monitoring_sample_log_generation_subscriptions
Creates, updates, deletes, gets or lists a monitoring_sample_log_generation_subscriptions resource.
Overview
| Name | monitoring_sample_log_generation_subscriptions |
| Type | Resource |
| Id | datadog.security.monitoring_sample_log_generation_subscriptions |
Fields
The following fields are returned by SELECT queries:
- list_sample_log_generation_subscriptions
| Name | Datatype | Description |
|---|---|---|
id | string | The unique identifier of the subscription. (example: 789) |
attributes | object | The attributes describing a sample log generation subscription. |
type | string | The type of the resource. The value should always be subscriptions. (subscriptions) (default: subscriptions, example: subscriptions) |
Methods
The following methods are available for this resource:
| Name | Accessible by | Required Params | Optional Params | Description |
|---|---|---|---|---|
list_sample_log_generation_subscriptions | select | status, start_timestamp, end_timestamp | Get the sample log generation subscriptions for the organization.<br />Sample log generation injects representative example logs for a given Cloud SIEM content pack into the Logs platform,<br />which can be used to test detection rules without onboarding the underlying integration first.<br /><br />Availability: this endpoint is restricted to Cloud SIEM trial organizations on an eligible<br />pricing model. Other organizations receive a 403 Forbidden (non-trial orgs) or a 400 Bad Request<br />(feature disabled), and legacy pricing tiers receive a response with status: not_available. | |
create_sample_log_generation_subscription | insert | data | Subscribe to sample log generation for a Cloud SIEM content pack. Sample logs for the<br />requested content pack are injected into the Logs platform for the duration of the subscription,<br />so detection rules can be exercised without onboarding the underlying integration first.<br /><br />Availability: this endpoint is restricted to Cloud SIEM trial organizations on an<br />eligible pricing model. Non-trial orgs receive 403 Forbidden, the feature flag may also reject<br />requests with 400 Bad Request, and legacy pricing tiers receive a response with status: not_available. | |
delete_sample_log_generation_subscription | delete | content_pack_id | Unsubscribe from sample log generation for a Cloud SIEM content pack.<br />After unsubscribing, no more sample logs are generated for the requested content pack.<br /><br />Availability: this endpoint is restricted to Cloud SIEM trial organizations on an<br />eligible pricing model. Non-trial orgs receive 403 Forbidden, the feature flag may also reject<br />requests with 400 Bad Request, and legacy pricing tiers receive a response with status: not_available. | |
bulk_create_sample_log_generation_subscriptions | exec | data | Subscribe to sample log generation for multiple Cloud SIEM content packs in a single call.<br />Each requested content pack is processed independently; the response includes a per-item<br />status so partial successes can be inspected.<br /><br />Availability: this endpoint is restricted to Cloud SIEM trial organizations on an<br />eligible pricing model. Non-trial orgs receive 403 Forbidden, the feature flag may also reject<br />requests with 400 Bad Request, and legacy pricing tiers receive per-item responses with status: not_available. |
Parameters
Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.
| Name | Datatype | Description |
|---|---|---|
content_pack_id | string | The identifier of the Cloud SIEM content pack to operate on (for example, aws-cloudtrail). |
site | string | The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both. |
end_timestamp | string (date-time) | The end of the time range, as an RFC3339 timestamp. Ignored unless start_timestamp is set. Defaults to the current time when start_timestamp is provided. (example: 2026-05-08T00:00:00Z) |
start_timestamp | string (date-time) | The start of the time range, as an RFC3339 timestamp. When provided, the response includes every subscription that was active at any point in [start_timestamp, end_timestamp], and the status filter is ignored. (example: 2026-05-01T00:00:00Z) |
status | string | Filter the subscriptions by status. Use active to return only currently active subscriptions, or all to return every subscription including expired ones. Ignored when start_timestamp is provided. Defaults to active. |
SELECT examples
- list_sample_log_generation_subscriptions
Get the sample log generation subscriptions for the organization.<br />Sample log generation injects representative example logs for a given Cloud SIEM content pack into the Logs platform,<br />which can be used to test detection rules without onboarding the underlying integration first.<br /><br />Availability: this endpoint is restricted to Cloud SIEM trial organizations on an eligible<br />pricing model. Other organizations receive a 403 Forbidden (non-trial orgs) or a 400 Bad Request<br />(feature disabled), and legacy pricing tiers receive a response with status: not_available.
SELECT
id,
attributes,
type
FROM datadog.security.monitoring_sample_log_generation_subscriptions
WHERE status = '{{ status }}'
AND start_timestamp = '{{ start_timestamp }}'
AND end_timestamp = '{{ end_timestamp }}'
;
INSERT examples
- create_sample_log_generation_subscription
- Manifest
Subscribe to sample log generation for a Cloud SIEM content pack. Sample logs for the<br />requested content pack are injected into the Logs platform for the duration of the subscription,<br />so detection rules can be exercised without onboarding the underlying integration first.<br /><br />Availability: this endpoint is restricted to Cloud SIEM trial organizations on an<br />eligible pricing model. Non-trial orgs receive 403 Forbidden, the feature flag may also reject<br />requests with 400 Bad Request, and legacy pricing tiers receive a response with status: not_available.
INSERT INTO datadog.security.monitoring_sample_log_generation_subscriptions (
data
)
SELECT
'{{ data }}' /* required */
RETURNING
data
;
# Description fields are for documentation purposes
- name: monitoring_sample_log_generation_subscriptions
props:
- name: data
description: |
The subscription request body.
value:
attributes:
content_pack_id: "{{ content_pack_id }}"
duration: "{{ duration }}"
type: "{{ type }}"
DELETE examples
- delete_sample_log_generation_subscription
Unsubscribe from sample log generation for a Cloud SIEM content pack.<br />After unsubscribing, no more sample logs are generated for the requested content pack.<br /><br />Availability: this endpoint is restricted to Cloud SIEM trial organizations on an<br />eligible pricing model. Non-trial orgs receive 403 Forbidden, the feature flag may also reject<br />requests with 400 Bad Request, and legacy pricing tiers receive a response with status: not_available.
DELETE FROM datadog.security.monitoring_sample_log_generation_subscriptions
WHERE content_pack_id = '{{ content_pack_id }}' --required
;
Lifecycle Methods
EXEC variables use wire (API) names.
- bulk_create_sample_log_generation_subscriptions
Subscribe to sample log generation for multiple Cloud SIEM content packs in a single call.<br />Each requested content pack is processed independently; the response includes a per-item<br />status so partial successes can be inspected.<br /><br />Availability: this endpoint is restricted to Cloud SIEM trial organizations on an<br />eligible pricing model. Non-trial orgs receive 403 Forbidden, the feature flag may also reject<br />requests with 400 Bad Request, and legacy pricing tiers receive per-item responses with status: not_available.
EXEC datadog.security.monitoring_sample_log_generation_subscriptions.bulk_create_sample_log_generation_subscriptions
@@json=
'{
"data": "{{ data }}"
}'
;