@@ -87240,6 +87240,38 @@ components:
8724087240 x-enum-varnames:
8724187241 - DONE
8724287242 - TIMEOUT
87243+ SecurityMonitoringAzureAppRegistration:
87244+ description: An Azure App Registration discovered for the organization.
87245+ properties:
87246+ client_id:
87247+ description: The client ID of the App Registration.
87248+ example: 66666666-7777-8888-9999-000000000000
87249+ type: string
87250+ error_count:
87251+ description: The number of errors encountered while crawling resources for this App Registration.
87252+ example: 0
87253+ format: int64
87254+ type: integer
87255+ resource_collection_enabled:
87256+ description: Whether resource collection is enabled for this App Registration.
87257+ example: true
87258+ type: boolean
87259+ subscription_count:
87260+ description: The number of Azure subscriptions associated with this App Registration.
87261+ example: 3
87262+ format: int64
87263+ type: integer
87264+ tenant_id:
87265+ description: The Azure tenant ID of the App Registration.
87266+ example: 11111111-2222-3333-4444-555555555555
87267+ type: string
87268+ required:
87269+ - tenant_id
87270+ - client_id
87271+ - resource_collection_enabled
87272+ - subscription_count
87273+ - error_count
87274+ type: object
8724387275 SecurityMonitoringContentPackActivation:
8724487276 description: The activation status of a content pack.
8724587277 enum:
@@ -88135,6 +88167,68 @@ components:
8813588167 (for example, `siem_entity_identity` for identities). Defaults to `entity` when the kind is unknown.
8813688168 example: siem_entity_identity
8813788169 type: string
88170+ SecurityMonitoringEntraIdAzureAppRegistrationsAttributes:
88171+ description: The attributes of the Entra ID Azure App Registration prerequisites.
88172+ properties:
88173+ azure_app_registrations:
88174+ description: The Azure App Registrations discovered for the organization.
88175+ items:
88176+ $ref: "#/components/schemas/SecurityMonitoringAzureAppRegistration"
88177+ type: array
88178+ has_valid_prerequisite:
88179+ description: Whether at least one Azure App Registration has resource collection enabled.
88180+ example: true
88181+ type: boolean
88182+ integration_id:
88183+ description: The ID of the Entra ID integration configuration, if one exists.
88184+ example: 11111111-2222-3333-4444-555555555555
88185+ type: string
88186+ is_enabled:
88187+ description: Whether the Entra ID integration configuration is enabled, if one exists.
88188+ example: true
88189+ type: boolean
88190+ subscribed_at:
88191+ description: The time at which the Entra ID integration configuration was created, if one exists.
88192+ example: "2026-05-01T12:00:00Z"
88193+ format: date-time
88194+ type: string
88195+ required:
88196+ - azure_app_registrations
88197+ - has_valid_prerequisite
88198+ type: object
88199+ SecurityMonitoringEntraIdAzureAppRegistrationsData:
88200+ description: The Azure App Registration prerequisites for the Entra ID integration.
88201+ properties:
88202+ attributes:
88203+ $ref: "#/components/schemas/SecurityMonitoringEntraIdAzureAppRegistrationsAttributes"
88204+ id:
88205+ description: The ID of the organization the Azure App Registrations belong to.
88206+ example: "123456"
88207+ type: string
88208+ type:
88209+ $ref: "#/components/schemas/SecurityMonitoringEntraIdAzureAppRegistrationsResourceType"
88210+ required:
88211+ - id
88212+ - type
88213+ - attributes
88214+ type: object
88215+ SecurityMonitoringEntraIdAzureAppRegistrationsResourceType:
88216+ default: entra_id_azure_app_registrations
88217+ description: The type of the resource. The value should always be `entra_id_azure_app_registrations`.
88218+ enum:
88219+ - entra_id_azure_app_registrations
88220+ example: entra_id_azure_app_registrations
88221+ type: string
88222+ x-enum-varnames:
88223+ - ENTRA_ID_AZURE_APP_REGISTRATIONS
88224+ SecurityMonitoringEntraIdAzureAppRegistrationsResponse:
88225+ description: Response containing the Azure App Registration prerequisites for the Entra ID integration.
88226+ properties:
88227+ data:
88228+ $ref: "#/components/schemas/SecurityMonitoringEntraIdAzureAppRegistrationsData"
88229+ required:
88230+ - data
88231+ type: object
8813888232 SecurityMonitoringFilter:
8813988233 description: The rule's suppression filter.
8814088234 properties:
@@ -88153,6 +88247,43 @@ components:
8815388247 x-enum-varnames:
8815488248 - REQUIRE
8815588249 - SUPPRESS
88250+ SecurityMonitoringIntegrationActivateAttributes:
88251+ description: Overrides applied when activating the integration. All fields are optional.
88252+ properties:
88253+ domain:
88254+ description: The domain associated with the external entity source.
