{
  "name": "DatadogConnector",
  "apiVersion": "2025-07-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "DatadogConnector",
      "title": "Datadog Logs (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The Datadog Logs data connector ingests [Datadog](https://www.datadoghq.com/) audit events, indexed logs, and security signals into Microsoft Sentinel through the [Datadog API](https://docs.datadoghq.com/api/latest/). The supported data types provide administrative activity, application and infrastructure telemetry, and Datadog Security Monitoring detections for investigation.",
      "graphQueries": [
        {
          "metricName": "Total audit events received",
          "legend": "Datadog Audit Events",
          "baseQuery": "DatadogAuditLogs_CL"
        },
        {
          "metricName": "Total logs received",
          "legend": "Datadog Logs",
          "baseQuery": "DatadogLogs_CL"
        },
        {
          "metricName": "Total security signals received",
          "legend": "Datadog Security Logs",
          "baseQuery": "DatadogSecurityLogs_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get sample of 20 recent Datadog audit events",
          "query": "DatadogAuditLogs_CL\n| take 20"
        },
        {
          "description": "Get sample of 20 recent Datadog logs",
          "query": "DatadogLogs_CL\n| take 20"
        },
        {
          "description": "Get sample of 20 recent Datadog security signals",
          "query": "DatadogSecurityLogs_CL\n| take 20"
        },
        {
          "description": "Audit events by action and status",
          "query": "DatadogAuditLogs_CL\n| summarize count() by Action, Status"
        },
        {
          "description": "Logs by Datadog service and status",
          "query": "DatadogLogs_CL\n| summarize count() by Service, Status"
        },
        {
          "description": "Security signals by status and title",
          "query": "DatadogSecurityLogs_CL\n| summarize count() by Status, SignalTitle"
        }
      ],
      "dataTypes": [
        {
          "name": "DatadogAuditLogs_CL",
          "lastDataReceivedQuery": "DatadogAuditLogs_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "DatadogLogs_CL",
          "lastDataReceivedQuery": "DatadogLogs_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "DatadogSecurityLogs_CL",
          "lastDataReceivedQuery": "DatadogSecurityLogs_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        },
        {
          "type": "IsConnectedQuery",
          "value": [
            "union DatadogAuditLogs_CL, DatadogLogs_CL, DatadogSecurityLogs_CL | where TimeGenerated > ago(1h) | take 1"
          ]
        }
      ],
      "availability": {
        "isPreview": true,
        "status": 1
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true,
              "action": false
            }
          }
        ],
        "customs": [
          {
            "name": "Datadog API access",
            "description": "**Datadog API and Application keys** are required. The Application key must have permission to read the selected data type. Security Logs require the `security_monitoring_signals_read` scope. See the [Datadog API and Application Keys documentation](https://docs.datadoghq.com/account_management/api-app-keys/)."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "1. Connections",
          "description": "Configure and manage Datadog connections.",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "Enter your Datadog API host (the region your account uses), without a scheme or trailing slash. Valid values: `api.datadoghq.com` (US1), `api.us3.datadoghq.com` (US3), `api.us5.datadoghq.com` (US5), `api.datadoghq.eu` (EU1), `api.ap1.datadoghq.com` (AP1), `api.ap2.datadoghq.com` (AP2), `api.ddog-gov.com` (US1-FED), `api.us2.ddog-gov.com` (US2-FED), `api.uk1.datadoghq.com` (UK1)."
              }
            },
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnName": "Connection Name",
                    "columnValue": "properties.addOnAttributes.friendlyName"
                  },
                  {
                    "columnName": "Datadog API Endpoint",
                    "columnValue": "properties.request.apiEndpoint"
                  },
                  {
                    "columnName": "Data Type",
                    "columnValue": "properties.addOnAttributes.dataType"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "label": "Add Connection",
                "title": "Add Datadog Connection",
                "subtitle": "Connect Datadog data to Microsoft Sentinel",
                "contextPaneType": "DataConnectorsContextPane",
                "instructionSteps": [
                  {
                    "instructions": [
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Connection Name",
                          "placeholder": "e.g. Production US1",
                          "type": "text",
                          "name": "friendlyName",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Datadog Site (API host)",
                          "placeholder": "api.datadoghq.com",
                          "type": "text",
                          "name": "datadogsite",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Datadog API Key",
                          "placeholder": "Enter your Datadog API key",
                          "type": "password",
                          "name": "apikey",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Datadog Application Key",
                          "placeholder": "Enter your Datadog Application key",
                          "type": "password",
                          "name": "appkey",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Dropdown",
                        "parameters": {
                          "label": "Data Type",
                          "name": "selectedDataType",
                          "options": [
                            {
                              "key": "DatadogAuditLogs",
                              "text": "Audit Events"
                            },
                            {
                              "key": "DatadogLogs",
                              "text": "Logs"
                            },
                            {
                              "key": "DatadogSecurityLogs",
                              "text": "Security Logs"
                            }
                          ],
                          "placeholder": "Select a data type",
                          "required": true
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ]
    }
  }
}