Add SpoofSentry integration by netallion · Pull Request #2963 · DataDog/integrations-extras

netallion · 2026-04-09T10:25:13Z

What does this PR do?

Adds a new integration for SpoofSentry by DomainSeal — a DMARC monitoring, domain spoofing detection, and automated takedown platform.

SpoofSentry sends domain security events to Datadog via the Logs API (HTTP intake).

Includes:

Integration tile with manifest and classifier tags (Security, Log Collection, Notifications)
Pre-built dashboard (7 widgets: event counts, severity timeseries, threat toplist, domain breakdown, takedown activity, log stream)
Log pipeline with attribute remapping
Setup documentation (README rendered in Datadog UI)

Motivation

SpoofSentry protects domains from email spoofing, phishing impersonation, and lookalike domain abuse. Security teams using Datadog need these events alongside their other security data for centralized analysis, correlation, and alerting.

Review checklist

PR has a meaningful title
Feature or bugfix has tests
Git history is clean
If PR impacts documentation, docs team has been notified
If this PR includes a log pipeline, please add a description describing the remappers and processors.

Log Pipeline Description

The log pipeline (assets/logs/spoofsentry.yaml) includes these processors:

Attribute remapper: eventType → evt.name (event classification)
Attribute remapper: severity → status (log level mapping)
Attribute remapper: domain → network.destination.domain (target domain)
Attribute remapper: tenantId → usr.id (customer tenant)
Category processor: Maps severity values (critical, high, medium, low, info) to named categories

Additional Notes

Source: spoofsentry (ddsource tag)
Auth: DD-API-KEY header
Multi-site: datadoghq.com (US), datadoghq.eu (EU)
Event types: DMARC failures, spoofing campaigns, lookalike domains, DNS enforcement changes, takedown orchestration lifecycle
Author: DomainSeal (https://spoofsentry.com)
Support: hello@spoofsentry.com

…d takedown events SpoofSentry by DomainSeal sends domain security events to Datadog via the Logs API. Includes: - Integration tile with manifest and classifier tags - Pre-built dashboard (7 widgets: event counts, severity timeseries, threat toplist, domain breakdown, takedown activity, log stream) - Log pipeline with attribute remapping (eventType, severity, domain, tenantId) - Setup documentation Event types: DMARC failures, spoofing campaigns, lookalike domains, DNS enforcement changes, takedown orchestration lifecycle. Severity levels: critical, high, medium, low, info Sourcetype: spoofsentry (ddsource tag) Auth: DD-API-KEY header Multi-site: datadoghq.com (US), datadoghq.eu (EU)

cswatt · 2026-04-09T17:00:52Z

Added DOCS-13959 to track docs review

dd-dominic · 2026-04-13T21:12:57Z

@netallion Your organization will need to onboard as a Technology Partner. Please reach out to ecosystems@datadoghq.com and reference this PR.

domalessi · 2026-04-14T21:34:50Z

+  "tile": {
+    "overview": "README.md#Overview",
+    "configuration": "README.md#Setup",
+    "uninstallation": "README.md#Uninstallation",


The manifest references README.md#Uninstallation, but the README doesn't include an ## Uninstallation section. Please add one. For a log-based integration, this can be brief — for example:

## Uninstallation Remove the SpoofSentry integration from **Integrations > Integrations**.

domalessi · 2026-04-14T21:35:58Z

+    "uninstallation": "README.md#Uninstallation",
+    "support": "README.md#Support",
+    "changelog": "CHANGELOG.md",
+    "description": "Ingest DMARC monitoring, spoofing detection, and takedown events from SpoofSentry",


This description is 81 characters, which exceeds the 80-character limit for tile descriptions. Trim slightly — for example:

Suggested change

"description": "Ingest DMARC monitoring, spoofing detection, and takedown events from SpoofSentry",

"description": "DMARC monitoring, spoofing detection, and takedown events from SpoofSentry",

domalessi · 2026-04-14T21:38:02Z

+
+### Log Pipeline
+
+A log pipeline is included that:


Suggested change

A log pipeline is included that:

The integration includes a log pipeline that:

domalessi · 2026-04-14T21:38:14Z

+
+### Logs
+
+SpoofSentry sends domain security events as JSON logs via the Datadog Logs API.


Suggested change

SpoofSentry sends domain security events as JSON logs via the Datadog Logs API.