88255+ example: default
88256+ type: string
88257+ name:
88258+ description: The display name for the entity context sync configuration.
88259+ example: My Entra ID Integration
88260+ type: string
88261+ settings:
88262+ $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigSettings"
88263+ type: object
88264+ SecurityMonitoringIntegrationActivateData:
88265+ description: The configuration overrides for the integration to activate.
88266+ properties:
88267+ attributes:
88268+ $ref: "#/components/schemas/SecurityMonitoringIntegrationActivateAttributes"
88269+ type:
88270+ $ref: "#/components/schemas/SecurityMonitoringIntegrationActivateResourceType"
88271+ type: object
88272+ SecurityMonitoringIntegrationActivateRequest:
88273+ description: Request body to activate an entity context sync integration for a source type that does not require secrets.
88274+ properties:
88275+ data:
88276+ $ref: "#/components/schemas/SecurityMonitoringIntegrationActivateData"
88277+ type: object
88278+ SecurityMonitoringIntegrationActivateResourceType:
88279+ default: activate_entra_id_request
88280+ description: The type of the resource. The value should always be `activate_entra_id_request`.
88281+ enum:
88282+ - activate_entra_id_request
88283+ example: activate_entra_id_request
88284+ type: string
88285+ x-enum-varnames:
88286+ - ACTIVATE_ENTRA_ID_REQUEST
8815688287 SecurityMonitoringIntegrationConfigAttributes:
8815788288 description: The attributes of an entity context sync configuration as returned by the API.
8815888289 properties:
@@ -88210,7 +88341,6 @@ components:
8821088341 - integration_type
8821188342 - domain
8821288343 - name
88213- - secrets
8821488344 type: object
8821588345 SecurityMonitoringIntegrationConfigCreateData:
8821688346 description: The entity context sync configuration to create.
@@ -88266,7 +88396,9 @@ components:
8826688396 type: object
8826788397 SecurityMonitoringIntegrationConfigSecrets:
8826888398 additionalProperties: {}
88269- description: The secrets used to authenticate against the external entity source. The accepted keys depend on the source type (for example, `admin_email` for Google Workspace).
88399+ description: |-
88400+ The secrets used to authenticate against the external entity source. The accepted keys depend on the source type
88401+ (for example, `admin_email` for Google Workspace). Not required for source types that do not use secrets (for example, `ENTRA_ID`).
8827088402 example:
8827188403 admin_email: test@example.com
8827288404 type: object
@@ -88354,7 +88486,6 @@ components:
8835488486 required:
8835588487 - integration_type
8835688488 - domain
88357- - secrets
8835888489 type: object
8835988490 SecurityMonitoringIntegrationCredentialsValidateData:
8836088491 description: The credentials to validate.
@@ -178068,6 +178199,54 @@ paths:
178068178199 x-unstable: |-
178069178200 **Note**: This endpoint is in preview and is subject to change.
178070178201 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
178202+ /api/v2/security_monitoring/configuration/integration_config/entra_id/azure_app_registrations:
178203+ get:
178204+ description: |-
178205+ Get the Azure App Registrations discovered for the organization and whether at least one of them has
178206+ resource collection enabled, which is a prerequisite for activating the Entra ID entity context sync integration.
178207+ operationId: GetEntraIdAzureAppRegistrations
178208+ responses:
178209+ "200":
178210+ content:
178211+ application/json:
178212+ examples:
178213+ default:
178214+ value:
178215+ data:
178216+ attributes:
178217+ azure_app_registrations:
178218+ - client_id: 66666666-7777-8888-9999-000000000000
178219+ error_count: 0
178220+ resource_collection_enabled: true
178221+ subscription_count: 3
178222+ tenant_id: 11111111-2222-3333-4444-555555555555
178223+ has_valid_prerequisite: true
178224+ integration_id: 11111111-2222-3333-4444-555555555555
178225+ is_enabled: true
178226+ subscribed_at: "2026-05-01T12:00:00Z"
178227+ id: "123456"
178228+ type: entra_id_azure_app_registrations
178229+ schema:
178230+ $ref: "#/components/schemas/SecurityMonitoringEntraIdAzureAppRegistrationsResponse"
178231+ description: OK
178232+ "403":
178233+ $ref: "#/components/responses/NotAuthorizedResponse"
178234+ "429":
178235+ $ref: "#/components/responses/TooManyRequestsResponse"
178236+ security:
178237+ - apiKeyAuth: []
178238+ appKeyAuth: []
178239+ - AuthZ:
178240+ - integrations_read
178241+ summary: Get Entra ID Azure App Registration prerequisites
178242+ tags: ["Security Monitoring"]
178243+ x-permission:
178244+ operator: OR
178245+ permissions:
178246+ - integrations_read
178247+ x-unstable: |-
178248+ **Note**: This endpoint is in preview and is subject to change.
