Datadog

Send alerts and logs from the SURF Admin console directly into DataDog SIEM.

Before you start

Step 1: Open the integration in SURF

1. Log in to the SURF Admin console at https://admin.surf-admin.link/
2. In the left menu, navigate to Integrations.
3. Search for DataDog, click the gear icon beside the integration and select Add Integration.

The setup dialog asks for a URL, an API key, and the data types to send. Collect the first two from DataDog before continuing.

Step 2: Find your DataDog URL

The URL depends on the region your DataDog account is in. It is visible in your DataDog admin page URL.

Step 3: Create a DataDog API key

1. Log in to DataDog with an Admin role user.
2. Click Go to in the left menu, search for API Keys and open that page.
3. Click New Key in the top right corner.
4. Enter a name for the key, for example Surf Integration, and click Create Key.
5. Click Copy to copy the key to the clipboard, and save it into a temporary file.
6. Click Finish.

Step 4: Complete the configuration in SURF

1. Return to the DataDog integration setup in SURF Admin.
2. Enter the values:

1. Click Submit.

DataDog now receives data from SURF.

Step 5: Verify

In the DataDog Log Explorer

Open the Log Explorer in DataDog. Under Service, you should see entries for the data types you enabled: surf-alerts, surf-logs, and surf-applications.

Using a test log

If you need to validate the setup independently of SURF, send a test log directly. Replace the URL and API key with your own.

curl --location 'https://http-intake.logs.datadoghq.com/api/v2/logs?ddtags=text%2Fplain' 
--header 'Content-Type: application/json' 
--header 'DD-API-KEY: a999a99aa9999a99aa9aa99a99aa9999' 
--data '{
    "message": "Test log from Postman",
    "ddsource": "postman_test",
    "service": "test-service",
    "status": "info"
}'

The entry appears in the Log Explorer under the service test-service.

Troubleshooting

For anything not covered here, contact the SURF support team.