SpoofSentry sends domain security events as JSON logs through the Datadog Logs API.

domalessi · 2026-04-14T21:45:58Z

+## Support
+
+- Email: hello@spoofsentry.com
+- Documentation: [https://spoofsentry.com/docs/integrations/datadog](https://spoofsentry.com/docs/integrations/datadog)
+- Status: [https://spoofsentry.com/status](https://spoofsentry.com/status)


The Support section for integrations-extras typically points directly to the creator's support contact. The Documentation: and Status: list items are non-standard here — consider simplifying to match the convention used by other integrations, and folding the docs link into the Setup section if it's useful there:

Suggested change

## Support

- Email: hello@spoofsentry.com

- Documentation: [https://spoofsentry.com/docs/integrations/datadog](https://spoofsentry.com/docs/integrations/datadog)

- Status: [https://spoofsentry.com/status](https://spoofsentry.com/status)

## Support

Need help? Contact [SpoofSentry support](mailto:hello@spoofsentry.com).

domalessi · 2026-04-14T21:46:26Z

+    {
+      "id": 1,
+      "definition": {
+        "title": "Security Events (24h)",


The (24h) suffix implies a fixed time window, but this widget uses the dashboard's time selector. Consider removing it or renaming to reflect the dynamic range, for example "Security Events".

domalessi · 2026-04-14T21:46:45Z

+    {
+      "id": 2,
+      "definition": {
+        "title": "Critical & High Threats (24h)",


Same as above — the (24h) suffix is misleading since the time range is controlled by the dashboard selector. Consider "Critical & High Threats".

domalessi · 2026-04-14T21:49:24Z

+                "indexes": ["*"],
+                "compute": { "aggregation": "count" },
+                "group_by": [
+                  { "facet": "host", "limit": 10, "sort": { "aggregation": "count", "order": "desc" } }


The "Events by Domain" widget groups by host, but the log pipeline maps domain to @network.destination.domain. Please verify that host is populated with the monitored domain — if not, this facet should likely be @network.destination.domain or @domain.

domalessi

Editorial review — SpoofSentry integration

Thanks for the submission! The integration looks well structured overall. A few things to address before this can be approved:

Blocking

The manifest references README.md#Uninstallation but the README has no ## Uninstallation section. Add a brief one (see inline comment on manifest.json).

Must fix

Missing Validation subsection: Add a ### Validation step under ## Setup explaining how users can confirm the integration is working — for example, by navigating to Logs and filtering by source:spoofsentry.
Missing Data Collected subsections: The README is missing ### Metrics, ### Service Checks, and ### Events under ## Data Collected. Each should include a statement such as "The SpoofSentry integration does not include any metrics." See the standard README template for reference.

See inline comments for additional must-fix and suggestion items.

domalessi · 2026-04-14T21:54:56Z

+1. Log in to [SpoofSentry](https://spoofsentry.com)
+2. Go to **Settings > Integrations > SIEM**
+3. Select **Datadog**
+4. Enter your **Datadog API key** (from Datadog > Organization Settings > API Keys)
+5. Select your **Datadog site** (US: `datadoghq.com`, EU: `datadoghq.eu`)
+6. Click **Test Connection** to verify


Suggested change

1. Log in to [SpoofSentry](https://spoofsentry.com)

2. Go to **Settings > Integrations > SIEM**

3. Select **Datadog**

4. Enter your **Datadog API key** (from Datadog > Organization Settings > API Keys)

5. Select your **Datadog site** (US: `datadoghq.com`, EU: `datadoghq.eu`)

6. Click **Test Connection** to verify

1. Log in to [SpoofSentry](https://spoofsentry.com).

2. Go to **Settings > Integrations > SIEM**.

3. Select **Datadog**.

4. Enter your **Datadog API key** (from Datadog > Organization Settings > API Keys).

5. Select your **Datadog site** (US: `datadoghq.com`, EU: `datadoghq.eu`).

6. Click **Test Connection** to verify,

domalessi · 2026-04-14T22:00:22Z

+
+### In Datadog
+
+Events appear automatically in **Logs** with `source:spoofsentry`. The pre-built dashboard is installed with this integration.


Suggested change

Events appear automatically in **Logs** with `source:spoofsentry`. The pre-built dashboard is installed with this integration.

Events appear automatically in **Logs** with `source:spoofsentry`. A prebuilt dashboard is installed with this integration.

domalessi · 2026-04-14T22:01:46Z

+
+### In SpoofSentry
+
+1. Log in to [SpoofSentry](https://spoofsentry.com)


Integration READMEs conventionally use reference-style links (e.g., [SpoofSentry][1] with [1]: https://spoofsentry.com at the bottom of the file) rather than inline URLs. Consider converting all links in this README to that format for consistency with the standard template.

domalessi · 2026-04-14T22:02:05Z

+
+| Field | Description |
+|-------|-------------|
+| `eventType` | Event classification (e.g., `SPOOF_THREAT_DETECTED`) |


domalessi · 2026-04-14T22:02:19Z

+
+### Tags
+
+All events include these tags:


