[pull] master from DataDog:master

.codecov.yml

@@ -562,6 +562,10 @@ coverage:
         target: 75
         flags:
         - powerdns_recursor
+      Prefect:
+        target: 75
+        flags:
+        - prefect
       Process:
         target: 75
         flags:
@@ -1584,6 +1588,11 @@ flags:
     paths:
     - powerdns_recursor/datadog_checks/powerdns_recursor
     - powerdns_recursor/tests
+  prefect:
+    carryforward: true
+    paths:
+    - prefect/datadog_checks/prefect
+    - prefect/tests
   process:
     carryforward: true
     paths:

.ddev/config.toml

@@ -14,12 +14,14 @@ teamcity = "TeamCity"
 win32_event_log = "Windows Event Log"
 krakend = "KrakenD"
 lustre = "Lustre"
+prefect = "Prefect"
 n8n = "n8n"
 control_m = "Control-M"
 
 [overrides.metrics-prefix]
 krakend = "krakend.api."
 lustre = "lustre."
+prefect = "prefect.server."
 n8n = "n8n."
 control_m = "control_m."
 
@@ -215,5 +217,6 @@ __pycache__ = false
 [overrides.manifest.platforms]
 krakend = ["linux", "windows", "mac_os"]
 lustre = ["linux", "windows", "mac_os"]
+prefect = ["linux", "windows", "mac_os"]
 n8n = ["linux", "windows", "mac_os"]
 control_m = ["linux", "windows", "mac_os"]

.github/CODEOWNERS

@@ -772,6 +772,7 @@ plaid/assets/logs/                                                  @DataDog/saa
 /cyberark_endpoint_privilege_manager/*.md                            @DataDog/saas-integrations @DataDog/documentation
 /cyberark_endpoint_privilege_manager/manifest.json                   @DataDog/saas-integrations @DataDog/documentation
 /cyberark_endpoint_privilege_manager/assets/logs/                    @DataDog/saas-integrations @DataDog/documentation @DataDog/logs-integrations-reviewers
+
 /beyondtrust_privileged_remote_access/                               @DataDog/agent-integrations
 /beyondtrust_privileged_remote_access/*.md                           @DataDog/agent-integrations @DataDog/documentation
 /beyondtrust_privileged_remote_access/manifest.json                  @DataDog/agent-integrations @DataDog/documentation

.github/chainguard/self.backport.pull-request-target.sts.yaml

@@ -0,0 +1,37 @@
+# Trust policy for the backport workflow in DataDog/integrations-core
+#
+# This policy grants the tibdex/backport action permission to create
+# backport pull requests when a merged PR has a backport label.
+#
+# Naming convention:
+#   self:                 Only this repository (DataDog/integrations-core) can use this policy
+#   backport:             Grants permissions to create backport pull requests
+#   pull-request-target:  Intended for workflows triggered by pull_request_target events
+#
+# Security model:
+#   - Workflow runs on pull_request_target (closed/labeled) events
+#   - Workflow file must be committed to master
+#
+# Permissions granted:
+#   - pull_requests: write  - Create and update pull requests
+#
+# Usage in workflows:
+#   - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
+#     with:
+#       scope: DataDog/integrations-core
+#       policy: self.backport.pull-request-target
+
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/integrations-core:pull_request
+
+claim_pattern:
+  ref: refs/heads/(master|\d+\.\d+\.x)
+  ref_protected: "true"
+  job_workflow_ref: DataDog/integrations-core/.github/workflows/backport-pr\.yml@refs/heads/master
+  event_name: pull_request_target
+
+permissions:
+  pull_requests: write
+  workflows: write
+  contents: write

.github/workflows/backport-pr.yml

@@ -9,6 +9,9 @@ jobs:
   backport:
     name: Backport PR
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # Required for OIDC token federation with dd-octo-sts
+      contents: read
     if: >
       github.event.pull_request.merged
       && (
@@ -19,13 +22,12 @@ jobs:
         )
       )
     steps:
-      - name: Create token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
-        id: token-generator
+      - name: Get GitHub token via dd-octo-sts
+        uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
+        id: octo-sts
         with:
-          app-id: ${{ secrets.DD_AGENT_INTEGRATIONS_BOT_APP_ID }}
-          private-key: ${{ secrets.DD_AGENT_INTEGRATIONS_BOT_PRIVATE_KEY }}
-          repositories: integrations-core
+          scope: DataDog/integrations-core
+          policy: self.backport.pull-request-target
       - uses: tibdex/backport@9565281eda0731b1d20c4025c43339fb0a23812e # v2.0.4
         with:
           label_pattern: "^backport/(?<base>([^ ]+))$"
@@ -36,4 +38,4 @@ jobs:
             ___
 
             <%= body %>
-          github_token: ${{ steps.token-generator.outputs.token }}
+          github_token: ${{ steps.octo-sts.outputs.token }}

.github/workflows/config/labeler.yml

@@ -402,6 +402,10 @@ integration/crowdstrike_fdr:
 - changed-files:
   - any-glob-to-any-file:
     - crowdstrike_fdr/**/*
+integration/cyberark_endpoint_privilege_manager:
+- changed-files:
+  - any-glob-to-any-file:
+    - cyberark_endpoint_privilege_manager/**/*
 integration/databricks:
 - changed-files:
   - any-glob-to-any-file:
@@ -1162,6 +1166,10 @@ integration/powerdns_recursor:
 - changed-files:
   - any-glob-to-any-file:
     - powerdns_recursor/**/*
+integration/prefect:
+- changed-files:
+  - any-glob-to-any-file:
+    - prefect/**/*
 integration/presto:
 - changed-files:
   - any-glob-to-any-file:
@@ -1506,7 +1514,7 @@ integration/trend_micro_email_security:
 - changed-files:
   - any-glob-to-any-file:
     - trend_micro_email_security/**/*
-integration/trend_micro_vision_one_endpoint_security:
+integration/trend_micro_vision_one_eps:
 - changed-files:
   - any-glob-to-any-file:
     - trend_micro_vision_one_endpoint_security/**/*

