Skip to content

[SEC-27721]: Add SIEM category to integrations #3002

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
2uent1n wants to merge 2 commits into
base: master
Choose a base branch
from
Open

[SEC-27721]: Add SIEM category to integrations #3002

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
606ab6b
[SEC-27721]: Add SIEM category to integrations
2uent1n May 7, 2026
17a2a3d
Merge branch 'master' into quentin.blin/sec-27721-add-siem-category
2uent1n May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions auth0/manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
"Category::Incidents",
"Category::Log Collection",
"Category::Security",
"Category::SIEM",
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Remove unsupported SIEM classifier tag

The validation workflow runs metadata validation for manifests, and Datadog's Integration Assets Reference says the classifier tag list is complete but does not include Category::SIEM; adding this tag here (and in the other manifests in this commit) will cause the new metadata to be rejected rather than placing the integrations in a SIEM category. Please use an allowed classifier, or add the new taxonomy upstream before referencing it in these manifests.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Collaborator Author

@2uent1n 2uent1n May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@codex where is that classifier tag list defined? https://datadoghq.atlassian.net/browse/IXP-742 and associated tickets should have handled this long ago

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It’s not defined in this repo as a centralized list.

What I can confirm from the codebase:

  • auth0/manifest.json only uses the classifier tags ("Category::SIEM" is just a string entry in classifier_tags), it does not define allowed values. auth0/manifest.jsonL21-L26
  • Other integrations in this same repo also use "Category::SIEM" the same way (again, as plain manifest strings), which suggests validation is controlled upstream, not by a local enum/table in this repository. zscaler/manifest.jsonL56-L62

So the “source of truth” for allowed classifier tags is in the upstream Integration Assets taxonomy/validator, not in integrations-extras. If you want, I can follow up by pointing to the exact upstream file in the other repo where the allowed list is enforced.

View task →

"Supported OS::Linux",
"Supported OS::Windows",
"Supported OS::macOS",
Expand Down
3 changes: 2 additions & 1 deletion bind9/manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@
"Category::Network",
"Category::Log Collection",
"Category::Metrics",
"Category::SIEM",
"Offering::Integration",
"Submitted Data Type::Logs",
"Submitted Data Type::Metrics"
Expand Down Expand Up @@ -74,4 +75,4 @@
"source": "bind9"
}
}
}
}
1 change: 1 addition & 0 deletions f5-distributed-cloud/manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@
"Category::Network",
"Category::Notifications",
"Category::Security",
"Category::SIEM",
"Offering::Integration",
"Supported OS::Linux",
"Supported OS::Windows",
Expand Down
3 changes: 2 additions & 1 deletion jamf_protect/manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
"Supported OS::Windows",
"Supported OS::macOS",
"Category::Security",
"Category::SIEM",
"Offering::Integration"
],
"media": []
Expand All @@ -41,4 +42,4 @@
"jamf-protect-overview": "assets/dashboards/jamf_protect_overview.json"
}
}
}
}
3 changes: 2 additions & 1 deletion sigsci/manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
"Supported OS::macOS",
"Supported OS::Windows",
"Category::Security",
"Category::SIEM",
"Offering::Integration"
],
"resources": [
Expand Down Expand Up @@ -57,4 +58,4 @@
"Firewall is blocking a high number of requests": "assets/monitors/excessiveblockedHTTP.json"
}
}
}
}
3 changes: 2 additions & 1 deletion tailscale/manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
"Category::Security",
"Category::Log Collection",
"Category::Network",
"Category::SIEM",
"Submitted Data Type::Logs",
"Offering::Integration"
],
Expand Down Expand Up @@ -56,4 +57,4 @@
"homepage": "https://www.datadoghq.com",
"sales_email": "info@datadoghq.com"
}
}
}
3 changes: 2 additions & 1 deletion zscaler/manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,7 @@
"Category::Log Collection",
"Category::Network",
"Category::Security",
"Category::SIEM",
"Supported OS::Linux",
"Supported OS::Windows",
"Supported OS::macOS",
Expand Down Expand Up @@ -101,4 +102,4 @@
"source": "zscaler"
}
}
}
}
Loading