slug: datadog provider: Datadog generated_by: planning/capability-mapping/scripts/classify_capabilities.py model: claude-opus-5 frame: - Banking & Capital Markets - Software & Technology min_confidence: 0.7 capability_model: source: https://github.com/vincentmakes/turbo-ea-capabilities license: CC-BY-4.0 attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0 notice: NOTICE edge_count: 30 edges: - tag: Detection spec_file: datadog-detection-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.85 evidence: POST /api/v2/security_monitoring/rules/validation ValidateSecurityMonitoringRule 'Validate a Detection Rule' reason: Schemas such as SecurityMonitoringRuleValidatePayload, SecurityMonitoringRuleSeverity and CloudConfigurationRegoRule show this is security detection rule authoring/validation — SIEM-style threat detection, i.e. Threat Detection & Response Management. Not financial-crime alerting despite the 'Detection' noun. - tag: Grants spec_file: datadog-grants-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: POST /api/v2/roles/{role_id}/permissions AddPermissionToRole 'Grant Permission to a Role'; RelationshipToPermission reason: Operations grant permissions to roles and roles to restriction queries — authorisation/access administration, i.e. identity and access management. - tag: Logs spec_file: datadog-logs-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.85 evidence: POST /api/v2/logs SubmitLog Datadog Send Logs; POST /api/v2/logs/events/search ListLogs reason: Submitting and searching log events for running services is squarely observability management. - tag: Metrics spec_file: datadog-metrics-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.85 evidence: POST /api/v2/series SubmitMetrics 'Submit Metrics'; 'Query Timeseries Data'; LogsMetricUpdateRequest, SpansMetricUpdateData reason: Operations submit and query time-series metrics and configure log/span/RUM-based metrics — telemetry that makes the running service understandable, i.e. observability management for a monitoring vendor. - tag: Monitors spec_file: datadog-monitors-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.85 evidence: POST /api/v1/monitor 'Create a Monitor'; 'monitors that watch a metric or check and notify your team when a defined threshold has been exceeded' reason: Full CRUD over monitors that watch metrics/checks and alert teams — core observability/monitoring capability of the platform. - tag: Observability spec_file: datadog-observability-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.85 evidence: POST /api/v2/remote_config/products/obs_pipelines/pipelines/validate 'Validate an Observability Pipeline'; ObservabilityPipelineConfig, ObservabilityPipelineFilterProcessor reason: Validates observability pipeline configuration for routing/processing logs and metrics — directly observability management (logs, metrics, traces plumbing). - tag: Cloud spec_file: datadog-cloud-api-openapi.yml capability_id: BC-600.80 capability_id_l1: BC-600 capability_name: IT Financial Management confidence: 0.8 evidence: '"List Cloud Cost Management Aws Cur Configs", "Create Cloud Cost Management Azure Configs"' reason: Operations configure ingestion of AWS Cost & Usage Reports and Azure usage/cost data for Cloud Cost Management — IT spend visibility and cost optimisation, i.e. IT Financial Management. - tag: Log Aggregation spec_file: datadog-log-aggregation-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.8 evidence: POST /api/v2/logs/analytics/aggregate aggregateLogs Datadog Aggregate Logs; LogsAggregateRequest, LogsGroupBy, LogsCompute reason: Aggregating and querying log events from the Log Management product is core observability (logs, metrics, traces) of running services. - tag: Monitor Muting spec_file: datadog-monitor-muting-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.8 evidence: POST /api/v1/monitor/{monitor_id}/mute 'Mute a Monitor'; MonitorMuteSettings; 'monitors that watch a metric or check and notify your team when a defined threshold has been exceeded' reason: Muting/unmuting monitors is operational control of production monitoring and alert noise — observability management, not any business alerting domain. - tag: Permissions spec_file: datadog-permissions-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: DELETE /api/v2/roles/{role_id}/permissions 'Revoke Permission'; PUT /api/v2/team/{team_id}/permission-settings/{action} 'Update Permission Setting for Team' reason: Operations manage role and team permissions/authorisation within the platform — identity and access management. - tag: Assignee spec_file: datadog-assignee-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.78 evidence: PATCH /api/v2/security_monitoring/signals/{signal_id}/assignee — "Modify the Triage Assignee of a Security Signal" reason: Triage assignment of security monitoring signals is SOC/SIEM alert handling — threat detection and response, not financial-crime alerting. - tag: Historical spec_file: datadog-historical-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.78 evidence: POST /api/v2/siem-historical-detections/jobs RunHistoricalJob; schemas SecurityMonitoringRuleSeverity, SecurityMonitoringStandardDataSource reason: Operations run historical SIEM detection jobs against security monitoring rules — SOC/SIEM detection work, i.e. threat detection and response, not generic monitoring or financial-crime alerting. - tag: Role spec_file: datadog-role-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.78 evidence: PATCH /api/v2/roles/{role_id} 'Update a Role'; schemas RoleUpdateAttributes, RelationshipToPermissions reason: Operation updates a role and its permission relationships within the platform, which is role-based access administration. - tag: Agent spec_file: datadog-agent-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.75 evidence: POST /api/v2/remote_config/products/cws/agent_rules — "Create a Workload Protection Agent Rule"; schema CloudWorkloadSecurityAgentRuleKill reason: Operations manage cloud workload security (CWS) agent detection rules — runtime threat detection rules for workloads, i.e. security threat detection tooling configuration, not monitoring of business processes. - tag: Cost spec_file: datadog-cost-api-openapi.yml capability_id: BC-600.80 capability_id_l1: BC-600 capability_name: IT Financial Management confidence: 0.75 evidence: GET /api/v2/cost_by_tag/monthly_cost_attribution — "Get Monthly Cost Attribution" reason: Retrieves monthly cost attribution by tag for observability/cloud spend — chargeback/showback style IT cost reporting. Single operation, hence moderate confidence. - tag: Log Indexes spec_file: datadog-log-indexes-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.75 evidence: 'GET /api/v1/logs/config/indexes listLogIndexes; description: ''managing log indexes, which control how long logs are retained and queried''' reason: Configuration of log indexes and retention/exclusion filters is part of operating the log telemetry pipeline, i.e. observability management. - tag: Monitor Validation spec_file: datadog-monitor-validation-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.75 evidence: POST /api/v1/monitor/validate 'Validate a Monitor'; MonitorThresholds, MonitorOptions reason: Validates monitor definitions (metric thresholds, checks) used to watch running services — configuration of production monitoring. - tag: Pages spec_file: datadog-pages-api-openapi.yml capability_id: BC-4220.30 capability_id_l1: BC-4220 capability_name: Incident Response Management confidence: 0.75 evidence: POST /api/v2/on-call/pages/{page_id}/resolve 'Resolve On-call Page' reason: Resolving an on-call page is part of on-call/incident response workflow, not web page content management. - tag: Incident spec_file: datadog-incident-api-openapi.yml capability_id: BC-4220.30 capability_id_l1: BC-4220 capability_name: Incident Response Management confidence: 0.74 evidence: PATCH /api/v2/incidents/config/types/{incident_type_id} UpdateIncidentType; UpdateIncidentTodo with IncidentTodoAssignee reason: 'Datadog incident management: incident types and per-incident action items with assignees, used for coordinating production incident response. Could alternatively be read as ITSM incident management (BC-600.30), hence moderate confidence on the sub-capability.' - tag: Change spec_file: datadog-change-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.72 evidence: PATCH /api/v2/security_monitoring/signals/{signal_id}/state — "Change the Triage State of a Security Signal" reason: Operations triage security monitoring signals and link them to incidents — SIEM/SOC detection-and-response work, not business alerting. Mapped to Threat Detection & Response with moderate confidence