For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/jen.gilbert/astro-base/ja/api/latest/security-monitoring/subscribe-to-sample-log-generation.md. A documentation index is available at /llms.txt.
Language
Datadog site

Subscribe to sample log generation

警告Note: This endpoint is in preview and is subject to change. If you have any feedback, contact Datadog support.
POSThttps://api.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptionshttps://api.us3.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptionshttps://api.us5.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptionshttps://api.datadoghq.eu/api/v2/security_monitoring/sample_log_generation/subscriptionshttps://api.ap1.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptionshttps://api.ap2.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptionshttps://api.uk1.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptionshttps://api.ddog-gov.com/api/v2/security_monitoring/sample_log_generation/subscriptionshttps://api.us2.ddog-gov.com/api/v2/security_monitoring/sample_log_generation/subscriptions

概要

Subscribe to sample log generation for a Cloud SIEM content pack. Sample logs for the requested content pack are injected into the Logs platform for the duration of the subscription, so detection rules can be exercised without onboarding the underlying integration first.

Availability: this endpoint is restricted to Cloud SIEM trial organizations on an eligible pricing model. Non-trial orgs receive 403 Forbidden, the feature flag may also reject requests with 400 Bad Request, and legacy pricing tiers receive a response with status: not_available.

This endpoint requires any of the following permissions:

  • security_monitoring_filters_write
  • logs_modify_indexes

OAuth apps require the security_monitoring_filters_write, logs_modify_indexes authorization scope to access this endpoint.

リクエスト

Body Data (required)

The content pack to subscribe to and the desired duration of the subscription.

フィールド
タイプ
説明
data [required]
object

The subscription request body.

応答

OK

Response containing a single sample log generation subscription.

フィールド
タイプ
説明
data [required]
object

A sample log generation subscription.

コード例

Subscribe to sample log generation
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/sample_log_generation/subscriptions" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "content_pack_id": "aws-cloudtrail",
      "duration": "3d"
    },
    "type": "subscription_requests"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/sample_log_generation/subscriptions" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "content_pack_id": "aws-cloudtrail",
      "duration": "3d"
    },
    "type": "subscription_requests"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/sample_log_generation/subscriptions" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "content_pack_id": "aws-cloudtrail",
      "duration": "3d"
    },
    "type": "subscription_requests"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/sample_log_generation/subscriptions" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "content_pack_id": "aws-cloudtrail",
      "duration": "3d"
    },
    "type": "subscription_requests"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/sample_log_generation/subscriptions" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "content_pack_id": "aws-cloudtrail",
      "duration": "3d"
    },
    "type": "subscription_requests"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/sample_log_generation/subscriptions" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "content_pack_id": "aws-cloudtrail",
      "duration": "3d"
    },
    "type": "subscription_requests"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/sample_log_generation/subscriptions" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "content_pack_id": "aws-cloudtrail",
      "duration": "3d"
    },
    "type": "subscription_requests"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/sample_log_generation/subscriptions" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "content_pack_id": "aws-cloudtrail",
      "duration": "3d"
    },
    "type": "subscription_requests"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security_monitoring/sample_log_generation/subscriptions" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "content_pack_id": "aws-cloudtrail",
      "duration": "3d"
    },
    "type": "subscription_requests"
  }
}
EOF