.github/workflows/test-all.yml

@@ -3110,6 +3110,26 @@ jobs:
       minimum-base-package: ${{ inputs.minimum-base-package }}
       pytest-args: ${{ inputs.pytest-args }}
     secrets: inherit
+  j8f01991:
+    uses: ./.github/workflows/test-target.yml
+    with:
+      job-name: Prefect
+      target: prefect
+      platform: linux
+      runner: '["ubuntu-22.04"]'
+      repo: "${{ inputs.repo }}"
+      context: ${{ inputs.context }}
+      python-version: "${{ inputs.python-version }}"
+      latest: ${{ inputs.latest }}
+      agent-image: "${{ inputs.agent-image }}"
+      agent-image-py2: "${{ inputs.agent-image-py2 }}"
+      agent-image-windows: "${{ inputs.agent-image-windows }}"
+      agent-image-windows-py2: "${{ inputs.agent-image-windows-py2 }}"
+      test-py2: ${{ inputs.test-py2 }}
+      test-py3: ${{ inputs.test-py3 }}
+      minimum-base-package: ${{ inputs.minimum-base-package }}
+      pytest-args: ${{ inputs.pytest-args }}
+    secrets: inherit
   jaeea6e0:
     uses: ./.github/workflows/test-target.yml
     with:

cyberark_endpoint_privilege_manager/README.md

@@ -1,39 +1,60 @@
-# Agent Check: cyberark_endpoint_privilege_manager
-
 ## Overview
 
-This check monitors [cyberark_endpoint_privilege_manager][1].
-
-## Setup
+[CyberArk Endpoint Privilege Manager][1] enforces least privilege and enables organizations to block and contain attacks on endpoint computers, reducing the risk of information being stolen or encrypted and held for ransom. 
 
-### Installation
+This integration ingests the following logs:
 
-The cyberark_endpoint_privilege_manager check is included in the [Datadog Agent][2] package.
-No additional installation is needed on your server.
+- **Raw Events**: Endpoint activities captured by EPM agents, including threat detection events.
+- **Policy Audit Events**: Audit records of policy usage on endpoints.
+- **Set Admin Audit Events**: Actions carried out by EPM administrators within sets.
+- **Account Admin Audit Events**: Actions performed by account administrators.
 
-### Configuration
+Integrate CyberArk Endpoint Privilege Manager with Datadog to gain insights into raw events, policy audit events, set admin audit events, and account admin audit events using pre-built dashboard visualizations. Datadog uses its built-in log pipelines to parse and enrich these logs, facilitating easy search and detailed insights. Additionally, the integration can be used for Cloud SIEM detection rules for enhanced monitoring and security.
 
-!!! Add list of steps to set up this integration !!!
 
-### Validation
+## Setup
 
-!!! Add steps to validate integration is functioning as expected !!!
+### Create a User in CyberArk Endpoint Privilege Manager
+1. Log in to the CyberArk Endpoint Privilege Manager portal.
+2. Navigate to **Administration**.
+3. Open the **Account Management** section.
+4. Click **Create** and then click on **Create User** from the dropdown.
+5. Enter the following details:
+   - Email
+   - Password
+   - Confirm Password
+6. Select the **Account Administrator** checkbox and choose the **View Only** option.
+7. Select the **Allow to Manage Sets** checkbox.
+8. Click **Next**.
+9. Assign the **View Only Set Admin** role for all listed sets.
+10. Click **Finish**.
+
+
+### Connect your CyberArk Endpoint Privilege Manager Account to Datadog
+
+1. Add your `EPM Account Region`, `Username`, and `Password`.
+   | Parameters | Description |
+   | ---------- | ---------------------------------------------- |
+   | EPM Account Region | The EPM Account Region of your CyberArk Endpoint Privilege Manager.|
+   | Username | The Username of CyberArk Endpoint Privilege Manager account which has access to the available sets.|
+   | Password | The CyberArk Endpoint Privilege Manager account password.|
+2. Click **Save**.
 
 ## Data Collected
 
+The CyberArk Endpoint Privilege Manager integration collects and forwards raw events, policy audit events, set admin audit events, and account admin audit events to Datadog.
+
 ### Metrics
 
-cyberark_endpoint_privilege_manager does not include any metrics.
+The CyberArk Endpoint Privilege Manager integration does not include any metrics.
 
 ### Events
 
-cyberark_endpoint_privilege_manager does not include any events.
+The CyberArk Endpoint Privilege Manager integration does not include any events.
 
 ## Troubleshooting
 
-Need help? Contact [Datadog support][3].
-
-[1]: **LINK_TO_INTEGRATION_SITE**
-[2]: https://app.datadoghq.com/account/settings/agent/latest
-[3]: https://docs.datadoghq.com/help/
+Need help? Contact [Datadog support][2].
 
+[1]: https://www.cyberark.com/products/endpoint-privilege-manager/
+[2]: https://docs.datadoghq.com/help/