Subscribe to sample log generation

Note: This endpoint is in preview and is subject to change. If you have any feedback, contact Datadog support.

POST https://api.ap1.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptionshttps://api.ap2.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptionshttps://api.datadoghq.eu/api/v2/security_monitoring/sample_log_generation/subscriptionshttps://api.ddog-gov.com/api/v2/security_monitoring/sample_log_generation/subscriptionshttps://api.us2.ddog-gov.com/api/v2/security_monitoring/sample_log_generation/subscriptionshttps://api.uk1.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptionshttps://api.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptionshttps://api.us3.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptionshttps://api.us5.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptions

개요

Cloud SIEM 콘텐츠 팩에 대한 샘플 로그 생성을 구독합니다. 요청된 콘텐츠 팩의 샘플 로그가 구독 기간 동안 Logs 플랫폼에 주입됩니다. 따라서 기본 통합을 먼저 온보딩하지 않아도 탐지 규칙을 실행할 수 있습니다.

가용성: 이 엔드포인트는 적격 요금제 모델을 사용하는 Cloud SIEM 체험 조직으로 제한됩니다. 체험판 조직이 아닌 조직은 403 Forbidden을 받으며 Feature Flag에 따라 400 Bad Request가 포함된 요청이 거부될 수도 있고, 요금제 계층은 status: not_available인 응답을 받습니다.

This endpoint requires any of the following permissions:
  • security_monitoring_filters_write
  • logs_modify_indexes

  • OAuth apps require the security_monitoring_filters_write, logs_modify_indexes authorization scope to access this endpoint.

    요청

    Body Data (required)

    구독할 콘텐츠 팩과 원하는 구독 기간입니다.

    Expand All

    항목

    유형

    설명

    data [required]

    object

    The subscription request body.

    attributes [required]

    object

    The attributes for creating a sample log generation subscription.

    content_pack_id [required]

    string

    The identifier of the Cloud SIEM content pack to subscribe to.

    duration

    enum

    How long the subscription should remain active before expiring. Allowed enum values: 1h,1d,3d,7d

    default: 3d

    type [required]

    enum

    The type of the resource. The value should always be subscription_requests. Allowed enum values: subscription_requests

    default: subscription_requests

    {
      "data": {
        "attributes": {
          "content_pack_id": "aws-cloudtrail",
          "duration": "3d"
        },
        "type": "subscription_requests"
      }
    }

    응답

    OK

    Response containing a single sample log generation subscription.

    Expand All

    항목

    유형

    설명

    data [required]

    object

    A sample log generation subscription.

    attributes [required]

    object

    The attributes describing a sample log generation subscription.

    content_pack_id [required]

    string

    The identifier of the Cloud SIEM content pack the subscription targets.

    created_at [required]

    date-time

    The time at which the subscription was created.

    expires_at [required]

    date-time

    The time at which the subscription expires and stops generating logs.

    is_active [required]

    boolean

    Whether the subscription is currently active and generating logs.

    status [required]

    enum

    The status of the subscription. Allowed enum values: subscribed,renewed,unsubscribed,no_active_subscription,not_available,active,expired

    id [required]

    string

    The unique identifier of the subscription.

    type [required]

    enum

    The type of the resource. The value should always be subscriptions. Allowed enum values: subscriptions

    default: subscriptions

    {
      "data": {
        "attributes": {
          "content_pack_id": "aws-cloudtrail",
          "created_at": "2026-05-08T20:02:13.77481Z",
          "expires_at": "2026-05-11T20:02:13.77481Z",
          "is_active": true,
          "status": "subscribed"
        },
        "id": "789",
        "type": "subscriptions"
      }
    }

    Bad Request

    API error response.

    Expand All

    항목

    유형

    설명

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Not Authorized

    API error response.

    Expand All

    항목

    유형

    설명

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    Too many requests

    API error response.

    Expand All

    항목

    유형

    설명

    errors [required]

    [string]

    A list of errors.

    {
      "errors": [
        "Bad Request"
      ]
    }

    코드 예시

                      ## default
    # 
    
    # Use a Personal Access Token or Service Access Token
    export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

    # Curl command
    curl -X POST "https://api.ap1.datadoghq.com"https://api.ap2.datadoghq.com"https://api.datadoghq.eu"https://api.ddog-gov.com"https://api.us2.ddog-gov.com"https://api.uk1.datadoghq.com"https://api.datadoghq.com"https://api.us3.datadoghq.com"https://api.us5.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptions" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" \ -d @- << EOF { "data": { "attributes": { "content_pack_id": "aws-cloudtrail", "duration": "3d" }, "type": "subscription_requests" } } EOF
    """
    Subscribe to sample log generation returns "OK" response
    """
    
