---
title: "Subscribe to sample log generation"
method: POST
path: "/api/v2/security_monitoring/sample_log_generation/subscriptions"
tags: ["Security Monitoring"]
---

# Subscribe to sample log generation

`POST /api/v2/security_monitoring/sample_log_generation/subscriptions`

Subscribe to sample log generation for a Cloud SIEM content pack. Sample logs for the
requested content pack are injected into the Logs platform for the duration of the subscription,
so detection rules can be exercised without onboarding the underlying integration first.

**Availability**: this endpoint is restricted to Cloud SIEM trial organizations on an
eligible pricing model. Non-trial orgs receive `403 Forbidden`, the feature flag may also reject
requests with `400 Bad Request`, and legacy pricing tiers receive a response with `status: not_available`.

## Request body

- SampleLogGenerationSubscriptionCreateRequest — Request body to create a sample log generation subscription for a single content pack.
  - `data` SampleLogGenerationSubscriptionCreateData, required — The subscription request body.
    - `attributes` SampleLogGenerationSubscriptionCreateAttributes, required — The attributes for creating a sample log generation subscription.
      - `content_pack_id` string, required — The identifier of the Cloud SIEM content pack to subscribe to.
      - `duration` '1h' | '1d' | '3d' | '7d' — How long the subscription should remain active before expiring.
    - `type` 'subscription_requests', required — The type of the resource. The value should always be `subscription_requests`.

## Response `200`

OK

- SampleLogGenerationSubscriptionResponse — Response containing a single sample log generation subscription.
  - `data` SampleLogGenerationSubscriptionData, required — A sample log generation subscription.
    - `attributes` SampleLogGenerationSubscriptionAttributes, required — The attributes describing a sample log generation subscription.
      - `content_pack_id` string, required — The identifier of the Cloud SIEM content pack the subscription targets.
      - `created_at` string, date-time, required — The time at which the subscription was created.
      - `expires_at` string, date-time, required — The time at which the subscription expires and stops generating logs.
      - `is_active` boolean, required — Whether the subscription is currently active and generating logs.
      - `status` 'subscribed' | 'renewed' | 'unsubscribed' | 'no_active_subscription' | 'not_available' | 'active' | 'expired', required — The status of the subscription.
    - `id` string, required — The unique identifier of the subscription.
    - `type` 'subscriptions', required — The type of the resource. The value should always be `subscriptions`.

## Other responses

- `400` — Bad Request
- `403` — Not Authorized
- `429` — Too many requests

---

[API](https://skmtc.dev/datadog/apis/api-v2.md) · [All operations](https://skmtc.dev/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)