[SEC-36059] Add Anomali ThreatStream Account Config

[seohyunh]

What does this PR do?

Adds the Anomali ThreatStream account_config.json asset used to generate the AMS account setup UI.

The schema defines the ThreatStream domain, email, API key, and default-enabled domain, IP address, and SHA256 indicator collection options. Its keys, labels, validation, defaults, and dataflow ID match the crawler-sdk configuration contract.

Motivation

Completes the AMS account configuration schema for the Anomali ThreatStream threat intelligence integration under SEC-36059.

This PR depends on:

• DataDog/crawler-sdk#1402, which declares these fields and the dataflow as in-development crawler dependencies.
• DDS: Anomali ThreatStream: Threat Intel Integration v1.0.0 #23345, which adds the referenced anomali-threatstream-threat-intel-feed dataflow and the remaining integration assets.

This PR should remain draft until both dependencies are ready.

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add qa/required if this PR needs QA validation, or qa/skip-qa if it does not. Exactly one of the two is required. (qa/skip-qa: this asset does not ship with the Datadog Agent.)
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

[cit-pr-commenter-54b7da]

evalya-impact-summary

evalya impact analysis

Impact analysis: 0 selected, 0 skipped (of 0 test tasks)
Publish tasks:   1 (always emitted)
Diff (1 file):
  anomali_threatstream/assets/account_config.json

Debug a specific task: evalya plan impact --path <path> --task <task>

Learn more about CI impact filtering

[datadog-datadog-prod-us1-2]

More details

The added account schema’s fields and defaults align with repository conventions, and its dataflow ID resolves to the existing Anomali ThreatStream dataflow.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit bf55aff · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[dd-octo-sts]

Validation Report

All 21 validations passed.

Show details

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
license-headers	Validate Python files have proper license headers	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
models	Validate configuration data models match spec.yaml	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata and naming	✅
qa-label	Validate the pull request declares whether it needs QA for the next Agent release	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run