diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 0c48f2123f5..891f5c695cc 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -234,6 +234,7 @@ /packages/cyera @elastic/security-service-integrations @elastic/sit-crest-contractors /packages/cylance @elastic/security-service-integrations @elastic/sit-crest-contractors /packages/darktrace @elastic/security-service-integrations @elastic/sit-crest-contractors +/packages/datadog @elastic/integration-experience /packages/dataminr_pulse @elastic/security-service-integrations @elastic/sit-crest-contractors /packages/ded @elastic/sec-applied-ml @elastic/kibana-management /packages/dga @elastic/sec-applied-ml diff --git a/packages/datadog/_dev/build/build.yml b/packages/datadog/_dev/build/build.yml new file mode 100644 index 00000000000..ac76b327e47 --- /dev/null +++ b/packages/datadog/_dev/build/build.yml @@ -0,0 +1,3 @@ +dependencies: + ecs: + reference: "git@v9.4.0" diff --git a/packages/datadog/_dev/build/docs/README.md b/packages/datadog/_dev/build/docs/README.md new file mode 100644 index 00000000000..35b3e00f47f --- /dev/null +++ b/packages/datadog/_dev/build/docs/README.md @@ -0,0 +1,56 @@ +# Datadog Audit Logs + +Collects the Datadog audit trail from an S3 bucket written by +[Datadog Log Archives](https://docs.datadoghq.com/logs/log_configuration/archives/), +using SQS object-created notifications for near-real-time delivery. + +## Data flow + +1. In Datadog, configure a Logs Archive with the query `source:audit`, targeting + an S3 bucket. Datadog writes gzipped NDJSON objects to a date-partitioned + prefix (`dt=YYYYMMDD/hour=HH/archive_*.json.gz`), one audit event per line. +2. Configure an S3 event notification on that bucket for `s3:ObjectCreated:*`, + delivering to an SQS queue. +3. Point this integration at the bucket ARN and the SQS queue URL. + +If no queue URL is supplied, the integration falls back to polling the bucket on +the configured interval. SQS is strongly preferred — polling re-lists the bucket +on every interval and does not scale with archive volume. + +## Required AWS permissions + +- `s3:GetObject` on the archive prefix +- `s3:ListBucket` on the bucket (polling mode only) +- `sqs:ReceiveMessage`, `sqs:DeleteMessage`, `sqs:GetQueueAttributes` on the queue + +Prefer `role_arn` over static access keys. + +## Data stream + +`datadog.audit` — all audit surfaces (API requests, workflows, agent +configuration changes, dashboards, organization management, MCP server calls, +audit-trail queries) in one stream. + +## Notable fields + +| Field | Description | +|---|---| +| `datadog.event.name` | Datadog product surface (`Request`, `Workflows`, `Dashboard`, …) | +| `datadog.action` | Raw Datadog verb (`accessed`, `modified`, `created`, …) | +| `event.action` | Composite `_`, e.g. `dashboard_modified` | +| `datadog.route.path` | Templated API route — aggregate on this, not `url.path`, which contains IDs | +| `datadog.actor.type` | `USER`, `SYSTEM`, or `SERVICE_ACCOUNT` | +| `datadog.auth_method` | `SESSION`, `SYSTEM`, `API_AND_APP_KEY`, `OAUTH_TOKEN` | +| `datadog.threat_intel.*` | Datadog's Spur-sourced IP enrichment, including VPN/proxy tunnel detail | +| `datadog.asset.new_value` / `.prev_value` | `flattened` before/after blobs for configuration changes | +| `datadog.metadata` | `flattened` catch-all for surface-specific metadata | +| `related.user` | Every actor identifier in the event, including API key and OAuth client IDs | + +`datadog.asset.new_value`, `datadog.asset.prev_value`, `datadog.metadata`, and `datadog.threat_intel` are +`flattened`. They are queryable in KQL and DSL by subkey, but **not** in ES|QL, +which hard-errors on `flattened`. Stable dimensions are lifted into typed +sibling fields for that reason. + +## Dashboard + +![Datadog Audit Logs Dashboard](../img/Datadog_dashboard.png) diff --git a/packages/datadog/changelog.yml b/packages/datadog/changelog.yml new file mode 100644 index 00000000000..0735e6c93a2 --- /dev/null +++ b/packages/datadog/changelog.yml @@ -0,0 +1,5 @@ +- version: "0.1.0" + changes: + - description: Initial release of the Datadog audit logs integration (S3 via SQS, full ECS mapping) + type: enhancement + link: https://github.com/elastic/integrations/pull/20526 diff --git a/packages/datadog/data_stream/audit/_dev/test/pipeline/test-events.json b/packages/datadog/data_stream/audit/_dev/test/pipeline/test-events.json new file mode 100644 index 00000000000..008e015a1c5 --- /dev/null +++ b/packages/datadog/data_stream/audit/_dev/test/pipeline/test-events.json @@ -0,0 +1,76 @@ +{ + "events": [ + { + "message": "{\"date\":\"2026-07-31T19:23:15.543Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Request\"},\"auth_method\":\"SESSION\",\"route\":{\"path\":\"/api/ui/frontend_telemetry/metrics\"},\"org\":{\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"id\":\"user01@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000002\",\"email\":\"user01@example.com\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.1\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":4,\"concentration\":{\"country\":\"US\",\"density\":1,\"city\":\"Sun Lakes\",\"geohash\":\"9tbmnn\",\"state\":\"Arizona\",\"skew\":596},\"countries\":1},\"location\":{\"country\":\"US\",\"city\":\"Los Angeles\",\"state\":\"California\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"action\":\"accessed\",\"http\":{\"status_code\":202,\"url_details\":{\"path\":\"/api/ui/frontend_telemetry/metrics\",\"host\":\"us5.datadoghq.com\"},\"method\":\"POST\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"California\",\"iso_code\":\"US-CA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.3/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Los Angeles\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.1\",\"location\":{\"latitude\":34.05223,\"longitude\":-118.24368}},\"ip\":\"198.51.100.1\"}},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:15.543Z\",\"emitted_source\":\"edge\"},\"_id\":\"id-000001\",\"source\":\"audit\",\"message\":\"POST request made to /api/ui/frontend_telemetry/metrics by user01@example.com with response 202\",\"status\":\"info\",\"tags\":[\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:23:17.234Z\",\"attributes\":{\"auth_method\":\"SYSTEM\",\"evt\":{\"actor\":{\"type\":\"SYSTEM\"},\"name\":\"Workflows\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000002\"},\"parent_workflow_id\":\"id-000003\",\"fqn\":\"com.datadoghq.http.request\",\"workflow_id\":\"id-000003\",\"workflow_name\":\"Dashboard Inventory Refresh (verification)\",\"actions_client\":\"WORKFLOWS\",\"result_hash\":\"31b1e3e51c0bdf6958acbd33e7ac2209494c23fd1987eff4922c7bc3ccf88495\",\"parent_workflow_instance_id\":\"id-000004\",\"instance_id\":\"id-000005\",\"step_name\":\"Fetch_dashboard_details\",\"action_name\":\"request\",\"bundle_id\":\"id-000006\",\"workflow_createdAt\":\"2026-05-21 19:32:51.72985 +0000 +0000\",\"action_client\":\"WORKFLOWS\",\"workflow_trigger\":\"TRIGGER_TYPE_WORKFLOW\"},\"action\":\"completed\",\"asset\":{\"name\":\"action task com.datadoghq.http.request\",\"id\":\"id-000007\",\"type\":\"action_platform_task\"},\"uuid\":\"id-000008\",\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:17.234Z\"},\"_id\":\"id-000009\",\"source\":\"audit\",\"message\":\"successfully completed action task com.datadoghq.http.request attempt-VUhVgtC53zdVbATgh4NCpG\",\"status\":\"info\",\"tags\":[\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:23:16.953Z\",\"attributes\":{\"auth_method\":\"SYSTEM\",\"evt\":{\"actor\":{\"type\":\"SYSTEM\"},\"name\":\"Workflows\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000002\"},\"parent_workflow_id\":\"id-000003\",\"fqn\":\"com.datadoghq.http.request\",\"workflow_id\":\"id-000003\",\"input_parameters_hash\":\"cbaf50686304c8fb83a6d1cb6d75c9f9b99b7ebfe0c79c2b5b137e9063cdec2b\",\"workflow_name\":\"Dashboard Inventory Refresh (verification)\",\"actions_client\":\"WORKFLOWS\",\"parent_workflow_instance_id\":\"id-000004\",\"instance_id\":\"id-000005\",\"request_endpoint\":\"https://api.us5.datadoghq.com/api/v1/dashboard/b6j-i5f-u3b\",\"step_name\":\"Fetch_dashboard_details\",\"action_name\":\"request\",\"bundle_id\":\"id-000006\",\"attributes\":{\"parent_workflow_id\":\"id-000003\",\"workflow_id\":\"id-000003\",\"instance_id\":\"id-000005\",\"workflow_name\":\"Dashboard Inventory Refresh (verification)\",\"step_name\":\"Fetch_dashboard_details\",\"client\":\"WORKFLOWS\",\"parent_workflow_instance_id\":\"id-000004\",\"workflow_createdAt\":\"2026-05-21 19:32:51.72985 +0000 +0000\",\"workflow_trigger\":\"TRIGGER_TYPE_WORKFLOW\"},\"workflow_createdAt\":\"2026-05-21 19:32:51.72985 +0000 +0000\",\"action_client\":\"WORKFLOWS\",\"workflow_trigger\":\"TRIGGER_TYPE_WORKFLOW\"},\"action\":\"started\",\"asset\":{\"name\":\"action task com.datadoghq.http.request\",\"id\":\"id-000007\",\"type\":\"action_platform_task\"},\"uuid\":\"id-000010\",\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:16.953Z\"},\"_id\":\"id-000011\",\"source\":\"audit\",\"message\":\"started action task com.datadoghq.http.request attempt-VUhVgtC53zdVbATgh4NCpG\",\"status\":\"info\",\"tags\":[\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:23:17.107Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Dashboard\"},\"auth_method\":\"SESSION\",\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"created\":\"2024-08-23T20:49:04.000Z\",\"name\":\"Example User 01\",\"id\":\"user02@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000003\",\"email\":\"user02@example.com\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.4\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":7,\"concentration\":{\"country\":\"US\",\"density\":1,\"city\":\"San Francisco\",\"geohash\":\"9q8yyj\",\"state\":\"California\",\"skew\":68},\"countries\":1},\"location\":{\"country\":\"US\",\"city\":\"San Jose\",\"state\":\"California\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"http\":{\"url_details\":{\"path\":\"/api/v1/dashboard/zza-xmd-7jt\",\"host\":\"us5.prod.dog\"},\"status_code\":200,\"method\":\"PUT\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.5 Safari/537.36\"},\"action\":\"modified\",\"asset\":{\"path\":\"/dashboard/zza-xmd-7jt/perf-strike-team\",\"version_uuid\":\"00000000-0000-4000-8000-000000000004\",\"name\":\"Perf Strike Team\",\"id\":\"id-000012\",\"type\":\"dashboard\",\"prev_value\":{\"dashboard_definition\":{\"author_name\":\"Example Author\",\"template_variable_presets\":[{\"name\":\"Joyce\",\"description\":\"drafts\",\"template_variables\":[{\"name\":\"env\",\"value\":\"devprod\"},{\"name\":\"customer-ns\",\"value\":\"*\"},{\"name\":\"view.url_host\",\"value\":\"example.ai\"}]}],\"tabs\":[{\"name\":\"Tab 1\",\"widget_ids\":[5786555378127436,2795964700760912,3725357411171479,6879929085074505],\"id\":\"id-000013\"},{\"name\":\"1. Workspace Loading\",\"widget_ids\":[2596549404097146,1738862716789832,8118717586213844,7116521192235267,1085918712924402,5375242069538586,7632570881757390,6424405168251415,6894734997716994],\"id\":\"id-000014\"},{\"name\":\"2. Panel Bank Search\",\"widget_ids\":[1872967732978139],\"id\":\"id-000015\"},{\"name\":\"Tab 4\",\"id\":\"id-000016\"},{\"name\":\"Tab 5\",\"id\":\"id-000017\"},{\"name\":\"Tab 6\",\"id\":\"id-000018\"},{\"name\":\"Tab 7\",\"id\":\"id-000019\"}],\"description\":\"[[suggested_dashboards]]\",\"layout_type\":\"ordered\",\"created_at\":\"2026-07-09T20:30:19.501285+00:00\",\"title\":\"Perf Strike Team\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":12,\"y\":0,\"height\":1},\"definition\":{\"background_color\":\"green\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"Core Web Vitals\",\"type\":\"group\"},\"id\":100020},{\"layout\":{\"x\":0,\"width\":12,\"y\":0,\"height\":4},\"definition\":{\"background_color\":\"purple\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"2. Panel Bank Search\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000005\"},\"id\":100021},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User typing in panel search input\\n- End: Selected panels showing up\",\"text_align\":\"left\"},\"id\":100022}]},\"id\":100023},{\"layout\":{\"x\":0,\"width\":2,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"# Critical workflows\\n1. Workspace loading\\n2. Panel bank search\\n3. Runs search\\n4. Toggle run visibility (eyeball click)\\n5. Metric selection in edit panel modal\\n6. Section pagination\\n7. Hovering panel data\\n\",\"text_align\":\"left\"},\"id\":100024},{\"layout\":{\"x\":2,\"width\":2,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"## Metrics to add\\n- \\\\# of slow views\\n- list of graphql queries & its latencies\\n- list of long tasks\\n- good or bad (define threshold like # of slow views > 10?)\\n\\n## Start and end definition\\n- start \\u2014 \\n- end \\u2014 after data returns and filters section & panels right before react re-rendering?\",\"text_align\":\"left\"},\"id\":100025},{\"layout\":{\"x\":4,\"width\":2,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"## TODO\\n- separate these workflow into its own tab\\n\",\"text_align\":\"left\"},\"id\":100026},{\"layout\":{\"x\":0,\"width\":12,\"y\":1,\"height\":1},\"definition\":{\"background_color\":\"yellow\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"HistoryKeysByHash Perf\",\"type\":\"group\"},\"id\":100027},{\"layout\":{\"x\":0,\"width\":12,\"y\":2,\"height\":11},\"definition\":{\"background_color\":\"gray\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"Justin - possible metrics\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":4,\"y\":0,\"height\":2},\"definition\":{\"title_align\":\"left\",\"title_size\":\"16\",\"has_search_bar\":\"auto\",\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"formula\":\"query1\",\"cell_display_mode\":\"bar\"},{\"formula\":\"query2\",\"cell_display_mode\":\"bar\"},{\"formula\":\"query3\",\"cell_display_mode\":\"bar\"},{\"alias\":\"50ms+ compressions\",\"formula\":\"query4\",\"cell_display_mode\":\"bar\"}],\"sort\":{\"count\":590,\"order_by\":[{\"index\":0,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:action @action.name:\\\"workspace.save_duration\\\" @context.compressDuration:>10\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":30,\"sort\":{\"metric\":\"count\",\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@context.compressDuration\",\"aggregation\":\"pc75\"},\"search\":{\"query\":\"@type:action @action.name:\\\"workspace.save_duration\\\" @context.compressDuration:>10\"},\"indexes\":[\"*\"],\"name\":\"query2\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":30,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@context.compressDuration\",\"aggregation\":\"max\"},\"search\":{\"query\":\"@type:action @action.name:\\\"workspace.save_duration\\\" @context.compressDuration:>10\"},\"indexes\":[\"*\"],\"name\":\"query3\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":30,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:action @action.name:\\\"workspace.save_duration\\\" @context.compressDuration:>50\"},\"indexes\":[\"*\"],\"name\":\"query4\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":500,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"\",\"type\":\"query_table\"},\"id\":100028},{\"layout\":{\"x\":5,\"width\":5,\"y\":0,\"height\":8},\"definition\":{\"title_align\":\"left\",\"title_size\":\"16\",\"has_search_bar\":\"auto\",\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"alias\":\"Max Workspace Keys\",\"formula\":\"query1\",\"cell_display_mode\":\"number\"},{\"alias\":\"Longest Task\",\"formula\":\"query2\",\"cell_display_mode\":\"bar\"},{\"alias\":\"Pc90 Task\",\"formula\":\"query3\",\"cell_display_mode\":\"number\"},{\"alias\":\"Count\",\"formula\":\"query4\",\"cell_display_mode\":\"bar\"},{\"alias\":\"Average\",\"formula\":\"query5\",\"cell_display_mode\":\"bar\"}],\"sort\":{\"count\":500,\"order_by\":[{\"index\":3,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"metric\":\"@context.keyCount\",\"aggregation\":\"max\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"max\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query2\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"pc90\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query3\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query4\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"avg\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query5\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"Autosync Cache Key Pain By Entity\",\"type\":\"query_table\"},\"id\":100029},{\"layout\":{\"x\":10,\"width\":2,\"y\":0,\"height\":4},\"definition\":{\"legend_columns\":[\"avg\",\"min\",\"max\",\"value\",\"sum\"],\"title_align\":\"left\",\"title_size\":\"16\",\"show_legend\":true,\"requests\":[{\"display_type\":\"line\",\"response_format\":\"timeseries\",\"formulas\":[{\"formula\":\"query1\"},{\"formula\":\"query2\"}],\"style\":{\"line_width\":\"normal\",\"line_type\":\"solid\",\"order_by\":\"values\",\"palette\":\"dog_classic\"},\"queries\":[{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"median\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"pc90\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query2\",\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"Slow cache key generation\",\"type\":\"timeseries\",\"legend_layout\":\"auto\"},\"id\":100030},{\"layout\":{\"x\":0,\"width\":5,\"y\":2,\"height\":8},\"definition\":{\"title_align\":\"left\",\"title_size\":\"16\",\"has_search_bar\":\"auto\",\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"alias\":\"100ms+\",\"formula\":\"query1\",\"cell_display_mode\":\"bar\"},{\"alias\":\"500ms+\",\"formula\":\"query3\",\"cell_display_mode\":\"bar\"},{\"alias\":\"Count\",\"formula\":\"query4\",\"cell_display_mode\":\"bar\"}],\"sort\":{\"count\":1100,\"order_by\":[{\"index\":2,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_panel_bank\\\" @vital.duration:>100000000\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":50,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_panel_bank\\\" @vital.duration:>500000000\"},\"indexes\":[\"*\"],\"name\":\"query3\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":50,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_panel_bank\\\" @vital.duration:>100000000\"},\"indexes\":[\"*\"],\"name\":\"query4\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":1000,\"sort\":{\"metric\":\"count\",\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"Slow autosync_panel_bank\",\"type\":\"query_table\"},\"id\":100031}]},\"id\":100032},{\"layout\":{\"x\":0,\"width\":12,\"y\":2,\"height\":4},\"definition\":{\"background_color\":\"blue\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"1. Workspace Loading\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000006\"},\"id\":100033},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":1},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User visiting example.ai//\\n- End: Runs search & panels show up\",\"text_align\":\"left\"},\"id\":100034}]},\"id\":100035},{\"layout\":{\"x\":0,\"width\":12,\"y\":6,\"height\":4},\"definition\":{\"background_color\":\"pink\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"3. Runs Search\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"cover\",\"has_background\":true,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000007\"},\"id\":100036},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":1},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User typing in runs search input\\n- End: Panel showing up\",\"text_align\":\"left\"},\"id\":100037}]},\"id\":100038},{\"layout\":{\"x\":0,\"width\":12,\"y\":13,\"height\":23},\"definition\":{\"background_color\":\"blue\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"Joyce - workspace loading proposals\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":12,\"y\":0,\"height\":5},\"definition\":{\"legend_columns\":[\"avg\",\"min\",\"max\",\"value\",\"sum\"],\"show_legend\":true,\"requests\":[{\"display_type\":\"line\",\"response_format\":\"timeseries\",\"formulas\":[{\"alias\":\"p95\",\"formula\":\"query1 / 1000000000\",\"number_format\":{\"unit\":{\"unit_name\":\"second\",\"type\":\"canonical_unit\"}}},{\"alias\":\"p98\",\"formula\":\"query2 / 1000000000\",\"number_format\":{\"unit\":{\"unit_name\":\"second\",\"type\":\"canonical_unit\"}}},{\"alias\":\"p99\",\"formula\":\"query3 / 1000000000\",\"number_format\":{\"unit\":{\"unit_name\":\"second\",\"type\":\"canonical_unit\"}}}],\"style\":{\"line_width\":\"normal\",\"line_type\":\"solid\",\"order_by\":\"values\",\"palette\":\"dog_classic\"},\"queries\":[{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc95\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc98\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query2\",\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query3\",\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"Multi-run page - workspace_init (BEFORE we hit any workspace-related logic)\",\"type\":\"timeseries\",\"legend_layout\":\"auto\"},\"id\":100039},{\"layout\":{\"x\":0,\"width\":12,\"y\":5,\"height\":5},\"definition\":{\"xaxis\":{\"include_zero\":true,\"min\":\"auto\",\"max\":\"auto\",\"scale\":\"linear\"},\"show_legend\":true,\"requests\":[{\"request_type\":\"histogram\",\"query\":{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc95\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"storage\":\"hot\",\"data_source\":\"rum\"}}],\"title\":\"Multi-run page - workspace_init (BEFORE we hit any workspace-related logic)\",\"type\":\"distribution\",\"yaxis\":{\"include_zero\":true,\"min\":\"auto\",\"max\":\"auto\",\"scale\":\"linear\"}},\"id\":100040},{\"layout\":{\"x\":0,\"width\":12,\"y\":10,\"height\":5},\"definition\":{\"has_search_bar\":\"auto\",\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"alias\":\"p99_seconds\",\"formula\":\"query1 / 1000000000\",\"cell_display_mode\":\"bar\"}],\"sort\":{\"count\":50,\"order_by\":[{\"index\":0,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @view.url:*nw=* @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":50,\"sort\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\",\"order\":\"desc\"},\"facet\":\"@view.url_path\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"workspace_init max by workspace nw param (RUM)\",\"type\":\"query_table\"},\"id\":100041},{\"layout\":{\"x\":0,\"width\":2,\"y\":15,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"why the hell is this taking 2h+ https://us5.datadoghq.com/rum/sessions?query=%40type%3Aview%20%40view.name%3AWorkspace%20%40view.loading_type%3Ainitial_load%20%40view.url%3A%2Anw%3D%2A%20%40context.datadogView.was_backgrounded%3Afalse%20env%3Aproduction%20AND%20%40context.entityName%3Aelisa-motta-&event=AwAAAZ-xlf0q88SBnQAAABhBWi14bGYwcUFBRHU5TXF3VEs2VWtaTUQAAAAkMTE5ZmIyMDktOTM0My00NDNhLWI2YjgtYjY5YWM5Y2FjZWEzAADbxg&fromUser=false&index=%2A&type=rum&viz=stream&from_ts=1784920005072&to_ts=1785524805072&live=true\",\"text_align\":\"left\"},\"id\":100042},{\"layout\":{\"x\":0,\"width\":12,\"y\":17,\"height\":5},\"definition\":{\"style\":{\"display\":{\"legend\":\"automatic\",\"type\":\"stacked\"}},\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"formula\":\"query1 / 1000000000\"}],\"sort\":{\"count\":50,\"order_by\":[{\"index\":0,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @view.url:*nw=* @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":50,\"sort\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"workspace_init top entities (p99)\",\"type\":\"toplist\"},\"id\":100043}]},\"id\":100044},{\"layout\":{\"x\":0,\"width\":12,\"y\":36,\"is_column_break\":true,\"height\":4},\"definition\":{\"background_color\":\"orange\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"4. Toggle Run Visibility (Eyeball Clicks)\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000008\"},\"id\":100045},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User clicking eyeballs in runs selector\\n- End: Panel with selected runs show up\",\"text_align\":\"left\"},\"id\":100046}]},\"id\":100047},{\"layout\":{\"x\":0,\"width\":12,\"y\":40,\"height\":4},\"definition\":{\"background_color\":\"yellow\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"5. Metric Selection in Edit Panel Modal\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000009\"},\"id\":100048},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User typing metric name in the metric search of edit panel modal\\n- End: Panel showing up (?)\",\"text_align\":\"left\"},\"id\":100049}]},\"id\":100050},{\"layout\":{\"x\":0,\"width\":12,\"y\":44,\"height\":4},\"definition\":{\"background_color\":\"green\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"6. Selection Pagination\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000010\"},\"id\":100051},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User clicking `<` and `>` in section\\n- End: A new page of panels show up\",\"text_align\":\"left\"},\"id\":100052}]},\"id\":100053},{\"layout\":{\"x\":0,\"width\":12,\"y\":48,\"height\":4},\"definition\":{\"background_color\":\"blue\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"7. Hovering Panel Data\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"cover\",\"has_background\":true,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000011\"},\"id\":100054},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User hovering panel to see specific point in line\\n- End: Legend with point data show up with syncing other panels\",\"text_align\":\"left\"},\"id\":100055}]},\"id\":100056}],\"author_handle\":\"example-author\",\"template_variables\":[{\"default\":\"*\",\"prefix\":\"env\",\"name\":\"env\"},{\"default\":\"*\",\"prefix\":\"customer-ns\",\"name\":\"customer-ns\"},{\"default\":\"*\",\"prefix\":\"@view.url_host\",\"name\":\"view.url_host\"}],\"url\":\"/dashboard/zza-xmd-7jt/perf-strike-team\",\"reflow_type\":\"fixed\",\"id\":\"id-000012\",\"modified_at\":\"2026-07-31T19:23:10.149500+00:00\"}},\"new_value\":{\"dashboard_definition\":{\"author_name\":\"Example Author\",\"template_variable_presets\":[{\"name\":\"Joyce\",\"description\":\"drafts\",\"template_variables\":[{\"name\":\"env\",\"value\":\"devprod\"},{\"name\":\"customer-ns\",\"value\":\"*\"},{\"name\":\"view.url_host\",\"value\":\"example.ai\"}]}],\"tabs\":[{\"name\":\"Tab 1\",\"widget_ids\":[5786555378127436,2795964700760912,3725357411171479,6879929085074505],\"id\":\"id-000013\"},{\"name\":\"1. Workspace Loading\",\"widget_ids\":[2596549404097146,1738862716789832,8118717586213844,7116521192235267,1085918712924402,5375242069538586,7632570881757390,6424405168251415,6894734997716994],\"id\":\"id-000014\"},{\"name\":\"2. Panel Bank Search\",\"widget_ids\":[1872967732978139],\"id\":\"id-000015\"},{\"name\":\"3.\",\"id\":\"id-000016\"},{\"name\":\"Tab 5\",\"id\":\"id-000017\"},{\"name\":\"Tab 6\",\"id\":\"id-000018\"},{\"name\":\"Tab 7\",\"id\":\"id-000019\"}],\"description\":\"[[suggested_dashboards]]\",\"layout_type\":\"ordered\",\"created_at\":\"2026-07-09T20:30:19.501285+00:00\",\"title\":\"Perf Strike Team\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":12,\"y\":0,\"height\":1},\"definition\":{\"background_color\":\"green\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"Core Web Vitals\",\"type\":\"group\"},\"id\":100020},{\"layout\":{\"x\":0,\"width\":12,\"y\":0,\"height\":4},\"definition\":{\"background_color\":\"purple\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"2. Panel Bank Search\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000005\"},\"id\":100021},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User typing in panel search input\\n- End: Selected panels showing up\",\"text_align\":\"left\"},\"id\":100022}]},\"id\":100023},{\"layout\":{\"x\":0,\"width\":2,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"# Critical workflows\\n1. Workspace loading\\n2. Panel bank search\\n3. Runs search\\n4. Toggle run visibility (eyeball click)\\n5. Metric selection in edit panel modal\\n6. Section pagination\\n7. Hovering panel data\\n\",\"text_align\":\"left\"},\"id\":100024},{\"layout\":{\"x\":2,\"width\":2,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"## Metrics to add\\n- \\\\# of slow views\\n- list of graphql queries & its latencies\\n- list of long tasks\\n- good or bad (define threshold like # of slow views > 10?)\\n\\n## Start and end definition\\n- start \\u2014 \\n- end \\u2014 after data returns and filters section & panels right before react re-rendering?\",\"text_align\":\"left\"},\"id\":100025},{\"layout\":{\"x\":4,\"width\":2,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"## TODO\\n- separate these workflow into its own tab\\n\",\"text_align\":\"left\"},\"id\":100026},{\"layout\":{\"x\":0,\"width\":12,\"y\":1,\"height\":1},\"definition\":{\"background_color\":\"yellow\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"HistoryKeysByHash Perf\",\"type\":\"group\"},\"id\":100027},{\"layout\":{\"x\":0,\"width\":12,\"y\":2,\"height\":11},\"definition\":{\"background_color\":\"gray\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"Justin - possible metrics\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":4,\"y\":0,\"height\":2},\"definition\":{\"title_align\":\"left\",\"title_size\":\"16\",\"has_search_bar\":\"auto\",\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"formula\":\"query1\",\"cell_display_mode\":\"bar\"},{\"formula\":\"query2\",\"cell_display_mode\":\"bar\"},{\"formula\":\"query3\",\"cell_display_mode\":\"bar\"},{\"alias\":\"50ms+ compressions\",\"formula\":\"query4\",\"cell_display_mode\":\"bar\"}],\"sort\":{\"count\":590,\"order_by\":[{\"index\":0,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:action @action.name:\\\"workspace.save_duration\\\" @context.compressDuration:>10\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":30,\"sort\":{\"metric\":\"count\",\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@context.compressDuration\",\"aggregation\":\"pc75\"},\"search\":{\"query\":\"@type:action @action.name:\\\"workspace.save_duration\\\" @context.compressDuration:>10\"},\"indexes\":[\"*\"],\"name\":\"query2\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":30,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@context.compressDuration\",\"aggregation\":\"max\"},\"search\":{\"query\":\"@type:action @action.name:\\\"workspace.save_duration\\\" @context.compressDuration:>10\"},\"indexes\":[\"*\"],\"name\":\"query3\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":30,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:action @action.name:\\\"workspace.save_duration\\\" @context.compressDuration:>50\"},\"indexes\":[\"*\"],\"name\":\"query4\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":500,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"\",\"type\":\"query_table\"},\"id\":100028},{\"layout\":{\"x\":5,\"width\":5,\"y\":0,\"height\":8},\"definition\":{\"title_align\":\"left\",\"title_size\":\"16\",\"has_search_bar\":\"auto\",\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"alias\":\"Max Workspace Keys\",\"formula\":\"query1\",\"cell_display_mode\":\"number\"},{\"alias\":\"Longest Task\",\"formula\":\"query2\",\"cell_display_mode\":\"bar\"},{\"alias\":\"Pc90 Task\",\"formula\":\"query3\",\"cell_display_mode\":\"number\"},{\"alias\":\"Count\",\"formula\":\"query4\",\"cell_display_mode\":\"bar\"},{\"alias\":\"Average\",\"formula\":\"query5\",\"cell_display_mode\":\"bar\"}],\"sort\":{\"count\":500,\"order_by\":[{\"index\":3,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"metric\":\"@context.keyCount\",\"aggregation\":\"max\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"max\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query2\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"pc90\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query3\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query4\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"avg\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query5\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"Autosync Cache Key Pain By Entity\",\"type\":\"query_table\"},\"id\":100029},{\"layout\":{\"x\":10,\"width\":2,\"y\":0,\"height\":4},\"definition\":{\"legend_columns\":[\"avg\",\"min\",\"max\",\"value\",\"sum\"],\"title_align\":\"left\",\"title_size\":\"16\",\"show_legend\":true,\"requests\":[{\"display_type\":\"line\",\"response_format\":\"timeseries\",\"formulas\":[{\"formula\":\"query1\"},{\"formula\":\"query2\"}],\"style\":{\"line_width\":\"normal\",\"line_type\":\"solid\",\"order_by\":\"values\",\"palette\":\"dog_classic\"},\"queries\":[{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"median\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"pc90\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query2\",\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"Slow cache key generation\",\"type\":\"timeseries\",\"legend_layout\":\"auto\"},\"id\":100030},{\"layout\":{\"x\":0,\"width\":5,\"y\":2,\"height\":8},\"definition\":{\"title_align\":\"left\",\"title_size\":\"16\",\"has_search_bar\":\"auto\",\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"alias\":\"100ms+\",\"formula\":\"query1\",\"cell_display_mode\":\"bar\"},{\"alias\":\"500ms+\",\"formula\":\"query3\",\"cell_display_mode\":\"bar\"},{\"alias\":\"Count\",\"formula\":\"query4\",\"cell_display_mode\":\"bar\"}],\"sort\":{\"count\":1100,\"order_by\":[{\"index\":2,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_panel_bank\\\" @vital.duration:>100000000\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":50,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_panel_bank\\\" @vital.duration:>500000000\"},\"indexes\":[\"*\"],\"name\":\"query3\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":50,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_panel_bank\\\" @vital.duration:>100000000\"},\"indexes\":[\"*\"],\"name\":\"query4\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":1000,\"sort\":{\"metric\":\"count\",\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"Slow autosync_panel_bank\",\"type\":\"query_table\"},\"id\":100031}]},\"id\":100032},{\"layout\":{\"x\":0,\"width\":12,\"y\":2,\"height\":4},\"definition\":{\"background_color\":\"blue\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"1. Workspace Loading\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000006\"},\"id\":100033},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":1},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User visiting example.ai//\\n- End: Runs search & panels show up\",\"text_align\":\"left\"},\"id\":100034}]},\"id\":100035},{\"layout\":{\"x\":0,\"width\":12,\"y\":6,\"height\":4},\"definition\":{\"background_color\":\"pink\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"3. Runs Search\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"cover\",\"has_background\":true,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000007\"},\"id\":100036},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":1},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User typing in runs search input\\n- End: Panel showing up\",\"text_align\":\"left\"},\"id\":100037}]},\"id\":100038},{\"layout\":{\"x\":0,\"width\":12,\"y\":13,\"height\":23},\"definition\":{\"background_color\":\"blue\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"Joyce - workspace loading proposals\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":12,\"y\":0,\"height\":5},\"definition\":{\"legend_columns\":[\"avg\",\"min\",\"max\",\"value\",\"sum\"],\"show_legend\":true,\"requests\":[{\"display_type\":\"line\",\"response_format\":\"timeseries\",\"formulas\":[{\"alias\":\"p95\",\"formula\":\"query1 / 1000000000\",\"number_format\":{\"unit\":{\"unit_name\":\"second\",\"type\":\"canonical_unit\"}}},{\"alias\":\"p98\",\"formula\":\"query2 / 1000000000\",\"number_format\":{\"unit\":{\"unit_name\":\"second\",\"type\":\"canonical_unit\"}}},{\"alias\":\"p99\",\"formula\":\"query3 / 1000000000\",\"number_format\":{\"unit\":{\"unit_name\":\"second\",\"type\":\"canonical_unit\"}}}],\"style\":{\"line_width\":\"normal\",\"line_type\":\"solid\",\"order_by\":\"values\",\"palette\":\"dog_classic\"},\"queries\":[{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc95\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc98\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query2\",\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query3\",\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"Multi-run page - workspace_init (BEFORE we hit any workspace-related logic)\",\"type\":\"timeseries\",\"legend_layout\":\"auto\"},\"id\":100039},{\"layout\":{\"x\":0,\"width\":12,\"y\":5,\"height\":5},\"definition\":{\"xaxis\":{\"include_zero\":true,\"min\":\"auto\",\"max\":\"auto\",\"scale\":\"linear\"},\"show_legend\":true,\"requests\":[{\"request_type\":\"histogram\",\"query\":{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc95\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"storage\":\"hot\",\"data_source\":\"rum\"}}],\"title\":\"Multi-run page - workspace_init (BEFORE we hit any workspace-related logic)\",\"type\":\"distribution\",\"yaxis\":{\"include_zero\":true,\"min\":\"auto\",\"max\":\"auto\",\"scale\":\"linear\"}},\"id\":100040},{\"layout\":{\"x\":0,\"width\":12,\"y\":10,\"height\":5},\"definition\":{\"has_search_bar\":\"auto\",\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"alias\":\"p99_seconds\",\"formula\":\"query1 / 1000000000\",\"cell_display_mode\":\"bar\"}],\"sort\":{\"count\":50,\"order_by\":[{\"index\":0,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @view.url:*nw=* @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":50,\"sort\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\",\"order\":\"desc\"},\"facet\":\"@view.url_path\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"workspace_init max by workspace nw param (RUM)\",\"type\":\"query_table\"},\"id\":100041},{\"layout\":{\"x\":0,\"width\":2,\"y\":15,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"why the hell is this taking 2h+ https://us5.datadoghq.com/rum/sessions?query=%40type%3Aview%20%40view.name%3AWorkspace%20%40view.loading_type%3Ainitial_load%20%40view.url%3A%2Anw%3D%2A%20%40context.datadogView.was_backgrounded%3Afalse%20env%3Aproduction%20AND%20%40context.entityName%3Aelisa-motta-&event=AwAAAZ-xlf0q88SBnQAAABhBWi14bGYwcUFBRHU5TXF3VEs2VWtaTUQAAAAkMTE5ZmIyMDktOTM0My00NDNhLWI2YjgtYjY5YWM5Y2FjZWEzAADbxg&fromUser=false&index=%2A&type=rum&viz=stream&from_ts=1784920005072&to_ts=1785524805072&live=true\",\"text_align\":\"left\"},\"id\":100042},{\"layout\":{\"x\":0,\"width\":12,\"y\":17,\"height\":5},\"definition\":{\"style\":{\"display\":{\"legend\":\"automatic\",\"type\":\"stacked\"}},\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"formula\":\"query1 / 1000000000\"}],\"sort\":{\"count\":50,\"order_by\":[{\"index\":0,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @view.url:*nw=* @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":50,\"sort\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"workspace_init top entities (p99)\",\"type\":\"toplist\"},\"id\":100043}]},\"id\":100044},{\"layout\":{\"x\":0,\"width\":12,\"y\":36,\"is_column_break\":true,\"height\":4},\"definition\":{\"background_color\":\"orange\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"4. Toggle Run Visibility (Eyeball Clicks)\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000008\"},\"id\":100045},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User clicking eyeballs in runs selector\\n- End: Panel with selected runs show up\",\"text_align\":\"left\"},\"id\":100046}]},\"id\":100047},{\"layout\":{\"x\":0,\"width\":12,\"y\":40,\"height\":4},\"definition\":{\"background_color\":\"yellow\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"5. Metric Selection in Edit Panel Modal\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000009\"},\"id\":100048},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User typing metric name in the metric search of edit panel modal\\n- End: Panel showing up (?)