Datadog

Events Feed

Our Datadog event integration creates an event when the Next-Gen WAF flags an IP address.

Adding a Datadog integration

1. Log in to Datadog.
2. Click Integrations in the navigation bar on the left.
3. Click APIs.
4. Click Create API Key.
5. Create a new API key by following the steps.
6. Copy the provided API Key.
7. Log in to the Next-Gen WAF console.
8. From the Sites menu, select a site if you have more than one site.
9. From the Manage menu, select Site Integrations.
10. Click Add site integration.
11. Select the Datadog Alert integration.
12. In the API Key field, enter the API Key created in Datadog.
13. Select if you want to be alerted regarding All activity or Specific activity. If you selected Specific activity, in the Activity menu choose the activity types that you want the integration to create alerts for.
14. Click Create site integration.

Activity types

Dashboard

Datadog has a default dashboard populated with StatsD metrics from the Next-Gen WAF agent. To use this functionality:

1. Find and install the Signal Sciences integration tile in Datadog integrations tab.

2. Confirm that the Datadog agent is configured to listen for StatsD events: https://docs.datadoghq.com/developers/dogstatsd/

3. Configure the Next-Gen WAF agent to use dogstatsd:

   • Add the following line to each agent's agent.config file:

     statsd-type = "dogstatsd"

   • When this is done the agent's statsd client will have tagging enabled and metrics such as sigsci.agent.signal.<SIGNAL_TYPE> will be sent as sigsci.agent.signal and tagged with signal_type:<SIGNAL_TYPE> (e.g., sigsci.agent.signal.http404 => sigsci.agent.signal tag signal_type:http404).

   • If using Kubernetes to run the Datadog agent, make sure to enable DogStatsD non local traffic as described in the Kubernetes DogStatsD documentation.

4. Configure the Next-Gen WAF agent to send metrics to the Datadog agent by adding the following line to each agent's agent.config file:

   $ statsd-address="<DATADOG_AGENT_HOSTNAME>:<DATADOG_AGENT_PORT>"

5. Verify that the Signal Sciences - Overview dashboard is created and starting to capture metrics.