[SAASINT-4304] DDS: BeyondTrust Identity Security Insights v1.0.0 #20642

tirthrajchaudhari-crest · 2025-07-02T13:38:24Z

What does this PR do?

This is a initial release PR of BeyondTrust Identity Security Insights integration including all the required assets i.e. Pipeline, Dashboards

Additional Notes

This integration is webhook based so Crawler will not be used.
The Datadog team will implement the appropriate component for generating URLs. A URL will be created having the ddsource query parameter set to beyondtrust-identity-security-insights.

Review checklist (to be filled by reviewers)

Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

maycmlee · 2025-07-02T16:31:27Z

Created DOCS-11399 for review

iadjivon

Hi there, thanks for opening a PR with Datadog. I am reviewing some files on behalf of the documentation team. I have made some edit recommendations here. Let me know what you think or if you have any questions.

iadjivon · 2025-07-07T21:13:27Z

beyondtrust_identity_security_insights/README.md

+
+[BeyondTrust Identity Security Insights][1] is a web-based application designed to enhance identity protection. It connects BeyondTrust products and third-party services to automatically scan for associated accounts and track your organization's identities.
+
+Integrate BeyondTrust Identity Security Insights with Datadog to gain insights into Detections Logs using pre-built dashboard visualizations. Datadog leverages its built-in log pipelines to parse and enrich these logs, facilitating easy search and detailed insights. Additionally, integration includes ready-to-use Cloud SIEM detection rules for enhanced monitoring and security which in turn can also be used with [Datadog Workflow Automation][5] leveraging OOTB Workflow Blueprints to orchestrate and automate your end-to-end processes.


Suggested change

Integrate BeyondTrust Identity Security Insights with Datadog to gain insights into Detections Logs using pre-built dashboard visualizations. Datadog leverages its built-in log pipelines to parse and enrich these logs, facilitating easy search and detailed insights. Additionally, integration includes ready-to-use Cloud SIEM detection rules for enhanced monitoring and security which in turn can also be used with [Datadog Workflow Automation][5] leveraging OOTB Workflow Blueprints to orchestrate and automate your end-to-end processes.

Integrate BeyondTrust Identity Security Insights with Datadog's pre-built dashboard visualizations to gain insights into detection logs. With Datadog's built-in log pipelines, you can parse and enrich these logs to facilitate easy search and detailed insights.

This integration also includes ready-to-use Cloud SIEM detection rules for enhanced monitoring and security. These Cloud SIEM rules can be used with [Datadog Workflow Automation][5] to orchestrate and automate your end-to-end processes with OOTB Workflow Blueprints.

Are Detection Logs something specific that may be linked? If they are not, using the sentence case here should suffice.

Do these edits keep the meaning?

iadjivon · 2025-07-07T21:18:27Z

beyondtrust_identity_security_insights/README.md

+
+### Configuration
+
+#### Webhook Configuration


Suggested change

#### Webhook Configuration

The set up seems slightly different here: https://docs.beyondtrust.com/entitle/docs/datadog. Are there other types of set up or configuration to be added to this section?

If not, I'd recommend removing the configuration and `webhook configuration headings as everything below is simply the set-up step. Let me know what you think.

The document you are referring to is for a different BeyondTrust product, which is Entitle. Hence, we need to keep this configuration section.

Hi @tirthrajchaudhari-crest, thanks for this information and apologies for my confusing the two products.

Thanks also for the clarification on the nested headers. From a documentation structure and usability standpoint, minimizing header depth tends to improve readability and scannability — especially when there's just one configuration type under Setup.

Right now, having both ### Configuration and #### Webhook Configuration introduces extra layers that may not be necessary. Flattening everything under a single ## Setup heading could make the content easier to follow and reduce visual noise — particularly in the table of contents or for readers skimming the page.

Could you share a bit more about the rationale for the extra levels? Are we planning for more configuration types in the future, or is there another reason the structure felt necessary? Thanks so much in advance.

This has been a standard format for all our integrations, some references of released integrations of the past:
https://docs.datadoghq.com/integrations/adyen/#configuration
https://docs.datadoghq.com/integrations/contentful/#setup

Are we changing the standard format going ahead?

Hi @tirthrajchaudhari-crest , thanks for these examples you've shared. I am discussing this standard format with the team and will keep you updated in a different PR if we plan on modifying it. If we do plan on modifying it, we will open a PR to modify the format for this and the other integrations.

I will go ahead and approve this PR now.

Thank you so much for your patience here and a fruitful discussion.

