Datadog

Connect Datadog so agents can query your logs, metrics, monitors, and dashboards during investigations.

Setup

1. Select your Datadog site (US1, US3, US5, EU1, AP1, and so on). Check your Datadog URL: app.datadoghq.com is US1, app.datadoghq.eu is EU1.
2. Enter your API key from Organization Settings → API Keys.
3. Enter your Application key from Organization Settings → Application Keys.
4. Praxen Inc. validates both keys and connects.

An application key without scopes has the same access as your user and works as is. If you scope the key, include user_app_keys (required to connect) plus logs_read_data, timeseries_query, metrics_read, monitors_read, monitors_write, monitors_downtime, dashboards_read, slos_read, hosts_read, events_read, incident_read, apm_read, aws_configuration_read, and create_webhooks. Your keys are encrypted before they are stored, and the agent never sees them.

Connecting creates a webhook named praxen in Datadog and subscribes every monitor to it, so alerts land in Praxen Inc. and get triaged as they fire.

What agents can do

• Search and filter logs with Datadog query syntax
• Read metric values and trends over time
• Check which monitors are alerting and their status
• Reference dashboard data in investigations

Disconnecting

Disconnect Datadog in Praxen Inc., then revoke the application and API keys in Datadog.

Praxen Inc. subscribes a monitor by appending the @webhook-praxen mention to its message and adding the praxen:managed tag. A recurring sync applies both to every monitor, so a Terraform-managed monitor shows drift until its Terraform config carries them too. Add both to each monitor:

resource "datadog_monitor" "high_error_rate" {
  name  = "High error rate on checkout"
  type  = "metric alert"
  query = "sum(last_5m):sum:trace.http.request.errors{service:checkout}.as_count() > 50"

  message = <<-EOT
    {{#is_alert}}Error rate on checkout is above threshold.{{/is_alert}}
    @webhook-praxen
  EOT

  tags = concat(var.tags, ["praxen:managed"])
}

The simplest setup keeps the webhook itself managed by Praxen Inc. and puts only the mention and tag in Terraform. If you also manage webhooks in Terraform, import the existing one instead of creating it, since Datadog webhook names are unique. Add the resource block first, then import:

resource "datadog_webhook" "praxen" {
  name      = "praxen"
  url       = "https://sinks.getpraxen.app/v1/datadog"
  encode_as = "json"

  custom_headers = jsonencode({
    "x-praxen-telemetry-token" = var.polylane_telemetry_token
  })

  payload = <<-EOT
    {
      "alert_id": "$ALERT_ID",
      "alert_metric": "$ALERT_METRIC",
      "alert_query": "$ALERT_QUERY",
      "alert_scope": "$ALERT_SCOPE",
      "alert_status": "$ALERT_STATUS",
      "alert_title": "$ALERT_TITLE",
      "alert_transition": "$ALERT_TRANSITION",
      "alert_type": "$ALERT_TYPE",
      "date": "$DATE_POSIX",
      "event_msg": "$EVENT_MSG",
      "event_title": "$EVENT_TITLE",
      "event_type": "$EVENT_TYPE",
      "hostname": "$HOSTNAME",
      "id": "$ID",
      "link": "$LINK",
      "logs_sample": $LOGS_SAMPLE,
      "org_id": "$ORG_ID",
      "org_name": "$ORG_NAME",
      "priority": "$PRIORITY",
      "snapshot": "$SNAPSHOT",
      "tags": "$TAGS",
      "user": "$USER",
      "username": "$USERNAME"
    }
  EOT
}

Keep the payload a raw JSON body: Datadog substitutes $LOGS_SAMPLE with a JSON object, and quoting it breaks the body.

terraform import datadog_webhook.praxen praxen

The telemetry token authenticates alert deliveries to your workspace. Find it in Praxen Inc. under Settings → Telemetry tokens (the token named datadog-integration), or create a new token on the same page. Reconnecting the integration recreates the webhook with a fresh token, so an imported webhook needs its token variable updated afterwards.