DDS: SpyCloud: Threat Intel Integration v1.0.0 by jaypatel7-crest · Pull Request #23510 · DataDog/integrations-core

jaypatel7-crest · 2026-04-29T07:44:52Z

What does this PR do?

This is a initial release PR of SpyCloud integration including all the required assets.

Integration Logo Source

Light Theme: https://spycloud.com/wp-content/uploads/2025/04/SpyCloud-Logo-Black-1.svg
Dark Theme: https://portal.spycloud.com/images/Logo-Reversed.png

Additional Notes

Crawler code for this integration has been committed in its respective repo
OOTB detection rules JSON would be shared separately with the required teams as a part of separate repository.
Since during the standard attribute remapping we are not preserving the source attributes as per suggested best practices, it would result in filters using these standard attributes populating the values of other integrations as well as per current Datadog behaviour.

Review checklist (to be filled by reviewers)

Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

domalessi

Left a few suggestions. Tag me or re-request review when ready for another look!

domalessi · 2026-04-29T20:28:18Z

+- IP
+- Domain
+
+Integrate SpyCloud with Datadog to enhance your security logs with threat intelligence, enabling analysis of matched IOCs through pre-built dashboards. Additionally, the integration can be used for Cloud SIEM detection rules for enhanced monitoring and security.


Tightening:

Suggested change

Integrate SpyCloud with Datadog to enhance your security logs with threat intelligence, enabling analysis of matched IOCs through pre-built dashboards. Additionally, the integration can be used for Cloud SIEM detection rules for enhanced monitoring and security.

Integrate SpyCloud with Datadog to enrich your security logs with threat intelligence and analyze matched IOCs through pre-built dashboards. The integration also feeds Cloud SIEM detection rules.

domalessi · 2026-04-29T20:28:19Z

+
+## Setup
+
+### Obtain an API Key from SpyCloud Platform


Headings use sentence case. Also, this heading says "SpyCloud Platform" but step 1 below points users to the "SpyCloud Customer Portal" — let's keep them consistent.

Suggested change

### Obtain an API Key from SpyCloud Platform

### Obtain an API key from the SpyCloud Customer Portal

Updated the PR.

domalessi · 2026-04-29T20:28:19Z

+
+### Connect your SpyCloud account to Datadog
+
+1. Provide following details.


Missing article ("the") and use a colon to introduce the table.

Suggested change

1. Provide following details.

1. Provide the following details:

Updated the PR.

domalessi · 2026-04-29T20:28:19Z

+   | Parameter | Description |
+   | ---------- | ---------------------------------------------- |
+   | API Key | The API Key of your SpyCloud account. |
+   | Collect IP IOCs | Enable to collect IP IOCs. The default value is true. |


"The default value is true" reads like a config-file value, but in the UI this is a toggle. Suggest "Enabled by default" for clarity.

Suggested change

| Collect IP IOCs | Enable to collect IP IOCs. The default value is true. |

| Collect IP IOCs | Enable to collect IP IOCs. Enabled by default. |

domalessi · 2026-04-29T20:28:19Z

+   | ---------- | ---------------------------------------------- |
+   | API Key | The API Key of your SpyCloud account. |
+   | Collect IP IOCs | Enable to collect IP IOCs. The default value is true. |
+   | Collect Domain IOCs | Enable to collect Domain IOCs. The default value is true. |


domalessi · 2026-04-29T20:28:19Z

+
+## Troubleshooting
+
+Need help? Contact  [Datadog support](https://docs.datadoghq.com/help/).


Double space between "Contact" and the link.

Suggested change

Need help? Contact [Datadog support](https://docs.datadoghq.com/help/).

Need help? Contact [Datadog support](https://docs.datadoghq.com/help/).

domalessi

Thanks for the fixes! Left some more tweaks inline, but should be good to go after that. Two high-level things:

Consider adding a brief Data Collected note

This integration doesn't submit metrics, service checks, or events, so it doesn't need the full Data Collected section from the standard template. That said, the convention is to state explicitly that none are collected, for example:

## Data Collected

The SpyCloud integration does not include any metrics, service checks, or events.

Optional, but it makes the README consistent with other integrations and answers a question users often ask.

display_on_public_website: false

Flagging this for awareness — the integration is not yet rendering on the public docs site. If that's intentional for this initial release, no action needed; just confirming we haven't missed flipping it.

domalessi · 2026-04-30T19:31:08Z

+
+1. Log in to your SpyCloud Customer Portal.
+2. Navigate to the **API** tab in the sidebar.
+3. In the **Keys** section, copy the **API Key**.


