Datadog Integration (Audit Log Export)

Stream your account's audit log (the history of Console / API operations) to Logs in your own Datadog organization. Analyze, monitor, and retain your agents' activity alongside your application logs and metrics, in one place.

• Plan: Business and above
• Status: Experimental (feedback welcome)
• Format: JSON conforming to OCSF (Open Cybersecurity Schema Framework) v1.1.0

1. Setup

On the Datadog side (2 min)

1. Issue an API key under Organization Settings → API Keys
2. Copy the secret string from the "Key" column
   • ⚠️ This is not the "Key ID" (UUID format). Authentication uses the key itself (a 32-character alphanumeric string)
   • No Application Key is required
3. Check your organization's site (region). Japanese organizations are usually AP1

On the AgenTrux side (2 min)

1. Sign in to the Console → Account → Integrations (Experimental) → Datadog Audit Export
2. Fill in:

   Field	Value
   Datadog site	Your organization's region (AP1 for Japan)
   API Key	The Key (secret) from the step above
   Service / Source	The service / ddsource attributes in Datadog (default agentrux is fine)
   Tags	Optional ddtags (e.g. env:prod,team:platform)

3. Save configuration → Test connection (sends one real test event and verifies acceptance)
4. Enable export — streaming starts here

2. What flows, and how

• Scope: audit events attributed to this account (sign-ins, Topic/Script/Grant creation and changes, settings changes, authentication and credential operations, and so on). Event payloads exchanged by your agents are not included
• Delivery takes a few minutes (periodic transfer with a grace window to avoid losing late-arriving records)
• On first enable, the available audit history of the account is exported from the beginning
• Delivery is at-least-once. Retries can duplicate an event; for strict counting, dedupe on @ocsf.metadata.uid (unique per event)
• If the plan drops below Business, the integration disables itself automatically (this is also recorded and exported as the audit event datadog_export.auto_disable). After upgrading, re-enable it in the Console — export resumes from where it stopped, with no gaps
• An event larger than 1MB is reduced to a summary form (marked with @ocsf.agentrux_truncated: true)

3. Log structure

Each audit event arrives as one log:

Main fields under @ocsf.*:

4. Getting ready for analysis (recommended recipes)

4-1. Create facets

In Logs Explorer, search service:agentrux, open any log, and Create facet for:

@ocsf.activity_name
@ocsf.actor.user.uid
@ocsf.status
@ocsf.class_uid
@ocsf.src_endpoint.ip

4-2. Map to standard attributes with a pipeline (optional, recommended)

Under Logs → Pipelines, create a pipeline filtered on service:agentrux and add remappers so Datadog's standard features (Cloud SIEM, etc.) work out of the box:

(status / timestamp / message are already in their standard positions — no extra setup needed.)

4-3. Example queries

# All failed operations
service:agentrux status:error

# Authentication / credential operations
service:agentrux @ocsf.class_uid:3002

# Activity of a specific user / agent
service:agentrux @ocsf.actor.user.uid:usr_xxxx

# Grant (access right) changes
service:agentrux @ocsf.activity_name:grant.*

# State changes of the integration itself (detect auto-disable)
service:agentrux @ocsf.activity_name:*_export.auto_disable

4-4. Suggested monitors (alerts)

• Spike in status:error (anomalous failure volume)
• Repeated @ocsf.class_uid:3002 status:error (authentication failure attempts)
• @ocsf.activity_name:(*credential* OR *revoke* OR grant.*) (notify Slack on permission / credential changes)
• @ocsf.activity_name:*_export.auto_disable (know when the export stopped)

5. Dashboard template

A ready-to-import dashboard definition is available:

Download datadog-dashboard-agentrux-audit.json

Import: Datadog Dashboards → New Dashboard → gear icon (top right) → Import dashboard JSON.

Included widgets: events / failures in 24h, activity timeseries by type, failure timeseries, top 10 actors, top 10 activities, and a recent-failure log stream. Note: create the facets from §4-1 first.

6. Operational notes

• API key rotation: issue a new key in Datadog, then re-enter and save it in the Console — export uses the new key from the next cycle
• The integration's state (last successful export, consecutive failures, last error) is shown on the Console's Datadog page
• For long-term retention, use Datadog Log Archives