Guillaume BOURGEOIS
046fb79008
Datadog API v1/v2, 6 commands: search logs, list/get monitors, submit event, list events. API-key + Application-key auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
89 lines
3.1 KiB
YAML
89 lines
3.1 KiB
YAML
id: datadog
|
|
name: Datadog
|
|
version: 1.0.0
|
|
description: "Datadog (API v1/v2) — observability and monitoring: search logs, list and read monitors, submit and list events. API-key + Application-key authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: search logs, list/get monitors, submit event, list events."
|
|
category: siem
|
|
|
|
# Per-instance configuration. Auth uses the 'DD-API-KEY' and 'DD-APPLICATION-KEY'
|
|
# headers. site selects the API host (e.g. datadoghq.com, datadoghq.eu, us5.datadoghq.com).
|
|
config_schema:
|
|
properties:
|
|
api_key:
|
|
type: string
|
|
description: "Datadog API key"
|
|
x-soar-sensitive: true
|
|
app_key:
|
|
type: string
|
|
description: "Datadog Application key"
|
|
x-soar-sensitive: true
|
|
site:
|
|
type: string
|
|
description: "Datadog site (default datadoghq.com)"
|
|
default: "datadoghq.com"
|
|
required:
|
|
- api_key
|
|
- app_key
|
|
|
|
commands:
|
|
- id: search_logs
|
|
name: datadog-search-logs
|
|
description: "Search logs."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
query: { type: string, description: "Log search query (e.g. 'service:web status:error')" }
|
|
from_time: { type: string, description: "From time (e.g. now-1h)" }
|
|
to_time: { type: string, description: "To time (e.g. now)" }
|
|
limit: { type: number, description: "Max logs (default 50)" }
|
|
required: [query]
|
|
outputs_schema: { properties: {} }
|
|
- id: list_monitors
|
|
name: datadog-list-monitors
|
|
description: "List monitors."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
tag: { type: string, description: "Optional monitor tag filter" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_monitor
|
|
name: datadog-get-monitor
|
|
description: "Get a single monitor by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
monitor_id: { type: string, description: "Monitor ID" }
|
|
required: [monitor_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: submit_event
|
|
name: datadog-submit-event
|
|
description: "Post an event to the Datadog event stream."
|
|
inputs_schema:
|
|
properties:
|
|
title: { type: string, description: "Event title" }
|
|
text: { type: string, description: "Event body" }
|
|
tags: { type: string, description: "Comma-separated tags" }
|
|
alert_type: { type: string, description: "info, warning, error, or success (default info)" }
|
|
required: [title, text]
|
|
outputs_schema: { properties: {} }
|
|
- id: list_events
|
|
name: datadog-list-events
|
|
description: "List events in a time window."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
start: { type: number, description: "Start POSIX timestamp (seconds)" }
|
|
end: { type: number, description: "End POSIX timestamp (seconds)" }
|
|
required: [start, end]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: datadog-test-connection
|
|
description: "Verify the API/app keys (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|