletions .generator/schemas/v2/openapi.yaml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -89626,6 +89626,57 @@ components:
- NEVER_ACTIVATED
- ACTIVATED
- DEACTIVATED
SecurityMonitoringContentPackAppSecDetails:
description: Details for an Application Security content pack.
properties:
type:
$ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetailsType"
required:
- type
type: object
SecurityMonitoringContentPackAppSecDetailsType:
description: Type for Application Security content pack details.
enum:
- appsec
example: appsec
type: string
x-enum-varnames:
- APPSEC
SecurityMonitoringContentPackAuditDetails:
description: Details for an audit trail content pack.
properties:
type:
$ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetailsType"
required:
- type
type: object
SecurityMonitoringContentPackAuditDetailsType:
description: Type for audit trail content pack details.
enum:
- audit
example: audit
type: string
x-enum-varnames:
- AUDIT
SecurityMonitoringContentPackEntityDetails:
description: Details for an entity or identity content pack.
properties:
cp_activation:
$ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
type:
$ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetailsType"
required:
- type
- cp_activation
type: object
SecurityMonitoringContentPackEntityDetailsType:
description: Type for entity content pack details.
enum:
- entity
example: entity
type: string
x-enum-varnames:
- ENTITY
SecurityMonitoringContentPackIntegrationStatus:
description: The installation status of the related integration.
enum:
Expand All@@ -89648,38 +89699,74 @@ components:
- PARTIALLY_INSTALLED
- DETECTED
- ERROR
SecurityMonitoringContentPackStateAttributes:
description: Attributes of a content pack state
SecurityMonitoringContentPackLogsDetails:
description: Details for a logs-based content pack.
properties:
cloud_siem_index_incorrect:
description: Whether the cloud SIEM index configuration is incorrect (only applies to certain pricing models)
example: false
type: boolean
cp_activation:
$ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
filters_configured_for_logs:
data_last_seen:
$ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
filters_configured:
description: |-
Whether filters (Security Filters or Index Query depending on the pricing model) are
present and correctly configured to route logs into Cloud SIEM.
example: true
type: boolean
integration_installed_status:
$ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
logs_last_collected:
$ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
logs_seen_from_any_index:
description: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
example: true
type: boolean
state:
$ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
siem_index_incorrect:
description: Whether the Cloud SIEM index configuration is incorrect (only applies to certain pricing models).
example: false
type: boolean
type:
$ref: "#/components/schemas/SecurityFilterFilteredDataType"
required:
- state
- type
- cp_activation
- data_last_seen
- integration_installed_status
- filters_configured
- logs_seen_from_any_index
- logs_last_collected
- cloud_siem_index_incorrect
- filters_configured_for_logs
- siem_index_incorrect
type: object
SecurityMonitoringContentPackOnboardingDetails:
description: |-
Content pack details returned when Cloud SIEM is inactive for the requesting organization.
properties:
integration_installed_status:
$ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
logs_seen_from_any_index:
description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
example: true
type: boolean
type:
$ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetailsType"
required:
- type
- logs_seen_from_any_index
type: object
SecurityMonitoringContentPackOnboardingDetailsType:
description: Type for onboarding content pack details.
enum:
- onboarding
example: onboarding
type: string
x-enum-varnames:
- ONBOARDING
SecurityMonitoringContentPackStateAttributes:
description: Attributes of a content pack state.
properties:
details:
$ref: "#/components/schemas/SecurityMonitoringContentPackStateDetails"
status:
$ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
required:
- status
- details
type: object
SecurityMonitoringContentPackStateData:
description: Content pack state data.
Expand All@@ -89697,13 +89784,42 @@ components:
- type
- attributes
type: object
SecurityMonitoringContentPackStateDetails:
description: |-
Type-specific details for a content pack state. The set of fields present depends
on the content pack's `type`. When Cloud SIEM is inactive for the requesting organization, `onboarding` is returned instead of the content pack's usual type, such as `logs` or `vulnerability`.`
discriminator:
mapping:
appsec: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
audit: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
entity: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
logs: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
onboarding: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
threat_intel: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
vulnerability: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
propertyName: type
oneOf:
- $ref: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
- $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
- $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
- $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
- $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
- $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
- $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
SecurityMonitoringContentPackStateMeta:
description: Metadata for content pack states
description: Metadata for content pack states.
properties:
cloud_siem_index_incorrect:
description: Whether the cloud SIEM index configuration is incorrect at the organization level
description: Whether the Cloud SIEM index configuration is incorrect for the organization.
example: false
type: boolean
retention_months:
description: |-
The number of months that standard logs are retained for organizations on the standalone_indexed` pricing model. This field is omitted for other pricing models.
example: 15
format: int32
maximum: 60
type: integer
sku:
$ref: "#/components/schemas/SecurityMonitoringSKU"
required:
Expand DownExpand Up@@ -89741,6 +89857,7 @@ components:
- active
- warning
- broken
- not_configured
example: active
type: string
x-enum-descriptions:
Expand All@@ -89750,13 +89867,40 @@ components:
- Activated; logs received within the last 24 hours.
- Activated; integration not installed or logs last seen 24 to 72 hours ago.
- Activated; no logs for over 72 hours, filter missing, or Cloud SIEM index incorrectly ordered.
- Activated, but no credentials are configured (entity content packs only).
x-enum-varnames:
- INSTALL
- ACTIVATE
- INITIALIZING
- ACTIVE
- WARNING
- BROKEN
- NOT_CONFIGURED
SecurityMonitoringContentPackThreatIntelDetails:
description: Details for a threat intelligence content pack.
properties:
cp_activation:
$ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
data_last_seen:
$ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
integration_installed_status:
$ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
type:
$ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetailsType"
required:
- type
- cp_activation
- data_last_seen
- integration_installed_status
type: object
SecurityMonitoringContentPackThreatIntelDetailsType:
description: Type for threat intelligence content pack details.
enum:
- threat_intel
example: threat_intel
type: string
x-enum-varnames:
- THREAT_INTEL
SecurityMonitoringContentPackTimestampBucket:
description: Timestamp bucket indicating when logs were last collected.
enum:
Expand All@@ -89779,6 +89923,31 @@ components:
- WITHIN_24_TO_72_HOURS
- OVER_72H_TO_30D
- OVER_30D
SecurityMonitoringContentPackVulnerabilityDetails:
description: Details for a vulnerability content pack.
properties:
cp_activation:
$ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
data_last_seen:
$ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
integration_installed_status:
$ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
type:
$ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetailsType"
required:
- type
- cp_activation
- data_last_seen
- integration_installed_status
type: object
SecurityMonitoringContentPackVulnerabilityDetailsType:
description: Type for vulnerability content pack details.
enum:
- vulnerability
example: vulnerability
type: string
x-enum-varnames:
- VULNERABILITY
SecurityMonitoringCriticalAsset:
description: The critical asset's properties.
properties:
Expand DownExpand Up@@ -92150,12 +92319,16 @@ components:
- per_gb_analyzed
- per_event_in_siem_index_2023
- add_on_2024
- standalone_indexed
- unknown
example: add_on_2024
type: string
x-enum-varnames:
- PER_GB_ANALYZED
- PER_EVENT_IN_SIEM_INDEX_2023
- ADD_ON_2024
- STANDALONE_INDEXED
- UNKNOWN
SecurityMonitoringSchedulingOptions:
description: Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
nullable: true
Expand DownExpand Up@@ -184119,12 +184292,15 @@ paths:
value:
data:
- attributes:
cloud_siem_index_incorrect: false
cp_activation: activated
filters_configured_for_logs: true
logs_last_collected: within_24_hours
logs_seen_from_any_index: true
state: active
details:
cp_activation: activated
data_last_seen: within_24_hours
filters_configured: true
integration_installed_status: installed
logs_seen_from_any_index: true
siem_index_incorrect: false
type: logs
status: active
id: aws-cloudtrail
type: content_pack_state
meta:
Expand Down
Loading
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Update documentation according to new content pack states endpoint response shape by api-clients-generation-pipeline[bot] · Pull Request #4102 · DataDog/datadog-api-client-java · GitHub
Skip to content
Update documentation according to new content pack states endpoint response shape#4102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

