diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml index 0263793da4e..cd37458693c 100644 --- a/.generator/schemas/v2/openapi.yaml +++ b/.generator/schemas/v2/openapi.yaml @@ -62234,19 +62234,23 @@ components: - DONE - TIMEOUT SecurityMonitoringContentPackActivation: - description: The activation status of a content pack + description: The activation status of a content pack. enum: - never_activated - activated - deactivated example: activated type: string + x-enum-descriptions: + - Pack has never been activated for this organization. + - Pack is currently activated. + - Pack was previously activated but has since been deactivated. x-enum-varnames: - NEVER_ACTIVATED - ACTIVATED - DEACTIVATED SecurityMonitoringContentPackIntegrationStatus: - description: The installation status of the related integration + description: The installation status of the related integration. enum: - installed - available @@ -62255,6 +62259,12 @@ components: - error example: installed type: string + x-enum-descriptions: + - Integration is fully installed. + - Integration exists in the catalog but is not installed. + - Integration is only partially configured. + - Integration detected (for example, logs are flowing) but not explicitly installed. + - Integration is in an error state. x-enum-varnames: - INSTALLED - AVAILABLE @@ -62271,7 +62281,9 @@ components: cp_activation: $ref: "#/components/schemas/SecurityMonitoringContentPackActivation" filters_configured_for_logs: - description: Whether filters (Security Filters or Index Query depending on the pricing model) are configured for logs + description: |- + Whether filters (Security Filters or Index Query depending on the pricing model) are + present and correctly configured to route logs into Cloud SIEM. example: true type: boolean integration_installed_status: @@ -62279,7 +62291,7 @@ components: logs_last_collected: $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket" logs_seen_from_any_index: - description: Whether logs have been seen from any index + description: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours. example: true type: boolean state: @@ -62344,7 +62356,7 @@ components: - meta type: object SecurityMonitoringContentPackStatus: - description: The current status of a content pack + description: The current operational status of a content pack. enum: - install - activate @@ -62354,6 +62366,13 @@ components: - broken example: active type: string + x-enum-descriptions: + - Not activated; no logs detected in the last 72 hours. + - Not activated; logs are flowing into a Datadog index but not yet routed through Cloud SIEM. + - Activated; awaiting first log ingestion. + - Activated; logs received within the last 24 hours. + - Activated; integration not installed or logs last seen 24 to 72 hours ago. + - Activated; no logs for over 72 hours, filter missing, or Cloud SIEM index incorrectly ordered. x-enum-varnames: - INSTALL - ACTIVATE @@ -62362,7 +62381,7 @@ components: - WARNING - BROKEN SecurityMonitoringContentPackTimestampBucket: - description: Timestamp bucket indicating when logs were last collected + description: Timestamp bucket indicating when logs were last collected. enum: - not_seen - within_24_hours @@ -62371,6 +62390,12 @@ components: - over_30d example: within_24_hours type: string + x-enum-descriptions: + - No logs observed. + - Logs received within the last 24 hours. + - Logs last seen 24 to 72 hours ago. + - Logs last seen 3 to 30 days ago. + - Logs last seen more than 30 days ago. x-enum-varnames: - NOT_SEEN - WITHIN_24_HOURS @@ -63461,7 +63486,7 @@ components: - $ref: "#/components/schemas/SecurityMonitoringSignalRulePayload" - $ref: "#/components/schemas/CloudConfigurationRulePayload" SecurityMonitoringSKU: - description: The SIEM pricing model (SKU) for the organization + description: The Cloud SIEM pricing model (SKU) for the organization. enum: - per_gb_analyzed - per_event_in_siem_index_2023 @@ -117994,9 +118019,8 @@ paths: /api/v2/security_monitoring/content_packs/states: get: description: |- - Get the activation and configuration states for all security monitoring content packs. - This endpoint returns status information about each content pack including activation state, - integration status, and log collection status. + Get the activation state, integration status, and log collection status + for all Cloud SIEM content packs. operationId: GetContentPacksStates responses: "200": @@ -118019,21 +118043,31 @@ paths: description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_filters_read summary: Get content pack states tags: - Security Monitoring + "x-permission": + operator: OR + permissions: + - security_monitoring_filters_read + - logs_read_index_data x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/content_packs/{content_pack_id}/activate: put: description: |- - Activate a security monitoring content pack. This operation configures