Guides

Datadog

This integration allows sending all threat notifications and workflow evaluations to Datadog using the HTTP Logs endpoint.

Steps to set up the Verosint integration with Datadog:

  1. Log in to Verosint and navigate to the workspace settings page.

  2. Click Add next to the Datadog logo on the SIEM Logs card

  3. Fill out the required details

    1. URL: The URL of the HTTP Logs intake endpoint. The default value is shown for the US1 region. You can use the linked page to change the region and find the appropriate URL if the default is not acceptable. The full list of intake endpoints (see the above link for the up-to-date list):

      RegionURL
      US1https://http-intake.logs.datadoghq.com/api/v2/logs
      US3https://http-intake.logs.us3.datadoghq.com/api/v2/logs
      US5https://http-intake.logs.us5.datadoghq.com/api/v2/logs
      EUhttps://http-intake.logs.datadoghq.eu/api/v2/logs
      AP1https://http-intake.logs.ap1.datadoghq.com/api/v2/logs
      US1-FEDhttps://http-intake.logs.ddog-gov.com/api/v2/logs

    2. API Key: The API key that is authorized to send logs.

    3. Tags: Tags that should be sent with each threat notification (optional).

    4. Events to Send: The event types to send.

Example Datadog Threat Notification dialog

Example Datadog SIEM Logs dialog

📘

Testing Notifications

It is recommended to send a test notification to validate that all parameters are set correctly. It will also enable the Datadog administrator to see and configure alerts based on the attributes of the threat notification.

Datadog Attributes Populated In Threat Notifications

Attribute NameValue
ddsourceverosint
ddtagssource:verosint in addition to the configured tags
evt.categorythreat
evt.nameName of the threat such as CREDENTIAL_STUFFING
evt.outcomeThe status of the threat such as STARTED or ENDED
hostnameapi.verosint.com
messageJSON formatted with the following properties
url: the URL of the threat in the Verosint app
timestamp: the timestamp of the threat in the UTC timezone
threat: the details of the threat as a JSON object
serviceverosint

Datadog Attributes Populated in Workflow Evaluations

Attribute NameValueOptional
ddsourceverosint
ddtagssource:verosint in addition to the configured tags
evt.nameworkflow_evaluation
evt.outcomeThe outcome of the workflow evaluation, e.g. Allow
hostnameapi.verosint.com
messageJSON formatted workflow evaluation
network.geoip.country.iso_codeIdentifies the two-letter country code (ISO 3166-1) from which an IP address is located✅
network.geoip.city.nameIdentifies the city in which the IP address is located✅
network.geoip.region.iso_codeIdentifies the geographical region (state/province) in which the IP is located✅
serviceverosint
usr.emailThe email address
usr.idThe account ID✅

ℹ️

Optional Attributes

Some attributes are only present in the log if the corresponding identifier - such as IP address - was used in the workflow evaluation

🚧

Format of the Message Attribute

The message attribute contains the entire workflow evaluation payload in a JSON format. The format may be subject to change without notice.

Updated 17 days ago