given the tag is a bare verb. - tag: Escalate spec_file: datadog-escalate-api-openapi.yml capability_id: BC-4220.30 capability_id_l1: BC-4220 capability_name: Incident Response Management confidence: 0.72 evidence: POST /api/v2/on-call/pages/{page_id}/escalate EscalateOnCallPage 'Datadog Escalate On-call Page' reason: Escalates an on-call page to the next responder — squarely on-call/incident response coordination for a running service. Only one operation and no domain schemas, so confidence is moderate; an ITSM incident reading is also possible. - tag: Metric Metadata spec_file: datadog-metric-meta-data-api-openapi.yml reanchored_from: datadog-metric-metadata-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.72 evidence: GET /api/v1/metrics listActiveMetrics; MetricsListResponse reason: Listing active metrics in the monitoring platform serves observability of production services; thin single-operation surface so moderate confidence. - tag: Metric Tags spec_file: datadog-metric-tags-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.72 evidence: POST /api/v2/metrics/{metric_name}/tags createMetricTagConfiguration Datadog Create a Tag Configuration reason: Manages tag configurations for time-series metrics in the monitoring platform — configuration of the metrics telemetry surface, mapped to observability management. - tag: Aggregate spec_file: datadog-aggregate-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.7 evidence: POST /api/v2/logs/analytics/aggregate AggregateLogs; POST /api/v2/spans/analytics/aggregate AggregateSpans reason: Aggregation queries over logs, spans, RUM and CI events — analytical access to observability telemetry of the running service. - tag: Budget spec_file: datadog-budget-api-openapi.yml capability_id: BC-600.80 capability_id_l1: BC-600 capability_name: IT Financial Management confidence: 0.7 evidence: 'PUT /api/v2/cost/budget UpsertBudget Create or Update a Budget; schemas: BudgetAttributes, BudgetEntry, TagFilter' reason: Cloud cost budgets under /api/v2/cost/ — setting and tracking technology spend budgets, i.e. IT financial management (cloud cost/showback), not enterprise FP&A budgeting. - tag: Budgets spec_file: datadog-budgets-api-openapi.yml capability_id: BC-600.80 capability_id_l1: BC-600 capability_name: IT Financial Management confidence: 0.7 evidence: 'GET /api/v2/cost/budgets ListBudgets List Budgets; schemas: BudgetAttributes, BudgetEntry' reason: Listing of cloud cost budgets (Datadog Cloud Cost Management), which is IT spend/cost management rather than corporate budgeting. - tag: Ip spec_file: datadog-ip-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: PATCH /api/v2/ip_allowlist UpdateIPAllowlist; IPAllowlistEntryAttributes reason: Manages an IP allowlist controlling which networks may access the organisation's account — an access-control mechanism, mapped to Identity & Access Management; thin surface so moderate confidence. - tag: Pipelines spec_file: datadog-pipelines-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.7 evidence: PUT /api/v2/remote_config/products/obs_pipelines/pipelines/{pipeline_id} 'Update a Pipeline'; schemas ObservabilityPipelineConfig, ObservabilityPipelineDatadogAgentSource reason: Operations configure Datadog 'observability pipelines' that ingest, process and route logs/metrics to destinations — telemetry collection for understanding running services, i.e. Observability Management, not any business data pipeline. - tag: Remove spec_file: datadog-remove-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: DELETE /api/v2/roles/{role_id}/users 'Remove a User from a Role'; 'Remove a User from a Team'; schemas Role, Permission, RelationshipToPermissions reason: Despite the verb-shaped tag, the operations manage user-to-role and user-to-team assignments with permission relationships, which is identity and access administration. - tag: Routing spec_file: datadog-routing-api-openapi.yml capability_id: BC-4220.30 capability_id_l1: BC-4220 capability_name: Incident Response Management confidence: 0.7 evidence: PUT /api/v2/on-call/teams/{team_id}/routing-rules 'Set On-call Team Routing Rules'; schemas Urgency, SendSlackMessageAction, TimeRestrictions reason: Configures how on-call pages are routed to teams with urgency and notification actions — on-call response and incident notification, i.e. Incident Response Management.