--- title: Récupérer les états des packs de contenu description: Récupérer les états d'activation et de configuration de tous les packs de contenu de surveillance de la sécurité. breadcrumbs: Documentation > API > Récupérer les états des packs de contenu --- > For the complete documentation index, see [llms.txt](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/llms.txt). # Récupérer les états des packs de contenu ## v2 (latest) {% alert level="warning" %} **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help.md). {% /alert %} | Datadog site | API endpoint | | ----------------- | --------------------------------------------------------------------------------- | | app.datadoghq.com | GET https://api.datadoghq.com/api/v2/security_monitoring/content_packs/states | | us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/security_monitoring/content_packs/states | | us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/security_monitoring/content_packs/states | | app.datadoghq.eu | GET https://api.datadoghq.eu/api/v2/security_monitoring/content_packs/states | | ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/security_monitoring/content_packs/states | | ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/security_monitoring/content_packs/states | | uk1.datadoghq.com | GET https://api.uk1.datadoghq.com/api/v2/security_monitoring/content_packs/states | | app.ddog-gov.com | GET https://api.ddog-gov.com/api/v2/security_monitoring/content_packs/states | | us2.ddog-gov.com | GET https://api.us2.ddog-gov.com/api/v2/security_monitoring/content_packs/states | ### Overview Récupérer les états d'activation et de configuration de tous les packs de contenu de surveillance de la sécurité. Cet endpoint renvoie des informations de statut sur chaque pack de contenu, notamment l'état d'activation, le statut d'intégration et le statut de collecte des logs. This endpoint requires any of the following permissions: - `security_monitoring_filters_read` - `logs_read_index_data` OAuth apps require the `security_monitoring_filters_read` authorization [scope](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/fr/api/latest/scopes.md#security-monitoring) to access this endpoint. ### Response {% tabs %} {% tab label="200" %} OK {% tabs %} {% tab label="Model" %} Response containing content pack states. | Parent field | Field | Type | Description | | -------------------- | ----------------------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | data [*required*] | [object] | Array of content pack states. | | data | attributes [*required*] | object | Attributes of a content pack state. | | attributes | details [*required*] | | Type-specific details for a content pack state. The set of fields present depends on the content pack's `type`. When Cloud SIEM is inactive for the requesting organization, `onboarding` is returned instead of the content pack's usual type, such as `logs` or `vulnerability`.` | | details | | object | Details for a logs-based content pack. | | | cp_activation [*required*] | enum | The activation status of a content pack. Allowed enum values: `never_activated`, `activated`, `deactivated`. | | | data_last_seen [*required*] | enum | Timestamp bucket indicating when logs were last collected. Allowed enum values: `not_seen`, `within_24_hours`, `within_24_to_72_hours`, `over_72h_to_30d`, `over_30d`. | | | filters_configured [*required*] | boolean | Whether filters (Security Filters or Index Query depending on the pricing model) are present and correctly configured to route logs into Cloud SIEM. | | | integration_installed_status [*required*] | enum | The installation status of the related integration. Allowed enum values: `installed`, `available`, `partially_installed`, `detected`, `error`. | | | logs_seen_from_any_index [*required*] | boolean | Whether logs for this content pack have been seen in any Datadog index in the last 72 hours. | | | siem_index_incorrect [*required*] | boolean | Whether the Cloud SIEM index configuration is incorrect (only applies to certain pricing models). | | | type [*required*] | enum | The filtered data type. Allowed enum values: `logs`. | | details | | object | Details for a threat intelligence content pack. | | | cp_activation [*required*] | enum | The activation status of a content pack. Allowed enum values: `never_activated`, `activated`, `deactivated`. | | | data_last_seen [*required*] | enum | Timestamp bucket indicating when logs were last collected. Allowed enum values: `not_seen`, `within_24_hours`, `within_24_to_72_hours`, `over_72h_to_30d`, `over_30d`. | | | integration_installed_status [*required*] | enum | The installation status of the related integration. Allowed enum values: `installed`, `available`, `partially_installed`, `detected`, `error`. | | | type [*required*] | enum | Type for threat intelligence content pack details. Allowed enum values: `threat_intel`. | | details | | object | Details for an entity or identity content pack. | | | cp_activation [*required*] | enum | The