diff --git a/descriptions-next/ghec/dereferenced/ghec.2022-11-28.deref.json b/descriptions-next/ghec/dereferenced/ghec.2022-11-28.deref.json index 360854c8e8..1de9fc9219 100644 --- a/descriptions-next/ghec/dereferenced/ghec.2022-11-28.deref.json +++ b/descriptions-next/ghec/dereferenced/ghec.2022-11-28.deref.json @@ -47064,7 +47064,7 @@ }, "post": { "summary": "Create an audit log streaming configuration for an enterprise", - "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nMicrosoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -47567,7 +47567,7 @@ }, "put": { "summary": "Update an existing audit log stream configuration", - "description": "Updates an existing audit log stream configuration for an enterprise.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Updates an existing audit log stream configuration for an enterprise.\n\nMicrosoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -47617,7 +47617,8 @@ "Splunk", "HTTPS Event Collector", "Google Cloud Storage", - "Datadog" + "Datadog", + "Microsoft Agent365" ] }, "vendor_specific": { @@ -47875,6 +47876,13 @@ "site", "key_id" ] + }, + { + "type": "object", + "title": "MicrosoftAgent365Config", + "description": "Empty configuration used when pausing or resuming a Microsoft Agent365 stream.", + "maxProperties": 0, + "additionalProperties": false } ] } diff --git a/descriptions-next/ghec/dereferenced/ghec.2022-11-28.deref.yaml b/descriptions-next/ghec/dereferenced/ghec.2022-11-28.deref.yaml index a5ea8620a0..43afcbe5de 100644 --- a/descriptions-next/ghec/dereferenced/ghec.2022-11-28.deref.yaml +++ b/descriptions-next/ghec/dereferenced/ghec.2022-11-28.deref.yaml @@ -15492,6 +15492,8 @@ paths: description: |- Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog. + Microsoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -15835,6 +15837,8 @@ paths: description: |- Updates an existing audit log stream configuration for an enterprise. + Microsoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -15867,6 +15871,7 @@ paths: - HTTPS Event Collector - Google Cloud Storage - Datadog + - Microsoft Agent365 vendor_specific: type: object oneOf: @@ -15878,6 +15883,12 @@ paths: - *108 - *109 - *110 + - type: object + title: MicrosoftAgent365Config + description: Empty configuration used when pausing or resuming + a Microsoft Agent365 stream. + maxProperties: 0 + additionalProperties: false required: - enabled - stream_type diff --git a/descriptions-next/ghec/dereferenced/ghec.2026-03-10.deref.json b/descriptions-next/ghec/dereferenced/ghec.2026-03-10.deref.json index a7df295b1c..32af5157d5 100644 --- a/descriptions-next/ghec/dereferenced/ghec.2026-03-10.deref.json +++ b/descriptions-next/ghec/dereferenced/ghec.2026-03-10.deref.json @@ -46931,7 +46931,7 @@ }, "post": { "summary": "Create an audit log streaming configuration for an enterprise", - "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nMicrosoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -47434,7 +47434,7 @@ }, "put": { "summary": "Update an existing audit log stream configuration", - "description": "Updates an existing audit log stream configuration for an enterprise.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Updates an existing audit log stream configuration for an enterprise.\n\nMicrosoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -47484,7 +47484,8 @@ "Splunk", "HTTPS Event Collector", "Google Cloud Storage", - "Datadog" + "Datadog", + "Microsoft Agent365" ] }, "vendor_specific": { @@ -47742,6 +47743,13 @@ "site", "key_id" ] + }, + { + "type": "object", + "title": "MicrosoftAgent365Config", + "description": "Empty configuration used when pausing or resuming a Microsoft Agent365 stream.", + "maxProperties": 0, + "additionalProperties": false } ] } diff --git a/descriptions-next/ghec/dereferenced/ghec.2026-03-10.deref.yaml b/descriptions-next/ghec/dereferenced/ghec.2026-03-10.deref.yaml index 03dad260f7..c799f1440e 100644 --- a/descriptions-next/ghec/dereferenced/ghec.2026-03-10.deref.yaml +++ b/descriptions-next/ghec/dereferenced/ghec.2026-03-10.deref.yaml @@ -15440,6 +15440,8 @@ paths: description: |- Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog. + Microsoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -15783,6 +15785,8 @@ paths: description: |- Updates an existing audit log stream configuration for an enterprise. + Microsoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -15815,6 +15819,7 @@ paths: - HTTPS Event Collector - Google Cloud Storage - Datadog + - Microsoft Agent365 vendor_specific: type: object oneOf: @@ -15826,6 +15831,12 @@ paths: - *108 - *109 - *110 + - type: object + title: MicrosoftAgent365Config + description: Empty configuration used when pausing or resuming + a Microsoft Agent365 stream. + maxProperties: 0 + additionalProperties: false required: - enabled - stream_type diff --git a/descriptions-next/ghec/dereferenced/ghec.deref.json b/descriptions-next/ghec/dereferenced/ghec.deref.json index 67f302e64a..9ab5d23e76 100644 --- a/descriptions-next/ghec/dereferenced/ghec.deref.json +++ b/descriptions-next/ghec/dereferenced/ghec.deref.json @@ -47511,7 +47511,7 @@ }, "post": { "summary": "Create an audit log streaming configuration for an enterprise", - "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nMicrosoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -48014,7 +48014,7 @@ }, "put": { "summary": "Update an existing audit log stream configuration", - "description": "Updates an existing audit log stream configuration for an enterprise.