\",\"text_align\":\"left\"},\"id\":100049}]},\"id\":100050},{\"layout\":{\"x\":0,\"width\":12,\"y\":44,\"height\":4},\"definition\":{\"background_color\":\"green\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"6. Selection Pagination\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000010\"},\"id\":100051},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User clicking `<` and `>` in section\\n- End: A new page of panels show up\",\"text_align\":\"left\"},\"id\":100052}]},\"id\":100053},{\"layout\":{\"x\":0,\"width\":12,\"y\":48,\"height\":4},\"definition\":{\"background_color\":\"blue\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"7. Hovering Panel Data\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"cover\",\"has_background\":true,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000011\"},\"id\":100054},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User hovering panel to see specific point in line\\n- End: Legend with point data show up with syncing other panels\",\"text_align\":\"left\"},\"id\":100055}]},\"id\":100056}],\"author_handle\":\"example-author\",\"template_variables\":[{\"default\":\"*\",\"prefix\":\"env\",\"name\":\"env\"},{\"default\":\"*\",\"prefix\":\"customer-ns\",\"name\":\"customer-ns\"},{\"default\":\"*\",\"prefix\":\"@view.url_host\",\"name\":\"view.url_host\"}],\"url\":\"/dashboard/zza-xmd-7jt/perf-strike-team\",\"reflow_type\":\"fixed\",\"id\":\"id-000012\",\"modified_at\":\"2026-07-31T19:23:16.908589+00:00\"}}},\"uuid\":\"id-000057\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"California\",\"iso_code\":\"US-CA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.6/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"San Francisco\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.4\",\"location\":{\"latitude\":37.77493,\"longitude\":-122.41942}},\"ip\":\"198.51.100.4\"}},\"timestamp\":\"2026-07-31T19:23:17.107Z\",\"status\":\"info\"},\"_id\":\"id-000058\",\"source\":\"audit\",\"message\":\"user02@example.com modified the dashboard Perf Strike Team\",\"status\":\"info\",\"tags\":[\"is_previewable_event:false\",\"is_notable_event:false\",\"is_mcp_call:false\",\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:22:58.866Z\",\"attributes\":{\"auth_method\":\"SYSTEM\",\"evt\":{\"actor\":{\"type\":\"SYSTEM\"},\"name\":\"Datadog Agent\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000059\"},\"integration_name\":\"service-discovery\",\"host_metadata\":{\"hostname\":\"example-host\",\"os\":\"\"},\"datadog_agent_key\":\"REDACTED\",\"event_name\":\"Integration Installed\",\"source\":[\"local\"],\"agent_metadata\":{\"flavor\":\"\",\"agent_version\":\"\",\"remote_updates_enabled\":false,\"install_method_tool\":\"\"}},\"action\":\"created\",\"asset\":{\"id\":\"id-000060\",\"type\":\"datadog_agent_configuration\"},\"uuid\":\"id-000061\",\"status\":\"info\",\"timestamp\":\"2026-07-31T19:22:58.866Z\"},\"_id\":\"id-000062\",\"source\":\"audit\",\"message\":\"Integration service-discovery installed on host\",\"status\":\"info\",\"tags\":[\"is_previewable_event:true\",\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:23:12.112Z\",\"attributes\":{\"auth_method\":\"SYSTEM\",\"evt\":{\"actor\":{\"type\":\"SYSTEM\"},\"name\":\"Datadog Agent\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000063\"},\"integration_name\":\"redis\",\"host_metadata\":{\"hostname\":\"example-host\",\"os\":\"\"},\"datadog_agent_key\":\"REDACTED\",\"event_name\":\"Integration Modified\",\"source\":[\"local\"],\"agent_metadata\":{\"flavor\":\"\",\"agent_version\":\"\",\"remote_updates_enabled\":false,\"install_method_tool\":\"\"}},\"action\":\"modified\",\"asset\":{\"id\":\"id-000064\",\"type\":\"datadog_agent_configuration\",\"prev_value\":{\"redisdb:7cb25ff876b899f1\":{\"port\":6379,\"host\":\"198.51.100.7\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:d84be0be7fd4ef3f\":{\"port\":\"6379\",\"host\":\"198.51.100.8\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:942dd83468ad984a\":{\"port\":6379,\"host\":\"198.51.100.9\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:10a931455444b1df\":{\"port\":\"6379\",\"host\":\"198.51.100.10\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:10baada62c3b2267\":{\"port\":6379,\"host\":\"198.51.100.8\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:c79c815b1d4b96e4\":{\"port\":\"6379\",\"host\":\"198.51.100.11\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:9af67e250eb281e4\":{\"port\":\"6379\",\"host\":\"198.51.100.12\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:1a388803ca6ffe11\":{\"port\":\"6379\",\"host\":\"198.51.100.13\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:d27ca5eb438a61f2\":{\"port\":6379,\"host\":\"198.51.100.14\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:e5ab3c5461018809\":{\"port\":\"6379\",\"host\":\"198.51.100.14\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:8da7c81a4e861345\":{\"port\":6379,\"host\":\"198.51.100.15\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:58834decc2ba3d\":{\"port\":\"6379\",\"host\":\"198.51.100.16\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:7aade5a8c38adeb1\":{\"port\":\"6379\",\"host\":\"198.51.100.15\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:e3b90f3e43924517\":{\"port\":\"6379\",\"host\":\"198.51.100.17\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:b3deaaed9a2ad761\":{\"port\":6379,\"host\":\"198.51.100.13\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:7110b07926056253\":{\"port\":6379,\"host\":\"198.51.100.18\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:9aefd7d3e29077ea\":{\"port\":\"6379\",\"host\":\"198.51.100.19\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:b8f5331710244154\":{\"port\":6379,\"host\":\"198.51.100.10\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:c7c8ece6b488cb56\":{\"port\":\"6379\",\"host\":\"198.51.100.9\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:8d8905b56566799b\":{\"port\":\"6379\",\"host\":\"198.51.100.7\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:bafceef4140d9995\":{\"port\":6379,\"host\":\"198.51.100.12\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:8d7f6192cd5df736\":{\"port\":6379,\"host\":\"198.51.100.19\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:8ed3a1e948696016\":{\"port\":6379,\"host\":\"198.51.100.11\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:98717c627b2963a5\":{\"port\":6379,\"host\":\"198.51.100.17\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:b0710ee4ef42e154\":{\"port\":\"6379\",\"host\":\"198.51.100.18\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:cf46da301ec66a78\":{\"port\":6379,\"host\":\"198.51.100.16\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]}},\"new_value\":{\"redisdb:eb864352a1a2db64\":{\"port\":6379,\"host\":\"198.51.100.20\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000013\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:63b93638503dbd2\":{\"port\":\"6379\",\"host\":\"198.51.100.20\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000013\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:34c6bec2c01cd159\":{\"port\":\"6379\",\"host\":\"198.51.100.21\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000013\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:f27d25c1da45af54\":{\"port\":6379,\"host\":\"198.51.100.21\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000013\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]}}},\"uuid\":\"id-000065\",\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:12.112Z\"},\"_id\":\"id-000066\",\"source\":\"audit\",\"message\":\"Integration redis modified on host\",\"status\":\"info\",\"tags\":[\"is_previewable_event:true\",\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:23:36.163Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Audit Trail\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000067\"},\"user_uuid\":\"00000000-0000-4000-8000-000000000014\",\"user_id\":100068,\"org_id\":100069,\"track\":\"audit\"},\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.22\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":7},\"location\":{\"country\":\"US\",\"city\":\"Seattle\",\"state\":\"Washington\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"uuid\":\"id-000070\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"Washington\",\"iso_code\":\"US-WA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.23/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Seattle\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.22\",\"location\":{\"latitude\":47.60621,\"longitude\":-122.33207}},\"ip\":\"198.51.100.22\"}},\"auth_method\":\"SESSION\",\"usr\":{\"created\":\"2024-08-23T20:49:04Z\",\"name\":\"Example User 02\",\"id\":\"user03@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000014\",\"email\":\"user03@example.com\"},\"action\":\"queried\",\"http\":{\"status_code\":200,\"url_details\":{\"path\":\"/api/v1/logs-analytics/list?type=audit\"},\"method\":\"POST\",\"level\":\"info\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"asset\":{\"type\":\"query\",\"new_value\":{\"query_source\":\"monitor_ui\",\"query\":{\"search\":\"(@asset.id:21072431 AND @asset.type:monitor AND NOT @action:resolved) OR (@asset.id:21072431 AND @asset.type:monitor AND @action:resolved ) OR (@asset.id:\\\"monitor:21072431\\\" AND @asset.type:restriction_policy)\",\"time_range\":1104445,\"to_ts\":\"1785525815733\",\"from_ts\":\"1785524711288\",\"limit\":100},\"query_type\":\"list\"}},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:36.163Z\"},\"_id\":\"id-000071\",\"source\":\"audit\",\"message\":\"user03@example.com successfully queried audit data with query '(@asset.id:21072431 AND @asset.type:monitor AND NOT @action:resolved) OR (@asset.id:21072431 AND @asset.type:monitor AND @action:resolved ) OR (@asset.id:\\\"monitor:21072431\\\" AND @asset.type:restriction_policy)'\",\"status\":\"info\",\"tags\":[\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:23:49.952Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Log Management\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000072\"},\"user_uuid\":\"00000000-0000-4000-8000-000000000015\",\"user_id\":100073,\"org_id\":100069,\"track\":\"logs\"},\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.24\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Los Angeles, CA\",\"client\":{\"types\":[\"MOBILE\",\"DESKTOP\"],\"count\":7},\"location\":{\"country\":\"US\",\"city\":\"Los Angeles\",\"state\":\"California\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"uuid\":\"id-000074\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"California\",\"iso_code\":\"US-CA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.25/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Los Angeles\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.24\",\"location\":{\"latitude\":34.05223,\"longitude\":-118.24368}},\"ip\":\"198.51.100.24\"}},\"auth_method\":\"SESSION\",\"usr\":{\"created\":\"2026-03-06T16:31:25Z\",\"name\":\"Example User 03\",\"id\":\"user04@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000015\",\"email\":\"user04@example.com\"},\"action\":\"queried\",\"http\":{\"status_code\":200,\"url_details\":{\"path\":\"/api/v1/logs-analytics/list?type=logs\"},\"method\":\"POST\",\"level\":\"info\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"asset\":{\"type\":\"logs_query\",\"new_value\":{\"query_source\":\"logs_explorer\",\"query\":{\"search\":\"env:prod\",\"indexes\":[\"*\"],\"time_range\":900000,\"to_ts\":\"1785525811200\",\"from_ts\":\"1785524911200\",\"limit\":50,\"data_access\":{\"indexes\":[\"*\"],\"restriction_queries\":[{\"query\":\"NOT(@data.methodName:FetchAuthUserByAPIKey AND @data.key:* AND (NOT @data.key:local-* OR @data.key:local-????????????????????????????????????????))\"}]}},\"query_type\":\"list\",\"storage\":\"indexes\"}},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:49.952Z\"},\"_id\":\"id-000075\",\"source\":\"audit\",\"message\":\"user04@example.com successfully queried logs data with query 'env:prod'\",\"status\":\"info\",\"tags\":[\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:23:56.275Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Request\"},\"auth_method\":\"SESSION\",\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"created\":\"2024-08-23T20:49:03.000Z\",\"name\":\"Example User 04\",\"id\":\"user05@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000016\",\"email\":\"user05@example.com\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.26\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":11,\"concentration\":{\"country\":\"US\",\"density\":1,\"city\":\"Buffalo\",\"geohash\":\"dpxuj2\",\"state\":\"New York\",\"skew\":731},\"countries\":1},\"location\":{\"country\":\"US\",\"city\":\"Chicago\",\"state\":\"Illinois\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"http\":{\"url_details\":{\"path\":\"/api/v0/synthetics/tests/pdj-nxa-4jc/status\",\"host\":\"us5.prod.dog\"},\"status_code\":200,\"method\":\"GET\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"action\":\"authorized\",\"uuid\":\"id-000076\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"Illinois\",\"iso_code\":\"US-IL\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.27/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Chicago\"},\"timezone\":\"America/Chicago\",\"ipAddress\":\"198.51.100.26\",\"location\":{\"latitude\":41.85003,\"longitude\":-87.65005}},\"ip\":\"198.51.100.26\"}},\"timestamp\":\"2026-07-31T19:23:56.275Z\",\"status\":\"info\"},\"_id\":\"id-000077\",\"source\":\"audit\",\"message\":\"user05@example.com was authorized to perform view on resource synthetics-test (pdj-nxa-4jc)\",\"status\":\"info\",\"tags\":[\"is_previewable_event:false\",\"is_notable_event:false\",\"is_mcp_call:false\",\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:23:59.886Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Organization Management\"},\"auth_method\":\"SESSION\",\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"created\":\"2026-06-20T18:46:11.000Z\",\"name\":\"Example User 05\",\"id\":\"user01@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000002\",\"email\":\"user01@example.com\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.1\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":4,\"concentration\":{\"country\":\"US\",\"density\":1,\"city\":\"Sun Lakes\",\"geohash\":\"9tbmnn\",\"state\":\"Arizona\",\"skew\":596},\"countries\":1},\"location\":{\"country\":\"US\",\"city\":\"Los Angeles\",\"state\":\"California\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"http\":{\"url_details\":{\"path\":\"/api/v2/domain_allowlist\",\"host\":\"us5.prod.dog\"},\"status_code\":200,\"method\":\"GET\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"action\":\"accessed\",\"asset\":{\"name\":\"domain_allowlist\",\"id\":\"id-000078\",\"type\":\"email_domain_allowlist\"},\"uuid\":\"id-000079\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"California\",\"iso_code\":\"US-CA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.3/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Los Angeles\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.1\",\"location\":{\"latitude\":34.05223,\"longitude\":-118.24368}},\"ip\":\"198.51.100.1\"}},\"timestamp\":\"2026-07-31T19:23:59.886Z\",\"status\":\"info\"},\"_id\":\"id-000080\",\"source\":\"audit\",\"message\":\"user01@example.com viewed domain allowlist\",\"status\":\"info\",\"tags\":[\"is_previewable_event:false\",\"is_notable_event:false\",\"is_mcp_call:false\",\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:23:48.520Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"MCP Server\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000081\"},\"client\":{\"name\":\"cursor-vscode\",\"version\":\"1.0.0\"},\"mcp\":{\"request_id\":100082},\"oauth_client\":{\"name\":\"Cursor\",\"uuid\":\"00000000-0000-4000-8000-000000000017\"}},\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.28\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Los Angeles, CA\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":7,\"concentration\":{\"country\":\"US\",\"density\":1,\"city\":\"Waldon\",\"geohash\":\"9q9pz0\",\"state\":\"California\",\"skew\":550},\"countries\":1},\"location\":{\"country\":\"US\",\"city\":\"Los Angeles\",\"state\":\"California\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"uuid\":\"id-000083\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"California\",\"iso_code\":\"US-CA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.25/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Los Angeles\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.28\",\"location\":{\"latitude\":34.05223,\"longitude\":-118.24368}},\"ip\":\"198.51.100.28\"}},\"auth_method\":\"OAUTH_TOKEN\",\"usr\":{\"created\":\"2024-08-23T20:49:04Z\",\"name\":\"Example User 06\",\"id\":\"user06@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000018\",\"email\":\"user06@example.com\"},\"action\":\"executed\",\"http\":{\"status_code\":200,\"url_details\":{\"path\":\"/v1/mcp?toolsets=core,visualizations\"},\"method\":\"POST\",\"level\":\"info\",\"useragent\":\"Cursor/3.14.7 (darwin arm64)\"},\"asset\":{\"type\":\"mcp\"},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:48.52Z\"},\"_id\":\"id-000084\",\"source\":\"audit\",\"message\":\"user06@example.com initialized a connection\",\"status\":\"info\",\"tags\":[\"is_mcp_call:true\",\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:23:58.350Z\",\"attributes\":{\"auth_method\":\"SYSTEM\",\"evt\":{\"actor\":{\"type\":\"SYSTEM\"},\"name\":\"Workflows\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000085\"},\"run_as_user_mode\":\"owner\",\"workflow_id\":\"id-000086\",\"instance_id\":\"id-000087\",\"workflow_name\":\"MI - EKS IAM role policy count anomaly emitter\",\"creation_source\":\"user08\",\"created_at\":\"2026-05-12T21:26:01.389503Z\",\"created_at_unix\":1778621161,\"source\":{\"scheduled_to_run_at\":\"2026-07-31T19:23:56Z\",\"source_type\":\"schedule\",\"manual\":false,\"schedule_id\":\"id-000088\"},\"trigger_payload_hash\":\"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a\",\"run_as_user\":{\"is_service_account\":true,\"name\":\"Terraform Workspaces\",\"id\":\"id-000089\"},\"status\":\"published\"},\"action\":\"executed\",\"asset\":{\"path\":\"/workflow/00000000-0000-4000-8000-000000000019?instance=00000000-0000-4000-8000-000000000020\",\"name\":\"Workflow \\\"MI - EKS IAM role policy count anomaly emitter\\\" from schedule\",\"id\":\"id-000086\",\"type\":\"workflow\"},\"uuid\":\"id-000090\",\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:58.35Z\"},\"_id\":\"id-000091\",\"source\":\"audit\",\"message\":\"launched workflow \\\"MI - EKS IAM role policy count anomaly emitter\\\"\",\"status\":\"info\",\"tags\":[\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:33:03.620Z\",\"attributes\":{\"auth_method\":\"SESSION\",\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Bits AI SRE\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000092\"}},\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"created\":\"2024-08-23T20:49:04Z\",\"name\":\"Example User 02\",\"id\":\"user03@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000014\",\"email\":\"user03@example.com\"},\"action\":\"created\",\"asset\":{\"name\":\"submit_remediations\",\"id\":\"tool:submit_remediations@2026-07-31T19:33:03Z\",\"type\":\"tool_call\",\"new_value\":{\"duration_ms\":0,\"tool_name\":\"submit_remediations\",\"executor_uuid\":\"00000000-0000-4000-8000-000000000014\",\"run_origin\":\"execution_source_regular\",\"datadog_product_name\":\"\",\"result_status\":\"success\",\"started_at\":\"2026-07-31T19:33:03Z\",\"source\":\"bits-copilot\",\"initiator_uuid\":\"00000000-0000-4000-8000-000000000014\"}},\"uuid\":\"id-000093\",\"status\":\"info\",\"timestamp\":\"2026-07-31T19:33:03.62Z\"},\"_id\":\"id-000094\",\"source\":\"audit\",\"message\":\"user03@example.com successfully created tool_call \\\"submit_remediations\\\"\",\"status\":\"info\",\"tags\":[\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:33:18.108Z\",\"attributes\":{\"auth_method\":\"SYSTEM\",\"evt\":{\"actor\":{\"type\":\"SYSTEM\"},\"name\":\"Bits AI SRE\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000092\"},\"fqn\":\"com.datadoghq.slack.listWorkspaces\",\"actions_client\":\"BITS_SRE\",\"action_name\":\"listWorkspaces\",\"bundle_id\":\"id-000095\",\"result_hash\":\"5334519f7311840e1e0e226684de9dabea20ec6b704af4ba4dfe243dcc87b87b\",\"session_id\":\"id-000096\",\"action_client\":\"BITS_SRE\"},\"action\":\"completed\",\"asset\":{\"name\":\"action task com.datadoghq.slack.listWorkspaces\",\"id\":\"id-000097\",\"type\":\"action_platform_task\"},\"uuid\":\"id-000098\",\"status\":\"info\",\"timestamp\":\"2026-07-31T19:33:18.108Z\"},\"_id\":\"id-000099\",\"source\":\"audit\",\"message\":\"successfully completed action task com.datadoghq.slack.listWorkspaces 00000000-0000-4000-8000-000000000021\",\"status\":\"info\",\"tags\":[\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:20:36.235Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Monitor\"},\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.29\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":8},\"location\":{\"country\":\"US\",\"city\":\"San Jose\",\"state\":\"California\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"uuid\":\"id-000100\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"California\",\"iso_code\":\"US-CA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.6/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"San Francisco\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.29\",\"location\":{\"latitude\":37.77493,\"longitude\":-122.41942}},\"ip\":\"198.51.100.29\"}},\"tags\":[\"canary_type:basic\",\"monitor_id:19123273\",\"origin:UI\"],\"auth_method\":\"SESSION\",\"usr\":{\"created\":\"2024-10-07T16:54:06.000Z\",\"name\":\"Example User 07\",\"id\":\"user07@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000022\",\"email\":\"user07@example.com\"},\"http\":{\"url_details\":{\"path\":\"/api/v1/monitor/19123273\",\"host\":\"us5.prod.dog\"},\"status_code\":200,\"method\":\"PUT\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.5 Safari/537.36\"},\"action\":\"modified\",\"asset\":{\"name\":\"[Sandboxes] Canary Success Rate is Low\",\"id\":\"id-000101\",\"type\":\"monitor\",\"prev_value\":{\"created\":\"2026-04-13T20:12:59.254963+00:00\",\"query\":\"avg(last_15m):avg:sandbox.canary.success{canary_type:basic} < 0.68\",\"name\":\"[Sandboxes] Canary Success Rate is Low\",\"options\":{\"thresholds\":{\"critical\":0.68,\"warning\":0.81,\"warning_recovery\":0.95,\"critical_recovery\":0.9},\"renotify_interval\":0,\"on_missing_data\":\"show_and_notify_no_data\",\"new_host_delay\":300,\"notification_preset_name\":\"show_all\",\"include_tags\":true,\"escalation_message\":\"\",\"notify_audit\":false},\"modified\":\"2026-06-04T00:02:51.091493+00:00\",\"overall_state\":\"No Data\",\"draft_status\":\"published\",\"id\":100102,\"type\":\"query alert\",\"message\":\"{{#is_alert}}\\n\\ud83d\\udd34 Sandbox canary failure rate is high \\u2014 success rate: {{value}} (threshold: {{threshold}})\\n\\n**Cluster:** example-evals-poc-cluster\\n\\n**Namespace:** aviato-system\\n\\n**CronJob:** sandbox-canary\\n\\n**Investigation Steps**:\\n1. Check the [Sandbox Ops Review dashboard](/dashboard/wpr-nk5-my7) for related metrics\\n2. Check recent pod logs: Find the job via `kubectl get jobs -n aviato-system | grep sandbox-canary` and check the logs with`kubectl logs -n aviato-system -l job-name= --tail=50`\\n3. Errors are logged to DD. Filter with `service:sandbox-canary status:error`.\\n\\n{{/is_alert}}\\n\\n{{#is_no_data}}\\n\\u26a0\\ufe0f Sandbox canary has stopped reporting data. Investigate whether the canary process is running.\\n{{/is_no_data}}\\n\\n{{#is_recovery}}\\n\\u2705 Sandbox canary has recovered.\\n{{/is_recovery}}\\n\\n@example-alerts\\n@user13@example.com\",\"multi\":false},\"new_value\":{\"created\":\"2026-04-13T20:12:59.254963+00:00\",\"query\":\"avg(last_15m):avg:sandbox.canary.success{canary_type:basic} < 0.68\",\"name\":\"[Sandboxes] Canary Success Rate is Low\",\"options\":{\"thresholds\":{\"critical\":0.68,\"warning\":0.81,\"warning_recovery\":0.95,\"critical_recovery\":0.9},\"renotify_interval\":0,\"on_missing_data\":\"show_and_notify_no_data\",\"new_host_delay\":300,\"notification_preset_name\":\"show_all\",\"include_tags\":true,\"escalation_message\":\"\",\"notify_audit\":false},\"modified\":\"2026-07-31T19:20:36.209920+00:00\",\"overall_state\":\"No Data\",\"draft_status\":\"published\",\"id\":100102,\"type\":\"query alert\",\"message\":\"{{#is_alert}}\\n\\ud83d\\udd34 Sandbox canary failure rate is high \\u2014 success rate: {{value}} (threshold: {{threshold}})\\n\\n**Cluster:** example-evals-poc-cluster\\n\\n**Namespace:** aviato-system\\n\\n**CronJob:** sandbox-canary\\n\\n**Investigation Steps**:\\n1. Check the [Sandbox Ops Review dashboard](/dashboard/wpr-nk5-my7) for related metrics\\n2. Check recent pod logs: Find the job via `kubectl get jobs -n aviato-system | grep sandbox-canary` and check the logs with`kubectl logs -n aviato-system -l job-name= --tail=50`\\n3. Errors are logged to DD. Filter with `service:sandbox-canary status:error`.\\n\\n{{/is_alert}}\\n\\n{{#is_no_data}}\\n\\u26a0\\ufe0f Sandbox canary has stopped reporting data. Investigate whether the canary process is running.\\n{{/is_no_data}}\\n\\n{{#is_recovery}}\\n\\u2705 Sandbox canary has recovered.\\n{{/is_recovery}}\\n\\n@example-alerts\",\"multi\":false}},\"timestamp\":\"2026-07-31T19:20:36.235Z\",\"status\":\"info\"},\"_id\":\"id-000103\",\"source\":\"audit\",\"message\":\"user07@example.com successfully modified monitor \\\"[Sandboxes] Canary Success Rate is Low\\\"\",\"status\":\"info\",\"tags\":[\"is_notable_event:false\",\"is_mcp_call:false\",\"is_previewable_event:true\",\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:22:35.940Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Case Management\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000104\"}},\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.22\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":7},\"location\":{\"country\":\"US\",\"city\":\"Seattle\",\"state\":\"Washington\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"uuid\":\"id-000105\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"Washington\",\"iso_code\":\"US-WA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.23/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Seattle\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.22\",\"location\":{\"latitude\":47.60621,\"longitude\":-122.33207}},\"ip\":\"198.51.100.22\"}},\"auth_method\":\"SESSION\",\"usr\":{\"created\":\"2024-08-23T20:49:04Z\",\"name\":\"Example User 02\",\"id\":\"user03@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000014\",\"email\":\"user03@example.com\"},\"action\":\"created\",\"http\":{\"status_code\":500,\"url_details\":{\"path\":\"/api/v2/cases/projects\"},\"method\":\"POST\",\"level\":\"error\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"asset\":{\"type\":\"project\"},\"status\":\"error\",\"timestamp\":\"2026-07-31T19:22:35.94Z\"},\"_id\":\"id-000106\",\"source\":\"audit\",\"message\":\"user03@example.com failed to create project \\\"\\\"\",\"status\":\"error\",\"tags\":[\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:28:41.881Z\",\"attributes\":{\"auth_method\":\"SESSION\",\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Bits AI SRE\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000092\"}},\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"created\":\"2024-08-23T20:49:04Z\",\"name\":\"Example User 02\",\"id\":\"user03@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000014\",\"email\":\"user03@example.com\"},\"action\":\"started\",\"asset\":{\"name\":\"investigation:00000000-0000-4000-8000-000000000023\",\"id\":\"id-000096\",\"type\":\"investigation\",\"new_value\":{\"executor_uuid\":\"00000000-0000-4000-8000-000000000014\",\"event_id\":\"id-000107\",\"monitor_id\":100108,\"investigation_uuid\":\"00000000-0000-4000-8000-000000000023\",\"event_ts\":\"2026-07-31T19:19:11Z\",\"initiator_uuid\":\"00000000-0000-4000-8000-000000000014\"}},\"uuid\":\"id-000109\",\"status\":\"info\",\"timestamp\":\"2026-07-31T19:28:41.881Z\"},\"_id\":\"id-000110\",\"source\":\"audit\",\"message\":\"user03@example.com successfully started investigation \\\"investigation:00000000-0000-4000-8000-000000000023\\\"\",\"status\":\"info\",\"tags\":[\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:23:18.758Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"SERVICE_ACCOUNT\"},\"name\":\"Request\"},\"metadata\":{\"api_key\":{\"id\":\"id-000111\"},\"application_key\":{\"id\":\"id-000112\"}},\"auth_method\":\"API_AND_APP_KEY\",\"route\":{\"path\":\"/api/v2/query/scalar\"},\"org\":{\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"id\":\"id-000089\",\"uuid\":\"00000000-0000-4000-8000-000000000024\",\"email\":\"user08@example.com\"},\"action\":\"accessed\",\"http\":{\"status_code\":200,\"url_details\":{\"path\":\"/api/v2/query/scalar\",\"host\":\"api.us5.datadoghq.com\"},\"method\":\"POST\",\"useragent\":\"Go-http-client/2.0\"},\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"Iowa\",\"iso_code\":\"US-IA\"},\"as\":{\"number\":\"AS396982\",\"route\":\"198.51.100.30/16\",\"domain\":\"google.com\",\"name\":\"Example Cloud\",\"type\":\"hosting\"},\"city\":{\"name\":\"Council Bluffs\"},\"timezone\":\"America/Chicago\",\"ipAddress\":\"198.51.100.31\",\"location\":{\"latitude\":41.26194,\"longitude\":-95.86083}},\"ip\":\"198.51.100.31\"}},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:18.758Z\",\"emitted_source\":\"edge\"},\"_id\":\"id-000113\",\"source\":\"audit\",\"message\":\"POST request made to /api/v2/query/scalar by user08@example.com with response 200\",\"status\":\"info\",\"tags\":[\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:23:26.859Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Request\"},\"auth_method\":\"SESSION\",\"route\":{\"path\":\"/api/ui/frontend_telemetry/metrics\"},\"org\":{\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"id\":\"user09@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000025\",\"email\":\"user09@example.com\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.32\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"MOBILE\",\"DESKTOP\"],\"count\":27,\"concentration\":{\"country\":\"US\",\"density\":0.5,\"city\":\"Seattle\",\"geohash\":\"c23nb7\",\"state\":\"Washington\",\"skew\":1},\"countries\":1},\"location\":{\"country\":\"US\",\"city\":\"Seattle\",\"state\":\"Washington\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"action\":\"accessed\",\"http\":{\"status_code\":202,\"url_details\":{\"path\":\"/api/ui/frontend_telemetry/metrics\",\"host\":\"us5.datadoghq.com\"},\"method\":\"POST\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"Washington\",\"iso_code\":\"US-WA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.23/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Seattle\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.32\",\"location\":{\"latitude\":47.60621,\"longitude\":-122.33207}},\"ip\":\"198.51.100.32\"}},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:26.859Z\",\"emitted_source\":\"edge\"},\"_id\":\"id-000114\",\"source\":\"audit\",\"message\":\"POST request made to /api/ui/frontend_telemetry/metrics by user09@example.com with response 202\",\"status\":\"info\",\"tags\":[\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:23:30.772Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Request\"},\"auth_method\":\"SESSION\",\"route\":{\"path\":\"/config\"},\"org\":{\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"id\":\"user10@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000026\",\"email\":\"user10@example.com\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.33\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"risks\":[\"CALLBACK_PROXY\"],\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"MOBILE\",\"DESKTOP\"],\"count\":7,\"concentration\":{\"country\":\"US\",\"density\":1,\"city\":\"Greenwood\",\"geohash\":\"c23p1p\",\"state\":\"Washington\",\"skew\":9},\"proxies\":[\"MELLOWTEL_PROXY\"],\"countries\":1},\"location\":{\"country\":\"US\",\"city\":\"Seattle\",\"state\":\"Washington\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"action\":\"accessed\",\"http\":{\"status_code\":200,\"url_details\":{\"path\":\"/config\",\"host\":\"us5.datadoghq.com\"},\"method\":\"GET\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"Washington\",\"iso_code\":\"US-WA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.23/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Seattle\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.33\",\"location\":{\"latitude\":47.60621,\"longitude\":-122.33207}},\"ip\":\"198.51.100.33\"}},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:30.772Z\",\"emitted_source\":\"edge\"},\"_id\":\"id-000115\",\"source\":\"audit\",\"message\":\"GET request made to /config by user10@example.com with response 200\",\"status\":\"info\",\"tags\":[\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:23:31.813Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Request\"},\"auth_method\":\"SESSION\",\"route\":{\"path\":\"/api/ui/query/scalar\"},\"org\":{\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"id\":\"user11@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000027\",\"email\":\"user11@example.com\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.34\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":4},\"location\":{\"country\":\"US\",\"city\":\"San Jose\",\"state\":\"California\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"action\":\"accessed\",\"http\":{\"status_code\":0,\"url_details\":{\"path\":\"/api/ui/query/scalar\",\"host\":\"us5.datadoghq.com\"},\"method\":\"POST\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"California\",\"iso_code\":\"US-CA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.6/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"San Francisco\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.34\",\"location\":{\"latitude\":37.77493,\"longitude\":-122.41942}},\"ip\":\"198.51.100.34\"}},\"status\":\"error\",\"timestamp\":\"2026-07-31T19:23:31.813Z\",\"emitted_source\":\"edge\"},\"_id\":\"id-000116\",\"source\":\"audit\",\"message\":\"POST request made to /api/ui/query/scalar by user11@example.com with response 0\",\"status\":\"error\",\"tags\":[\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:23:34.938Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Request\"},\"metadata\":{\"oauth_client\":{\"name\":\"Cursor\",\"uuid\":\"00000000-0000-4000-8000-000000000017\"}},\"org\":{\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.35\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":5},\"location\":{\"country\":\"US\",\"city\":\"Seattle\",\"state\":\"Washington\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"Washington\",\"iso_code\":\"US-WA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.23/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Seattle\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.35\",\"location\":{\"latitude\":47.60621,\"longitude\":-122.33207}},\"ip\":\"198.51.100.35\"}},\"auth_method\":\"OAUTH_TOKEN\",\"route\":{\"path\":\"/api/unstable/mcp-server/mcp\"},\"usr\":{\"id\":\"user12@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000028\",\"email\":\"user12@example.com\"},\"action\":\"accessed\",\"http\":{\"status_code\":200,\"url_details\":{\"path\":\"/api/unstable/mcp-server/mcp\",\"host\":\"mcp.us5.datadoghq.com\"},\"method\":\"POST\",\"useragent\":\"Cursor/3.9.16 (darwin arm64)\"},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:34.938Z\",\"emitted_source\":\"edge\"},\"_id\":\"id-000117\",\"source\":\"audit\",\"message\":\"POST request made to /api/unstable/mcp-server/mcp by user12@example.com with response 200\",\"status\":\"info\",\"tags\":[\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:23:55.557Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"SERVICE_ACCOUNT\"},\"name\":\"Request\"},\"metadata\":{\"api_key\":{\"id\":\"id-000111\"},\"application_key\":{\"id\":\"id-000112\"}},\"auth_method\":\"API_AND_APP_KEY\",\"route\":{\"path\":\"/api/v2/query/scalar\"},\"org\":{\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"id\":\"id-000089\",\"uuid\":\"00000000-0000-4000-8000-000000000024\",\"email\":\"user08@example.com\"},\"action\":\"accessed\",\"http\":{\"status_code\":400,\"url_details\":{\"path\":\"/api/v2/query/scalar\",\"host\":\"api.us5.datadoghq.com\"},\"method\":\"POST\",\"useragent\":\"Go-http-client/2.0\"},\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"Iowa\",\"iso_code\":\"US-IA\"},\"as\":{\"number\":\"AS396982\",\"route\":\"198.51.100.30/16\",\"domain\":\"google.com\",\"name\":\"Example Cloud\",\"type\":\"hosting\"},\"city\":{\"name\":\"Council Bluffs\"},\"timezone\":\"America/Chicago\",\"ipAddress\":\"198.51.100.31\",\"location\":{\"latitude\":41.26194,\"longitude\":-95.86083}},\"ip\":\"198.51.100.31\"}},\"status\":\"warn\",\"timestamp\":\"2026-07-31T19:23:55.557Z\",\"emitted_source\":\"edge\"},\"_id\":\"id-000118\",\"source\":\"audit\",\"message\":\"POST request made to /api/v2/query/scalar by user08@example.com with response 400\",\"status\":\"warn\",\"tags\":[\"source:audit\"]}" + }, + { + "message": "{\"date\":\"2026-07-31T19:22:29.882Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"MCP Server\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000119\"},\"usage\":{\"duration\":734338771},\"mcp\":{\"request_id\":\"mcp-id-000120\"},\"oauth_client\":{\"name\":\"Datadog Generic MCP Client\",\"uuid\":\"00000000-0000-4000-8000-000000000029\"},\"tool\":{\"name\":\"search_datadog_rum_events\",\"arguments\":{\"detailed_output\":false,\"max_tokens\":12000,\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @view.url:*nw=* @context.datadogView.was_backgrounded:false env:production @context.entityName:elisa-motta- @view.in_foreground_periods.start:>300000000000\",\"from\":\"1784920005072\",\"to\":\"1785524805072\"}}},\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.28\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Los Angeles, CA\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":7,\"concentration\":{\"country\":\"US\",\"density\":1,\"city\":\"Waldon\",\"geohash\":\"9q9pz0\",\"state\":\"California\",\"skew\":550},\"countries\":1},\"location\":{\"country\":\"US\",\"city\":\"Los Angeles\",\"state\":\"California\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"uuid\":\"id-000121\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"California\",\"iso_code\":\"US-CA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.25/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Los Angeles\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.28\",\"location\":{\"latitude\":34.05223,\"longitude\":-118.24368}},\"ip\":\"198.51.100.28\"}},\"auth_method\":\"OAUTH_TOKEN\",\"usr\":{\"created\":\"2024-08-23T20:49:04Z\",\"name\":\"Example User 06\",\"id\":\"user06@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000018\",\"email\":\"user06@example.com\"},\"action\":\"executed\",\"http\":{\"status_code\":200,\"url_details\":{\"path\":\"/api/unstable/mcp-server/mcp?toolsets=all\"},\"method\":\"POST\",\"level\":\"info\"},\"asset\":{\"type\":\"mcp\"},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:22:29.882Z\"},\"_id\":\"id-000122\",\"source\":\"audit\",\"message\":\"user06@example.com successfully called tool 'search_datadog_rum_events'\",\"status\":\"info\",\"tags\":[\"is_mcp_call:true\",\"source:audit\"]}" + } + ] +} diff --git a/packages/datadog/data_stream/audit/_dev/test/pipeline/test-events.json-expected.json b/packages/datadog/data_stream/audit/_dev/test/pipeline/test-events.json-expected.json new file mode 100644 index 00000000000..e2720b808e8 --- /dev/null +++ b/packages/datadog/data_stream/audit/_dev/test/pipeline/test-events.json-expected.json @@ -0,0 +1,6953 @@ +{ + "expected": [ + { + "@timestamp": "2026-07-31T19:23:15.543Z", + "datadog": { + "action": "accessed", + "actor": { + "type": "USER" + }, + "auth_method": "SESSION", + "emitted_source": "edge", + "event": { + "name": "Request" + }, + "route": { + "path": "/api/ui/frontend_telemetry/metrics" + }, + "source": { + "as": { + "domain": "example.net", + "route": "198.51.100.3/24", + "type": "hosting" + } + }, + "tags": [ + "source:audit" + ], + "threat_intel": { + "indicators_matched": [ + "IP" + ], + "results": [ + { + "additional_data": { + "as": { + "number": 64496, + "organization": "Example ISP" + }, + "client": { + "concentration": { + "city": "Sun Lakes", + "country": "US", + "density": 1, + "geohash": "9tbmnn", + "skew": 596, + "state": "Arizona" + }, + "count": 4, + "countries": 1, + "types": [ + "DESKTOP", + "MOBILE" + ] + }, + "infrastructure": "DATACENTER", + "location": { + "city": "Los Angeles", + "country": "US", + "state": "California" + }, + "organization": "Example ISP", + "tunnels": [ + { + "anonymous": false, + "operator": "EXAMPLE_PROXY", + "type": "PROXY" + } + ] + }, + "category": "corp_vpn", + "indicator": "198.51.100.1", + "intention": "benign", + "source": { + "name": "spur", + "type": "managed", + "url": "https://spur.us" + }, + "type": "IP" + } + ] + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "request_accessed", + "category": [ + "api", + "web" + ], + "dataset": "datadog.audit", + "id": "id-000001", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:15.543Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Request\"},\"auth_method\":\"SESSION\",\"route\":{\"path\":\"/api/ui/frontend_telemetry/metrics\"},\"org\":{\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"id\":\"user01@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000002\",\"email\":\"user01@example.com\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.1\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":4,\"concentration\":{\"country\":\"US\",\"density\":1,\"city\":\"Sun Lakes\",\"geohash\":\"9tbmnn\",\"state\":\"Arizona\",\"skew\":596},\"countries\":1},\"location\":{\"country\":\"US\",\"city\":\"Los Angeles\",\"state\":\"California\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"action\":\"accessed\",\"http\":{\"status_code\":202,\"url_details\":{\"path\":\"/api/ui/frontend_telemetry/metrics\",\"host\":\"us5.datadoghq.com\"},\"method\":\"POST\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"California\",\"iso_code\":\"US-CA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.3/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Los Angeles\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.1\",\"location\":{\"latitude\":34.05223,\"longitude\":-118.24368}},\"ip\":\"198.51.100.1\"}},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:15.543Z\",\"emitted_source\":\"edge\"},\"_id\":\"id-000001\",\"source\":\"audit\",\"message\":\"POST request made to /api/ui/frontend_telemetry/metrics by user01@example.com with response 202\",\"status\":\"info\",\"tags\":[\"source:audit\"]}", + "outcome": "success", + "type": [ + "access" + ] + }, + "http": { + "request": { + "method": "POST" + }, + "response": { + "status_code": 202 + } + }, + "log": { + "level": "info" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001" + }, + "related": { + "hosts": [ + "us5.datadoghq.com" + ], + "ip": [ + "198.51.100.1" + ], + "user": [ + "user01@example.com" + ] + }, + "source": { + "as": { + "number": 64496, + "organization": { + "name": "Example ISP" + } + }, + "geo": { + "city_name": "Los Angeles", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 34.05223, + "lon": -118.24368 + }, + "region_iso_code": "US-CA", + "region_name": "California", + "timezone": "America/Los_Angeles" + }, + "ip": "198.51.100.1" + }, + "url": { + "domain": "us5.datadoghq.com", + "full": "https://us5.datadoghq.com/api/ui/frontend_telemetry/metrics", + "path": "/api/ui/frontend_telemetry/metrics" + }, + "user": { + "email": "user01@example.com", + "id": "00000000-0000-4000-8000-000000000002", + "name": "user01@example.com" + }, + "user_agent": { + "device": { + "name": "Mac" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36", + "os": { + "full": "Mac OS X 10.15.7", + "name": "Mac OS X", + "version": "10.15.7" + }, + "version": "198.51.100.2" + } + }, + { + "@timestamp": "2026-07-31T19:23:17.234Z", + "datadog": { + "action": "completed", + "action_name": "request", + "actor": { + "type": "SYSTEM" + }, + "asset": { + "id": "id-000007", + "name": "action task com.datadoghq.http.request", + "type": "action_platform_task" + }, + "auth_method": "SYSTEM", + "bundle_id": "id-000006", + "event": { + "name": "Workflows", + "uuid": "id-000008" + }, + "fqn": "com.datadoghq.http.request", + "metadata": { + "action_client": "WORKFLOWS", + "action_name": "request", + "actions_client": "WORKFLOWS", + "bundle_id": "id-000006", + "dd": { + "request_id": "id-000002" + }, + "fqn": "com.datadoghq.http.request", + "instance_id": "id-000005", + "parent_workflow_id": "id-000003", + "parent_workflow_instance_id": "id-000004", + "result_hash": "31b1e3e51c0bdf6958acbd33e7ac2209494c23fd1987eff4922c7bc3ccf88495", + "step_name": "Fetch_dashboard_details", + "workflow_createdAt": "2026-05-21 19:32:51.72985 +0000 +0000", + "workflow_id": "id-000003", + "workflow_name": "Dashboard Inventory Refresh (verification)", + "workflow_trigger": "TRIGGER_TYPE_WORKFLOW" + }, + "request_id": "id-000002", + "tags": [ + "source:audit" + ], + "workflow": { + "id": "id-000003", + "instance_id": "id-000005", + "name": "Dashboard Inventory Refresh (verification)", + "parent_id": "id-000003", + "parent_instance_id": "id-000004", + "step_name": "Fetch_dashboard_details", + "trigger": "TRIGGER_TYPE_WORKFLOW" + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "workflows_completed", + "category": [ + "api", + "configuration" + ], + "dataset": "datadog.audit", + "id": "id-000009", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:17.234Z\",\"attributes\":{\"auth_method\":\"SYSTEM\",\"evt\":{\"actor\":{\"type\":\"SYSTEM\"},\"name\":\"Workflows\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000002\"},\"parent_workflow_id\":\"id-000003\",\"fqn\":\"com.datadoghq.http.request\",\"workflow_id\":\"id-000003\",\"workflow_name\":\"Dashboard Inventory Refresh (verification)\",\"actions_client\":\"WORKFLOWS\",\"result_hash\":\"31b1e3e51c0bdf6958acbd33e7ac2209494c23fd1987eff4922c7bc3ccf88495\",\"parent_workflow_instance_id\":\"id-000004\",\"instance_id\":\"id-000005\",\"step_name\":\"Fetch_dashboard_details\",\"action_name\":\"request\",\"bundle_id\":\"id-000006\",\"workflow_createdAt\":\"2026-05-21 19:32:51.72985 +0000 +0000\",\"action_client\":\"WORKFLOWS\",\"workflow_trigger\":\"TRIGGER_TYPE_WORKFLOW\"},\"action\":\"completed\",\"asset\":{\"name\":\"action task com.datadoghq.http.request\",\"id\":\"id-000007\",\"type\":\"action_platform_task\"},\"uuid\":\"id-000008\",\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:17.234Z\"},\"_id\":\"id-000009\",\"source\":\"audit\",\"message\":\"successfully completed action task com.datadoghq.http.request attempt-VUhVgtC53zdVbATgh4NCpG\",\"status\":\"info\",\"tags\":[\"source:audit\"]}", + "outcome": "success", + "type": [ + "end" + ] + }, + "log": { + "level": "info" + } + }, + { + "@timestamp": "2026-07-31T19:23:16.953Z", + "datadog": { + "action": "started", + "action_name": "request", + "actor": { + "type": "SYSTEM" + }, + "asset": { + "id": "id-000007", + "name": "action task com.datadoghq.http.request", + "type": "action_platform_task" + }, + "auth_method": "SYSTEM", + "bundle_id": "id-000006", + "event": { + "name": "Workflows", + "uuid": "id-000010" + }, + "fqn": "com.datadoghq.http.request", + "metadata": { + "action_client": "WORKFLOWS", + "action_name": "request", + "actions_client": "WORKFLOWS", + "attributes": { + "client": "WORKFLOWS", + "instance_id": "id-000005", + "parent_workflow_id": "id-000003", + "parent_workflow_instance_id": "id-000004", + "step_name": "Fetch_dashboard_details", + "workflow_createdAt": "2026-05-21 19:32:51.72985 +0000 +0000", + "workflow_id": "id-000003", + "workflow_name": "Dashboard Inventory Refresh (verification)", + "workflow_trigger": "TRIGGER_TYPE_WORKFLOW" + }, + "bundle_id": "id-000006", + "dd": { + "request_id": "id-000002" + }, + "fqn": "com.datadoghq.http.request", + "input_parameters_hash": "cbaf50686304c8fb83a6d1cb6d75c9f9b99b7ebfe0c79c2b5b137e9063cdec2b", + "instance_id": "id-000005", + "parent_workflow_id": "id-000003", + "parent_workflow_instance_id": "id-000004", + "request_endpoint": "https://api.us5.datadoghq.com/api/v1/dashboard/b6j-i5f-u3b", + "step_name": "Fetch_dashboard_details", + "workflow_createdAt": "2026-05-21 19:32:51.72985 +0000 +0000", + "workflow_id": "id-000003", + "workflow_name": "Dashboard Inventory Refresh (verification)", + "workflow_trigger": "TRIGGER_TYPE_WORKFLOW" + }, + "request_endpoint": "https://api.us5.datadoghq.com/api/v1/dashboard/b6j-i5f-u3b", + "request_id": "id-000002", + "tags": [ + "source:audit" + ], + "workflow": { + "id": "id-000003", + "instance_id": "id-000005", + "name": "Dashboard Inventory Refresh (verification)", + "parent_id": "id-000003", + "parent_instance_id": "id-000004", + "step_name": "Fetch_dashboard_details", + "trigger": "TRIGGER_TYPE_WORKFLOW" + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "workflows_started", + "category": [ + "api", + "configuration" + ], + "dataset": "datadog.audit", + "id": "id-000011", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:16.953Z\",\"attributes\":{\"auth_method\":\"SYSTEM\",\"evt\":{\"actor\":{\"type\":\"SYSTEM\"},\"name\":\"Workflows\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000002\"},\"parent_workflow_id\":\"id-000003\",\"fqn\":\"com.datadoghq.http.request\",\"workflow_id\":\"id-000003\",\"input_parameters_hash\":\"cbaf50686304c8fb83a6d1cb6d75c9f9b99b7ebfe0c79c2b5b137e9063cdec2b\",\"workflow_name\":\"Dashboard Inventory Refresh (verification)\",\"actions_client\":\"WORKFLOWS\",\"parent_workflow_instance_id\":\"id-000004\",\"instance_id\":\"id-000005\",\"request_endpoint\":\"https://api.us5.datadoghq.com/api/v1/dashboard/b6j-i5f-u3b\",\"step_name\":\"Fetch_dashboard_details\",\"action_name\":\"request\",\"bundle_id\":\"id-000006\",\"attributes\":{\"parent_workflow_id\":\"id-000003\",\"workflow_id\":\"id-000003\",\"instance_id\":\"id-000005\",\"workflow_name\":\"Dashboard Inventory Refresh (verification)\",\"step_name\":\"Fetch_dashboard_details\",\"client\":\"WORKFLOWS\",\"parent_workflow_instance_id\":\"id-000004\",\"workflow_createdAt\":\"2026-05-21 19:32:51.72985 +0000 +0000\",\"workflow_trigger\":\"TRIGGER_TYPE_WORKFLOW\"},\"workflow_createdAt\":\"2026-05-21 19:32:51.72985 +0000 +0000\",\"action_client\":\"WORKFLOWS\",\"workflow_trigger\":\"TRIGGER_TYPE_WORKFLOW\"},\"action\":\"started\",\"asset\":{\"name\":\"action task com.datadoghq.http.request\",\"id\":\"id-000007\",\"type\":\"action_platform_task\"},\"uuid\":\"id-000010\",\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:16.953Z\"},\"_id\":\"id-000011\",\"source\":\"audit\",\"message\":\"started action task com.datadoghq.http.request attempt-VUhVgtC53zdVbATgh4NCpG\",\"status\":\"info\",\"tags\":[\"source:audit\"]}", + "outcome": "success", + "type": [ + "start" + ] + }, + "log": { + "level": "info" + } + }, + { + "@timestamp": "2026-07-31T19:23:17.107Z", + "datadog": { + "action": "modified", + "actor": { + "type": "USER" + }, + "asset": { + "id": "id-000012", + "name": "Perf Strike Team", + "new_value": { + "dashboard_definition": { + "author_handle": "example-author", + "author_name": "Example Author", + "created_at": "2026-07-09T20:30:19.501285+00:00", + "description": "[[suggested_dashboards]]", + "id": "id-000012", + "layout_type": "ordered", + "modified_at": "2026-07-31T19:23:16.908589+00:00", + "reflow_type": "fixed", + "tabs": [ + { + "id": "id-000013", + "name": "Tab 1", + "widget_ids": [ + 5786555378127436, + 2795964700760912, + 3725357411171479, + 6879929085074505 + ] + }, + { + "id": "id-000014", + "name": "1. Workspace Loading", + "widget_ids": [ + 2596549404097146, + 1738862716789832, + 8118717586213844, + 7116521192235267, + 1085918712924402, + 5375242069538586, + 7632570881757390, + 6424405168251415, + 6894734997716994 + ] + }, + { + "id": "id-000015", + "name": "2. Panel Bank Search", + "widget_ids": [ + 1872967732978139 + ] + }, + { + "id": "id-000016", + "name": "3." + }, + { + "id": "id-000017", + "name": "Tab 5" + }, + { + "id": "id-000018", + "name": "Tab 6" + }, + { + "id": "id-000019", + "name": "Tab 7" + } + ], + "template_variable_presets": [ + { + "description": "drafts", + "name": "Joyce", + "template_variables": [ + { + "name": "env", + "value": "devprod" + }, + { + "name": "customer-ns", + "value": "*" + }, + { + "name": "view.url_host", + "value": "example.ai" + } + ] + } + ], + "template_variables": [ + { + "default": "*", + "name": "env", + "prefix": "env" + }, + { + "default": "*", + "name": "customer-ns", + "prefix": "customer-ns" + }, + { + "default": "*", + "name": "view.url_host", + "prefix": "@view.url_host" + } + ], + "title": "Perf Strike Team", + "url": "/dashboard/zza-xmd-7jt/perf-strike-team", + "widgets": [ + { + "definition": { + "background_color": "green", + "layout_type": "ordered", + "show_title": true, + "title": "Core Web Vitals", + "type": "group" + }, + "id": 100020, + "layout": { + "height": 1, + "width": 12, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "purple", + "layout_type": "ordered", + "show_title": true, + "title": "2. Panel Bank Search", + "type": "group", + "widgets": [ + { + "definition": { + "has_background": false, + "has_border": true, + "horizontal_align": "center", + "sizing": "contain", + "type": "image", + "url": "/api/v2/images/00000000-0000-4000-8000-000000000005", + "vertical_align": "center" + }, + "id": 100021, + "layout": { + "height": 3, + "width": 7, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "- Start: User typing in panel search input\n- End: Selected panels showing up", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100022, + "layout": { + "height": 2, + "width": 5, + "x": 7, + "y": 0 + } + } + ] + }, + "id": 100023, + "layout": { + "height": 4, + "width": 12, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "# Critical workflows\n1. Workspace loading\n2. Panel bank search\n3. Runs search\n4. Toggle run visibility (eyeball click)\n5. Metric selection in edit panel modal\n6. Section pagination\n7. Hovering panel data\n", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100024, + "layout": { + "height": 2, + "width": 2, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "## Metrics to add\n- \\# of slow views\n- list of graphql queries & its latencies\n- list of long tasks\n- good or bad (define threshold like # of slow views > 10?)\n\n## Start and end definition\n- start — \n- end — after data returns and filters section & panels right before react re-rendering?", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100025, + "layout": { + "height": 2, + "width": 2, + "x": 2, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "## TODO\n- separate these workflow into its own tab\n", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100026, + "layout": { + "height": 2, + "width": 2, + "x": 4, + "y": 0 + } + }, + { + "definition": { + "background_color": "yellow", + "layout_type": "ordered", + "show_title": true, + "title": "HistoryKeysByHash Perf", + "type": "group" + }, + "id": 100027, + "layout": { + "height": 1, + "width": 12, + "x": 0, + "y": 1 + } + }, + { + "definition": { + "background_color": "gray", + "layout_type": "ordered", + "show_title": true, + "title": "Justin - possible metrics", + "type": "group", + "widgets": [ + { + "definition": { + "has_search_bar": "auto", + "requests": [ + { + "formulas": [ + { + "cell_display_mode": "bar", + "formula": "query1" + }, + { + "cell_display_mode": "bar", + "formula": "query2" + }, + { + "cell_display_mode": "bar", + "formula": "query3" + }, + { + "alias": "50ms+ compressions", + "cell_display_mode": "bar", + "formula": "query4" + } + ], + "queries": [ + { + "compute": { + "aggregation": "count" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 30, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "metric": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query1", + "search": { + "query": "@type:action @action.name:\"workspace.save_duration\" @context.compressDuration:>10" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "pc75", + "metric": "@context.compressDuration" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 30, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query2", + "search": { + "query": "@type:action @action.name:\"workspace.save_duration\" @context.compressDuration:>10" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "max", + "metric": "@context.compressDuration" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 30, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query3", + "search": { + "query": "@type:action @action.name:\"workspace.save_duration\" @context.compressDuration:>10" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "count" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 500, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query4", + "search": { + "query": "@type:action @action.name:\"workspace.save_duration\" @context.compressDuration:>50" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 590, + "order_by": [ + { + "index": 0, + "order": "desc", + "type": "formula" + } + ] + } + } + ], + "title": "", + "title_align": "left", + "title_size": "16", + "type": "query_table" + }, + "id": 100028, + "layout": { + "height": 2, + "width": 4, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "has_search_bar": "auto", + "requests": [ + { + "formulas": [ + { + "alias": "Max Workspace Keys", + "cell_display_mode": "number", + "formula": "query1" + }, + { + "alias": "Longest Task", + "cell_display_mode": "bar", + "formula": "query2" + }, + { + "alias": "Pc90 Task", + "cell_display_mode": "number", + "formula": "query3" + }, + { + "alias": "Count", + "cell_display_mode": "bar", + "formula": "query4" + }, + { + "alias": "Average", + "cell_display_mode": "bar", + "formula": "query5" + } + ], + "queries": [ + { + "compute": { + "aggregation": "max", + "metric": "@context.keyCount" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 100, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query1", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_cache_key\" @context.keyCount:>10000" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "max", + "metric": "@vital.duration" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 100, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query2", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_cache_key\" @context.keyCount:>10000" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "pc90", + "metric": "@vital.duration" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 100, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query3", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_cache_key\" @context.keyCount:>10000" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "count" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 100, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query4", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_cache_key\" @context.keyCount:>10000" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "avg", + "metric": "@vital.duration" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 100, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query5", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_cache_key\" @context.keyCount:>10000" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 500, + "order_by": [ + { + "index": 3, + "order": "desc", + "type": "formula" + } + ] + } + } + ], + "title": "Autosync Cache Key Pain By Entity", + "title_align": "left", + "title_size": "16", + "type": "query_table" + }, + "id": 100029, + "layout": { + "height": 8, + "width": 5, + "x": 5, + "y": 0 + } + }, + { + "definition": { + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "legend_layout": "auto", + "requests": [ + { + "display_type": "line", + "formulas": [ + { + "formula": "query1" + }, + { + "formula": "query2" + } + ], + "queries": [ + { + "compute": { + "aggregation": "median", + "metric": "@vital.duration" + }, + "data_source": "rum", + "indexes": [ + "*" + ], + "name": "query1", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_cache_key\" @context.keyCount:>10000" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "pc90", + "metric": "@vital.duration" + }, + "data_source": "rum", + "indexes": [ + "*" + ], + "name": "query2", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_cache_key\" @context.keyCount:>10000" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "line_type": "solid", + "line_width": "normal", + "order_by": "values", + "palette": "dog_classic" + } + } + ], + "show_legend": true, + "title": "Slow cache key generation", + "title_align": "left", + "title_size": "16", + "type": "timeseries" + }, + "id": 100030, + "layout": { + "height": 4, + "width": 2, + "x": 10, + "y": 0 + } + }, + { + "definition": { + "has_search_bar": "auto", + "requests": [ + { + "formulas": [ + { + "alias": "100ms+", + "cell_display_mode": "bar", + "formula": "query1" + }, + { + "alias": "500ms+", + "cell_display_mode": "bar", + "formula": "query3" + }, + { + "alias": "Count", + "cell_display_mode": "bar", + "formula": "query4" + } + ], + "queries": [ + { + "compute": { + "aggregation": "count" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 50, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query1", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_panel_bank\" @vital.duration:>100000000" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "count" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 50, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query3", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_panel_bank\" @vital.duration:>500000000" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "count" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 1000, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "metric": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query4", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_panel_bank\" @vital.duration:>100000000" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 1100, + "order_by": [ + { + "index": 2, + "order": "desc", + "type": "formula" + } + ] + } + } + ], + "title": "Slow autosync_panel_bank", + "title_align": "left", + "title_size": "16", + "type": "query_table" + }, + "id": 100031, + "layout": { + "height": 8, + "width": 5, + "x": 0, + "y": 2 + } + } + ] + }, + "id": 100032, + "layout": { + "height": 11, + "width": 12, + "x": 0, + "y": 2 + } + }, + { + "definition": { + "background_color": "blue", + "layout_type": "ordered", + "show_title": true, + "title": "1. Workspace Loading", + "type": "group", + "widgets": [ + { + "definition": { + "has_background": false, + "has_border": true, + "horizontal_align": "center", + "sizing": "contain", + "type": "image", + "url": "/api/v2/images/00000000-0000-4000-8000-000000000006", + "vertical_align": "center" + }, + "id": 100033, + "layout": { + "height": 3, + "width": 7, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "- Start: User visiting example.ai//\n- End: Runs search & panels show up", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100034, + "layout": { + "height": 1, + "width": 5, + "x": 7, + "y": 0 + } + } + ] + }, + "id": 100035, + "layout": { + "height": 4, + "width": 12, + "x": 0, + "y": 2 + } + }, + { + "definition": { + "background_color": "pink", + "layout_type": "ordered", + "show_title": true, + "title": "3. Runs Search", + "type": "group", + "widgets": [ + { + "definition": { + "has_background": true, + "has_border": true, + "horizontal_align": "center", + "sizing": "cover", + "type": "image", + "url": "/api/v2/images/00000000-0000-4000-8000-000000000007", + "vertical_align": "center" + }, + "id": 100036, + "layout": { + "height": 3, + "width": 7, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "- Start: User typing in runs search input\n- End: Panel showing up", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100037, + "layout": { + "height": 1, + "width": 5, + "x": 7, + "y": 0 + } + } + ] + }, + "id": 100038, + "layout": { + "height": 4, + "width": 12, + "x": 0, + "y": 6 + } + }, + { + "definition": { + "background_color": "blue", + "layout_type": "ordered", + "show_title": true, + "title": "Joyce - workspace loading proposals", + "type": "group", + "widgets": [ + { + "definition": { + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "legend_layout": "auto", + "requests": [ + { + "display_type": "line", + "formulas": [ + { + "alias": "p95", + "formula": "query1 / 1000000000", + "number_format": { + "unit": { + "type": "canonical_unit", + "unit_name": "second" + } + } + }, + { + "alias": "p98", + "formula": "query2 / 1000000000", + "number_format": { + "unit": { + "type": "canonical_unit", + "unit_name": "second" + } + } + }, + { + "alias": "p99", + "formula": "query3 / 1000000000", + "number_format": { + "unit": { + "type": "canonical_unit", + "unit_name": "second" + } + } + } + ], + "queries": [ + { + "compute": { + "aggregation": "pc95", + "metric": "@view.custom_timings.workspace_init" + }, + "data_source": "rum", + "indexes": [ + "*" + ], + "name": "query1", + "search": { + "query": "@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "pc98", + "metric": "@view.custom_timings.workspace_init" + }, + "data_source": "rum", + "indexes": [ + "*" + ], + "name": "query2", + "search": { + "query": "@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "pc99", + "metric": "@view.custom_timings.workspace_init" + }, + "data_source": "rum", + "indexes": [ + "*" + ], + "name": "query3", + "search": { + "query": "@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "line_type": "solid", + "line_width": "normal", + "order_by": "values", + "palette": "dog_classic" + } + } + ], + "show_legend": true, + "title": "Multi-run page - workspace_init (BEFORE we hit any workspace-related logic)", + "type": "timeseries" + }, + "id": 100039, + "layout": { + "height": 5, + "width": 12, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "requests": [ + { + "query": { + "compute": { + "aggregation": "pc95", + "metric": "@view.custom_timings.workspace_init" + }, + "data_source": "rum", + "indexes": [ + "*" + ], + "name": "query1", + "search": { + "query": "@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production" + }, + "storage": "hot" + }, + "request_type": "histogram" + } + ], + "show_legend": true, + "title": "Multi-run page - workspace_init (BEFORE we hit any workspace-related logic)", + "type": "distribution", + "xaxis": { + "include_zero": true, + "max": "auto", + "min": "auto", + "scale": "linear" + }, + "yaxis": { + "include_zero": true, + "max": "auto", + "min": "auto", + "scale": "linear" + } + }, + "id": 100040, + "layout": { + "height": 5, + "width": 12, + "x": 0, + "y": 5 + } + }, + { + "definition": { + "has_search_bar": "auto", + "requests": [ + { + "formulas": [ + { + "alias": "p99_seconds", + "cell_display_mode": "bar", + "formula": "query1 / 1000000000" + } + ], + "queries": [ + { + "compute": { + "aggregation": "pc99", + "metric": "@view.custom_timings.workspace_init" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@view.url_path", + "limit": 50, + "should_exclude_missing": true, + "sort": { + "aggregation": "pc99", + "metric": "@view.custom_timings.workspace_init", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query1", + "search": { + "query": "@type:view @view.name:Workspace @view.loading_type:initial_load @view.url:*nw=* @context.datadogView.was_backgrounded:false env:production" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 50, + "order_by": [ + { + "index": 0, + "order": "desc", + "type": "formula" + } + ] + } + } + ], + "title": "workspace_init max by workspace nw param (RUM)", + "type": "query_table" + }, + "id": 100041, + "layout": { + "height": 5, + "width": 12, + "x": 0, + "y": 10 + } + }, + { + "definition": { + "background_color": "white", + "content": "why the hell is this taking 2h+ https://us5.datadoghq.com/rum/sessions?query=%40type%3Aview%20%40view.name%3AWorkspace%20%40view.loading_type%3Ainitial_load%20%40view.url%3A%2Anw%3D%2A%20%40context.datadogView.was_backgrounded%3Afalse%20env%3Aproduction%20AND%20%40context.entityName%3Aelisa-motta-&event=AwAAAZ-xlf0q88SBnQAAABhBWi14bGYwcUFBRHU5TXF3VEs2VWtaTUQAAAAkMTE5ZmIyMDktOTM0My00NDNhLWI2YjgtYjY5YWM5Y2FjZWEzAADbxg&fromUser=false&index=%2A&type=rum&viz=stream&from_ts=1784920005072&to_ts=1785524805072&live=true", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100042, + "layout": { + "height": 2, + "width": 2, + "x": 0, + "y": 15 + } + }, + { + "definition": { + "requests": [ + { + "formulas": [ + { + "formula": "query1 / 1000000000" + } + ], + "queries": [ + { + "compute": { + "aggregation": "pc99", + "metric": "@view.custom_timings.workspace_init" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 50, + "should_exclude_missing": true, + "sort": { + "aggregation": "pc99", + "metric": "@view.custom_timings.workspace_init", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query1", + "search": { + "query": "@type:view @view.name:Workspace @view.loading_type:initial_load @view.url:*nw=* @context.datadogView.was_backgrounded:false env:production" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 50, + "order_by": [ + { + "index": 0, + "order": "desc", + "type": "formula" + } + ] + } + } + ], + "style": { + "display": { + "legend": "automatic", + "type": "stacked" + } + }, + "title": "workspace_init top entities (p99)", + "type": "toplist" + }, + "id": 100043, + "layout": { + "height": 5, + "width": 12, + "x": 0, + "y": 17 + } + } + ] + }, + "id": 100044, + "layout": { + "height": 23, + "width": 12, + "x": 0, + "y": 13 + } + }, + { + "definition": { + "background_color": "orange", + "layout_type": "ordered", + "show_title": true, + "title": "4. Toggle Run Visibility (Eyeball Clicks)", + "type": "group", + "widgets": [ + { + "definition": { + "has_background": false, + "has_border": true, + "horizontal_align": "center", + "sizing": "contain", + "type": "image", + "url": "/api/v2/images/00000000-0000-4000-8000-000000000008", + "vertical_align": "center" + }, + "id": 100045, + "layout": { + "height": 3, + "width": 7, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "- Start: User clicking eyeballs in runs selector\n- End: Panel with selected runs show up", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100046, + "layout": { + "height": 2, + "width": 5, + "x": 7, + "y": 0 + } + } + ] + }, + "id": 100047, + "layout": { + "height": 4, + "is_column_break": true, + "width": 12, + "x": 0, + "y": 36 + } + }, + { + "definition": { + "background_color": "yellow", + "layout_type": "ordered", + "show_title": true, + "title": "5. Metric Selection in Edit Panel Modal", + "type": "group", + "widgets": [ + { + "definition": { + "has_background": false, + "has_border": true, + "horizontal_align": "center", + "sizing": "contain", + "type": "image", + "url": "/api/v2/images/00000000-0000-4000-8000-000000000009", + "vertical_align": "center" + }, + "id": 100048, + "layout": { + "height": 3, + "width": 7, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "- Start: User typing metric name in the metric search of edit panel modal\n- End: Panel showing up (?)", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100049, + "layout": { + "height": 2, + "width": 5, + "x": 7, + "y": 0 + } + } + ] + }, + "id": 100050, + "layout": { + "height": 4, + "width": 12, + "x": 0, + "y": 40 + } + }, + { + "definition": { + "background_color": "green", + "layout_type": "ordered", + "show_title": true, + "title": "6. Selection Pagination", + "type": "group", + "widgets": [ + { + "definition": { + "has_background": false, + "has_border": true, + "horizontal_align": "center", + "sizing": "contain", + "type": "image", + "url": "/api/v2/images/00000000-0000-4000-8000-000000000010", + "vertical_align": "center" + }, + "id": 100051, + "layout": { + "height": 3, + "width": 7, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "- Start: User clicking `<` and `>` in section\n- End: A new page of panels show up", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100052, + "layout": { + "height": 2, + "width": 5, + "x": 7, + "y": 0 + } + } + ] + }, + "id": 100053, + "layout": { + "height": 4, + "width": 12, + "x": 0, + "y": 44 + } + }, + { + "definition": { + "background_color": "blue", + "layout_type": "ordered", + "show_title": true, + "title": "7. Hovering Panel Data", + "type": "group", + "widgets": [ + { + "definition": { + "has_background": true, + "has_border": true, + "horizontal_align": "center", + "sizing": "cover", + "type": "image", + "url": "/api/v2/images/00000000-0000-4000-8000-000000000011", + "vertical_align": "center" + }, + "id": 100054, + "layout": { + "height": 3, + "width": 7, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "- Start: User hovering panel to see specific point in line\n- End: Legend with point data show up with syncing other panels", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100055, + "layout": { + "height": 2, + "width": 5, + "x": 7, + "y": 0 + } + } + ] + }, + "id": 100056, + "layout": { + "height": 4, + "width": 12, + "x": 0, + "y": 48 + } + } + ] + } + }, + "path": "/dashboard/zza-xmd-7jt/perf-strike-team", + "prev_value": { + "dashboard_definition": { + "author_handle": "example-author", + "author_name": "Example Author", + "created_at": "2026-07-09T20:30:19.501285+00:00", + "description": "[[suggested_dashboards]]", + "id": "id-000012", + "layout_type": "ordered", + "modified_at": "2026-07-31T19:23:10.149500+00:00", + "reflow_type": "fixed", + "tabs": [ + { + "id": "id-000013", + "name": "Tab 1", + "widget_ids": [ + 5786555378127436, + 2795964700760912, + 3725357411171479, + 6879929085074505 + ] + }, + { + "id": "id-000014", + "name": "1. Workspace Loading", + "widget_ids": [ + 2596549404097146, + 1738862716789832, + 8118717586213844, + 7116521192235267, + 1085918712924402, + 5375242069538586, + 7632570881757390, + 6424405168251415, + 6894734997716994 + ] + }, + { + "id": "id-000015", + "name": "2. Panel Bank Search", + "widget_ids": [ + 1872967732978139 + ] + }, + { + "id": "id-000016", + "name": "Tab 4" + }, + { + "id": "id-000017", + "name": "Tab 5" + }, + { + "id": "id-000018", + "name": "Tab 6" + }, + { + "id": "id-000019", + "name": "Tab 7" + } + ], + "template_variable_presets": [ + { + "description": "drafts", + "name": "Joyce", + "template_variables": [ + { + "name": "env", + "value": "devprod" + }, + { + "name": "customer-ns", + "value": "*" + }, + { + "name": "view.url_host", + "value": "example.ai" + } + ] + } + ], + "template_variables": [ + { + "default": "*", + "name": "env", + "prefix": "env" + }, + { + "default": "*", + "name": "customer-ns", + "prefix": "customer-ns" + }, + { + "default": "*", + "name": "view.url_host", + "prefix": "@view.url_host" + } + ], + "title": "Perf Strike Team", + "url": "/dashboard/zza-xmd-7jt/perf-strike-team", + "widgets": [ + { + "definition": { + "background_color": "green", + "layout_type": "ordered", + "show_title": true, + "title": "Core Web Vitals", + "type": "group" + }, + "id": 100020, + "layout": { + "height": 1, + "width": 12, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "purple", + "layout_type": "ordered", + "show_title": true, + "title": "2. Panel Bank Search", + "type": "group", + "widgets": [ + { + "definition": { + "has_background": false, + "has_border": true, + "horizontal_align": "center", + "sizing": "contain", + "type": "image", + "url": "/api/v2/images/00000000-0000-4000-8000-000000000005", + "vertical_align": "center" + }, + "id": 100021, + "layout": { + "height": 3, + "width": 7, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "- Start: User typing in panel search input\n- End: Selected panels showing up", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100022, + "layout": { + "height": 2, + "width": 5, + "x": 7, + "y": 0 + } + } + ] + }, + "id": 100023, + "layout": { + "height": 4, + "width": 12, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "# Critical workflows\n1. Workspace loading\n2. Panel bank search\n3. Runs search\n4. Toggle run visibility (eyeball click)\n5. Metric selection in edit panel modal\n6. Section pagination\n7. Hovering panel data\n", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100024, + "layout": { + "height": 2, + "width": 2, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "## Metrics to add\n- \\# of slow views\n- list of graphql queries & its latencies\n- list of long tasks\n- good or bad (define threshold like # of slow views > 10?)