Datadog style uses lowercase "API key" since it's not a proper noun. (Same applies in line 23.)

Suggested change

3. In the **Keys** section, copy the **API Key**.

3. In the **Keys** section, copy the **API key**.

domalessi · 2026-04-30T19:31:08Z

+1. Provide the following details:
+   | Parameter | Description |
+   | ---------- | ---------------------------------------------- |
+   | API Key | The API Key of your SpyCloud account. |


domalessi · 2026-04-30T19:31:08Z

+
+### Connect your SpyCloud account to Datadog
+
+1. Provide the following details:


Step 1 doesn't tell the user where they are. Add a brief orienting phrase so it's clear they should be on the SpyCloud integration tile in Datadog.

Suggested change

1. Provide the following details:

1. In Datadog, on the SpyCloud integration tile, provide the following details:

domalessi · 2026-04-30T19:31:08Z

+   | Parameter | Description |
+   | ---------- | ---------------------------------------------- |
+   | API Key | The API Key of your SpyCloud account. |
+   | Collect IP IOCs | Enable to collect IP IOCs. Enabled by default. |


The description "Enable to collect IP IOCs" repeats the parameter name. "Whether to..." is a clearer pattern for a toggle setting.

Suggested change

| Collect IP IOCs | Enable to collect IP IOCs. Enabled by default. |

| Collect IP IOCs | Whether to collect IP IOCs from SpyCloud. Enabled by default. |

domalessi · 2026-04-30T19:31:08Z

+   | ---------- | ---------------------------------------------- |
+   | API Key | The API Key of your SpyCloud account. |
+   | Collect IP IOCs | Enable to collect IP IOCs. Enabled by default. |
+   | Collect Domain IOCs | Enable to collect Domain IOCs. Enabled by default. |


domalessi · 2026-04-30T19:31:09Z

+                    {
+                        "id": 5986136339683419,
+                        "definition": {
+                            "title": "CRITICALs",


Sentence case for widget titles.

Also, pluralizing all-caps tokens with a lowercase "s" ("CRITICALs") is grammatically awkward. Same applies to lines 1437, 1561, 1614, and 1667 (separate suggestions on each).

Suggested change

"title": "CRITICALs",

"title": "Critical signals",

domalessi · 2026-04-30T19:31:09Z

+                    {
+                        "id": 6559980888525287,
+                        "definition": {
+                            "title": "HIGHs",


Suggested change

"title": "HIGHs",

"title": "High signals",

domalessi · 2026-04-30T19:31:09Z

+                    {
+                        "id": 2114682197371367,
+                        "definition": {
+                            "title": "MEDIUMs",


Suggested change

"title": "MEDIUMs",

"title": "Medium signals",

domalessi · 2026-04-30T19:31:09Z

+                    {
+                        "id": 1150500876952374,
+                        "definition": {
+                            "title": "LOWs",


Suggested change

"title": "LOWs",

"title": "Low signals",

domalessi · 2026-04-30T19:31:09Z

+                    {
+                        "id": 3077932004771300,
+                        "definition": {
+                            "title": "INFOs",


Suggested change

"title": "INFOs",

"title": "Info signals",

domalessi

A few nits I missed last time but this is looking good! Approving so you're not blocked on me :)

domalessi · 2026-05-04T18:52:36Z

+                    {
+                        "id": 6044605789288649,
+                        "definition": {
+                            "title": "Critical Security Signals",


Suggested change

"title": "Critical Security Signals",

"title": "Critical security signals",

domalessi · 2026-05-04T18:52:50Z

+                    {
+                        "id": 1784805821887938,
+                        "definition": {
+                            "title": "High Security Signals",


Suggested change

"title": "High Security Signals",

"title": "High security signals",

domalessi · 2026-05-04T18:53:01Z

+                    {
+                        "id": 6427496511993500,
+                        "definition": {
+                            "title": "Medium Security Signals",


Suggested change

"title": "Medium Security Signals",

"title": "Medium security signals",

domalessi · 2026-05-04T18:53:35Z

+- IP
+- Domain
+
+Integrate SpyCloud with Datadog to enrich your security logs with threat intelligence and analyze matched IOCs through pre-built dashboards. The integration also feeds Cloud SIEM detection rules.


Suggested change

Integrate SpyCloud with Datadog to enrich your security logs with threat intelligence and analyze matched IOCs through pre-built dashboards. The integration also feeds Cloud SIEM detection rules.

