From 663a6e849bd2bf141ca79ef82020f6777575a546 Mon Sep 17 00:00:00 2001
From: Vijay Oommen <voommen@livefront.com>
Date: Mon, 23 Feb 2026 17:00:05 -0600
Subject: [PATCH] [PM-31725] updated template for HEC and datadog (#18819)

---
 .../datadog-template.ts                       | 16 ++++++++++----
 .../configuration-template/hec-template.ts    | 22 ++++++++++---------
 2 files changed, 24 insertions(+), 14 deletions(-)

diff --git a/bitwarden_license/bit-common/src/dirt/organization-integrations/models/integration-configuration-config/configuration-template/datadog-template.ts b/bitwarden_license/bit-common/src/dirt/organization-integrations/models/integration-configuration-config/configuration-template/datadog-template.ts
index b5816ba34a2..5f642dd6503 100644
--- a/bitwarden_license/bit-common/src/dirt/organization-integrations/models/integration-configuration-config/configuration-template/datadog-template.ts
+++ b/bitwarden_license/bit-common/src/dirt/organization-integrations/models/integration-configuration-config/configuration-template/datadog-template.ts
@@ -14,19 +14,27 @@ export class DatadogTemplate implements OrgIntegrationTemplate {
       ddsource: "bitwarden",
       service: "event-logs",
       event: {
-        service: "payments",
         object: "event",
-        type: "#Type#",
+        type: "#TypeId#",
+        typeName: "#Type#",
+        memberId: "#UserId#",
+        organizationId: "#OrganizationId#",
+        providerId: "#ProviderId#",
         itemId: "#CipherId#",
         collectionId: "#CollectionId#",
         groupId: "#GroupId#",
         policyId: "#PolicyId#",
-        memberId: "#UserId#",
+        organizationUserId: "#OrganizationUserId#",
+        providerUserId: "#ProviderUserId#",
+        providerOrganizationId: "#ProviderOrganizationId#",
         actingUserId: "#ActingUserId#",
         installationId: "#InstallationId#",
         date: "#DateIso8601#",
-        device: "#DeviceType#",
+        deviceType: "#DeviceType#",
+        device: "#DeviceTypeId#",
         ipAddress: "#IpAddress#",
+        systemUser: "#SystemUser#",
+        domainName: "#DomainName#",
         secretId: "#SecretId#",
         projectId: "#ProjectId#",
         serviceAccountId: "#ServiceAccountId#",
diff --git a/bitwarden_license/bit-common/src/dirt/organization-integrations/models/integration-configuration-config/configuration-template/hec-template.ts b/bitwarden_license/bit-common/src/dirt/organization-integrations/models/integration-configuration-config/configuration-template/hec-template.ts
index 3c0cf3b9b35..2da8624c66f 100644
--- a/bitwarden_license/bit-common/src/dirt/organization-integrations/models/integration-configuration-config/configuration-template/hec-template.ts
+++ b/bitwarden_license/bit-common/src/dirt/organization-integrations/models/integration-configuration-config/configuration-template/hec-template.ts
@@ -17,27 +17,29 @@ export class HecTemplate implements OrgIntegrationTemplate {
       service: "event-logs",
       event: {
         object: "event",
-        type: "#Type#",
+        type: "#TypeId#",
+        typeName: "#Type#",
+        memberId: "#UserId#",
+        organizationId: "#OrganizationId#",
+        providerId: "#ProviderId#",
         itemId: "#CipherId#",
         collectionId: "#CollectionId#",
         groupId: "#GroupId#",
         policyId: "#PolicyId#",
-        memberId: "#UserId#",
+        organizationUserId: "#OrganizationUserId#",
+        providerUserId: "#ProviderUserId#",
+        providerOrganizationId: "#ProviderOrganizationId#",
         actingUserId: "#ActingUserId#",
         installationId: "#InstallationId#",
         date: "#DateIso8601#",
-        device: "#DeviceType#",
+        deviceType: "#DeviceType#",
+        device: "#DeviceTypeId#",
         ipAddress: "#IpAddress#",
+        systemUser: "#SystemUser#",
+        domainName: "#DomainName#",
         secretId: "#SecretId#",
         projectId: "#ProjectId#",
         serviceAccountId: "#ServiceAccountId#",
-        actingUserName: "#ActingUserName#",
-        actingUserEmail: "#ActingUserEmail#",
-        actingUserType: "#ActingUserType#",
-        userName: "#UserName#",
-        userEmail: "#UserEmail#",
-        userType: "#UserType#",
-        groupName: "#GroupName#",
       },
     };