\n\n## Start and end definition\n- start — \n- end — after data returns and filters section & panels right before react re-rendering?", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100025, + "layout": { + "height": 2, + "width": 2, + "x": 2, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "## TODO\n- separate these workflow into its own tab\n", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100026, + "layout": { + "height": 2, + "width": 2, + "x": 4, + "y": 0 + } + }, + { + "definition": { + "background_color": "yellow", + "layout_type": "ordered", + "show_title": true, + "title": "HistoryKeysByHash Perf", + "type": "group" + }, + "id": 100027, + "layout": { + "height": 1, + "width": 12, + "x": 0, + "y": 1 + } + }, + { + "definition": { + "background_color": "gray", + "layout_type": "ordered", + "show_title": true, + "title": "Justin - possible metrics", + "type": "group", + "widgets": [ + { + "definition": { + "has_search_bar": "auto", + "requests": [ + { + "formulas": [ + { + "cell_display_mode": "bar", + "formula": "query1" + }, + { + "cell_display_mode": "bar", + "formula": "query2" + }, + { + "cell_display_mode": "bar", + "formula": "query3" + }, + { + "alias": "50ms+ compressions", + "cell_display_mode": "bar", + "formula": "query4" + } + ], + "queries": [ + { + "compute": { + "aggregation": "count" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 30, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "metric": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query1", + "search": { + "query": "@type:action @action.name:\"workspace.save_duration\" @context.compressDuration:>10" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "pc75", + "metric": "@context.compressDuration" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 30, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query2", + "search": { + "query": "@type:action @action.name:\"workspace.save_duration\" @context.compressDuration:>10" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "max", + "metric": "@context.compressDuration" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 30, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query3", + "search": { + "query": "@type:action @action.name:\"workspace.save_duration\" @context.compressDuration:>10" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "count" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 500, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query4", + "search": { + "query": "@type:action @action.name:\"workspace.save_duration\" @context.compressDuration:>50" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 590, + "order_by": [ + { + "index": 0, + "order": "desc", + "type": "formula" + } + ] + } + } + ], + "title": "", + "title_align": "left", + "title_size": "16", + "type": "query_table" + }, + "id": 100028, + "layout": { + "height": 2, + "width": 4, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "has_search_bar": "auto", + "requests": [ + { + "formulas": [ + { + "alias": "Max Workspace Keys", + "cell_display_mode": "number", + "formula": "query1" + }, + { + "alias": "Longest Task", + "cell_display_mode": "bar", + "formula": "query2" + }, + { + "alias": "Pc90 Task", + "cell_display_mode": "number", + "formula": "query3" + }, + { + "alias": "Count", + "cell_display_mode": "bar", + "formula": "query4" + }, + { + "alias": "Average", + "cell_display_mode": "bar", + "formula": "query5" + } + ], + "queries": [ + { + "compute": { + "aggregation": "max", + "metric": "@context.keyCount" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 100, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query1", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_cache_key\" @context.keyCount:>10000" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "max", + "metric": "@vital.duration" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 100, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query2", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_cache_key\" @context.keyCount:>10000" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "pc90", + "metric": "@vital.duration" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 100, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query3", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_cache_key\" @context.keyCount:>10000" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "count" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 100, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query4", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_cache_key\" @context.keyCount:>10000" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "avg", + "metric": "@vital.duration" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 100, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query5", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_cache_key\" @context.keyCount:>10000" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 500, + "order_by": [ + { + "index": 3, + "order": "desc", + "type": "formula" + } + ] + } + } + ], + "title": "Autosync Cache Key Pain By Entity", + "title_align": "left", + "title_size": "16", + "type": "query_table" + }, + "id": 100029, + "layout": { + "height": 8, + "width": 5, + "x": 5, + "y": 0 + } + }, + { + "definition": { + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "legend_layout": "auto", + "requests": [ + { + "display_type": "line", + "formulas": [ + { + "formula": "query1" + }, + { + "formula": "query2" + } + ], + "queries": [ + { + "compute": { + "aggregation": "median", + "metric": "@vital.duration" + }, + "data_source": "rum", + "indexes": [ + "*" + ], + "name": "query1", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_cache_key\" @context.keyCount:>10000" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "pc90", + "metric": "@vital.duration" + }, + "data_source": "rum", + "indexes": [ + "*" + ], + "name": "query2", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_cache_key\" @context.keyCount:>10000" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "line_type": "solid", + "line_width": "normal", + "order_by": "values", + "palette": "dog_classic" + } + } + ], + "show_legend": true, + "title": "Slow cache key generation", + "title_align": "left", + "title_size": "16", + "type": "timeseries" + }, + "id": 100030, + "layout": { + "height": 4, + "width": 2, + "x": 10, + "y": 0 + } + }, + { + "definition": { + "has_search_bar": "auto", + "requests": [ + { + "formulas": [ + { + "alias": "100ms+", + "cell_display_mode": "bar", + "formula": "query1" + }, + { + "alias": "500ms+", + "cell_display_mode": "bar", + "formula": "query3" + }, + { + "alias": "Count", + "cell_display_mode": "bar", + "formula": "query4" + } + ], + "queries": [ + { + "compute": { + "aggregation": "count" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 50, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query1", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_panel_bank\" @vital.duration:>100000000" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "count" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 50, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query3", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_panel_bank\" @vital.duration:>500000000" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "count" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 1000, + "should_exclude_missing": true, + "sort": { + "aggregation": "count", + "metric": "count", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query4", + "search": { + "query": "@type:vital @vital.name:\"workspace.autosync_panel_bank\" @vital.duration:>100000000" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 1100, + "order_by": [ + { + "index": 2, + "order": "desc", + "type": "formula" + } + ] + } + } + ], + "title": "Slow autosync_panel_bank", + "title_align": "left", + "title_size": "16", + "type": "query_table" + }, + "id": 100031, + "layout": { + "height": 8, + "width": 5, + "x": 0, + "y": 2 + } + } + ] + }, + "id": 100032, + "layout": { + "height": 11, + "width": 12, + "x": 0, + "y": 2 + } + }, + { + "definition": { + "background_color": "blue", + "layout_type": "ordered", + "show_title": true, + "title": "1. Workspace Loading", + "type": "group", + "widgets": [ + { + "definition": { + "has_background": false, + "has_border": true, + "horizontal_align": "center", + "sizing": "contain", + "type": "image", + "url": "/api/v2/images/00000000-0000-4000-8000-000000000006", + "vertical_align": "center" + }, + "id": 100033, + "layout": { + "height": 3, + "width": 7, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "- Start: User visiting example.ai//\n- End: Runs search & panels show up", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100034, + "layout": { + "height": 1, + "width": 5, + "x": 7, + "y": 0 + } + } + ] + }, + "id": 100035, + "layout": { + "height": 4, + "width": 12, + "x": 0, + "y": 2 + } + }, + { + "definition": { + "background_color": "pink", + "layout_type": "ordered", + "show_title": true, + "title": "3. Runs Search", + "type": "group", + "widgets": [ + { + "definition": { + "has_background": true, + "has_border": true, + "horizontal_align": "center", + "sizing": "cover", + "type": "image", + "url": "/api/v2/images/00000000-0000-4000-8000-000000000007", + "vertical_align": "center" + }, + "id": 100036, + "layout": { + "height": 3, + "width": 7, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "- Start: User typing in runs search input\n- End: Panel showing up", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100037, + "layout": { + "height": 1, + "width": 5, + "x": 7, + "y": 0 + } + } + ] + }, + "id": 100038, + "layout": { + "height": 4, + "width": 12, + "x": 0, + "y": 6 + } + }, + { + "definition": { + "background_color": "blue", + "layout_type": "ordered", + "show_title": true, + "title": "Joyce - workspace loading proposals", + "type": "group", + "widgets": [ + { + "definition": { + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "legend_layout": "auto", + "requests": [ + { + "display_type": "line", + "formulas": [ + { + "alias": "p95", + "formula": "query1 / 1000000000", + "number_format": { + "unit": { + "type": "canonical_unit", + "unit_name": "second" + } + } + }, + { + "alias": "p98", + "formula": "query2 / 1000000000", + "number_format": { + "unit": { + "type": "canonical_unit", + "unit_name": "second" + } + } + }, + { + "alias": "p99", + "formula": "query3 / 1000000000", + "number_format": { + "unit": { + "type": "canonical_unit", + "unit_name": "second" + } + } + } + ], + "queries": [ + { + "compute": { + "aggregation": "pc95", + "metric": "@view.custom_timings.workspace_init" + }, + "data_source": "rum", + "indexes": [ + "*" + ], + "name": "query1", + "search": { + "query": "@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "pc98", + "metric": "@view.custom_timings.workspace_init" + }, + "data_source": "rum", + "indexes": [ + "*" + ], + "name": "query2", + "search": { + "query": "@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production" + }, + "storage": "hot" + }, + { + "compute": { + "aggregation": "pc99", + "metric": "@view.custom_timings.workspace_init" + }, + "data_source": "rum", + "indexes": [ + "*" + ], + "name": "query3", + "search": { + "query": "@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "line_type": "solid", + "line_width": "normal", + "order_by": "values", + "palette": "dog_classic" + } + } + ], + "show_legend": true, + "title": "Multi-run page - workspace_init (BEFORE we hit any workspace-related logic)", + "type": "timeseries" + }, + "id": 100039, + "layout": { + "height": 5, + "width": 12, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "requests": [ + { + "query": { + "compute": { + "aggregation": "pc95", + "metric": "@view.custom_timings.workspace_init" + }, + "data_source": "rum", + "indexes": [ + "*" + ], + "name": "query1", + "search": { + "query": "@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production" + }, + "storage": "hot" + }, + "request_type": "histogram" + } + ], + "show_legend": true, + "title": "Multi-run page - workspace_init (BEFORE we hit any workspace-related logic)", + "type": "distribution", + "xaxis": { + "include_zero": true, + "max": "auto", + "min": "auto", + "scale": "linear" + }, + "yaxis": { + "include_zero": true, + "max": "auto", + "min": "auto", + "scale": "linear" + } + }, + "id": 100040, + "layout": { + "height": 5, + "width": 12, + "x": 0, + "y": 5 + } + }, + { + "definition": { + "has_search_bar": "auto", + "requests": [ + { + "formulas": [ + { + "alias": "p99_seconds", + "cell_display_mode": "bar", + "formula": "query1 / 1000000000" + } + ], + "queries": [ + { + "compute": { + "aggregation": "pc99", + "metric": "@view.custom_timings.workspace_init" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@view.url_path", + "limit": 50, + "should_exclude_missing": true, + "sort": { + "aggregation": "pc99", + "metric": "@view.custom_timings.workspace_init", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query1", + "search": { + "query": "@type:view @view.name:Workspace @view.loading_type:initial_load @view.url:*nw=* @context.datadogView.was_backgrounded:false env:production" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 50, + "order_by": [ + { + "index": 0, + "order": "desc", + "type": "formula" + } + ] + } + } + ], + "title": "workspace_init max by workspace nw param (RUM)", + "type": "query_table" + }, + "id": 100041, + "layout": { + "height": 5, + "width": 12, + "x": 0, + "y": 10 + } + }, + { + "definition": { + "background_color": "white", + "content": "why the hell is this taking 2h+ https://us5.datadoghq.com/rum/sessions?query=%40type%3Aview%20%40view.name%3AWorkspace%20%40view.loading_type%3Ainitial_load%20%40view.url%3A%2Anw%3D%2A%20%40context.datadogView.was_backgrounded%3Afalse%20env%3Aproduction%20AND%20%40context.entityName%3Aelisa-motta-&event=AwAAAZ-xlf0q88SBnQAAABhBWi14bGYwcUFBRHU5TXF3VEs2VWtaTUQAAAAkMTE5ZmIyMDktOTM0My00NDNhLWI2YjgtYjY5YWM5Y2FjZWEzAADbxg&fromUser=false&index=%2A&type=rum&viz=stream&from_ts=1784920005072&to_ts=1785524805072&live=true", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100042, + "layout": { + "height": 2, + "width": 2, + "x": 0, + "y": 15 + } + }, + { + "definition": { + "requests": [ + { + "formulas": [ + { + "formula": "query1 / 1000000000" + } + ], + "queries": [ + { + "compute": { + "aggregation": "pc99", + "metric": "@view.custom_timings.workspace_init" + }, + "data_source": "rum", + "group_by": [ + { + "facet": "@context.entityName", + "limit": 50, + "should_exclude_missing": true, + "sort": { + "aggregation": "pc99", + "metric": "@view.custom_timings.workspace_init", + "order": "desc" + } + } + ], + "indexes": [ + "*" + ], + "name": "query1", + "search": { + "query": "@type:view @view.name:Workspace @view.loading_type:initial_load @view.url:*nw=* @context.datadogView.was_backgrounded:false env:production" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 50, + "order_by": [ + { + "index": 0, + "order": "desc", + "type": "formula" + } + ] + } + } + ], + "style": { + "display": { + "legend": "automatic", + "type": "stacked" + } + }, + "title": "workspace_init top entities (p99)", + "type": "toplist" + }, + "id": 100043, + "layout": { + "height": 5, + "width": 12, + "x": 0, + "y": 17 + } + } + ] + }, + "id": 100044, + "layout": { + "height": 23, + "width": 12, + "x": 0, + "y": 13 + } + }, + { + "definition": { + "background_color": "orange", + "layout_type": "ordered", + "show_title": true, + "title": "4. Toggle Run Visibility (Eyeball Clicks)", + "type": "group", + "widgets": [ + { + "definition": { + "has_background": false, + "has_border": true, + "horizontal_align": "center", + "sizing": "contain", + "type": "image", + "url": "/api/v2/images/00000000-0000-4000-8000-000000000008", + "vertical_align": "center" + }, + "id": 100045, + "layout": { + "height": 3, + "width": 7, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "- Start: User clicking eyeballs in runs selector\n- End: Panel with selected runs show up", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100046, + "layout": { + "height": 2, + "width": 5, + "x": 7, + "y": 0 + } + } + ] + }, + "id": 100047, + "layout": { + "height": 4, + "is_column_break": true, + "width": 12, + "x": 0, + "y": 36 + } + }, + { + "definition": { + "background_color": "yellow", + "layout_type": "ordered", + "show_title": true, + "title": "5. Metric Selection in Edit Panel Modal", + "type": "group", + "widgets": [ + { + "definition": { + "has_background": false, + "has_border": true, + "horizontal_align": "center", + "sizing": "contain", + "type": "image", + "url": "/api/v2/images/00000000-0000-4000-8000-000000000009", + "vertical_align": "center" + }, + "id": 100048, + "layout": { + "height": 3, + "width": 7, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "- Start: User typing metric name in the metric search of edit panel modal\n- End: Panel showing up (?)", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100049, + "layout": { + "height": 2, + "width": 5, + "x": 7, + "y": 0 + } + } + ] + }, + "id": 100050, + "layout": { + "height": 4, + "width": 12, + "x": 0, + "y": 40 + } + }, + { + "definition": { + "background_color": "green", + "layout_type": "ordered", + "show_title": true, + "title": "6. Selection Pagination", + "type": "group", + "widgets": [ + { + "definition": { + "has_background": false, + "has_border": true, + "horizontal_align": "center", + "sizing": "contain", + "type": "image", + "url": "/api/v2/images/00000000-0000-4000-8000-000000000010", + "vertical_align": "center" + }, + "id": 100051, + "layout": { + "height": 3, + "width": 7, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "- Start: User clicking `<` and `>` in section\n- End: A new page of panels show up", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100052, + "layout": { + "height": 2, + "width": 5, + "x": 7, + "y": 0 + } + } + ] + }, + "id": 100053, + "layout": { + "height": 4, + "width": 12, + "x": 0, + "y": 44 + } + }, + { + "definition": { + "background_color": "blue", + "layout_type": "ordered", + "show_title": true, + "title": "7. Hovering Panel Data", + "type": "group", + "widgets": [ + { + "definition": { + "has_background": true, + "has_border": true, + "horizontal_align": "center", + "sizing": "cover", + "type": "image", + "url": "/api/v2/images/00000000-0000-4000-8000-000000000011", + "vertical_align": "center" + }, + "id": 100054, + "layout": { + "height": 3, + "width": 7, + "x": 0, + "y": 0 + } + }, + { + "definition": { + "background_color": "white", + "content": "- Start: User hovering panel to see specific point in line\n- End: Legend with point data show up with syncing other panels", + "font_size": "14", + "has_padding": true, + "show_tick": false, + "text_align": "left", + "tick_edge": "left", + "tick_pos": "50%", + "type": "note", + "vertical_align": "top" + }, + "id": 100055, + "layout": { + "height": 2, + "width": 5, + "x": 7, + "y": 0 + } + } + ] + }, + "id": 100056, + "layout": { + "height": 4, + "width": 12, + "x": 0, + "y": 48 + } + } + ] + } + }, + "type": "dashboard", + "version_uuid": "00000000-0000-4000-8000-000000000004" + }, + "auth_method": "SESSION", + "event": { + "name": "Dashboard", + "uuid": "id-000057" + }, + "mcp_call": false, + "notable_event": false, + "previewable_event": false, + "source": { + "as": { + "domain": "example.net", + "route": "198.51.100.6/24", + "type": "hosting" + } + }, + "tags": [ + "is_previewable_event:false", + "is_notable_event:false", + "is_mcp_call:false", + "source:audit" + ], + "threat_intel": { + "indicators_matched": [ + "IP" + ], + "results": [ + { + "additional_data": { + "as": { + "number": 64496, + "organization": "Example ISP" + }, + "client": { + "concentration": { + "city": "San Francisco", + "country": "US", + "density": 1, + "geohash": "9q8yyj", + "skew": 68, + "state": "California" + }, + "count": 7, + "countries": 1, + "types": [ + "DESKTOP", + "MOBILE" + ] + }, + "infrastructure": "DATACENTER", + "location": { + "city": "San Jose", + "country": "US", + "state": "California" + }, + "organization": "Example ISP", + "tunnels": [ + { + "anonymous": false, + "operator": "EXAMPLE_PROXY", + "type": "PROXY" + } + ] + }, + "category": "corp_vpn", + "indicator": "198.51.100.4", + "intention": "benign", + "source": { + "name": "spur", + "type": "managed", + "url": "https://spur.us" + }, + "type": "IP" + } + ] + }, + "user": { + "created": "2024-08-23T20:49:04.000Z" + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "dashboard_modified", + "category": [ + "api", + "web", + "configuration" + ], + "dataset": "datadog.audit", + "id": "id-000058", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:17.107Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Dashboard\"},\"auth_method\":\"SESSION\",\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"created\":\"2024-08-23T20:49:04.000Z\",\"name\":\"Example User 01\",\"id\":\"user02@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000003\",\"email\":\"user02@example.com\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.4\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":7,\"concentration\":{\"country\":\"US\",\"density\":1,\"city\":\"San Francisco\",\"geohash\":\"9q8yyj\",\"state\":\"California\",\"skew\":68},\"countries\":1},\"location\":{\"country\":\"US\",\"city\":\"San Jose\",\"state\":\"California\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"http\":{\"url_details\":{\"path\":\"/api/v1/dashboard/zza-xmd-7jt\",\"host\":\"us5.prod.dog\"},\"status_code\":200,\"method\":\"PUT\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.5 Safari/537.36\"},\"action\":\"modified\",\"asset\":{\"path\":\"/dashboard/zza-xmd-7jt/perf-strike-team\",\"version_uuid\":\"00000000-0000-4000-8000-000000000004\",\"name\":\"Perf Strike Team\",\"id\":\"id-000012\",\"type\":\"dashboard\",\"prev_value\":{\"dashboard_definition\":{\"author_name\":\"Example Author\",\"template_variable_presets\":[{\"name\":\"Joyce\",\"description\":\"drafts\",\"template_variables\":[{\"name\":\"env\",\"value\":\"devprod\"},{\"name\":\"customer-ns\",\"value\":\"*\"},{\"name\":\"view.url_host\",\"value\":\"example.ai\"}]}],\"tabs\":[{\"name\":\"Tab 1\",\"widget_ids\":[5786555378127436,2795964700760912,3725357411171479,6879929085074505],\"id\":\"id-000013\"},{\"name\":\"1. Workspace Loading\",\"widget_ids\":[2596549404097146,1738862716789832,8118717586213844,7116521192235267,1085918712924402,5375242069538586,7632570881757390,6424405168251415,6894734997716994],\"id\":\"id-000014\"},{\"name\":\"2. Panel Bank Search\",\"widget_ids\":[1872967732978139],\"id\":\"id-000015\"},{\"name\":\"Tab 4\",\"id\":\"id-000016\"},{\"name\":\"Tab 5\",\"id\":\"id-000017\"},{\"name\":\"Tab 6\",\"id\":\"id-000018\"},{\"name\":\"Tab 7\",\"id\":\"id-000019\"}],\"description\":\"[[suggested_dashboards]]\",\"layout_type\":\"ordered\",\"created_at\":\"2026-07-09T20:30:19.501285+00:00\",\"title\":\"Perf Strike Team\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":12,\"y\":0,\"height\":1},\"definition\":{\"background_color\":\"green\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"Core Web Vitals\",\"type\":\"group\"},\"id\":100020},{\"layout\":{\"x\":0,\"width\":12,\"y\":0,\"height\":4},\"definition\":{\"background_color\":\"purple\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"2. Panel Bank Search\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000005\"},\"id\":100021},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User typing in panel search input\\n- End: Selected panels showing up\",\"text_align\":\"left\"},\"id\":100022}]},\"id\":100023},{\"layout\":{\"x\":0,\"width\":2,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"# Critical workflows\\n1. Workspace loading\\n2. Panel bank search\\n3. Runs search\\n4. Toggle run visibility (eyeball click)\\n5. Metric selection in edit panel modal\\n6. Section pagination\\n7. Hovering panel data\\n\",\"text_align\":\"left\"},\"id\":100024},{\"layout\":{\"x\":2,\"width\":2,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"## Metrics to add\\n- \\\\# of slow views\\n- list of graphql queries & its latencies\\n- list of long tasks\\n- good or bad (define threshold like # of slow views > 10?)\\n\\n## Start and end definition\\n- start \\u2014 \\n- end \\u2014 after data returns and filters section & panels right before react re-rendering?\",\"text_align\":\"left\"},\"id\":100025},{\"layout\":{\"x\":4,\"width\":2,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"## TODO\\n- separate these workflow into its own tab\\n\",\"text_align\":\"left\"},\"id\":100026},{\"layout\":{\"x\":0,\"width\":12,\"y\":1,\"height\":1},\"definition\":{\"background_color\":\"yellow\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"HistoryKeysByHash Perf\",\"type\":\"group\"},\"id\":100027},{\"layout\":{\"x\":0,\"width\":12,\"y\":2,\"height\":11},\"definition\":{\"background_color\":\"gray\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"Justin - possible metrics\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":4,\"y\":0,\"height\":2},\"definition\":{\"title_align\":\"left\",\"title_size\":\"16\",\"has_search_bar\":\"auto\",\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"formula\":\"query1\",\"cell_display_mode\":\"bar\"},{\"formula\":\"query2\",\"cell_display_mode\":\"bar\"},{\"formula\":\"query3\",\"cell_display_mode\":\"bar\"},{\"alias\":\"50ms+ compressions\",\"formula\":\"query4\",\"cell_display_mode\":\"bar\"}],\"sort\":{\"count\":590,\"order_by\":[{\"index\":0,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:action @action.name:\\\"workspace.save_duration\\\" @context.compressDuration:>10\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":30,\"sort\":{\"metric\":\"count\",\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@context.compressDuration\",\"aggregation\":\"pc75\"},\"search\":{\"query\":\"@type:action @action.name:\\\"workspace.save_duration\\\" @context.compressDuration:>10\"},\"indexes\":[\"*\"],\"name\":\"query2\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":30,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@context.compressDuration\",\"aggregation\":\"max\"},\"search\":{\"query\":\"@type:action @action.name:\\\"workspace.save_duration\\\" @context.compressDuration:>10\"},\"indexes\":[\"*\"],\"name\":\"query3\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":30,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:action @action.name:\\\"workspace.save_duration\\\" @context.compressDuration:>50\"},\"indexes\":[\"*\"],\"name\":\"query4\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":500,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"\",\"type\":\"query_table\"},\"id\":100028},{\"layout\":{\"x\":5,\"width\":5,\"y\":0,\"height\":8},\"definition\":{\"title_align\":\"left\",\"title_size\":\"16\",\"has_search_bar\":\"auto\",\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"alias\":\"Max Workspace Keys\",\"formula\":\"query1\",\"cell_display_mode\":\"number\"},{\"alias\":\"Longest Task\",\"formula\":\"query2\",\"cell_display_mode\":\"bar\"},{\"alias\":\"Pc90 Task\",\"formula\":\"query3\",\"cell_display_mode\":\"number\"},{\"alias\":\"Count\",\"formula\":\"query4\",\"cell_display_mode\":\"bar\"},{\"alias\":\"Average\",\"formula\":\"query5\",\"cell_display_mode\":\"bar\"}],\"sort\":{\"count\":500,\"order_by\":[{\"index\":3,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"metric\":\"@context.keyCount\",\"aggregation\":\"max\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"max\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query2\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"pc90\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query3\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query4\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"avg\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query5\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"Autosync Cache Key Pain By Entity\",\"type\":\"query_table\"},\"id\":100029},{\"layout\":{\"x\":10,\"width\":2,\"y\":0,\"height\":4},\"definition\":{\"legend_columns\":[\"avg\",\"min\",\"max\",\"value\",\"sum\"],\"title_align\":\"left\",\"title_size\":\"16\",\"show_legend\":true,\"requests\":[{\"display_type\":\"line\",\"response_format\":\"timeseries\",\"formulas\":[{\"formula\":\"query1\"},{\"formula\":\"query2\"}],\"style\":{\"line_width\":\"normal\",\"line_type\":\"solid\",\"order_by\":\"values\",\"palette\":\"dog_classic\"},\"queries\":[{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"median\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"pc90\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query2\",\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"Slow cache key generation\",\"type\":\"timeseries\",\"legend_layout\":\"auto\"},\"id\":100030},{\"layout\":{\"x\":0,\"width\":5,\"y\":2,\"height\":8},\"definition\":{\"title_align\":\"left\",\"title_size\":\"16\",\"has_search_bar\":\"auto\",\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"alias\":\"100ms+\",\"formula\":\"query1\",\"cell_display_mode\":\"bar\"},{\"alias\":\"500ms+\",\"formula\":\"query3\",\"cell_display_mode\":\"bar\"},{\"alias\":\"Count\",\"formula\":\"query4\",\"cell_display_mode\":\"bar\"}],\"sort\":{\"count\":1100,\"order_by\":[{\"index\":2,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_panel_bank\\\" @vital.duration:>100000000\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":50,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_panel_bank\\\" @vital.duration:>500000000\"},\"indexes\":[\"*\"],\"name\":\"query3\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":50,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_panel_bank\\\" @vital.duration:>100000000\"},\"indexes\":[\"*\"],\"name\":\"query4\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":1000,\"sort\":{\"metric\":\"count\",\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"Slow autosync_panel_bank\",\"type\":\"query_table\"},\"id\":100031}]},\"id\":100032},{\"layout\":{\"x\":0,\"width\":12,\"y\":2,\"height\":4},\"definition\":{\"background_color\":\"blue\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"1. Workspace Loading\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000006\"},\"id\":100033},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":1},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User visiting example.ai//\\n- End: Runs search & panels show up\",\"text_align\":\"left\"},\"id\":100034}]},\"id\":100035},{\"layout\":{\"x\":0,\"width\":12,\"y\":6,\"height\":4},\"definition\":{\"background_color\":\"pink\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"3. Runs Search\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"cover\",\"has_background\":true,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000007\"},\"id\":100036},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":1},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User typing in runs search input\\n- End: Panel showing up\",\"text_align\":\"left\"},\"id\":100037}]},\"id\":100038},{\"layout\":{\"x\":0,\"width\":12,\"y\":13,\"height\":23},\"definition\":{\"background_color\":\"blue\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"Joyce - workspace loading proposals\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":12,\"y\":0,\"height\":5},\"definition\":{\"legend_columns\":[\"avg\",\"min\",\"max\",\"value\",\"sum\"],\"show_legend\":true,\"requests\":[{\"display_type\":\"line\",\"response_format\":\"timeseries\",\"formulas\":[{\"alias\":\"p95\",\"formula\":\"query1 / 1000000000\",\"number_format\":{\"unit\":{\"unit_name\":\"second\",\"type\":\"canonical_unit\"}}},{\"alias\":\"p98\",\"formula\":\"query2 / 1000000000\",\"number_format\":{\"unit\":{\"unit_name\":\"second\",\"type\":\"canonical_unit\"}}},{\"alias\":\"p99\",\"formula\":\"query3 / 1000000000\",\"number_format\":{\"unit\":{\"unit_name\":\"second\",\"type\":\"canonical_unit\"}}}],\"style\":{\"line_width\":\"normal\",\"line_type\":\"solid\",\"order_by\":\"values\",\"palette\":\"dog_classic\"},\"queries\":[{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc95\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc98\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query2\",\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query3\",\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"Multi-run page - workspace_init (BEFORE we hit any workspace-related logic)\",\"type\":\"timeseries\",\"legend_layout\":\"auto\"},\"id\":100039},{\"layout\":{\"x\":0,\"width\":12,\"y\":5,\"height\":5},\"definition\":{\"xaxis\":{\"include_zero\":true,\"min\":\"auto\",\"max\":\"auto\",\"scale\":\"linear\"},\"show_legend\":true,\"requests\":[{\"request_type\":\"histogram\",\"query\":{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc95\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"storage\":\"hot\",\"data_source\":\"rum\"}}],\"title\":\"Multi-run page - workspace_init (BEFORE we hit any workspace-related logic)\",\"type\":\"distribution\",\"yaxis\":{\"include_zero\":true,\"min\":\"auto\",\"max\":\"auto\",\"scale\":\"linear\"}},\"id\":100040},{\"layout\":{\"x\":0,\"width\":12,\"y\":10,\"height\":5},\"definition\":{\"has_search_bar\":\"auto\",\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"alias\":\"p99_seconds\",\"formula\":\"query1 / 1000000000\",\"cell_display_mode\":\"bar\"}],\"sort\":{\"count\":50,\"order_by\":[{\"index\":0,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @view.url:*nw=* @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":50,\"sort\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\",\"order\":\"desc\"},\"facet\":\"@view.url_path\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"workspace_init max by workspace nw param (RUM)\",\"type\":\"query_table\"},\"id\":100041},{\"layout\":{\"x\":0,\"width\":2,\"y\":15,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"why the hell is this taking 2h+ https://us5.datadoghq.com/rum/sessions?query=%40type%3Aview%20%40view.name%3AWorkspace%20%40view.loading_type%3Ainitial_load%20%40view.url%3A%2Anw%3D%2A%20%40context.datadogView.was_backgrounded%3Afalse%20env%3Aproduction%20AND%20%40context.entityName%3Aelisa-motta-&event=AwAAAZ-xlf0q88SBnQAAABhBWi14bGYwcUFBRHU5TXF3VEs2VWtaTUQAAAAkMTE5ZmIyMDktOTM0My00NDNhLWI2YjgtYjY5YWM5Y2FjZWEzAADbxg&fromUser=false&index=%2A&type=rum&viz=stream&from_ts=1784920005072&to_ts=1785524805072&live=true\",\"text_align\":\"left\"},\"id\":100042},{\"layout\":{\"x\":0,\"width\":12,\"y\":17,\"height\":5},\"definition\":{\"style\":{\"display\":{\"legend\":\"automatic\",\"type\":\"stacked\"}},\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"formula\":\"query1 / 1000000000\"}],\"sort\":{\"count\":50,\"order_by\":[{\"index\":0,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @view.url:*nw=* @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":50,\"sort\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"workspace_init top entities (p99)\",\"type\":\"toplist\"},\"id\":100043}]},\"id\":100044},{\"layout\":{\"x\":0,\"width\":12,\"y\":36,\"is_column_break\":true,\"height\":4},\"definition\":{\"background_color\":\"orange\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"4. Toggle Run Visibility (Eyeball Clicks)\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000008\"},\"id\":100045},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User clicking eyeballs in runs selector\\n- End: Panel with selected runs show up\",\"text_align\":\"left\"},\"id\":100046}]},\"id\":100047},{\"layout\":{\"x\":0,\"width\":12,\"y\":40,\"height\":4},\"definition\":{\"background_color\":\"yellow\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"5. Metric Selection in Edit Panel Modal\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000009\"},\"id\":100048},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User typing metric name in the metric search of edit panel modal\\n- End: Panel showing up (?)\",\"text_align\":\"left\"},\"id\":100049}]},\"id\":100050},{\"layout\":{\"x\":0,\"width\":12,\"y\":44,\"height\":4},\"definition\":{\"background_color\":\"green\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"6. Selection Pagination\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000010\"},\"id\":100051},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User clicking `<` and `>` in section\\n- End: A new page of panels show up\",\"text_align\":\"left\"},\"id\":100052}]},\"id\":100053},{\"layout\":{\"x\":0,\"width\":12,\"y\":48,\"height\":4},\"definition\":{\"background_color\":\"blue\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"7. Hovering Panel Data\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"cover\",\"has_background\":true,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000011\"},\"id\":100054},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User hovering panel to see specific point in line\\n- End: Legend with point data show up with syncing other panels\",\"text_align\":\"left\"},\"id\":100055}]},\"id\":100056}],\"author_handle\":\"example-author\",\"template_variables\":[{\"default\":\"*\",\"prefix\":\"env\",\"name\":\"env\"},{\"default\":\"*\",\"prefix\":\"customer-ns\",\"name\":\"customer-ns\"},{\"default\":\"*\",\"prefix\":\"@view.url_host\",\"name\":\"view.url_host\"}],\"url\":\"/dashboard/zza-xmd-7jt/perf-strike-team\",\"reflow_type\":\"fixed\",\"id\":\"id-000012\",\"modified_at\":\"2026-07-31T19:23:10.149500+00:00\"}},\"new_value\":{\"dashboard_definition\":{\"author_name\":\"Example Author\",\"template_variable_presets\":[{\"name\":\"Joyce\",\"description\":\"drafts\",\"template_variables\":[{\"name\":\"env\",\"value\":\"devprod\"},{\"name\":\"customer-ns\",\"value\":\"*\"},{\"name\":\"view.url_host\",\"value\":\"example.ai\"}]}],\"tabs\":[{\"name\":\"Tab 1\",\"widget_ids\":[5786555378127436,2795964700760912,3725357411171479,6879929085074505],\"id\":\"id-000013\"},{\"name\":\"1. Workspace Loading\",\"widget_ids\":[2596549404097146,1738862716789832,8118717586213844,7116521192235267,1085918712924402,5375242069538586,7632570881757390,6424405168251415,6894734997716994],\"id\":\"id-000014\"},{\"name\":\"2. Panel Bank Search\",\"widget_ids\":[1872967732978139],\"id\":\"id-000015\"},{\"name\":\"3.\",\"id\":\"id-000016\"},{\"name\":\"Tab 5\",\"id\":\"id-000017\"},{\"name\":\"Tab 6\",\"id\":\"id-000018\"},{\"name\":\"Tab 7\",\"id\":\"id-000019\"}],\"description\":\"[[suggested_dashboards]]\",\"layout_type\":\"ordered\",\"created_at\":\"2026-07-09T20:30:19.501285+00:00\",\"title\":\"Perf Strike Team\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":12,\"y\":0,\"height\":1},\"definition\":{\"background_color\":\"green\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"Core Web Vitals\",\"type\":\"group\"},\"id\":100020},{\"layout\":{\"x\":0,\"width\":12,\"y\":0,\"height\":4},\"definition\":{\"background_color\":\"purple\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"2. Panel Bank Search\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000005\"},\"id\":100021},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User typing in panel search input\\n- End: Selected panels showing up\",\"text_align\":\"left\"},\"id\":100022}]},\"id\":100023},{\"layout\":{\"x\":0,\"width\":2,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"# Critical workflows\\n1. Workspace loading\\n2. Panel bank search\\n3. Runs search\\n4. Toggle run visibility (eyeball click)\\n5. Metric selection in edit panel modal\\n6. Section pagination\\n7. Hovering panel data\\n\",\"text_align\":\"left\"},\"id\":100024},{\"layout\":{\"x\":2,\"width\":2,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"## Metrics to add\\n- \\\\# of slow views\\n- list of graphql queries & its latencies\\n- list of long tasks\\n- good or bad (define threshold like # of slow views > 10?)\\n\\n## Start and end definition\\n- start \\u2014 \\n- end \\u2014 after data returns and filters section & panels right before react re-rendering?