api-clients-generation-pipeline
merged 1 commit into

from

Jul 24, 2026
 Merged


Update documentation according to new content pack states endpoint response shape
#4102
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


224 changes: 200 additions & 24 deletions
.generator/schemas/v2/openapi.yaml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89626,6 +89626,57 @@ components:
 - NEVER_ACTIVATED
 - ACTIVATED
 - DEACTIVATED
 SecurityMonitoringContentPackAppSecDetails:
 description: Details for an Application Security content pack.
 properties:
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetailsType"
 required:
 - type
 type: object
 SecurityMonitoringContentPackAppSecDetailsType:
 description: Type for Application Security content pack details.
 enum:
 - appsec
 example: appsec
 type: string
 x-enum-varnames:
 - APPSEC
 SecurityMonitoringContentPackAuditDetails:
 description: Details for an audit trail content pack.
 properties:
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetailsType"
 required:
 - type
 type: object
 SecurityMonitoringContentPackAuditDetailsType:
 description: Type for audit trail content pack details.
 enum:
 - audit
 example: audit
 type: string
 x-enum-varnames:
 - AUDIT
 SecurityMonitoringContentPackEntityDetails:
 description: Details for an entity or identity content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetailsType"
 required:
 - type
 - cp_activation
 type: object
 SecurityMonitoringContentPackEntityDetailsType:
 description: Type for entity content pack details.
 enum:
 - entity
 example: entity
 type: string
 x-enum-varnames:
 - ENTITY
 SecurityMonitoringContentPackIntegrationStatus:
 description: The installation status of the related integration.
 enum:
Expand All@@ -89648,38 +89699,74 @@ components:
 - PARTIALLY_INSTALLED
 - DETECTED
 - ERROR
SecurityMonitoringContentPackStateAttributes:
 description: Attributes of a content pack state
SecurityMonitoringContentPackLogsDetails:
 description: Details for a logs-based content pack.
 properties:
 cloud_siem_index_incorrect:
 description: Whether the cloud SIEM index configuration is incorrect (only applies to certain pricing models)
 example: false
 type: boolean
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 filters_configured_for_logs:
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 filters_configured:
 description: |-
 Whether filters (Security Filters or Index Query depending on the pricing model) are
 present and correctly configured to route logs into Cloud SIEM.
 example: true
 type: boolean
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 logs_last_collected:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 logs_seen_from_any_index:
 description: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
 description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
 example: true
 type: boolean
 state:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
 siem_index_incorrect:
 description: Whether the Cloud SIEM index configuration is incorrect (only applies to certain pricing models).
 example: false
 type: boolean
 type:
 $ref: "#/components/schemas/SecurityFilterFilteredDataType"
 required:
 - state
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 - filters_configured
 - logs_seen_from_any_index
 - logs_last_collected
 - cloud_siem_index_incorrect
 - filters_configured_for_logs
 - siem_index_incorrect
 type: object
 SecurityMonitoringContentPackOnboardingDetails:
 description: |-
 Content pack details returned when Cloud SIEM is inactive for the requesting organization.
 properties:
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 logs_seen_from_any_index:
 description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
 example: true
 type: boolean
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetailsType"
 required:
 - type
 - logs_seen_from_any_index
 type: object
 SecurityMonitoringContentPackOnboardingDetailsType:
 description: Type for onboarding content pack details.
 enum:
 - onboarding
 example: onboarding
 type: string
 x-enum-varnames:
 - ONBOARDING
 SecurityMonitoringContentPackStateAttributes:
 description: Attributes of a content pack state.
 properties:
 details:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStateDetails"
 status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
 required:
 - status
 - details
 type: object
 SecurityMonitoringContentPackStateData:
 description: Content pack state data.
Expand All@@ -89697,13 +89784,42 @@ components:
 - type
 - attributes
 type: object
 SecurityMonitoringContentPackStateDetails:
 description: |-
 Type-specific details for a content pack state. The set of fields present depends
 on the content pack's `type`. When Cloud SIEM is inactive for the requesting organization, `onboarding` is returned instead of the content pack's usual type, such as `logs` or `vulnerability`.`
 discriminator:
 mapping:
 appsec: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
 audit: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
 entity: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
 logs: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
 onboarding: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
 threat_intel: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
 vulnerability: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
 propertyName: type
 oneOf:
 - $ref: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
 SecurityMonitoringContentPackStateMeta:
 description: Metadata for content pack states
 description: Metadata for content pack states.
 properties:
 cloud_siem_index_incorrect:
 description: Whether the cloud SIEM index configuration is incorrect at the organization level
 description: Whether the Cloud SIEM index configuration is incorrect for the organization.
 example: false
 type: boolean
 retention_months:
 description: |-
 The number of months that standard logs are retained for organizations on the standalone_indexed` pricing model. This field is omitted for other pricing models.
 example: 15
 format: int32
 maximum: 60
 type: integer
 sku:
 $ref: "#/components/schemas/SecurityMonitoringSKU"
 required:
Expand DownExpand Up@@ -89741,6 +89857,7 @@ components:
 - active
 - warning
 - broken
 - not_configured
 example: active
 type: string
 x-enum-descriptions:
Expand All@@ -89750,13 +89867,40 @@ components:
 - Activated; logs received within the last 24 hours.
 - Activated; integration not installed or logs last seen 24 to 72 hours ago.
 - Activated; no logs for over 72 hours, filter missing, or Cloud SIEM index incorrectly ordered.
 - Activated, but no credentials are configured (entity content packs only).
 x-enum-varnames:
 - INSTALL
 - ACTIVATE
 - INITIALIZING
 - ACTIVE
 - WARNING
 - BROKEN
 - NOT_CONFIGURED
 SecurityMonitoringContentPackThreatIntelDetails:
 description: Details for a threat intelligence content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetailsType"
 required:
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 type: object
 SecurityMonitoringContentPackThreatIntelDetailsType:
 description: Type for threat intelligence content pack details.
 enum:
 - threat_intel
 example: threat_intel
 type: string
 x-enum-varnames:
 - THREAT_INTEL
 SecurityMonitoringContentPackTimestampBucket:
 description: Timestamp bucket indicating when logs were last collected.
 enum:
Expand All@@ -89779,6 +89923,31 @@ components:
 - WITHIN_24_TO_72_HOURS
 - OVER_72H_TO_30D
 - OVER_30D
 SecurityMonitoringContentPackVulnerabilityDetails:
 description: Details for a vulnerability content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetailsType"
 required:
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 type: object
 SecurityMonitoringContentPackVulnerabilityDetailsType:
 description: Type for vulnerability content pack details.
 enum:
 - vulnerability
 example: vulnerability
 type: string
 x-enum-varnames:
 - VULNERABILITY
 SecurityMonitoringCriticalAsset:
 description: The critical asset's properties.
 properties:
Expand DownExpand Up@@ -92150,12 +92319,16 @@ components:
 - per_gb_analyzed
 - per_event_in_siem_index_2023
 - add_on_2024
 - standalone_indexed
 - unknown
 example: add_on_2024
 type: string
 x-enum-varnames:
 - PER_GB_ANALYZED
 - PER_EVENT_IN_SIEM_INDEX_2023
 - ADD_ON_2024
 - STANDALONE_INDEXED
 - UNKNOWN
 SecurityMonitoringSchedulingOptions:
 description: Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
 nullable: true
Expand DownExpand Up@@ -184119,12 +184292,15 @@ paths:
 value:
 data:
 - attributes:
 cloud_siem_index_incorrect: false
 cp_activation: activated
 filters_configured_for_logs: true
 logs_last_collected: within_24_hours
 logs_seen_from_any_index: true
 state: active
 details:
 cp_activation: activated
 data_last_seen: within_24_hours
 filters_configured: true
 integration_installed_status: installed
 logs_seen_from_any_index: true
 siem_index_incorrect: false
 type: logs
 status: active
 id: aws-cloudtrail
 type: content_pack_state
 meta:
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Update documentation according to new content pack states endpoint response shape by api-clients-generation-pipeline[bot] · Pull Request #4102 · DataDog/datadog-api-client-java · GitHub
Skip to content
Update documentation according to new content pack states endpoint response shape#4102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

