Skip to main content
VisIQ can forward your governance decision and audit logs to your own Datadog organization as they happen, so your existing dashboards, monitors and retention policy cover AI governance the same way they cover everything else. Set it up at Connectors → Log Streaming → Datadog. It takes about three minutes.

​
Before you start

  • A Datadog organization and permission to create an API key in it.
  • A VisIQ account with the settings:update permission — the log-destination endpoints are guarded by it.
Streaming starts from the moment you save. There is no historical backfill — logs recorded before the destination existed stay in VisIQ’s audit trail and are not replayed into Datadog.

​
Step 1 — Create a Datadog API key

In Datadog, go to Organization Settings → API Keys → New Key and copy the key value. An API key is all VisIQ needs, and it is deliberately the least-privileged option:
  • Log submission authenticates with the DD-API-KEY header and nothing else.
  • VisIQ never asks for an Application key, which is the credential that can read your Datadog data and change configuration. If you are about to paste something that starts with your user’s app key, you have the wrong one.

​
Step 2 — Pick your site

Datadog runs several independent regions and your API key only works against yours. VisIQ asks you to pick it from a fixed list rather than accepting a URL: To find yours, match your browser’s Datadog URL (app.datadoghq.com is US1, us5.datadoghq.com is US5, app.datadoghq.eu is EU1, and so on), or read it at the top of My Preferences. Note that EU1 is datadoghq.eu — not eu1.datadoghq.com — and US1 has no region prefix at all.

​
Why a list and not a URL

VisIQ derives every Datadog host from the site you pick and never accepts a customer-supplied URL for this connector:
  • logs go to https://http-intake.logs.<site>/api/v2/logs
  • the key check goes to https://api.<site>/api/v1/validate
That removes a whole class of risk: because there is no URL field, there is nothing to point at an internal host, and a typo produces “wrong site” rather than a silent redirection of your compliance logs.

​
Step 3 — Choose what to stream

Pick at least one stream. Both are on by default. You can also set an optional source name (Datadog’s source attribute, e.g. visiq) to make the events easy to filter alongside your other log sources.

​
Step 4 — Verify and save

There is no Test connection button here. As soon as your key is entered and the configuration is complete, VisIQ sends a test event to your Datadog intake automatically, and Save unlocks once it is verified. If it fails, fix the key or the site and VisIQ re-verifies on its own. Once saved, the connector card shows delivered and failed counts so you can see the stream’s health at a glance.

​
How delivery behaves

Understanding the retry model matters when you are reconciling counts.
  • Datadog’s intake returns 202 for an accepted batch. That is what VisIQ counts as delivered.
  • A bad key, wrong site, or oversized batch is a permanent rejection. VisIQ buffers and backs off rather than discarding the batch, so you can fix the configuration without losing logs.
  • Rate limits, timeouts, server errors and network failures are retried.
  • Datadog silently drops logs older than roughly its 18-hour intake window while still answering 202. VisIQ will not report those as delivered: a batch that has aged past the window is counted as dropped and skipped, so a backlog can never be falsely attested as shipped.

​
The API behind the card

GET needs settings:view; POST needs settings:update.
POST /api/log-destinations
Note the shape: Datadog carries datadog_site and no endpoint_url, because the host is derived. streams must be a non-empty subset of decisions and audit. On a later update, omitting auth_config keeps the stored key unchanged.

​
Troubleshooting

Almost always the wrong site. A key issued in EU1 does not authenticate against US1. Match the site to the Datadog URL you use in the browser, then let VisIQ re-verify.
Open the destination — the recorded error names the cause. A permanent status (a rejected key, a site mismatch) means VisIQ is buffering rather than dropping: correct the setting and the buffered batches deliver on the next attempt.
Datadog discards logs older than about 18 hours at intake. VisIQ counts anything that has aged past that window as dropped instead of reporting it delivered — the stream keeps moving rather than wedging on undeliverable history.
Log submission takes an organization API key, not an Application key. Create one under Organization Settings → API Keys.

Stream logs to Elasticsearch

The same streams into your own Elastic deployment, with a least-privilege API key.

Stream logs to Rapid7

InsightIDR Custom Logs, where the webhook URL is the whole credential.