Skip to main content
The Datadog integration provides log search and analysis capabilities, allowing Hiro to investigate security events across your application and infrastructure logs.

​
Capabilities

​
Query Tools

Hiro can query Datadog logs with flexible filtering:
  • Usernames — Filter by @usr.name field
  • IP addresses — Filter by @network.client.ip field
  • Hostnames — Filter by host field
  • Custom queries — Full Datadog query syntax support
Example queries:

​
Action Tools

The Datadog integration is read-only. Hiro can query and analyze logs but cannot modify Datadog configuration, create monitors, or trigger alerts.
Remediation actions based on Datadog findings are executed through other integrations (Okta, AWS, CrowdStrike, etc.).

​
Setup

​
Prerequisites

  • Datadog account with log retention enabled
  • Ability to create API and Application keys

​
Connection Steps

1

Create an API key

In Datadog:
  1. Go to Organization Settings > API Keys
  2. Click New Key
  3. Name it (e.g., “Hiro Security”)
  4. Copy the API key
2

Create an Application key

  1. Go to Organization Settings > Application Keys
  2. Click New Key
  3. Name it (e.g., “Hiro Security”)
  4. Copy the Application key
3

Connect in Hiro

In Hiro, go to Settings > Integrations:
  1. Click Connect next to Datadog
  2. Enter your API Key
  3. Enter your Application Key
  4. Select your Datadog site (e.g., datadoghq.com for US1)
  5. Click Connect

​
Datadog Sites

Select the site that matches your Datadog account:

​
Investigation Examples

​
Search for errors

​
Investigate a user

​
Search by IP

​
Correlate across systems

Hiro queries all connected integrations and builds a unified timeline.

​
Troubleshooting

​
”Authentication failed”

  • Verify both the API Key and Application Key are correct
  • Check that the keys haven’t been revoked in Datadog
  • Ensure you selected the correct Datadog site

​
”No logs found”

  • Verify log retention is enabled in your Datadog plan
  • Check that relevant log sources are configured and indexed
  • Try expanding the time range

​
Rate limiting

Datadog has API rate limits. If you’re hitting limits, try narrowing your search queries or reducing the time range.

​
Next Steps

Okta

Connect identity management.

AWS

Connect cloud infrastructure.