Collect Datadog integration metadata

Author: RamazanKara

CHANGELOG.md

@@ -24,6 +24,7 @@
 - Added validation and export path-safety checks that reject symlinks in evidence bundle inputs.
 - Added best-effort live GitHub App installation metadata collection for the GitHub Enterprise to Forgejo path.
 - Added referenced metric and tag metadata capture to the live Datadog collector.
+- Added best-effort live Datadog integration installation metadata collection.
 - Updated CI and release workflows to Node.js 24-native GitHub Actions.
 
 ## 0.1.0 - 2026-05-24

README.md

@@ -94,7 +94,7 @@ Included in the current implementation:
 - CLI skeleton and project init/status.
 - Typed project, inventory, assessment, mapping, and validation manifests.
 - Fixture-based Datadog inventory import.
-- Read-only Datadog collection for dashboards, monitors, SLOs, and referenced metric/tag metadata.
+- Read-only Datadog collection for dashboards, monitors, SLOs, installed integration metadata, and referenced metric/tag metadata.
 - Read-only GitHub/GitHub Enterprise collection for repositories, teams, branch protection, Actions workflows, secret metadata, runners, deploy keys, and GitHub App installations.
 - Read-only Okta collection for applications, groups, policy/rule metadata, org MFA factors, and explicit break-glass user metadata.
 - Read-only Auth0 collection for clients, roles, action/rule metadata, Guardian MFA factors, and explicit break-glass user metadata.

docs/datadog-to-grafana.md

@@ -29,7 +29,7 @@ Validation checks the ArgoCD candidate for Application shape, OpenExit candidate
 
 ## Live Collection
 
-The live Datadog collector stores redacted evidence for dashboards, monitors, and SLOs. It records referenced metric names and tag keys from dashboard and monitor queries so cost, cardinality, and target sizing review can use the same metadata as fixture-based assessments. Evidence refs in generated assessments resolve to local files under `evidence/datadog/`.
+The live Datadog collector stores redacted evidence for dashboards, monitors, SLOs, and integration installation metadata where the Datadog API exposes it. It records referenced metric names and tag keys from dashboard and monitor queries so cost, cardinality, and target sizing review can use the same metadata as fixture-based assessments. Evidence refs in generated assessments resolve to local files under `evidence/datadog/`.
 
 ## Risk Rules
 

docs/schemas.md

@@ -4,7 +4,7 @@ OpenExit schemas live under `schemas/` and mirror the typed Go manifests. Releas
 
 Project manifests must use one of the supported source/target pairs: Datadog to Grafana LGTM, GitHub Enterprise to Forgejo, Okta/Auth0 to Keycloak/Zitadel, Cloudflare/Akamai to Varnish/HAProxy/Coraza, or OpenAI/Anthropic to vLLM/LiteLLM.
 
-Inventory dashboards can include optional `dataSources` and `templateVariables` fields so assessment can flag Grafana mapping risk. Datadog fixture and live collectors populate `metrics` from captured dashboard and monitor queries, including referenced tag keys where available. SLOs can include optional `sli`, `burnRateMonitorIds`, and `dashboardRefs` fields. The top-level inventory `volumes` section records whether log and trace volume assumptions are known.
+Inventory dashboards can include optional `dataSources` and `templateVariables` fields so assessment can flag Grafana mapping risk. Datadog fixture and live collectors populate `metrics` from captured dashboard and monitor queries, including referenced tag keys where available. The live Datadog collector also populates `integrations` from the Datadog v2 Integrations API when accessible. SLOs can include optional `sli`, `burnRateMonitorIds`, and `dashboardRefs` fields. The top-level inventory `volumes` section records whether log and trace volume assumptions are known.
 
 Mapping manifests use `kind: Mapping` and are written to `mapping/openexit.mapping.yaml` and `.json`. They record candidate dashboard paths, alert-rule candidate paths, unsupported source items, and manual-review entries derived from assessment findings. Validation reloads the mapping manifest and checks that source and target types still match inventory and assessment.
 

docs/security.md

@@ -4,6 +4,7 @@ OpenExit is designed for local-first assessment work.
 
