# Datadog

{% hint style="info" %}
This integration is currently in Beta.  
{% endhint %}

## Overview

This article provides a step-by-step guide to setting up the integration between Cisco Identity Intelligence and Datadog, enabling enhanced identity security monitoring and analytics. Cisco Identity Intelligence aggregates identity data from multiple identity providers (IdPs) and applications to deliver comprehensive visibility into identity activity and risks. Integrating Identity Intelligence with Datadog allows organizations to forward identity-related events and alerts to Datadog for monitoring, correlation, and incident response.

### Datadog API Information

General information about Datadog API authentication can be found [here](https://docs.datadoghq.com/api/latest/authentication/). 

More specifically, API and Application Keys information can be found in the Datadog docs [here](https://docs.datadoghq.com/account_management/api-app-keys/).

> **API keys**\
> API keys are unique to your organization. An [API key](https://app.datadoghq.com/organization-settings/api-keys) is required by the Datadog Agent to submit metrics and events to Datadog.
>
> **Application keys**\
> [Application keys](https://app.datadoghq.com/organization-settings/application-keys), in conjunction with your organization’s API key, give users access to Datadog’s programmatic API. Application keys are associated with the user account that created them and by default have the permissions of the user who created them.

## Datadog API Setup

#### Create an API key

1. Go to <https://app.datadoghq.com/organization-settings/api-keys>, OR \
   \
   search for "API Keys" in the global search ("search on the top of the right side drawer") and select API Keys, OR

   <figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2F5rcJ5AvRRmyNl8LUYzOo%2Fimage.png?alt=media&#x26;token=d99e4bfc-53cc-4d9c-9875-7b0e6085344b" alt=""><figcaption></figcaption></figure>

Hover on the username on the bottom right and select API Keys

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FMEIB5iGq98b0GmvEexoL%2Fimage.png?alt=media&#x26;token=e6a5ab36-503e-4da8-abcd-529f17212d06" alt=""><figcaption></figcaption></figure>

2. Then click "+ New Key", give it a name and click "Create Key"
3. Copy the value, save it somewhere secure and close.

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2Fooqh7J9BKABw2Rjt54vt%2Fimage.png?alt=media&#x26;token=8cef4322-f79d-4774-89cf-2325e3ebae99" alt=""><figcaption></figcaption></figure>

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FfUwzWPNH83IrPLPAJl1I%2Fimage.png?alt=media&#x26;token=f7af8070-2061-4553-916f-17797ff30ccd" alt=""><figcaption></figcaption></figure>

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FCGhhqPTkuPkD4au0rRJZ%2Fimage.png?alt=media&#x26;token=d58415ea-a8d3-4c07-927a-6ade02e26b6e" alt=""><figcaption></figcaption></figure>

#### Create the Application Key

Go to <https://app.datadoghq.com/organization-settings/application-keys>, or use any of the methods described above, such as:&#x20;

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FCkp2watYElaSw6Zh0qE0%2Fimage.png?alt=media&#x26;token=f71c750d-0d1a-4614-9642-bd95a8ca2fdb" alt=""><figcaption></figcaption></figure>

Then click "+ New Key", give it a name and click "Create Key"

<figure><img src="https://private-user-images.githubusercontent.com/31853965/514068934-3082bba3-6489-4b95-9b13-77374c70e4aa.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NjM0MTQ3OTAsIm5iZiI6MTc2MzQxNDQ5MCwicGF0aCI6Ii8zMTg1Mzk2NS81MTQwNjg5MzQtMzA4MmJiYTMtNjQ4OS00Yjk1LTliMTMtNzczNzRjNzBlNGFhLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNTExMTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjUxMTE3VDIxMjEzMFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWVkMWVlMzg0NDAyNGJlYTAxYTg2MDkzMjIyZGZkZTc0OTcwMGM3ZGNkZTJiMjk5ZTZjNDJhODQ3MDBiOGE5MDkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.EHFUTzWyNjoA2Y5JHLzQPvrSWLQX1TawF96CUQ9NAB0" alt=""><figcaption></figcaption></figure>

Click "Edit" next to the "Scopes" section and check the scopes:

* `audit_logs_read`
* `events_read`
* `user_access_read`
* `api_keys_read`
* `org_app_keys_read`\
  (use the search bar to filter for these values)

<figure><img src="https://private-user-images.githubusercontent.com/31853965/514068137-94e48b25-21ea-4d1b-817e-d901df7f832b.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NjM0MTQ3OTAsIm5iZiI6MTc2MzQxNDQ5MCwicGF0aCI6Ii8zMTg1Mzk2NS81MTQwNjgxMzctOTRlNDhiMjUtMjFlYS00ZDFiLTgxN2UtZDkwMWRmN2Y4MzJiLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNTExMTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjUxMTE3VDIxMjEzMFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTcxYzI3OWY5MjUyMDIzZWY0YzM2Y2QwMjYxNmEzZmFmZWE5Y2Q4MGRiYmJhMDM4MmFjOTFmYzYxNDQ0MTMwNDgmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.OHJbuYNhFLnN4Dz7eN6GWJES1-Ewmx22avcWyPHJW0M" alt=""><figcaption></figcaption></figure>

Copy the Key and save it to a secure location.&#x20;

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FJdy97r78OSesceH8j6aw%2Fimage.png?alt=media&#x26;token=7e0185a5-591e-4bce-b19e-82c11ad955ad" alt=""><figcaption></figcaption></figure>

#### Datadog API URLs

The default value is `datadoghq.com`. You can consult [this page](https://docs.datadoghq.com/getting_started/site/) for other Datadog app or API URLs.

## Identity Intelligence Integration Setup

1. Under Integrations, select **Add Integration** in the top right corner
2. Select the **Datadog** integration<br>

   <figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FbPIMWk3NBGSGjVsvDU1z%2Fimage.png?alt=media&#x26;token=efe8286e-e4b2-4d57-b09b-e4cfc639da0c" alt=""><figcaption></figcaption></figure>
3. Provide a display name and enter both the API key and App key.  Change the Site URL if your Datadog tenant is located under a different URL. <br>

   <figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2F7EIJXMi99aogntw2tsxP%2Fimage.png?alt=media&#x26;token=372688ad-760e-48c1-923f-fe821383fa2d" alt=""><figcaption></figcaption></figure>
4. Select **Connect**&#x20;