From 594abd8b665d5eb698e6e1657326ab78d10e3e11 Mon Sep 17 00:00:00 2001
From: SeoHyun Hwang <seohyun.hwang@datadoghq.com>
Date: Mon, 17 Aug 2026 16:56:29 -0400
Subject: [PATCH 1/2] add anomali threatstream account config

---
 .../assets/account_config.json                | 64 +++++++++++++++++++
 1 file changed, 64 insertions(+)
 create mode 100644 anomali_threatstream/assets/account_config.json

diff --git a/anomali_threatstream/assets/account_config.json b/anomali_threatstream/assets/account_config.json
new file mode 100644
index 0000000000000..fab4de8614de1
--- /dev/null
+++ b/anomali_threatstream/assets/account_config.json
@@ -0,0 +1,64 @@
+{
+  "supported_auth_methods": [],
+  "additional_config_fields": [
+    {
+      "key": "api_domain",
+      "label": "Domain",
+      "editable": true,
+      "required": true,
+      "domain": {
+        "pattern": "^(?:[a-zA-Z0-9-]+\\.)*threatstream\\.com$"
+      }
+    },
+    {
+      "key": "email",
+      "label": "Email",
+      "editable": true,
+      "required": true,
+      "text": {}
+    },
+    {
+      "key": "api_key",
+      "label": "API Key",
+      "editable": true,
+      "required": true,
+      "password": {}
+    },
+    {
+      "key": "domain_risk_enabled",
+      "label": "Collect Domain Indicators (Threat Intel Feed)",
+      "help": "Enrich logs with Anomali ThreatStream domain indicators data",
+      "editable": true,
+      "required": false,
+      "checkbox": {
+        "default": true
+      }
+    },
+    {
+      "key": "ip_risk_enabled",
+      "label": "Collect IP Address Indicators (Threat Intel Feed)",
+      "help": "Enrich logs with Anomali ThreatStream ip address indicators data",
+      "editable": true,
+      "required": false,
+      "checkbox": {
+        "default": true
+      }
+    },
+    {
+      "key": "hash_risk_enabled",
+      "label": "Collect hash SHA256 Indicators (Threat Intel Feed)",
+      "help": "Enrich logs with Anomali ThreatStream hash SHA256 indicators data",
+      "editable": true,
+      "required": false,
+      "checkbox": {
+        "default": true
+      }
+    }
+  ],
+  "dataflow_config": [
+    {
+      "dataflow_id": "anomali-threatstream-threat-intel-feed",
+      "additional_config_fields": []
+    }
+  ]
+}

From 16f25d412c49593b06f0ae9295618a8b800b3462 Mon Sep 17 00:00:00 2001
From: SeoHyun Hwang <seohyun.hwang@datadoghq.com>
Date: Mon, 24 Aug 2026 10:48:21 -0400
Subject: [PATCH 2/2] ci: retrigger checks