Update Observability Pipelines Packs documentation for full catalog - #38795
Closed
daniellepark-datadog wants to merge 1 commit into
Closed
Update Observability Pipelines Packs documentation for full catalog#38795daniellepark-datadog wants to merge 1 commit into
daniellepark-datadog wants to merge 1 commit into
Conversation
Adds individual pack pages and card images for packs not yet documented, and updates the packs index page to list all available packs alphabetically.
Contributor
domalessi
reviewed
Aug 5, 2026
Contributor
There was a problem hiding this comment.
Thanks for the PR!
Higher-level notes:
- Many new overview paragraphs use telegraphic sentence fragments instead of full declarative sentences. Recommend a batch pass across ~16 affected pages, using existing pack pages (for example, Cisco ASA) as the model.
- Confirm that omitting left-nav entries for the new pages is intentional. On
master, only a subset of pack pages appear inmain.en.yaml; the rest are discoverable from the Packs index.
A handful of suggestions inline as well.
|
|
||
| {{< img src="observability_pipelines/packs/palo_alto_microsoft_sentinel.png" alt="The Palo Alto Networks - Microsoft Sentinel pack" style="width:25%;" >}} | ||
|
|
||
| PAN-OS logs capture firewall traffic, threat, configuration changes, and endpoint activity across devices. |
Contributor
There was a problem hiding this comment.
The page title scopes this pack to Microsoft Sentinel, but the overview reads like generic PAN-OS documentation and never mentions Sentinel or CommonSecurityLog mapping.
Suggested change
| PAN-OS logs capture firewall traffic, threat, configuration changes, and endpoint activity across devices. | |
| Maps PAN-OS logs to the CommonSecurityLog schema in Microsoft Sentinel. |
|
|
||
| - Maps FortiGate traffic logs to CommonSecurityLog | ||
| - Remaps UTM, IPS, VPN, and auth events to CommonSecurityLog | ||
| - Detects FortiGate logs arriving directly from Microsoft Sentinel |
Contributor
There was a problem hiding this comment.
Confirm intended behavior with the pack owner before merging. FortiGate logs are typically sent to Sentinel, not detected as arriving from Sentinel.
Suggested change
| - Detects FortiGate logs arriving directly from Microsoft Sentinel | |
| - Maps FortiGate UTM, IPS, VPN, and auth events to CommonSecurityLog |
|
|
||
| {{< img src="observability_pipelines/packs/gcp_firewall.png" alt="The GCP Firewall pack" style="width:25%;" >}} | ||
|
|
||
| GCP VPC Firewall logs traffic allowed and denied. |
Contributor
There was a problem hiding this comment.
Suggested change
| GCP VPC Firewall logs traffic allowed and denied. | |
| GCP VPC Firewall logs record allowed and denied traffic. |
Comment on lines
+14
to
+16
| - Keeps detections and enforcement logs | ||
| - Drops redundant and benign events | ||
| - Normalizes traffic, threat, and system fields |
Contributor
There was a problem hiding this comment.
These bullets describe generic PAN-OS filtering, not Sentinel/CommonSecurityLog mapping. Parallel sibling Sentinel packs like cisco_asa_microsoft_sentinel.md.
Suggested change
| - Keeps detections and enforcement logs | |
| - Drops redundant and benign events | |
| - Normalizes traffic, threat, and system fields | |
| - Maps PAN-OS traffic logs to CommonSecurityLog | |
| - Remaps threat, config, and system logs to CommonSecurityLog | |
| - Normalizes traffic, threat, and system fields for Sentinel ingestion |
|
|
||
| {{< img src="observability_pipelines/packs/active_directory.png" alt="The Active Directory pack" style="width:25%;" >}} | ||
|
|
||
| AD DS Kerberos authentication, directory-service changes, and DCSync replication abuse events. |
Contributor
There was a problem hiding this comment.
Suggested change
| AD DS Kerberos authentication, directory-service changes, and DCSync replication abuse events. | |
| This pack processes Active Directory Domain Services events, including Kerberos authentication, directory-service changes, and DCSync replication abuse. |
|
|
||
| {{< img src="observability_pipelines/packs/cisco_asa_google_secops.png" alt="The Cisco ASA - Google SecOps pack" style="width:25%;" >}} | ||
|
|
||
| Maps syslog events to the UDM schema in Google Security Operations. |
Contributor
There was a problem hiding this comment.
Suggested change
| Maps syslog events to the UDM schema in Google Security Operations. | |
| This pack maps Cisco ASA syslog events to the UDM schema in Google Security Operations. |
| What this pack does: | ||
|
|
||
| - Normalizes ASA codes | ||
| - Dedupes repeated logs |
Contributor
There was a problem hiding this comment.
Suggested change
| - Dedupes repeated logs | |
| - Deduplicates repeated logs |
|
|
||
| {{< img src="observability_pipelines/packs/microsoft_dns.png" alt="The Microsoft DNS pack" style="width:25%;" >}} | ||
|
|
||
| Classic Windows DNS Server debug text log (dns.log) with decoded query names and response codes. |
Contributor
There was a problem hiding this comment.
Suggested change
| Classic Windows DNS Server debug text log (dns.log) with decoded query names and response codes. | |
| This pack parses the classic Windows DNS Server debug text log (dns.log) and decodes query names and response codes. |
|
|
||
| {{< img src="observability_pipelines/packs/argo_cd.png" alt="The Argo CD pack" style="width:25%;" >}} | ||
|
|
||
| Argo CD sync, health, and RBAC events from the application controller and API server. |
Contributor
There was a problem hiding this comment.
Same fragment pattern appears on ~12 other new pages (azure_nsg.md, bluecat_dns.md, dns_stream.md, Google SecOps mapping pages, etc.).
Suggested change
| Argo CD sync, health, and RBAC events from the application controller and API server. | |
| This pack processes Argo CD sync, health, and RBAC events from the application controller and API server. |
2 tasks
Contributor
|
[Automated message] This PR has merge conflicts caused by the recent docs repo reorg (files moved from the repo root into Please follow the instructions in the PR description. This is an automated comment, but if you have a question, you can mention me in this PR (external contributors) or reach out in #docs-repo-reorg-support on Slack (internal contributors). |
jhgilbert
added
astro-reorg-autofixed
daniellepark-datadog
added a commit
that referenced
this pull request
Aug 6, 2026
Addresses review feedback on PR #38795: several new pack overview paragraphs read as noun-phrase fragments or subjectless "Maps X to Y" constructions instead of full declarative sentences. Also fixes a duplicate/illogical bullet on the Fortinet - Microsoft Sentinel pack and a wording nit on Exabeam - Cisco ASA.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do? What is the motivation?
Updates the Observability Pipelines Packs documentation to reflect the full current catalog of packs.
_index.mdto include all packs, sorted alphabeticallyMerge readiness
For Datadog employees:
<name>/<description>convention and include the forward slash (/). If you've already created your PR with an incorrect branch name, please rename your branch and open a fresh PR./reviewto run an automated check that catches common issues before a Documentation team member reviews your PR.AI assistance
Used Claude Code to help generate new pack pages from provided pack descriptions/screenshots, crop card images, and regenerate the sorted packs list in
_index.md.Additional notes