[SAASINT-4032] DDS: DNSFilter: Crawler Integration v1.0.0 #20384

manan-crest · 2025-05-27T12:28:08Z

What does this PR do?

This is a initial release PR of DNSFilter integration including all the required assets.

Motivation

Crawler code for this integration has been committed in its respective repository.
Pipeline and Facet group created for this integration are available in our sandbox and would be shared separately with the required teams.
Samples for the pipeline review would also be shared separately with the required teams.
OOTB detection rules JSON would be shared separately with the required teams as a part of separate repository.
Since during the standard attribute remapping we are not preserving the source attributes as per suggested best practices, it would result in filters using these standard attributes populating the values of other integrations as well as per current Datadog behaviour.

Review checklist (to be filled by reviewers)

Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

…into dnsfilter-assets-v1.0.0

drichards-87 · 2025-05-28T15:42:24Z

Created DOCS-11046 for Docs Team review.

urseberry · 2025-05-30T19:59:29Z

I'm the assigned reviewer from Documentation.

urseberry · 2025-05-30T20:17:15Z

dnsfilter/README.md


 ## Overview

-This check monitors [DNSFilter][1].
+[DNSFilter][1] is a cloud-based content filtering and threat protection by blocking internet threats at the DNS layer. It protects organizations by preventing access to malicious domains, phishing sites, and other cyber threats, ensuring a safer internet experience.


Suggested change

[DNSFilter][1] is a cloud-based content filtering and threat protection by blocking internet threats at the DNS layer. It protects organizations by preventing access to malicious domains, phishing sites, and other cyber threats, ensuring a safer internet experience.

[DNSFilter][1] is a cloud-based content filtering tool that blocks internet threats at the DNS layer. It protects organizations by preventing access to malicious domains, phishing sites, and other cyber threats, ensuring a safer internet experience.

The first sentence is not grammatically correct. I made one possible edit, but feel free to revise to your preferences.

urseberry · 2025-05-30T20:18:07Z

dnsfilter/README.md


-### Installation
+This integration seamlessly collects DNS Traffic Logs, channeling them into Datadog for analysis. Leveraging the built-in logs pipeline, these logs are parsed and enriched, enabling effortless search and analysis. The integration provides insight into dns traffic logs through out-of-the-box dashboards and includes ready-to-use Cloud SIEM detection rules for improved monitoring and security.


Suggested change

This integration seamlessly collects DNS Traffic Logs, channeling them into Datadog for analysis. Leveraging the built-in logs pipeline, these logs are parsed and enriched, enabling effortless search and analysis. The integration provides insight into dns traffic logs through out-of-the-box dashboards and includes ready-to-use Cloud SIEM detection rules for improved monitoring and security.

This integration collects DNS Traffic Logs, channeling them into Datadog for analysis. Leveraging the built-in logs pipeline, these logs are parsed and enriched, enabling search and analysis. The integration provides insight into DNS traffic logs through out-of-the-box dashboards and includes ready-to-use Cloud SIEM detection rules for improved monitoring and security.

urseberry · 2025-05-30T20:18:18Z

dnsfilter/README.md


-The DNSFilter check is included in the [Datadog Agent][2] package.
-No additional installation is needed on your server.
+### Generate API Credentials in DNSFilter


Suggested change

### Generate API Credentials in DNSFilter

### Generate API credentials in DNSFilter

urseberry · 2025-05-30T20:19:46Z

dnsfilter/README.md

+3. Navigate to **Security** tab.
+4. Navigate to **API Keys** section, then click **CREATE KEY**.
+5. Enter a key **Name** and select an **Expiration**.
+6. Click **GENERATE KEY**.
+7. Fetch API Key from **Your API Key** Section.


Suggested change

3. Navigate to **Security** tab.

4. Navigate to **API Keys** section, then click **CREATE KEY**.

5. Enter a key **Name** and select an **Expiration**.

6. Click **GENERATE KEY**.

7. Fetch API Key from **Your API Key** Section.

3. Navigate to the **Security** tab.

4. Navigate to the **API Keys** section, then click **CREATE KEY**.

5. Enter a key **Name** and select an **Expiration**.

6. Click **GENERATE KEY**.

7. Fetch the API Key from the **Your API Key** Section.

urseberry · 2025-05-30T20:20:01Z

dnsfilter/README.md


-!!! Add list of steps to set up this integration !!!
+### Connect your DNSFilter Account to Datadog


Suggested change

### Connect your DNSFilter Account to Datadog

### Connect your DNSFilter account to Datadog

urseberry · 2025-05-30T20:20:22Z

dnsfilter/README.md

-!!! Add steps to validate integration is functioning as expected !!!
+    | Parameters                            | Description                                                  |
+    | ------------------------------------- | ------------------------------------------------------------ |
+    | API Key                               | The API Key of your DNSFilter Platform                       |


urseberry · 2025-05-30T20:20:35Z

dnsfilter/README.md


-DNSFilter does not include any metrics.
+The DNSFilter integration collects and forwards dns traffic logs to Datadog.


