DDS: Anomali ThreatStream: Threat Intel Integration v1.0.0 (DataDog#23345)

* Add Anomali ThreatStream threat intel integration without assets

* Resolve CI Failure

* Add Anomali ThreatStream integration with assets

* Renamed support to troubleshooting

* Address review comments

Co-authored-by: jeff-morgan-dd <jeff.morgan@datadoghq.com>

* Address review comments

Co-authored-by: jeff-morgan-dd <jeff.morgan@datadoghq.com>

* review comment changes

* updated the id to match the standard

* Update anomali_threatstream_threat_intelligence.json dashboard URL

* vendor_name crawler related changes

* updating screeshots for new logo

* align anomali dashboard with other threat intel dashboards

* updating dashboard images

* update screenshots with more data

* remove reputation/risk_score

* change images to correct aspect ratio

* changed images to fit max required width

* remove hardcoded ioc available values

* remove indicator types from description

* update dashboard images

* update images

* address comments on documentation

---------

Co-authored-by: jaypatel7-crest <jay.patel7@crestdata.ai>
Co-authored-by: jeff-morgan-dd <jeff.morgan@datadoghq.com>
Co-authored-by: Bhargav Nariyani <35323912+bhargavnariyanicrest@users.noreply.github.com>
Co-authored-by: Bhargav Nariyani <bhargav.nariyani@crestdata.ai>
Co-authored-by: SeoHyun Hwang <seohyun.hwang@datadoghq.com>
Co-authored-by: SeoHyun Hwang <93045769+seohyunh@users.noreply.github.com>

Author: 5 people

.github/CODEOWNERS

@@ -816,7 +816,7 @@ plaid/assets/logs/                                                  @DataDog/saa
 /anomali_threatstream/                                               @DataDog/saas-integrations
 /anomali_threatstream/*.md                                           @DataDog/saas-integrations @DataDog/documentation
 /anomali_threatstream/manifest.json                                  @DataDog/saas-integrations @DataDog/documentation
-/anomali_threatstream/assets/logs/                                   @DataDog/saas-integrations @DataDog/documentation @DataDog/logs-integrations-reviewers
+
 
 /palo_alto_networks_cortex_xsoar/                                     @DataDog/saas-integrations
 /palo_alto_networks_cortex_xsoar/*.md                                 @DataDog/saas-integrations @DataDog/documentation

anomali_threatstream/README.md

@@ -1,39 +1,41 @@
-# Agent Check: Anomali ThreatStream
-
 ## Overview
 
-This check monitors [Anomali ThreatStream][1].
-
-## Setup
-
-### Installation
+[Anomali ThreatStream][1] is a threat intelligence platform (TIP) that automates the collection, curation, and analysis of threat data from global, open-source, and premium feeds.
 
-The Anomali ThreatStream check is included in the [Datadog Agent][2] package.
-No additional installation is needed on your server.
+This integration collects the following indicator types:
 
-### Configuration
+- IPv4
+- Domain
+- SHA256
 
-!!! Add list of steps to set up this integration !!!
+Integrate Anomali ThreatStream with Datadog to enhance your security logs with threat intelligence, enabling analysis of matched Indicators of Compromise (IOCs) through pre-built dashboards. Additionally, the integration can be used for Cloud SIEM detection rules for enhanced monitoring and security.
 
-### Validation
-
-!!! Add steps to validate integration is functioning as expected !!!
-
-## Data Collected
+## Setup
 
-### Metrics
+### Obtaining Anomali ThreatStream API credentials and domain
 
-Anomali ThreatStream does not include any metrics.
+1. Log in to the Anomali ThreatStream instance.
+2. Navigate to **Settings** > **My profile**.
+3. Under **Account Information**, click **Reveal** next to the **API Key** and copy it. Also, copy your **Email**.
+4. Identify your Anomali ThreatStream Domain using the URL of your Anomali ThreatStream instance.
+   - For example, if your Anomali ThreatStream instance URL is `https://ui.threatstream.com/`, then your Anomali ThreatStream domain is `ui.threatstream.com`.
 
-### Events
+### Connect your Anomali ThreatStream account to Datadog
 
-Anomali ThreatStream does not include any events.
+1. Provide the following details:
+   | Parameter | Description |
+   | ---------- | ---------------------------------------------- |
+   | Domain | Your Anomali ThreatStream domain. |
+   | Email | Email address associated with your ThreatStream account. |
+   | API Key | API key of your Anomali ThreatStream account. |
+   | Collect IPv4 IOCs | Enable to collect IPv4 IOCs. The default value is `true`. |
+   | Collect Domain IOCs | Enable to collect Domain IOCs. The default value is `true`. |
+   | Collect SHA256 IOCs | Enable to collect SHA256 IOCs. The default value is `true`. |
+2. Click **Save**.
 
 ## Troubleshooting
 
-Need help? Contact [Datadog support][3].
-
-[1]: **LINK_TO_INTEGRATION_SITE**
-[2]: https://app.datadoghq.com/account/settings/agent/latest
-[3]: https://docs.datadoghq.com/help/
+Need help? Contact [Datadog support][2].
 
+[1]: https://www.anomali.com/products/threatstream
+[2]: https://docs.datadoghq.com/help/