Datadog

Datadog receives the Authdog audit stream as logs. Lidar still detects and triages inside Authdog. This channel copies the same events to the Datadog site you already watch. Configuration belongs to one environment.

Create the channel

In the Authdog console:

1. Select the project and environment.
2. Open Notifications > Channels.
3. Select Add Channel.
4. Set Channel Name and Channel Type to Datadog.
5. Paste a Datadog API Key.
6. Set Datadog Site to the site your account uses. The default is datadoghq.com. Other sites include datadoghq.eu, us3.datadoghq.com, us5.datadoghq.com, and ap1.datadoghq.com.
7. Optionally set Service, Source, and comma-separated Tags (for example team:security,product:authdog).
8. Choose the event triggers. Leave the event list empty to drain every event. Build a narrower list from the event catalog.
9. Save, then send a test delivery.

The API key is stored as a secret. Later edits show it as redacted. Leave the field unchanged to keep the stored key. Select Change only when you are replacing it.

What lands in Datadog

Deliveries use Datadog's own authentication, not the X-Authdog-Signature header used by generic webhooks. A 2xx from Datadog is success. Failures retry with exponential backoff, starting at 60 seconds, for at most five attempts. Inspect delivery records if a test does not appear.

This is log intake, not a Lidar detector. Signals stay in the console under Lidar. The channel is how you correlate those events with the rest of your stack.

Test it

1. Trigger a sign-in in the same environment.
2. Search Datadog logs for the service or source you set.
3. Confirm a failed destination shows up in delivery records, then recovers after Datadog accepts the retry.

Repeat the channel in production with a production API key. Channels do not copy between environments.

Related