api-clients-generation-pipeline
merged 1 commit into

from

Jul 24, 2026
 Merged


Update documentation according to new content pack states endpoint response shape
#4102
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


224 changes: 200 additions & 24 deletions
.generator/schemas/v2/openapi.yaml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89626,6 +89626,57 @@ components:
 - NEVER_ACTIVATED
 - ACTIVATED
 - DEACTIVATED
 SecurityMonitoringContentPackAppSecDetails:
 description: Details for an Application Security content pack.
 properties:
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetailsType"
 required:
 - type
 type: object
 SecurityMonitoringContentPackAppSecDetailsType:
 description: Type for Application Security content pack details.
 enum:
 - appsec
 example: appsec
 type: string
 x-enum-varnames:
 - APPSEC
 SecurityMonitoringContentPackAuditDetails:
 description: Details for an audit trail content pack.
 properties:
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetailsType"
 required:
 - type
 type: object
 SecurityMonitoringContentPackAuditDetailsType:
 description: Type for audit trail content pack details.
 enum:
 - audit
 example: audit
 type: string
 x-enum-varnames:
 - AUDIT
 SecurityMonitoringContentPackEntityDetails:
 description: Details for an entity or identity content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetailsType"
 required:
 - type
 - cp_activation
 type: object
 SecurityMonitoringContentPackEntityDetailsType:
 description: Type for entity content pack details.
 enum:
 - entity
 example: entity
 type: string
 x-enum-varnames:
 - ENTITY
 SecurityMonitoringContentPackIntegrationStatus:
 description: The installation status of the related integration.
 enum:
Expand All@@ -89648,38 +89699,74 @@ components:
 - PARTIALLY_INSTALLED
 - DETECTED
 - ERROR
SecurityMonitoringContentPackStateAttributes:
 description: Attributes of a content pack state
SecurityMonitoringContentPackLogsDetails:
 description: Details for a logs-based content pack.
 properties:
 cloud_siem_index_incorrect:
 description: Whether the cloud SIEM index configuration is incorrect (only applies to certain pricing models)
 example: false
 type: boolean
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 filters_configured_for_logs:
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 filters_configured:
 description: |-
 Whether filters (Security Filters or Index Query depending on the pricing model) are
 present and correctly configured to route logs into Cloud SIEM.
 example: true
 type: boolean
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 logs_last_collected:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 logs_seen_from_any_index:
 description: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
 description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
 example: true
 type: boolean
 state:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
 siem_index_incorrect:
 description: Whether the Cloud SIEM index configuration is incorrect (only applies to certain pricing models).
 example: false
 type: boolean
 type:
 $ref: "#/components/schemas/SecurityFilterFilteredDataType"
 required:
 - state
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 - filters_configured
 - logs_seen_from_any_index
 - logs_last_collected
 - cloud_siem_index_incorrect
 - filters_configured_for_logs
 - siem_index_incorrect
 type: object
 SecurityMonitoringContentPackOnboardingDetails:
 description: |-
 Content pack details returned when Cloud SIEM is inactive for the requesting organization.
 properties:
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 logs_seen_from_any_index:
 description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
 example: true
 type: boolean
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetailsType"
 required:
 - type
 - logs_seen_from_any_index
 type: object
 SecurityMonitoringContentPackOnboardingDetailsType:
 description: Type for onboarding content pack details.
 enum:
 - onboarding
 example: onboarding
 type: string
 x-enum-varnames:
 - ONBOARDING
 SecurityMonitoringContentPackStateAttributes:
 description: Attributes of a content pack state.
 properties:
 details:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStateDetails"
 status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
 required:
 - status
 - details
 type: object
 SecurityMonitoringContentPackStateData:
 description: Content pack state data.
Expand All@@ -89697,13 +89784,42 @@ components:
 - type
 - attributes
 type: object
 SecurityMonitoringContentPackStateDetails:
 description: |-
 Type-specific details for a content pack state. The set of fields present depends
 on the content pack's `type`. When Cloud SIEM is inactive for the requesting organization, `onboarding` is returned instead of the content pack's usual type, such as `logs` or `vulnerability`.`
 discriminator:
 mapping:
 appsec: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
 audit: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
 entity: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
 logs: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
 onboarding: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
 threat_intel: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
 vulnerability: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
 propertyName: type
 oneOf:
 - $ref: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
 SecurityMonitoringContentPackStateMeta:
 description: Metadata for content pack states
 description: Metadata for content pack states.
 properties:
 cloud_siem_index_incorrect:
 description: Whether the cloud SIEM index configuration is incorrect at the organization level
 description: Whether the Cloud SIEM index configuration is incorrect for the organization.
 example: false
 type: boolean
 retention_months:
 description: |-
 The number of months that standard logs are retained for organizations on the standalone_indexed` pricing model. This field is omitted for other pricing models.
 example: 15
 format: int32
 maximum: 60
 type: integer
 sku:
 $ref: "#/components/schemas/SecurityMonitoringSKU"
 required:
Expand DownExpand Up@@ -89741,6 +89857,7 @@ components:
 - active
 - warning
 - broken
 - not_configured
 example: active
 type: string
 x-enum-descriptions:
Expand All@@ -89750,13 +89867,40 @@ components:
 - Activated; logs received within the last 24 hours.
 - Activated; integration not installed or logs last seen 24 to 72 hours ago.
 - Activated; no logs for over 72 hours, filter missing, or Cloud SIEM index incorrectly ordered.
 - Activated, but no credentials are configured (entity content packs only).
 x-enum-varnames:
 - INSTALL
 - ACTIVATE
 - INITIALIZING
 - ACTIVE
 - WARNING
 - BROKEN
 - NOT_CONFIGURED
 SecurityMonitoringContentPackThreatIntelDetails:
 description: Details for a threat intelligence content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetailsType"
 required:
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 type: object
 SecurityMonitoringContentPackThreatIntelDetailsType:
 description: Type for threat intelligence content pack details.
 enum:
 - threat_intel
 example: threat_intel
 type: string
 x-enum-varnames:
 - THREAT_INTEL
 SecurityMonitoringContentPackTimestampBucket:
 description: Timestamp bucket indicating when logs were last collected.
 enum:
Expand All@@ -89779,6 +89923,31 @@ components:
 - WITHIN_24_TO_72_HOURS
 - OVER_72H_TO_30D
 - OVER_30D
 SecurityMonitoringContentPackVulnerabilityDetails:
 description: Details for a vulnerability content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetailsType"
 required:
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 type: object
 SecurityMonitoringContentPackVulnerabilityDetailsType:
 description: Type for vulnerability content pack details.
 enum:
 - vulnerability
 example: vulnerability
 type: string
 x-enum-varnames:
 - VULNERABILITY
 SecurityMonitoringCriticalAsset:
 description: The critical asset's properties.
 properties:
Expand DownExpand Up@@ -92150,12 +92319,16 @@ components:
 - per_gb_analyzed
 - per_event_in_siem_index_2023
 - add_on_2024
 - standalone_indexed
 - unknown
 example: add_on_2024
 type: string
 x-enum-varnames:
 - PER_GB_ANALYZED
 - PER_EVENT_IN_SIEM_INDEX_2023
 - ADD_ON_2024
 - STANDALONE_INDEXED
 - UNKNOWN
 SecurityMonitoringSchedulingOptions:
 description: Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
 nullable: true
Expand DownExpand Up@@ -184119,12 +184292,15 @@ paths:
 value:
 data:
 - attributes:
 cloud_siem_index_incorrect: false
 cp_activation: activated
 filters_configured_for_logs: true
 logs_last_collected: within_24_hours
 logs_seen_from_any_index: true
 state: active
 details:
 cp_activation: activated
 data_last_seen: within_24_hours
 filters_configured: true
 integration_installed_status: installed
 logs_seen_from_any_index: true
 siem_index_incorrect: false
 type: logs
 status: active
 id: aws-cloudtrail
 type: content_pack_state
 meta:
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Update documentation according to new content pack states endpoint response shape by api-clients-generation-pipeline[bot] · Pull Request #4102 · DataDog/datadog-api-client-java · GitHub
Skip to content
Update documentation according to new content pack states endpoint response shape#4102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

