Note : This endpoint is in preview and is subject to change.
If you have any feedback, contact Datadog support .
POST https://api.ap1.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptions https://api.ap2.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptions https://api.datadoghq.eu/api/v2/security_monitoring/sample_log_generation/subscriptions https://api.ddog-gov.com/api/v2/security_monitoring/sample_log_generation/subscriptions https://api.us2.ddog-gov.com/api/v2/security_monitoring/sample_log_generation/subscriptions https://api.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptions https://api.us3.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptions https://api.us5.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptions
Overview
Subscribe to sample log generation for a Cloud SIEM content pack. Sample logs for the
requested content pack are injected into the Logs platform for the duration of the subscription,
so detection rules can be exercised without onboarding the underlying integration first.
Availability : this endpoint is restricted to Cloud SIEM trial organizations on an
eligible pricing model. Non-trial orgs receive 403 Forbidden, the feature flag may also reject
requests with 400 Bad Request, and legacy pricing tiers receive a response with status: not_available.
This endpoint requires
any
of the following permissions:
security_monitoring_filters_writelogs_modify_indexesOAuth apps require the security_monitoring_filters_write, logs_modify_indexes authorization scope to access this endpoint.
Request Body Data (required) The content pack to subscribe to and the desired duration of the subscription.
Expand All
The subscription request body.
The attributes for creating a sample log generation subscription.
content_pack_id [required ]
The identifier of the Cloud SIEM content pack to subscribe to.
How long the subscription should remain active before expiring.
Allowed enum values: 1h,1d,3d,7d
default: 3d
The type of the resource. The value should always be subscription_requests.
Allowed enum values: subscription_requests
default: subscription_requests
{
"data" : {
"attributes" : {
"content_pack_id" : "aws-cloudtrail" ,
"duration" : "3d"
},
"type" : "subscription_requests"
}
} Response OK
Response containing a single sample log generation subscription.
Expand All
A sample log generation subscription.
The attributes describing a sample log generation subscription.
content_pack_id [required ]
The identifier of the Cloud SIEM content pack the subscription targets.
The time at which the subscription was created.
The time at which the subscription expires and stops generating logs.
Whether the subscription is currently active and generating logs.
The status of the subscription.
Allowed enum values: subscribed,renewed,unsubscribed,no_active_subscription,not_available,active,expired
The unique identifier of the subscription.
The type of the resource. The value should always be subscriptions.
Allowed enum values: subscriptions
default: subscriptions
{
"data" : {
"attributes" : {
"content_pack_id" : "aws-cloudtrail" ,
"created_at" : "2026-05-08T20:02:13.77481Z" ,
"expires_at" : "2026-05-11T20:02:13.77481Z" ,
"is_active" : true ,
"status" : "subscribed"
},
"id" : "789" ,
"type" : "subscriptions"
}
} Bad Request
{
"errors" : [
"Bad Request"
]
} Not Authorized
{
"errors" : [
"Bad Request"
]
} Too many requests
{
"errors" : [
"Bad Request"
]
} Code Example Copy
## default
#
# Curl command curl -X POST "https://api.ap1.datadoghq.com "https://api.ap2.datadoghq.com "https://api.datadoghq.eu "https://api.ddog-gov.com "https://api.us2.ddog-gov.com "https://api.datadoghq.com "https://api.us3.datadoghq.com "https://api.us5.datadoghq.com /api/v2/security_monitoring/sample_log_generation/subscriptions " \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "DD-API-KEY: ${DD_API_KEY} " \
-H "DD-APPLICATION-KEY: ${DD_APP_KEY} " \
-d @- << EOF
{
"data": {
"attributes": {
"content_pack_id": "aws-cloudtrail",
"duration": "3d"
},
"type": "subscription_requests"
}
}
EOF
