> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/system-management/settings/connectors/siem-and-soar-connectors/datadog.md).

# Datadog

You can send these DoControl entities to your organization's consolidated event management system for further investigation, data aggregation, and monitoring:

* **Alerts** - Investigate alerts in Datadog and remediate in the DoControl platform when necessary.
* **Workflows** - A JSON structured log is sent to Datadog, containing a synthetic high-level summary of each workflow execution. The log includes the workflow name, actor, event type, app, execution duration, and execution path.
* **SaaS events** -  Select the relevant app and event types to send to Datadog.

{% hint style="warning" %}

* Sending events and workflows to your SIEM increases the volume of generated logs and might impact your SIEM cost.
* DoControl sends logs for event-triggered workflows only, not for on-demand, scheduled, or alert-triggered workflows.
  {% endhint %}

To push DoControl data downstream to the Datadog alert and event pipeline and display them in the collection board, you need to:

1. [Generate an API key in Datadog](#generate-api-key-in-datadog)
2. [Connect to Datadog SIEM in DoControl](#connect-to-datadog-siem-in-docontrol)
3. [Verify your Datadog connection](#verify-your-datadog-connection)

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FYsfhA8veZISEdg4iyS0g%2Fdatadog%20connector.png?alt=media&amp;token=55bff1de-df2e-48ba-84e7-7e0bdd7445bd" alt=""><figcaption><p>Defining a SIEM connector for sending DoControl alerts and events to Datadog</p></figcaption></figure>

## Generate API key in Datadog

1. Login to your Datadog account.
2. Navigate to **Organization settings**, then click the API keys or Client Tokens tab.
3. Click the **New key** or **New client token** button, depending if you’re creating an API key or client token.
4. Enter a name for your key or token.
5. Click **Create API key** or **Create client token**.
6. Copy the generated API key.

## Connect to Datadog SIEM in DoControl

Make sure you generated the [API key](#generate-api-key-in-datadog) in Datadog before you perform the one-time SIEM connection in DoControl.

In this procedure, you need to connect your Datadog site to DoControl. Datadog's various global sites allow you to store your data in a specific location.

{% hint style="info" %}
For reference, see headers that are supported in [Datadog](< https://docs.datadoghq.com/api/latest/logs/#send-logs>).
{% endhint %}

1. In DoControl, click **Settings** <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FWkfN1O2BKZBlrnVXQ5Wu%2Fsettings%20icon.png?alt=media&amp;token=9336f06e-7a3c-4651-97c7-a1ccd2cbface" alt="" data-size="line"> from the top-right corner in any screen.
2. Navigate to **Connectors > SIEM and SOAR connectors > Datadog**.
3. Select your **Datadog site** from the dropdown list. To find out what your Datadog site is, compare your Datadog website URL to the [global URL table](https://docs.datadoghq.com/getting_started/site/#access-the-datadog-site).
4. Enter the **API key** or client token that you generated in the [previous step](#generate-api-key-in-datadog).
5. **Optional**: Enter custom header keys and values.\
   HTTP headers can provide attribution information on the data being sent to the SIEM.
6. Click **Add** to enter additional header keys and values.
7. Select the DoControl data types to send to Datadog:
   * Alerts
   * SaaS events
   * Workflows<br>

     <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FdJaEvgKXPv05PKAgPvsI%2Fdata%20types%20datadog.png?alt=media&amp;token=8b23b989-ea48-4c0b-bea8-8668cacab969" alt=""><figcaption></figcaption></figure></div>
8. For SaaS events, select the relevant **app** and **event types**.
9. For **workflows**, select the relevant workflows and execution status.\
   You can select between 1 and 100 event-triggered workflows.&#x20;
   1. To send all your workflows to Datadog, click **Select all**.&#x20;
   2. Select the relevant execution status: Completed, Warning, Failed, Cancelled or Timed out.<br>

      <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F2gaLbjTXr3IgVnr6s15t%2Fdatadog%20workflows.png?alt=media&amp;token=9e933128-41d1-40be-a855-186f5d576c3f" alt="" width="449"><figcaption></figcaption></figure></div>
10. Click **Add app** to send events from another integrated app.
11. Click **Test & Save**.
12. If you wish to edit the connector, make any changes and click **Test & Save**.

{% hint style="success" %}
Once you're connected to Datadog, you'll receive a success message as confirmation:\
\
**Success!**

Your Datadog connector is all set up. DoControl data logs are now being pushed downstream to Datadog.
{% endhint %}

## Verify your Datadog connection

After you successfully created the Datadog connection, you need to:

1. Login to your Datadog account.
2. In the left menu, click **Logs**.
3. Go to **Service,** where all DoControl alerts and events are displayed.
4. Search for `DoControl/Alert` and click it (check the spelling because it is case-sensitive).\
   Each row represents an alert generated by DoControl and is highlighted in <mark style="background-color:red;">red</mark>.\
   Alerts are represented according to this structure:\
   `<alert name> | <alert severity>`<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F2JmdvzzwPgLGCCyRQj19%2FDatadog%20SIEM.png?alt=media&amp;token=42113beb-2d58-445e-8638-4d2d6c661d99" alt=""><figcaption><p>DoControl alerts are sent to Datadog <br></p></figcaption></figure>
5. Search for `DoControl/Events` and click it (check the spelling because it is case-sensitive).\
   Each row represents a SaaS event detected by DoControl and is highlighted in <mark style="background-color:blue;">blue</mark>.\
   Events are represented according to this structure:\
   `<app name> | <event type>`<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FwOXBNqjxTKaf9y4I0a1f%2FDatadog%20events.png?alt=media&amp;token=4b452ec4-c901-495e-a597-f966e75e07e9" alt=""><figcaption><p>DoControl events are sent to Datadog </p></figcaption></figure>

## Delete a connector

If you wish to delete the connector, you can no longer view DoControl alerts, workflows or events in Datadog.

1. From the top-right corner in DoControl, navigate to **Settings > Connectors > SIEM and SOAR connectors > Datadog**.
2. Click **Disable** in the top-right.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/system-management/settings/connectors/siem-and-soar-connectors/datadog.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.