api-clients-generation-pipeline
merged 1 commit into

from

Jul 24, 2026
 Merged


Update documentation according to new content pack states endpoint response shape
#4102
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


224 changes: 200 additions & 24 deletions
.generator/schemas/v2/openapi.yaml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89626,6 +89626,57 @@ components:
 - NEVER_ACTIVATED
 - ACTIVATED
 - DEACTIVATED
 SecurityMonitoringContentPackAppSecDetails:
 description: Details for an Application Security content pack.
 properties:
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetailsType"
 required:
 - type
 type: object
 SecurityMonitoringContentPackAppSecDetailsType:
 description: Type for Application Security content pack details.
 enum:
 - appsec
 example: appsec
 type: string
 x-enum-varnames:
 - APPSEC
 SecurityMonitoringContentPackAuditDetails:
 description: Details for an audit trail content pack.
 properties:
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetailsType"
 required:
 - type
 type: object
 SecurityMonitoringContentPackAuditDetailsType:
 description: Type for audit trail content pack details.
 enum:
 - audit
 example: audit
 type: string
 x-enum-varnames:
 - AUDIT
 SecurityMonitoringContentPackEntityDetails:
 description: Details for an entity or identity content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetailsType"
 required:
 - type
 - cp_activation
 type: object
 SecurityMonitoringContentPackEntityDetailsType:
 description: Type for entity content pack details.
 enum:
 - entity
 example: entity
 type: string
 x-enum-varnames:
 - ENTITY
 SecurityMonitoringContentPackIntegrationStatus:
 description: The installation status of the related integration.
 enum:
Expand All@@ -89648,38 +89699,74 @@ components:
 - PARTIALLY_INSTALLED
 - DETECTED
 - ERROR
SecurityMonitoringContentPackStateAttributes:
 description: Attributes of a content pack state
SecurityMonitoringContentPackLogsDetails:
 description: Details for a logs-based content pack.
 properties:
 cloud_siem_index_incorrect:
 description: Whether the cloud SIEM index configuration is incorrect (only applies to certain pricing models)
 example: false
 type: boolean
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 filters_configured_for_logs:
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 filters_configured:
 description: |-
 Whether filters (Security Filters or Index Query depending on the pricing model) are
 present and correctly configured to route logs into Cloud SIEM.
 example: true
 type: boolean
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 logs_last_collected:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 logs_seen_from_any_index:
 description: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
 description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
 example: true
 type: boolean
 state:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
 siem_index_incorrect:
 description: Whether the Cloud SIEM index configuration is incorrect (only applies to certain pricing models).
 example: false
 type: boolean
 type:
 $ref: "#/components/schemas/SecurityFilterFilteredDataType"
 required:
 - state
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 - filters_configured
 - logs_seen_from_any_index
 - logs_last_collected
 - cloud_siem_index_incorrect
 - filters_configured_for_logs
 - siem_index_incorrect
 type: object
 SecurityMonitoringContentPackOnboardingDetails:
 description: |-
 Content pack details returned when Cloud SIEM is inactive for the requesting organization.
 properties:
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 logs_seen_from_any_index:
 description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
 example: true
 type: boolean
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetailsType"
 required:
 - type
 - logs_seen_from_any_index
 type: object
 SecurityMonitoringContentPackOnboardingDetailsType:
 description: Type for onboarding content pack details.
 enum:
 - onboarding
 example: onboarding
 type: string
 x-enum-varnames:
 - ONBOARDING
 SecurityMonitoringContentPackStateAttributes:
 description: Attributes of a content pack state.
 properties:
 details:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStateDetails"
 status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
 required:
 - status
 - details
 type: object
 SecurityMonitoringContentPackStateData:
 description: Content pack state data.
Expand All@@ -89697,13 +89784,42 @@ components:
 - type
 - attributes
 type: object
 SecurityMonitoringContentPackStateDetails:
 description: |-
 Type-specific details for a content pack state. The set of fields present depends
 on the content pack's `type`. When Cloud SIEM is inactive for the requesting organization, `onboarding` is returned instead of the content pack's usual type, such as `logs` or `vulnerability`.`
 discriminator:
 mapping:
 appsec: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
 audit: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
 entity: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
 logs: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
 onboarding: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
 threat_intel: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
 vulnerability: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
 propertyName: type
 oneOf:
 - $ref: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
 SecurityMonitoringContentPackStateMeta:
 description: Metadata for content pack states
 description: Metadata for content pack states.
 properties:
 cloud_siem_index_incorrect:
 description: Whether the cloud SIEM index configuration is incorrect at the organization level
 description: Whether the Cloud SIEM index configuration is incorrect for the organization.
 example: false
 type: boolean
 retention_months:
 description: |-
 The number of months that standard logs are retained for organizations on the standalone_indexed` pricing model. This field is omitted for other pricing models.
 example: 15
 format: int32
 maximum: 60
 type: integer
 sku:
 $ref: "#/components/schemas/SecurityMonitoringSKU"
 required:
Expand DownExpand Up@@ -89741,6 +89857,7 @@ components:
 - active
 - warning
 - broken
 - not_configured
 example: active
 type: string
 x-enum-descriptions:
Expand All@@ -89750,13 +89867,40 @@ components:
 - Activated; logs received within the last 24 hours.
 - Activated; integration not installed or logs last seen 24 to 72 hours ago.
 - Activated; no logs for over 72 hours, filter missing, or Cloud SIEM index incorrectly ordered.
 - Activated, but no credentials are configured (entity content packs only).
 x-enum-varnames:
 - INSTALL
 - ACTIVATE
 - INITIALIZING
 - ACTIVE
 - WARNING
 - BROKEN
 - NOT_CONFIGURED
 SecurityMonitoringContentPackThreatIntelDetails:
 description: Details for a threat intelligence content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetailsType"
 required:
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 type: object
 SecurityMonitoringContentPackThreatIntelDetailsType:
 description: Type for threat intelligence content pack details.
 enum:
 - threat_intel
 example: threat_intel
 type: string
 x-enum-varnames:
 - THREAT_INTEL
 SecurityMonitoringContentPackTimestampBucket:
 description: Timestamp bucket indicating when logs were last collected.
 enum:
Expand All@@ -89779,6 +89923,31 @@ components:
 - WITHIN_24_TO_72_HOURS
 - OVER_72H_TO_30D
 - OVER_30D
 SecurityMonitoringContentPackVulnerabilityDetails:
 description: Details for a vulnerability content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetailsType"
 required:
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 type: object
 SecurityMonitoringContentPackVulnerabilityDetailsType:
 description: Type for vulnerability content pack details.
 enum:
 - vulnerability
 example: vulnerability
 type: string
 x-enum-varnames:
 - VULNERABILITY
 SecurityMonitoringCriticalAsset:
 description: The critical asset's properties.
 properties:
Expand DownExpand Up@@ -92150,12 +92319,16 @@ components:
 - per_gb_analyzed
 - per_event_in_siem_index_2023
 - add_on_2024
 - standalone_indexed
 - unknown
 example: add_on_2024
 type: string
 x-enum-varnames:
 - PER_GB_ANALYZED
 - PER_EVENT_IN_SIEM_INDEX_2023
 - ADD_ON_2024
 - STANDALONE_INDEXED
 - UNKNOWN
 SecurityMonitoringSchedulingOptions:
 description: Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
 nullable: true
Expand DownExpand Up@@ -184119,12 +184292,15 @@ paths:
 value:
 data:
 - attributes:
 cloud_siem_index_incorrect: false
 cp_activation: activated
 filters_configured_for_logs: true
 logs_last_collected: within_24_hours
 logs_seen_from_any_index: true
 state: active
 details:
 cp_activation: activated
 data_last_seen: within_24_hours
 filters_configured: true
 integration_installed_status: installed
 logs_seen_from_any_index: true
 siem_index_incorrect: false
 type: logs
 status: active
 id: aws-cloudtrail
 type: content_pack_state
 meta:
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
Update documentation according to new content pack states endpoint response shape by api-clients-generation-pipeline[bot] · Pull Request #4102 · DataDog/datadog-api-client-java · GitHub
Skip to content
Update documentation according to new content pack states endpoint response shape#4102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

api-clients-generation-pipeline
merged 1 commit into

from

Jul 24, 2026
 Merged


Update documentation according to new content pack states endpoint response shape
#4102
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


