id: datadog
name: Datadog
version: 1.0.0
description: "Datadog (API v1/v2) — observability and monitoring: search logs, list and read monitors, submit and list events. API-key + Application-key authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: search logs, list/get monitors, submit event, list events."
category: siem

# Per-instance configuration. Auth uses the 'DD-API-KEY' and 'DD-APPLICATION-KEY'
# headers. site selects the API host (e.g. datadoghq.com, datadoghq.eu, us5.datadoghq.com).
config_schema:
  properties:
    api_key:
      type: string
      description: "Datadog API key"
      x-soar-sensitive: true
    app_key:
      type: string
      description: "Datadog Application key"
      x-soar-sensitive: true
    site:
      type: string
      description: "Datadog site (default datadoghq.com)"
      default: "datadoghq.com"
  required:
    - api_key
    - app_key

commands:
  - id: search_logs
    name: datadog-search-logs
    description: "Search logs."
    risk: read
    inputs_schema:
      properties:
        query: { type: string, description: "Log search query (e.g. 'service:web status:error')" }
        from_time: { type: string, description: "From time (e.g. now-1h)" }
        to_time: { type: string, description: "To time (e.g. now)" }
        limit: { type: number, description: "Max logs (default 50)" }
      required: [query]
    outputs_schema: { properties: {} }
  - id: list_monitors
    name: datadog-list-monitors
    description: "List monitors."
    risk: read
    inputs_schema:
      properties:
        tag: { type: string, description: "Optional monitor tag filter" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_monitor
    name: datadog-get-monitor
    description: "Get a single monitor by ID."
    risk: read
    inputs_schema:
      properties:
        monitor_id: { type: string, description: "Monitor ID" }
      required: [monitor_id]
    outputs_schema: { properties: {} }
  - id: submit_event
    name: datadog-submit-event
    description: "Post an event to the Datadog event stream."
    inputs_schema:
      properties:
        title: { type: string, description: "Event title" }
        text: { type: string, description: "Event body" }
        tags: { type: string, description: "Comma-separated tags" }
        alert_type: { type: string, description: "info, warning, error, or success (default info)" }
      required: [title, text]
    outputs_schema: { properties: {} }
  - id: list_events
    name: datadog-list-events
    description: "List events in a time window."
    risk: read
    inputs_schema:
      properties:
        start: { type: number, description: "Start POSIX timestamp (seconds)" }
        end: { type: number, description: "End POSIX timestamp (seconds)" }
      required: [start, end]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: datadog-test-connection
    description: "Verify the API/app keys (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }