Skip to content
WebDecoy Docs

Datadog Integration

Stream detection events to Datadog Logs for centralized security monitoring, alerting, and dashboards. This is a log integration — every detection is submitted to the Datadog HTTP logs intake, where you can build monitors and dashboards on top of the log stream.

Prerequisites

Section titled “Prerequisites”
  • Datadog account
  • Datadog API key (no application key needed)

Getting Your Datadog API Key

Section titled “Getting Your Datadog API Key”
  1. Go to Organization Settings → API Keys in Datadog
  2. Click New Key, name it (e.g., “WebDecoy”)
  3. Copy the key

Configuring Integration

Section titled “Configuring Integration”

  1. Go to Integrations → Datadog in WebDecoy

  2. Click Add Datadog Integration

  3. Enter:

    FieldDescription
    NameIntegration name (e.g., “Security Logs”)
    API KeyYour Datadog API key
    SiteYour Datadog site (see below)
    Service NameThe service on submitted logs (default webdecoy)
    SourceThe ddsource on submitted logs (default webdecoy)
    TagsExtra tags to attach to every log

  4. Click Test to send a test log, then Create

Datadog Sites

Section titled “Datadog Sites”
SiteRegion
datadoghq.comUS1
us3.datadoghq.comUS3
us5.datadoghq.comUS5
datadoghq.euEU
ap1.datadoghq.comAP1

Log Format

Section titled “Log Format”

Each detection is submitted as one log entry:

{
  "ddsource": "webdecoy",
  "ddtags": "env:production,event_type:detection,team:security",
  "service": "webdecoy",
  "status": "warn",
  "message": "WebDecoy detection",
  "attributes": {
    "detection_id": "det_abc123",
    "decoy_id": "decoy_uuid",
    "event_type": "detection",
    "rules_enforced": true,
    "timestamp": "2026-07-15T10:30:00Z",
    "organization_id": "org_xyz789",
    "property_id": "prop_def456",
    "ip_address": "192.168.1.100",
    "user_agent": "Mozilla/5.0...",
    "bot_score": 92,
    "rule_enforcement_error": null
  }
}

Tags always include env:production and event_type:<type>, plus any custom tags you configured. For full enriched detail (geo, signals, threat category), fetch the detection from the WebDecoy API using detection_id.

Building Dashboards

Section titled “Building Dashboards”

Build dashboards from the log stream (Log Analytics widgets):

  • Detections over time — count of logs, service:webdecoy, grouped by @attributes.event_type
  • Top attacking IPs — top list by @attributes.ip_address
  • High-score detections — table filtered to @attributes.bot_score:>=80
  • Enforcement outcomes — split by @attributes.rules_enforced

Alerting

Section titled “Alerting”

Create log monitors (Monitors → New Monitor → Logs):

High-Risk Detection Alert

Section titled “High-Risk Detection Alert”
logs("service:webdecoy @attributes.bot_score:>=80").index("*").rollup("count").last("5m") > 0

Detection Spike Alert

Section titled “Detection Spike Alert”
logs("service:webdecoy @attributes.event_type:detection").index("*").rollup("count").last("15m") > 100

Log Pipeline

Section titled “Log Pipeline”

Optionally create a pipeline to enrich WebDecoy logs:

  1. Go to Logs → Configuration → Pipelines
  2. Create new pipeline for service:webdecoy
  3. Add processors:
    • Status remapper (e.g., on bot_score thresholds)
    • GeoIP processor for @attributes.ip_address

Best Practices

Section titled “Best Practices”

Do’s

Section titled “Do’s”
  • ✅ Route WebDecoy logs to a security index with appropriate retention
  • ✅ Alert on high-score detections rather than every event
  • ✅ Add team/environment tags in the integration config

Don’ts

Section titled “Don’ts”
  • ❌ Don’t alert on every detection — use score thresholds
  • ❌ Don’t parse the message string — use the structured attributes

Troubleshooting

Section titled “Troubleshooting”

Logs Not Appearing

Section titled “Logs Not Appearing”
  1. Verify the API key is valid and for the right site
  2. Use the Test button in WebDecoy and search service:webdecoy in Live Tail
  3. Check the integration’s failure count in the WebDecoy dashboard

Authentication Errors

Section titled “Authentication Errors”
  • Regenerate the API key in Datadog and update the integration
  • Confirm the site matches where your organization lives (US1 vs EU etc.)

Next Steps

Section titled “Next Steps”