224 changes: 200 additions & 24 deletions
.generator/schemas/v2/openapi.yaml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89626,6 +89626,57 @@ components:
 - NEVER_ACTIVATED
 - ACTIVATED
 - DEACTIVATED
 SecurityMonitoringContentPackAppSecDetails:
 description: Details for an Application Security content pack.
 properties:
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetailsType"
 required:
 - type
 type: object
 SecurityMonitoringContentPackAppSecDetailsType:
 description: Type for Application Security content pack details.
 enum:
 - appsec
 example: appsec
 type: string
 x-enum-varnames:
 - APPSEC
 SecurityMonitoringContentPackAuditDetails:
 description: Details for an audit trail content pack.
 properties:
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetailsType"
 required:
 - type
 type: object
 SecurityMonitoringContentPackAuditDetailsType:
 description: Type for audit trail content pack details.
 enum:
 - audit
 example: audit
 type: string
 x-enum-varnames:
 - AUDIT
 SecurityMonitoringContentPackEntityDetails:
 description: Details for an entity or identity content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetailsType"
 required:
 - type
 - cp_activation
 type: object
 SecurityMonitoringContentPackEntityDetailsType:
 description: Type for entity content pack details.
 enum:
 - entity
 example: entity
 type: string
 x-enum-varnames:
 - ENTITY
 SecurityMonitoringContentPackIntegrationStatus:
 description: The installation status of the related integration.
 enum:
Expand All@@ -89648,38 +89699,74 @@ components:
 - PARTIALLY_INSTALLED
 - DETECTED
 - ERROR
SecurityMonitoringContentPackStateAttributes:
 description: Attributes of a content pack state
SecurityMonitoringContentPackLogsDetails:
 description: Details for a logs-based content pack.
 properties:
 cloud_siem_index_incorrect:
 description: Whether the cloud SIEM index configuration is incorrect (only applies to certain pricing models)
 example: false
 type: boolean
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 filters_configured_for_logs:
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 filters_configured:
 description: |-
 Whether filters (Security Filters or Index Query depending on the pricing model) are
 present and correctly configured to route logs into Cloud SIEM.
 example: true
 type: boolean
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 logs_last_collected:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 logs_seen_from_any_index:
 description: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
 description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
 example: true
 type: boolean
 state:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
 siem_index_incorrect:
 description: Whether the Cloud SIEM index configuration is incorrect (only applies to certain pricing models).
 example: false
 type: boolean
 type:
 $ref: "#/components/schemas/SecurityFilterFilteredDataType"
 required:
 - state
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 - filters_configured
 - logs_seen_from_any_index
 - logs_last_collected
 - cloud_siem_index_incorrect
 - filters_configured_for_logs
 - siem_index_incorrect
 type: object
 SecurityMonitoringContentPackOnboardingDetails:
 description: |-
 Content pack details returned when Cloud SIEM is inactive for the requesting organization.
 properties:
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 logs_seen_from_any_index:
 description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
 example: true
 type: boolean
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetailsType"
 required:
 - type
 - logs_seen_from_any_index
 type: object
 SecurityMonitoringContentPackOnboardingDetailsType:
 description: Type for onboarding content pack details.
 enum:
 - onboarding
 example: onboarding
 type: string
 x-enum-varnames:
 - ONBOARDING
 SecurityMonitoringContentPackStateAttributes:
 description: Attributes of a content pack state.
 properties:
 details:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStateDetails"
 status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
 required:
 - status
 - details
 type: object
 SecurityMonitoringContentPackStateData:
 description: Content pack state data.
Expand All@@ -89697,13 +89784,42 @@ components:
 - type
 - attributes
 type: object
 SecurityMonitoringContentPackStateDetails:
 description: |-
 Type-specific details for a content pack state. The set of fields present depends
 on the content pack's `type`. When Cloud SIEM is inactive for the requesting organization, `onboarding` is returned instead of the content pack's usual type, such as `logs` or `vulnerability`.`
 discriminator:
 mapping:
 appsec: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
 audit: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
 entity: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
 logs: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
 onboarding: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
 threat_intel: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
 vulnerability: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
 propertyName: type
 oneOf:
 - $ref: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
 SecurityMonitoringContentPackStateMeta:
 description: Metadata for content pack states
 description: Metadata for content pack states.
 properties:
 cloud_siem_index_incorrect:
 description: Whether the cloud SIEM index configuration is incorrect at the organization level
 description: Whether the Cloud SIEM index configuration is incorrect for the organization.
 example: false
 type: boolean
 retention_months:
 description: |-
 The number of months that standard logs are retained for organizations on the standalone_indexed` pricing model. This field is omitted for other pricing models.
 example: 15
 format: int32
 maximum: 60
 type: integer
 sku:
 $ref: "#/components/schemas/SecurityMonitoringSKU"
 required:
Expand DownExpand Up@@ -89741,6 +89857,7 @@ components:
 - active
 - warning
 - broken
 - not_configured
 example: active
 type: string
 x-enum-descriptions:
Expand All@@ -89750,13 +89867,40 @@ components:
 - Activated; logs received within the last 24 hours.
 - Activated; integration not installed or logs last seen 24 to 72 hours ago.
 - Activated; no logs for over 72 hours, filter missing, or Cloud SIEM index incorrectly ordered.
 - Activated, but no credentials are configured (entity content packs only).
 x-enum-varnames:
 - INSTALL
 - ACTIVATE
 - INITIALIZING
 - ACTIVE
 - WARNING
 - BROKEN
 - NOT_CONFIGURED
 SecurityMonitoringContentPackThreatIntelDetails:
 description: Details for a threat intelligence content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetailsType"
 required:
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 type: object
 SecurityMonitoringContentPackThreatIntelDetailsType:
 description: Type for threat intelligence content pack details.
 enum:
 - threat_intel
 example: threat_intel
 type: string
 x-enum-varnames:
 - THREAT_INTEL
 SecurityMonitoringContentPackTimestampBucket:
 description: Timestamp bucket indicating when logs were last collected.
 enum:
Expand All@@ -89779,6 +89923,31 @@ components:
 - WITHIN_24_TO_72_HOURS
 - OVER_72H_TO_30D
 - OVER_30D
 SecurityMonitoringContentPackVulnerabilityDetails:
 description: Details for a vulnerability content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetailsType"
 required:
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 type: object
 SecurityMonitoringContentPackVulnerabilityDetailsType:
 description: Type for vulnerability content pack details.
 enum:
 - vulnerability
 example: vulnerability
 type: string
 x-enum-varnames:
 - VULNERABILITY
 SecurityMonitoringCriticalAsset:
 description: The critical asset's properties.
 properties:
Expand DownExpand Up@@ -92150,12 +92319,16 @@ components:
 - per_gb_analyzed
 - per_event_in_siem_index_2023
 - add_on_2024
 - standalone_indexed
 - unknown
 example: add_on_2024
 type: string
 x-enum-varnames:
 - PER_GB_ANALYZED
 - PER_EVENT_IN_SIEM_INDEX_2023
 - ADD_ON_2024
 - STANDALONE_INDEXED
 - UNKNOWN
 SecurityMonitoringSchedulingOptions:
 description: Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
 nullable: true
Expand DownExpand Up@@ -184119,12 +184292,15 @@ paths:
 value:
 data:
 - attributes:
 cloud_siem_index_incorrect: false
 cp_activation: activated
 filters_configured_for_logs: true
 logs_last_collected: within_24_hours
 logs_seen_from_any_index: true
 state: active
 details:
 cp_activation: activated
 data_last_seen: within_24_hours
 filters_configured: true
 integration_installed_status: installed
 logs_seen_from_any_index: true
 siem_index_incorrect: false
 type: logs
 status: active
 id: aws-cloudtrail
 type: content_pack_state
 meta:
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Update documentation according to new content pack states endpoint response shape by api-clients-generation-pipeline[bot] · Pull Request #4102 · DataDog/datadog-api-client-java · GitHub
Skip to content
Update documentation according to new content pack states endpoint response shape#4102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

api-clients-generation-pipeline
merged 1 commit into

from

Jul 24, 2026
 Merged


Update documentation according to new content pack states endpoint response shape
#4102
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