    from os import environ
    from datadog_api_client import ApiClient, Configuration
    from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
    from datadog_api_client.v2.model.sample_log_generation_duration import SampleLogGenerationDuration
    from datadog_api_client.v2.model.sample_log_generation_subscription_create_attributes import (
        SampleLogGenerationSubscriptionCreateAttributes,
    )
    from datadog_api_client.v2.model.sample_log_generation_subscription_create_data import (
        SampleLogGenerationSubscriptionCreateData,
    )
    from datadog_api_client.v2.model.sample_log_generation_subscription_create_request import (
        SampleLogGenerationSubscriptionCreateRequest,
    )
    from datadog_api_client.v2.model.sample_log_generation_subscription_request_type import (
        SampleLogGenerationSubscriptionRequestType,
    )
    
    body = SampleLogGenerationSubscriptionCreateRequest(
        data=SampleLogGenerationSubscriptionCreateData(
            attributes=SampleLogGenerationSubscriptionCreateAttributes(
                content_pack_id="aws-cloudtrail",
                duration=SampleLogGenerationDuration.THREE_DAYS,
            ),
            type=SampleLogGenerationSubscriptionRequestType.SUBSCRIPTION_REQUESTS,
        ),
    )
    
    configuration = Configuration()
    configuration.access_token = environ["DD_BEARER_TOKEN"]
    configuration.unstable_operations["create_sample_log_generation_subscription"] = True
    with ApiClient(configuration) as api_client:
        api_instance = SecurityMonitoringApi(api_client)
        response = api_instance.create_sample_log_generation_subscription(body=body)
    
        print(response)
    

    Instructions

    First install the library and its dependencies and then save the example to example.py and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"
    # Subscribe to sample log generation returns "OK" response
    
    require "datadog_api_client"
    DatadogAPIClient.configure do |config|
      config.access_token = ENV["DD_BEARER_TOKEN"]
      config.unstable_operations["v2.create_sample_log_generation_subscription".to_sym] = true
    end
    api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
    
    body = DatadogAPIClient::V2::SampleLogGenerationSubscriptionCreateRequest.new({
      data: DatadogAPIClient::V2::SampleLogGenerationSubscriptionCreateData.new({
        attributes: DatadogAPIClient::V2::SampleLogGenerationSubscriptionCreateAttributes.new({
          content_pack_id: "aws-cloudtrail",
          duration: DatadogAPIClient::V2::SampleLogGenerationDuration::THREE_DAYS,
        }),
        type: DatadogAPIClient::V2::SampleLogGenerationSubscriptionRequestType::SUBSCRIPTION_REQUESTS,
      }),
    })
    p api_instance.create_sample_log_generation_subscription(body)
    

    Instructions

    First install the library and its dependencies and then save the example to example.rb and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"
    // Subscribe to sample log generation returns "OK" response
    
    package main
    
    import (
    	"context"
    	"encoding/json"
    	"fmt"
    	"os"
    
    	"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
    	"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
    )
    
    func main() {
    	body := datadogV2.SampleLogGenerationSubscriptionCreateRequest{
    		Data: datadogV2.SampleLogGenerationSubscriptionCreateData{
    			Attributes: datadogV2.SampleLogGenerationSubscriptionCreateAttributes{
    				ContentPackId: "aws-cloudtrail",
    				Duration:      datadogV2.SAMPLELOGGENERATIONDURATION_THREE_DAYS.Ptr(),
    			},
    			Type: datadogV2.SAMPLELOGGENERATIONSUBSCRIPTIONREQUESTTYPE_SUBSCRIPTION_REQUESTS,
    		},
    	}
    	ctx := datadog.NewDefaultContext(context.Background())
    	ctx = context.WithValue(ctx, datadog.ContextAccessToken, os.Getenv("DD_BEARER_TOKEN"))
    	configuration := datadog.NewConfiguration()
    	configuration.SetUnstableOperationEnabled("v2.CreateSampleLogGenerationSubscription", true)
    	apiClient := datadog.NewAPIClient(configuration)
    	api := datadogV2.NewSecurityMonitoringApi(apiClient)
    	resp, r, err := api.CreateSampleLogGenerationSubscription(ctx, body)
    
    	if err != nil {
    		fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.CreateSampleLogGenerationSubscription`: %v\n", err)
    		fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
    	}
    
    	responseContent, _ := json.MarshalIndent(resp, "", "  ")
    	fmt.Fprintf(os.Stdout, "Response from `SecurityMonitoringApi.CreateSampleLogGenerationSubscription`:\n%s\n", responseContent)
    }
    

