feat(datadog): new Datadog observability integration

Datadog API v1/v2, 6 commands: search logs, list/get monitors, submit event, list events. API-key + Application-key auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 15:08:51 +02:00
parent 6548740890
commit 046fb79008
7 changed files with 442 additions and 0 deletions
@@ -0,0 +1,88 @@
+id: datadog
+name: Datadog
+version: 1.0.0
+description: "Datadog (API v1/v2) — observability and monitoring: search logs, list and read monitors, submit and list events. API-key + Application-key authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: search logs, list/get monitors, submit event, list events."
+category: siem
+
+# Per-instance configuration. Auth uses the 'DD-API-KEY' and 'DD-APPLICATION-KEY'
+# headers. site selects the API host (e.g. datadoghq.com, datadoghq.eu, us5.datadoghq.com).
+config_schema:
+  properties:
+    api_key:
+      type: string
+      description: "Datadog API key"
+      x-soar-sensitive: true
+    app_key:
+      type: string
+      description: "Datadog Application key"
+      x-soar-sensitive: true
+    site:
+      type: string
+      description: "Datadog site (default datadoghq.com)"
+      default: "datadoghq.com"
+  required:
+    - api_key
+    - app_key
+
+commands:
+  - id: search_logs
+    name: datadog-search-logs
+    description: "Search logs."
+    risk: read
+    inputs_schema:
+      properties:
+        query: { type: string, description: "Log search query (e.g. 'service:web status:error')" }
+        from_time: { type: string, description: "From time (e.g. now-1h)" }
+        to_time: { type: string, description: "To time (e.g. now)" }
+        limit: { type: number, description: "Max logs (default 50)" }
+      required: [query]
+    outputs_schema: { properties: {} }
+  - id: list_monitors
+    name: datadog-list-monitors
+    description: "List monitors."
+    risk: read
+    inputs_schema:
+      properties:
+        tag: { type: string, description: "Optional monitor tag filter" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_monitor
+    name: datadog-get-monitor
+    description: "Get a single monitor by ID."
+    risk: read
+    inputs_schema:
+      properties:
+        monitor_id: { type: string, description: "Monitor ID" }
+      required: [monitor_id]
+    outputs_schema: { properties: {} }
+  - id: submit_event
+    name: datadog-submit-event
+    description: "Post an event to the Datadog event stream."
+    inputs_schema:
+      properties:
+        title: { type: string, description: "Event title" }
+        text: { type: string, description: "Event body" }
+        tags: { type: string, description: "Comma-separated tags" }
+        alert_type: { type: string, description: "info, warning, error, or success (default info)" }
+      required: [title, text]
+    outputs_schema: { properties: {} }
+  - id: list_events
+    name: datadog-list-events
+    description: "List events in a time window."
+    risk: read
+    inputs_schema:
+      properties:
+        start: { type: number, description: "Start POSIX timestamp (seconds)" }
+        end: { type: number, description: "End POSIX timestamp (seconds)" }
+      required: [start, end]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: datadog-test-connection
+    description: "Verify the API/app keys (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }