Skip to main content
This article covers the legacy Datadog SIEM connector, the connection where the Domain ID under your Lumos domain shows datadoghq.com. In addition to syncing users and roles and suspending users, this connector can ship Lumos Activity Logs to Datadog SIEM. For connections created after July 2025 (Domain ID datadog_ics), which add full user and role provisioning, see Datadog. Both use the same credentials and scopes.

​
After this article

You will be able to connect Datadog to Lumos to sync users and roles, suspend Datadog user accounts, track last login activity, and ship your Lumos Activity Logs to Datadog SIEM.

​
Capabilities

Activity tracking is supported: the integration syncs each user’s last login (via Datadog audit log search). User status mapping: Datadog active maps to Lumos Active, disabled maps to Suspended, and a user no longer returned by Datadog (deleted) maps to Deprovisioned. Suspending a user (available via Offboarding, Access Reviews, and License Management, not AppStore) sets the Lumos Account Status to Suspended and disables login in Datadog, but does not reclaim a Datadog license.

​
Required plan and roles

  • Datadog plan: at least the Datadog Pro plan is required.
  • Credentials: a Datadog API key plus an Application key created with the minimum required scopes.
  • Application key scopes (all three are required):
    • user_access_manage: disable users, manage user roles, manage SAML-to-role mappings, and configure logs restriction queries
    • org_management: view organizational information
    • user_access_read: read user and role data
  • Permission scoping: this integration requires write privileges. There’s no read-only version. Write operations require user_access_manage (or user_access_invite).
  • Key inheritance: Application keys inherit permissions from the user who creates them, so the creating user must hold all required scopes and their account must remain active.

​
Instructions

Phase 1: Create keys in Datadog
  1. Generate an API key and temporarily save it.
  2. Generate a new Application key with the minimum required scopes listed above and temporarily save it.
Phase 2: Connect in Lumos
  1. Find the Datadog card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Enter the API key into the API Key field.
  3. Enter the Application key into the Application Key field.
  4. Select the Region of your Datadog tenant. The API base URL varies by Datadog site, so this must match where your organization is hosted.
  5. Click Connect.
Phase 3: Ship Lumos Activity Logs to Datadog SIEM
  1. Connect Datadog to Lumos as above.
  2. Configure Datadog as your SIEM connection in Lumos.
  3. Once configured, events from your Lumos Activity Log ship to Datadog automatically. Filter your Datadog logs for source:lumos to verify Activity Logs are being shipped from Lumos to Datadog.

​
API Endpoints Used

​
Troubleshooting

Can’t connect. Make sure you’ve selected the correct region for your tenant, and that your key has at least the user_access_manage scope tied to it (plus org_management and user_access_read). 403 Forbidden errors. Application keys inherit permissions from their creator. Verify which Datadog user created the Application key, confirm that user still has all required scopes, and check their account is still active (not deactivated). If not, grant the needed scopes to that user or regenerate the Application key from an account with sufficient privileges. Suspended user still consumes a license. This is expected: disabling a user in Datadog prevents login but does not reclaim the license in Datadog. Activity Logs are not appearing in Datadog. Confirm Datadog is configured as your SIEM connection in Lumos and the connection is on the datadoghq.com (legacy) card. In Datadog, filter logs for source:lumos. If nothing appears, verify the Application key still holds the required scopes and the region matches your tenant. Last-login sync returns a 410 Gone on audit search. The audit resource or query window is no longer available for that request. This is surfaced as a client-side error rather than a connector failure, and later syncs recover on their own.