---
title: "Get content pack states"
method: GET
path: "/api/v2/security_monitoring/content_packs/states"
tags: ["Security Monitoring"]
---

# Get content pack states

`GET /api/v2/security_monitoring/content_packs/states`

Get the activation state, integration status, and log collection status
for all Cloud SIEM content packs.

## Response `200`

OK

- SecurityMonitoringContentPackStatesResponse — Response containing content pack states.
  - `data` SecurityMonitoringContentPackStateData[], required — Array of content pack states.
    - `attributes` SecurityMonitoringContentPackStateAttributes, required — Attributes of a content pack state
      - `cloud_siem_index_incorrect` boolean, required — Whether the cloud SIEM index configuration is incorrect (only applies to certain pricing models)
      - `cp_activation` 'never_activated' | 'activated' | 'deactivated', required — The activation status of a content pack.
      - `filters_configured_for_logs` boolean, required — Whether filters (Security Filters or Index Query depending on the pricing model) are present and correctly configured to route logs into Cloud SIEM.
      - `integration_installed_status` 'installed' | 'available' | 'partially_installed' | 'detected' | 'error' — The installation status of the related integration.
      - `logs_last_collected` 'not_seen' | 'within_24_hours' | 'within_24_to_72_hours' | 'over_72h_to_30d' | 'over_30d', required — Timestamp bucket indicating when logs were last collected.
      - `logs_seen_from_any_index` boolean, required — Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
      - `state` 'install' | 'activate' | 'initializing' | 'active' | 'warning' | 'broken', required — The current operational status of a content pack.
    - `id` string, required — The content pack identifier.
    - `type` 'content_pack_state', required — Type for content pack state object
  - `meta` SecurityMonitoringContentPackStateMeta, required — Metadata for content pack states
    - `cloud_siem_index_incorrect` boolean, required — Whether the cloud SIEM index configuration is incorrect at the organization level
    - `sku` 'per_gb_analyzed' | 'per_event_in_siem_index_2023' | 'add_on_2024', required — The Cloud SIEM pricing model (SKU) for the organization.

## Other responses

- `403` — Forbidden
- `404` — Not Found
- `429` — Too many requests

---

[API](https://skmtc.dev/datadog/apis/api-v2.md) · [All operations](https://skmtc.dev/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)