178249+ If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
178071178250 /api/v2/security_monitoring/configuration/integration_config/validate:
178072178251 post:
178073178252 description: |-
@@ -178293,6 +178472,132 @@ paths:
178293178472 x-unstable: |-
178294178473 **Note**: This endpoint is in preview and is subject to change.
178295178474 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
178475+ /api/v2/security_monitoring/configuration/integration_config/{integration_type}/activate:
178476+ post:
178477+ description: |-
178478+ Activate an entity context sync integration for a source type that does not require manually
178479+ supplied credentials (for example, Entra ID). If an integration of this type already exists,
178480+ it is returned (re-enabling it first if it was disabled) instead of creating a duplicate.
178481+ operationId: ActivateIntegration
178482+ parameters:
178483+ - description: The integration type to activate (for example, `entra_id`).
178484+ in: path
178485+ name: integration_type
178486+ required: true
178487+ schema:
178488+ example: entra_id
178489+ type: string
178490+ requestBody:
178491+ content:
178492+ application/json:
178493+ examples:
178494+ default:
178495+ value:
178496+ data:
178497+ attributes:
178498+ name: My Entra ID Integration
178499+ type: activate_entra_id_request
178500+ schema:
178501+ $ref: "#/components/schemas/SecurityMonitoringIntegrationActivateRequest"
178502+ description: Optional configuration overrides for the integration to activate.
178503+ required: false
178504+ responses:
178505+ "200":
178506+ content:
178507+ application/json:
178508+ examples:
178509+ default:
178510+ value:
178511+ data:
178512+ attributes:
178513+ created_at: "2026-05-01T12:00:00Z"
178514+ domain: default
178515+ enabled: true
178516+ integration_type: ENTRA_ID
178517+ modified_at: "2026-05-01T12:00:00Z"
178518+ name: My Entra ID Integration
178519+ state: valid
178520+ id: 11111111-2222-3333-4444-555555555555
178521+ type: integration_config
178522+ schema:
178523+ $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigResponse"
178524+ description: OK
178525+ "400":
178526+ $ref: "#/components/responses/BadRequestResponse"
178527+ "403":
178528+ $ref: "#/components/responses/NotAuthorizedResponse"
178529+ "404":
178530+ $ref: "#/components/responses/NotFoundResponse"
178531+ "429":
178532+ $ref: "#/components/responses/TooManyRequestsResponse"
178533+ security:
178534+ - apiKeyAuth: []
178535+ appKeyAuth: []
178536+ - AuthZ:
178537+ - manage_integrations
178538+ summary: Activate an entity context sync integration
178539+ tags: ["Security Monitoring"]
178540+ x-codegen-request-body-name: body
178541+ x-permission:
178542+ operator: OR
178543+ permissions:
178544+ - manage_integrations
178545+ x-unstable: |-
178546+ **Note**: This endpoint is in preview and is subject to change.
178547+ If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
178548+ /api/v2/security_monitoring/configuration/integration_config/{integration_type}/deactivate:
178549+ post:
178550+ description: Deactivate all active entity context sync integrations of the given source type (for example, Entra ID).
178551+ operationId: DeactivateIntegration
178552+ parameters:
178553+ - description: The integration type to deactivate (for example, `entra_id`).
178554+ in: path
178555+ name: integration_type
178556+ required: true
178557+ schema:
178558+ example: entra_id
178559+ type: string
178560+ responses:
178561+ "200":
178562+ content:
178563+ application/json:
178564+ examples:
178565+ default:
178566+ value:
178567+ data:
178568+ attributes:
178569+ created_at: "2026-05-01T12:00:00Z"
178570+ domain: default
178571+ enabled: false
178572+ integration_type: ENTRA_ID
178573+ modified_at: "2026-05-08T12:00:00Z"
178574+ name: My Entra ID Integration
178575+ state: valid
178576+ id: 11111111-2222-3333-4444-555555555555
178577+ type: integration_config
178578+ schema:
178579+ $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigResponse"
178580+ description: OK
178581+ "403":
178582+ $ref: "#/components/responses/NotAuthorizedResponse"
178583+ "404":
178584+ $ref: "#/components/responses/NotFoundResponse"
178585+ "429":
178586+ $ref: "#/components/responses/TooManyRequestsResponse"
178587+ security:
178588+ - apiKeyAuth: []
178589+ appKeyAuth: []
178590+ - AuthZ:
178591+ - manage_integrations
178592+ summary: Deactivate an entity context sync integration
178593+ tags: ["Security Monitoring"]
178594+ x-permission:
178595+ operator: OR
178596+ permissions:
178597+ - manage_integrations
178598+ x-unstable: |-
178599+ **Note**: This endpoint is in preview and is subject to change.
178600+ If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
178296178601 /api/v2/security_monitoring/configuration/notification_rules/send_notification_preview:
178297178602 post:
178298178603 description: Send a notification preview to test that a notification rule's targets are properly configured.
0 commit comments