\",\"text_align\":\"left\"},\"id\":100025},{\"layout\":{\"x\":4,\"width\":2,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"## TODO\\n- separate these workflow into its own tab\\n\",\"text_align\":\"left\"},\"id\":100026},{\"layout\":{\"x\":0,\"width\":12,\"y\":1,\"height\":1},\"definition\":{\"background_color\":\"yellow\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"HistoryKeysByHash Perf\",\"type\":\"group\"},\"id\":100027},{\"layout\":{\"x\":0,\"width\":12,\"y\":2,\"height\":11},\"definition\":{\"background_color\":\"gray\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"Justin - possible metrics\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":4,\"y\":0,\"height\":2},\"definition\":{\"title_align\":\"left\",\"title_size\":\"16\",\"has_search_bar\":\"auto\",\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"formula\":\"query1\",\"cell_display_mode\":\"bar\"},{\"formula\":\"query2\",\"cell_display_mode\":\"bar\"},{\"formula\":\"query3\",\"cell_display_mode\":\"bar\"},{\"alias\":\"50ms+ compressions\",\"formula\":\"query4\",\"cell_display_mode\":\"bar\"}],\"sort\":{\"count\":590,\"order_by\":[{\"index\":0,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:action @action.name:\\\"workspace.save_duration\\\" @context.compressDuration:>10\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":30,\"sort\":{\"metric\":\"count\",\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@context.compressDuration\",\"aggregation\":\"pc75\"},\"search\":{\"query\":\"@type:action @action.name:\\\"workspace.save_duration\\\" @context.compressDuration:>10\"},\"indexes\":[\"*\"],\"name\":\"query2\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":30,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@context.compressDuration\",\"aggregation\":\"max\"},\"search\":{\"query\":\"@type:action @action.name:\\\"workspace.save_duration\\\" @context.compressDuration:>10\"},\"indexes\":[\"*\"],\"name\":\"query3\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":30,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:action @action.name:\\\"workspace.save_duration\\\" @context.compressDuration:>50\"},\"indexes\":[\"*\"],\"name\":\"query4\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":500,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"\",\"type\":\"query_table\"},\"id\":100028},{\"layout\":{\"x\":5,\"width\":5,\"y\":0,\"height\":8},\"definition\":{\"title_align\":\"left\",\"title_size\":\"16\",\"has_search_bar\":\"auto\",\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"alias\":\"Max Workspace Keys\",\"formula\":\"query1\",\"cell_display_mode\":\"number\"},{\"alias\":\"Longest Task\",\"formula\":\"query2\",\"cell_display_mode\":\"bar\"},{\"alias\":\"Pc90 Task\",\"formula\":\"query3\",\"cell_display_mode\":\"number\"},{\"alias\":\"Count\",\"formula\":\"query4\",\"cell_display_mode\":\"bar\"},{\"alias\":\"Average\",\"formula\":\"query5\",\"cell_display_mode\":\"bar\"}],\"sort\":{\"count\":500,\"order_by\":[{\"index\":3,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"metric\":\"@context.keyCount\",\"aggregation\":\"max\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"max\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query2\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"pc90\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query3\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query4\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"avg\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query5\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":100,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"Autosync Cache Key Pain By Entity\",\"type\":\"query_table\"},\"id\":100029},{\"layout\":{\"x\":10,\"width\":2,\"y\":0,\"height\":4},\"definition\":{\"legend_columns\":[\"avg\",\"min\",\"max\",\"value\",\"sum\"],\"title_align\":\"left\",\"title_size\":\"16\",\"show_legend\":true,\"requests\":[{\"display_type\":\"line\",\"response_format\":\"timeseries\",\"formulas\":[{\"formula\":\"query1\"},{\"formula\":\"query2\"}],\"style\":{\"line_width\":\"normal\",\"line_type\":\"solid\",\"order_by\":\"values\",\"palette\":\"dog_classic\"},\"queries\":[{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"median\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@vital.duration\",\"aggregation\":\"pc90\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_cache_key\\\" @context.keyCount:>10000\"},\"indexes\":[\"*\"],\"name\":\"query2\",\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"Slow cache key generation\",\"type\":\"timeseries\",\"legend_layout\":\"auto\"},\"id\":100030},{\"layout\":{\"x\":0,\"width\":5,\"y\":2,\"height\":8},\"definition\":{\"title_align\":\"left\",\"title_size\":\"16\",\"has_search_bar\":\"auto\",\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"alias\":\"100ms+\",\"formula\":\"query1\",\"cell_display_mode\":\"bar\"},{\"alias\":\"500ms+\",\"formula\":\"query3\",\"cell_display_mode\":\"bar\"},{\"alias\":\"Count\",\"formula\":\"query4\",\"cell_display_mode\":\"bar\"}],\"sort\":{\"count\":1100,\"order_by\":[{\"index\":2,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_panel_bank\\\" @vital.duration:>100000000\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":50,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_panel_bank\\\" @vital.duration:>500000000\"},\"indexes\":[\"*\"],\"name\":\"query3\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":50,\"sort\":{\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"aggregation\":\"count\"},\"search\":{\"query\":\"@type:vital @vital.name:\\\"workspace.autosync_panel_bank\\\" @vital.duration:>100000000\"},\"indexes\":[\"*\"],\"name\":\"query4\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":1000,\"sort\":{\"metric\":\"count\",\"aggregation\":\"count\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"Slow autosync_panel_bank\",\"type\":\"query_table\"},\"id\":100031}]},\"id\":100032},{\"layout\":{\"x\":0,\"width\":12,\"y\":2,\"height\":4},\"definition\":{\"background_color\":\"blue\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"1. Workspace Loading\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000006\"},\"id\":100033},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":1},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User visiting example.ai//\\n- End: Runs search & panels show up\",\"text_align\":\"left\"},\"id\":100034}]},\"id\":100035},{\"layout\":{\"x\":0,\"width\":12,\"y\":6,\"height\":4},\"definition\":{\"background_color\":\"pink\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"3. Runs Search\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"cover\",\"has_background\":true,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000007\"},\"id\":100036},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":1},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User typing in runs search input\\n- End: Panel showing up\",\"text_align\":\"left\"},\"id\":100037}]},\"id\":100038},{\"layout\":{\"x\":0,\"width\":12,\"y\":13,\"height\":23},\"definition\":{\"background_color\":\"blue\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"Joyce - workspace loading proposals\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":12,\"y\":0,\"height\":5},\"definition\":{\"legend_columns\":[\"avg\",\"min\",\"max\",\"value\",\"sum\"],\"show_legend\":true,\"requests\":[{\"display_type\":\"line\",\"response_format\":\"timeseries\",\"formulas\":[{\"alias\":\"p95\",\"formula\":\"query1 / 1000000000\",\"number_format\":{\"unit\":{\"unit_name\":\"second\",\"type\":\"canonical_unit\"}}},{\"alias\":\"p98\",\"formula\":\"query2 / 1000000000\",\"number_format\":{\"unit\":{\"unit_name\":\"second\",\"type\":\"canonical_unit\"}}},{\"alias\":\"p99\",\"formula\":\"query3 / 1000000000\",\"number_format\":{\"unit\":{\"unit_name\":\"second\",\"type\":\"canonical_unit\"}}}],\"style\":{\"line_width\":\"normal\",\"line_type\":\"solid\",\"order_by\":\"values\",\"palette\":\"dog_classic\"},\"queries\":[{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc95\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc98\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query2\",\"storage\":\"hot\",\"data_source\":\"rum\"},{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query3\",\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"Multi-run page - workspace_init (BEFORE we hit any workspace-related logic)\",\"type\":\"timeseries\",\"legend_layout\":\"auto\"},\"id\":100039},{\"layout\":{\"x\":0,\"width\":12,\"y\":5,\"height\":5},\"definition\":{\"xaxis\":{\"include_zero\":true,\"min\":\"auto\",\"max\":\"auto\",\"scale\":\"linear\"},\"show_legend\":true,\"requests\":[{\"request_type\":\"histogram\",\"query\":{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc95\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"storage\":\"hot\",\"data_source\":\"rum\"}}],\"title\":\"Multi-run page - workspace_init (BEFORE we hit any workspace-related logic)\",\"type\":\"distribution\",\"yaxis\":{\"include_zero\":true,\"min\":\"auto\",\"max\":\"auto\",\"scale\":\"linear\"}},\"id\":100040},{\"layout\":{\"x\":0,\"width\":12,\"y\":10,\"height\":5},\"definition\":{\"has_search_bar\":\"auto\",\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"alias\":\"p99_seconds\",\"formula\":\"query1 / 1000000000\",\"cell_display_mode\":\"bar\"}],\"sort\":{\"count\":50,\"order_by\":[{\"index\":0,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @view.url:*nw=* @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":50,\"sort\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\",\"order\":\"desc\"},\"facet\":\"@view.url_path\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"workspace_init max by workspace nw param (RUM)\",\"type\":\"query_table\"},\"id\":100041},{\"layout\":{\"x\":0,\"width\":2,\"y\":15,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"why the hell is this taking 2h+ https://us5.datadoghq.com/rum/sessions?query=%40type%3Aview%20%40view.name%3AWorkspace%20%40view.loading_type%3Ainitial_load%20%40view.url%3A%2Anw%3D%2A%20%40context.datadogView.was_backgrounded%3Afalse%20env%3Aproduction%20AND%20%40context.entityName%3Aelisa-motta-&event=AwAAAZ-xlf0q88SBnQAAABhBWi14bGYwcUFBRHU5TXF3VEs2VWtaTUQAAAAkMTE5ZmIyMDktOTM0My00NDNhLWI2YjgtYjY5YWM5Y2FjZWEzAADbxg&fromUser=false&index=%2A&type=rum&viz=stream&from_ts=1784920005072&to_ts=1785524805072&live=true\",\"text_align\":\"left\"},\"id\":100042},{\"layout\":{\"x\":0,\"width\":12,\"y\":17,\"height\":5},\"definition\":{\"style\":{\"display\":{\"legend\":\"automatic\",\"type\":\"stacked\"}},\"requests\":[{\"response_format\":\"scalar\",\"formulas\":[{\"formula\":\"query1 / 1000000000\"}],\"sort\":{\"count\":50,\"order_by\":[{\"index\":0,\"type\":\"formula\",\"order\":\"desc\"}]},\"queries\":[{\"compute\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\"},\"search\":{\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @view.url:*nw=* @context.datadogView.was_backgrounded:false env:production\"},\"indexes\":[\"*\"],\"name\":\"query1\",\"group_by\":[{\"should_exclude_missing\":true,\"limit\":50,\"sort\":{\"metric\":\"@view.custom_timings.workspace_init\",\"aggregation\":\"pc99\",\"order\":\"desc\"},\"facet\":\"@context.entityName\"}],\"storage\":\"hot\",\"data_source\":\"rum\"}]}],\"title\":\"workspace_init top entities (p99)\",\"type\":\"toplist\"},\"id\":100043}]},\"id\":100044},{\"layout\":{\"x\":0,\"width\":12,\"y\":36,\"is_column_break\":true,\"height\":4},\"definition\":{\"background_color\":\"orange\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"4. Toggle Run Visibility (Eyeball Clicks)\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000008\"},\"id\":100045},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User clicking eyeballs in runs selector\\n- End: Panel with selected runs show up\",\"text_align\":\"left\"},\"id\":100046}]},\"id\":100047},{\"layout\":{\"x\":0,\"width\":12,\"y\":40,\"height\":4},\"definition\":{\"background_color\":\"yellow\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"5. Metric Selection in Edit Panel Modal\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000009\"},\"id\":100048},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User typing metric name in the metric search of edit panel modal\\n- End: Panel showing up (?)\",\"text_align\":\"left\"},\"id\":100049}]},\"id\":100050},{\"layout\":{\"x\":0,\"width\":12,\"y\":44,\"height\":4},\"definition\":{\"background_color\":\"green\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"6. Selection Pagination\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"contain\",\"has_background\":false,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000010\"},\"id\":100051},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User clicking `<` and `>` in section\\n- End: A new page of panels show up\",\"text_align\":\"left\"},\"id\":100052}]},\"id\":100053},{\"layout\":{\"x\":0,\"width\":12,\"y\":48,\"height\":4},\"definition\":{\"background_color\":\"blue\",\"show_title\":true,\"layout_type\":\"ordered\",\"title\":\"7. Hovering Panel Data\",\"type\":\"group\",\"widgets\":[{\"layout\":{\"x\":0,\"width\":7,\"y\":0,\"height\":3},\"definition\":{\"sizing\":\"cover\",\"has_background\":true,\"vertical_align\":\"center\",\"has_border\":true,\"horizontal_align\":\"center\",\"type\":\"image\",\"url\":\"/api/v2/images/00000000-0000-4000-8000-000000000011\"},\"id\":100054},{\"layout\":{\"x\":7,\"width\":5,\"y\":0,\"height\":2},\"definition\":{\"show_tick\":false,\"background_color\":\"white\",\"vertical_align\":\"top\",\"tick_pos\":\"50%\",\"has_padding\":true,\"font_size\":\"14\",\"tick_edge\":\"left\",\"type\":\"note\",\"content\":\"- Start: User hovering panel to see specific point in line\\n- End: Legend with point data show up with syncing other panels\",\"text_align\":\"left\"},\"id\":100055}]},\"id\":100056}],\"author_handle\":\"example-author\",\"template_variables\":[{\"default\":\"*\",\"prefix\":\"env\",\"name\":\"env\"},{\"default\":\"*\",\"prefix\":\"customer-ns\",\"name\":\"customer-ns\"},{\"default\":\"*\",\"prefix\":\"@view.url_host\",\"name\":\"view.url_host\"}],\"url\":\"/dashboard/zza-xmd-7jt/perf-strike-team\",\"reflow_type\":\"fixed\",\"id\":\"id-000012\",\"modified_at\":\"2026-07-31T19:23:16.908589+00:00\"}}},\"uuid\":\"id-000057\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"California\",\"iso_code\":\"US-CA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.6/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"San Francisco\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.4\",\"location\":{\"latitude\":37.77493,\"longitude\":-122.41942}},\"ip\":\"198.51.100.4\"}},\"timestamp\":\"2026-07-31T19:23:17.107Z\",\"status\":\"info\"},\"_id\":\"id-000058\",\"source\":\"audit\",\"message\":\"user02@example.com modified the dashboard Perf Strike Team\",\"status\":\"info\",\"tags\":[\"is_previewable_event:false\",\"is_notable_event:false\",\"is_mcp_call:false\",\"source:audit\"]}", + "outcome": "success", + "type": [ + "change" + ] + }, + "http": { + "request": { + "method": "PUT" + }, + "response": { + "status_code": 200 + } + }, + "log": { + "level": "info" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001", + "name": "Example Corp" + }, + "related": { + "hosts": [ + "us5.prod.dog" + ], + "ip": [ + "198.51.100.4" + ], + "user": [ + "user02@example.com" + ] + }, + "source": { + "as": { + "number": 64496, + "organization": { + "name": "Example ISP" + } + }, + "geo": { + "city_name": "San Francisco", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 37.77493, + "lon": -122.41942 + }, + "region_iso_code": "US-CA", + "region_name": "California", + "timezone": "America/Los_Angeles" + }, + "ip": "198.51.100.4" + }, + "url": { + "domain": "us5.prod.dog", + "full": "https://us5.prod.dog/api/v1/dashboard/zza-xmd-7jt", + "path": "/api/v1/dashboard/zza-xmd-7jt" + }, + "user": { + "email": "user02@example.com", + "full_name": "Example User 01", + "id": "00000000-0000-4000-8000-000000000003", + "name": "user02@example.com" + }, + "user_agent": { + "device": { + "name": "Mac" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.5 Safari/537.36", + "os": { + "full": "Mac OS X 10.15.7", + "name": "Mac OS X", + "version": "10.15.7" + }, + "version": "198.51.100.5" + } + }, + { + "@timestamp": "2026-07-31T19:22:58.866Z", + "datadog": { + "action": "created", + "actor": { + "type": "SYSTEM" + }, + "agent": { + "remote_updates_enabled": false + }, + "asset": { + "id": "id-000060", + "type": "datadog_agent_configuration" + }, + "auth_method": "SYSTEM", + "event": { + "name": "Datadog Agent", + "uuid": "id-000061" + }, + "event_name": "Integration Installed", + "integration_name": "service-discovery", + "metadata": { + "agent_metadata": { + "agent_version": "", + "flavor": "", + "install_method_tool": "", + "remote_updates_enabled": false + }, + "datadog_agent_key": "REDACTED", + "dd": { + "request_id": "id-000059" + }, + "event_name": "Integration Installed", + "host_metadata": { + "hostname": "example-host", + "os": "" + }, + "integration_name": "service-discovery", + "source": [ + "local" + ] + }, + "previewable_event": true, + "request_id": "id-000059", + "tags": [ + "is_previewable_event:true", + "source:audit" + ] + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "datadog_agent_created", + "category": [ + "api", + "configuration" + ], + "dataset": "datadog.audit", + "id": "id-000062", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:22:58.866Z\",\"attributes\":{\"auth_method\":\"SYSTEM\",\"evt\":{\"actor\":{\"type\":\"SYSTEM\"},\"name\":\"Datadog Agent\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000059\"},\"integration_name\":\"service-discovery\",\"host_metadata\":{\"hostname\":\"example-host\",\"os\":\"\"},\"datadog_agent_key\":\"REDACTED\",\"event_name\":\"Integration Installed\",\"source\":[\"local\"],\"agent_metadata\":{\"flavor\":\"\",\"agent_version\":\"\",\"remote_updates_enabled\":false,\"install_method_tool\":\"\"}},\"action\":\"created\",\"asset\":{\"id\":\"id-000060\",\"type\":\"datadog_agent_configuration\"},\"uuid\":\"id-000061\",\"status\":\"info\",\"timestamp\":\"2026-07-31T19:22:58.866Z\"},\"_id\":\"id-000062\",\"source\":\"audit\",\"message\":\"Integration service-discovery installed on host\",\"status\":\"info\",\"tags\":[\"is_previewable_event:true\",\"source:audit\"]}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "host": { + "name": "example-host" + }, + "log": { + "level": "info" + } + }, + { + "@timestamp": "2026-07-31T19:23:12.112Z", + "datadog": { + "action": "modified", + "actor": { + "type": "SYSTEM" + }, + "agent": { + "remote_updates_enabled": false + }, + "asset": { + "id": "id-000064", + "new_value": { + "redisdb:34c6bec2c01cd159": { + "host": "198.51.100.21", + "port": "6379", + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000013", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:63b93638503dbd2": { + "host": "198.51.100.20", + "port": "6379", + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000013", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:eb864352a1a2db64": { + "host": "198.51.100.20", + "port": 6379, + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000013", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:f27d25c1da45af54": { + "host": "198.51.100.21", + "port": 6379, + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000013", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + } + }, + "prev_value": { + "redisdb:10a931455444b1df": { + "host": "198.51.100.10", + "port": "6379", + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:10baada62c3b2267": { + "host": "198.51.100.8", + "port": 6379, + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:1a388803ca6ffe11": { + "host": "198.51.100.13", + "port": "6379", + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:58834decc2ba3d": { + "host": "198.51.100.16", + "port": "6379", + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:7110b07926056253": { + "host": "198.51.100.18", + "port": 6379, + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:7aade5a8c38adeb1": { + "host": "198.51.100.15", + "port": "6379", + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:7cb25ff876b899f1": { + "host": "198.51.100.7", + "port": 6379, + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:8d7f6192cd5df736": { + "host": "198.51.100.19", + "port": 6379, + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:8d8905b56566799b": { + "host": "198.51.100.7", + "port": "6379", + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:8da7c81a4e861345": { + "host": "198.51.100.15", + "port": 6379, + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:8ed3a1e948696016": { + "host": "198.51.100.11", + "port": 6379, + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:942dd83468ad984a": { + "host": "198.51.100.9", + "port": 6379, + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:98717c627b2963a5": { + "host": "198.51.100.17", + "port": 6379, + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:9aefd7d3e29077ea": { + "host": "198.51.100.19", + "port": "6379", + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:9af67e250eb281e4": { + "host": "198.51.100.12", + "port": "6379", + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:b0710ee4ef42e154": { + "host": "198.51.100.18", + "port": "6379", + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:b3deaaed9a2ad761": { + "host": "198.51.100.13", + "port": 6379, + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:b8f5331710244154": { + "host": "198.51.100.10", + "port": 6379, + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:bafceef4140d9995": { + "host": "198.51.100.12", + "port": 6379, + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:c79c815b1d4b96e4": { + "host": "198.51.100.11", + "port": "6379", + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:c7c8ece6b488cb56": { + "host": "198.51.100.9", + "port": "6379", + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:cf46da301ec66a78": { + "host": "198.51.100.16", + "port": 6379, + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:d27ca5eb438a61f2": { + "host": "198.51.100.14", + "port": 6379, + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:d84be0be7fd4ef3f": { + "host": "198.51.100.8", + "port": "6379", + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:e3b90f3e43924517": { + "host": "198.51.100.17", + "port": "6379", + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + }, + "redisdb:e5ab3c5461018809": { + "host": "198.51.100.14", + "port": "6379", + "tags": [ + "image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd", + "image_name:us-central1-docker.pkg.dev/example-production/hub/redis", + "image_tag:7.0.12", + "kube_container_name:redis", + "kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012", + "kube_namespace:default", + "kube_ownerref_kind:job", + "kube_qos:Burstable", + "pod_phase:running", + "short_image:redis" + ] + } + }, + "type": "datadog_agent_configuration" + }, + "auth_method": "SYSTEM", + "event": { + "name": "Datadog Agent", + "uuid": "id-000065" + }, + "event_name": "Integration Modified", + "integration_name": "redis", + "metadata": { + "agent_metadata": { + "agent_version": "", + "flavor": "", + "install_method_tool": "", + "remote_updates_enabled": false + }, + "datadog_agent_key": "REDACTED", + "dd": { + "request_id": "id-000063" + }, + "event_name": "Integration Modified", + "host_metadata": { + "hostname": "example-host", + "os": "" + }, + "integration_name": "redis", + "source": [ + "local" + ] + }, + "previewable_event": true, + "request_id": "id-000063", + "tags": [ + "is_previewable_event:true", + "source:audit" + ] + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "datadog_agent_modified", + "category": [ + "api", + "configuration" + ], + "dataset": "datadog.audit", + "id": "id-000066", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:12.112Z\",\"attributes\":{\"auth_method\":\"SYSTEM\",\"evt\":{\"actor\":{\"type\":\"SYSTEM\"},\"name\":\"Datadog Agent\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000063\"},\"integration_name\":\"redis\",\"host_metadata\":{\"hostname\":\"example-host\",\"os\":\"\"},\"datadog_agent_key\":\"REDACTED\",\"event_name\":\"Integration Modified\",\"source\":[\"local\"],\"agent_metadata\":{\"flavor\":\"\",\"agent_version\":\"\",\"remote_updates_enabled\":false,\"install_method_tool\":\"\"}},\"action\":\"modified\",\"asset\":{\"id\":\"id-000064\",\"type\":\"datadog_agent_configuration\",\"prev_value\":{\"redisdb:7cb25ff876b899f1\":{\"port\":6379,\"host\":\"198.51.100.7\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:d84be0be7fd4ef3f\":{\"port\":\"6379\",\"host\":\"198.51.100.8\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:942dd83468ad984a\":{\"port\":6379,\"host\":\"198.51.100.9\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:10a931455444b1df\":{\"port\":\"6379\",\"host\":\"198.51.100.10\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:10baada62c3b2267\":{\"port\":6379,\"host\":\"198.51.100.8\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:c79c815b1d4b96e4\":{\"port\":\"6379\",\"host\":\"198.51.100.11\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:9af67e250eb281e4\":{\"port\":\"6379\",\"host\":\"198.51.100.12\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:1a388803ca6ffe11\":{\"port\":\"6379\",\"host\":\"198.51.100.13\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:d27ca5eb438a61f2\":{\"port\":6379,\"host\":\"198.51.100.14\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:e5ab3c5461018809\":{\"port\":\"6379\",\"host\":\"198.51.100.14\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:8da7c81a4e861345\":{\"port\":6379,\"host\":\"198.51.100.15\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:58834decc2ba3d\":{\"port\":\"6379\",\"host\":\"198.51.100.16\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:7aade5a8c38adeb1\":{\"port\":\"6379\",\"host\":\"198.51.100.15\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:e3b90f3e43924517\":{\"port\":\"6379\",\"host\":\"198.51.100.17\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:b3deaaed9a2ad761\":{\"port\":6379,\"host\":\"198.51.100.13\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:7110b07926056253\":{\"port\":6379,\"host\":\"198.51.100.18\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:9aefd7d3e29077ea\":{\"port\":\"6379\",\"host\":\"198.51.100.19\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:b8f5331710244154\":{\"port\":6379,\"host\":\"198.51.100.10\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:c7c8ece6b488cb56\":{\"port\":\"6379\",\"host\":\"198.51.100.9\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:8d8905b56566799b\":{\"port\":\"6379\",\"host\":\"198.51.100.7\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:bafceef4140d9995\":{\"port\":6379,\"host\":\"198.51.100.12\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:8d7f6192cd5df736\":{\"port\":6379,\"host\":\"198.51.100.19\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:8ed3a1e948696016\":{\"port\":6379,\"host\":\"198.51.100.11\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:98717c627b2963a5\":{\"port\":6379,\"host\":\"198.51.100.17\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:b0710ee4ef42e154\":{\"port\":\"6379\",\"host\":\"198.51.100.18\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:cf46da301ec66a78\":{\"port\":6379,\"host\":\"198.51.100.16\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000012\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]}},\"new_value\":{\"redisdb:eb864352a1a2db64\":{\"port\":6379,\"host\":\"198.51.100.20\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000013\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:63b93638503dbd2\":{\"port\":\"6379\",\"host\":\"198.51.100.20\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000013\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:34c6bec2c01cd159\":{\"port\":\"6379\",\"host\":\"198.51.100.21\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000013\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]},\"redisdb:f27d25c1da45af54\":{\"port\":6379,\"host\":\"198.51.100.21\",\"tags\":[\"image_id:********@sha256:a030024d2b65447fba04de1e3b440226d78dfe6e4fbc8ab0ca9a44ca6eed0acd\",\"image_name:us-central1-docker.pkg.dev/example-production/hub/redis\",\"image_tag:7.0.12\",\"kube_container_name:redis\",\"kube_job:integration-test-cloud-00000000-0000-4000-8000-000000000013\",\"kube_namespace:default\",\"kube_ownerref_kind:job\",\"kube_qos:Burstable\",\"pod_phase:running\",\"short_image:redis\"]}}},\"uuid\":\"id-000065\",\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:12.112Z\"},\"_id\":\"id-000066\",\"source\":\"audit\",\"message\":\"Integration redis modified on host\",\"status\":\"info\",\"tags\":[\"is_previewable_event:true\",\"source:audit\"]}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "name": "example-host" + }, + "log": { + "level": "info" + } + }, + { + "@timestamp": "2026-07-31T19:23:36.163Z", + "datadog": { + "action": "queried", + "actor": { + "type": "USER" + }, + "asset": { + "new_value": { + "query": { + "from_ts": "1785524711288", + "limit": 100, + "search": "(@asset.id:21072431 AND @asset.type:monitor AND NOT @action:resolved) OR (@asset.id:21072431 AND @asset.type:monitor AND @action:resolved ) OR (@asset.id:\"monitor:21072431\" AND @asset.type:restriction_policy)", + "time_range": 1104445, + "to_ts": "1785525815733" + }, + "query_source": "monitor_ui", + "query_type": "list" + }, + "type": "query" + }, + "auth_method": "SESSION", + "event": { + "name": "Audit Trail", + "uuid": "id-000070" + }, + "http": { + "level": "info" + }, + "metadata": { + "dd": { + "request_id": "id-000067" + }, + "org_id": 100069, + "track": "audit", + "user_id": 100068, + "user_uuid": "00000000-0000-4000-8000-000000000014" + }, + "org": { + "id": 100069 + }, + "request_id": "id-000067", + "source": { + "as": { + "domain": "example.net", + "route": "198.51.100.23/24", + "type": "hosting" + } + }, + "tags": [ + "source:audit" + ], + "threat_intel": { + "indicators_matched": [ + "IP" + ], + "results": [ + { + "additional_data": { + "as": { + "number": 64496, + "organization": "Example ISP" + }, + "client": { + "count": 7, + "types": [ + "DESKTOP", + "MOBILE" + ] + }, + "infrastructure": "DATACENTER", + "location": { + "city": "Seattle", + "country": "US", + "state": "Washington" + }, + "organization": "Example ISP", + "tunnels": [ + { + "anonymous": false, + "operator": "EXAMPLE_PROXY", + "type": "PROXY" + } + ] + }, + "category": "corp_vpn", + "indicator": "198.51.100.22", + "intention": "benign", + "source": { + "name": "spur", + "type": "managed", + "url": "https://spur.us" + }, + "type": "IP" + } + ] + }, + "track": "audit", + "user": { + "created": "2024-08-23T20:49:04.000Z" + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "audit_trail_queried", + "category": [ + "api", + "configuration" + ], + "dataset": "datadog.audit", + "id": "id-000071", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:36.163Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Audit Trail\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000067\"},\"user_uuid\":\"00000000-0000-4000-8000-000000000014\",\"user_id\":100068,\"org_id\":100069,\"track\":\"audit\"},\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.22\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":7},\"location\":{\"country\":\"US\",\"city\":\"Seattle\",\"state\":\"Washington\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"uuid\":\"id-000070\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"Washington\",\"iso_code\":\"US-WA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.23/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Seattle\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.22\",\"location\":{\"latitude\":47.60621,\"longitude\":-122.33207}},\"ip\":\"198.51.100.22\"}},\"auth_method\":\"SESSION\",\"usr\":{\"created\":\"2024-08-23T20:49:04Z\",\"name\":\"Example User 02\",\"id\":\"user03@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000014\",\"email\":\"user03@example.com\"},\"action\":\"queried\",\"http\":{\"status_code\":200,\"url_details\":{\"path\":\"/api/v1/logs-analytics/list?type=audit\"},\"method\":\"POST\",\"level\":\"info\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"asset\":{\"type\":\"query\",\"new_value\":{\"query_source\":\"monitor_ui\",\"query\":{\"search\":\"(@asset.id:21072431 AND @asset.type:monitor AND NOT @action:resolved) OR (@asset.id:21072431 AND @asset.type:monitor AND @action:resolved ) OR (@asset.id:\\\"monitor:21072431\\\" AND @asset.type:restriction_policy)\",\"time_range\":1104445,\"to_ts\":\"1785525815733\",\"from_ts\":\"1785524711288\",\"limit\":100},\"query_type\":\"list\"}},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:36.163Z\"},\"_id\":\"id-000071\",\"source\":\"audit\",\"message\":\"user03@example.com successfully queried audit data with query '(@asset.id:21072431 AND @asset.type:monitor AND NOT @action:resolved) OR (@asset.id:21072431 AND @asset.type:monitor AND @action:resolved ) OR (@asset.id:\\\"monitor:21072431\\\" AND @asset.type:restriction_policy)'\",\"status\":\"info\",\"tags\":[\"source:audit\"]}", + "outcome": "success", + "type": [ + "access" + ] + }, + "http": { + "request": { + "method": "POST" + }, + "response": { + "status_code": 200 + } + }, + "log": { + "level": "info" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001", + "name": "Example Corp" + }, + "related": { + "ip": [ + "198.51.100.22" + ], + "user": [ + "user03@example.com", + "100068", + "00000000-0000-4000-8000-000000000014" + ] + }, + "source": { + "as": { + "number": 64496, + "organization": { + "name": "Example ISP" + } + }, + "geo": { + "city_name": "Seattle", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.60621, + "lon": -122.33207 + }, + "region_iso_code": "US-WA", + "region_name": "Washington", + "timezone": "America/Los_Angeles" + }, + "ip": "198.51.100.22" + }, + "url": { + "path": "/api/v1/logs-analytics/list?type=audit" + }, + "user": { + "email": "user03@example.com", + "full_name": "Example User 02", + "id": "00000000-0000-4000-8000-000000000014", + "name": "user03@example.com" + }, + "user_agent": { + "device": { + "name": "Mac" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36", + "os": { + "full": "Mac OS X 10.15.7", + "name": "Mac OS X", + "version": "10.15.7" + }, + "version": "198.51.100.2" + } + }, + { + "@timestamp": "2026-07-31T19:23:49.952Z", + "datadog": { + "action": "queried", + "actor": { + "type": "USER" + }, + "asset": { + "new_value": { + "query": { + "data_access": { + "indexes": [ + "*" + ], + "restriction_queries": [ + { + "query": "NOT(@data.methodName:FetchAuthUserByAPIKey AND @data.key:* AND (NOT @data.key:local-* OR @data.key:local-????????????????????????????????????????))" + } + ] + }, + "from_ts": "1785524911200", + "indexes": [ + "*" + ], + "limit": 50, + "search": "env:prod", + "time_range": 900000, + "to_ts": "1785525811200" + }, + "query_source": "logs_explorer", + "query_type": "list", + "storage": "indexes" + }, + "type": "logs_query" + }, + "auth_method": "SESSION", + "event": { + "name": "Log Management", + "uuid": "id-000074" + }, + "http": { + "level": "info" + }, + "metadata": { + "dd": { + "request_id": "id-000072" + }, + "org_id": 100069, + "track": "logs", + "user_id": 100073, + "user_uuid": "00000000-0000-4000-8000-000000000015" + }, + "org": { + "id": 100069 + }, + "request_id": "id-000072", + "source": { + "as": { + "domain": "example.net", + "route": "198.51.100.25/24", + "type": "hosting" + } + }, + "tags": [ + "source:audit" + ], + "threat_intel": { + "indicators_matched": [ + "IP" + ], + "results": [ + { + "additional_data": { + "as": { + "number": 64496, + "organization": "Example ISP" + }, + "client": { + "count": 7, + "types": [ + "MOBILE", + "DESKTOP" + ] + }, + "infrastructure": "DATACENTER", + "location": { + "city": "Los Angeles", + "country": "US", + "state": "California" + }, + "organization": "Los Angeles, CA", + "tunnels": [ + { + "anonymous": false, + "operator": "EXAMPLE_PROXY", + "type": "PROXY" + } + ] + }, + "category": "corp_vpn", + "indicator": "198.51.100.24", + "intention": "benign", + "source": { + "name": "spur", + "type": "managed", + "url": "https://spur.us" + }, + "type": "IP" + } + ] + }, + "track": "logs", + "user": { + "created": "2026-03-06T16:31:25.000Z" + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "log_management_queried", + "category": [ + "api", + "configuration" + ], + "dataset": "datadog.audit", + "id": "id-000075", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:49.952Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Log Management\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000072\"},\"user_uuid\":\"00000000-0000-4000-8000-000000000015\",\"user_id\":100073,\"org_id\":100069,\"track\":\"logs\"},\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.24\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Los Angeles, CA\",\"client\":{\"types\":[\"MOBILE\",\"DESKTOP\"],\"count\":7},\"location\":{\"country\":\"US\",\"city\":\"Los Angeles\",\"state\":\"California\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"uuid\":\"id-000074\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"California\",\"iso_code\":\"US-CA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.25/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Los Angeles\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.24\",\"location\":{\"latitude\":34.05223,\"longitude\":-118.24368}},\"ip\":\"198.51.100.24\"}},\"auth_method\":\"SESSION\",\"usr\":{\"created\":\"2026-03-06T16:31:25Z\",\"name\":\"Example User 03\",\"id\":\"user04@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000015\",\"email\":\"user04@example.com\"},\"action\":\"queried\",\"http\":{\"status_code\":200,\"url_details\":{\"path\":\"/api/v1/logs-analytics/list?type=logs\"},\"method\":\"POST\",\"level\":\"info\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"asset\":{\"type\":\"logs_query\",\"new_value\":{\"query_source\":\"logs_explorer\",\"query\":{\"search\":\"env:prod\",\"indexes\":[\"*\"],\"time_range\":900000,\"to_ts\":\"1785525811200\",\"from_ts\":\"1785524911200\",\"limit\":50,\"data_access\":{\"indexes\":[\"*\"],\"restriction_queries\":[{\"query\":\"NOT(@data.methodName:FetchAuthUserByAPIKey AND @data.key:* AND (NOT @data.key:local-* OR @data.key:local-????????????????????????????????????????))\"}]}},\"query_type\":\"list\",\"storage\":\"indexes\"}},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:49.952Z\"},\"_id\":\"id-000075\",\"source\":\"audit\",\"message\":\"user04@example.com successfully queried logs data with query 'env:prod'\",\"status\":\"info\",\"tags\":[\"source:audit\"]}", + "outcome": "success", + "type": [ + "access" + ] + }, + "http": { + "request": { + "method": "POST" + }, + "response": { + "status_code": 200 + } + }, + "log": { + "level": "info" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001", + "name": "Example Corp" + }, + "related": { + "ip": [ + "198.51.100.24" + ], + "user": [ + "user04@example.com", + "100073", + "00000000-0000-4000-8000-000000000015" + ] + }, + "source": { + "as": { + "number": 64496, + "organization": { + "name": "Example ISP" + } + }, + "geo": { + "city_name": "Los Angeles", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 34.05223, + "lon": -118.24368 + }, + "region_iso_code": "US-CA", + "region_name": "California", + "timezone": "America/Los_Angeles" + }, + "ip": "198.51.100.24" + }, + "url": { + "path": "/api/v1/logs-analytics/list?type=logs" + }, + "user": { + "email": "user04@example.com", + "full_name": "Example User 03", + "id": "00000000-0000-4000-8000-000000000015", + "name": "user04@example.com" + }, + "user_agent": { + "device": { + "name": "Mac" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36", + "os": { + "full": "Mac OS X 10.15.7", + "name": "Mac OS X", + "version": "10.15.7" + }, + "version": "198.51.100.2" + } + }, + { + "@timestamp": "2026-07-31T19:23:56.275Z", + "datadog": { + "action": "authorized", + "actor": { + "type": "USER" + }, + "auth_method": "SESSION", + "event": { + "name": "Request", + "uuid": "id-000076" + }, + "mcp_call": false, + "notable_event": false, + "previewable_event": false, + "source": { + "as": { + "domain": "example.net", + "route": "198.51.100.27/24", + "type": "hosting" + } + }, + "tags": [ + "is_previewable_event:false", + "is_notable_event:false", + "is_mcp_call:false", + "source:audit" + ], + "threat_intel": { + "indicators_matched": [ + "IP" + ], + "results": [ + { + "additional_data": { + "as": { + "number": 64496, + "organization": "Example ISP" + }, + "client": { + "concentration": { + "city": "Buffalo", + "country": "US", + "density": 1, + "geohash": "dpxuj2", + "skew": 731, + "state": "New York" + }, + "count": 11, + "countries": 1, + "types": [ + "DESKTOP", + "MOBILE" + ] + }, + "infrastructure": "DATACENTER", + "location": { + "city": "Chicago", + "country": "US", + "state": "Illinois" + }, + "organization": "Example ISP", + "tunnels": [ + { + "anonymous": false, + "operator": "EXAMPLE_PROXY", + "type": "PROXY" + } + ] + }, + "category": "corp_vpn", + "indicator": "198.51.100.26", + "intention": "benign", + "source": { + "name": "spur", + "type": "managed", + "url": "https://spur.us" + }, + "type": "IP" + } + ] + }, + "user": { + "created": "2024-08-23T20:49:03.000Z" + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "request_authorized", + "category": [ + "api", + "web" + ], + "dataset": "datadog.audit", + "id": "id-000077", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:56.275Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Request\"},\"auth_method\":\"SESSION\",\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"created\":\"2024-08-23T20:49:03.000Z\",\"name\":\"Example User 04\",\"id\":\"user05@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000016\",\"email\":\"user05@example.com\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.26\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":11,\"concentration\":{\"country\":\"US\",\"density\":1,\"city\":\"Buffalo\",\"geohash\":\"dpxuj2\",\"state\":\"New York\",\"skew\":731},\"countries\":1},\"location\":{\"country\":\"US\",\"city\":\"Chicago\",\"state\":\"Illinois\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"http\":{\"url_details\":{\"path\":\"/api/v0/synthetics/tests/pdj-nxa-4jc/status\",\"host\":\"us5.prod.dog\"},\"status_code\":200,\"method\":\"GET\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"action\":\"authorized\",\"uuid\":\"id-000076\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"Illinois\",\"iso_code\":\"US-IL\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.27/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Chicago\"},\"timezone\":\"America/Chicago\",\"ipAddress\":\"198.51.100.26\",\"location\":{\"latitude\":41.85003,\"longitude\":-87.65005}},\"ip\":\"198.51.100.26\"}},\"timestamp\":\"2026-07-31T19:23:56.275Z\",\"status\":\"info\"},\"_id\":\"id-000077\",\"source\":\"audit\",\"message\":\"user05@example.com was authorized to perform view on resource synthetics-test (pdj-nxa-4jc)\",\"status\":\"info\",\"tags\":[\"is_previewable_event:false\",\"is_notable_event:false\",\"is_mcp_call:false\",\"source:audit\"]}", + "outcome": "success", + "type": [ + "access" + ] + }, + "http": { + "request": { + "method": "GET" + }, + "response": { + "status_code": 200 + } + }, + "log": { + "level": "info" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001", + "name": "Example Corp" + }, + "related": { + "hosts": [ + "us5.prod.dog" + ], + "ip": [ + "198.51.100.26" + ], + "user": [ + "user05@example.com" + ] + }, + "source": { + "as": { + "number": 64496, + "organization": { + "name": "Example ISP" + } + }, + "geo": { + "city_name": "Chicago", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 41.85003, + "lon": -87.65005 + }, + "region_iso_code": "US-IL", + "region_name": "Illinois", + "timezone": "America/Chicago" + }, + "ip": "198.51.100.26" + }, + "url": { + "domain": "us5.prod.dog", + "full": "https://us5.prod.dog/api/v0/synthetics/tests/pdj-nxa-4jc/status", + "path": "/api/v0/synthetics/tests/pdj-nxa-4jc/status" + }, + "user": { + "email": "user05@example.com", + "full_name": "Example User 04", + "id": "00000000-0000-4000-8000-000000000016", + "name": "user05@example.com" + }, + "user_agent": { + "device": { + "name": "Mac" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36", + "os": { + "full": "Mac OS X 10.15.7", + "name": "Mac OS X", + "version": "10.15.7" + }, + "version": "198.51.100.2" + } + }, + { + "@timestamp": "2026-07-31T19:23:59.886Z", + "datadog": { + "action": "accessed", + "actor": { + "type": "USER" + }, + "asset": { + "id": "id-000078", + "name": "domain_allowlist", + "type": "email_domain_allowlist" + }, + "auth_method": "SESSION", + "event": { + "name": "Organization Management", + "uuid": "id-000079" + }, + "mcp_call": false, + "notable_event": false, + "previewable_event": false, + "source": { + "as": { + "domain": "example.net", + "route": "198.51.100.3/24", + "type": "hosting" + } + }, + "tags": [ + "is_previewable_event:false", + "is_notable_event:false", + "is_mcp_call:false", + "source:audit" + ], + "threat_intel": { + "indicators_matched": [ + "IP" + ], + "results": [ + { + "additional_data": { + "as": { + "number": 64496, + "organization": "Example ISP" + }, + "client": { + "concentration": { + "city": "Sun Lakes", + "country": "US", + "density": 1, + "geohash": "9tbmnn", + "skew": 596, + "state": "Arizona" + }, + "count": 4, + "countries": 1, + "types": [ + "DESKTOP", + "MOBILE" + ] + }, + "infrastructure": "DATACENTER", + "location": { + "city": "Los Angeles", + "country": "US", + "state": "California" + }, + "organization": "Example ISP", + "tunnels": [ + { + "anonymous": false, + "operator": "EXAMPLE_PROXY", + "type": "PROXY" + } + ] + }, + "category": "corp_vpn", + "indicator": "198.51.100.1", + "intention": "benign", + "source": { + "name": "spur", + "type": "managed", + "url": "https://spur.us" + }, + "type": "IP" + } + ] + }, + "user": { + "created": "2026-06-20T18:46:11.000Z" + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "organization_management_accessed", + "category": [ + "api", + "web", + "configuration", + "iam" + ], + "dataset": "datadog.audit", + "id": "id-000080", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:59.886Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Organization Management\"},\"auth_method\":\"SESSION\",\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"created\":\"2026-06-20T18:46:11.000Z\",\"name\":\"Example User 05\",\"id\":\"user01@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000002\",\"email\":\"user01@example.com\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.1\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":4,\"concentration\":{\"country\":\"US\",\"density\":1,\"city\":\"Sun Lakes\",\"geohash\":\"9tbmnn\",\"state\":\"Arizona\",\"skew\":596},\"countries\":1},\"location\":{\"country\":\"US\",\"city\":\"Los Angeles\",\"state\":\"California\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"http\":{\"url_details\":{\"path\":\"/api/v2/domain_allowlist\",\"host\":\"us5.prod.dog\"},\"status_code\":200,\"method\":\"GET\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"action\":\"accessed\",\"asset\":{\"name\":\"domain_allowlist\",\"id\":\"id-000078\",\"type\":\"email_domain_allowlist\"},\"uuid\":\"id-000079\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"California\",\"iso_code\":\"US-CA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.3/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Los Angeles\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.1\",\"location\":{\"latitude\":34.05223,\"longitude\":-118.24368}},\"ip\":\"198.51.100.1\"}},\"timestamp\":\"2026-07-31T19:23:59.886Z\",\"status\":\"info\"},\"_id\":\"id-000080\",\"source\":\"audit\",\"message\":\"user01@example.com viewed domain allowlist\",\"status\":\"info\",\"tags\":[\"is_previewable_event:false\",\"is_notable_event:false\",\"is_mcp_call:false\",\"source:audit\"]}", + "outcome": "success", + "type": [ + "access" + ] + }, + "http": { + "request": { + "method": "GET" + }, + "response": { + "status_code": 200 + } + }, + "log": { + "level": "info" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001", + "name": "Example Corp" + }, + "related": { + "hosts": [ + "us5.prod.dog" + ], + "ip": [ + "198.51.100.1" + ], + "user": [ + "user01@example.com" + ] + }, + "source": { + "as": { + "number": 64496, + "organization": { + "name": "Example ISP" + } + }, + "geo": { + "city_name": "Los Angeles", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 34.05223, + "lon": -118.24368 + }, + "region_iso_code": "US-CA", + "region_name": "California", + "timezone": "America/Los_Angeles" + }, + "ip": "198.51.100.1" + }, + "url": { + "domain": "us5.prod.dog", + "full": "https://us5.prod.dog/api/v2/domain_allowlist", + "path": "/api/v2/domain_allowlist" + }, + "user": { + "email": "user01@example.com", + "full_name": "Example User 05", + "id": "00000000-0000-4000-8000-000000000002", + "name": "user01@example.com" + }, + "user_agent": { + "device": { + "name": "Mac" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36", + "os": { + "full": "Mac OS X 10.15.7", + "name": "Mac OS X", + "version": "10.15.7" + }, + "version": "198.51.100.2" + } + }, + { + "@timestamp": "2026-07-31T19:23:48.520Z", + "datadog": { + "action": "executed", + "actor": { + "type": "USER" + }, + "asset": { + "type": "mcp" + }, + "auth_method": "OAUTH_TOKEN", + "client": { + "name": "cursor-vscode", + "version": "1.0.0" + }, + "event": { + "name": "MCP Server", + "uuid": "id-000083" + }, + "http": { + "level": "info" + }, + "mcp": { + "request_id": "100082" + }, + "mcp_call": true, + "metadata": { + "client": { + "name": "cursor-vscode", + "version": "1.0.0" + }, + "dd": { + "request_id": "id-000081" + }, + "mcp": { + "request_id": 100082 + }, + "oauth_client": { + "name": "Cursor", + "uuid": "00000000-0000-4000-8000-000000000017" + } + }, + "oauth_client": { + "id": "00000000-0000-4000-8000-000000000017", + "name": "Cursor" + }, + "request_id": "id-000081", + "source": { + "as": { + "domain": "example.net", + "route": "198.51.100.25/24", + "type": "hosting" + } + }, + "tags": [ + "is_mcp_call:true", + "source:audit" + ], + "threat_intel": { + "indicators_matched": [ + "IP" + ], + "results": [ + { + "additional_data": { + "as": { + "number": 64496, + "organization": "Example ISP" + }, + "client": { + "concentration": { + "city": "Waldon", + "country": "US", + "density": 1, + "geohash": "9q9pz0", + "skew": 550, + "state": "California" + }, + "count": 7, + "countries": 1, + "types": [ + "DESKTOP", + "MOBILE" + ] + }, + "infrastructure": "DATACENTER", + "location": { + "city": "Los Angeles", + "country": "US", + "state": "California" + }, + "organization": "Los Angeles, CA", + "tunnels": [ + { + "anonymous": false, + "operator": "EXAMPLE_PROXY", + "type": "PROXY" + } + ] + }, + "category": "corp_vpn", + "indicator": "198.51.100.28", + "intention": "benign", + "source": { + "name": "spur", + "type": "managed", + "url": "https://spur.us" + }, + "type": "IP" + } + ] + }, + "user": { + "created": "2024-08-23T20:49:04.000Z" + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "mcp_server_executed", + "category": [ + "api", + "configuration" + ], + "dataset": "datadog.audit", + "id": "id-000084", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:48.520Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"MCP Server\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000081\"},\"client\":{\"name\":\"cursor-vscode\",\"version\":\"1.0.0\"},\"mcp\":{\"request_id\":100082},\"oauth_client\":{\"name\":\"Cursor\",\"uuid\":\"00000000-0000-4000-8000-000000000017\"}},\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.28\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Los Angeles, CA\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":7,\"concentration\":{\"country\":\"US\",\"density\":1,\"city\":\"Waldon\",\"geohash\":\"9q9pz0\",\"state\":\"California\",\"skew\":550},\"countries\":1},\"location\":{\"country\":\"US\",\"city\":\"Los Angeles\",\"state\":\"California\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"uuid\":\"id-000083\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"California\",\"iso_code\":\"US-CA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.25/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Los Angeles\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.28\",\"location\":{\"latitude\":34.05223,\"longitude\":-118.24368}},\"ip\":\"198.51.100.28\"}},\"auth_method\":\"OAUTH_TOKEN\",\"usr\":{\"created\":\"2024-08-23T20:49:04Z\",\"name\":\"Example User 06\",\"id\":\"user06@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000018\",\"email\":\"user06@example.com\"},\"action\":\"executed\",\"http\":{\"status_code\":200,\"url_details\":{\"path\":\"/v1/mcp?toolsets=core,visualizations\"},\"method\":\"POST\",\"level\":\"info\",\"useragent\":\"Cursor/3.14.7 (darwin arm64)\"},\"asset\":{\"type\":\"mcp\"},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:48.52Z\"},\"_id\":\"id-000084\",\"source\":\"audit\",\"message\":\"user06@example.com initialized a connection\",\"status\":\"info\",\"tags\":[\"is_mcp_call:true\",\"source:audit\"]}", + "outcome": "success", + "type": [ + "access" + ] + }, + "http": { + "request": { + "method": "POST" + }, + "response": { + "status_code": 200 + } + }, + "log": { + "level": "info" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001", + "name": "Example Corp" + }, + "related": { + "ip": [ + "198.51.100.28" + ], + "user": [ + "user06@example.com", + "Cursor" + ] + }, + "source": { + "as": { + "number": 64496, + "organization": { + "name": "Example ISP" + } + }, + "geo": { + "city_name": "Los Angeles", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 34.05223, + "lon": -118.24368 + }, + "region_iso_code": "US-CA", + "region_name": "California", + "timezone": "America/Los_Angeles" + }, + "ip": "198.51.100.28" + }, + "url": { + "path": "/v1/mcp?toolsets=core,visualizations" + }, + "user": { + "email": "user06@example.com", + "full_name": "Example User 06", + "id": "00000000-0000-4000-8000-000000000018", + "name": "user06@example.com" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Other", + "original": "Cursor/3.14.7 (darwin arm64)" + } + }, + { + "@timestamp": "2026-07-31T19:23:58.350Z", + "datadog": { + "action": "executed", + "actor": { + "type": "SYSTEM" + }, + "asset": { + "id": "id-000086", + "name": "Workflow \"MI - EKS IAM role policy count anomaly emitter\" from schedule", + "path": "/workflow/00000000-0000-4000-8000-000000000019?instance=00000000-0000-4000-8000-000000000020", + "type": "workflow" + }, + "auth_method": "SYSTEM", + "event": { + "name": "Workflows", + "uuid": "id-000090" + }, + "metadata": { + "created_at": "2026-05-12T21:26:01.389503Z", + "created_at_unix": 1778621161, + "creation_source": "user08", + "dd": { + "request_id": "id-000085" + }, + "instance_id": "id-000087", + "run_as_user": { + "id": "id-000089", + "is_service_account": true, + "name": "Terraform Workspaces" + }, + "run_as_user_mode": "owner", + "source": { + "manual": false, + "schedule_id": "id-000088", + "scheduled_to_run_at": "2026-07-31T19:23:56Z", + "source_type": "schedule" + }, + "status": "published", + "trigger_payload_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "workflow_id": "id-000086", + "workflow_name": "MI - EKS IAM role policy count anomaly emitter" + }, + "request_id": "id-000085", + "run_as_user": { + "id": "id-000089", + "is_service_account": true, + "name": "Terraform Workspaces" + }, + "tags": [ + "source:audit" + ], + "workflow": { + "id": "id-000086", + "instance_id": "id-000087", + "name": "MI - EKS IAM role policy count anomaly emitter" + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "workflows_executed", + "category": [ + "api", + "configuration" + ], + "dataset": "datadog.audit", + "id": "id-000091", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:58.350Z\",\"attributes\":{\"auth_method\":\"SYSTEM\",\"evt\":{\"actor\":{\"type\":\"SYSTEM\"},\"name\":\"Workflows\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000085\"},\"run_as_user_mode\":\"owner\",\"workflow_id\":\"id-000086\",\"instance_id\":\"id-000087\",\"workflow_name\":\"MI - EKS IAM role policy count anomaly emitter\",\"creation_source\":\"user08\",\"created_at\":\"2026-05-12T21:26:01.389503Z\",\"created_at_unix\":1778621161,\"source\":{\"scheduled_to_run_at\":\"2026-07-31T19:23:56Z\",\"source_type\":\"schedule\",\"manual\":false,\"schedule_id\":\"id-000088\"},\"trigger_payload_hash\":\"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a\",\"run_as_user\":{\"is_service_account\":true,\"name\":\"Terraform Workspaces\",\"id\":\"id-000089\"},\"status\":\"published\"},\"action\":\"executed\",\"asset\":{\"path\":\"/workflow/00000000-0000-4000-8000-000000000019?instance=00000000-0000-4000-8000-000000000020\",\"name\":\"Workflow \\\"MI - EKS IAM role policy count anomaly emitter\\\" from schedule\",\"id\":\"id-000086\",\"type\":\"workflow\"},\"uuid\":\"id-000090\",\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:58.35Z\"},\"_id\":\"id-000091\",\"source\":\"audit\",\"message\":\"launched workflow \\\"MI - EKS IAM role policy count anomaly emitter\\\"\",\"status\":\"info\",\"tags\":[\"source:audit\"]}", + "outcome": "success", + "type": [ + "access" + ] + }, + "log": { + "level": "info" + }, + "related": { + "user": [ + "id-000089", + "Terraform Workspaces" + ] + } + }, + { + "@timestamp": "2026-07-31T19:33:03.620Z", + "datadog": { + "action": "created", + "actor": { + "type": "USER" + }, + "asset": { + "id": "tool:submit_remediations@2026-07-31T19:33:03Z", + "name": "submit_remediations", + "new_value": { + "datadog_product_name": "", + "duration_ms": 0, + "executor_uuid": "00000000-0000-4000-8000-000000000014", + "initiator_uuid": "00000000-0000-4000-8000-000000000014", + "result_status": "success", + "run_origin": "execution_source_regular", + "source": "bits-copilot", + "started_at": "2026-07-31T19:33:03Z", + "tool_name": "submit_remediations" + }, + "type": "tool_call" + }, + "auth_method": "SESSION", + "event": { + "name": "Bits AI SRE", + "uuid": "id-000093" + }, + "metadata": { + "dd": { + "request_id": "id-000092" + } + }, + "request_id": "id-000092", + "tags": [ + "source:audit" + ], + "user": { + "created": "2024-08-23T20:49:04.000Z" + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "bits_ai_sre_created", + "category": [ + "api", + "configuration" + ], + "dataset": "datadog.audit", + "id": "id-000094", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:33:03.620Z\",\"attributes\":{\"auth_method\":\"SESSION\",\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Bits AI SRE\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000092\"}},\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"created\":\"2024-08-23T20:49:04Z\",\"name\":\"Example User 02\",\"id\":\"user03@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000014\",\"email\":\"user03@example.com\"},\"action\":\"created\",\"asset\":{\"name\":\"submit_remediations\",\"id\":\"tool:submit_remediations@2026-07-31T19:33:03Z\",\"type\":\"tool_call\",\"new_value\":{\"duration_ms\":0,\"tool_name\":\"submit_remediations\",\"executor_uuid\":\"00000000-0000-4000-8000-000000000014\",\"run_origin\":\"execution_source_regular\",\"datadog_product_name\":\"\",\"result_status\":\"success\",\"started_at\":\"2026-07-31T19:33:03Z\",\"source\":\"bits-copilot\",\"initiator_uuid\":\"00000000-0000-4000-8000-000000000014\"}},\"uuid\":\"id-000093\",\"status\":\"info\",\"timestamp\":\"2026-07-31T19:33:03.62Z\"},\"_id\":\"id-000094\",\"source\":\"audit\",\"message\":\"user03@example.com successfully created tool_call \\\"submit_remediations\\\"\",\"status\":\"info\",\"tags\":[\"source:audit\"]}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "log": { + "level": "info" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001", + "name": "Example Corp" + }, + "related": { + "user": [ + "user03@example.com" + ] + }, + "user": { + "email": "user03@example.com", + "full_name": "Example User 02", + "id": "00000000-0000-4000-8000-000000000014", + "name": "user03@example.com" + } + }, + { + "@timestamp": "2026-07-31T19:33:18.108Z", + "datadog": { + "action": "completed", + "action_name": "listWorkspaces", + "actor": { + "type": "SYSTEM" + }, + "asset": { + "id": "id-000097", + "name": "action task com.datadoghq.slack.listWorkspaces", + "type": "action_platform_task" + }, + "auth_method": "SYSTEM", + "bundle_id": "id-000095", + "event": { + "name": "Bits AI SRE", + "uuid": "id-000098" + }, + "fqn": "com.datadoghq.slack.listWorkspaces", + "metadata": { + "action_client": "BITS_SRE", + "action_name": "listWorkspaces", + "actions_client": "BITS_SRE", + "bundle_id": "id-000095", + "dd": { + "request_id": "id-000092" + }, + "fqn": "com.datadoghq.slack.listWorkspaces", + "result_hash": "5334519f7311840e1e0e226684de9dabea20ec6b704af4ba4dfe243dcc87b87b", + "session_id": "id-000096" + }, + "request_id": "id-000092", + "session_id": "id-000096", + "tags": [ + "source:audit" + ] + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "bits_ai_sre_completed", + "category": [ + "api", + "configuration" + ], + "dataset": "datadog.audit", + "id": "id-000099", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:33:18.108Z\",\"attributes\":{\"auth_method\":\"SYSTEM\",\"evt\":{\"actor\":{\"type\":\"SYSTEM\"},\"name\":\"Bits AI SRE\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000092\"},\"fqn\":\"com.datadoghq.slack.listWorkspaces\",\"actions_client\":\"BITS_SRE\",\"action_name\":\"listWorkspaces\",\"bundle_id\":\"id-000095\",\"result_hash\":\"5334519f7311840e1e0e226684de9dabea20ec6b704af4ba4dfe243dcc87b87b\",\"session_id\":\"id-000096\",\"action_client\":\"BITS_SRE\"},\"action\":\"completed\",\"asset\":{\"name\":\"action task com.datadoghq.slack.listWorkspaces\",\"id\":\"id-000097\",\"type\":\"action_platform_task\"},\"uuid\":\"id-000098\",\"status\":\"info\",\"timestamp\":\"2026-07-31T19:33:18.108Z\"},\"_id\":\"id-000099\",\"source\":\"audit\",\"message\":\"successfully completed action task com.datadoghq.slack.listWorkspaces 00000000-0000-4000-8000-000000000021\",\"status\":\"info\",\"tags\":[\"source:audit\"]}", + "outcome": "success", + "type": [ + "end" + ] + }, + "log": { + "level": "info" + } + }, + { + "@timestamp": "2026-07-31T19:20:36.235Z", + "datadog": { + "action": "modified", + "actor": { + "type": "USER" + }, + "asset": { + "id": "id-000101", + "name": "[Sandboxes] Canary Success Rate is Low", + "new_value": { + "created": "2026-04-13T20:12:59.254963+00:00", + "draft_status": "published", + "id": 100102, + "message": "{{#is_alert}}\n🔴 Sandbox canary failure rate is high — success rate: {{value}} (threshold: {{threshold}})\n\n**Cluster:** example-evals-poc-cluster\n\n**Namespace:** aviato-system\n\n**CronJob:** sandbox-canary\n\n**Investigation Steps**:\n1. Check the [Sandbox Ops Review dashboard](/dashboard/wpr-nk5-my7) for related metrics\n2. Check recent pod logs: Find the job via `kubectl get jobs -n aviato-system | grep sandbox-canary` and check the logs with`kubectl logs -n aviato-system -l job-name= --tail=50`\n3. Errors are logged to DD. Filter with `service:sandbox-canary status:error`.\n\n{{/is_alert}}\n\n{{#is_no_data}}\n⚠️ Sandbox canary has stopped reporting data. Investigate whether the canary process is running.\n{{/is_no_data}}\n\n{{#is_recovery}}\n✅ Sandbox canary has recovered.\n{{/is_recovery}}\n\n@example-alerts", + "modified": "2026-07-31T19:20:36.209920+00:00", + "multi": false, + "name": "[Sandboxes] Canary Success Rate is Low", + "options": { + "escalation_message": "", + "include_tags": true, + "new_host_delay": 300, + "notification_preset_name": "show_all", + "notify_audit": false, + "on_missing_data": "show_and_notify_no_data", + "renotify_interval": 0, + "thresholds": { + "critical": 0.68, + "critical_recovery": 0.9, + "warning": 0.81, + "warning_recovery": 0.95 + } + }, + "overall_state": "No Data", + "query": "avg(last_15m):avg:sandbox.canary.success{canary_type:basic} < 0.68", + "type": "query alert" + }, + "prev_value": { + "created": "2026-04-13T20:12:59.254963+00:00", + "draft_status": "published", + "id": 100102, + "message": "{{#is_alert}}\n🔴 Sandbox canary failure rate is high — success rate: {{value}} (threshold: {{threshold}})\n\n**Cluster:** example-evals-poc-cluster\n\n**Namespace:** aviato-system\n\n**CronJob:** sandbox-canary\n\n**Investigation Steps**:\n1. Check the [Sandbox Ops Review dashboard](/dashboard/wpr-nk5-my7) for related metrics\n2. Check recent pod logs: Find the job via `kubectl get jobs -n aviato-system | grep sandbox-canary` and check the logs with`kubectl logs -n aviato-system -l job-name= --tail=50`\n3. Errors are logged to DD. Filter with `service:sandbox-canary status:error`.\n\n{{/is_alert}}\n\n{{#is_no_data}}\n⚠️ Sandbox canary has stopped reporting data. Investigate whether the canary process is running.\n{{/is_no_data}}\n\n{{#is_recovery}}\n✅ Sandbox canary has recovered.\n{{/is_recovery}}\n\n@example-alerts\n@user13@example.com", + "modified": "2026-06-04T00:02:51.091493+00:00", + "multi": false, + "name": "[Sandboxes] Canary Success Rate is Low", + "options": { + "escalation_message": "", + "include_tags": true, + "new_host_delay": 300, + "notification_preset_name": "show_all", + "notify_audit": false, + "on_missing_data": "show_and_notify_no_data", + "renotify_interval": 0, + "thresholds": { + "critical": 0.68, + "critical_recovery": 0.9, + "warning": 0.81, + "warning_recovery": 0.95 + } + }, + "overall_state": "No Data", + "query": "avg(last_15m):avg:sandbox.canary.success{canary_type:basic} < 0.68", + "type": "query alert" + }, + "type": "monitor" + }, + "auth_method": "SESSION", + "event": { + "name": "Monitor", + "uuid": "id-000100" + }, + "mcp_call": false, + "notable_event": false, + "previewable_event": true, + "source": { + "as": { + "domain": "example.net", + "route": "198.51.100.6/24", + "type": "hosting" + } + }, + "tags": [ + "is_notable_event:false", + "is_mcp_call:false", + "is_previewable_event:true", + "source:audit" + ], + "threat_intel": { + "indicators_matched": [ + "IP" + ], + "results": [ + { + "additional_data": { + "as": { + "number": 64496, + "organization": "Example ISP" + }, + "client": { + "count": 8, + "types": [ + "DESKTOP", + "MOBILE" + ] + }, + "infrastructure": "DATACENTER", + "location": { + "city": "San Jose", + "country": "US", + "state": "California" + }, + "organization": "Example ISP", + "tunnels": [ + { + "anonymous": false, + "operator": "EXAMPLE_PROXY", + "type": "PROXY" + } + ] + }, + "category": "corp_vpn", + "indicator": "198.51.100.29", + "intention": "benign", + "source": { + "name": "spur", + "type": "managed", + "url": "https://spur.us" + }, + "type": "IP" + } + ] + }, + "user": { + "created": "2024-10-07T16:54:06.000Z" + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "monitor_modified", + "category": [ + "api", + "web", + "configuration" + ], + "dataset": "datadog.audit", + "id": "id-000103", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:20:36.235Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Monitor\"},\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.29\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":8},\"location\":{\"country\":\"US\",\"city\":\"San Jose\",\"state\":\"California\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"uuid\":\"id-000100\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"California\",\"iso_code\":\"US-CA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.6/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"San Francisco\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.29\",\"location\":{\"latitude\":37.77493,\"longitude\":-122.41942}},\"ip\":\"198.51.100.29\"}},\"tags\":[\"canary_type:basic\",\"monitor_id:19123273\",\"origin:UI\"],\"auth_method\":\"SESSION\",\"usr\":{\"created\":\"2024-10-07T16:54:06.000Z\",\"name\":\"Example User 07\",\"id\":\"user07@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000022\",\"email\":\"user07@example.com\"},\"http\":{\"url_details\":{\"path\":\"/api/v1/monitor/19123273\",\"host\":\"us5.prod.dog\"},\"status_code\":200,\"method\":\"PUT\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.5 Safari/537.36\"},\"action\":\"modified\",\"asset\":{\"name\":\"[Sandboxes] Canary Success Rate is Low\",\"id\":\"id-000101\",\"type\":\"monitor\",\"prev_value\":{\"created\":\"2026-04-13T20:12:59.254963+00:00\",\"query\":\"avg(last_15m):avg:sandbox.canary.success{canary_type:basic} < 0.68\",\"name\":\"[Sandboxes] Canary Success Rate is Low\",\"options\":{\"thresholds\":{\"critical\":0.68,\"warning\":0.81,\"warning_recovery\":0.95,\"critical_recovery\":0.9},\"renotify_interval\":0,\"on_missing_data\":\"show_and_notify_no_data\",\"new_host_delay\":300,\"notification_preset_name\":\"show_all\",\"include_tags\":true,\"escalation_message\":\"\",\"notify_audit\":false},\"modified\":\"2026-06-04T00:02:51.091493+00:00\",\"overall_state\":\"No Data\",\"draft_status\":\"published\",\"id\":100102,\"type\":\"query alert\",\"message\":\"{{#is_alert}}\\n\\ud83d\\udd34 Sandbox canary failure rate is high \\u2014 success rate: {{value}} (threshold: {{threshold}})\\n\\n**Cluster:** example-evals-poc-cluster\\n\\n**Namespace:** aviato-system\\n\\n**CronJob:** sandbox-canary\\n\\n**Investigation Steps**:\\n1. Check the [Sandbox Ops Review dashboard](/dashboard/wpr-nk5-my7) for related metrics\\n2. Check recent pod logs: Find the job via `kubectl get jobs -n aviato-system | grep sandbox-canary` and check the logs with`kubectl logs -n aviato-system -l job-name= --tail=50`\\n3. Errors are logged to DD. Filter with `service:sandbox-canary status:error`.\\n\\n{{/is_alert}}\\n\\n{{#is_no_data}}\\n\\u26a0\\ufe0f Sandbox canary has stopped reporting data. Investigate whether the canary process is running.\\n{{/is_no_data}}\\n\\n{{#is_recovery}}\\n\\u2705 Sandbox canary has recovered.\\n{{/is_recovery}}\\n\\n@example-alerts\\n@user13@example.com\",\"multi\":false},\"new_value\":{\"created\":\"2026-04-13T20:12:59.254963+00:00\",\"query\":\"avg(last_15m):avg:sandbox.canary.success{canary_type:basic} < 0.68\",\"name\":\"[Sandboxes] Canary Success Rate is Low\",\"options\":{\"thresholds\":{\"critical\":0.68,\"warning\":0.81,\"warning_recovery\":0.95,\"critical_recovery\":0.9},\"renotify_interval\":0,\"on_missing_data\":\"show_and_notify_no_data\",\"new_host_delay\":300,\"notification_preset_name\":\"show_all\",\"include_tags\":true,\"escalation_message\":\"\",\"notify_audit\":false},\"modified\":\"2026-07-31T19:20:36.209920+00:00\",\"overall_state\":\"No Data\",\"draft_status\":\"published\",\"id\":100102,\"type\":\"query alert\",\"message\":\"{{#is_alert}}\\n\\ud83d\\udd34 Sandbox canary failure rate is high \\u2014 success rate: {{value}} (threshold: {{threshold}})\\n\\n**Cluster:** example-evals-poc-cluster\\n\\n**Namespace:** aviato-system\\n\\n**CronJob:** sandbox-canary\\n\\n**Investigation Steps**:\\n1. Check the [Sandbox Ops Review dashboard](/dashboard/wpr-nk5-my7) for related metrics\\n2. Check recent pod logs: Find the job via `kubectl get jobs -n aviato-system | grep sandbox-canary` and check the logs with`kubectl logs -n aviato-system -l job-name= --tail=50`\\n3. Errors are logged to DD. Filter with `service:sandbox-canary status:error`.\\n\\n{{/is_alert}}\\n\\n{{#is_no_data}}\\n\\u26a0\\ufe0f Sandbox canary has stopped reporting data. Investigate whether the canary process is running.\\n{{/is_no_data}}\\n\\n{{#is_recovery}}\\n\\u2705 Sandbox canary has recovered.\\n{{/is_recovery}}\\n\\n@example-alerts\",\"multi\":false}},\"timestamp\":\"2026-07-31T19:20:36.235Z\",\"status\":\"info\"},\"_id\":\"id-000103\",\"source\":\"audit\",\"message\":\"user07@example.com successfully modified monitor \\\"[Sandboxes] Canary Success Rate is Low\\\"\",\"status\":\"info\",\"tags\":[\"is_notable_event:false\",\"is_mcp_call:false\",\"is_previewable_event:true\",\"source:audit\"]}", + "outcome": "success", + "type": [ + "change" + ] + }, + "http": { + "request": { + "method": "PUT" + }, + "response": { + "status_code": 200 + } + }, + "log": { + "level": "info" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001", + "name": "Example Corp" + }, + "related": { + "hosts": [ + "us5.prod.dog" + ], + "ip": [ + "198.51.100.29" + ], + "user": [ + "user07@example.com" + ] + }, + "source": { + "as": { + "number": 64496, + "organization": { + "name": "Example ISP" + } + }, + "geo": { + "city_name": "San Francisco", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 37.77493, + "lon": -122.41942 + }, + "region_iso_code": "US-CA", + "region_name": "California", + "timezone": "America/Los_Angeles" + }, + "ip": "198.51.100.29" + }, + "url": { + "domain": "us5.prod.dog", + "full": "https://us5.prod.dog/api/v1/monitor/19123273", + "path": "/api/v1/monitor/19123273" + }, + "user": { + "email": "user07@example.com", + "full_name": "Example User 07", + "id": "00000000-0000-4000-8000-000000000022", + "name": "user07@example.com" + }, + "user_agent": { + "device": { + "name": "Mac" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.5 Safari/537.36", + "os": { + "full": "Mac OS X 10.15.7", + "name": "Mac OS X", + "version": "10.15.7" + }, + "version": "198.51.100.5" + } + }, + { + "@timestamp": "2026-07-31T19:22:35.940Z", + "datadog": { + "action": "created", + "actor": { + "type": "USER" + }, + "asset": { + "type": "project" + }, + "auth_method": "SESSION", + "event": { + "name": "Case Management", + "uuid": "id-000105" + }, + "http": { + "level": "error" + }, + "metadata": { + "dd": { + "request_id": "id-000104" + } + }, + "request_id": "id-000104", + "source": { + "as": { + "domain": "example.net", + "route": "198.51.100.23/24", + "type": "hosting" + } + }, + "tags": [ + "source:audit" + ], + "threat_intel": { + "indicators_matched": [ + "IP" + ], + "results": [ + { + "additional_data": { + "as": { + "number": 64496, + "organization": "Example ISP" + }, + "client": { + "count": 7, + "types": [ + "DESKTOP", + "MOBILE" + ] + }, + "infrastructure": "DATACENTER", + "location": { + "city": "Seattle", + "country": "US", + "state": "Washington" + }, + "organization": "Example ISP", + "tunnels": [ + { + "anonymous": false, + "operator": "EXAMPLE_PROXY", + "type": "PROXY" + } + ] + }, + "category": "corp_vpn", + "indicator": "198.51.100.22", + "intention": "benign", + "source": { + "name": "spur", + "type": "managed", + "url": "https://spur.us" + }, + "type": "IP" + } + ] + }, + "user": { + "created": "2024-08-23T20:49:04.000Z" + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "case_management_created", + "category": [ + "api", + "configuration" + ], + "dataset": "datadog.audit", + "id": "id-000106", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:22:35.940Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Case Management\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000104\"}},\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.22\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":7},\"location\":{\"country\":\"US\",\"city\":\"Seattle\",\"state\":\"Washington\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"uuid\":\"id-000105\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"Washington\",\"iso_code\":\"US-WA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.23/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Seattle\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.22\",\"location\":{\"latitude\":47.60621,\"longitude\":-122.33207}},\"ip\":\"198.51.100.22\"}},\"auth_method\":\"SESSION\",\"usr\":{\"created\":\"2024-08-23T20:49:04Z\",\"name\":\"Example User 02\",\"id\":\"user03@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000014\",\"email\":\"user03@example.com\"},\"action\":\"created\",\"http\":{\"status_code\":500,\"url_details\":{\"path\":\"/api/v2/cases/projects\"},\"method\":\"POST\",\"level\":\"error\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"asset\":{\"type\":\"project\"},\"status\":\"error\",\"timestamp\":\"2026-07-31T19:22:35.94Z\"},\"_id\":\"id-000106\",\"source\":\"audit\",\"message\":\"user03@example.com failed to create project \\\"\\\"\",\"status\":\"error\",\"tags\":[\"source:audit\"]}", + "outcome": "failure", + "type": [ + "creation" + ] + }, + "http": { + "request": { + "method": "POST" + }, + "response": { + "status_code": 500 + } + }, + "log": { + "level": "error" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001", + "name": "Example Corp" + }, + "related": { + "ip": [ + "198.51.100.22" + ], + "user": [ + "user03@example.com" + ] + }, + "source": { + "as": { + "number": 64496, + "organization": { + "name": "Example ISP" + } + }, + "geo": { + "city_name": "Seattle", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.60621, + "lon": -122.33207 + }, + "region_iso_code": "US-WA", + "region_name": "Washington", + "timezone": "America/Los_Angeles" + }, + "ip": "198.51.100.22" + }, + "url": { + "path": "/api/v2/cases/projects" + }, + "user": { + "email": "user03@example.com", + "full_name": "Example User 02", + "id": "00000000-0000-4000-8000-000000000014", + "name": "user03@example.com" + }, + "user_agent": { + "device": { + "name": "Mac" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36", + "os": { + "full": "Mac OS X 10.15.7", + "name": "Mac OS X", + "version": "10.15.7" + }, + "version": "198.51.100.2" + } + }, + { + "@timestamp": "2026-07-31T19:28:41.881Z", + "datadog": { + "action": "started", + "actor": { + "type": "USER" + }, + "asset": { + "id": "id-000096", + "name": "investigation:00000000-0000-4000-8000-000000000023", + "new_value": { + "event_id": "id-000107", + "event_ts": "2026-07-31T19:19:11Z", + "executor_uuid": "00000000-0000-4000-8000-000000000014", + "initiator_uuid": "00000000-0000-4000-8000-000000000014", + "investigation_uuid": "00000000-0000-4000-8000-000000000023", + "monitor_id": 100108 + }, + "type": "investigation" + }, + "auth_method": "SESSION", + "event": { + "name": "Bits AI SRE", + "uuid": "id-000109" + }, + "metadata": { + "dd": { + "request_id": "id-000092" + } + }, + "request_id": "id-000092", + "tags": [ + "source:audit" + ], + "user": { + "created": "2024-08-23T20:49:04.000Z" + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "bits_ai_sre_started", + "category": [ + "api", + "configuration" + ], + "dataset": "datadog.audit", + "id": "id-000110", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:28:41.881Z\",\"attributes\":{\"auth_method\":\"SESSION\",\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Bits AI SRE\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000092\"}},\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"created\":\"2024-08-23T20:49:04Z\",\"name\":\"Example User 02\",\"id\":\"user03@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000014\",\"email\":\"user03@example.com\"},\"action\":\"started\",\"asset\":{\"name\":\"investigation:00000000-0000-4000-8000-000000000023\",\"id\":\"id-000096\",\"type\":\"investigation\",\"new_value\":{\"executor_uuid\":\"00000000-0000-4000-8000-000000000014\",\"event_id\":\"id-000107\",\"monitor_id\":100108,\"investigation_uuid\":\"00000000-0000-4000-8000-000000000023\",\"event_ts\":\"2026-07-31T19:19:11Z\",\"initiator_uuid\":\"00000000-0000-4000-8000-000000000014\"}},\"uuid\":\"id-000109\",\"status\":\"info\",\"timestamp\":\"2026-07-31T19:28:41.881Z\"},\"_id\":\"id-000110\",\"source\":\"audit\",\"message\":\"user03@example.com successfully started investigation \\\"investigation:00000000-0000-4000-8000-000000000023\\\"\",\"status\":\"info\",\"tags\":[\"source:audit\"]}", + "outcome": "success", + "type": [ + "start" + ] + }, + "log": { + "level": "info" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001", + "name": "Example Corp" + }, + "related": { + "user": [ + "user03@example.com" + ] + }, + "user": { + "email": "user03@example.com", + "full_name": "Example User 02", + "id": "00000000-0000-4000-8000-000000000014", + "name": "user03@example.com" + } + }, + { + "@timestamp": "2026-07-31T19:23:18.758Z", + "datadog": { + "action": "accessed", + "actor": { + "type": "SERVICE_ACCOUNT" + }, + "api_key": { + "id": "id-000111" + }, + "application_key": { + "id": "id-000112" + }, + "auth_method": "API_AND_APP_KEY", + "emitted_source": "edge", + "event": { + "name": "Request" + }, + "metadata": { + "api_key": { + "id": "id-000111" + }, + "application_key": { + "id": "id-000112" + } + }, + "route": { + "path": "/api/v2/query/scalar" + }, + "source": { + "as": { + "domain": "google.com", + "route": "198.51.100.30/16", + "type": "hosting" + } + }, + "tags": [ + "source:audit" + ] + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "request_accessed", + "category": [ + "api", + "web" + ], + "dataset": "datadog.audit", + "id": "id-000113", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:18.758Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"SERVICE_ACCOUNT\"},\"name\":\"Request\"},\"metadata\":{\"api_key\":{\"id\":\"id-000111\"},\"application_key\":{\"id\":\"id-000112\"}},\"auth_method\":\"API_AND_APP_KEY\",\"route\":{\"path\":\"/api/v2/query/scalar\"},\"org\":{\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"id\":\"id-000089\",\"uuid\":\"00000000-0000-4000-8000-000000000024\",\"email\":\"user08@example.com\"},\"action\":\"accessed\",\"http\":{\"status_code\":200,\"url_details\":{\"path\":\"/api/v2/query/scalar\",\"host\":\"api.us5.datadoghq.com\"},\"method\":\"POST\",\"useragent\":\"Go-http-client/2.0\"},\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"Iowa\",\"iso_code\":\"US-IA\"},\"as\":{\"number\":\"AS396982\",\"route\":\"198.51.100.30/16\",\"domain\":\"google.com\",\"name\":\"Example Cloud\",\"type\":\"hosting\"},\"city\":{\"name\":\"Council Bluffs\"},\"timezone\":\"America/Chicago\",\"ipAddress\":\"198.51.100.31\",\"location\":{\"latitude\":41.26194,\"longitude\":-95.86083}},\"ip\":\"198.51.100.31\"}},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:18.758Z\",\"emitted_source\":\"edge\"},\"_id\":\"id-000113\",\"source\":\"audit\",\"message\":\"POST request made to /api/v2/query/scalar by user08@example.com with response 200\",\"status\":\"info\",\"tags\":[\"source:audit\"]}", + "outcome": "success", + "type": [ + "access" + ] + }, + "http": { + "request": { + "method": "POST" + }, + "response": { + "status_code": 200 + } + }, + "log": { + "level": "info" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001" + }, + "related": { + "hosts": [ + "api.us5.datadoghq.com" + ], + "ip": [ + "198.51.100.31" + ], + "user": [ + "id-000089", + "user08@example.com", + "id-000111", + "id-000112" + ] + }, + "source": { + "as": { + "number": 396982, + "organization": { + "name": "Example Cloud" + } + }, + "geo": { + "city_name": "Council Bluffs", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 41.26194, + "lon": -95.86083 + }, + "region_iso_code": "US-IA", + "region_name": "Iowa", + "timezone": "America/Chicago" + }, + "ip": "198.51.100.31" + }, + "url": { + "domain": "api.us5.datadoghq.com", + "full": "https://api.us5.datadoghq.com/api/v2/query/scalar", + "path": "/api/v2/query/scalar" + }, + "user": { + "email": "user08@example.com", + "id": "00000000-0000-4000-8000-000000000024", + "name": "id-000089" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Go-http-client", + "original": "Go-http-client/2.0", + "version": "2.0" + } + }, + { + "@timestamp": "2026-07-31T19:23:26.859Z", + "datadog": { + "action": "accessed", + "actor": { + "type": "USER" + }, + "auth_method": "SESSION", + "emitted_source": "edge", + "event": { + "name": "Request" + }, + "route": { + "path": "/api/ui/frontend_telemetry/metrics" + }, + "source": { + "as": { + "domain": "example.net", + "route": "198.51.100.23/24", + "type": "hosting" + } + }, + "tags": [ + "source:audit" + ], + "threat_intel": { + "indicators_matched": [ + "IP" + ], + "results": [ + { + "additional_data": { + "as": { + "number": 64496, + "organization": "Example ISP" + }, + "client": { + "concentration": { + "city": "Seattle", + "country": "US", + "density": 0.5, + "geohash": "c23nb7", + "skew": 1, + "state": "Washington" + }, + "count": 27, + "countries": 1, + "types": [ + "MOBILE", + "DESKTOP" + ] + }, + "infrastructure": "DATACENTER", + "location": { + "city": "Seattle", + "country": "US", + "state": "Washington" + }, + "organization": "Example ISP", + "tunnels": [ + { + "anonymous": false, + "operator": "EXAMPLE_PROXY", + "type": "PROXY" + } + ] + }, + "category": "corp_vpn", + "indicator": "198.51.100.32", + "intention": "benign", + "source": { + "name": "spur", + "type": "managed", + "url": "https://spur.us" + }, + "type": "IP" + } + ] + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "request_accessed", + "category": [ + "api", + "web" + ], + "dataset": "datadog.audit", + "id": "id-000114", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:26.859Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Request\"},\"auth_method\":\"SESSION\",\"route\":{\"path\":\"/api/ui/frontend_telemetry/metrics\"},\"org\":{\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"id\":\"user09@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000025\",\"email\":\"user09@example.com\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.32\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"MOBILE\",\"DESKTOP\"],\"count\":27,\"concentration\":{\"country\":\"US\",\"density\":0.5,\"city\":\"Seattle\",\"geohash\":\"c23nb7\",\"state\":\"Washington\",\"skew\":1},\"countries\":1},\"location\":{\"country\":\"US\",\"city\":\"Seattle\",\"state\":\"Washington\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"action\":\"accessed\",\"http\":{\"status_code\":202,\"url_details\":{\"path\":\"/api/ui/frontend_telemetry/metrics\",\"host\":\"us5.datadoghq.com\"},\"method\":\"POST\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"Washington\",\"iso_code\":\"US-WA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.23/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Seattle\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.32\",\"location\":{\"latitude\":47.60621,\"longitude\":-122.33207}},\"ip\":\"198.51.100.32\"}},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:26.859Z\",\"emitted_source\":\"edge\"},\"_id\":\"id-000114\",\"source\":\"audit\",\"message\":\"POST request made to /api/ui/frontend_telemetry/metrics by user09@example.com with response 202\",\"status\":\"info\",\"tags\":[\"source:audit\"]}", + "outcome": "success", + "type": [ + "access" + ] + }, + "http": { + "request": { + "method": "POST" + }, + "response": { + "status_code": 202 + } + }, + "log": { + "level": "info" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001" + }, + "related": { + "hosts": [ + "us5.datadoghq.com" + ], + "ip": [ + "198.51.100.32" + ], + "user": [ + "user09@example.com" + ] + }, + "source": { + "as": { + "number": 64496, + "organization": { + "name": "Example ISP" + } + }, + "geo": { + "city_name": "Seattle", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.60621, + "lon": -122.33207 + }, + "region_iso_code": "US-WA", + "region_name": "Washington", + "timezone": "America/Los_Angeles" + }, + "ip": "198.51.100.32" + }, + "url": { + "domain": "us5.datadoghq.com", + "full": "https://us5.datadoghq.com/api/ui/frontend_telemetry/metrics", + "path": "/api/ui/frontend_telemetry/metrics" + }, + "user": { + "email": "user09@example.com", + "id": "00000000-0000-4000-8000-000000000025", + "name": "user09@example.com" + }, + "user_agent": { + "device": { + "name": "Mac" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36", + "os": { + "full": "Mac OS X 10.15.7", + "name": "Mac OS X", + "version": "10.15.7" + }, + "version": "198.51.100.2" + } + }, + { + "@timestamp": "2026-07-31T19:23:30.772Z", + "datadog": { + "action": "accessed", + "actor": { + "type": "USER" + }, + "auth_method": "SESSION", + "emitted_source": "edge", + "event": { + "name": "Request" + }, + "route": { + "path": "/config" + }, + "source": { + "as": { + "domain": "example.net", + "route": "198.51.100.23/24", + "type": "hosting" + } + }, + "tags": [ + "source:audit" + ], + "threat_intel": { + "indicators_matched": [ + "IP" + ], + "results": [ + { + "additional_data": { + "as": { + "number": 64496, + "organization": "Example ISP" + }, + "client": { + "concentration": { + "city": "Greenwood", + "country": "US", + "density": 1, + "geohash": "c23p1p", + "skew": 9, + "state": "Washington" + }, + "count": 7, + "countries": 1, + "proxies": [ + "MELLOWTEL_PROXY" + ], + "types": [ + "MOBILE", + "DESKTOP" + ] + }, + "infrastructure": "DATACENTER", + "location": { + "city": "Seattle", + "country": "US", + "state": "Washington" + }, + "organization": "Example ISP", + "risks": [ + "CALLBACK_PROXY" + ], + "tunnels": [ + { + "anonymous": false, + "operator": "EXAMPLE_PROXY", + "type": "PROXY" + } + ] + }, + "category": "corp_vpn", + "indicator": "198.51.100.33", + "intention": "benign", + "source": { + "name": "spur", + "type": "managed", + "url": "https://spur.us" + }, + "type": "IP" + } + ] + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "request_accessed", + "category": [ + "api", + "web" + ], + "dataset": "datadog.audit", + "id": "id-000115", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:30.772Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Request\"},\"auth_method\":\"SESSION\",\"route\":{\"path\":\"/config\"},\"org\":{\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"id\":\"user10@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000026\",\"email\":\"user10@example.com\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.33\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"risks\":[\"CALLBACK_PROXY\"],\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"MOBILE\",\"DESKTOP\"],\"count\":7,\"concentration\":{\"country\":\"US\",\"density\":1,\"city\":\"Greenwood\",\"geohash\":\"c23p1p\",\"state\":\"Washington\",\"skew\":9},\"proxies\":[\"MELLOWTEL_PROXY\"],\"countries\":1},\"location\":{\"country\":\"US\",\"city\":\"Seattle\",\"state\":\"Washington\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"action\":\"accessed\",\"http\":{\"status_code\":200,\"url_details\":{\"path\":\"/config\",\"host\":\"us5.datadoghq.com\"},\"method\":\"GET\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"Washington\",\"iso_code\":\"US-WA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.23/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Seattle\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.33\",\"location\":{\"latitude\":47.60621,\"longitude\":-122.33207}},\"ip\":\"198.51.100.33\"}},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:30.772Z\",\"emitted_source\":\"edge\"},\"_id\":\"id-000115\",\"source\":\"audit\",\"message\":\"GET request made to /config by user10@example.com with response 200\",\"status\":\"info\",\"tags\":[\"source:audit\"]}", + "outcome": "success", + "type": [ + "access" + ] + }, + "http": { + "request": { + "method": "GET" + }, + "response": { + "status_code": 200 + } + }, + "log": { + "level": "info" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001" + }, + "related": { + "hosts": [ + "us5.datadoghq.com" + ], + "ip": [ + "198.51.100.33" + ], + "user": [ + "user10@example.com" + ] + }, + "source": { + "as": { + "number": 64496, + "organization": { + "name": "Example ISP" + } + }, + "geo": { + "city_name": "Seattle", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.60621, + "lon": -122.33207 + }, + "region_iso_code": "US-WA", + "region_name": "Washington", + "timezone": "America/Los_Angeles" + }, + "ip": "198.51.100.33" + }, + "url": { + "domain": "us5.datadoghq.com", + "full": "https://us5.datadoghq.com/config", + "path": "/config" + }, + "user": { + "email": "user10@example.com", + "id": "00000000-0000-4000-8000-000000000026", + "name": "user10@example.com" + }, + "user_agent": { + "device": { + "name": "Mac" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36", + "os": { + "full": "Mac OS X 10.15.7", + "name": "Mac OS X", + "version": "10.15.7" + }, + "version": "198.51.100.2" + } + }, + { + "@timestamp": "2026-07-31T19:23:31.813Z", + "datadog": { + "action": "accessed", + "actor": { + "type": "USER" + }, + "auth_method": "SESSION", + "emitted_source": "edge", + "event": { + "name": "Request" + }, + "route": { + "path": "/api/ui/query/scalar" + }, + "source": { + "as": { + "domain": "example.net", + "route": "198.51.100.6/24", + "type": "hosting" + } + }, + "tags": [ + "source:audit" + ], + "threat_intel": { + "indicators_matched": [ + "IP" + ], + "results": [ + { + "additional_data": { + "as": { + "number": 64496, + "organization": "Example ISP" + }, + "client": { + "count": 4, + "types": [ + "DESKTOP", + "MOBILE" + ] + }, + "infrastructure": "DATACENTER", + "location": { + "city": "San Jose", + "country": "US", + "state": "California" + }, + "organization": "Example ISP", + "tunnels": [ + { + "anonymous": false, + "operator": "EXAMPLE_PROXY", + "type": "PROXY" + } + ] + }, + "category": "corp_vpn", + "indicator": "198.51.100.34", + "intention": "benign", + "source": { + "name": "spur", + "type": "managed", + "url": "https://spur.us" + }, + "type": "IP" + } + ] + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "request_accessed", + "category": [ + "api", + "web" + ], + "dataset": "datadog.audit", + "id": "id-000116", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:31.813Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Request\"},\"auth_method\":\"SESSION\",\"route\":{\"path\":\"/api/ui/query/scalar\"},\"org\":{\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"id\":\"user11@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000027\",\"email\":\"user11@example.com\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.34\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":4},\"location\":{\"country\":\"US\",\"city\":\"San Jose\",\"state\":\"California\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"action\":\"accessed\",\"http\":{\"status_code\":0,\"url_details\":{\"path\":\"/api/ui/query/scalar\",\"host\":\"us5.datadoghq.com\"},\"method\":\"POST\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"California\",\"iso_code\":\"US-CA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.6/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"San Francisco\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.34\",\"location\":{\"latitude\":37.77493,\"longitude\":-122.41942}},\"ip\":\"198.51.100.34\"}},\"status\":\"error\",\"timestamp\":\"2026-07-31T19:23:31.813Z\",\"emitted_source\":\"edge\"},\"_id\":\"id-000116\",\"source\":\"audit\",\"message\":\"POST request made to /api/ui/query/scalar by user11@example.com with response 0\",\"status\":\"error\",\"tags\":[\"source:audit\"]}", + "outcome": "failure", + "type": [ + "access", + "error" + ] + }, + "http": { + "request": { + "method": "POST" + }, + "response": { + "status_code": 0 + } + }, + "log": { + "level": "error" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001" + }, + "related": { + "hosts": [ + "us5.datadoghq.com" + ], + "ip": [ + "198.51.100.34" + ], + "user": [ + "user11@example.com" + ] + }, + "source": { + "as": { + "number": 64496, + "organization": { + "name": "Example ISP" + } + }, + "geo": { + "city_name": "San Francisco", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 37.77493, + "lon": -122.41942 + }, + "region_iso_code": "US-CA", + "region_name": "California", + "timezone": "America/Los_Angeles" + }, + "ip": "198.51.100.34" + }, + "url": { + "domain": "us5.datadoghq.com", + "full": "https://us5.datadoghq.com/api/ui/query/scalar", + "path": "/api/ui/query/scalar" + }, + "user": { + "email": "user11@example.com", + "id": "00000000-0000-4000-8000-000000000027", + "name": "user11@example.com" + }, + "user_agent": { + "device": { + "name": "Mac" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36", + "os": { + "full": "Mac OS X 10.15.7", + "name": "Mac OS X", + "version": "10.15.7" + }, + "version": "198.51.100.2" + } + }, + { + "@timestamp": "2026-07-31T19:23:34.938Z", + "datadog": { + "action": "accessed", + "actor": { + "type": "USER" + }, + "auth_method": "OAUTH_TOKEN", + "emitted_source": "edge", + "event": { + "name": "Request" + }, + "metadata": { + "oauth_client": { + "name": "Cursor", + "uuid": "00000000-0000-4000-8000-000000000017" + } + }, + "oauth_client": { + "id": "00000000-0000-4000-8000-000000000017", + "name": "Cursor" + }, + "route": { + "path": "/api/unstable/mcp-server/mcp" + }, + "source": { + "as": { + "domain": "example.net", + "route": "198.51.100.23/24", + "type": "hosting" + } + }, + "tags": [ + "source:audit" + ], + "threat_intel": { + "indicators_matched": [ + "IP" + ], + "results": [ + { + "additional_data": { + "as": { + "number": 64496, + "organization": "Example ISP" + }, + "client": { + "count": 5, + "types": [ + "DESKTOP", + "MOBILE" + ] + }, + "infrastructure": "DATACENTER", + "location": { + "city": "Seattle", + "country": "US", + "state": "Washington" + }, + "organization": "Example ISP", + "tunnels": [ + { + "anonymous": false, + "operator": "EXAMPLE_PROXY", + "type": "PROXY" + } + ] + }, + "category": "corp_vpn", + "indicator": "198.51.100.35", + "intention": "benign", + "source": { + "name": "spur", + "type": "managed", + "url": "https://spur.us" + }, + "type": "IP" + } + ] + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "request_accessed", + "category": [ + "api", + "web" + ], + "dataset": "datadog.audit", + "id": "id-000117", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:34.938Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Request\"},\"metadata\":{\"oauth_client\":{\"name\":\"Cursor\",\"uuid\":\"00000000-0000-4000-8000-000000000017\"}},\"org\":{\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.35\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":5},\"location\":{\"country\":\"US\",\"city\":\"Seattle\",\"state\":\"Washington\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"Washington\",\"iso_code\":\"US-WA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.23/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Seattle\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.35\",\"location\":{\"latitude\":47.60621,\"longitude\":-122.33207}},\"ip\":\"198.51.100.35\"}},\"auth_method\":\"OAUTH_TOKEN\",\"route\":{\"path\":\"/api/unstable/mcp-server/mcp\"},\"usr\":{\"id\":\"user12@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000028\",\"email\":\"user12@example.com\"},\"action\":\"accessed\",\"http\":{\"status_code\":200,\"url_details\":{\"path\":\"/api/unstable/mcp-server/mcp\",\"host\":\"mcp.us5.datadoghq.com\"},\"method\":\"POST\",\"useragent\":\"Cursor/3.9.16 (darwin arm64)\"},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:34.938Z\",\"emitted_source\":\"edge\"},\"_id\":\"id-000117\",\"source\":\"audit\",\"message\":\"POST request made to /api/unstable/mcp-server/mcp by user12@example.com with response 200\",\"status\":\"info\",\"tags\":[\"source:audit\"]}", + "outcome": "success", + "type": [ + "access" + ] + }, + "http": { + "request": { + "method": "POST" + }, + "response": { + "status_code": 200 + } + }, + "log": { + "level": "info" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001" + }, + "related": { + "hosts": [ + "mcp.us5.datadoghq.com" + ], + "ip": [ + "198.51.100.35" + ], + "user": [ + "user12@example.com", + "Cursor" + ] + }, + "source": { + "as": { + "number": 64496, + "organization": { + "name": "Example ISP" + } + }, + "geo": { + "city_name": "Seattle", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.60621, + "lon": -122.33207 + }, + "region_iso_code": "US-WA", + "region_name": "Washington", + "timezone": "America/Los_Angeles" + }, + "ip": "198.51.100.35" + }, + "url": { + "domain": "mcp.us5.datadoghq.com", + "full": "https://mcp.us5.datadoghq.com/api/unstable/mcp-server/mcp", + "path": "/api/unstable/mcp-server/mcp" + }, + "user": { + "email": "user12@example.com", + "id": "00000000-0000-4000-8000-000000000028", + "name": "user12@example.com" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Other", + "original": "Cursor/3.9.16 (darwin arm64)" + } + }, + { + "@timestamp": "2026-07-31T19:23:55.557Z", + "datadog": { + "action": "accessed", + "actor": { + "type": "SERVICE_ACCOUNT" + }, + "api_key": { + "id": "id-000111" + }, + "application_key": { + "id": "id-000112" + }, + "auth_method": "API_AND_APP_KEY", + "emitted_source": "edge", + "event": { + "name": "Request" + }, + "metadata": { + "api_key": { + "id": "id-000111" + }, + "application_key": { + "id": "id-000112" + } + }, + "route": { + "path": "/api/v2/query/scalar" + }, + "source": { + "as": { + "domain": "google.com", + "route": "198.51.100.30/16", + "type": "hosting" + } + }, + "tags": [ + "source:audit" + ] + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "request_accessed", + "category": [ + "api", + "web" + ], + "dataset": "datadog.audit", + "id": "id-000118", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:55.557Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"SERVICE_ACCOUNT\"},\"name\":\"Request\"},\"metadata\":{\"api_key\":{\"id\":\"id-000111\"},\"application_key\":{\"id\":\"id-000112\"}},\"auth_method\":\"API_AND_APP_KEY\",\"route\":{\"path\":\"/api/v2/query/scalar\"},\"org\":{\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"id\":\"id-000089\",\"uuid\":\"00000000-0000-4000-8000-000000000024\",\"email\":\"user08@example.com\"},\"action\":\"accessed\",\"http\":{\"status_code\":400,\"url_details\":{\"path\":\"/api/v2/query/scalar\",\"host\":\"api.us5.datadoghq.com\"},\"method\":\"POST\",\"useragent\":\"Go-http-client/2.0\"},\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"Iowa\",\"iso_code\":\"US-IA\"},\"as\":{\"number\":\"AS396982\",\"route\":\"198.51.100.30/16\",\"domain\":\"google.com\",\"name\":\"Example Cloud\",\"type\":\"hosting\"},\"city\":{\"name\":\"Council Bluffs\"},\"timezone\":\"America/Chicago\",\"ipAddress\":\"198.51.100.31\",\"location\":{\"latitude\":41.26194,\"longitude\":-95.86083}},\"ip\":\"198.51.100.31\"}},\"status\":\"warn\",\"timestamp\":\"2026-07-31T19:23:55.557Z\",\"emitted_source\":\"edge\"},\"_id\":\"id-000118\",\"source\":\"audit\",\"message\":\"POST request made to /api/v2/query/scalar by user08@example.com with response 400\",\"status\":\"warn\",\"tags\":[\"source:audit\"]}", + "outcome": "failure", + "type": [ + "access", + "error" + ] + }, + "http": { + "request": { + "method": "POST" + }, + "response": { + "status_code": 400 + } + }, + "log": { + "level": "warn" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001" + }, + "related": { + "hosts": [ + "api.us5.datadoghq.com" + ], + "ip": [ + "198.51.100.31" + ], + "user": [ + "id-000089", + "user08@example.com", + "id-000111", + "id-000112" + ] + }, + "source": { + "as": { + "number": 396982, + "organization": { + "name": "Example Cloud" + } + }, + "geo": { + "city_name": "Council Bluffs", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 41.26194, + "lon": -95.86083 + }, + "region_iso_code": "US-IA", + "region_name": "Iowa", + "timezone": "America/Chicago" + }, + "ip": "198.51.100.31" + }, + "url": { + "domain": "api.us5.datadoghq.com", + "full": "https://api.us5.datadoghq.com/api/v2/query/scalar", + "path": "/api/v2/query/scalar" + }, + "user": { + "email": "user08@example.com", + "id": "00000000-0000-4000-8000-000000000024", + "name": "id-000089" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Go-http-client", + "original": "Go-http-client/2.0", + "version": "2.0" + } + }, + { + "@timestamp": "2026-07-31T19:22:29.882Z", + "datadog": { + "action": "executed", + "actor": { + "type": "USER" + }, + "asset": { + "type": "mcp" + }, + "auth_method": "OAUTH_TOKEN", + "event": { + "name": "MCP Server", + "uuid": "id-000121" + }, + "http": { + "level": "info" + }, + "mcp": { + "request_id": "mcp-id-000120" + }, + "mcp_call": true, + "metadata": { + "dd": { + "request_id": "id-000119" + }, + "mcp": { + "request_id": "mcp-id-000120" + }, + "oauth_client": { + "name": "Datadog Generic MCP Client", + "uuid": "00000000-0000-4000-8000-000000000029" + }, + "tool": { + "arguments": { + "detailed_output": false, + "from": "1784920005072", + "max_tokens": 12000, + "query": "@type:view @view.name:Workspace @view.loading_type:initial_load @view.url:*nw=* @context.datadogView.was_backgrounded:false env:production @context.entityName:elisa-motta- @view.in_foreground_periods.start:>300000000000", + "to": "1785524805072" + }, + "name": "search_datadog_rum_events" + }, + "usage": { + "duration": 734338771 + } + }, + "oauth_client": { + "id": "00000000-0000-4000-8000-000000000029", + "name": "Datadog Generic MCP Client" + }, + "request_id": "id-000119", + "source": { + "as": { + "domain": "example.net", + "route": "198.51.100.25/24", + "type": "hosting" + } + }, + "tags": [ + "is_mcp_call:true", + "source:audit" + ], + "threat_intel": { + "indicators_matched": [ + "IP" + ], + "results": [ + { + "additional_data": { + "as": { + "number": 64496, + "organization": "Example ISP" + }, + "client": { + "concentration": { + "city": "Waldon", + "country": "US", + "density": 1, + "geohash": "9q9pz0", + "skew": 550, + "state": "California" + }, + "count": 7, + "countries": 1, + "types": [ + "DESKTOP", + "MOBILE" + ] + }, + "infrastructure": "DATACENTER", + "location": { + "city": "Los Angeles", + "country": "US", + "state": "California" + }, + "organization": "Los Angeles, CA", + "tunnels": [ + { + "anonymous": false, + "operator": "EXAMPLE_PROXY", + "type": "PROXY" + } + ] + }, + "category": "corp_vpn", + "indicator": "198.51.100.28", + "intention": "benign", + "source": { + "name": "spur", + "type": "managed", + "url": "https://spur.us" + }, + "type": "IP" + } + ] + }, + "tool": { + "name": "search_datadog_rum_events" + }, + "usage": { + "duration": 734338771 + }, + "user": { + "created": "2024-08-23T20:49:04.000Z" + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "mcp_server_executed", + "category": [ + "api", + "configuration" + ], + "dataset": "datadog.audit", + "id": "id-000122", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:22:29.882Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"MCP Server\"},\"metadata\":{\"dd\":{\"request_id\":\"id-000119\"},\"usage\":{\"duration\":734338771},\"mcp\":{\"request_id\":\"mcp-id-000120\"},\"oauth_client\":{\"name\":\"Datadog Generic MCP Client\",\"uuid\":\"00000000-0000-4000-8000-000000000029\"},\"tool\":{\"name\":\"search_datadog_rum_events\",\"arguments\":{\"detailed_output\":false,\"max_tokens\":12000,\"query\":\"@type:view @view.name:Workspace @view.loading_type:initial_load @view.url:*nw=* @context.datadogView.was_backgrounded:false env:production @context.entityName:elisa-motta- @view.in_foreground_periods.start:>300000000000\",\"from\":\"1784920005072\",\"to\":\"1785524805072\"}}},\"org\":{\"name\":\"Example Corp\",\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.28\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Los Angeles, CA\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":7,\"concentration\":{\"country\":\"US\",\"density\":1,\"city\":\"Waldon\",\"geohash\":\"9q9pz0\",\"state\":\"California\",\"skew\":550},\"countries\":1},\"location\":{\"country\":\"US\",\"city\":\"Los Angeles\",\"state\":\"California\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"uuid\":\"id-000121\",\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"California\",\"iso_code\":\"US-CA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.25/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Los Angeles\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.28\",\"location\":{\"latitude\":34.05223,\"longitude\":-118.24368}},\"ip\":\"198.51.100.28\"}},\"auth_method\":\"OAUTH_TOKEN\",\"usr\":{\"created\":\"2024-08-23T20:49:04Z\",\"name\":\"Example User 06\",\"id\":\"user06@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000018\",\"email\":\"user06@example.com\"},\"action\":\"executed\",\"http\":{\"status_code\":200,\"url_details\":{\"path\":\"/api/unstable/mcp-server/mcp?toolsets=all\"},\"method\":\"POST\",\"level\":\"info\"},\"asset\":{\"type\":\"mcp\"},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:22:29.882Z\"},\"_id\":\"id-000122\",\"source\":\"audit\",\"message\":\"user06@example.com successfully called tool 'search_datadog_rum_events'\",\"status\":\"info\",\"tags\":[\"is_mcp_call:true\",\"source:audit\"]}", + "outcome": "success", + "type": [ + "access" + ] + }, + "http": { + "request": { + "method": "POST" + }, + "response": { + "status_code": 200 + } + }, + "log": { + "level": "info" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001", + "name": "Example Corp" + }, + "related": { + "ip": [ + "198.51.100.28" + ], + "user": [ + "user06@example.com", + "Datadog Generic MCP Client" + ] + }, + "source": { + "as": { + "number": 64496, + "organization": { + "name": "Example ISP" + } + }, + "geo": { + "city_name": "Los Angeles", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 34.05223, + "lon": -118.24368 + }, + "region_iso_code": "US-CA", + "region_name": "California", + "timezone": "America/Los_Angeles" + }, + "ip": "198.51.100.28" + }, + "url": { + "path": "/api/unstable/mcp-server/mcp?toolsets=all" + }, + "user": { + "email": "user06@example.com", + "full_name": "Example User 06", + "id": "00000000-0000-4000-8000-000000000018", + "name": "user06@example.com" + } + } + ] +} diff --git a/packages/datadog/data_stream/audit/agent/stream/aws-s3.yml.hbs b/packages/datadog/data_stream/audit/agent/stream/aws-s3.yml.hbs new file mode 100644 index 00000000000..a07313e1580 --- /dev/null +++ b/packages/datadog/data_stream/audit/agent/stream/aws-s3.yml.hbs @@ -0,0 +1,102 @@ +{{#if bucket_list_prefix}} +bucket_list_prefix: {{bucket_list_prefix}} +{{/if}} +{{#if region}} +region: {{region}} +{{/if}} + +# Collection mode +{{#if collection_mode}} +{{#contains "sqs" collection_mode}} +# SQS Configuration (real-time mode) +{{#if queue_url}} +queue_url: {{queue_url}} +{{/if}} +{{#if visibility_timeout}} +visibility_timeout: {{visibility_timeout}} +{{/if}} +{{#if max_number_of_messages}} +max_number_of_messages: {{max_number_of_messages}} +{{/if}} +{{/contains}} +{{#contains "polling" collection_mode}} +# Polling Configuration (interval mode) +# S3 Bucket Configuration +{{#if bucket_arn}} +bucket_arn: {{bucket_arn}} +{{/if}} +{{#if interval}} +bucket_list_interval: {{bucket_list_interval}} +{{/if}} +{{/contains}} +{{else}} +# Backward-compatible fallback when collection_mode is not present. +{{#if queue_url}} +# SQS Configuration (real-time mode) +queue_url: {{queue_url}} +{{#if visibility_timeout}} +visibility_timeout: {{visibility_timeout}} +{{/if}} +{{#if max_number_of_messages}} +max_number_of_messages: {{max_number_of_messages}} +{{/if}} +{{else}} +# Polling Configuration (interval mode) +{{#if interval}} +bucket_list_interval: {{bucket_list_interval}} +{{/if}} +{{/if}} +{{/if}} + +# AWS Credentials +{{#if access_key_id}} +access_key_id: {{access_key_id}} +{{/if}} +{{#if secret_access_key}} +secret_access_key: {{secret_access_key}} +{{/if}} +{{#if session_token}} +session_token: {{session_token}} +{{/if}} +{{#if role_arn}} +role_arn: {{role_arn}} +{{/if}} + +# File Processing +{{#if file_selectors}} +file_selectors: +{{{file_selectors}}} +{{else}} +file_selectors: + - regex: '.*\.json\.gz$' +{{#if max_bytes}} + max_bytes: {{max_bytes}} +{{/if}} +{{/if}} + +# Performance & Concurrency +{{#if number_of_workers}} +number_of_workers: {{number_of_workers}} +{{/if}} +{{#if api_timeout}} +api_timeout: {{api_timeout}} +{{/if}} +{{#if fips_enabled}} +fips_enabled: {{fips_enabled}} +{{/if}} + +tags: +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} + +processors: +{{#if processors}} +{{processors}} +{{/if}} + +# Disable host enrichment +publisher_pipeline.disable_host: true diff --git a/packages/datadog/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/datadog/data_stream/audit/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..a6d580dd609 --- /dev/null +++ b/packages/datadog/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,805 @@ +--- +description: Pipeline for Datadog audit trail logs (Log Archives via S3/SQS) with ECS mapping +processors: + - json: + field: message + target_field: _dd + tag: json_parse_message + on_failure: + - append: + field: error.message + value: "failed to parse message as JSON: {{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error + + - set: + field: ecs.version + value: "9.4.0" + tag: set_ecs_version + + # event.original is populated agent-side by the .hbs copy_fields block in + # production. Setting it here as well — guarded, so production does not + # double-set — means pipeline tests exercise the real document shape, + # including the `remove: message` in the cleanup block. This mirrors + # cloudsmith, which does the same. + # + # Retention is separately gated: .fleet_final_pipeline-1 strips + # event.original from any document whose tags lack preserve_original_event. + - set: + field: event.original + copy_from: message + if: ctx.event?.original == null && ctx.message != null + tag: event_original_from_message + + # === Timestamp === + # `date` and `attributes.timestamp` are the same instant on every observed + # event; the string mismatches are trailing-zero serialization only + # (.560Z vs .56Z). strict_date_optional_time accepts both precisions. + - date: + field: _dd.date + target_field: '@timestamp' + formats: + - strict_date_optional_time + if: ctx._dd?.date != null + tag: date_from_root + - date: + field: _dd.attributes.timestamp + target_field: '@timestamp' + formats: + - strict_date_optional_time + if: ctx._dd?.attributes?.timestamp != null && ctx['@timestamp'] == null + tag: date_fallback_attributes_timestamp + + # === Event core === + - set: + field: event.kind + value: event + tag: set_event_kind + - set: + field: event.module + value: datadog + tag: set_event_module + - set: + field: event.dataset + value: datadog.audit + tag: set_event_dataset + - set: + field: event.id + copy_from: _dd._id + ignore_empty_value: true + tag: set_event_id + + # event.action = "_", lowercased, non-alphanumerics collapsed + # to a single underscore. Built with lowercase+gsub rather than Painless: + # script.painless.regex.enabled is off by default, so String.replaceAll + # would throw at runtime. + - set: + field: event.action + value: "{{{_dd.attributes.evt.name}}}_{{{_dd.attributes.action}}}" + if: ctx._dd?.attributes?.evt?.name != null && ctx._dd?.attributes?.action != null + tag: event_action_composite + - lowercase: + field: event.action + ignore_missing: true + tag: lowercase_event_action + - gsub: + field: event.action + pattern: '[^a-z0-9]+' + replacement: '_' + ignore_missing: true + tag: gsub_event_action_non_alnum_to_underscore + - gsub: + field: event.action + pattern: '(^_+)|(_+$)' + replacement: '' + ignore_missing: true + tag: gsub_event_action_trim_underscores + + # === Outcome === + # Ordered: vendor status first, then the HTTP override, then the fallback. + - set: + field: event.outcome + value: success + if: ctx._dd?.attributes?.status == 'info' + tag: set_event_outcome_success + - set: + field: event.outcome + value: unknown + if: ctx._dd?.attributes?.status == 'warn' + tag: set_event_outcome_unknown + - set: + field: event.outcome + value: failure + if: ctx._dd?.attributes?.status == 'error' + tag: set_event_outcome_failure + - set: + field: event.outcome + value: failure + if: >- + ctx._dd?.attributes?.http?.status_code instanceof Number && + ctx._dd.attributes.http.status_code >= 400 + tag: outcome_http_error + - set: + field: event.outcome + value: unknown + if: ctx.event?.outcome == null + tag: outcome_fallback + + # === log.level === + # Root `status` is byte-identical to attributes.status on all sampled events. + - set: + field: log.level + copy_from: _dd.status + ignore_empty_value: true + tag: set_log_level + + # === datadog.* scalars === + - set: + field: datadog.event.name + copy_from: _dd.attributes.evt.name + ignore_empty_value: true + tag: set_datadog_event_name + - set: + field: datadog.event.uuid + copy_from: _dd.attributes.uuid + ignore_empty_value: true + tag: set_datadog_event_uuid + - set: + field: datadog.action + copy_from: _dd.attributes.action + ignore_empty_value: true + tag: set_datadog_action + - set: + field: datadog.actor.type + copy_from: _dd.attributes.evt.actor.type + ignore_empty_value: true + tag: set_datadog_actor_type + - set: + field: datadog.auth_method + copy_from: _dd.attributes.auth_method + ignore_empty_value: true + tag: set_datadog_auth_method + - set: + field: datadog.emitted_source + copy_from: _dd.attributes.emitted_source + ignore_empty_value: true + tag: set_datadog_emitted_source + - set: + field: datadog.route.path + copy_from: _dd.attributes.route.path + ignore_empty_value: true + tag: set_datadog_route_path + - set: + field: datadog.http.level + copy_from: _dd.attributes.http.level + ignore_empty_value: true + tag: set_datadog_http_level + + # === Actor and organization === + # Only Datadog's usr object populates ECS user.*. Other actor identities + # remain searchable via related.user below. + - set: + field: user.name + copy_from: _dd.attributes.usr.id + ignore_empty_value: true + tag: set_user_name + - set: + field: user.id + copy_from: _dd.attributes.usr.uuid + ignore_empty_value: true + tag: set_user_id + - set: + field: user.email + copy_from: _dd.attributes.usr.email + ignore_empty_value: true + tag: set_user_email + - set: + field: user.full_name + copy_from: _dd.attributes.usr.name + ignore_empty_value: true + tag: set_user_full_name + - date: + field: _dd.attributes.usr.created + target_field: datadog.user.created + formats: [strict_date_optional_time] + if: ctx._dd?.attributes?.usr?.created != null + ignore_failure: true + tag: date_datadog_user_created + - set: + field: organization.id + copy_from: _dd.attributes.org.uuid + ignore_empty_value: true + tag: set_organization_id + - set: + field: organization.name + copy_from: _dd.attributes.org.name + ignore_empty_value: true + tag: set_organization_name + - set: + field: datadog.org.id + copy_from: _dd.attributes.metadata.org_id + ignore_empty_value: true + tag: set_datadog_org_id + - convert: + field: _dd.attributes.metadata.user_id + target_field: _tmp.metadata_user_id + type: string + ignore_missing: true + tag: convert_tmp_metadata_user_id + - append: + field: related.user + value: "{{{user.name}}}" + allow_duplicates: false + if: ctx.user?.name != null + tag: append_related_user_user_name + - append: + field: related.user + value: "{{{user.email}}}" + allow_duplicates: false + if: ctx.user?.email != null + tag: append_related_user_user_email + - append: + field: related.user + value: "{{{_tmp.metadata_user_id}}}" + allow_duplicates: false + if: ctx._tmp?.metadata_user_id != null + tag: append_related_user_tmp_metadata_user_id + - append: + field: related.user + value: "{{{_dd.attributes.metadata.user_uuid}}}" + allow_duplicates: false + if: ctx._dd?.attributes?.metadata?.user_uuid != null + tag: append_related_user_dd_attributes_metadata_user_uuid + - append: + field: related.user + value: "{{{_dd.attributes.metadata.api_key.id}}}" + allow_duplicates: false + if: ctx._dd?.attributes?.metadata?.api_key?.id != null + tag: append_related_user_dd_attributes_metadata_api_key_id + - append: + field: related.user + value: "{{{_dd.attributes.metadata.application_key.id}}}" + allow_duplicates: false + if: ctx._dd?.attributes?.metadata?.application_key?.id != null + tag: append_related_user_dd_attributes_metadata_application_key_id + - append: + field: related.user + value: "{{{_dd.attributes.metadata.oauth_client.name}}}" + allow_duplicates: false + if: ctx._dd?.attributes?.metadata?.oauth_client?.name != null + tag: append_related_user_dd_attributes_metadata_oauth_client_name + - append: + field: related.user + value: "{{{_dd.attributes.metadata.run_as_user.id}}}" + allow_duplicates: false + if: ctx._dd?.attributes?.metadata?.run_as_user?.id != null + tag: append_related_user_dd_attributes_metadata_run_as_user_id + - append: + field: related.user + value: "{{{_dd.attributes.metadata.run_as_user.name}}}" + allow_duplicates: false + if: ctx._dd?.attributes?.metadata?.run_as_user?.name != null + tag: append_related_user_dd_attributes_metadata_run_as_user_name + + # === HTTP, URL, user-agent, source IP, and geo === + - set: + field: http.request.method + copy_from: _dd.attributes.http.method + ignore_empty_value: true + tag: set_http_request_method + - set: + field: http.response.status_code + copy_from: _dd.attributes.http.status_code + ignore_empty_value: true + tag: set_http_response_status_code + - set: + field: url.domain + copy_from: _dd.attributes.http.url_details.host + ignore_empty_value: true + tag: set_url_domain + - set: + field: url.path + copy_from: _dd.attributes.http.url_details.path + ignore_empty_value: true + tag: set_url_path + - set: + field: url.full + value: "https://{{{_dd.attributes.http.url_details.host}}}{{{_dd.attributes.http.url_details.path}}}" + if: >- + ctx._dd?.attributes?.http?.url_details?.host != null && + ctx._dd?.attributes?.http?.url_details?.path != null + tag: set_url_full + - append: + field: related.hosts + value: "{{{url.domain}}}" + allow_duplicates: false + if: ctx.url?.domain != null + tag: append_related_hosts_url_domain + - set: + field: user_agent.original + copy_from: _dd.attributes.http.useragent + ignore_empty_value: true + tag: set_user_agent_original + - user_agent: + field: user_agent.original + ignore_missing: true + tag: user_agent_user_agent_original + - set: + field: source.ip + copy_from: _dd.attributes.network.client.ip + ignore_empty_value: true + tag: set_source_ip + - append: + field: related.ip + value: "{{{source.ip}}}" + allow_duplicates: false + if: ctx.source?.ip != null + tag: append_related_ip_source_ip + - set: + field: source.geo.city_name + copy_from: _dd.attributes.network.client.geoip.city.name + ignore_empty_value: true + tag: set_source_geo_city_name + - set: + field: source.geo.country_name + copy_from: _dd.attributes.network.client.geoip.country.name + ignore_empty_value: true + tag: set_source_geo_country_name + - set: + field: source.geo.country_iso_code + copy_from: _dd.attributes.network.client.geoip.country.iso_code + ignore_empty_value: true + tag: set_source_geo_country_iso_code + - set: + field: source.geo.region_name + copy_from: _dd.attributes.network.client.geoip.subdivision.name + ignore_empty_value: true + tag: set_source_geo_region_name + - set: + field: source.geo.region_iso_code + copy_from: _dd.attributes.network.client.geoip.subdivision.iso_code + ignore_empty_value: true + tag: set_source_geo_region_iso_code + - set: + field: source.geo.continent_name + copy_from: _dd.attributes.network.client.geoip.continent.name + ignore_empty_value: true + tag: set_source_geo_continent_name + - set: + field: source.geo.continent_code + copy_from: _dd.attributes.network.client.geoip.continent.code + ignore_empty_value: true + tag: set_source_geo_continent_code + - set: + field: source.geo.timezone + copy_from: _dd.attributes.network.client.geoip.timezone + ignore_empty_value: true + tag: set_source_geo_timezone + - set: + field: source.geo.location.lat + copy_from: _dd.attributes.network.client.geoip.location.latitude + ignore_empty_value: true + tag: set_source_geo_location_lat + - set: + field: source.geo.location.lon + copy_from: _dd.attributes.network.client.geoip.location.longitude + ignore_empty_value: true + tag: set_source_geo_location_lon + - set: + field: _tmp.as_number + copy_from: _dd.attributes.network.client.geoip.as.number + ignore_empty_value: true + tag: set_tmp_as_number + - gsub: + field: _tmp.as_number + pattern: '^AS' + replacement: '' + ignore_missing: true + tag: gsub_tmp_as_number + - convert: + field: _tmp.as_number + target_field: source.as.number + type: long + ignore_missing: true + ignore_failure: true + tag: convert_source_as_number + - set: + field: source.as.organization.name + copy_from: _dd.attributes.network.client.geoip.as.name + ignore_empty_value: true + tag: set_source_as_organization_name + - set: + field: datadog.source.as.domain + copy_from: _dd.attributes.network.client.geoip.as.domain + ignore_empty_value: true + tag: set_datadog_source_as_domain + - set: + field: datadog.source.as.route + copy_from: _dd.attributes.network.client.geoip.as.route + ignore_empty_value: true + tag: set_datadog_source_as_route + - set: + field: datadog.source.as.type + copy_from: _dd.attributes.network.client.geoip.as.type + ignore_empty_value: true + tag: set_datadog_source_as_type + + # === ECS categorization === + - append: + field: event.category + value: api + tag: append_event_category_api + - append: + field: event.category + value: web + if: >- + ctx.http?.request?.method != null && + ctx.http?.response?.status_code != null && ctx.url?.full != null + tag: append_event_category_web + - append: + field: event.category + value: configuration + if: >- + ['modified', 'created'].contains(ctx._dd?.attributes?.action) || + ctx._dd?.attributes?.asset?.type != null + tag: append_event_category_configuration + - append: + field: event.category + value: iam + if: >- + ctx.user?.name != null && + (ctx._dd?.attributes?.evt?.name == 'Organization Management' || + ctx._dd?.attributes?.asset?.type == 'email_domain_allowlist') + tag: append_event_category_iam + - append: + field: event.type + value: access + if: "['accessed', 'queried', 'authorized', 'executed'].contains(ctx._dd?.attributes?.action)" + tag: append_event_type_access + - append: + field: event.type + value: change + if: ctx._dd?.attributes?.action == 'modified' + tag: append_event_type_change + - append: + field: event.type + value: creation + if: ctx._dd?.attributes?.action == 'created' + tag: append_event_type_creation + - append: + field: event.type + value: start + if: ctx._dd?.attributes?.action == 'started' + tag: append_event_type_start + - append: + field: event.type + value: end + if: ctx._dd?.attributes?.action == 'completed' + tag: append_event_type_end + - append: + field: event.type + value: error + if: >- + ctx.event?.category instanceof List && ctx.event.category.contains('web') && + ctx.event?.outcome == 'failure' + tag: append_event_type_error + - append: + field: event.type + value: info + if: ctx.event?.type == null + tag: append_event_type_info + + # === Asset and curated metadata === + - set: + field: datadog.asset.id + copy_from: _dd.attributes.asset.id + ignore_empty_value: true + tag: set_datadog_asset_id + - set: + field: datadog.asset.name + copy_from: _dd.attributes.asset.name + ignore_empty_value: true + tag: set_datadog_asset_name + - set: + field: datadog.asset.type + copy_from: _dd.attributes.asset.type + ignore_empty_value: true + tag: set_datadog_asset_type + - set: + field: datadog.asset.path + copy_from: _dd.attributes.asset.path + ignore_empty_value: true + tag: set_datadog_asset_path + - set: + field: datadog.asset.version_uuid + copy_from: _dd.attributes.asset.version_uuid + ignore_empty_value: true + tag: set_datadog_asset_version_uuid + - set: + field: datadog.request_id + copy_from: _dd.attributes.metadata.dd.request_id + ignore_empty_value: true + tag: set_datadog_request_id + - set: + field: datadog.track + copy_from: _dd.attributes.metadata.track + ignore_empty_value: true + tag: set_datadog_track + - set: + field: datadog.session_id + copy_from: _dd.attributes.metadata.session_id + ignore_empty_value: true + tag: set_datadog_session_id + - set: + field: datadog.workflow.id + copy_from: _dd.attributes.metadata.workflow_id + ignore_empty_value: true + tag: set_datadog_workflow_id + - set: + field: datadog.workflow.name + copy_from: _dd.attributes.metadata.workflow_name + ignore_empty_value: true + tag: set_datadog_workflow_name + - set: + field: datadog.workflow.instance_id + copy_from: _dd.attributes.metadata.instance_id + ignore_empty_value: true + tag: set_datadog_workflow_instance_id + - set: + field: datadog.workflow.step_name + copy_from: _dd.attributes.metadata.step_name + ignore_empty_value: true + tag: set_datadog_workflow_step_name + - set: + field: datadog.workflow.step_execution_id + copy_from: _dd.attributes.metadata.step_execution_id + ignore_empty_value: true + tag: set_datadog_workflow_step_execution_id + - set: + field: datadog.workflow.trigger + copy_from: _dd.attributes.metadata.workflow_trigger + ignore_empty_value: true + tag: set_datadog_workflow_trigger + - set: + field: datadog.workflow.parent_id + copy_from: _dd.attributes.metadata.parent_workflow_id + ignore_empty_value: true + tag: set_datadog_workflow_parent_id + - set: + field: datadog.workflow.parent_instance_id + copy_from: _dd.attributes.metadata.parent_workflow_instance_id + ignore_empty_value: true + tag: set_datadog_workflow_parent_instance_id + - gsub: + field: _dd.attributes.metadata.workflow_createdAt + pattern: '^(\d{4}-\d{2}-\d{2}) (\d{2}:\d{2}:\d{2})(\.