Observability and IT

Checks whether SAML SSO is both enabled and enforced in strict mode, which disables password-based login, for a Datadog organization. Calls the Datadog Organizations API, authenticated with two headers, DD-API-KEY and DD-APPLICATION-KEY, and reads settings.saml.enabled and settings.saml.strict_mode.enabled.

apiKey, appKey

a Datadog API key and application key pair with permission to read organization settings.

publicId (optional)

omit it to use the calling account's first organization. The target is the organization's public ID, or a site-qualified label when omitted.

SAML enabled alone means SSO is available, not enforced. Users can still log in with a password unless strict mode is also on, so this check requires both to pass. A 401 or 403 response is reported as needs-review, never fail.

Checks whether every host registered in a CrowdStrike Falcon organization has an actively-reporting sensor. Exchanges a client ID and secret for a bearer token at POST /oauth2/token, then reads each host's last check-in time from the Falcon device entity.

clientId, clientSecret

a CrowdStrike API client credential pair. The target is a fixed label for the tenant's host fleet.

A sensor counts as healthy when it has checked in within a bounded recent window, the common proxy for endpoint coverage, since the device entity has no single healthy boolean of its own. A 401 or 403 response is reported as needs-review, never fail.

Checks whether an enabled IP allowlist with configured CIDR ranges exists for a PagerDuty account. Calls GET /ip_allow_lists, authenticated with Authorization: Token token={apiKey}, and reads whether the returned list's state is enabled.

apiKey

a PagerDuty REST API v2 key. The target is a fixed label for the account.

This is an early-access PagerDuty API and requires an X-EARLY-ACCESS: ip-allow-lists header on every request. A 403 can mean either bad credentials or an account not enrolled in the early-access program, so it is reported as needs-review, never fail. PagerDuty's public API has no SSO or MFA enforcement endpoint, so this check verifies IP allowlisting instead, a real, checkable access-control setting.

Checks whether the instance-wide multi-factor authentication system property is enabled for a ServiceNow instance. Calls GET https://{instanceHostname}/api/now/table/sys_properties for the glide.authenticate.multifactor property, authenticated with HTTP Basic auth using an instance username and password.

instanceHostname

the ServiceNow instance hostname, also used as the target.

username, password

ServiceNow credentials with an elevated role, typically security_admin or admin, needed to read this property.

A 401 or 403 response can mean bad credentials or a role gap, and is reported as needs-review either way, never fail.

Checks whether two-factor authentication is enforced for agents on a Zendesk account. Calls GET https://{subdomain}.zendesk.com/api/v2/security_settings and reads security_settings.authentication.agent.two_factor_enforce, authenticated with HTTP Basic auth using {email}/token as the username and an API token as the password.

subdomain

the Zendesk account subdomain. The target is {subdomain}.zendesk.com.

email, apiToken

an admin agent's email and API token. This endpoint is admin-only.

A 401 or 403 response is reported as needs-review, never fail.