    Instructions

    First install the library and its dependencies and then save the example to main.go and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"
    // Subscribe to sample log generation returns "OK" response
    
    import com.datadog.api.client.ApiClient;
    import com.datadog.api.client.ApiException;
    import com.datadog.api.client.v2.api.SecurityMonitoringApi;
    import com.datadog.api.client.v2.model.SampleLogGenerationDuration;
    import com.datadog.api.client.v2.model.SampleLogGenerationSubscriptionCreateAttributes;
    import com.datadog.api.client.v2.model.SampleLogGenerationSubscriptionCreateData;
    import com.datadog.api.client.v2.model.SampleLogGenerationSubscriptionCreateRequest;
    import com.datadog.api.client.v2.model.SampleLogGenerationSubscriptionRequestType;
    import com.datadog.api.client.v2.model.SampleLogGenerationSubscriptionResponse;
    
    public class Example {
      public static void main(String[] args) {
        ApiClient defaultClient = ApiClient.getDefaultApiClient();
        defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN"));
        defaultClient.setUnstableOperationEnabled("v2.createSampleLogGenerationSubscription", true);
        SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient);
    
        SampleLogGenerationSubscriptionCreateRequest body =
            new SampleLogGenerationSubscriptionCreateRequest()
                .data(
                    new SampleLogGenerationSubscriptionCreateData()
                        .attributes(
                            new SampleLogGenerationSubscriptionCreateAttributes()
                                .contentPackId("aws-cloudtrail")
                                .duration(SampleLogGenerationDuration.THREE_DAYS))
                        .type(SampleLogGenerationSubscriptionRequestType.SUBSCRIPTION_REQUESTS));
    
        try {
          SampleLogGenerationSubscriptionResponse result =
              apiInstance.createSampleLogGenerationSubscription(body);
          System.out.println(result);
        } catch (ApiException e) {
          System.err.println(
              "Exception when calling SecurityMonitoringApi#createSampleLogGenerationSubscription");
          System.err.println("Status code: " + e.getCode());
          System.err.println("Reason: " + e.getResponseBody());
          System.err.println("Response headers: " + e.getResponseHeaders());
          e.printStackTrace();
        }
      }
    }
    

    Instructions

    First install the library and its dependencies and then save the example to Example.java and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"
    // Subscribe to sample log generation returns "OK" response
    use datadog_api_client::datadog;
    use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;
    use datadog_api_client::datadogV2::model::SampleLogGenerationDuration;
    use datadog_api_client::datadogV2::model::SampleLogGenerationSubscriptionCreateAttributes;
    use datadog_api_client::datadogV2::model::SampleLogGenerationSubscriptionCreateData;
    use datadog_api_client::datadogV2::model::SampleLogGenerationSubscriptionCreateRequest;
    use datadog_api_client::datadogV2::model::SampleLogGenerationSubscriptionRequestType;
    
    #[tokio::main]
    async fn main() {
        let body = SampleLogGenerationSubscriptionCreateRequest::new(
            SampleLogGenerationSubscriptionCreateData::new(
                SampleLogGenerationSubscriptionCreateAttributes::new("aws-cloudtrail".to_string())
                    .duration(SampleLogGenerationDuration::THREE_DAYS),
                SampleLogGenerationSubscriptionRequestType::SUBSCRIPTION_REQUESTS,
            ),
        );
        let mut configuration = datadog::Configuration::new();
        configuration
            .set_unstable_operation_enabled("v2.create_sample_log_generation_subscription", true);
        let api = SecurityMonitoringAPI::with_config(configuration);
        let resp = api.create_sample_log_generation_subscription(body).await;
        if let Ok(value) = resp {
            println!("{:#?}", value);
        } else {
            println!("{:#?}", resp.unwrap_err());
        }
    }
    

    Instructions

    First install the library and its dependencies and then save the example to src/main.rs and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo run
    /**
     * Subscribe to sample log generation returns "OK" response
     */
    
    import { client, v2 } from "@datadog/datadog-api-client";
    
    const configuration = client.createConfiguration({
      authMethods: {
        AuthZ: {
          accessToken: process.env.DD_BEARER_TOKEN as string,
        },
      },
    });
    configuration.unstableOperations["v2.createSampleLogGenerationSubscription"] =
      true;
    const apiInstance = new v2.SecurityMonitoringApi(configuration);
    
    const params: v2.SecurityMonitoringApiCreateSampleLogGenerationSubscriptionRequest =
      {
        body: {
          data: {
            attributes: {
              contentPackId: "aws-cloudtrail",
              duration: "3d",
            },
            type: "subscription_requests",
          },
        },
      };
    
    apiInstance
      .createSampleLogGenerationSubscription(params)
      .then((data: v2.SampleLogGenerationSubscriptionResponse) => {
        console.log(
          "API called successfully. Returned data: " + JSON.stringify(data)
        );
      })
      .catch((error: any) => console.error(error));
    

    Instructions

    First install the library and its dependencies and then save the example to example.ts and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"