AS-Datadog-Events-Integration

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

This playbook is intended to be run on a timmed trigger. It will poll Datadog for new events and replicate them in Sentinel

Attribute	Value
Type	Playbook
Solution	Standalone Content
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
Datadog_Events_CL	?	✓	?

Logic App Connectors

This playbook uses 4 Logic App connectors / built-in actions:

Connector / Action	Type	Connections	Actions
azureloganalyticsdatacollector	Managed	1	1
azuremonitorlogs	Managed	1	1
keyvault	Managed	1	2
http	Built-in	0	1

Action parameters (URLs, paths, function IDs)

azureloganalyticsdatacollector (Managed)

Action	Method	Endpoint	Other
Send_Data	post	/api/logs	—

azuremonitorlogs (Managed)

Action	Method	Endpoint	Other
Run_query_and_list_results_V2	post	/queryDataV2	—

keyvault (Managed)

Action	Method	Endpoint	Other
Get_Secret_-_API_Key	get	[concat('/secrets/@{encodeURIComponent(''', parameters('APIKeySecretName'), ''')}/value')]	—
Get_Secret_-_Application_Key	get	[concat('/secrets/@{encodeURIComponent(''', parameters('ApplicationKeySecretName'), ''')}/value')]	—

http (Built-in)

Action	Method	Endpoint	Other
HTTP_-_Get_Events	GET	[concat('https://', parameters('DatadogDomain'), '/api/v2/events?filter[from]=@{variables(''Unix Start Time'')}&filter[to]=@{variables(''Unix End Time'')}')]	—

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Playbooks