224 changes: 200 additions & 24 deletions
.generator/schemas/v2/openapi.yaml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89626,6 +89626,57 @@ components:
 - NEVER_ACTIVATED
 - ACTIVATED
 - DEACTIVATED
 SecurityMonitoringContentPackAppSecDetails:
 description: Details for an Application Security content pack.
 properties:
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetailsType"
 required:
 - type
 type: object
 SecurityMonitoringContentPackAppSecDetailsType:
 description: Type for Application Security content pack details.
 enum:
 - appsec
 example: appsec
 type: string
 x-enum-varnames:
 - APPSEC
 SecurityMonitoringContentPackAuditDetails:
 description: Details for an audit trail content pack.
 properties:
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetailsType"
 required:
 - type
 type: object
 SecurityMonitoringContentPackAuditDetailsType:
 description: Type for audit trail content pack details.
 enum:
 - audit
 example: audit
 type: string
 x-enum-varnames:
 - AUDIT
 SecurityMonitoringContentPackEntityDetails:
 description: Details for an entity or identity content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetailsType"
 required:
 - type
 - cp_activation
 type: object
 SecurityMonitoringContentPackEntityDetailsType:
 description: Type for entity content pack details.
 enum:
 - entity
 example: entity
 type: string
 x-enum-varnames:
 - ENTITY
 SecurityMonitoringContentPackIntegrationStatus:
 description: The installation status of the related integration.
 enum:
Expand All@@ -89648,38 +89699,74 @@ components:
 - PARTIALLY_INSTALLED
 - DETECTED
 - ERROR
SecurityMonitoringContentPackStateAttributes:
 description: Attributes of a content pack state
SecurityMonitoringContentPackLogsDetails:
 description: Details for a logs-based content pack.
 properties:
 cloud_siem_index_incorrect:
 description: Whether the cloud SIEM index configuration is incorrect (only applies to certain pricing models)
 example: false
 type: boolean
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 filters_configured_for_logs:
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 filters_configured:
 description: |-
 Whether filters (Security Filters or Index Query depending on the pricing model) are
 present and correctly configured to route logs into Cloud SIEM.
 example: true
 type: boolean
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 logs_last_collected:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 logs_seen_from_any_index:
 description: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
 description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
 example: true
 type: boolean
 state:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
 siem_index_incorrect:
 description: Whether the Cloud SIEM index configuration is incorrect (only applies to certain pricing models).
 example: false
 type: boolean
 type:
 $ref: "#/components/schemas/SecurityFilterFilteredDataType"
 required:
 - state
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 - filters_configured
 - logs_seen_from_any_index
 - logs_last_collected
 - cloud_siem_index_incorrect
 - filters_configured_for_logs
 - siem_index_incorrect
 type: object
 SecurityMonitoringContentPackOnboardingDetails:
 description: |-
 Content pack details returned when Cloud SIEM is inactive for the requesting organization.
 properties:
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 logs_seen_from_any_index:
 description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
 example: true
 type: boolean
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetailsType"
 required:
 - type
 - logs_seen_from_any_index
 type: object
 SecurityMonitoringContentPackOnboardingDetailsType:
 description: Type for onboarding content pack details.
 enum:
 - onboarding
 example: onboarding
 type: string
 x-enum-varnames:
 - ONBOARDING
 SecurityMonitoringContentPackStateAttributes:
 description: Attributes of a content pack state.
 properties:
 details:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStateDetails"
 status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
 required:
 - status
 - details
 type: object
 SecurityMonitoringContentPackStateData:
 description: Content pack state data.
Expand All@@ -89697,13 +89784,42 @@ components:
 - type
 - attributes
 type: object
 SecurityMonitoringContentPackStateDetails:
 description: |-
 Type-specific details for a content pack state. The set of fields present depends
 on the content pack's `type`. When Cloud SIEM is inactive for the requesting organization, `onboarding` is returned instead of the content pack's usual type, such as `logs` or `vulnerability`.`
 discriminator:
 mapping:
 appsec: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
 audit: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
 entity: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
 logs: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
 onboarding: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
 threat_intel: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
 vulnerability: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
 propertyName: type
 oneOf:
 - $ref: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
 SecurityMonitoringContentPackStateMeta:
 description: Metadata for content pack states
 description: Metadata for content pack states.
 properties:
 cloud_siem_index_incorrect:
 description: Whether the cloud SIEM index configuration is incorrect at the organization level
 description: Whether the Cloud SIEM index configuration is incorrect for the organization.
 example: false
 type: boolean
 retention_months:
 description: |-
 The number of months that standard logs are retained for organizations on the standalone_indexed` pricing model. This field is omitted for other pricing models.
 example: 15
 format: int32
 maximum: 60
 type: integer
 sku:
 $ref: "#/components/schemas/SecurityMonitoringSKU"
 required:
Expand DownExpand Up@@ -89741,6 +89857,7 @@ components:
 - active
 - warning
 - broken
 - not_configured
 example: active
 type: string
 x-enum-descriptions:
Expand All@@ -89750,13 +89867,40 @@ components:
 - Activated; logs received within the last 24 hours.
 - Activated; integration not installed or logs last seen 24 to 72 hours ago.
 - Activated; no logs for over 72 hours, filter missing, or Cloud SIEM index incorrectly ordered.
 - Activated, but no credentials are configured (entity content packs only).
 x-enum-varnames:
 - INSTALL
 - ACTIVATE
 - INITIALIZING
 - ACTIVE
 - WARNING
 - BROKEN
 - NOT_CONFIGURED
 SecurityMonitoringContentPackThreatIntelDetails:
 description: Details for a threat intelligence content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetailsType"
 required:
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 type: object
 SecurityMonitoringContentPackThreatIntelDetailsType:
 description: Type for threat intelligence content pack details.
 enum:
 - threat_intel
 example: threat_intel
 type: string
 x-enum-varnames:
 - THREAT_INTEL
 SecurityMonitoringContentPackTimestampBucket:
 description: Timestamp bucket indicating when logs were last collected.
 enum:
Expand All@@ -89779,6 +89923,31 @@ components:
 - WITHIN_24_TO_72_HOURS
 - OVER_72H_TO_30D
 - OVER_30D
 SecurityMonitoringContentPackVulnerabilityDetails:
 description: Details for a vulnerability content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetailsType"
 required:
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 type: object
 SecurityMonitoringContentPackVulnerabilityDetailsType:
 description: Type for vulnerability content pack details.
 enum:
 - vulnerability
 example: vulnerability
 type: string
 x-enum-varnames:
 - VULNERABILITY
 SecurityMonitoringCriticalAsset:
 description: The critical asset's properties.
 properties:
Expand DownExpand Up@@ -92150,12 +92319,16 @@ components:
 - per_gb_analyzed
 - per_event_in_siem_index_2023
 - add_on_2024
 - standalone_indexed
 - unknown
 example: add_on_2024
 type: string
 x-enum-varnames:
 - PER_GB_ANALYZED
 - PER_EVENT_IN_SIEM_INDEX_2023
 - ADD_ON_2024
 - STANDALONE_INDEXED
 - UNKNOWN
 SecurityMonitoringSchedulingOptions:
 description: Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
 nullable: true
Expand DownExpand Up@@ -184119,12 +184292,15 @@ paths:
 value:
 data:
 - attributes:
 cloud_siem_index_incorrect: false
 cp_activation: activated
 filters_configured_for_logs: true
 logs_last_collected: within_24_hours
 logs_seen_from_any_index: true
 state: active
 details:
 cp_activation: activated
 data_last_seen: within_24_hours
 filters_configured: true
 integration_installed_status: installed
 logs_seen_from_any_index: true
 siem_index_incorrect: false
 type: logs
 status: active
 id: aws-cloudtrail
 type: content_pack_state
 meta:
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
})();
Update documentation according to new content pack states endpoint response shape by api-clients-generation-pipeline[bot] · Pull Request #4102 · DataDog/datadog-api-client-java · GitHub
Skip to content
Update documentation according to new content pack states endpoint response shape#4102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

api-clients-generation-pipeline
merged 1 commit into

from

Jul 24, 2026
 Merged


Update documentation according to new content pack states endpoint response shape
#4102
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


