This guide walks you through creating the required Datadog API credentials, then configuring a Datadog Cloud SIEM integration in Synqly.

Log in to your Datadog organization with an account that can manage API keys.

In Datadog, open Organization Settings and go to Access -> API Keys. Click New Key, enter a name such as Synqly Cloud SIEM, and click Create Key. Copy the key and store it securely; the value is shown only once.

For full API key steps, see Datadog's API key documentation.

In Organization Settings, go to Access -> Application Keys. Click New Key, select the user or service account that should own the key, and create the key.

Grant the following scopes:

• security_monitoring_signals_read to search and retrieve security signals (QueryAlerts, GetAlert)
• security_monitoring_rules_read to read detection rule details linked from signals
• logs_read_data to search log events (QueryEvents)
• logs_read_index_data to search log events (QueryEvents)
• logs_read_config to list log indexes (QueryLogProviders)

Copy the key and store it securely; the value is shown only once.

For full Application key steps and scope management, see Datadog's Application key documentation.

Create your integration by supplying the following configuration values.

Credential

Use the Datadog API key you created in step 2. You can provide it inline as a token or reference an existing credential by ID.

Application Key Credential

Use the Datadog Application key you created in step 4. You can provide it inline as a token or reference an existing credential by ID.

Site

Enter your Datadog site name, such as datadoghq.com (US1), us3.datadoghq.com, us5.datadoghq.com, datadoghq.eu, or ap1.datadoghq.com. If you leave this blank, Synqly defaults to datadoghq.com.

For the full list, see Datadog Sites.