Suggested change

All events include these tags:

All events include the following tags:

domalessi

A few inline suggestions but nothing blocking. Approved!

domalessi · 2026-05-04T19:20:45Z

+
+The integration includes a log pipeline that:
+- Maps `eventType` to `evt.name`
+- Maps `severity` to log status


Is "log status" an attribute name? Ideally, this bullet would be parallel with the first and third bullets which include an attribute name.

domalessi · 2026-05-04T19:21:29Z

+    {
+      "id": 1,
+      "definition": {
+        "title": "Security Events",


Suggested change

"title": "Security Events",

"title": "Security events",

domalessi · 2026-05-04T19:21:38Z

+    {
+      "id": 2,
+      "definition": {
+        "title": "Critical & High Threats",


Suggested change

"title": "Critical & High Threats",

"title": "Critical and high threats",

domalessi · 2026-05-04T19:21:46Z

+    {
+      "id": 3,
+      "definition": {
+        "title": "Events by Severity",


Suggested change

"title": "Events by Severity",

"title": "Events by severity",

domalessi · 2026-05-04T19:21:52Z

+    {
+      "id": 4,
+      "definition": {
+        "title": "Events by Type",


Suggested change

"title": "Events by Type",

"title": "Events by type",

domalessi · 2026-05-04T19:21:58Z

+    {
+      "id": 5,
+      "definition": {
+        "title": "Events by Domain",


Suggested change

"title": "Events by Domain",

"title": "Events by domain",

domalessi · 2026-05-04T19:22:04Z

+    {
+      "id": 6,
+      "definition": {
+        "title": "Takedown Activity",


Suggested change

"title": "Takedown Activity",

"title": "Takedown activity",

domalessi · 2026-05-04T19:22:12Z

+    {
+      "id": 7,
+      "definition": {
+        "title": "Recent Security Events",


Suggested change

"title": "Recent Security Events",

"title": "Recent security events",

domalessi · 2026-05-04T19:22:50Z

@@ -0,0 +1,160 @@
+{
+  "title": "SpoofSentry - Domain Security Overview",


Suggested change

"title": "SpoofSentry - Domain Security Overview",

"title": "SpoofSentry: Domain Security Overview",

netallion requested review from a team as code owners April 9, 2026 10:25

cswatt added the editorial review Waiting on a more in-depth review from a docs team editor label Apr 9, 2026

netallion added 2 commits April 13, 2026 13:21

fix: correct app_uuid, logs asset structure, add integration block

9ed6180

add empty service_checks.json

7eb8ce6

dd-dominic added the product/HOLD label Apr 13, 2026

domalessi reviewed Apr 14, 2026

View reviewed changes

domalessi requested changes Apr 14, 2026

View reviewed changes

domalessi reviewed Apr 14, 2026

View reviewed changes

netallion added 3 commits April 16, 2026 19:01

fix: address editorial review — README restructure

a9e83e0

fix: remove (24h) suffixes, use @network.destination.domain facet

5d64ac3

fix: trim tile description to under 80 chars

a3da5fa

domalessi approved these changes May 4, 2026

View reviewed changes

	"description": "Ingest DMARC monitoring, spoofing detection, and takedown events from SpoofSentry",
	"description": "DMARC monitoring, spoofing detection, and takedown events from SpoofSentry",

	A log pipeline is included that:
	The integration includes a log pipeline that:


		### Logs

		SpoofSentry sends domain security events as JSON logs via the Datadog Logs API.


		### In Datadog

		Events appear automatically in Logs with `source:spoofsentry`. The pre-built dashboard is installed with this integration.


		### In SpoofSentry

		1. Log in to [SpoofSentry](https://spoofsentry.com)

	\| `eventType` \| Event classification (e.g., `SPOOF_THREAT_DETECTED`) \|
	\| `eventType` \| Event classification (for example, `SPOOF_THREAT_DETECTED`) \|

	All events include these tags:
	All events include the following tags:

	"title": "Critical & High Threats",
	"title": "Critical and high threats",

	"title": "Events by Severity",
	"title": "Events by severity",

	"title": "Recent Security Events",
	"title": "Recent security events",

		@@ -0,0 +1,160 @@
		{
		"title": "SpoofSentry - Domain Security Overview",

	"title": "SpoofSentry - Domain Security Overview",
	"title": "SpoofSentry: Domain Security Overview",

Conversation

netallion commented Apr 9, 2026

What does this PR do?

Motivation

Review checklist

Log Pipeline Description

Additional Notes

Uh oh!

cswatt commented Apr 9, 2026

Uh oh!

dd-dominic commented Apr 13, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

domalessi left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

domalessi left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants