Datadog
Connect Datadog to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Datadog to collect observability evidence automatically.
| Category | Observability |
| Connect with | API token |
| What a connection produces | Automated evidence collection |
| Datadog's guide | docs.datadoghq.com |
Connect with an API token
-
In Datadog:
- API key: in Datadog go to Organization Settings › API Keys, click New Key, enter a name, and click Create API key.
- Application key: go to Organization Settings › Application Keys, click New Key, enter a name, and create it.
- Copy the application key secret immediately. With One-Time Read mode (on automatically for organizations created after August 20, 2025) it cannot be retrieved later.
- When creating or editing the application key, set its authorization scopes; without them, application keys have all the same scopes and permissions as the user who created them.
Where to find the other values:
- Site: Your site parameter from the address you sign in to (for example datadoghq.com for https://app.datadoghq.com). With a custom domain, click your profile avatar in the lower-left corner and select My Preferences; the site is listed at the top of the page.
Datadog shows the secret only once, so copy it before you leave the page.
Datadog's public documentation does not cover every step.
Source: docs.datadoghq.com, docs.datadoghq.com, checked 2026-10-07.
The permissions Safeguard needs:
monitors_read,synthetics_read,logs_read_config,logs_read_archives,user_access_read,security_monitoring_signals_read,security_monitoring_findings_read. -
On Compliance › Connectors, open Datadog, click Connect, choose API token and fill in:
Field What to enter API Key Required. Stored encrypted and never shown again. Application Key Required. Stored encrypted and never shown again. Site Optional. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Datadog and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | A1.1, CC6.2, CC7.1, CC7.2, CC7.3, CC7.4 | 11 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.5.25, A.6.5, A.8.6, A.8.8, A.8.9, A.8.15, A.8.16 | 11 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.312(b) | 10 |
| PCI DSS | Automated tests | 2.2.1, 6.3.3, 7.2.4, 8.2.5, 10.4.1, 10.5.1, 11.3.1 | 10 |
| NIST CSF 2.0 | Automated tests | DE.AE-02, DE.AE-06, DE.CM-01, DE.CM-09, ID.AM-02, ID.RA-01, PR.AA-01, PR.AA-05, PR.PS-01, PR.PS-04 | 11 |
These tests are switched on per workspace by the Safeguard team.
Datadog CSM connect to the same provider as Datadog, and these tests run for a connection made through any of them.
Related
- Observability connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks