@@ -37853,7 +37853,7 @@ components:
3785337853 $ref: "#/components/schemas/LLMObsAnnotationItem"
3785437854 type: array
3785537855 content_id:
37856- description: Identifier of the content for this interaction.
37856+ description: Identifier of the content (trace ID or session ID) for this interaction.
3785737857 example: "trace-abc-123"
3785837858 type: string
3785937859 id:
@@ -38052,7 +38052,7 @@ components:
3805238052 description: A single interaction to add to an annotation queue.
3805338053 properties:
3805438054 content_id:
38055- description: Identifier of the content (such as trace ID) for this interaction.
38055+ description: Identifier of the content (trace ID or session ID) for this interaction.
3805638056 example: "trace-abc-123"
3805738057 type: string
3805838058 type:
@@ -38069,7 +38069,7 @@ components:
3806938069 example: false
3807038070 type: boolean
3807138071 content_id:
38072- description: Identifier of the content for this interaction.
38072+ description: Identifier of the content (trace ID or session ID) for this interaction.
3807338073 example: "trace-abc-123"
3807438074 type: string
3807538075 id:
@@ -39516,11 +39516,13 @@ components:
3951639516 enum:
3951739517 - trace
3951839518 - experiment_trace
39519+ - session
3951939520 example: trace
3952039521 type: string
3952139522 x-enum-varnames:
3952239523 - TRACE
3952339524 - EXPERIMENT_TRACE
39525+ - SESSION
3952439526 LLMObsMetricAssessment:
3952539527 description: Assessment result for an LLM Observability experiment metric.
3952639528 enum:
@@ -62654,23 +62656,19 @@ components:
6265462656 - DONE
6265562657 - TIMEOUT
6265662658 SecurityMonitoringContentPackActivation:
62657- description: The activation status of a content pack.
62659+ description: The activation status of a content pack
6265862660 enum:
6265962661 - never_activated
6266062662 - activated
6266162663 - deactivated
6266262664 example: activated
6266362665 type: string
62664- x-enum-descriptions:
62665- - Pack has never been activated for this organization.
62666- - Pack is currently activated.
62667- - Pack was previously activated but has since been deactivated.
6266862666 x-enum-varnames:
6266962667 - NEVER_ACTIVATED
6267062668 - ACTIVATED
6267162669 - DEACTIVATED
6267262670 SecurityMonitoringContentPackIntegrationStatus:
62673- description: The installation status of the related integration.
62671+ description: The installation status of the related integration
6267462672 enum:
6267562673 - installed
6267662674 - available
@@ -62679,12 +62677,6 @@ components:
6267962677 - error
6268062678 example: installed
6268162679 type: string
62682- x-enum-descriptions:
62683- - Integration is fully installed.
62684- - Integration exists in the catalog but is not installed.
62685- - Integration is only partially configured.
62686- - Integration detected (for example, logs are flowing) but not explicitly installed.
62687- - Integration is in an error state.
6268862680 x-enum-varnames:
6268962681 - INSTALLED
6269062682 - AVAILABLE
@@ -62701,17 +62693,15 @@ components:
6270162693 cp_activation:
6270262694 $ref: "#/components/schemas/SecurityMonitoringContentPackActivation"
6270362695 filters_configured_for_logs:
62704- description: |-
62705- Whether filters (Security Filters or Index Query depending on the pricing model) are
62706- present and correctly configured to route logs into Cloud SIEM.
62696+ description: Whether filters (Security Filters or Index Query depending on the pricing model) are configured for logs
6270762697 example: true
6270862698 type: boolean
6270962699 integration_installed_status:
6271062700 $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus"
6271162701 logs_last_collected:
6271262702 $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket"
6271362703 logs_seen_from_any_index:
62714- description: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
62704+ description: Whether logs have been seen from any index
6271562705 example: true
6271662706 type: boolean
6271762707 state:
@@ -62776,7 +62766,7 @@ components:
6277662766 - meta
6277762767 type: object
6277862768 SecurityMonitoringContentPackStatus:
62779- description: The current operational status of a content pack.
62769+ description: The current status of a content pack
6278062770 enum:
6278162771 - install
6278262772 - activate
@@ -62786,13 +62776,6 @@ components:
6278662776 - broken
6278762777 example: active
6278862778 type: string
62789- x-enum-descriptions:
62790- - Not activated; no logs detected in the last 72 hours.
62791- - Not activated; logs are flowing into a Datadog index but not yet routed through Cloud SIEM.
62792- - Activated; awaiting first log ingestion.
62793- - Activated; logs received within the last 24 hours.
62794- - Activated; integration not installed or logs last seen 24 to 72 hours ago.
62795- - Activated; no logs for over 72 hours, filter missing, or Cloud SIEM index incorrectly ordered.
6279662779 x-enum-varnames:
6279762780 - INSTALL
6279862781 - ACTIVATE
@@ -62801,7 +62784,7 @@ components:
6280162784 - WARNING
6280262785 - BROKEN
6280362786 SecurityMonitoringContentPackTimestampBucket:
62804- description: Timestamp bucket indicating when logs were last collected.
62787+ description: Timestamp bucket indicating when logs were last collected
6280562788 enum:
6280662789 - not_seen
6280762790 - within_24_hours
@@ -62810,12 +62793,6 @@ components:
6281062793 - over_30d
6281162794 example: within_24_hours
6281262795 type: string
62813- x-enum-descriptions:
62814- - No logs observed.
62815- - Logs received within the last 24 hours.
62816- - Logs last seen 24 to 72 hours ago.
62817- - Logs last seen 3 to 30 days ago.
62818- - Logs last seen more than 30 days ago.