Suggested change

The DNSFilter integration collects and forwards dns traffic logs to Datadog.

The DNSFilter integration collects and forwards DNS traffic logs to Datadog.

urseberry · 2025-05-30T20:21:36Z

dnsfilter/assets/dashboards/dnsfilter_overview.json

+            "id": 8262886595283344,
+            "definition": {
+                "type": "note",
+                "content": "DNSFilter is a cloud-based content filtering and threat protection by blocking internet threats at the DNS layer. It protects organizations by preventing access to malicious domains, phishing sites, and other cyber threats, ensuring a safer internet experience.\n\nThis dashboard provides a comprehensive summary of DNSFilter Traffic logs.\n\nFor more information, see the [DNSFilter Integration Documentation](https://docs.datadoghq.com/integrations/dnsfilter/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations. ",


Suggested change

"content": "DNSFilter is a cloud-based content filtering and threat protection by blocking internet threats at the DNS layer. It protects organizations by preventing access to malicious domains, phishing sites, and other cyber threats, ensuring a safer internet experience.\n\nThis dashboard provides a comprehensive summary of DNSFilter Traffic logs.\n\nFor more information, see the [DNSFilter Integration Documentation](https://docs.datadoghq.com/integrations/dnsfilter/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations. ",

"content": "DNSFilter is a cloud-based content filtering tool that blocking internet threats at the DNS layer. It protects organizations by preventing access to malicious domains, phishing sites, and other cyber threats, ensuring a safer internet experience.\n\nThis dashboard provides a comprehensive summary of DNSFilter Traffic logs.\n\nFor more information, see the [DNSFilter Integration Documentation](https://docs.datadoghq.com/integrations/dnsfilter/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations. ",

urseberry · 2025-05-30T20:22:29Z

dnsfilter/assets/dashboards/dnsfilter_security_insights.json

+            "id": 3572596914767264,
+            "definition": {
+                "type": "note",
+                "content": "DNSFilter is a cloud-based content filtering and threat protection by blocking internet threats at the DNS layer. It protects organizations by preventing access to malicious domains, phishing sites, and other cyber threats, ensuring a safer internet experience.\n\nThis dashboard displays information about allowed and blocked DNS requests, threats, domains accessed, policies, networks, and other DNS-related traffic data.\n\nFor more information, see the [DNSFilter Integration Documentation](https://docs.datadoghq.com/integrations/dnsfilter/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations. ",


Suggested change

"content": "DNSFilter is a cloud-based content filtering and threat protection by blocking internet threats at the DNS layer. It protects organizations by preventing access to malicious domains, phishing sites, and other cyber threats, ensuring a safer internet experience.\n\nThis dashboard displays information about allowed and blocked DNS requests, threats, domains accessed, policies, networks, and other DNS-related traffic data.\n\nFor more information, see the [DNSFilter Integration Documentation](https://docs.datadoghq.com/integrations/dnsfilter/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations. ",

"content": "DNSFilter is a cloud-based content filtering and threat protection tool that blocks internet threats at the DNS layer. It protects organizations by preventing access to malicious domains, phishing sites, and other cyber threats, ensuring a safer internet experience.\n\nThis dashboard displays information about allowed and blocked DNS requests, threats, domains accessed, policies, networks, and other DNS-related traffic data.\n\nFor more information, see the [DNSFilter Integration Documentation](https://docs.datadoghq.com/integrations/dnsfilter/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations. ",

avaid-crest and others added 4 commits May 20, 2025 18:16

initial commit without assets

e75abdc

Adding changes into manifest file

85c0573

Removed service_checks and added codeowners

f473eee

Add: DNSFilter Assets

8a1091b

temporal-github-worker-1 bot added docs/review-requested ecosystems/review-requested product/review-requested labels May 27, 2025

datadog-agent-integrations-bot bot added documentation dev/testing dev/tooling qa/skip-qa Automatically skip this PR for the next QA integration/dnsfilter labels May 27, 2025

