Thor.kell/add anthropic compliance logs#23664
Conversation
Adds a new sibling tile to anthropic_usage_and_costs for collecting audit activity events from the Anthropic Compliance API (GET /v1/compliance/activities). Crawler implementation lives in DataDog/crawler-sdk under clients/anthropic_compliance_logs. Assets: - Log pipeline + tests for source:anthropic service:anthropic.compliance (flattens actor, GeoIP + UA enrichment, remaps type to evt.name) - Overview dashboard with auth/admin/API-key lifecycle widgets - Ingestion-stopped log alert monitor - Five Log Explorer saved views (all, auth, API key, admin, org membership) - CODEOWNERS entry under SaaS Integrations Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
This PR does not modify any files shipped with the agent. To help streamline the release process, please consider adding the |
Validation Report
Run Passed validations (18)
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 32c48f2fba
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "critical": 1, | ||
| "warning": 1 |
There was a problem hiding this comment.
Differentiate warning and critical trigger conditions
This monitor defines both critical and warning as 1 while evaluating a single last("1h") < 1 condition, so the warning path is effectively unreachable and the {{#is_warning}} branch (which claims a 30-minute early warning) will not trigger as intended. As written, users only get the critical behavior, which defeats the staged alerting described in the message.
Useful? React with 👍 / 👎.
| id: "activity_01R1sBnxj7yvtdZnt8DsfpRL" | ||
| organization_id: "org_01GuSHHxdWNCcTtk6Wr5arBM" | ||
| organization_uuid: "80cb55fa-462c-4bc0-82d6-07ebb1a6f004" | ||
| type: "claude_chat_viewed" |
There was a problem hiding this comment.
Align parser test fixture with remapper output
The pipeline remaps top-level type to evt.name with preserveSource: false in assets/logs/anthropic-compliance-logs.yaml, so keeping type in the expected parsed payload makes this fixture inconsistent with the configured processors. This causes parser-test expectations to diverge from actual pipeline behavior and can fail integration asset validation.
Useful? React with 👍 / 👎.
What does this PR do?
This might be right? Assets for
anthropic-compliance-logs, re-using the existing source type id, but declaring a new folder with new assets.I am unsure if I need to override the tile in web-ui, but I'll see if this builds first.
Motivation
Review checklist (to be filled by reviewers)
qa/skip-qalabel if the PR doesn't need to be tested during QA.backport/<branch-name>label to the PR and it will automatically open a backport PR once this one is merged