the necessary + Activate a Cloud SIEM content pack. This operation configures the necessary log filters or security filters depending on the pricing model and updates the content pack activation state. operationId: ActivateContentPack parameters: - - description: The ID of the content pack to activate. + - description: The ID of the content pack to activate (for example, `aws-cloudtrail`). in: path name: content_pack_id required: true @@ -118057,20 +118091,30 @@ paths: description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_filters_write summary: Activate content pack tags: - Security Monitoring + "x-permission": + operator: OR + permissions: + - security_monitoring_filters_write + - logs_modify_indexes x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/content_packs/{content_pack_id}/deactivate: put: description: |- - Deactivate a security monitoring content pack. This operation removes the content pack's + Deactivate a Cloud SIEM content pack. This operation removes the content pack's configuration from log filters or security filters and updates the content pack activation state. operationId: DeactivateContentPack parameters: - - description: The ID of the content pack to deactivate. + - description: The ID of the content pack to deactivate (for example, `aws-cloudtrail`). in: path name: content_pack_id required: true @@ -118094,9 +118138,19 @@ paths: description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" + security: + - apiKeyAuth: [] + appKeyAuth: [] + - AuthZ: + - security_monitoring_filters_write summary: Deactivate content pack tags: - Security Monitoring + "x-permission": + operator: OR + permissions: + - security_monitoring_filters_write + - logs_modify_indexes x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). diff --git a/src/main/java/com/datadog/api/client/v2/api/SecurityMonitoringApi.java b/src/main/java/com/datadog/api/client/v2/api/SecurityMonitoringApi.java index 0f5a870dc7f..67ff22f8e95 100644 --- a/src/main/java/com/datadog/api/client/v2/api/SecurityMonitoringApi.java +++ b/src/main/java/com/datadog/api/client/v2/api/SecurityMonitoringApi.java @@ -156,7 +156,8 @@ public void setApiClient(ApiClient apiClient) { * *

See {@link #activateContentPackWithHttpInfo}. * - * @param contentPackId The ID of the content pack to activate. (required) + * @param contentPackId The ID of the content pack to activate (for example, aws-cloudtrail + * ). (required) * @throws ApiException if fails to make API call */ public void activateContentPack(String contentPackId) throws ApiException { @@ -168,7 +169,8 @@ public void activateContentPack(String contentPackId) throws ApiException { * *

See {@link #activateContentPackWithHttpInfoAsync}. * - * @param contentPackId The ID of the content pack to activate. (required) + * @param contentPackId The ID of the content pack to activate (for example, aws-cloudtrail + * ). (required) * @return CompletableFuture */ public CompletableFuture activateContentPackAsync(String contentPackId) { @@ -180,11 +182,11 @@ public CompletableFuture activateContentPackAsync(String contentPackId) { } /** - * Activate a security monitoring content pack. This operation configures the necessary log - * filters or security filters depending on the pricing model and updates the content pack - * activation state. + * Activate a Cloud SIEM content pack. This operation configures the necessary log filters or + * security filters depending on the pricing model and updates the content pack activation state. * - * @param contentPackId The ID of the content pack to activate. (required) + * @param contentPackId The ID of the content pack to activate (for example, aws-cloudtrail + * ). (required) * @return ApiResponse<Void> * @throws ApiException if fails to make API call * @http.response.details @@ -230,7 +232,7 @@ public ApiResponse activateContentPackWithHttpInfo(String contentPackId) localVarHeaderParams, new HashMap(), new String[] {"*/*"}, - new String[] {"apiKeyAuth", "appKeyAuth"}); + new String[] {"apiKeyAuth", "appKeyAuth", "AuthZ"}); return apiClient.invokeAPI( "PUT", builder, @@ -247,7 +249,8 @@ public ApiResponse activateContentPackWithHttpInfo(String contentPackId) * *

See {@link #activateContentPackWithHttpInfo}. * - * @param contentPackId The ID of the content pack to activate. (required) + * @param contentPackId The ID of the content pack to activate (for example, aws-cloudtrail + * ). (required) * @return CompletableFuture<ApiResponse<Void>> */ public CompletableFuture> activateContentPackWithHttpInfoAsync( @@ -292,7 +295,7 @@ public CompletableFuture> activateContentPackWithHttpInfoAsync localVarHeaderParams, new HashMap(), new String[] {"*/*"}, - new String[] {"apiKeyAuth", "appKeyAuth"}); + new String[] {"apiKeyAuth", "appKeyAuth", "AuthZ"}); } catch (ApiException ex) { CompletableFuture> result = new CompletableFuture<>(); result.completeExceptionally(ex); @@ -3279,7 +3282,8 @@ public ApiResponse createVulnerabilityNotificationRule * *

See {@link #deactivateContentPackWithHttpInfo}. * - * @param contentPackId The ID of the content pack to deactivate. (required) + * @param contentPackId The ID of the content pack to deactivate (for example, + * aws-cloudtrail). (required) * @throws ApiException if fails to make API call */ public void deactivateContentPack(String contentPackId) throws ApiException { @@ -3291,7 +3295,8 @@ public void deactivateContentPack(String contentPackId) throws ApiException { * *

See {@link #deactivateContentPackWithHttpInfoAsync}. * - * @param contentPackId The ID of the content pack to deactivate. (required) + * @param contentPackId The ID of the content pack to deactivate (for example, + * aws-cloudtrail). (required) * @return CompletableFuture */ public CompletableFuture deactivateContentPackAsync(String contentPackId) { @@ -3303,11 +3308,11 @@ public CompletableFuture deactivateContentPackAsync(String contentPackId) } /** - * Deactivate a security monitoring content pack. This operation removes the content pack's - * configuration from log filters or security filters and updates the content pack activation - * state. + * Deactivate a Cloud SIEM content pack. This operation removes the content pack's configuration + * from log filters or security filters and updates the content pack activation state. * - * @param contentPackId The ID of the content pack to deactivate. (required) + * @param contentPackId The ID of the content pack to deactivate (for example, + * aws-cloudtrail). (required) * @return ApiResponse<Void> * @throws ApiException if fails to make API call * @http.response.details @@ -3353,7 +3358,7 @@ public ApiResponse deactivateContentPackWithHttpInfo(String contentPackId) localVarHeaderParams, new HashMap(), new String[] {"*/*"}, - new String[] {"apiKeyAuth", "appKeyAuth"}); + new String[] {"apiKeyAuth", "appKeyAuth", "AuthZ"}); return apiClient.invokeAPI( "PUT", builder, @@ -3370,7 +3375,8 @@ public ApiResponse deactivateContentPackWithHttpInfo(String contentPackId) * *

See {@link #deactivateContentPackWithHttpInfo}. * - * @param contentPackId The ID of the content pack to deactivate. (required) + * @param contentPackId The ID of the content pack to deactivate (for example, + * aws-cloudtrail). (required) * @return CompletableFuture<ApiResponse<Void>> */ public CompletableFuture> deactivateContentPackWithHttpInfoAsync( @@ -3415,7 +3421,7 @@ public CompletableFuture> deactivateContentPackWithHttpInfoAsy localVarHeaderParams, new HashMap(), new String[] {"*/*"}, - new String[] {"apiKeyAuth", "appKeyAuth"}); + new String[] {"apiKeyAuth", "appKeyAuth", "AuthZ"}); } catch (ApiException ex) { CompletableFuture> result = new CompletableFuture<>(); result.completeExceptionally(ex); @@ -5447,9 +5453,8 @@ public SecurityMonitoringContentPackStatesResponse getContentPacksStates() throw } /** - * Get the activation and configuration states for all security monitoring content packs. This - * endpoint returns status information about each content pack including activation state, - * integration status, and log collection status. + * Get the activation state, integration status, and log collection status for all Cloud SIEM + * content packs. * * @return ApiResponse<SecurityMonitoringContentPackStatesResponse> * @throws ApiException if fails to make API call @@ -5486,7 +5491,7 @@ public SecurityMonitoringContentPackStatesResponse getContentPacksStates() throw localVarHeaderParams, new HashMap(), new String[] {"application/json"}, - new String[] {"apiKeyAuth", "appKeyAuth"}); + new String[] {"apiKeyAuth", "appKeyAuth", "AuthZ"}); return apiClient.invokeAPI( "GET", builder, @@ -5534,7 +5539,7 @@ public SecurityMonitoringContentPackStatesResponse getContentPacksStates() throw localVarHeaderParams, new HashMap(), new String[] {"application/json"}, - new String[] {"apiKeyAuth", "appKeyAuth"}); + new String[] {"apiKeyAuth", "appKeyAuth", "AuthZ"}); } catch (ApiException ex) { CompletableFuture> result = new CompletableFuture<>(); diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackActivation.java b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackActivation.java index 2d3c0328e92..884450111ad 100644 --- a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackActivation.java +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackActivation.java @@ -18,7 +18,7 @@ import java.util.HashSet; import java.util.Set; -/** The activation status of a content pack */ +/** The activation status of a content pack. */ @JsonSerialize( using = SecurityMonitoringContentPackActivation.SecurityMonitoringContentPackActivationSerializer diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackIntegrationStatus.java b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackIntegrationStatus.java index 93f8867efee..0ab15e018e1 100644 --- a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackIntegrationStatus.java +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackIntegrationStatus.java @@ -18,7 +18,7 @@ import java.util.HashSet; import java.util.Set; -/** The installation status of the related integration */ +/** The installation status of the related integration. */ @JsonSerialize( using = SecurityMonitoringContentPackIntegrationStatus diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackStateAttributes.java b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackStateAttributes.java index c7a04b18143..0754dc5cf31 100644 --- a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackStateAttributes.java +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackStateAttributes.java @@ -112,7 +112,7 @@ public SecurityMonitoringContentPackStateAttributes cpActivation( } /** - * The activation status of a content pack + * The activation status of a content pack. * * @return cpActivation */ @@ -136,8 +136,8 @@ public SecurityMonitoringContentPackStateAttributes filtersConfiguredForLogs( } /** - * Whether filters (Security Filters or Index Query depending on the pricing model) are configured - * for logs + * Whether filters (Security Filters or Index Query depending on the pricing model) are present + * and correctly configured to route logs into Cloud SIEM. * * @return filtersConfiguredForLogs */ @@ -159,7 +159,7 @@ public SecurityMonitoringContentPackStateAttributes integrationInstalledStatus( } /** - * The installation status of the related integration + * The installation status of the related integration. * * @return integrationInstalledStatus */ @@ -186,7 +186,7 @@ public SecurityMonitoringContentPackStateAttributes logsLastCollected( } /** - * Timestamp bucket indicating when logs were last collected + * Timestamp bucket indicating when logs were last collected. * * @return logsLastCollected */ @@ -210,7 +210,8 @@ public SecurityMonitoringContentPackStateAttributes logsSeenFromAnyIndex( } /** - * Whether logs have been seen from any index + * Whether logs for this content pack have been seen in any Datadog index within the last 72 + * hours. * * @return logsSeenFromAnyIndex */ @@ -232,7 +233,7 @@ public SecurityMonitoringContentPackStateAttributes state( } /** - * The current status of a content pack + * The current operational status of a content pack. * * @return state */ diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackStateMeta.java b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackStateMeta.java index fc23f9a2738..4cd929eb0ae 100644 --- a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackStateMeta.java +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackStateMeta.java @@ -73,7 +73,7 @@ public SecurityMonitoringContentPackStateMeta sku(SecurityMonitoringSKU sku) { } /** - * The SIEM pricing model (SKU) for the organization + * The Cloud SIEM pricing model (SKU) for the organization. * * @return sku */ diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackStatus.java b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackStatus.java index 953111c0ad1..9be02f125b9 100644 --- a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackStatus.java +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackStatus.java @@ -18,7 +18,7 @@ import java.util.HashSet; import java.util.Set; -/** The current status of a content pack */ +/** The current operational status of a content pack. */ @JsonSerialize( using = SecurityMonitoringContentPackStatus.SecurityMonitoringContentPackStatusSerializer.class) public class SecurityMonitoringContentPackStatus extends ModelEnum { diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackTimestampBucket.java b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackTimestampBucket.java index 065c1f05ab3..9b3e9e74802 100644 --- a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackTimestampBucket.java +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringContentPackTimestampBucket.java @@ -18,7 +18,7 @@ import java.util.HashSet; import java.util.Set; -/** Timestamp bucket indicating when logs were last collected */ +/** Timestamp bucket indicating when logs were last collected. */ @JsonSerialize( using = SecurityMonitoringContentPackTimestampBucket diff --git a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringSKU.java b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringSKU.java index ecef96592f0..fb7e65e4225 100644 --- a/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringSKU.java +++ b/src/main/java/com/datadog/api/client/v2/model/SecurityMonitoringSKU.java @@ -18,7 +18,7 @@ import java.util.HashSet; import java.util.Set; -/** The SIEM pricing model (SKU) for the organization */ +/** The Cloud SIEM pricing model (SKU) for the organization. */ @JsonSerialize(using = SecurityMonitoringSKU.SecurityMonitoringSKUSerializer.class) public class SecurityMonitoringSKU extends ModelEnum {