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Updates an existing audit log stream configuration for an enterprise.\n\nMicrosoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -48064,7 +48064,8 @@ "Splunk", "HTTPS Event Collector", "Google Cloud Storage", - "Datadog" + "Datadog", + "Microsoft Agent365" ] }, "vendor_specific": { @@ -48322,6 +48323,13 @@ "site", "key_id" ] + }, + { + "type": "object", + "title": "MicrosoftAgent365Config", + "description": "Empty configuration used when pausing or resuming a Microsoft Agent365 stream.", + "maxProperties": 0, + "additionalProperties": false } ] } diff --git a/descriptions-next/ghec/dereferenced/ghec.deref.yaml b/descriptions-next/ghec/dereferenced/ghec.deref.yaml index 366a6c39eb..f40038c431 100644 --- a/descriptions-next/ghec/dereferenced/ghec.deref.yaml +++ b/descriptions-next/ghec/dereferenced/ghec.deref.yaml @@ -15646,6 +15646,8 @@ paths: description: |- Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog. + Microsoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -15989,6 +15991,8 @@ paths: description: |- Updates an existing audit log stream configuration for an enterprise. + Microsoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -16021,6 +16025,7 @@ paths: - HTTPS Event Collector - Google Cloud Storage - Datadog + - Microsoft Agent365 vendor_specific: type: object oneOf: @@ -16032,6 +16037,12 @@ paths: - *108 - *109 - *110 + - type: object + title: MicrosoftAgent365Config + description: Empty configuration used when pausing or resuming + a Microsoft Agent365 stream. + maxProperties: 0 + additionalProperties: false required: - enabled - stream_type diff --git a/descriptions-next/ghec/ghec.2022-11-28.json b/descriptions-next/ghec/ghec.2022-11-28.json index f00a600ef4..7adbf7be20 100644 --- a/descriptions-next/ghec/ghec.2022-11-28.json +++ b/descriptions-next/ghec/ghec.2022-11-28.json @@ -10725,7 +10725,7 @@ }, "post": { "summary": "Create an audit log streaming configuration for an enterprise", - "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nMicrosoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -10878,7 +10878,7 @@ }, "put": { "summary": "Update an existing audit log stream configuration", - "description": "Updates an existing audit log stream configuration for an enterprise.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Updates an existing audit log stream configuration for an enterprise.\n\nMicrosoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -10916,7 +10916,8 @@ "Splunk", "HTTPS Event Collector", "Google Cloud Storage", - "Datadog" + "Datadog", + "Microsoft Agent365" ] }, "vendor_specific": { @@ -10945,6 +10946,13 @@ }, { "$ref": "#/components/schemas/datadog-config" + }, + { + "type": "object", + "title": "MicrosoftAgent365Config", + "description": "Empty configuration used when pausing or resuming a Microsoft Agent365 stream.", + "maxProperties": 0, + "additionalProperties": false } ] } diff --git a/descriptions-next/ghec/ghec.2022-11-28.yaml b/descriptions-next/ghec/ghec.2022-11-28.yaml index f5209a8e8d..1d24bf24a9 100644 --- a/descriptions-next/ghec/ghec.2022-11-28.yaml +++ b/descriptions-next/ghec/ghec.2022-11-28.yaml @@ -7891,6 +7891,8 @@ paths: description: |- Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog. + Microsoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -7991,6 +7993,8 @@ paths: description: |- Updates an existing audit log stream configuration for an enterprise. + Microsoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -8023,6 +8027,7 @@ paths: - HTTPS Event Collector - Google Cloud Storage - Datadog + - Microsoft Agent365 vendor_specific: type: object oneOf: @@ -8034,6 +8039,12 @@ paths: - "$ref": "#/components/schemas/hec-config" - "$ref": "#/components/schemas/google-cloud-config" - "$ref": "#/components/schemas/datadog-config" + - type: object + title: MicrosoftAgent365Config + description: Empty configuration used when pausing or resuming + a Microsoft Agent365 stream. + maxProperties: 0 + additionalProperties: false required: - enabled - stream_type diff --git a/descriptions-next/ghec/ghec.2026-03-10.json b/descriptions-next/ghec/ghec.2026-03-10.json index 4d544ef80c..7630239bfd 100644 --- a/descriptions-next/ghec/ghec.2026-03-10.json +++ b/descriptions-next/ghec/ghec.2026-03-10.json @@ -10725,7 +10725,7 @@ }, "post": { "summary": "Create an audit log streaming configuration for an enterprise", - "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nMicrosoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -10878,7 +10878,7 @@ }, "put": { "summary": "Update an existing audit log stream configuration", - "description": "Updates an existing audit log stream configuration for an enterprise.