diff --git a/descriptions/ghec/dereferenced/ghec.2022-11-28.deref.json b/descriptions/ghec/dereferenced/ghec.2022-11-28.deref.json index 0ca37b7433..c7a59335f2 100644 --- a/descriptions/ghec/dereferenced/ghec.2022-11-28.deref.json +++ b/descriptions/ghec/dereferenced/ghec.2022-11-28.deref.json @@ -43853,7 +43853,7 @@ }, "post": { "summary": "Create an audit log streaming configuration for an enterprise", - "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nMicrosoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -44352,7 +44352,7 @@ }, "put": { "summary": "Update an existing audit log stream configuration", - "description": "Updates an existing audit log stream configuration for an enterprise.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Updates an existing audit log stream configuration for an enterprise.\n\nMicrosoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -44402,7 +44402,8 @@ "Splunk", "HTTPS Event Collector", "Google Cloud Storage", - "Datadog" + "Datadog", + "Microsoft Agent365" ] }, "vendor_specific": { @@ -44660,6 +44661,13 @@ "site", "key_id" ] + }, + { + "type": "object", + "title": "MicrosoftAgent365Config", + "description": "Empty configuration used when pausing or resuming a Microsoft Agent365 stream.", + "maxProperties": 0, + "additionalProperties": false } ] } diff --git a/descriptions/ghec/dereferenced/ghec.2022-11-28.deref.yaml b/descriptions/ghec/dereferenced/ghec.2022-11-28.deref.yaml index 203a0ba16d..77c8146b7c 100644 --- a/descriptions/ghec/dereferenced/ghec.2022-11-28.deref.yaml +++ b/descriptions/ghec/dereferenced/ghec.2022-11-28.deref.yaml @@ -15138,6 +15138,8 @@ paths: description: |- Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog. + Microsoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -15480,6 +15482,8 @@ paths: description: |- Updates an existing audit log stream configuration for an enterprise. + Microsoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -15512,6 +15516,7 @@ paths: - HTTPS Event Collector - Google Cloud Storage - Datadog + - Microsoft Agent365 vendor_specific: type: object oneOf: @@ -15523,6 +15528,12 @@ paths: - *110 - *111 - *112 + - type: object + title: MicrosoftAgent365Config + description: Empty configuration used when pausing or resuming + a Microsoft Agent365 stream. + maxProperties: 0 + additionalProperties: false required: - enabled - stream_type diff --git a/descriptions/ghec/dereferenced/ghec.2026-03-10.deref.json b/descriptions/ghec/dereferenced/ghec.2026-03-10.deref.json index 469df553b3..50ec637d65 100644 --- a/descriptions/ghec/dereferenced/ghec.2026-03-10.deref.json +++ b/descriptions/ghec/dereferenced/ghec.2026-03-10.deref.json @@ -43738,7 +43738,7 @@ }, "post": { "summary": "Create an audit log streaming configuration for an enterprise", - "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nMicrosoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -44237,7 +44237,7 @@ }, "put": { "summary": "Update an existing audit log stream configuration", - "description": "Updates an existing audit log stream configuration for an enterprise.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Updates an existing audit log stream configuration for an enterprise.\n\nMicrosoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -44287,7 +44287,8 @@ "Splunk", "HTTPS Event Collector", "Google Cloud Storage", - "Datadog" + "Datadog", + "Microsoft Agent365" ] }, "vendor_specific": { @@ -44545,6 +44546,13 @@ "site", "key_id" ] + }, + { + "type": "object", + "title": "MicrosoftAgent365Config", + "description": "Empty configuration used when pausing or resuming a Microsoft Agent365 stream.", + "maxProperties": 0, + "additionalProperties": false } ] } diff --git a/descriptions/ghec/dereferenced/ghec.2026-03-10.deref.yaml b/descriptions/ghec/dereferenced/ghec.2026-03-10.deref.yaml index faefde349e..4572ae419c 100644 --- a/descriptions/ghec/dereferenced/ghec.2026-03-10.deref.yaml +++ b/descriptions/ghec/dereferenced/ghec.2026-03-10.deref.yaml @@ -15090,6 +15090,8 @@ paths: description: |- Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog. + Microsoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -15432,6 +15434,8 @@ paths: description: |- Updates an existing audit log stream configuration for an enterprise. + Microsoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -15464,6 +15468,7 @@ paths: - HTTPS Event Collector - Google Cloud Storage - Datadog + - Microsoft Agent365 vendor_specific: type: object oneOf: @@ -15475,6 +15480,12 @@ paths: - *110 - *111 - *112 + - type: object + title: MicrosoftAgent365Config + description: Empty configuration used when pausing or resuming + a Microsoft Agent365 stream. + maxProperties: 0 + additionalProperties: false required: - enabled - stream_type diff --git a/descriptions/ghec/dereferenced/ghec.deref.json b/descriptions/ghec/dereferenced/ghec.deref.json index 3bfdefc913..b1fa7fc3ca 100644 --- a/descriptions/ghec/dereferenced/ghec.deref.json +++ b/descriptions/ghec/dereferenced/ghec.deref.json @@ -44300,7 +44300,7 @@ }, "post": { "summary": "Create an audit log streaming configuration for an enterprise", - "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nMicrosoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -44799,7 +44799,7 @@ }, "put": { "summary": "Update an existing audit log stream configuration", - "description": "Updates an existing audit log stream configuration for an enterprise.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Updates an existing audit log stream configuration for an enterprise.\n\nMicrosoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -44849,7 +44849,8 @@ "Splunk", "HTTPS Event Collector", "Google Cloud Storage", - "Datadog" + "Datadog", + "Microsoft Agent365" ] }, "vendor_specific": { @@ -45107,6 +45108,13 @@ "site", "key_id" ] + }, + { + "type": "object", + "title": "MicrosoftAgent365Config", + "description": "Empty configuration used when pausing or resuming a Microsoft Agent365 stream.", + "maxProperties": 0, + "additionalProperties": false } ] } diff --git a/descriptions/ghec/dereferenced/ghec.deref.yaml b/descriptions/ghec/dereferenced/ghec.deref.yaml index 13411774ab..7f39ba57e5 100644 --- a/descriptions/ghec/dereferenced/ghec.deref.yaml +++ b/descriptions/ghec/dereferenced/ghec.deref.yaml @@ -15292,6 +15292,8 @@ paths: description: |- Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog. + Microsoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -15634,6 +15636,8 @@ paths: description: |- Updates an existing audit log stream configuration for an enterprise. + Microsoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -15666,6 +15670,7 @@ paths: - HTTPS Event Collector - Google Cloud Storage - Datadog + - Microsoft Agent365 vendor_specific: type: object oneOf: @@ -15677,6 +15682,12 @@ paths: - *110 - *111 - *112 + - type: object + title: MicrosoftAgent365Config + description: Empty configuration used when pausing or resuming + a Microsoft Agent365 stream. + maxProperties: 0 + additionalProperties: false required: - enabled - stream_type diff --git a/descriptions/ghec/ghec.2022-11-28.json b/descriptions/ghec/ghec.2022-11-28.json index 05fad572f8..253965755c 100644 --- a/descriptions/ghec/ghec.2022-11-28.json +++ b/descriptions/ghec/ghec.2022-11-28.json @@ -10683,7 +10683,7 @@ }, "post": { "summary": "Create an audit log streaming configuration for an enterprise", - "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nMicrosoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -10836,7 +10836,7 @@ }, "put": { "summary": "Update an existing audit log stream configuration", - "description": "Updates an existing audit log stream configuration for an enterprise.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Updates an existing audit log stream configuration for an enterprise.\n\nMicrosoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -10874,7 +10874,8 @@ "Splunk", "HTTPS Event Collector", "Google Cloud Storage", - "Datadog" + "Datadog", + "Microsoft Agent365" ] }, "vendor_specific": { @@ -10903,6 +10904,13 @@ }, { "$ref": "#/components/schemas/datadog-config" + }, + { + "type": "object", + "title": "MicrosoftAgent365Config", + "description": "Empty configuration used when pausing or resuming a Microsoft Agent365 stream.", + "maxProperties": 0, + "additionalProperties": false } ] } diff --git a/descriptions/ghec/ghec.2022-11-28.yaml b/descriptions/ghec/ghec.2022-11-28.yaml index be8874ab25..ed883673b5 100644 --- a/descriptions/ghec/ghec.2022-11-28.yaml +++ b/descriptions/ghec/ghec.2022-11-28.yaml @@ -7870,6 +7870,8 @@ paths: description: |- Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog. + Microsoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -7970,6 +7972,8 @@ paths: description: |- Updates an existing audit log stream configuration for an enterprise. + Microsoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -8002,6 +8006,7 @@ paths: - HTTPS Event Collector - Google Cloud Storage - Datadog + - Microsoft Agent365 vendor_specific: type: object oneOf: @@ -8013,6 +8018,12 @@ paths: - "$ref": "#/components/schemas/hec-config" - "$ref": "#/components/schemas/google-cloud-config" - "$ref": "#/components/schemas/datadog-config" + - type: object + title: MicrosoftAgent365Config + description: Empty configuration used when pausing or resuming + a Microsoft Agent365 stream. + maxProperties: 0 + additionalProperties: false required: - enabled - stream_type diff --git a/descriptions/ghec/ghec.2026-03-10.json b/descriptions/ghec/ghec.2026-03-10.json index 7c6b37c0c9..b17a6db963 100644 --- a/descriptions/ghec/ghec.2026-03-10.json +++ b/descriptions/ghec/ghec.2026-03-10.json @@ -10683,7 +10683,7 @@ }, "post": { "summary": "Create an audit log streaming configuration for an enterprise", - "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nMicrosoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -10836,7 +10836,7 @@ }, "put": { "summary": "Update an existing audit log stream configuration", - "description": "Updates an existing audit log stream configuration for an enterprise.