Stream the audit events to Datadog

Send every audit event to Datadog Logs as it happens.

In short

Connect Datadog once. Every audit event of the organization is then sent to Datadog Logs, signed and retried.

Before you start

• Who: someone who may manage the organization's connections - owners and admins have it by default.
• Plan: the audit stream comes with the Enterprise plan, and the 14-day trial has it.
• First: in Datadog, "Organization Settings" › "API Keys", a key made for {{brand}}.

Where it lives

1. Open your organization, then Settings › "Connections", and press "Stream the audit events".
2. Choose "Datadog". The wizard opens; each step is checked before the next one opens.
3. Read what you need and press "Next".
4. Type the "Datadog site" from your Datadog address, such as datadoghq.eu or us5.datadoghq.com. Leave it empty for datadoghq.com.
5. Optional: type the "Service" the logs should carry.
6. Press "Check this step", then "Next".

Sign in

1. Press "Open the token page". In "API Keys" press "New Key", name it, and copy the key.
2. Paste it into "API key" - an API key, not an application key - and press "Check this step". A test event shows in "Logs" › "Explorer".
3. Press "Next".

Check and use

1. Press "Run the full check". It sends one more test event; every step should say Passed.
2. Check the "Name" and press "Finish". The audit stream shows under "Audit stream" with its health.
3. From then on every audit event is sent as it happens. "Deliveries" on the row lists what was sent and what the destination answered.

If a step fails

• "Test event" failed: the destination did not take the event. Check the address and the token or key, and that the site is the one in your Datadog address.
• "Where it lives" failed: the address is not https, or it is a private address your installation does not reach.
• Change what the step says and press "Check again". Closing the wizard keeps every step that passed; "Continue setup" on the row goes on.

Good to know

• Only audit events are sent - who did what and when, with the record's kind and id - never your records' content.
• Every page of events is signed and retried until the destination takes it. A destination that stays down turns the row's health to Down and says so.
• One audit stream per organization. To move it, disconnect it and connect the new one.
• Plan: the audit stream comes with the Enterprise plan, and the 14-day trial has it.

Related

• /help/settings/fix-a-company-connection
• /help/settings/scim-entra-id