[Ikmunozmartinez]

Checklist before requesting review

• I self-reviewed the full diff, and this description matches the final change
• Tests cover the change, or this description explains why none are needed
• Automated review comments, including Codex review, were addressed or answered
• I, the human author, understand this change, can explain it to reviewers, and believe it meets the repository standards

What does this PR do?

Adds the assets/account_config.json schema for the cisco_secure_email_threat_defense integration (Generic AMS), feeding the cisco-secure-email-threat-defense-logs dataflow. It uses the same field keys the crawler declares in fields_in_development:

• Auth (basic): client_id → settings.client_id, client_password → secrets.client_password. The crawler uses them for basic auth on POST /v1/oauth/token to get a bearer token.
• Connection (regional): host_name keeps the existing hostnames (api.{us,au,de,in}.etd.cisco.com) as codes and maps each to https://<host>, matching the crawler's https://{host_name}.
• Account-level fields: api_key (see below) and verdict_delay (integer with min: 0, max: 720, default: 30, matching the crawler).

No tests: this is a schema-only asset, covered by the account-config-schema and account-config-runtime validations.

Motivation

The cisco_secure_email_threat_defense integration has an autogenerated tile via crawler-sdk but no account configuration schema on Generic AMS yet. This adds it.

Draft, blocked on IXP:

1. regional with codes: today regional dropdown values must be https URLs. IXP proposed allowing codes, plus a code → base URL mapping. The mapping now uses IXP's field name, region_base_urls, from ddoghq/dd-source#128691, so this part passes validate-account-config-schema once that PR is merged and deployed.
2. api_key: the crawler sends a third credential as the x-api-key header, on top of the basic credentials. No auth method can hold it, password isn't allowed at the account level, and exemptions are closed. It stays at the account level until IXP confirms how to model it.

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add qa/required if this PR needs QA validation, or qa/skip-qa if it does not. Exactly one of the two is required.
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

[cit-pr-commenter-54b7da]

evalya-impact-summary

evalya impact analysis

Impact analysis: 0 selected, 0 skipped (of 0 test tasks)
Publish tasks:   4 (always emitted)
Diff (1 file):
  cisco_secure_email_threat_defense/assets/account_config.json

Debug a specific task: evalya plan impact --path <path> --task <task>

Learn more about CI impact filtering

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-22T11:32:41.896140Z	5229f66	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[dd-octo-sts]

This pull request has been automatically marked as stale because it has not had activity in the past 15 days.

It will be closed in 30 days if no further activity occurs. If this pull request is still relevant, adding a comment or pushing new commits will keep it open. Also, you can always reopen the pull request if you missed the window.

Thank you for your contributions!

[dd-octo-sts]

Validation Report

Validation	Description	Status
labeler	Validate PR labeler config matches integration directories	❌
version	Validate version consistency between package and changelog	❌

Run ddev validate all changed --fix to attempt to auto-fix supported validations.

Passed validations (20)

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
license-headers	Validate Python files have proper license headers	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
models	Validate configuration data models match spec.yaml	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata, naming, and wheel contents	✅
pr-description	Validate the pull request checklist and visible description length	✅
qa-label	Validate the pull request declares whether it needs QA for the next Agent release	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅

View full run

[datadog-prod-us1-4]

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 1 Pipeline job failed

Validate repository | Run Validations / Validate

View more details · View in GitHub Actions

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 5229f66 | Docs | View more details | Give us feedback!}