Security compliance inspector for Datadog for Government environments.
1. Overview
Datadog is a cloud-scale monitoring and security platform that provides infrastructure monitoring, application performance monitoring (APM), log management, Cloud SIEM, and Cloud Security Management (CSM). Datadog for Government operates on a FedRAMP-authorized infrastructure at ddog-gov.com, holding FedRAMP Moderate authorization with FedRAMP High "In Process" status.
Compliance matters because Datadog tenants are the control plane for observability and security across an organization's entire technology stack. Misconfigured RBAC, unrotated API keys, disabled audit logs, or overly permissive sharing settings can expose sensitive telemetry data, security signals, and compliance posture information. Federal and regulated environments require continuous validation that Datadog organization settings, user access, key management, and security monitoring configurations meet the requirements of FedRAMP, CMMC, PCI-DSS, SOC 2, and other frameworks.
datadog-sec-inspector programmatically audits a Datadog organization's security configuration against 20 controls mapped to eight compliance frameworks, producing machine-readable findings and human-readable reports.
2. APIs & SDKs
Datadog API v1 Endpoints
Endpoint
Method
Description
Permission Required
/api/v1/org
GET
Organization settings (SAML, sharing, data retention)
go get github.com/DataDog/datadog-api-client-go/v2
Official. Supports v1 and v2 APIs. Used by this tool.
datadog-api-client-python
Python
pip install datadog-api-client
Official. Async support via [async] extra.
datadogpy
Python
pip install datadog
Older library. Includes dogshell CLI (dog command).
datadog-api-client-java
Java
Maven/Gradle
Official.
datadog-api-client-typescript
TypeScript
npm install @datadog/datadog-api-client
Official.
datadog-api-client-ruby
Ruby
gem install datadog_api_client
Official.
CLIs
Tool
Description
dogshell (dog)
CLI bundled with datadogpy. Configure via ~/.dogrc. Supports metrics, events, monitors, dashboards.
Datadog Terraform Provider
hashicorp/datadog provider for IaC management of Datadog resources.
3. Authentication
Credential Types
Credential
Header
Description
API Key
DD-API-KEY
Organization-level key. Required for all API calls. Identifies the organization. Does not grant user-level permissions alone.
Application Key
DD-APPLICATION-KEY
User-scoped key. Required for most read/write operations. Inherits the permissions of the user who created it. Scoped application keys can further restrict permissions.
1. Read DD_API_KEY, DD_APP_KEY, DD_SITE from environment (or config file / flags).
2. Construct base URL: https://api.{DD_SITE}/
3. Set headers: DD-API-KEY and DD-APPLICATION-KEY on every request.
4. Validate credentials via GET /api/v1/validate before proceeding.
5. All subsequent API calls inherit the permissions of the Application Key's owner.
Additional Auth Mechanisms
OAuth (limited): Datadog supports OAuth for partner integrations and Datadog Apps. Not applicable for compliance auditing.
SAML SSO: Organization-level SSO via SAML 2.0 (Okta, Azure AD, PingOne, etc.). Configurable via /api/v1/org endpoint. Inspector checks whether SAML is enforced.
Scoped Application Keys: Application keys can be created with a subset of the owner's permissions. Inspector should flag unscoped keys.
4. Security Controls
#
Control
API Source
What the Inspector Checks
1
SAML SSO Enforcement
GET /api/v1/org
SAML is enabled and IdP-initiated login is configured. Strict mode enforced (password login disabled).
2
MFA Status
GET /api/v2/users
All active users have MFA enabled. No users rely solely on password authentication.
3
RBAC Configuration (Custom Roles)
GET /api/v2/roles, GET /api/v2/roles/{id}/permissions
Custom roles follow least-privilege. No custom roles grant org_management or admin equivalent. Default roles are not over-assigned.
4
User Access Review
GET /api/v2/users
No disabled/deprovisioned users with active sessions. No users inactive >90 days. Service accounts are identified and justified.
5
API Key Rotation
GET /api/v2/api_keys
All API keys have been rotated within policy window (e.g., 90 days). Keys not used in >30 days are flagged. Key names follow naming convention.
6
Application Key Audit
GET /api/v2/application_keys
Application keys are scoped (not full-permission). Keys tied to active users only. No orphaned keys from deprovisioned users. Last-used date is recent.
7
Audit Log Enabled and Retained
GET /api/v2/audit/events/search
Audit Trail is enabled. Events are being recorded. Retention meets policy requirements (e.g., 90+ days).
8
Security Detection Rules Enabled
GET /api/v2/security_monitoring/rules
Cloud SIEM detection rules are enabled. Critical rule categories (authentication, privilege escalation, data exfiltration) have active rules. No default rules have been disabled.
9
Security Signals Review
POST /api/v1/security_analytics/signals/search
Unresolved HIGH/CRITICAL security signals are flagged. Signals older than SLA threshold trigger findings.
10
Log Pipeline Security
GET /api/v1/logs/config/pipelines
Log pipelines do not drop security-relevant logs. Sensitive fields are redacted. Archive destinations are configured.
11
Sensitive Data Scanner
GET /api/v2/sensitive-data-scanner/config
Sensitive Data Scanner is enabled. Scanning groups cover logs, APM, RUM, and events. PII/PCI patterns are active.
12
Cloud Security Posture Management (CSPM)
GET /api/v2/security_monitoring/rules (type: cloud_configuration)
CSPM is enabled. Compliance rules are active for applicable frameworks (CIS, PCI-DSS, SOC 2, HIPAA). Passing rate meets threshold.
13
Compliance Rule Coverage
GET /api/v2/security_monitoring/rules
Detection rules cover all required compliance frameworks. No gaps in CIS, PCI-DSS, SOC 2, HIPAA rule sets.
14
Public Dashboard Restrictions
GET /api/v1/dashboard, GET /api/v1/org
No dashboards are publicly shared without authentication. Org settings restrict public sharing. Shared dashboards require email-domain allowlisting.
15
IP Allowlisting
GET /api/v2/ip_allowlist
IP allowlist is enabled. Allowlist entries are present and reviewed. No overly broad CIDR ranges (e.g., /0, /8).
16
Session Timeout
GET /api/v1/org
Organization session timeout is configured. Timeout does not exceed policy maximum (e.g., 15 minutes for High, 30 minutes for Moderate).
17
Monitor Notification Channels
GET /api/v1/monitor
Security-critical monitors send to approved channels (PagerDuty, Slack security channel, email DLs). No monitors send to personal email only.
18
Integration Permissions
GET /api/v1/integration/{source}
Third-party integrations use least-privilege API keys. No integrations have full admin access. Webhooks use HTTPS endpoints only.
19
Service Account Audit
GET /api/v2/users, GET /api/v2/application_keys
Service accounts are identified (naming convention). Service accounts do not have interactive login. Service account keys are rotated per policy.
20
Organization Settings (Data Retention & Sharing)
GET /api/v1/org
Data retention meets policy minimums. Cross-org data sharing is disabled or restricted. Widget sharing outside org is disabled.