Drain Audit Logs to Datadog
Audit Log Drains are available on Enterprise plans
Audit Log Drains can forward team activity events to Datadog using the Datadog Logs API. Use this setup to ingest audit logs into Datadog for security monitoring, compliance review, and alerting.
The Datadog destination sends events over HTTPS to the log intake endpoint for your Datadog site, authenticated with a Datadog API key.
Before you configure the drain, make sure you have:
- A Datadog API key
- The Datadog site where your organization is hosted
- Access to configure Audit Log Drains for your Vercel team
In Datadog, go to Organization Settings > API Keys and create an API key, or copy an existing one. Datadog documents the full process in API and Application Keys.
Vercel builds the log intake endpoint from the site you select, so the site must match where your Datadog organization is hosted. You can read the site from your Datadog browser URL, as described in Getting Started with Datadog Sites.
In the Vercel dashboard, go to Team Settings > Drains, click Add Drain, and choose Audit Log as the data type.
Enter a name for the drain, select Datadog as the destination, and configure these fields:
- Datadog Site: Select the site from the previous step.
- API Key: Paste your Datadog API key.
Click Test to send an example event to Datadog. A successful test returns a 202 response, which means Datadog accepted the event for processing. A 403 response usually means the API key is invalid or doesn't match the selected site.
Click Create Drain to begin forwarding team activity events. In the Datadog Log Explorer, search for
source:vercel service:audit-logsand verify that events arrive. Datadog surfaces theddsourcefield from the event format through the reservedsourcefacet.
| Field | Description | Example |
|---|---|---|
| Datadog Site | The Datadog site that receives your audit log events. | US1 (datadoghq.com) |
| API Key | The API key Vercel uses to authenticate with the Logs API. | 00000000000000000000000000000000 |
Vercel sends each audit log event to the Datadog Logs API with the event fields at the top level. Vercel tags events with ddsource set to vercel and service set to audit-logs, so pipelines, facets, and monitors have a stable identity to target.
See the Audit Log Drains reference for delivery details and the underlying audit log schema.
Was this helpful?