224 changes: 200 additions & 24 deletions
.generator/schemas/v2/openapi.yaml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89626,6 +89626,57 @@ components:
 - NEVER_ACTIVATED
 - ACTIVATED
 - DEACTIVATED
 SecurityMonitoringContentPackAppSecDetails:
 description: Details for an Application Security content pack.
 properties:
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetailsType"
 required:
 - type
 type: object
 SecurityMonitoringContentPackAppSecDetailsType:
 description: Type for Application Security content pack details.
 enum:
 - appsec
 example: appsec
 type: string
 x-enum-varnames:
 - APPSEC
 SecurityMonitoringContentPackAuditDetails:
 description: Details for an audit trail content pack.
 properties:
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetailsType"
 required:
 - type
 type: object
 SecurityMonitoringContentPackAuditDetailsType:
 description: Type for audit trail content pack details.
 enum:
 - audit
 example: audit
 type: string
 x-enum-varnames:
 - AUDIT
 SecurityMonitoringContentPackEntityDetails:
 description: Details for an entity or identity content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetailsType"
 required:
 - type
 - cp_activation
 type: object
 SecurityMonitoringContentPackEntityDetailsType:
 description: Type for entity content pack details.
 enum:
 - entity
 example: entity
 type: string
 x-enum-varnames:
 - ENTITY
 SecurityMonitoringContentPackIntegrationStatus:
 description: The installation status of the related integration.
 enum:
Expand All@@ -89648,38 +89699,74 @@ components:
 - PARTIALLY_INSTALLED
 - DETECTED
 - ERROR
SecurityMonitoringContentPackStateAttributes:
 description: Attributes of a content pack state
SecurityMonitoringContentPackLogsDetails:
 description: Details for a logs-based content pack.
 properties:
 cloud_siem_index_incorrect:
 description: Whether the cloud SIEM index configuration is incorrect (only applies to certain pricing models)
 example: false
 type: boolean
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 filters_configured_for_logs:
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 filters_configured:
 description: |-
 Whether filters (Security Filters or Index Query depending on the pricing model) are
 present and correctly configured to route logs into Cloud SIEM.
 example: true
 type: boolean
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 logs_last_collected:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 logs_seen_from_any_index:
 description: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
 description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
 example: true
 type: boolean
 state:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
 siem_index_incorrect:
 description: Whether the Cloud SIEM index configuration is incorrect (only applies to certain pricing models).
 example: false
 type: boolean
 type:
 $ref: "#/components/schemas/SecurityFilterFilteredDataType"
 required:
 - state
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 - filters_configured
 - logs_seen_from_any_index
 - logs_last_collected
 - cloud_siem_index_incorrect
 - filters_configured_for_logs
 - siem_index_incorrect
 type: object
 SecurityMonitoringContentPackOnboardingDetails:
 description: |-
 Content pack details returned when Cloud SIEM is inactive for the requesting organization.
 properties:
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 logs_seen_from_any_index:
 description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours.
 example: true
 type: boolean
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetailsType"
 required:
 - type
 - logs_seen_from_any_index
 type: object
 SecurityMonitoringContentPackOnboardingDetailsType:
 description: Type for onboarding content pack details.
 enum:
 - onboarding
 example: onboarding
 type: string
 x-enum-varnames:
 - ONBOARDING
 SecurityMonitoringContentPackStateAttributes:
 description: Attributes of a content pack state.
 properties:
 details:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStateDetails"
 status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackStatus"
 required:
 - status
 - details
 type: object
 SecurityMonitoringContentPackStateData:
 description: Content pack state data.
Expand All@@ -89697,13 +89784,42 @@ components:
 - type
 - attributes
 type: object
 SecurityMonitoringContentPackStateDetails:
 description: |-
 Type-specific details for a content pack state. The set of fields present depends
 on the content pack's `type`. When Cloud SIEM is inactive for the requesting organization, `onboarding` is returned instead of the content pack's usual type, such as `logs` or `vulnerability`.`
 discriminator:
 mapping:
 appsec: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
 audit: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
 entity: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
 logs: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
 onboarding: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
 threat_intel: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
 vulnerability: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
 propertyName: type
 oneOf:
 - $ref: "#/components/schemas/SecurityMonitoringContentPackLogsDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails"
 - $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails"
 SecurityMonitoringContentPackStateMeta:
 description: Metadata for content pack states
 description: Metadata for content pack states.
 properties:
 cloud_siem_index_incorrect:
 description: Whether the cloud SIEM index configuration is incorrect at the organization level
 description: Whether the Cloud SIEM index configuration is incorrect for the organization.
 example: false
 type: boolean
 retention_months:
 description: |-
 The number of months that standard logs are retained for organizations on the standalone_indexed` pricing model. This field is omitted for other pricing models.
 example: 15
 format: int32
 maximum: 60
 type: integer
 sku:
 $ref: "#/components/schemas/SecurityMonitoringSKU"
 required:
Expand DownExpand Up@@ -89741,6 +89857,7 @@ components:
 - active
 - warning
 - broken
 - not_configured
 example: active
 type: string
 x-enum-descriptions:
Expand All@@ -89750,13 +89867,40 @@ components:
 - Activated; logs received within the last 24 hours.
 - Activated; integration not installed or logs last seen 24 to 72 hours ago.
 - Activated; no logs for over 72 hours, filter missing, or Cloud SIEM index incorrectly ordered.
 - Activated, but no credentials are configured (entity content packs only).
 x-enum-varnames:
 - INSTALL
 - ACTIVATE
 - INITIALIZING
 - ACTIVE
 - WARNING
 - BROKEN
 - NOT_CONFIGURED
 SecurityMonitoringContentPackThreatIntelDetails:
 description: Details for a threat intelligence content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetailsType"
 required:
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 type: object
 SecurityMonitoringContentPackThreatIntelDetailsType:
 description: Type for threat intelligence content pack details.
 enum:
 - threat_intel
 example: threat_intel
 type: string
 x-enum-varnames:
 - THREAT_INTEL
 SecurityMonitoringContentPackTimestampBucket:
 description: Timestamp bucket indicating when logs were last collected.
 enum:
Expand All@@ -89779,6 +89923,31 @@ components:
 - WITHIN_24_TO_72_HOURS
 - OVER_72H_TO_30D
 - OVER_30D
 SecurityMonitoringContentPackVulnerabilityDetails:
 description: Details for a vulnerability content pack.
 properties:
 cp_activation:
 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
 data_last_seen:
 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
 integration_installed_status:
 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
 type:
 $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetailsType"
 required:
 - type
 - cp_activation
 - data_last_seen
 - integration_installed_status
 type: object
 SecurityMonitoringContentPackVulnerabilityDetailsType:
 description: Type for vulnerability content pack details.
 enum:
 - vulnerability
 example: vulnerability
 type: string
 x-enum-varnames:
 - VULNERABILITY
 SecurityMonitoringCriticalAsset:
 description: The critical asset's properties.
 properties:
Expand DownExpand Up@@ -92150,12 +92319,16 @@ components:
 - per_gb_analyzed
 - per_event_in_siem_index_2023
 - add_on_2024
 - standalone_indexed
 - unknown
 example: add_on_2024
 type: string
 x-enum-varnames:
 - PER_GB_ANALYZED
 - PER_EVENT_IN_SIEM_INDEX_2023
 - ADD_ON_2024
 - STANDALONE_INDEXED
 - UNKNOWN
 SecurityMonitoringSchedulingOptions:
 description: Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.
 nullable: true
Expand DownExpand Up@@ -184119,12 +184292,15 @@ paths:
 value:
 data:
 - attributes:
 cloud_siem_index_incorrect: false
 cp_activation: activated
 filters_configured_for_logs: true
 logs_last_collected: within_24_hours
 logs_seen_from_any_index: true
 state: active
 details:
 cp_activation: activated
 data_last_seen: within_24_hours
 filters_configured: true
 integration_installed_status: installed
 logs_seen_from_any_index: true
 siem_index_incorrect: false
 type: logs
 status: active
 id: aws-cloudtrail
 type: content_pack_state
 meta:
Expand Down
Loading
Loading