---
title: "Get content pack states"
method: GET
path: "/api/v2/security_monitoring/content_packs/states"
tags: ["Security Monitoring"]
---

# Get content pack states

`GET /api/v2/security_monitoring/content_packs/states`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security_monitoring/content_packs/states`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `security_monitoring_filters_read`

Get the activation state, integration status, and log collection status
for all Cloud SIEM content packs.

## Response `200`

OK

- SecurityMonitoringContentPackStatesResponse: Response containing content pack states.
  - `data` SecurityMonitoringContentPackStateData[], required: Array of content pack states.
    - `attributes` SecurityMonitoringContentPackStateAttributes, required: Attributes of a content pack state
      - `cloud_siem_index_incorrect` boolean, required: Whether the cloud SIEM index configuration is incorrect (only applies to certain pricing models)
      - `cp_activation` 'never_activated' | 'activated' | 'deactivated', required: The activation status of a content pack.
      - `filters_configured_for_logs` boolean, required: Whether filters (Security Filters or Index Query depending on the pricing model) are present and correctly configured to route logs into Cloud SIEM.
      - `integration_installed_status` 'installed' | 'available' | 'partially_installed' | 'detected' | 'error': The installation status of the related integration.
      - `logs_last_collected` 'not_seen' | 'within_24_hours' | 'within_24_to_72_hours' | 'over_72h_to_30d' | 'over_30d', required: Timestamp bucket indicating when logs were last collected.
      - `logs_seen_from_any_index` boolean, required: Whether logs for this content pack have been seen in any Datadog index within the last 72 hours.
      - `state` 'install' | 'activate' | 'initializing' | 'active' | 'warning' | 'broken', required: The current operational status of a content pack.
    - `id` string, required: The content pack identifier.
    - `type` 'content_pack_state', required: Type for content pack state object
  - `meta` SecurityMonitoringContentPackStateMeta, required: Metadata for content pack states
    - `cloud_siem_index_incorrect` boolean, required: Whether the cloud SIEM index configuration is incorrect at the organization level
    - `sku` 'per_gb_analyzed' | 'per_event_in_siem_index_2023' | 'add_on_2024', required: The Cloud SIEM pricing model (SKU) for the organization.

## Other responses

- `403`: Forbidden
- `404`: Not Found
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)