activation status of a content pack. Allowed enum values: `never_activated`, `activated`, `deactivated`. | | | type [*required*] | enum | Type for entity content pack details. Allowed enum values: `entity`. | | details | | object | Details for an audit trail content pack. | | | type [*required*] | enum | Type for audit trail content pack details. Allowed enum values: `audit`. | | details | | object | Details for an Application Security content pack. | | | type [*required*] | enum | Type for Application Security content pack details. Allowed enum values: `appsec`. | | details | | object | Details for a vulnerability content pack. | | | cp_activation [*required*] | enum | The activation status of a content pack. Allowed enum values: `never_activated`, `activated`, `deactivated`. | | | data_last_seen [*required*] | enum | Timestamp bucket indicating when logs were last collected. Allowed enum values: `not_seen`, `within_24_hours`, `within_24_to_72_hours`, `over_72h_to_30d`, `over_30d`. | | | integration_installed_status [*required*] | enum | The installation status of the related integration. Allowed enum values: `installed`, `available`, `partially_installed`, `detected`, `error`. | | | type [*required*] | enum | Type for vulnerability content pack details. Allowed enum values: `vulnerability`. | | details | | object | Content pack details returned when Cloud SIEM is inactive for the requesting organization. | | | integration_installed_status | enum | The installation status of the related integration. Allowed enum values: `installed`, `available`, `partially_installed`, `detected`, `error`. | | | logs_seen_from_any_index [*required*] | boolean | Whether logs for this content pack have been seen in any Datadog index in the last 72 hours. | | | type [*required*] | enum | Type for onboarding content pack details. Allowed enum values: `onboarding`. | | attributes | status [*required*] | enum | The current operational status of a content pack. Allowed enum values: `install`, `activate`, `initializing`, `active`, `warning`, `broken`, `not_configured`. | | data | id [*required*] | string | The content pack identifier. | | data | type [*required*] | enum | Type for content pack state object Allowed enum values: `content_pack_state`. | | | meta [*required*] | object | Metadata for content pack states. | | meta | cloud_siem_index_incorrect [*required*] | boolean | Whether the Cloud SIEM index configuration is incorrect for the organization. | | meta | retention_months | int32 | The number of months that standard logs are retained for organizations on the standalone_indexed` pricing model. This field is omitted for other pricing models. | | meta | sku [*required*] | enum | The Cloud SIEM pricing model (SKU) for the organization. Allowed enum values: `per_gb_analyzed`, `per_event_in_siem_index_2023`, `add_on_2024`, `standalone_indexed`, `unknown`. | {% /tab %} {% tab label="Example" %} ```json { "data": [ { "attributes": { "details": { "cp_activation": "activated", "data_last_seen": "within_24_hours", "filters_configured": true, "integration_installed_status": "installed", "logs_seen_from_any_index": true, "siem_index_incorrect": false, "type": "logs" }, "status": "active" }, "id": "aws-cloudtrail", "type": "content_pack_state" } ], "meta": { "cloud_siem_index_incorrect": false, "retention_months": 15, "sku": "add_on_2024" } } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="403" %} Forbidden {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="404" %} Not Found {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="429" %} Too many requests {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% /tabs %} ### Code Example {% tabs %} {% tab label="Curl" %} ```bash # Set your Datadog site and credentials export DD_SITE="datadoghq.com" # Or us3.datadoghq.com, us5.datadoghq.com, datadoghq.eu, ap1.datadoghq.com, ap2.datadoghq.com, uk1.datadoghq.com, ddog-gov.com, us2.ddog-gov.com # Use a Personal Access Token or Service Access Token export DD_BEARER_TOKEN="" curl -X GET "https://api.${DD_SITE}/api/v2/security_monitoring/content_packs/states" \ -H "Accept: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" ``` {% /tab %} {% tab label="Go" %} ```go // Get content pack states returns "OK" response package main import ( "context" "encoding/json" "fmt" "os" "github.com/DataDog/datadog-api-client-go/v2/api/datadog" "github.com/DataDog/datadog-api-client-go/v2/api/datadogV2" ) func main() { ctx := datadog.NewDefaultContext(context.Background()) ctx = context.WithValue(ctx, datadog.ContextAccessToken, os.Getenv("DD_BEARER_TOKEN")) configuration := datadog.NewConfiguration() configuration.SetUnstableOperationEnabled("v2.GetContentPacksStates", true) apiClient := datadog.NewAPIClient(configuration) api := datadogV2.NewSecurityMonitoringApi(apiClient) resp, r, err := api.GetContentPacksStates(ctx) if err != nil { fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.GetContentPacksStates`: %v\n", err) fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) } responseContent, _ := json.MarshalIndent(resp, "", " ") fmt.Fprintf(os.Stdout, "Response from `SecurityMonitoringApi.GetContentPacksStates`:\n%s\n", responseContent) } ``` #### Instructions First [install the library and its dependencies](https://dnd37xeb23o8n.cloudfront.net/api/latest.md?code-lang=go) and then save the example to `main.go` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" go run "main.go" ``` {% /tab %} {% tab label="Java" %} ```java // Get content pack states returns "OK" response import com.datadog.api.client.ApiClient; import com.datadog.api.client.ApiException; import com.datadog.api.client.v2.api.SecurityMonitoringApi; import com.datadog.api.client.v2.model.SecurityMonitoringContentPackStatesResponse; public class Example { public static void main(String[] args) { ApiClient defaultClient = ApiClient.getDefaultApiClient(); defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN")); defaultClient.setUnstableOperationEnabled("v2.getContentPacksStates", true); SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient); try { SecurityMonitoringContentPackStatesResponse result = apiInstance.getContentPacksStates(); System.out.println(result); } catch (ApiException e) { System.err.println("Exception when calling SecurityMonitoringApi#getContentPacksStates"); System.err.println("Status code: " + e.getCode()); System.err.println("Reason: " + e.getResponseBody()); System.err.println("Response headers: " + e.getResponseHeaders()); e.printStackTrace(); } } } ``` #### Instructions First [install the library and its dependencies](https://dnd37xeb23o8n.cloudfront.net/api/latest.md?code-lang=java) and then save the example to `Example.java` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" java "Example.java" ``` {% /tab %} {% tab label="Python" %} ```python """ Get content pack states returns "OK" response """ from os import environ from datadog_api_client import ApiClient, Configuration from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi configuration = Configuration() configuration.access_token = environ["DD_BEARER_TOKEN"] configuration.unstable_operations["get_content_packs_states"] = True with ApiClient(configuration) as api_client: api_instance = SecurityMonitoringApi(api_client) response = api_instance.get_content_packs_states() print(response) ``` #### Instructions First [install the library and its dependencies](https://dnd37xeb23o8n.cloudfront.net/api/latest.md?code-lang=python) and then save the example to `example.py` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" python3 "example.py" ``` {% /tab %} {% tab label="Ruby" %} ```ruby # Get content pack states returns "OK" response require "datadog_api_client" DatadogAPIClient.configure do |config| config.access_token = ENV["DD_BEARER_TOKEN"] config.unstable_operations["v2.get_content_packs_states".to_sym] = true end api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new p api_instance.get_content_packs_states() ``` #### Instructions First [install the library and its dependencies](https://dnd37xeb23o8n.cloudfront.net/api/latest.md?code-lang=ruby) and then save the example to `example.rb` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" rb "example.rb" ``` {% /tab %} {% tab label="Rust" %} ```rust // Get content pack states returns "OK" response use datadog_api_client::datadog; use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI; #[tokio::main] async fn main() { let mut configuration = datadog::Configuration::new(); configuration.set_unstable_operation_enabled("v2.get_content_packs_states", true); let api = SecurityMonitoringAPI::with_config(configuration); let resp = api.get_content_packs_states().await; if let Ok(value) = resp { println!("{:#?}", value); } else { println!("{:#?}", resp.unwrap_err()); } } ``` #### Instructions First [install the library and its dependencies](https://dnd37xeb23o8n.cloudfront.net/api/latest.md?code-lang=rust) and then save the example to `src/main.rs` and run following commands: ```bash DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" cargo run ``` {% /tab %} {% tab label="TypeScript" %} ```typescript /** * Get content pack states returns "OK" response */ import { client, v2 } from "@datadog/datadog-api-client"; const configuration = client.createConfiguration({ authMethods: { AuthZ: { accessToken: process.env.DD_BEARER_TOKEN as string, }, }, }); configuration.unstableOperations["v2.getContentPacksStates"] = true; const apiInstance = new v2.SecurityMonitoringApi(configuration); apiInstance .getContentPacksStates() .then((data: v2.SecurityMonitoringContentPackStatesResponse) => { console.log( "API called successfully. Returned data: " + JSON.stringify(data) ); }) .catch((error: any) => console.error(error)); ``` #### Instructions First [install the library and its dependencies](https://dnd37xeb23o8n.cloudfront.net/api/latest.md?code-lang=typescript) and then save the example to `example.ts` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" tsc "example.ts" ``` {% /tab %} {% /tabs %}