Skip to content

Commit 23be503

Browse files
tesnim5hamdounitesnim5hamdouni
authored
ide-shepherd integration (DataDog#22571)
* rebase with main to fix ci test * Fix 3rd party licenses * update licenses * restore licenses file * restore config.toml * reapply changes and pray for the best * update codeowners * test * remove saas from ide-shepherd and saas codeowners * restore saas for scfw * restore scfw codeowners * update owner in manifest * implement documentation's request for changes * decapitalize titles * Implement requested changes * fix oversight
1 parent 0b2cf10 commit 23be503

9 files changed

Lines changed: 2416 additions & 0 deletions

File tree

‎.github/CODEOWNERS‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -776,6 +776,11 @@ plaid/assets/logs/ @DataDog/saa
776776
/cisco_secure_client/manifest.json @DataDog/agent-integrations @DataDog/documentation
777777
/cisco_secure_client/assets/logs/ @DataDog/agent-integrations @DataDog/documentation @DataDog/logs-integrations-reviewers
778778

779+
/ide-shepherd/ @DataDog/agent-integrations
780+
/ide-shepherd/*.md @DataDog/agent-integrations @DataDog/documentation
781+
/ide-shepherd/manifest.json @DataDog/agent-integrations @DataDog/documentation
782+
/ide-shepherd/assets/logs/ @DataDog/agent-integrations @DataDog/documentation @DataDog/logs-integrations-reviewers
783+
779784
# To keep Security up-to-date with changes to the signing tool.
780785
/datadog_checks_dev/datadog_checks/dev/tooling/signing.py @DataDog/agent-integrations
781786
# As well as the secure downloader.

‎.github/workflows/config/labeler.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -682,6 +682,10 @@ integration/iboss:
682682
- changed-files:
683683
- any-glob-to-any-file:
684684
- iboss/**/*
685+
integration/ide_shepherd:
686+
- changed-files:
687+
- any-glob-to-any-file:
688+
- ide_shepherd/**/*
685689
integration/ignite:
686690
- changed-files:
687691
- any-glob-to-any-file:

‎ide_shepherd/CHANGELOG.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# CHANGELOG - ide-shepherd
2+
3+
## 1.0.0 / 2026-01-23
4+
5+
***Added***:
6+
7+
* Initial Release

‎ide_shepherd/README.md‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# IDE Shepherd
2+
3+
## Overview
4+
5+
[IDE Shepherd][1] is a real-time security monitoring and protection tool for IDE environments. It monitors extension and workspace task activities in VS Code and Cursor, actively blocking malicious behaviors to protect developer endpoints from supply chain attacks and compromised extensions. IDE Shepherd provides observability into security and extension lifecycle events (installation, updates, and uninstallation), enabling security teams to detect and respond to threats in real-time.
6+
7+
Integrate IDE Shepherd with Datadog's pre-built dashboard visualizations for insight into security alerts, extension activities, and workspace task monitoring. With Datadog's built-in log pipelines, you can parse and enrich these logs to facilitate search and detailed insights. The integration includes ready-to-use dashboards for monitoring security events, extension lifecycle, and activity patterns by IDE type and host.
8+
9+
## Setup
10+
11+
### Configuration
12+
13+
**1. Install and start Datadog Agent**
14+
15+
First, verify the Datadog Agent is installed and running on your system with your organization API key configured. See [Datadog Agent Installation Guide][2] for installation instructions.
16+
17+
**2. Install IDE Shepherd extension**
18+
19+
Install the IDE Shepherd extension in VS Code or Cursor. See the [IDE Shepherd repository][1] for installation instructions.
20+
21+
**3. Enable telemetry in IDE Shepherd**
22+
23+
IDE Shepherd **automatically configures the Datadog Agent** when you enable telemetry for the first time:
24+
25+
1. Open the IDE Shepherd sidebar in VS Code or Cursor.
26+
2. Navigate to **Settings > Datadog Telemetry**.
27+
3. Click on **Telemetry: Disabled** to enable it.
28+
29+
IDE Shepherd automatically:
30+
- Creates the configuration directory: `/opt/datadog-agent/etc/conf.d/ide-shepherd.d/`
31+
- Writes the configuration file: `conf.yaml` with the appropriate settings
32+
- Configures the agent to listen on the default port
33+
34+
35+
**Note**: Keep the default port configuration. The extension handles all setup automatically.
36+
37+
**4. Restart Datadog Agent**
38+
39+
After the automatic configuration, IDE Shepherd requests permission to restart the Datadog Agent. If it fails, restart it manually:
40+
41+
```bash
42+
# Linux
43+
sudo systemctl restart datadog-agent
44+
45+
# macOS
46+
launchctl stop com.datadoghq.agent
47+
launchctl start com.datadoghq.agent
48+
```
49+
50+
See [Datadog Agent Commands][3] for more details.
51+
52+
**5. Verify Telemetry Status**
53+
54+
Telemetry is **sent automatically** in real-time:
55+
56+
- Extension installed, updated, or uninstalled: OCSF event sent immediately
57+
- Security threat detected: OCSF event sent immediately
58+
59+
You can verify the connection from the IDE Shepherd sidebar:
60+
61+
- **Agent Status**: Shows if the Datadog Agent is up and running
62+
- **Agent Port**: Shows the port on which the Agent is listening
63+
64+
### Validation
65+
66+
[Run the Agent's status subcommand][3] and look for `ide-shepherd` under the Logs Agent section. You can also verify in the IDE Shepherd sidebar that the **Agent Status** shows as connected.
67+
68+
To view your logs in Datadog:
69+
70+
1. Go to the [Log Explorer][4]
71+
2. Filter by `source:ide-shepherd service:ide-shepherd-telemetry`
72+
3. Explore security events, extension lifecycle events, and workspace task activities.
73+
74+
## Data Collected
75+
76+
### Logs
77+
78+
The IDE Shepherd integration collects and forwards IDE security and activity logs to Datadog, including:
79+
80+
- **Security events**: Real-time alerts for malicious extension activities and blocked threats
81+
- **Extension lifecycle events**: Installation, update, and uninstallation events
82+
- **Extension Metadata**: Name, version, publisher information along with a risk estimate based on predefined heuristics.
83+
- **OCSF (Open Cybersecurity Schema Framework) classified events**: Standardized security event formats
84+
85+
The logs are automatically enriched with:
86+
- OCSF class UIDs (Application Security Posture Finding, Detection Finding)
87+
- IDE type (VS Code or Cursor) and its version
88+
- Host information
89+
- Security technique information for flagged behaviors
90+
- Observable threat indicators
91+
92+
### Metrics
93+
94+
The IDE Shepherd integration does not include any metrics.
95+
96+
### Events
97+
98+
The IDE Shepherd integration does not include any events.
99+
100+
## Troubleshooting
101+
102+
Need help? Contact [Datadog support][5].
103+
104+
[1]: https://github.com/DataDog/IDE-SHEPHERD-extension
105+
[2]: https://docs.datadoghq.com/agent/
106+
[3]: https://docs.datadoghq.com/agent/guide/agent-commands/#agent-status-and-information
107+
[4]: https://app.datadoghq.com/logs
108+
[5]: https://docs.datadoghq.com/help/

0 commit comments

Comments
 (0)