Skip to content

Commit e820982

Browse files
mauneelsorathia-crestbparmar-crestcmlaverdieregunterd
authored
[SIEMINT-123] DDSaaS: incident.io: Integration v1.0.0 (#18595)
* Added incident.io integration assets * Removed saved views from manifest * Resolved log pipeline tests check failure * Fixed pipeline tests file identation * Changed tab spacing of pipeline tests yaml * Changed tab spacing of pipeline tests yaml * Reformatted pipeline tests file * Reformatted pipeline tests file * Fixed identation * log sample fixed * log sample fixed * Updated README and monitor descriptions * incorporated PR review suggestions * Update critical_public_incident.json * Update high_number_of_public_incidents.json * Update public_incident_reopened.json * Clean up monitor names --------- Co-authored-by: Bhavik Parmar <bhavik.parmar@crestdatasys.com> Co-authored-by: Bhavik Parmar <84003960+bparmar-crest@users.noreply.github.com> Co-authored-by: Chris Laverdiere <chris.laverdiere@datadoghq.com> Co-authored-by: Chris Laverdiere <cmlaverdiere@gmail.com> Co-authored-by: Doug Gunter <douglas.gunter@datadoghq.com>
1 parent 61912ca commit e820982

16 files changed

+4283
-0
lines changed

‎.github/CODEOWNERS

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -276,6 +276,11 @@ datadog_checks_base/datadog_checks/base/checks/windows/ @DataDog/wi
276276
/greenhouse/manifest.json @DataDog/saas-integrations @DataDog/documentation
277277
/greenhouse/assets/logs/ @DataDog/saas-integrations @DataDog/documentation @DataDog/logs-backend
278278

279+
/incident_io/ @DataDog/saas-integrations
280+
/incident_io/*.md @DataDog/saas-integrations @DataDog/documentation
281+
/incident_io/manifest.json @DataDog/saas-integrations @DataDog/documentation
282+
/incident_io/assets/logs/ @DataDog/saas-integrations @DataDog/documentation @DataDog/logs-backend
283+
279284
/lastpass/ @DataDog/saas-integrations
280285
/lastpass/*.md @DataDog/saas-integrations @DataDog/documentation
281286
/lastpass/manifest.json @DataDog/saas-integrations @DataDog/documentation

‎.github/workflows/config/labeler.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -261,6 +261,8 @@ integration/iis:
261261
- iis/**/*
262262
integration/impala:
263263
- impala/**/*
264+
integration/incident_io:
265+
- incident_io/**/*
264266
integration/istio:
265267
- istio/**/*
266268
integration/jboss_wildfly:

‎incident_io/CHANGELOG.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# CHANGELOG - incident.io
2+
3+
## 1.0.0 / 2024-09-04
4+
5+
***Added***:
6+
7+
* Initial Release

‎incident_io/README.md

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
## Overview
2+
3+
[incident.io][1] helps companies declare, collaborate, communicate around, and learn from events that disturb their normal course of business-from critical infrastructure being down, to data breaches and security incidents. It is a service that helps teams manage incidents and outages effectively. It typically provides features like incident reporting, tracking, and resolution workflows.
4+
5+
Integrate your incident.io account with Datadog to gain insights into incident-related activities.
6+
7+
## Setup
8+
9+
Follow the instructions below to configure this integration for incident.io incident events through a Webhook.
10+
11+
### Configuration
12+
13+
#### Webhook configuration
14+
Configure the Datadog endpoint to forward events of incident.io incidents as logs to Datadog. For more details, see the incident.io [webhooks][2] documentation.
15+
16+
1. Select an existing API key or create a new one by clicking one of the buttons below: <!-- UI Component to be added by Datadog team -->
17+
2. Log in to your [incident.io account][3] as org owner.
18+
3. Go to **Settings > Webhooks**.
19+
4. Click **Add Endpoint**.
20+
5. Fill in the webhook URL that you generated in step 1.
21+
6. Select the type of incident events that you want to push to Datadog under the **Subscribe to events** section.
22+
7. Click **Create**.
23+
24+
## Data Collected
25+
26+
### Logs
27+
The incident.io integration ingests the following logs:
28+
- Public incident event logs
29+
- Private incident event logs
30+
- Action and follow up event logs
31+
32+
### Metrics
33+
34+
incident.io does not include any metrics.
35+
36+
### Service Checks
37+
38+
incident.io does not include any service checks.
39+
40+
### Events
41+
42+
incident.io does not include any events.
43+
44+
## Support
45+
46+
Need help? Contact [Datadog support][4].
47+
48+
[1]: https://incident.io/
49+
[2]: https://api-docs.incident.io/tag/Webhooks/
50+
[3]: https://app.incident.io/
51+
[4]: https://docs.datadoghq.com/help/

‎incident_io/assets/dashboards/incident-io_incidents_overview.json

Lines changed: 1781 additions & 0 deletions
Large diffs are not rendered by default.

‎incident_io/assets/incident_io.svg

Lines changed: 1 addition & 0 deletions
Loading

‎incident_io/assets/logs/incident-io.yaml

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
id: incident-io
2+
metric_id: incident-io
3+
backend_only: false
4+
facets:
5+
- groups:
6+
- Event
7+
name: Event Name
8+
path: evt.name
9+
source: log
10+
pipeline:
11+
type: pipeline
12+
name: incident.io
13+
enabled: true
14+
filter:
15+
query: "source:incident-io"
16+
processors:
17+
- type: attribute-remapper
18+
name: Map `event_type` to `evt.name`
19+
enabled: true
20+
sources:
21+
- event_type
22+
sourceType: attribute
23+
target: evt.name
24+
targetType: attribute
25+
preserveSource: false
26+
overrideOnConflict: false
27+
- type: attribute-remapper
28+
name: Map `private_incident.action_created_v1`, `private_incident.action_updated_v1`, `private_incident.follow_up_created_v1`, `private_incident.follow_up_updated_v1`, `private_incident.incident_created_v2`, `private_incident.incident_updated_v2`, `private_incident.membership_granted_v1`, `private_incident.membership_revoked_v1`, `public_incident.action_created_v1`, `public_incident.action_updated_v1`, `public_incident.follow_up_created_v1`, `public_incident.follow_up_updated_v1`, `public_incident.incident_created_v2`, `public_incident.incident_status_updated_v2`, `public_incident.incident_updated_v2` to `data`
29+
enabled: true
30+
sources:
31+
- private_incident.action_created_v1
32+
- private_incident.action_updated_v1
33+
- private_incident.follow_up_created_v1
34+
- private_incident.follow_up_updated_v1
35+
- private_incident.incident_created_v2
36+
- private_incident.incident_updated_v2
37+
- private_incident.membership_granted_v1
38+
- private_incident.membership_revoked_v1
39+
- public_incident.action_created_v1
40+
- public_incident.action_updated_v1
41+
- public_incident.follow_up_created_v1
42+
- public_incident.follow_up_updated_v1
43+
- public_incident.incident_created_v2
44+
- public_incident.incident_status_updated_v2
45+
- public_incident.incident_updated_v2
46+
sourceType: attribute
47+
target: data
48+
targetType: attribute
49+
preserveSource: false
50+
overrideOnConflict: false
51+
- type: pipeline
52+
name: Creation Events
53+
enabled: true
54+
filter:
55+
query: "@evt.name:(public_incident.action_created_v1 OR
56+
public_incident.follow_up_created_v1)"
57+
processors:
58+
- type: date-remapper
59+
name: Define `data.created_at` as the official date of the log
60+
enabled: true
61+
sources:
62+
- data.created_at
63+
- type: pipeline
64+
name: Update Events
65+
enabled: true
66+
filter:
67+
query: "@evt.name:(public_incident.action_updated_v1 OR
68+
public_incident.follow_up_updated_v1)"
69+
processors:
70+
- type: date-remapper
71+
name: Define `data.updated_at` as the official date of the log
72+
enabled: true
73+
sources:
74+
- data.updated_at
75+
- type: pipeline
76+
name: Incident Created Event
77+
enabled: true
78+
filter:
79+
query: "@evt.name:public_incident.incident_created_v2"
80+
processors:
81+
- type: date-remapper
82+
name: Define `data.created_at` as the official date of the log
83+
enabled: true
84+
sources:
85+
- data.created_at
86+
- type: attribute-remapper
87+
name: Map `data.id` to `data.incident_id`
88+
enabled: true
89+
sources:
90+
- data.id
91+
sourceType: attribute
92+
target: data.incident_id
93+
targetType: attribute
94+
preserveSource: false
95+
overrideOnConflict: false
96+
- type: pipeline
97+
name: Incident Updated Event
98+
enabled: true
99+
filter:
100+
query: "@evt.name:public_incident.incident_updated_v2"
101+
processors:
102+
- type: date-remapper
103+
name: Define `data.updated_at` as the official date of the log
104+
enabled: true
105+
sources:
106+
- data.updated_at
107+
- type: attribute-remapper
108+
name: Map `data.id` to `data.incident_id`
109+
enabled: true
110+
sources:
111+
- data.id
112+
sourceType: attribute
113+
target: data.incident_id
114+
targetType: attribute
115+
preserveSource: false
116+
overrideOnConflict: false
117+
- type: pipeline
118+
name: Incident Status Update Event
119+
enabled: true
120+
filter:
121+
query: "@evt.name:public_incident.incident_status_updated_v2"
122+
processors:
123+
- type: date-remapper
124+
name: Define `data.incident.updated_at` as the official date of the log
125+
enabled: true
126+
sources:
127+
- data.incident.updated_at
128+
- type: attribute-remapper
129+
name: Map `data.incident.name` to `data.name`
130+
enabled: true
131+
sources:
132+
- data.incident.name
133+
sourceType: attribute
134+
target: data.name
135+
targetType: attribute
136+
preserveSource: false
137+
overrideOnConflict: false
138+
- type: attribute-remapper
139+
name: Map `data.incident.reference` to `data.reference`
140+
enabled: true
141+
sources:
142+
- data.incident.reference
143+
sourceType: attribute
144+
target: data.reference
145+
targetType: attribute
146+
preserveSource: false
147+
overrideOnConflict: false
148+
- type: attribute-remapper
149+
name: Map `data.incident.id` to `data.incident_id`
150+
enabled: true
151+
sources:
152+
- data.incident.id
153+
sourceType: attribute
154+
target: data.incident_id
155+
targetType: attribute
156+
preserveSource: false
157+
overrideOnConflict: false
158+
- type: attribute-remapper
159+
name: Map `data.incident.incident_type.name` to `data.incident_type.name`
160+
enabled: true
161+
sources:
162+
- data.incident.incident_type.name
163+
sourceType: attribute
164+
target: data.incident_type.name
165+
targetType: attribute
166+
preserveSource: false
167+
overrideOnConflict: false
168+
- type: pipeline
169+
name: Private Incident Events
170+
enabled: true
171+
filter:
172+
query: "@evt.name:(private_incident.incident_created_v2 OR
173+
private_incident.incident_updated_v2)"
174+
processors:
175+
- type: attribute-remapper
176+
name: Map `data.id` to `data.incident_id`
177+
enabled: true
178+
sources:
179+
- data.id
180+
sourceType: attribute
181+
target: data.incident_id
182+
targetType: attribute
183+
preserveSource: false
184+
overrideOnConflict: false

0 commit comments

Comments
 (0)