Get the activation state, integration status, and log collection status
for all Cloud SIEM content packs.
This endpoint requires
any
of the following permissions:
security_monitoring_filters_read
logs_read_index_data
OAuth apps require the security_monitoring_filters_read authorization scope to access this endpoint.
Whether the cloud SIEM index configuration is incorrect (only applies to certain pricing models)
cp_activation [required]
enum
The activation status of a content pack.
Allowed enum values: never_activated,activated,deactivated
filters_configured_for_logs [required]
boolean
Whether filters (Security Filters or Index Query depending on the pricing model) are
present and correctly configured to route logs into Cloud SIEM.
integration_installed_status
enum
The installation status of the related integration.
Allowed enum values: installed,available,partially_installed,detected,error
logs_last_collected [required]
enum
Timestamp bucket indicating when logs were last collected.
Allowed enum values: not_seen,within_24_hours,within_24_to_72_hours,over_72h_to_30d,over_30d
logs_seen_from_any_index [required]
boolean
Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
state [required]
enum
The current operational status of a content pack.
Allowed enum values: install,activate,initializing,active,warning,broken
id [required]
string
The content pack identifier.
type [required]
enum
Type for content pack state object
Allowed enum values: content_pack_state
meta [required]
object
Metadata for content pack states
cloud_siem_index_incorrect [required]
boolean
Whether the cloud SIEM index configuration is incorrect at the organization level
sku [required]
enum
The Cloud SIEM pricing model (SKU) for the organization.
Allowed enum values: per_gb_analyzed,per_event_in_siem_index_2023,add_on_2024
"""
Get content pack states returns "OK" response
"""fromdatadog_api_clientimportApiClient,Configurationfromdatadog_api_client.v2.api.security_monitoring_apiimportSecurityMonitoringApiconfiguration=Configuration()configuration.unstable_operations["get_content_packs_states"]=TruewithApiClient(configuration)asapi_client:api_instance=SecurityMonitoringApi(api_client)response=api_instance.get_content_packs_states()print(response)
# Get content pack states returns "OK" responserequire"datadog_api_client"DatadogAPIClient.configuredo|config|config.unstable_operations["v2.get_content_packs_states".to_sym]=trueendapi_instance=DatadogAPIClient::V2::SecurityMonitoringAPI.newpapi_instance.get_content_packs_states()
// Get content pack states returns "OK" responsepackagemainimport("context""encoding/json""fmt""os""github.com/DataDog/datadog-api-client-go/v2/api/datadog""github.com/DataDog/datadog-api-client-go/v2/api/datadogV2")funcmain(){ctx:=datadog.NewDefaultContext(context.Background())configuration:=datadog.NewConfiguration()configuration.SetUnstableOperationEnabled("v2.GetContentPacksStates",true)apiClient:=datadog.NewAPIClient(configuration)api:=datadogV2.NewSecurityMonitoringApi(apiClient)resp,r,err:=api.GetContentPacksStates(ctx)iferr!=nil{fmt.Fprintf(os.Stderr,"Error when calling `SecurityMonitoringApi.GetContentPacksStates`: %v\n",err)fmt.Fprintf(os.Stderr,"Full HTTP response: %v\n",r)}responseContent,_:=json.MarshalIndent(resp,""," ")fmt.Fprintf(os.Stdout,"Response from `SecurityMonitoringApi.GetContentPacksStates`:\n%s\n",responseContent)}
// Get content pack states returns "OK" response
usedatadog_api_client::datadog;usedatadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;#[tokio::main]asyncfnmain(){letmutconfiguration=datadog::Configuration::new();configuration.set_unstable_operation_enabled("v2.GetContentPacksStates",true);letapi=SecurityMonitoringAPI::with_config(configuration);letresp=api.get_content_packs_states().await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Get content pack states returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();configuration.unstableOperations["v2.getContentPacksStates"]=true;constapiInstance=newv2.SecurityMonitoringApi(configuration);apiInstance.getContentPacksStates().then((data: v2.SecurityMonitoringContentPackStatesResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));