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Updates an existing audit log stream configuration for an enterprise.\n\nMicrosoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -10916,7 +10916,8 @@ "Splunk", "HTTPS Event Collector", "Google Cloud Storage", - "Datadog" + "Datadog", + "Microsoft Agent365" ] }, "vendor_specific": { @@ -10945,6 +10946,13 @@ }, { "$ref": "#/components/schemas/datadog-config" + }, + { + "type": "object", + "title": "MicrosoftAgent365Config", + "description": "Empty configuration used when pausing or resuming a Microsoft Agent365 stream.", + "maxProperties": 0, + "additionalProperties": false } ] } diff --git a/descriptions-next/ghec/ghec.2026-03-10.yaml b/descriptions-next/ghec/ghec.2026-03-10.yaml index 062ddf1ac5..c8114cebfb 100644 --- a/descriptions-next/ghec/ghec.2026-03-10.yaml +++ b/descriptions-next/ghec/ghec.2026-03-10.yaml @@ -7891,6 +7891,8 @@ paths: description: |- Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog. + Microsoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -7991,6 +7993,8 @@ paths: description: |- Updates an existing audit log stream configuration for an enterprise. + Microsoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -8023,6 +8027,7 @@ paths: - HTTPS Event Collector - Google Cloud Storage - Datadog + - Microsoft Agent365 vendor_specific: type: object oneOf: @@ -8034,6 +8039,12 @@ paths: - "$ref": "#/components/schemas/hec-config" - "$ref": "#/components/schemas/google-cloud-config" - "$ref": "#/components/schemas/datadog-config" + - type: object + title: MicrosoftAgent365Config + description: Empty configuration used when pausing or resuming + a Microsoft Agent365 stream. + maxProperties: 0 + additionalProperties: false required: - enabled - stream_type diff --git a/descriptions-next/ghec/ghec.json b/descriptions-next/ghec/ghec.json index 6886029f8c..09cf5a441a 100644 --- a/descriptions-next/ghec/ghec.json +++ b/descriptions-next/ghec/ghec.json @@ -10739,7 +10739,7 @@ }, "post": { "summary": "Create an audit log streaming configuration for an enterprise", - "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.\n\nMicrosoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -10892,7 +10892,7 @@ }, "put": { "summary": "Update an existing audit log stream configuration", - "description": "Updates an existing audit log stream configuration for an enterprise.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", + "description": "Updates an existing audit log stream configuration for an enterprise.\n\nMicrosoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization.\n\nWhen using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See \"[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api).\"", "tags": [ "enterprise-admin" ], @@ -10930,7 +10930,8 @@ "Splunk", "HTTPS Event Collector", "Google Cloud Storage", - "Datadog" + "Datadog", + "Microsoft Agent365" ] }, "vendor_specific": { @@ -10959,6 +10960,13 @@ }, { "$ref": "#/components/schemas/datadog-config" + }, + { + "type": "object", + "title": "MicrosoftAgent365Config", + "description": "Empty configuration used when pausing or resuming a Microsoft Agent365 stream.", + "maxProperties": 0, + "additionalProperties": false } ] } diff --git a/descriptions-next/ghec/ghec.yaml b/descriptions-next/ghec/ghec.yaml index e7efe70536..aeb55efea1 100644 --- a/descriptions-next/ghec/ghec.yaml +++ b/descriptions-next/ghec/ghec.yaml @@ -7899,6 +7899,8 @@ paths: description: |- Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog. + Microsoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -7999,6 +8001,8 @@ paths: description: |- Updates an existing audit log stream configuration for an enterprise. + Microsoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization. + When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)." tags: - enterprise-admin @@ -8031,6 +8035,7 @@ paths: - HTTPS Event Collector - Google Cloud Storage - Datadog + - Microsoft Agent365 vendor_specific: type: object oneOf: @@ -8042,6 +8047,12 @@ paths: - "$ref": "#/components/schemas/hec-config" - "$ref": "#/components/schemas/google-cloud-config" - "$ref": "#/components/schemas/datadog-config" + - type: object + title: MicrosoftAgent365Config + description: Empty configuration used when pausing or resuming + a Microsoft Agent365 stream. + maxProperties: 0 + additionalProperties: false required: - enabled - stream_type