D

Datadog

Stream every Cheqpoint approval event to Datadog as a structured log. Correlate AI agent approvals, rejections, and high-risk actions alongside your existing security signals in Datadog SIEM.

1. Configure the Notification URL in Cheqpoint

text
Settings → Integrations → Datadog → Enter Webhook URL → Save

Cheqpoint will POST a JSON event to this URL for every:
  • New approval request (status: pending)
  • Human decision (approved / rejected / modified)
  • Auto-decision (auto_approved / expired / escalated)

2. Datadog Log Intake endpoint

bash
# Datadog HTTP log intake (replace <DD_API_KEY> and <DD_SITE>)
https://http-intake.logs.<DD_SITE>/api/v2/logs

# Example DD_SITE values:
#   datadoghq.com   (US1)
#   us3.datadoghq.com
#   eu.datadoghq.com

# Cheqpoint sends events with:
#   Content-Type: application/json
#   DD-API-KEY: <your key> (added in Cheqpoint's webhook secret field)

3. Cheqpoint event payload

json
{
  "event": "request.decided",
  "requestId": "req_01j3abc",
  "action": "send_email",
  "status": "rejected",
  "agentId": "agent_crm_bot",
  "agentName": "CRM Bot",
  "riskScore": 0.82,
  "workspaceId": "ws_01j3xyz",
  "decidedBy": "alex@company.com",
  "decisionNote": "Rejected - email list too broad for this campaign",
  "createdAt": "2026-10-15T09:12:00Z",
  "decidedAt": "2026-10-15T09:14:33Z"
}

4. Datadog log pipeline transform (recommended)

json
// Datadog log pipeline: Grok parser
// Add a processing rule to extract fields as facets

cheqpoint_parser
  rule: status:%%{word:cheqpoint_status} riskScore:%%{number:cheqpoint_risk}

// Or use the JSON auto-parse - Cheqpoint events are valid JSON,
// Datadog will auto-index all top-level fields as attributes.

5. Example SIEM monitor (high-risk rejections)

json
{
  "name": "Cheqpoint: High-risk AI agent action rejected",
  "type": "log alert",
  "query": "source:cheqpoint status:rejected @riskScore:>0.7",
  "message": "A high-risk AI agent action was rejected. Agent: {{@agentName}} Action: {{@action}} Risk: {{@riskScore}}",
  "tags": ["team:security", "product:cheqpoint"],
  "options": {
    "thresholds": { "critical": 1 }
  }
}

What to monitor

  • High-risk actions (riskScore > 0.7) regardless of decision
  • Repeated rejections from the same agent - potential prompt injection or runaway behaviour
  • Approval volume spikes vs. 7-day baseline (Cheqpoint surfaces this in the dashboard anomaly card)
  • SLA breaches - requests that expired without a human decision
  • Actions tagged with regulatory frameworks (EU AI Act, SOX, HIPAA) for compliance dashboards

For CEF-format log export (for SIEM ingestion via file-based collectors), use Audit Log → Export CEF.