DAdatadog
Security Monitoring

Subscribe to sample log generation

Subscribe to sample log generation for a Cloud SIEM content pack. Sample logs for the requested content pack are injected into the Logs platform for the duration of the subscription, so detection rules can be exercised without onboarding the underlying integration first.

Availability: this endpoint is restricted to Cloud SIEM trial organizations on an eligible pricing model. Non-trial orgs receive 403 Forbidden, the feature flag may also reject requests with 400 Bad Request, and legacy pricing tiers receive a response with status: not_available.

post/api/v2/security_monitoring/sample_log_generation/subscriptions

Request

  • Base URL
    https://api.datadoghq.com
  • URL
    https://api.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptions
  • Auth
    • API key in header DD-API-KEY and API key in header DD-APPLICATION-KEY
    • or OAuth 2
      Authorization code: /oauth2/v1/authorize
      Token URL: /oauth2/v1/token scopes: security_monitoring_filters_write, logs_modify_indexes

Request body

Example request

{
  "data": {
    "attributes": {
      "content_pack_id": "aws-cloudtrail",
      "duration": "3d"
    },
    "type": "subscription_requests"
  }
}

Response

OK

Example response

{
  "data": {
    "attributes": {
      "content_pack_id": "aws-cloudtrail",
      "created_at": "2026-05-08T20:02:13.77481Z",
      "expires_at": "2026-05-11T20:02:13.77481Z",
      "is_active": true,
      "status": "subscribed"
    },
    "id": "789",
    "type": "subscriptions"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.