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Updates an existing audit log stream configuration for an enterprise.\n\nMicrosoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -10874,7 +10874,8 @@ "Splunk", "HTTPS Event Collector", "Google Cloud Storage", - "Datadog" + "Datadog", + "Microsoft Agent365" ] }, "vendor_specific": { @@ -10903,6 +10904,13 @@ }, { "$ref": "#/components/schemas/datadog-config" + }, + { + "type": "object", + "title": "MicrosoftAgent365Config", + "description": "Empty configuration used when pausing or resuming a Microsoft Agent365 stream.", + "maxProperties": 0, + "additionalProperties": false } ] } diff --git a/descriptions/ghec/ghec.2026-03-10.yaml b/descriptions/ghec/ghec.2026-03-10.yaml index 6a3edfa67f..13602ec502 100644 --- a/descriptions/ghec/ghec.2026-03-10.yaml +++ b/descriptions/ghec/ghec.2026-03-10.yaml @@ -7870,6 +7870,8 @@ paths: description: |- Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog. + Microsoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -7970,6 +7972,8 @@ paths: description: |- Updates an existing audit log stream configuration for an enterprise. + Microsoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -8002,6 +8006,7 @@ paths: - HTTPS Event Collector - Google Cloud Storage - Datadog + - Microsoft Agent365 vendor_specific: type: object oneOf: @@ -8013,6 +8018,12 @@ paths: - "$ref": "#/components/schemas/hec-config" - "$ref": "#/components/schemas/google-cloud-config" - "$ref": "#/components/schemas/datadog-config" + - type: object + title: MicrosoftAgent365Config + description: Empty configuration used when pausing or resuming + a Microsoft Agent365 stream. + maxProperties: 0 + additionalProperties: false required: - enabled - stream_type diff --git a/descriptions/ghec/ghec.json b/descriptions/ghec/ghec.json index ec0eae0f63..20c3982279 100644 --- a/descriptions/ghec/ghec.json +++ b/descriptions/ghec/ghec.json @@ -10697,7 +10697,7 @@ }, "post": { "summary": "Create an audit log streaming configuration for an enterprise", - "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nMicrosoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -10850,7 +10850,7 @@ }, "put": { "summary": "Update an existing audit log stream configuration", - "description": "Updates an existing audit log stream configuration for an enterprise.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Updates an existing audit log stream configuration for an enterprise.\n\nMicrosoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -10888,7 +10888,8 @@ "Splunk", "HTTPS Event Collector", "Google Cloud Storage", - "Datadog" + "Datadog", + "Microsoft Agent365" ] }, "vendor_specific": { @@ -10917,6 +10918,13 @@ }, { "$ref": "#/components/schemas/datadog-config" + }, + { + "type": "object", + "title": "MicrosoftAgent365Config", + "description": "Empty configuration used when pausing or resuming a Microsoft Agent365 stream.", + "maxProperties": 0, + "additionalProperties": false } ] } diff --git a/descriptions/ghec/ghec.yaml b/descriptions/ghec/ghec.yaml index 0932876214..3170f67de3 100644 --- a/descriptions/ghec/ghec.yaml +++ b/descriptions/ghec/ghec.yaml @@ -7878,6 +7878,8 @@ paths: description: |- Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog. + Microsoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -7978,6 +7980,8 @@ paths: description: |- Updates an existing audit log stream configuration for an enterprise. + Microsoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -8010,6 +8014,7 @@ paths: - HTTPS Event Collector - Google Cloud Storage - Datadog + - Microsoft Agent365 vendor_specific: type: object oneOf: @@ -8021,6 +8026,12 @@ paths: - "$ref": "#/components/schemas/hec-config" - "$ref": "#/components/schemas/google-cloud-config" - "$ref": "#/components/schemas/datadog-config" + - type: object + title: MicrosoftAgent365Config + description: Empty configuration used when pausing or resuming + a Microsoft Agent365 stream. + maxProperties: 0 + additionalProperties: false required: - enabled - stream_type