manan-crest changed the title ~~DDS: DNSFilter: Integration v1.0.0~~ DDS: DNSFilter: Crawler Integration v1.0.0 May 27, 2025

manan-crest added 4 commits May 27, 2025 18:22

Update: facets in logs file

11734b0

Update: fix CI checks and add sample results

a0a667f

Merge branch 'master' of https://github.com/DataDog/integrations-core …

36beb0d

…into dnsfilter-assets-v1.0.0

Update: minor changes in overview dashboard

e7ce8b3

manan-crest changed the title ~~DDS: DNSFilter: Crawler Integration v1.0.0~~ [SAASINT-4032] DDS: DNSFilter: Crawler Integration v1.0.0 May 28, 2025

manan-crest marked this pull request as ready for review May 28, 2025 12:35

manan-crest requested review from a team as code owners May 28, 2025 12:35

datadog-agent-integrations-bot bot added team/documentation team/logs-backend team/logs-integrations-reviewers team/saas-integrations labels May 28, 2025

drichards-87 added the editorial review Waiting on a more in-depth review from a docs team editor label May 28, 2025

guttymora approved these changes May 30, 2025

View reviewed changes

urseberry reviewed May 30, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[SAASINT-4032] DDS: DNSFilter: Crawler Integration v1.0.0 #20384

[SAASINT-4032] DDS: DNSFilter: Crawler Integration v1.0.0 #20384

Uh oh!

manan-crest commented May 27, 2025 •

edited

Loading

Uh oh!

drichards-87 commented May 28, 2025

Uh oh!

urseberry commented May 30, 2025

Uh oh!

urseberry May 30, 2025

Uh oh!

urseberry May 30, 2025

Uh oh!

urseberry May 30, 2025

Uh oh!

urseberry May 30, 2025

Uh oh!

urseberry May 30, 2025

Uh oh!

urseberry May 30, 2025

Uh oh!

urseberry May 30, 2025

Uh oh!

urseberry May 30, 2025

Uh oh!

urseberry May 30, 2025

Uh oh!

Uh oh!

	[DNSFilter][1] is a cloud-based content filtering and threat protection by blocking internet threats at the DNS layer. It protects organizations by preventing access to malicious domains, phishing sites, and other cyber threats, ensuring a safer internet experience.
	[DNSFilter][1] is a cloud-based content filtering tool that blocks internet threats at the DNS layer. It protects organizations by preventing access to malicious domains, phishing sites, and other cyber threats, ensuring a safer internet experience.


		### Installation
		This integration seamlessly collects DNS Traffic Logs, channeling them into Datadog for analysis. Leveraging the built-in logs pipeline, these logs are parsed and enriched, enabling effortless search and analysis. The integration provides insight into dns traffic logs through out-of-the-box dashboards and includes ready-to-use Cloud SIEM detection rules for improved monitoring and security.

	This integration seamlessly collects DNS Traffic Logs, channeling them into Datadog for analysis. Leveraging the built-in logs pipeline, these logs are parsed and enriched, enabling effortless search and analysis. The integration provides insight into dns traffic logs through out-of-the-box dashboards and includes ready-to-use Cloud SIEM detection rules for improved monitoring and security.
	This integration collects DNS Traffic Logs, channeling them into Datadog for analysis. Leveraging the built-in logs pipeline, these logs are parsed and enriched, enabling search and analysis. The integration provides insight into DNS traffic logs through out-of-the-box dashboards and includes ready-to-use Cloud SIEM detection rules for improved monitoring and security.

	### Generate API Credentials in DNSFilter
	### Generate API credentials in DNSFilter


		!!! Add list of steps to set up this integration !!!
		### Connect your DNSFilter Account to Datadog

	\| API Key \| The API Key of your DNSFilter Platform \|
	\| API Key \| The API Key of your DNSFilter platform \|


		DNSFilter does not include any metrics.
		The DNSFilter integration collects and forwards dns traffic logs to Datadog.

[SAASINT-4032] DDS: DNSFilter: Crawler Integration v1.0.0 #20384

Are you sure you want to change the base?

[SAASINT-4032] DDS: DNSFilter: Crawler Integration v1.0.0 #20384

Uh oh!

Conversation

manan-crest commented May 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Motivation

Review checklist (to be filled by reviewers)

Uh oh!

drichards-87 commented May 28, 2025

Uh oh!

urseberry commented May 30, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

manan-crest commented May 27, 2025 •

edited

Loading