 - Collectors must not make production writes.
 - Live Datadog, GitHub, Okta, Auth0, Cloudflare, Akamai, OpenAI, and Anthropic credentials are read from environment variables or local credential files and are never written to project files.
+- The Datadog collector records dashboard, monitor, SLO, integration installation, metric, and tag metadata only; it never mutates Datadog resources.
 - The GitHub collector records repository, workflow, runner, deploy-key, GitHub App installation, and secret metadata only; it never requests or stores secret values.
 - The Okta collector records client and policy metadata only; it never requests or stores client secrets, passwords, factor secrets, or token values.
 - The Auth0 collector records client, role, action/rule, Guardian MFA, and explicit break-glass user metadata only; it does not persist client secrets, action code, rule scripts, user passwords, MFA secrets, or token values.

internal/collector/datadog/live.go

@@ -44,6 +44,9 @@ func (LiveCollector) Collect(ctx context.Context, req collector.CollectRequest)
 	if err := collectSLOs(ctx, client, req.ProjectDir, inv); err != nil {
 		warnings = append(warnings, err.Error())
 	}
+	if err := collectIntegrations(ctx, client, req.ProjectDir, inv); err != nil {
+		warnings = append(warnings, err.Error())
+	}
 	inv.Warnings = warnings
 	inv.RecomputeSummary()
 	if err := inventory.Validate(inv); err != nil {
@@ -242,6 +245,44 @@ func collectSLOs(ctx context.Context, client *Client, projectDir string, inv *in
 	return nil
 }
 
+func collectIntegrations(ctx context.Context, client *Client, projectDir string, inv *inventory.Inventory) error {
+	var out struct {
+		Data []struct {
+			ID         string `json:"id"`
+			Attributes struct {
+				Title      string   `json:"title"`
+				Categories []string `json:"categories"`
+				Installed  bool     `json:"installed"`
+			} `json:"attributes"`
+		} `json:"data"`
+	}
+	body, err := client.get(ctx, "/api/v2/integrations", nil, &out)
+	if err != nil {
+		return fmt.Errorf("collect integrations: %w", err)
+	}
+	if err := writeEvidence(projectDir, "datadog/integrations/list.json", inventory.RedactBytes(body)); err != nil {
+		return err
+	}
+	for _, item := range out.Data {
+		name := firstNonEmpty(item.Attributes.Title, item.ID)
+		if name == "" {
+			continue
+		}
+		integration := inventory.Integration{
+			Name:        name,
+			Enabled:     item.Attributes.Installed,
+			Tags:        uniqueSorted(item.Attributes.Categories),
+			EvidenceRef: "evidence://datadog/integration/" + safeID(name),
+		}
+		if err := writeEvidence(projectDir, "datadog/integrations/"+safeID(name)+".json", inventory.RedactBytes(prettyJSON(item))); err != nil {
+			return err
+		}
+		inv.Assets.Integrations = append(inv.Assets.Integrations, integration)
+	}
+	sort.Slice(inv.Assets.Integrations, func(i, j int) bool { return inv.Assets.Integrations[i].Name < inv.Assets.Integrations[j].Name })
+	return nil
+}
+
 func stringSlice(value any) []string {
 	raw, ok := value.([]any)
 	if !ok {
@@ -261,6 +302,16 @@ func rawString(value any) string {
 	return text
 }
 
+func firstNonEmpty(values ...string) string {
+	for _, value := range values {
+		value = strings.TrimSpace(value)
+		if value != "" {
+			return value
+		}
+	}
+	return ""
+}
+
 func uniqueSorted(values []string) []string {
 	seen := map[string]struct{}{}
 	for _, value := range values {

