Datadog

Datadog is a comprehensive cloud-scale monitoring, observability, and security platform that provides real-time visibility into infrastructure, applications, logs, and security posture. It enables organizations to monitor performance metrics, track key performance indicators (KPIs), detect security threats, analyze log data, and manage alerts across their entire technology stack.

Category	Observability
Direction	Query source
Sign-in	API and Application Keys
Query languages	STIX, SQLite
Tables	12
Query templates	38
Website	datadog.com

Before you start

Huntbase signs in to Datadog with API and Application Keys. Create the credential in Datadog first, then keep it to hand for the Connect step.

1. In Datadog, go to Organization Settings › API Keys, click New Key, enter a name and click Create API key.
2. Go to Organization Settings › Application Keys, click New Key, enter a name and click Create.
3. Copy the application key immediately. If One-Time Read mode is on, you can't retrieve it later.

Watch out for

• To create an application key for yourself you need the user_app_keys permission.
• An application key has the permissions of the user who created it. Create it as a user with read-only access, or restrict it with scopes, to keep access least-privilege.

For the vendor's own instructions, see Datadog API and application keys documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Datadog

1. Go to Connections and click New connection, or click New connection on the Datadog product page.
2. On Product, pick Datadog and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings

Where your Datadog lives:

Field	Required	Notes
Site URL	Yes	The URL you sign in to Datadog with, such as https://app.datadoghq.com, https://us5.datadoghq.com or https://app.datadoghq.eu.
Self-Signed Cert (PEM)	No	Provide a self-signed or CA-signed certificate to securely communicate with the data source.
API URL	No	The API URL for your site. Defaults to https://api.datadoghq.com/. For the EU site, use https://api.datadoghq.eu/. Don't add /api/ to the end.

Credentials

The only Method is API and Application Keys. Enter a Credential label (for example Production), then fill in:

Field	Required	Notes
API Key	Yes	Api key of Datadog. Secret — not shown again after you save it.
Application Key	Yes	Application key of Datadog. Secret — not shown again after you save it.

Query it

Once connected, Datadog can serve these languages in a query tab, and Scout can use it when you ask in Auto:

Language	Use it for
STIX	STIX patterns for indicator sweeps, translated into the product's native search.
SQLite	SQL over the 12 tables listed below, alongside every other connected source.

Example: SQLite

Datadog roles basic info — List all roles created in a Datadog account, including their names, IDs, and creation timestamps.

select
  name,
  id,
  created_at
from
  datadog_role;

Datadog ships with 38 query templates. Find them in Library › Queries — see Query templates.

Tables

Datadog adds 12 tables. Browse their columns from Schema in the query bar's ⋯ menu.

All 12 tables

Table	Contains
datadog_dashboard	A dashboard is Datadog’s tool for visually tracking, analyzing, and displaying key performance metrics.
datadog_host	A host is any piece of infrastructure that runs an instance of the Datadog Agent such as a bare metal instance or a VM.
datadog_integration_aws	Datadog AWS integration resource.
datadog_log_event	Datadog log events are records of notable changes in your environments.
datadog_logs_metric	Log-based metrics are a cost-efficient way to summarize log data from the entire ingest stream.
datadog_monitor	A monitor provides alerts and notifications if a specific metric is above or below a certain threshold.
datadog_permission	Permissions provide the base level of access for roles.
datadog_role	Roles categorize users and define what account permissions those users have.
datadog_security_monitoring_rule	Security monitoring rules define conditional logic that is applied to all ingested logs and cloud configurations.
datadog_security_monitoring_signal	Signals are threats detected based on a security monitoring rule.
datadog_service_level_objective	An SLO(Service Level Objective) provides a target percentage of a specific metric over a certain period of time.
datadog_user	A user belongs to an organization and can be assigned roles.

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog