monitoring_content_packs
Creates, updates, deletes, gets or lists a monitoring_content_packs resource.
Overview
| Name | monitoring_content_packs |
| Type | Resource |
| Id | datadog.security.monitoring_content_packs |
Fields
The following fields are returned by SELECT queries:
SELECT not supported for this resource, use SHOW METHODS to view available operations for the resource.
Methods
The following methods are available for this resource:
| Name | Accessible by | Required Params | Optional Params | Description |
|---|---|---|---|---|
activate_content_pack | exec | content_pack_id | Activate a Cloud SIEM content pack. This operation configures the necessary<br />log filters or security filters depending on the pricing model and updates the content<br />pack activation state. | |
deactivate_content_pack | exec | content_pack_id | Deactivate a Cloud SIEM content pack. This operation removes the content pack's<br />configuration from log filters or security filters and updates the content pack activation state. |
Parameters
Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.
| Name | Datatype | Description |
|---|---|---|
content_pack_id | string | The ID of the content pack to deactivate (for example, aws-cloudtrail). |
site | string | The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both. |
Lifecycle Methods
EXEC variables use wire (API) names.
- activate_content_pack
- deactivate_content_pack
Activate a Cloud SIEM content pack. This operation configures the necessary<br />log filters or security filters depending on the pricing model and updates the content<br />pack activation state.
EXEC datadog.security.monitoring_content_packs.activate_content_pack
@content_pack_id='{{ content_pack_id }}' --required
;
Deactivate a Cloud SIEM content pack. This operation removes the content pack's<br />configuration from log filters or security filters and updates the content pack activation state.
EXEC datadog.security.monitoring_content_packs.deactivate_content_pack
@content_pack_id='{{ content_pack_id }}' --required
;