# Integrating SailPoint with Datadog

Datadog is a SaaS (Software as a Service) observability and security platform that provides unified, real-time monitoring and analytics for cloud-scale applications and infrastructure. This document provides instructions to configure a new direct connection to a Datadog source. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Datadog connector supports the following:

### Account Management

- Aggregate Users

### Entitlement Management

- Aggregate Roles

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

- Datadog **API Key**.
- Datadog **Application Key**.

  > **Resource Links**
  >
  > [Authentication Guide](<https://docs.datadoghq.com/api/latest/authentication/>) | [API and Application Keys](<https://docs.datadoghq.com/account_management/api-app-keys/>)

## Required Permissions

Users with the **Admin** role, or users granted the **API and Application Key Management** permission through a custom role, are authorized to create and manage API keys and Application keys in Datadog. These credentials are used to authenticate API requests and enable integrations with the Datadog connector.

Datadog supports **fine-grained Role-Based Access Control (RBAC)**, allowing organizations to create custom roles with specific permissions and assign them to users or service accounts. RBAC also supports read-only access configurations for users and roles.

For API and Application Key management, Datadog provides the following granular permissions:

- `api_keys_read` - Allows users to view API and Application keys.
- `api_keys_write` - Allows users to create, update, and revoke API and Application keys.

#### Recommended Least-Privilege Integration Approach

SailPoint recommends the following configuration when integrating with Datadog to ensure least-privilege access:

- Custom Role with `User Access Manage` permission.
- Service Account with Custom Role.
- Ensure the Application Key used is the one owned by the Service Account.
- The Application Key must be `scoped` and must have `user_access_read` granular permission.

> [!IMPORTANT]
>
> **Resource Links**
>
> - You can refer to [Service Accounts](<https://docs.datadoghq.com/account_management/org_settings/service_accounts/>) for the latest information about service accounts.
> - For detailed permission and role definitions, refer to [Datadog Role Permissions](<https://docs.datadoghq.com/account_management/rbac/permissions/>).