Integrate SpyCloud with Datadog to enrich your security logs with threat intelligence and analyze matched indicators of compromise (IOCs) through pre-built dashboards. The integration also feeds Cloud SIEM detection rules.

jaypatel7-crest added 3 commits April 29, 2026 12:51

Add SpyCloud threat intel integration without assets

c93cb18

Merge branch 'master' into spycloud-without-assets-v1.0.0

fd095fd

Add SpyCloud threat intel integration without assets

7079d72

temporal-github-worker-1 Bot added docs/review-requested ecosystems/review-requested product/review-requested labels Apr 29, 2026

dd-octo-sts Bot added documentation dev/testing dev/tooling labels Apr 29, 2026

Updated manifest.json

2a1f28a

jaypatel7-crest marked this pull request as ready for review April 29, 2026 10:59

jaypatel7-crest requested review from a team as code owners April 29, 2026 10:59

dd-octo-sts Bot added team/agent-integrations team/documentation team/saas-integrations labels Apr 29, 2026

domalessi self-assigned this Apr 29, 2026

domalessi reviewed Apr 29, 2026

View reviewed changes

jaypatel7-crest added 2 commits April 30, 2026 09:01

Addressed review comments

ba78087

Merge branch 'master' into spycloud-assets-v1.0.0

78012cd

jaypatel7-crest requested a review from domalessi April 30, 2026 03:34

domalessi reviewed Apr 30, 2026

View reviewed changes

Addressed review comments

654d953

domalessi reviewed May 4, 2026

View reviewed changes

jaypatel7-crest added 2 commits May 5, 2026 10:08

Addressed review comments

0bbe864

Merge branch 'master' into spycloud-assets-v1.0.0

9443ec4

jaypatel7-crest requested a review from domalessi May 5, 2026 04:42

domalessi approved these changes May 5, 2026

View reviewed changes

temporal-github-worker-1 Bot added the docs/approved label May 5, 2026

temporal-github-worker-1 Bot removed the docs/review-requested label May 5, 2026

	Integrate SpyCloud with Datadog to enhance your security logs with threat intelligence, enabling analysis of matched IOCs through pre-built dashboards. Additionally, the integration can be used for Cloud SIEM detection rules for enhanced monitoring and security.
	Integrate SpyCloud with Datadog to enrich your security logs with threat intelligence and analyze matched IOCs through pre-built dashboards. The integration also feeds Cloud SIEM detection rules.

	### Obtain an API Key from SpyCloud Platform
	### Obtain an API key from the SpyCloud Customer Portal


		### Connect your SpyCloud account to Datadog

		1. Provide following details.

	1. Provide following details.
	1. Provide the following details:

	\| Collect IP IOCs \| Enable to collect IP IOCs. The default value is true. \|
	\| Collect IP IOCs \| Enable to collect IP IOCs. Enabled by default. \|

	\| Collect Domain IOCs \| Enable to collect Domain IOCs. The default value is true. \|
	\| Collect Domain IOCs \| Enable to collect Domain IOCs. Enabled by default. \|


		## Troubleshooting

		Need help? Contact [Datadog support](https://docs.datadoghq.com/help/). No newline at end of file

	3. In the Keys section, copy the API Key.
	3. In the Keys section, copy the API key.

	\| API Key \| The API Key of your SpyCloud account. \|
	\| API key \| The API key for your SpyCloud account. \|

	1. Provide the following details:
	1. In Datadog, on the SpyCloud integration tile, provide the following details:

	\| Collect IP IOCs \| Enable to collect IP IOCs. Enabled by default. \|
	\| Collect IP IOCs \| Whether to collect IP IOCs from SpyCloud. Enabled by default. \|

	\| Collect Domain IOCs \| Enable to collect Domain IOCs. Enabled by default. \|
	\| Collect Domain IOCs \| Whether to collect domain IOCs from SpyCloud. Enabled by default. \|

	"title": "Critical Security Signals",
	"title": "Critical security signals",

	"title": "High Security Signals",
	"title": "High security signals",

	"title": "Medium Security Signals",
	"title": "Medium security signals",

Conversation

jaypatel7-crest commented Apr 29, 2026

What does this PR do?

Integration Logo Source

Additional Notes

Review checklist (to be filled by reviewers)

Uh oh!

domalessi left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

domalessi left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

domalessi left a comment

Choose a reason for hiding this comment

domalessi left a comment •

edited

Loading