Skip to content
WebDecoy Docs

Datadog Integration

Stream detection events to Datadog Logs for centralized security monitoring, alerting, and dashboards. This is a log integration: every detection is submitted to the Datadog HTTP logs intake, where you can build monitors and dashboards on top of the log stream.

Prerequisites

Section titled “Prerequisites”
  • Datadog account
  • Datadog API key (no application key needed)

Getting Your Datadog API Key

Section titled “Getting Your Datadog API Key”
  1. Go to Organization Settings → API Keys in Datadog
  2. Click New Key, name it (e.g., “WebDecoy”)
  3. Copy the key

Configuring Integration

Section titled “Configuring Integration”

  1. Go to Integrations → Datadog in WebDecoy

  2. Click Add Datadog Integration

  3. Enter:

    Field Description
    Name Integration name (e.g., “Security Logs”)
    API Key Your Datadog API key
    Datadog Site Your Datadog site (see below)
    Service Name The service on submitted logs (default webdecoy)
    Source The ddsource on submitted logs (default webdecoy)
    Tags (comma-separated) Extra tags to attach to every log

  4. Choose event types (All Detections, High Risk Detections (Score >= 80), Rule Enforced Events) and the optional Minimum Score and Filter by Decoys

  5. Click Create Integration, then use Test on the integration card to send a test log

Datadog Sites

Section titled “Datadog Sites”
Site Region
datadoghq.com US1
us3.datadoghq.com US3
us5.datadoghq.com US5
datadoghq.eu EU
ap1.datadoghq.com AP1

Log Format

Section titled “Log Format”

Each detection is submitted as one log entry. Illustrative example (empty fields are omitted):

{
  "message": "New detection: ip=198.51.100.23",
  "ddsource": "webdecoy",
  "ddtags": "env:production,event_type:detection,team:security",
  "hostname": "webdecoy",
  "service": "webdecoy",
  "status": "info",
  "@timestamp": "2026-07-15T10:30:00Z",
  "attributes": {
    "detection_id": "5d0c8f1e-...",
    "decoy_id": "c2e9f6a0-...",
    "event_type": "detection",
    "rules_enforced": false,
    "timestamp": "2026-07-15T10:30:00Z",
    "organization_id": "3f1c2a9e-...",
    "property_id": "8b7d4e21-...",
    "ip_address": "198.51.100.23",
    "user_agent": "Mozilla/5.0...",
    "bot_score": 92
  }
}

event_type is detection, high_risk_detection (unified score or bot_score 80 or higher) or rule_enforced (not sent by the detection pipeline today). status is info for detections, error for high-risk detections and warning for rule-enforced events. rule_enforcement_error is added when enforcement failed.

Tags always include env:production and event_type:<type>, plus any custom tags you configured. For full enriched detail (geo, signals, threat category), fetch the detection from the WebDecoy API using detection_id.

Building Dashboards

Section titled “Building Dashboards”

Build dashboards from the log stream (Log Analytics widgets):

  • Detections over time: count of logs, service:webdecoy, grouped by @attributes.event_type
  • Top attacking IPs: top list by @attributes.ip_address
  • High-score detections: table filtered to @attributes.bot_score:>=80
  • Enforcement outcomes: split by @attributes.rules_enforced

Alerting

Section titled “Alerting”

Create log monitors (Monitors → New Monitor → Logs):

High-Risk Detection Alert

Section titled “High-Risk Detection Alert”
logs("service:webdecoy @attributes.bot_score:>=80").index("*").rollup("count").last("5m") > 0

Detection Spike Alert

Section titled “Detection Spike Alert”
logs("service:webdecoy @attributes.event_type:detection").index("*").rollup("count").last("15m") > 100

Log Pipeline

Section titled “Log Pipeline”

Optionally create a pipeline to enrich WebDecoy logs:

  1. Go to Logs → Configuration → Pipelines
  2. Create new pipeline for service:webdecoy
  3. Add processors:
    • Category or status processors (for example on @attributes.bot_score thresholds)
    • GeoIP processor for @attributes.ip_address

Best Practices

Section titled “Best Practices”

Do’s

Section titled “Do’s”
  • ✅ Route WebDecoy logs to a security index with appropriate retention
  • ✅ Alert on high-score detections rather than every event
  • ✅ Add team/environment tags in the integration config

Don’ts

Section titled “Don’ts”
  • ❌ Don’t alert on every detection. Use score thresholds
  • ❌ Don’t parse the message string. Use the structured attributes

Troubleshooting

Section titled “Troubleshooting”

Logs Not Appearing

Section titled “Logs Not Appearing”
  1. Verify the API key is valid and for the right site
  2. Use the Test button in WebDecoy and search service:webdecoy in Live Tail
  3. Check the integration’s failure count in the WebDecoy dashboard

Authentication Errors

Section titled “Authentication Errors”
  • Regenerate the API key in Datadog and update the integration
  • Confirm the site matches where your organization lives (US1 vs EU etc.)

Next Steps

Section titled “Next Steps”