6281962796 x-enum-varnames:
6282062797 - NOT_SEEN
6282162798 - WITHIN_24_HOURS
@@ -63906,7 +63883,7 @@ components:
6390663883 - $ref: "#/components/schemas/SecurityMonitoringSignalRulePayload"
6390763884 - $ref: "#/components/schemas/CloudConfigurationRulePayload"
6390863885 SecurityMonitoringSKU:
63909- description: The Cloud SIEM pricing model (SKU) for the organization.
63886+ description: The SIEM pricing model (SKU) for the organization
6391063887 enum:
6391163888 - per_gb_analyzed
6391263889 - per_event_in_siem_index_2023
@@ -101142,7 +101119,7 @@ paths:
101142101119 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
101143101120 /api/v2/llm-obs/v1/annotation-queues/{queue_id}/annotated-interactions:
101144101121 get:
101145- description: Retrieve all interactions and their annotations for a given annotation queue.
101122+ description: Retrieve all interactions (traces and sessions) and their annotations for a given annotation queue.
101146101123 operationId: GetLLMObsAnnotatedInteractions
101147101124 parameters:
101148101125 - $ref: "#/components/parameters/LLMObsAnnotationQueueIDPathParameter"
@@ -101191,7 +101168,7 @@ paths:
101191101168 /api/v2/llm-obs/v1/annotation-queues/{queue_id}/interactions:
101192101169 post:
101193101170 description: |-
101194- Add one or more interactions (traces) to an annotation queue.
101171+ Add one or more interactions (traces or sessions ) to an annotation queue.
101195101172 At least one interaction must be provided.
101196101173 operationId: CreateLLMObsAnnotationQueueInteractions
101197101174 parameters:
@@ -118729,8 +118706,9 @@ paths:
118729118706 /api/v2/security_monitoring/content_packs/states:
118730118707 get:
118731118708 description: |-
118732- Get the activation state, integration status, and log collection status
118733- for all Cloud SIEM content packs.
118709+ Get the activation and configuration states for all security monitoring content packs.
118710+ This endpoint returns status information about each content pack including activation state,
118711+ integration status, and log collection status.
118734118712 operationId: GetContentPacksStates
118735118713 responses:
118736118714 "200":
@@ -118753,31 +118731,21 @@ paths:
118753118731 description: Not Found
118754118732 "429":
118755118733 $ref: "#/components/responses/TooManyRequestsResponse"
118756- security:
118757- - apiKeyAuth: []
118758- appKeyAuth: []
118759- - AuthZ:
118760- - security_monitoring_filters_read
118761118734 summary: Get content pack states
118762118735 tags:
118763118736 - Security Monitoring
118764- "x-permission":
118765- operator: OR
118766- permissions:
118767- - security_monitoring_filters_read
118768- - logs_read_index_data
118769118737 x-unstable: |-
118770118738 **Note**: This endpoint is in preview and is subject to change.
118771118739 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
118772118740 /api/v2/security_monitoring/content_packs/{content_pack_id}/activate:
118773118741 put:
118774118742 description: |-
118775- Activate a Cloud SIEM content pack. This operation configures the necessary
118743+ Activate a security monitoring content pack. This operation configures the necessary
118776118744 log filters or security filters depending on the pricing model and updates the content
118777118745 pack activation state.
118778118746 operationId: ActivateContentPack
118779118747 parameters:
118780- - description: The ID of the content pack to activate (for example, `aws-cloudtrail`) .
118748+ - description: The ID of the content pack to activate.
118781118749 in: path
118782118750 name: content_pack_id
118783118751 required: true
@@ -118801,30 +118769,20 @@ paths:
118801118769 description: Not Found
118802118770 "429":
118803118771 $ref: "#/components/responses/TooManyRequestsResponse"
118804- security:
118805- - apiKeyAuth: []
118806- appKeyAuth: []
118807- - AuthZ:
118808- - security_monitoring_filters_write
118809118772 summary: Activate content pack
118810118773 tags:
118811118774 - Security Monitoring
118812- "x-permission":
118813- operator: OR
118814- permissions:
118815- - security_monitoring_filters_write
118816- - logs_modify_indexes
118817118775 x-unstable: |-
118818118776 **Note**: This endpoint is in preview and is subject to change.
118819118777 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
118820118778 /api/v2/security_monitoring/content_packs/{content_pack_id}/deactivate:
118821118779 put:
118822118780 description: |-
118823- Deactivate a Cloud SIEM content pack. This operation removes the content pack's
118781+ Deactivate a security monitoring content pack. This operation removes the content pack's
118824118782 configuration from log filters or security filters and updates the content pack activation state.
118825118783 operationId: DeactivateContentPack
118826118784 parameters:
118827- - description: The ID of the content pack to deactivate (for example, `aws-cloudtrail`) .
118785+ - description: The ID of the content pack to deactivate.
118828118786 in: path
118829118787 name: content_pack_id
118830118788 required: true
@@ -118848,19 +118806,9 @@ paths:
118848118806 description: Not Found
118849118807 "429":
118850118808 $ref: "#/components/responses/TooManyRequestsResponse"
118851- security:
118852- - apiKeyAuth: []
118853- appKeyAuth: []
118854- - AuthZ:
118855- - security_monitoring_filters_write
118856118809 summary: Deactivate content pack
118857118810 tags:
118858118811 - Security Monitoring
118859- "x-permission":
118860- operator: OR
118861- permissions:
118862- - security_monitoring_filters_write
118863- - logs_modify_indexes
118864118812 x-unstable: |-
118865118813 **Note**: This endpoint is in preview and is subject to change.
118866118814 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
0 commit comments