internal/collector/datadog/live_test.go

@@ -6,6 +6,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
@@ -44,6 +45,11 @@ func TestLiveCollectorNormalizationWithMockedAPI(t *testing.T) {
 			}]`))
 		case "/api/v1/slo":
 			_, _ = w.Write([]byte(`{"data":[{"id":"slo-1","attributes":{"name":"Availability","target_threshold":99.9,"timeframe":"30d"}}]}`))
+		case "/api/v2/integrations":
+			_, _ = w.Write([]byte(`{"data":[
+				{"id":"kubernetes","type":"integration","attributes":{"title":"Kubernetes","categories":["containers","orchestration"],"installed":true}},
+				{"id":"pagerduty","type":"integration","attributes":{"title":"PagerDuty","categories":["alerting"],"installed":false}}
+			]}`))
 		default:
 			http.NotFound(w, r)
 		}
@@ -61,6 +67,9 @@ func TestLiveCollectorNormalizationWithMockedAPI(t *testing.T) {
 	if err := collectSLOs(context.Background(), client, projectDir, inv); err != nil {
 		t.Fatal(err)
 	}
+	if err := collectIntegrations(context.Background(), client, projectDir, inv); err != nil {
+		t.Fatal(err)
+	}
 	inv.RecomputeSummary()
 	if err := inventory.Validate(inv); err != nil {
 		t.Fatal(err)
@@ -71,9 +80,18 @@ func TestLiveCollectorNormalizationWithMockedAPI(t *testing.T) {
 	if inv.Summary.Dashboards != 1 || inv.Summary.Monitors != 1 || inv.Summary.SLOs != 1 {
 		t.Fatalf("unexpected summary: %+v", inv.Summary)
 	}
+	if inv.Summary.Integrations != 2 {
+		t.Fatalf("expected live integrations in summary, got %+v", inv.Summary)
+	}
 	if inv.Summary.UniqueMetrics != 2 {
 		t.Fatalf("expected live queries to populate metric summary, got %+v", inv.Summary)
 	}
+	if integration := integrationByName(inv.Assets.Integrations, "Kubernetes"); integration == nil || !integration.Enabled || !hasAll(integration.Tags, "containers", "orchestration") {
+		t.Fatalf("expected installed Kubernetes integration metadata, got %+v", inv.Assets.Integrations)
+	}
+	if integration := integrationByName(inv.Assets.Integrations, "PagerDuty"); integration == nil || integration.Enabled {
+		t.Fatalf("expected disabled PagerDuty integration metadata, got %+v", inv.Assets.Integrations)
+	}
 	if metric := metricByName(inv.Assets.Metrics, "system.cpu.user"); metric == nil || !hasAll(metric.Tags, "env", "service") {
 		t.Fatalf("expected dashboard metric tags to be captured, got %+v", inv.Assets.Metrics)
 	}
@@ -84,6 +102,7 @@ func TestLiveCollectorNormalizationWithMockedAPI(t *testing.T) {
 		inv.Assets.Dashboards[0].EvidenceRef,
 		inv.Assets.Monitors[0].EvidenceRef,
 		inv.Assets.SLOs[0].EvidenceRef,
+		inv.Assets.Integrations[0].EvidenceRef,
 	} {
 		path, err := evidence.PathForRef(projectDir, ref)
 		if err != nil {
@@ -103,6 +122,29 @@ func TestLiveCollectorNormalizationWithMockedAPI(t *testing.T) {
 	}
 }
 
+func TestCollectIntegrationsReturnsWarningFriendlyError(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		if r.URL.Path == "/api/v2/integrations" {
+			w.WriteHeader(http.StatusForbidden)
+			_, _ = w.Write([]byte(`{"errors":["missing integrations_read"]}`))
+			return
+		}
+		http.NotFound(w, r)
+	}))
+	defer server.Close()
+
+	client := &Client{baseURL: server.URL, apiKey: "api", appKey: "app", http: server.Client()}
+	inv := inventory.New("demo", "datadog", "datadoghq.eu", "test", time.Unix(0, 0))
+	err := collectIntegrations(context.Background(), client, t.TempDir(), inv)
+	if err == nil || !strings.Contains(err.Error(), "collect integrations") {
+		t.Fatalf("expected contextual integration collection error, got %v", err)
+	}
+	if len(inv.Assets.Integrations) != 0 {
+		t.Fatalf("expected no integration assets on failed collection, got %+v", inv.Assets.Integrations)
+	}
+}
+
 func TestDatadogBaseURLValidation(t *testing.T) {
 	for _, site := range []string{"datadoghq.com", "datadoghq.eu", "us3.datadoghq.com", "us5.datadoghq.com", "ap1.datadoghq.com", "ap2.datadoghq.com"} {
 		if _, err := datadogBaseURL(site); err != nil {
@@ -126,6 +168,15 @@ func metricByName(metrics []inventory.MetricRef, name string) *inventory.MetricR
 	return nil
 }
 
+func integrationByName(integrations []inventory.Integration, name string) *inventory.Integration {
+	for i := range integrations {
+		if integrations[i].Name == name {
+			return &integrations[i]
+		}
+	}
+	return nil
+}
+
 func hasAll(values []string, expected ...string) bool {
 	seen := map[string]struct{}{}
 	for _, value := range values {

internal/evidence/refs.go

@@ -25,6 +25,8 @@ func PathForRef(projectDir, ref string) (string, error) {
 		dir = "monitors"
 	case "slo":
 		dir = "slos"
+	case "integration":
+		dir = "integrations"
 	case "repository":
 		dir = "repositories"
 	case "team":