v1

latestOpenAPI 3.0.02026-07-141,4077,1665.2 MB

Security Monitoring

Get sample log generation subscriptions

Get the sample log generation subscriptions for the organization. Sample log generation injects representative example logs for a given Cloud SIEM content pack into the Logs platform, which can be used to test detection rules without onboarding the underlying integration first.

Availability: this endpoint is restricted to Cloud SIEM trial organizations on an eligible pricing model. Other organizations receive a 403 Forbidden (non-trial orgs) or a 400 Bad Request (feature disabled), and legacy pricing tiers receive a response with status: not_available.

get/api/v2/security_monitoring/sample_log_generation/subscriptions

Query parameters

status'active' | 'all'

Filter that controls whether to return only active subscriptions or every subscription on record.

Example:active

Filter the subscriptions by status. Use active to return only currently active subscriptions, or all to return every subscription including expired ones. Ignored when start_timestamp is provided. Defaults to active.

start_timestampstring date-time

The start of the time range, as an RFC3339 timestamp. When provided, the response includes every subscription that was active at any point in [start_timestamp, end_timestamp], and the status filter is ignored.

end_timestampstring date-time

The end of the time range, as an RFC3339 timestamp. Ignored unless start_timestamp is set. Defaults to the current time when start_timestamp is provided.

Response

Example response

{
  "data": [
    {
      "attributes": {
        "content_pack_id": "aws-cloudtrail",
        "created_at": "2026-05-08T20:02:13.77481Z",
        "expires_at": "2026-05-11T20:02:13.77481Z",
        "is_active": true,
        "status": "subscribed"
      },
      "id": "789",
      "type": "subscriptions"
    }
  ],
  "meta": {
    "total_subscriptions": 1
  }
}