\d+)? \+0000 \+0000$' + replacement: '$1T$2$3Z' + ignore_missing: true + tag: normalize_workflow_created_at + - date: + field: _dd.attributes.metadata.workflow_createdAt + target_field: datadog.workflow.created_at + formats: + - strict_date_optional_time + if: ctx._dd?.attributes?.metadata?.workflow_createdAt != null + tag: date_workflow_created_at + - set: + field: datadog.agent.version + copy_from: _dd.attributes.metadata.agent_metadata.agent_version + ignore_empty_value: true + tag: set_datadog_agent_version + - set: + field: datadog.agent.flavor + copy_from: _dd.attributes.metadata.agent_metadata.flavor + ignore_empty_value: true + tag: set_datadog_agent_flavor + - set: + field: datadog.agent.install_method_tool + copy_from: _dd.attributes.metadata.agent_metadata.install_method_tool + ignore_empty_value: true + tag: set_datadog_agent_install_method_tool + - set: + field: datadog.agent.remote_updates_enabled + copy_from: _dd.attributes.metadata.agent_metadata.remote_updates_enabled + ignore_empty_value: true + tag: set_datadog_agent_remote_updates_enabled + - set: + field: host.name + copy_from: _dd.attributes.metadata.host_metadata.hostname + ignore_empty_value: true + tag: set_host_name + - set: + field: host.os.full + copy_from: _dd.attributes.metadata.host_metadata.os + ignore_empty_value: true + tag: set_host_os_full + - set: + field: datadog.oauth_client.name + copy_from: _dd.attributes.metadata.oauth_client.name + ignore_empty_value: true + tag: set_datadog_oauth_client_name + - set: + field: datadog.oauth_client.id + copy_from: _dd.attributes.metadata.oauth_client.uuid + ignore_empty_value: true + tag: set_datadog_oauth_client_id + - set: + field: datadog.api_key.id + copy_from: _dd.attributes.metadata.api_key.id + ignore_empty_value: true + tag: set_datadog_api_key_id + - set: + field: datadog.application_key.id + copy_from: _dd.attributes.metadata.application_key.id + ignore_empty_value: true + tag: set_datadog_application_key_id + - set: + field: datadog.client.name + copy_from: _dd.attributes.metadata.client.name + ignore_empty_value: true + tag: set_datadog_client_name + - set: + field: datadog.client.version + copy_from: _dd.attributes.metadata.client.version + ignore_empty_value: true + tag: set_datadog_client_version + - set: + field: datadog.tool.name + copy_from: _dd.attributes.metadata.tool.name + ignore_empty_value: true + tag: set_datadog_tool_name + - convert: + field: _dd.attributes.metadata.mcp.request_id + target_field: datadog.mcp.request_id + type: string + ignore_missing: true + tag: convert_datadog_mcp_request_id + - set: + field: datadog.event_name + copy_from: _dd.attributes.metadata.event_name + ignore_empty_value: true + tag: set_datadog_event_name_dd_attributes_metadata_event_name + - set: + field: datadog.fqn + copy_from: _dd.attributes.metadata.fqn + ignore_empty_value: true + tag: set_datadog_fqn + - set: + field: datadog.integration_name + copy_from: _dd.attributes.metadata.integration_name + ignore_empty_value: true + tag: set_datadog_integration_name + - set: + field: datadog.action_name + copy_from: _dd.attributes.metadata.action_name + ignore_empty_value: true + tag: set_datadog_action_name + - set: + field: datadog.bundle_id + copy_from: _dd.attributes.metadata.bundle_id + ignore_empty_value: true + tag: set_datadog_bundle_id + - set: + field: datadog.configuration_type + copy_from: _dd.attributes.metadata.configuration_type + ignore_empty_value: true + tag: set_datadog_configuration_type + - set: + field: datadog.connection_id + copy_from: _dd.attributes.metadata.connection_id + ignore_empty_value: true + tag: set_datadog_connection_id + - set: + field: datadog.request_endpoint + copy_from: _dd.attributes.metadata.request_endpoint + ignore_empty_value: true + tag: set_datadog_request_endpoint + - set: + field: datadog.usage.duration + copy_from: _dd.attributes.metadata.usage.duration + ignore_empty_value: true + tag: set_datadog_usage_duration + - set: + field: datadog.run_as_user.id + copy_from: _dd.attributes.metadata.run_as_user.id + ignore_empty_value: true + tag: set_datadog_run_as_user_id + - set: + field: datadog.run_as_user.name + copy_from: _dd.attributes.metadata.run_as_user.name + ignore_empty_value: true + tag: set_datadog_run_as_user_name + - set: + field: datadog.run_as_user.is_service_account + copy_from: _dd.attributes.metadata.run_as_user.is_service_account + ignore_empty_value: true + tag: set_datadog_run_as_user_is_service_account + - set: + field: datadog.metadata + copy_from: _dd.attributes.metadata + ignore_empty_value: true + tag: set_datadog_metadata + - set: + field: datadog.asset.new_value + copy_from: _dd.attributes.asset.new_value + ignore_empty_value: true + tag: set_datadog_asset_new_value + - set: + field: datadog.asset.prev_value + copy_from: _dd.attributes.asset.prev_value + ignore_empty_value: true + tag: set_datadog_asset_prev_value + + # === Threat intel === + # results[] and tunnels[] are arrays of objects upstream. Collect their + # scalar dimensions as parallel arrays so they remain aggregatable. + - set: + field: datadog.threat_intel + copy_from: _dd.attributes.threat_intel + ignore_empty_value: true + tag: set_datadog_threat_intel + + # === Source tags and cleanup === + # Preserve source tags under the vendor namespace; ECS tags are agent-owned. + - set: + field: datadog.tags + copy_from: _dd.tags + ignore_empty_value: true + tag: set_datadog_tags + - set: + field: datadog.notable_event + value: true + if: ctx._dd?.tags instanceof List && ctx._dd.tags.contains('is_notable_event:true') + tag: set_datadog_notable_event_true + - set: + field: datadog.notable_event + value: false + if: ctx._dd?.tags instanceof List && ctx._dd.tags.contains('is_notable_event:false') + tag: set_datadog_notable_event_false + - set: + field: datadog.mcp_call + value: true + if: ctx._dd?.tags instanceof List && ctx._dd.tags.contains('is_mcp_call:true') + tag: set_datadog_mcp_call_true + - set: + field: datadog.mcp_call + value: false + if: ctx._dd?.tags instanceof List && ctx._dd.tags.contains('is_mcp_call:false') + tag: set_datadog_mcp_call_false + - set: + field: datadog.previewable_event + value: true + if: ctx._dd?.tags instanceof List && ctx._dd.tags.contains('is_previewable_event:true') + tag: set_datadog_previewable_event_true + - set: + field: datadog.previewable_event + value: false + if: ctx._dd?.tags instanceof List && ctx._dd.tags.contains('is_previewable_event:false') + tag: set_datadog_previewable_event_false + - remove: + field: _dd + ignore_missing: true + tag: remove_dd + - remove: + field: _tmp + ignore_missing: true + tag: remove_tmp + - remove: + field: message + ignore_missing: true + if: ctx.event?.original != null + tag: remove_message + + +on_failure: + - append: + field: error.message + value: "{{{ _ingest.on_failure_processor_type }}}: {{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/packages/datadog/data_stream/audit/fields/base-fields.yml b/packages/datadog/data_stream/audit/fields/base-fields.yml new file mode 100644 index 00000000000..14017be5fb2 --- /dev/null +++ b/packages/datadog/data_stream/audit/fields/base-fields.yml @@ -0,0 +1,8 @@ +- name: data_stream.type + external: ecs +- name: data_stream.dataset + external: ecs +- name: data_stream.namespace + external: ecs +- name: '@timestamp' + external: ecs diff --git a/packages/datadog/data_stream/audit/fields/beats.yml b/packages/datadog/data_stream/audit/fields/beats.yml new file mode 100644 index 00000000000..fc4e0e78c9d --- /dev/null +++ b/packages/datadog/data_stream/audit/fields/beats.yml @@ -0,0 +1,24 @@ +- name: aws.s3 + type: group + fields: + - name: bucket + type: group + fields: + - name: name + type: keyword + description: The AWS S3 bucket name. + - name: arn + type: keyword + description: The AWS S3 bucket ARN. + - name: object + type: group + fields: + - name: key + type: keyword + description: The AWS S3 Object key. +- name: input.type + type: keyword + description: Input type +- name: log.offset + type: long + description: Log offset \ No newline at end of file diff --git a/packages/datadog/data_stream/audit/fields/ecs.yml b/packages/datadog/data_stream/audit/fields/ecs.yml new file mode 100644 index 00000000000..9b4038b0310 --- /dev/null +++ b/packages/datadog/data_stream/audit/fields/ecs.yml @@ -0,0 +1,94 @@ +- name: ecs.version + external: ecs +- name: error.message + external: ecs +- name: event.kind + external: ecs +- name: event.module + external: ecs +- name: event.dataset + external: ecs +- name: event.id + external: ecs +- name: event.category + external: ecs +- name: event.type + external: ecs +- name: event.action + external: ecs +- name: event.outcome + external: ecs +- name: event.original + external: ecs +- name: log.level + external: ecs +- name: organization.id + external: ecs +- name: organization.name + external: ecs +- name: related.hosts + external: ecs +- name: related.ip + external: ecs +- name: related.user + external: ecs +- name: source.ip + external: ecs +- name: source.as.number + external: ecs +- name: source.as.organization.name + external: ecs +- name: source.geo.city_name + external: ecs +- name: source.geo.country_name + external: ecs +- name: source.geo.country_iso_code + external: ecs +- name: source.geo.region_name + external: ecs +- name: source.geo.region_iso_code + external: ecs +- name: source.geo.continent_name + external: ecs +- name: source.geo.continent_code + external: ecs +- name: source.geo.timezone + external: ecs +- name: source.geo.location + external: ecs +- name: url.domain + external: ecs +- name: url.path + external: ecs +- name: url.full + external: ecs +- name: user.id + external: ecs +- name: user.name + external: ecs +- name: user.email + external: ecs +- name: user.full_name + external: ecs +- name: user_agent.original + external: ecs +- name: user_agent.name + external: ecs +- name: user_agent.version + external: ecs +- name: user_agent.os.name + external: ecs +- name: user_agent.os.version + external: ecs +- name: user_agent.os.full + external: ecs +- name: user_agent.device.name + external: ecs +- name: http.request.method + external: ecs +- name: http.response.status_code + external: ecs +- name: host.name + external: ecs +- name: host.os.full + external: ecs diff --git a/packages/datadog/data_stream/audit/fields/fields.yml b/packages/datadog/data_stream/audit/fields/fields.yml new file mode 100644 index 00000000000..79205732162 --- /dev/null +++ b/packages/datadog/data_stream/audit/fields/fields.yml @@ -0,0 +1,188 @@ +- name: datadog + type: group + fields: + - name: action + type: keyword + - name: action_name + type: keyword + - name: api_key + type: group + fields: + - name: id + type: keyword + - name: application_key + type: group + fields: + - name: id + type: keyword + - name: asset + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: type + type: keyword + - name: path + type: keyword + - name: version_uuid + type: keyword + - name: new_value + type: flattened + description: Dynamic Datadog asset snapshot after change. + - name: prev_value + type: flattened + description: Dynamic Datadog asset snapshot before change. + - name: actor + type: group + fields: + - name: type + type: keyword + - name: agent + type: group + fields: + - name: version + type: keyword + - name: flavor + type: keyword + - name: install_method_tool + type: keyword + - name: remote_updates_enabled + type: boolean + - name: auth_method + type: keyword + - name: bundle_id + type: keyword + - name: client + type: group + fields: + - name: name + type: keyword + - name: version + type: keyword + - name: configuration_type + type: keyword + - name: connection_id + type: keyword + - name: emitted_source + type: keyword + - name: event + type: group + fields: + - name: name + type: keyword + - name: uuid + type: keyword + - name: event_name + type: keyword + - name: fqn + type: keyword + - name: http + type: group + fields: + - name: level + type: keyword + - name: integration_name + type: keyword + - name: mcp + type: group + fields: + - name: request_id + type: keyword + - name: mcp_call + type: boolean + - name: metadata + type: flattened + description: Dynamic Datadog metadata blob. + - name: notable_event + type: boolean + - name: oauth_client + type: group + fields: + - name: name + type: keyword + - name: id + type: keyword + - name: org + type: group + fields: + - name: id + type: long + - name: previewable_event + type: boolean + - name: request_endpoint + type: keyword + - name: request_id + type: keyword + - name: route + type: group + fields: + - name: path + type: keyword + - name: run_as_user + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: is_service_account + type: boolean + - name: session_id + type: keyword + - name: source + type: group + fields: + - name: as + type: group + fields: + - name: domain + type: keyword + - name: route + type: keyword + - name: type + type: keyword + - name: tags + type: keyword + - name: threat_intel + type: flattened + description: Flattened threat intel values derived from nested Datadog result objects. + - name: tool + type: group + fields: + - name: name + type: keyword + - name: track + type: keyword + - name: usage + type: group + fields: + - name: duration + type: long + - name: user + type: group + fields: + - name: created + type: date + - name: workflow + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: instance_id + type: keyword + - name: step_name + type: keyword + - name: step_execution_id + type: keyword + - name: trigger + type: keyword + - name: parent_id + type: keyword + - name: parent_instance_id + type: keyword + - name: created_at + type: date diff --git a/packages/datadog/data_stream/audit/manifest.yml b/packages/datadog/data_stream/audit/manifest.yml new file mode 100644 index 00000000000..c9e1b5b7604 --- /dev/null +++ b/packages/datadog/data_stream/audit/manifest.yml @@ -0,0 +1,36 @@ +title: Datadog audit trail logs +type: logs +dataset: datadog.audit +streams: + - input: aws-s3 + title: Datadog audit logs via S3 + description: Collect Datadog audit trail logs from the S3 bucket written by Datadog Log Archives. + template_path: aws-s3.yml.hbs + vars: + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - datadog + - audit + - forwarded + - name: preserve_original_event + type: bool + title: Preserve original event + description: |- + Preserves a raw copy of the original event, added to the field `event.original` + multi: false + required: true + show_user: false + default: true + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. diff --git a/packages/datadog/docs/README.md b/packages/datadog/docs/README.md new file mode 100644 index 00000000000..a2f6c7c784d --- /dev/null +++ b/packages/datadog/docs/README.md @@ -0,0 +1,62 @@ +# Datadog Audit Logs + +Collects the Datadog audit trail from an S3 bucket written by +[Datadog Log Archives](https://docs.datadoghq.com/logs/log_configuration/archives/), +using SQS object-created notifications for near-real-time delivery. + +## Data flow + +1. In Datadog, configure a Logs Archive with the query `source:audit`, targeting + an S3 bucket. Datadog writes gzipped NDJSON objects to a date-partitioned + prefix (`dt=YYYYMMDD/hour=HH/archive_*.json.gz`), one audit event per line. +2. Configure an S3 event notification on that bucket for `s3:ObjectCreated:*`, + delivering to an SQS queue. +3. Point this integration at the bucket ARN and the SQS queue URL. + +If no queue URL is supplied, the integration falls back to polling the bucket on +the configured interval. SQS is strongly preferred — polling re-lists the bucket +on every interval and does not scale with archive volume. + +## Required AWS permissions + +- `s3:GetObject` on the archive prefix +- `s3:ListBucket` on the bucket (polling mode only) +- `sqs:ReceiveMessage`, `sqs:DeleteMessage`, `sqs:GetQueueAttributes` on the queue + +Prefer `role_arn` over static access keys. + +## Data stream + +`datadog.audit` — all audit surfaces (API requests, workflows, agent +configuration changes, dashboards, organization management, MCP server calls, +audit-trail queries) in one stream. + +## Notable fields + +| Field | Description | +|---|---| +| `datadog.event.name` | Datadog product surface (`Request`, `Workflows`, `Dashboard`, …) | +| `datadog.action` | Raw Datadog verb (`accessed`, `modified`, `created`, …) | +| `event.action` | Composite `_`, e.g. `dashboard_modified` | +| `datadog.route.path` | Templated API route — aggregate on this, not `url.path`, which contains IDs | +| `datadog.actor.type` | `USER`, `SYSTEM`, or `SERVICE_ACCOUNT` | +| `datadog.auth_method` | `SESSION`, `SYSTEM`, `API_AND_APP_KEY`, `OAUTH_TOKEN` | +| `datadog.threat_intel.*` | Datadog's Spur-sourced IP enrichment, including VPN/proxy tunnel detail | +| `datadog.asset.new_value` / `.prev_value` | `flattened` before/after blobs for configuration changes | +| `datadog.metadata` | `flattened` catch-all for surface-specific metadata | +| `related.user` | Every actor identifier in the event, including API key and OAuth client IDs | + +`datadog.asset.new_value`, `datadog.asset.prev_value`, `datadog.metadata`, and `datadog.threat_intel` are +`flattened`. They are queryable in KQL and DSL by subkey, but **not** in ES|QL, +which hard-errors on `flattened`. Stable dimensions are lifted into typed +sibling fields for that reason. + +## Dashboard + +![Datadog Audit Logs Dashboard](../img/Datadog_dashboard.png) + +### Audit + +{{event "audit"}} + +{{fields "audit"}} \ No newline at end of file diff --git a/packages/datadog/img/Datadog_Logo.svg b/packages/datadog/img/Datadog_Logo.svg new file mode 100644 index 00000000000..f39a6ac1b0b --- /dev/null +++ b/packages/datadog/img/Datadog_Logo.svg @@ -0,0 +1,41 @@ + + + + + + diff --git a/packages/datadog/img/Datadog_dashboard.png b/packages/datadog/img/Datadog_dashboard.png new file mode 100644 index 00000000000..15bd4a0a2e6 Binary files /dev/null and b/packages/datadog/img/Datadog_dashboard.png differ diff --git a/packages/datadog/kibana/dashboard/datadog-f14d9abf-fd86-4ef1-b0a3-a9881043629c.json b/packages/datadog/kibana/dashboard/datadog-f14d9abf-fd86-4ef1-b0a3-a9881043629c.json new file mode 100644 index 00000000000..eb565f97a5d --- /dev/null +++ b/packages/datadog/kibana/dashboard/datadog-f14d9abf-fd86-4ef1-b0a3-a9881043629c.json @@ -0,0 +1,714 @@ +{ + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "meta": { + "alias": null, + "disabled": false, + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "datadog.audit" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "autoApplyFilters": true, + "hidePanelBorders": false, + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b43ab4bb-efa5-4b73-91b3-febc2496915d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": { + + }, + "datasourceStates": { + "formBased": { + "layers": { + "b43ab4bb-efa5-4b73-91b3-febc2496915d": { + "columnOrder": [ + "b2def797-62d1-4da7-afbe-834c3967d882", + "4fa9c40d-aed2-4c87-8e4e-1d5457c3931c", + "495072ca-260e-492c-b85a-7854a88e87d9" + ], + "columns": { + "495072ca-260e-492c-b85a-7854a88e87d9": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "sourceField": "___records___" + }, + "4fa9c40d-aed2-4c87-8e4e-1d5457c3931c": { + "dataType": "string", + "isBucketed": true, + "label": "Top 9 values of http.request.method", + "operationType": "terms", + "params": { + "exclude": [ + + ], + "excludeIsRegex": false, + "include": [ + + ], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "495072ca-260e-492c-b85a-7854a88e87d9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 9 + }, + "sourceField": "http.request.method" + }, + "b2def797-62d1-4da7-afbe-834c3967d882": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "sourceField": "@timestamp" + } + }, + "incompleteColumns": { + + }, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": { + + } + }, + "textBased": { + "layers": { + + } + } + }, + "filters": [ + + ], + "internalReferences": [ + + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "Linear", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "495072ca-260e-492c-b85a-7854a88e87d9" + ], + "colorMapping": { + "assignments": [ + + ], + "colorMode": { + "type": "categorical" + }, + "paletteId": "default", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rules": [ + { + "type": "other" + } + ], + "touched": false + } + ] + }, + "layerId": "b43ab4bb-efa5-4b73-91b3-febc2496915d", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessors": [ + "4fa9c40d-aed2-4c87-8e4e-1d5457c3931c" + ], + "xAccessor": "b2def797-62d1-4da7-afbe-834c3967d882" + } + ], + "legend": { + "isVisible": true, + "layout": "list", + "position": "bottom" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Top HTTP Methods", + "version": 2, + "visualizationType": "lnsXY" + } + }, + "gridData": { + "h": 21, + "i": "df18f977-1ec4-4162-afc9-25c898314c5f", + "w": 24, + "x": 0, + "y": 11 + }, + "panelIndex": "df18f977-1ec4-4162-afc9-25c898314c5f", + "type": "vis" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-fd4fd860-acb1-4c0a-aeeb-a26ea102ee1a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": { + + }, + "datasourceStates": { + "formBased": { + "layers": { + "fd4fd860-acb1-4c0a-aeeb-a26ea102ee1a": { + "columnOrder": [ + "47a8923a-f93c-4333-bef3-ed95ee6beeee", + "149c00db-1a65-4b9e-a330-37bea74bb57d", + "007ebfda-680e-4f8d-b123-ba316e462bdd" + ], + "columns": { + "007ebfda-680e-4f8d-b123-ba316e462bdd": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "sourceField": "___records___" + }, + "149c00db-1a65-4b9e-a330-37bea74bb57d": { + "dataType": "number", + "isBucketed": true, + "label": "http.response.status_code", + "operationType": "range", + "params": { + "includeEmptyRows": true, + "maxBars": "auto", + "ranges": [ + { + "from": 0, + "label": "", + "to": 1000 + } + ], + "type": "histogram" + }, + "sourceField": "http.response.status_code" + }, + "47a8923a-f93c-4333-bef3-ed95ee6beeee": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "sourceField": "@timestamp" + } + }, + "incompleteColumns": { + + }, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": { + + } + }, + "textBased": { + "layers": { + + } + } + }, + "filters": [ + + ], + "internalReferences": [ + + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "Linear", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "007ebfda-680e-4f8d-b123-ba316e462bdd" + ], + "colorMapping": { + "assignments": [ + + ], + "colorMode": { + "type": "categorical" + }, + "paletteId": "elastic_line_optimized", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rules": [ + { + "type": "other" + } + ], + "touched": false + } + ] + }, + "layerId": "fd4fd860-acb1-4c0a-aeeb-a26ea102ee1a", + "layerType": "data", + "seriesType": "line", + "splitAccessors": [ + "149c00db-1a65-4b9e-a330-37bea74bb57d" + ], + "xAccessor": "47a8923a-f93c-4333-bef3-ed95ee6beeee" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Top HTTP Response Status Codes", + "version": 2, + "visualizationType": "lnsXY" + }, + "drilldowns": [ + + ] + }, + "gridData": { + "h": 20, + "i": "30620a7f-83e3-40f7-8226-c15fd8f0b33f", + "w": 24, + "x": 24, + "y": 11 + }, + "panelIndex": "30620a7f-83e3-40f7-8226-c15fd8f0b33f", + "type": "vis" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-01176e8d-06be-4604-906d-44d2dce4e6fd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": { + + }, + "datasourceStates": { + "formBased": { + "layers": { + "01176e8d-06be-4604-906d-44d2dce4e6fd": { + "columnOrder": [ + "44052788-b051-4fbd-a2b0-da41262deaec", + "84bfee97-bb0e-40ab-a959-471271174f0d", + "d18ad346-787d-4a81-a9fd-39de636b6f18" + ], + "columns": { + "44052788-b051-4fbd-a2b0-da41262deaec": { + "dataType": "string", + "isBucketed": true, + "label": "Top 9 values of datadog.actor.type", + "operationType": "terms", + "params": { + "exclude": [ + + ], + "excludeIsRegex": false, + "include": [ + + ], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d18ad346-787d-4a81-a9fd-39de636b6f18", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 9 + }, + "sourceField": "datadog.actor.type" + }, + "84bfee97-bb0e-40ab-a959-471271174f0d": { + "dataType": "string", + "isBucketed": true, + "label": "Top 9 values of datadog.action", + "operationType": "terms", + "params": { + "exclude": [ + + ], + "excludeIsRegex": false, + "include": [ + + ], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d18ad346-787d-4a81-a9fd-39de636b6f18", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 9 + }, + "sourceField": "datadog.action" + }, + "d18ad346-787d-4a81-a9fd-39de636b6f18": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "sourceField": "___records___" + } + }, + "incompleteColumns": { + + }, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": { + + } + }, + "textBased": { + "layers": { + + } + } + }, + "filters": [ + + ], + "internalReferences": [ + + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "44052788-b051-4fbd-a2b0-da41262deaec", + "isTransposed": false + }, + { + "columnId": "84bfee97-bb0e-40ab-a959-471271174f0d", + "isTransposed": false + }, + { + "columnId": "d18ad346-787d-4a81-a9fd-39de636b6f18", + "isTransposed": false + } + ], + "layerId": "01176e8d-06be-4604-906d-44d2dce4e6fd", + "layerType": "data", + "showRowNumbers": true, + "sorting": { + "columnId": "d18ad346-787d-4a81-a9fd-39de636b6f18", + "direction": "desc" + } + } + }, + "title": "Tope actor types and actions", + "version": 2, + "visualizationType": "lnsDatatable" + } + }, + "gridData": { + "h": 11, + "i": "0df207d6-73a6-4bef-9c3b-d5de9981eba9", + "w": 24, + "x": 0, + "y": 0 + }, + "panelIndex": "0df207d6-73a6-4bef-9c3b-d5de9981eba9", + "type": "vis" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0139bcd3-6e50-4d90-9e23-14fcde48d57d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": { + + }, + "datasourceStates": { + "formBased": { + "layers": { + "0139bcd3-6e50-4d90-9e23-14fcde48d57d": { + "columnOrder": [ + "f7aec231-6e27-496a-b610-37859f757c75", + "49f43780-d6e1-4f75-a12a-0dc5e1837d38" + ], + "columns": { + "49f43780-d6e1-4f75-a12a-0dc5e1837d38": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "sourceField": "___records___" + }, + "f7aec231-6e27-496a-b610-37859f757c75": { + "dataType": "string", + "isBucketed": true, + "label": "Top 9 values of user_agent.name", + "operationType": "terms", + "params": { + "exclude": [ + + ], + "excludeIsRegex": false, + "include": [ + + ], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "49f43780-d6e1-4f75-a12a-0dc5e1837d38", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 9 + }, + "sourceField": "user_agent.name" + } + }, + "incompleteColumns": { + + }, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": { + + } + }, + "textBased": { + "layers": { + + } + } + }, + "filters": [ + + ], + "internalReferences": [ + + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "f7aec231-6e27-496a-b610-37859f757c75" + }, + { + "columnId": "49f43780-d6e1-4f75-a12a-0dc5e1837d38" + } + ], + "layerId": "0139bcd3-6e50-4d90-9e23-14fcde48d57d", + "layerType": "data", + "showRowNumbers": true + } + }, + "title": "Count by User Agent Name", + "version": 2, + "visualizationType": "lnsDatatable" + } + }, + "gridData": { + "h": 11, + "i": "846cb077-454a-40c7-a68b-1cb449bc8432", + "w": 23, + "x": 24, + "y": 0 + }, + "panelIndex": "846cb077-454a-40c7-a68b-1cb449bc8432", + "type": "vis" + } + ], + "timeRestore": false, + "title": "[Datadog] - audit logs" + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-08-04T15:31:44.848Z", + "created_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", + "id": "datadog-f14d9abf-fd86-4ef1-b0a3-a9881043629c", + "references": [ + { + "id": "logs-*", + "name": "df18f977-1ec4-4162-afc9-25c898314c5f:indexpattern-datasource-layer-b43ab4bb-efa5-4b73-91b3-febc2496915d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "30620a7f-83e3-40f7-8226-c15fd8f0b33f:indexpattern-datasource-layer-fd4fd860-acb1-4c0a-aeeb-a26ea102ee1a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0df207d6-73a6-4bef-9c3b-d5de9981eba9:indexpattern-datasource-layer-01176e8d-06be-4604-906d-44d2dce4e6fd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "846cb077-454a-40c7-a68b-1cb449bc8432:indexpattern-datasource-layer-0139bcd3-6e50-4d90-9e23-14fcde48d57d", + "type": "index-pattern" + } + ], + "type": "dashboard", + "typeMigrationVersion": "10.3.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" +} diff --git a/packages/datadog/manifest.yml b/packages/datadog/manifest.yml new file mode 100644 index 00000000000..3a463f69879 --- /dev/null +++ b/packages/datadog/manifest.yml @@ -0,0 +1,187 @@ +format_version: 3.5.4 +name: datadog +title: "Datadog Audit Logs" +version: "0.1.0" +description: "Collect and analyze Datadog audit trail logs delivered to S3 by Datadog Log Archives, via SQS notifications, with full ECS mapping" +type: integration +categories: + - security + - observability + - custom_logs +conditions: + kibana: + version: "^8.19.0 || ^9.1.0" + elastic: + subscription: "basic" +icons: + - src: /img/Datadog_Logo.svg + title: Datadog logo + size: 32x32 + type: image/svg+xml +screenshots: + - src: /img/Datadog_dashboard.png + title: Datadog Audit Logs Dashboard + size: 600x600 + type: image/png +policy_templates: + - name: datadog + title: Datadog Audit Logs + description: Collect Datadog audit trail logs from an S3 bucket via SQS notifications or bucket polling + inputs: + - type: aws-s3 + title: Datadog Audit Logs via S3 + description: Collect Datadog Log Archives audit objects from S3 using SQS notifications, or bucket polling when no queue is configured + required_vars: + sqs_mode: + - name: collection_mode + value: sqs + - name: queue_url + polling_mode: + - name: collection_mode + value: polling + - name: bucket_arn + vars: + - name: collection_mode + type: select + title: Collection Mode + description: Choose whether to collect from SQS notifications or S3 bucket polling. + required: false + show_user: true + options: + - text: SQS (real-time) + value: sqs + - text: Polling (interval) + value: polling + default: sqs + + # === S3 Bucket Configuration === + - name: bucket_arn + type: text + title: S3 Bucket ARN + description: ARN of the S3 bucket Datadog Log Archives writes to. Required in Polling mode. + required: false + show_user: true + - name: bucket_list_prefix + type: text + title: Bucket Prefix + description: > + Prefix path for S3 objects. Datadog Log Archives writes to a date-partitioned + layout under the archive root, e.g. "datadog-audit/dt=20260731/hour=19/". + Set this to the archive root to scope collection. Leave empty to process all objects. + required: false + show_user: true + default: "" + - name: region + type: text + title: AWS Region + description: AWS region where the bucket is located (e.g. us-east-1). + required: false + show_user: true + default: "us-east-1" + + # === SQS Configuration (real-time mode) === + - name: queue_url + type: text + title: SQS Queue URL + description: URL of the SQS queue receiving S3 object-created notifications. Required in SQS mode. + required: false + show_user: true + - name: visibility_timeout + type: text + title: SQS Visibility Timeout + description: SQS message visibility timeout (e.g. "300s"). + required: false + show_user: false + default: "300s" + - name: max_number_of_messages + type: integer + title: Max SQS Messages + description: Maximum number of messages to receive from SQS per batch. + required: false + show_user: false + default: 5 + + # === Polling Configuration (fallback if no SQS) === + - name: interval + type: text + title: Polling Interval + description: How often to list the bucket for new objects when SQS is not configured (e.g. "5m"). + required: false + show_user: true + default: "5m" + + # === AWS Credentials === + - name: access_key_id + type: password + title: AWS Access Key ID + description: AWS Access Key ID for S3/SQS access. + required: false + show_user: true + secret: true + - name: secret_access_key + type: password + title: AWS Secret Access Key + description: AWS Secret Access Key for S3/SQS access. + required: false + show_user: true + secret: true + - name: session_token + type: password + title: AWS Session Token + description: AWS Session Token for temporary credentials. + required: false + show_user: false + secret: true + - name: role_arn + type: text + title: IAM Role ARN + description: ARN of an IAM role to assume (preferred over static access keys). + required: false + show_user: false + + # === File Processing === + - name: file_selectors + type: yaml + title: File Selectors + description: | + Regex patterns selecting which S3 objects to process. Datadog Log Archives + writes gzipped NDJSON, so the default matches `.json.gz`. + Example: - regex: '.*\.json\.gz$' + required: false + show_user: false + multi: false + default: | + - regex: '.*\.json\.gz$' + - name: max_bytes + type: text + title: Max File Size + description: Maximum object size to process (e.g. "100MB"). + required: false + show_user: false + default: "100MB" + + # === Performance & Concurrency === + - name: number_of_workers + type: integer + title: Number of Workers + description: Number of workers processing S3 objects concurrently. + default: 5 + required: false + show_user: false + - name: api_timeout + type: text + title: AWS API Timeout + description: Timeout for AWS API calls (e.g. "120s"). + required: false + show_user: false + default: "120s" + - name: fips_enabled + type: bool + title: FIPS Enabled + description: Use FIPS-compliant AWS endpoints. + required: false + show_user: false + default: false +owner: + github: elastic/integration-experience + type: elastic diff --git a/packages/datadog/sample_event.json b/packages/datadog/sample_event.json new file mode 100644 index 00000000000..c5d6e8d9523 --- /dev/null +++ b/packages/datadog/sample_event.json @@ -0,0 +1,171 @@ +{ + "@timestamp": "2026-07-31T19:23:15.543Z", + "datadog": { + "action": "accessed", + "actor": { + "type": "USER" + }, + "auth_method": "SESSION", + "emitted_source": "edge", + "event": { + "name": "Request" + }, + "route": { + "path": "/api/ui/frontend_telemetry/metrics" + }, + "source": { + "as": { + "domain": "example.net", + "route": "198.51.100.3/24", + "type": "hosting" + } + }, + "tags": [ + "source:audit" + ], + "threat_intel": { + "indicators_matched": [ + "IP" + ], + "results": [ + { + "additional_data": { + "as": { + "number": 64496, + "organization": "Example ISP" + }, + "client": { + "concentration": { + "city": "Sun Lakes", + "country": "US", + "density": 1, + "geohash": "9tbmnn", + "skew": 596, + "state": "Arizona" + }, + "count": 4, + "countries": 1, + "types": [ + "DESKTOP", + "MOBILE" + ] + }, + "infrastructure": "DATACENTER", + "location": { + "city": "Los Angeles", + "country": "US", + "state": "California" + }, + "organization": "Example ISP", + "tunnels": [ + { + "anonymous": false, + "operator": "EXAMPLE_PROXY", + "type": "PROXY" + } + ] + }, + "category": "corp_vpn", + "indicator": "198.51.100.1", + "intention": "benign", + "source": { + "name": "spur", + "type": "managed", + "url": "https://spur.us" + }, + "type": "IP" + } + ] + } + }, + "ecs": { + "version": "9.4.0" + }, + "event": { + "action": "request_accessed", + "category": [ + "api", + "web" + ], + "dataset": "datadog.audit", + "id": "id-000001", + "kind": "event", + "module": "datadog", + "original": "{\"date\":\"2026-07-31T19:23:15.543Z\",\"attributes\":{\"evt\":{\"actor\":{\"type\":\"USER\"},\"name\":\"Request\"},\"auth_method\":\"SESSION\",\"route\":{\"path\":\"/api/ui/frontend_telemetry/metrics\"},\"org\":{\"uuid\":\"00000000-0000-4000-8000-000000000001\"},\"usr\":{\"id\":\"user01@example.com\",\"uuid\":\"00000000-0000-4000-8000-000000000002\",\"email\":\"user01@example.com\"},\"threat_intel\":{\"indicators_matched\":[\"IP\"],\"results\":[{\"indicator\":\"198.51.100.1\",\"additional_data\":{\"tunnels\":[{\"anonymous\":false,\"type\":\"PROXY\",\"operator\":\"EXAMPLE_PROXY\"}],\"as\":{\"number\":64496,\"organization\":\"Example ISP\"},\"infrastructure\":\"DATACENTER\",\"organization\":\"Example ISP\",\"client\":{\"types\":[\"DESKTOP\",\"MOBILE\"],\"count\":4,\"concentration\":{\"country\":\"US\",\"density\":1,\"city\":\"Sun Lakes\",\"geohash\":\"9tbmnn\",\"state\":\"Arizona\",\"skew\":596},\"countries\":1},\"location\":{\"country\":\"US\",\"city\":\"Los Angeles\",\"state\":\"California\"}},\"source\":{\"name\":\"spur\",\"type\":\"managed\",\"url\":\"https://spur.us\"},\"type\":\"IP\",\"category\":\"corp_vpn\",\"intention\":\"benign\"}]},\"action\":\"accessed\",\"http\":{\"status_code\":202,\"url_details\":{\"path\":\"/api/ui/frontend_telemetry/metrics\",\"host\":\"us5.datadoghq.com\"},\"method\":\"POST\",\"useragent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36\"},\"network\":{\"client\":{\"geoip\":{\"continent\":{\"code\":\"NA\",\"name\":\"North America\"},\"country\":{\"name\":\"United States\",\"iso_code\":\"US\"},\"subdivision\":{\"name\":\"California\",\"iso_code\":\"US-CA\"},\"as\":{\"number\":\"AS64496\",\"route\":\"198.51.100.3/24\",\"domain\":\"example.net\",\"name\":\"Example ISP\",\"type\":\"hosting\"},\"city\":{\"name\":\"Los Angeles\"},\"timezone\":\"America/Los_Angeles\",\"ipAddress\":\"198.51.100.1\",\"location\":{\"latitude\":34.05223,\"longitude\":-118.24368}},\"ip\":\"198.51.100.1\"}},\"status\":\"info\",\"timestamp\":\"2026-07-31T19:23:15.543Z\",\"emitted_source\":\"edge\"},\"_id\":\"id-000001\",\"source\":\"audit\",\"message\":\"POST request made to /api/ui/frontend_telemetry/metrics by user01@example.com with response 202\",\"status\":\"info\",\"tags\":[\"source:audit\"]}", + "outcome": "success", + "type": [ + "access" + ] + }, + "http": { + "request": { + "method": "POST" + }, + "response": { + "status_code": 202 + } + }, + "log": { + "level": "info" + }, + "organization": { + "id": "00000000-0000-4000-8000-000000000001" + }, + "related": { + "hosts": [ + "us5.datadoghq.com" + ], + "ip": [ + "198.51.100.1" + ], + "user": [ + "user01@example.com" + ] + }, + "source": { + "as": { + "number": 64496, + "organization": { + "name": "Example ISP" + } + }, + "geo": { + "city_name": "Los Angeles", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 34.05223, + "lon": -118.24368 + }, + "region_iso_code": "US-CA", + "region_name": "California", + "timezone": "America/Los_Angeles" + }, + "ip": "198.51.100.1" + }, + "url": { + "domain": "us5.datadoghq.com", + "full": "https://us5.datadoghq.com/api/ui/frontend_telemetry/metrics", + "path": "/api/ui/frontend_telemetry/metrics" + }, + "user": { + "email": "user01@example.com", + "id": "00000000-0000-4000-8000-000000000002", + "name": "user01@example.com" + }, + "user_agent": { + "device": { + "name": "Mac" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/198.51.100.2 Safari/537.36", + "os": { + "full": "Mac OS X 10.15.7", + "name": "Mac OS X", + "version": "10.15.7" + }, + "version": "198.51.100.2" + } +} \ No newline at end of file