monitoring_integration_configs

Creates, updates, deletes, gets or lists a monitoring_integration_configs resource.

Overview

Name	monitoring_integration_configs
Type	Resource
Id	datadog.security.monitoring_integration_configs

Fields

The following fields are returned by SELECT queries:

get_security_monitoring_integration_config

Name	Datatype	Description
id	string	The unique identifier of the integration configuration. (example: 11111111-2222-3333-4444-555555555555)
attributes	object	The attributes of an entity context sync configuration as returned by the API.
type	string	The type of the resource. The value should always be integration_config. (integration_config) (default: integration_config, example: integration_config)

list_security_monitoring_integration_configs

Name	Datatype	Description
id	string	The unique identifier of the integration configuration. (example: 11111111-2222-3333-4444-555555555555)
attributes	object	The attributes of an entity context sync configuration as returned by the API.
type	string	The type of the resource. The value should always be integration_config. (integration_config) (default: integration_config, example: integration_config)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_security_monitoring_integration_config	select	integration_config_id		Get the details of a specific entity context sync configuration.
list_security_monitoring_integration_configs	select		filter[integration_type]	List the entity context sync configurations for Cloud SIEM. Each configuration connects Cloud SIEM<br />to an external source that provides entities (for example, users from an identity provider) for use<br />in signals and the entity explorer.
create_security_monitoring_integration_config	insert	data		Create a new entity context sync configuration so Cloud SIEM can ingest entities from an external<br />source. The credentials provided in secrets are validated against the source before the configuration<br />is stored and never returned in subsequent responses.
update_security_monitoring_integration_config	update	integration_config_id, data		Update an existing entity context sync configuration. Supports partial updates; only the fields provided in the request body are modified.
delete_security_monitoring_integration_config	delete	integration_config_id		Delete an entity context sync configuration. Cloud SIEM stops ingesting entities from this source,<br />and the credentials stored for the configuration are removed from the secrets store.
validate_security_monitoring_integration_credentials	exec	data		Validate a set of credentials against the external entity source before creating a sync configuration.<br />Returns a 200 status code if the credentials are valid.
validate_security_monitoring_integration_config	exec	integration_config_id		Validate the credentials currently stored on an existing entity context sync configuration.<br />Returns a 200 status code if the credentials are still valid against the external entity source.
activate_integration	exec	integration_type		Activate an entity context sync integration for a source type that does not require manually<br />supplied credentials (for example, Entra ID). If an integration of this type already exists,<br />it is returned (re-enabling it first if it was disabled) instead of creating a duplicate.
deactivate_integration	exec	integration_type		Deactivate all active entity context sync integrations of the given source type (for example, Entra ID).

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
integration_config_id	string	The ID of the entity context sync configuration.
integration_type	string	The integration type to deactivate (for example, entra_id).
site	string	The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both.
filter[integration_type]	string	Filter the entity context sync configurations by source type.

SELECT examples

get_security_monitoring_integration_config

Get the details of a specific entity context sync configuration.

SELECT
id,
attributes,
type
FROM datadog.security.monitoring_integration_configs
WHERE integration_config_id = '{{ integration_config_id }}' -- required
;

list_security_monitoring_integration_configs

List the entity context sync configurations for Cloud SIEM. Each configuration connects Cloud SIEM<br />to an external source that provides entities (for example, users from an identity provider) for use<br />in signals and the entity explorer.

SELECT
id,
attributes,
type
FROM datadog.security.monitoring_integration_configs
WHERE filter[integration_type] = '{{ filter[integration_type] }}'
;

INSERT examples

create_security_monitoring_integration_config

Create a new entity context sync configuration so Cloud SIEM can ingest entities from an external<br />source. The credentials provided in secrets are validated against the source before the configuration<br />is stored and never returned in subsequent responses.

INSERT INTO datadog.security.monitoring_integration_configs (
data
)
SELECT 
'{{ data }}' /* required */
RETURNING
data
;

Manifest

# Description fields are for documentation purposes
- name: monitoring_integration_configs
props:
  - name: data
    description: |
      The entity context sync configuration to create.
    value:
      attributes:
        domain: "{{ domain }}"
        integration_type: "{{ integration_type }}"
        name: "{{ name }}"
        secrets:
          admin_email: "{{ admin_email }}"
          service_account_json:
            client_email: "{{ client_email }}"
            private_key: "{{ private_key }}"
            project_id: "{{ project_id }}"
            type: "{{ type }}"
        settings: "{{ settings }}"
      type: "{{ type }}"

UPDATE examples

update_security_monitoring_integration_config

Update an existing entity context sync configuration. Supports partial updates; only the fields provided in the request body are modified.

UPDATE datadog.security.monitoring_integration_configs
SET 
data = '{{ data }}'
WHERE 
integration_config_id = '{{ integration_config_id }}' --required
AND data = '{{ data }}' --required
RETURNING
data;

DELETE examples

delete_security_monitoring_integration_config

Delete an entity context sync configuration. Cloud SIEM stops ingesting entities from this source,<br />and the credentials stored for the configuration are removed from the secrets store.

DELETE FROM datadog.security.monitoring_integration_configs
WHERE integration_config_id = '{{ integration_config_id }}' --required
;

Lifecycle Methods

EXEC variables use wire (API) names.

validate_security_monitoring_integration_credentials

Validate a set of credentials against the external entity source before creating a sync configuration.<br />Returns a 200 status code if the credentials are valid.

EXEC datadog.security.monitoring_integration_configs.validate_security_monitoring_integration_credentials 
@@json=
'{
"data": "{{ data }}"
}'
;

validate_security_monitoring_integration_config

Validate the credentials currently stored on an existing entity context sync configuration.<br />Returns a 200 status code if the credentials are still valid against the external entity source.

EXEC datadog.security.monitoring_integration_configs.validate_security_monitoring_integration_config 
@integration_config_id='{{ integration_config_id }}' --required 
;

activate_integration

Activate an entity context sync integration for a source type that does not require manually<br />supplied credentials (for example, Entra ID). If an integration of this type already exists,<br />it is returned (re-enabling it first if it was disabled) instead of creating a duplicate.

EXEC datadog.security.monitoring_integration_configs.activate_integration 
@integration_type='{{ integration_type }}' --required, 
@@json=
'{
"data": "{{ data }}"
}'
;

deactivate_integration

Deactivate all active entity context sync integrations of the given source type (for example, Entra ID).

EXEC datadog.security.monitoring_integration_configs.deactivate_integration 
@integration_type='{{ integration_type }}' --required 
;