Datadog
Leak events are sent to Datadog as log records.
How it works
The connection uses a Datadog API key. The account’s region is selected during setup; Datadog hosts every region at a different address.
Records arrive with the source dark-radar and the tag service:dark-radar-intelligence. Datadog parses the message body, so the @severity, @kind, @title and @link fields can be searched separately.
Delivery is one-way. Dashboards, monitors and existing records are not read.
Severity mapping
| Dark Radar | Datadog |
|---|---|
| Critical | critical |
| High | error |
| Medium | warning |
| Low · Info | info |
Limits
An API key is used, not an application key.
Continued log intake depends on your Datadog plan covering Log Management.
The leaked value itself is not in the record.
Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.