beyondtrust_identity_security_insights/README.md

iadjivon · 2025-07-07T21:31:32Z

beyondtrust_identity_security_insights/README.md

+            "link": "%%link%%"
+        }
+        ```
+    - **Send detections automatically?**: Select the checkbox.


Suggested change

- **Send detections automatically?**: Select the checkbox.

- **Send detections automatically (optional)**: Select the checkbox to send detections automatically.

Apart from (Optional) change updated the content as per your recommendation.

beyondtrust_identity_security_insights/README.md

iadjivon · 2025-07-07T21:39:39Z

...y_security_insights/assets/dashboards/beyondtrust_identity_security_insights_detections.json

+            "id": 4446171428078009,
+            "definition": {
+                "type": "note",
+                "content": "**Overview**\n\nThis dashboard offers a comprehensive summary of detection details triggered from beyond trust identity security insights.\n\nFor more information, see the [BeyondTrust Identity Security Insights Integration Documentation](https://docs.datadoghq.com/integrations/beyondtrust_identity_security_insights/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations.",


Suggested change

"content": "**Overview**\n\nThis dashboard offers a comprehensive summary of detection details triggered from beyond trust identity security insights.\n\nFor more information, see the [BeyondTrust Identity Security Insights Integration Documentation](https://docs.datadoghq.com/integrations/beyondtrust_identity_security_insights/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations.",

"content": "**Overview**\n\nThis dashboard offers a comprehensive summary of detection details triggered from BeyondTrust Identity Security Insights.\n\nFor more information, see the [BeyondTrust Identity Security Insights Integration Documentation](https://docs.datadoghq.com/integrations/beyondtrust_identity_security_insights/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations.",

iadjivon

Hi there, thanks so much for your responses! I just have one follow-up question on the nested headers. We should be all set afterwards. Thanks for your continued patience.

Add beyondtrust identity security insights integration

7df979f

temporal-github-worker-1 bot added docs/review-requested ecosystems/review-requested product/review-requested labels Jul 2, 2025

datadog-agent-integrations-bot bot added documentation dev/testing dev/tooling qa/skip-qa Automatically skip this PR for the next QA labels Jul 2, 2025

tirthrajchaudhari-crest added 4 commits July 2, 2025 19:17

Resolve CI failures

4b68841

Update test yaml file

895b3d6

Update test results

9e670b3

Empty commit to rerun validate-assets

2767df6

tirthrajchaudhari-crest marked this pull request as ready for review July 2, 2025 14:30

tirthrajchaudhari-crest requested review from a team as code owners July 2, 2025 14:30

datadog-agent-integrations-bot bot added team/agent-integrations team/documentation team/logs-backend team/logs-integrations-reviewers team/saas-integrations labels Jul 2, 2025

tirthrajchaudhari-crest changed the title ~~DDS: BeyondTrust Identity Security Insights v1.0.0~~ [SAASINT-4304] DDS: BeyondTrust Identity Security Insights v1.0.0 Jul 2, 2025

maycmlee added the editorial review Waiting on a more in-depth review from a docs team editor label Jul 2, 2025

Minor dashboard update

d516cc7

iadjivon reviewed Jul 7, 2025

View reviewed changes

Address review comments

e38226f

tirthrajchaudhari-crest requested a review from iadjivon July 8, 2025 11:06

iadjivon reviewed Jul 8, 2025

View reviewed changes

tirthrajchaudhari-crest requested a review from iadjivon July 9, 2025 11:38

iadjivon approved these changes Jul 9, 2025

View reviewed changes

temporal-github-worker-1 bot added docs/approved and removed docs/review-requested labels Jul 9, 2025

Resolve merge conflict

01af9a3

BoyangHuang added the assets/deploy-logs-staging ONLY USED BY Logs Backend - Validates that a PR is OK to go to staging label Jul 24, 2025

BoyangHuang approved these changes Jul 24, 2025

View reviewed changes


		[BeyondTrust Identity Security Insights][1] is a web-based application designed to enhance identity protection. It connects BeyondTrust products and third-party services to automatically scan for associated accounts and track your organization's identities.

		Integrate BeyondTrust Identity Security Insights with Datadog to gain insights into Detections Logs using pre-built dashboard visualizations. Datadog leverages its built-in log pipelines to parse and enrich these logs, facilitating easy search and detailed insights. Additionally, integration includes ready-to-use Cloud SIEM detection rules for enhanced monitoring and security which in turn can also be used with [Datadog Workflow Automation][5] leveraging OOTB Workflow Blueprints to orchestrate and automate your end-to-end processes.

-Integrate BeyondTrust Identity Security Insights with Datadog to gain insights into Detections Logs using pre-built dashboard visualizations. Datadog leverages its built-in log pipelines to parse and enrich these logs, facilitating easy search and detailed insights. Additionally, integration includes ready-to-use Cloud SIEM detection rules for enhanced monitoring and security which in turn can also be used with [Datadog Workflow Automation][5] leveraging OOTB Workflow Blueprints to orchestrate and automate your end-to-end processes.
+Integrate BeyondTrust Identity Security Insights with Datadog's pre-built dashboard visualizations to gain insights into detection logs. With Datadog's built-in log pipelines, you can parse and enrich these logs to facilitate easy search and detailed insights.
+This integration also includes ready-to-use Cloud SIEM detection rules for enhanced monitoring and security. These Cloud SIEM rules can be used with [Datadog Workflow Automation][5] to orchestrate and automate your end-to-end processes with OOTB Workflow Blueprints.

	- Send detections automatically?: Select the checkbox.
	- Send detections automatically (optional): Select the checkbox to send detections automatically.

[SAASINT-4304] DDS: BeyondTrust Identity Security Insights v1.0.0 #20642

Are you sure you want to change the base?

[SAASINT-4304] DDS: BeyondTrust Identity Security Insights v1.0.0 #20642

Uh oh!

Conversation

tirthrajchaudhari-crest commented Jul 2, 2025

What does this PR do?

Additional Notes

Review checklist (to be filled by reviewers)

Uh oh!

maycmlee commented Jul 2, 2025

Uh oh!

iadjivon left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

iadjivon left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!