Workday User Activity Logs

Supported OS Linux Windows Mac OS

Overview

This integration enables the collection of Workday User Activity Logs to capture user activity within a Workday tenant. This integration allows you to:

  • Control your Workday data retention.
  • Build custom widgets and dashboards.
  • Set up Cloud SIEM detection rules using the out-of-the-box Logs Pipeline.
  • Cross-reference Workday events with the data from other services across your stack.

Datadog’s Workday integration collects logs using Workday’s User Activity Logging API, which generates logs that allow insight into:

  • Which users are making requests in Workday
  • What type of requests are being made
  • The total amount of requests made
  • Other metadata related to the event, such as device type and IP address

Setup

Installation

Step 1: Enable User Activity Logging at the tenant level

  1. Access the Edit Tenant Setup - System task and ensure that the Enable User Activity Logging checkbox is selected.
  2. Access the Edit Tenant Setup - Security task and ensure that the OAuth 2.0 Clients Enabled checkbox is selected.

Step 2: Create an Integration System User

  1. Access the Create Integration System User task.
    • Username: < ISU_Datadog >
    • Session Timeout Minutes: 0 (disable session expiration)
    • Don’t Allow UI Sessions: Yes (select this checkbox)
  2. Access the Create Security Group task.
    • Type of Tenanted Security Group: Integration System Security Group (Unconstrained)
    • Name: < ISSG_Datadog_Monitoring >
  3. Access the Edit Integration System Security Group (Unconstrained) task for the group you just created.
    • Integration System Users: < ISU_Datadog >
  4. Access the View Domain task for the domain System Auditing.
  5. Select Domain > Edit Security Policy Permissions from the System Auditing related actions menu.
  6. Add the group that you created, Remote Security Monitoring, to both tables:
    • Report/Task Permissions table: View access
    • Integration Permissions table: Get access
  7. Access the Activate Pending Security Policy Changes task and activate the changes that you made.

Step 3: Register the API client for integrations in your tenant

  1. Access the Register API Clients for Integrations task and register the client.
    • Client Name: < Datadog User Activity Monitor >
    • Non-Expiring Refresh Tokens: Yes
    • Scope: System

Step 4: Grab Required Configuration Values to setup the Monitor in Datadog

  1. Access the View API Clients task, select the API Clients for Integrations tab and confirm these settings:
    • Client Grant Type: Authorization Code Grant
    • Access Token Type: Bearer
  2. Copy and store these four values (the first two values are at the top of the page):
    • Workday REST API Endpoint
    • Token Endpoint
    • Client ID
    • Client Secret
  3. Select API Client > Manage Refresh Token for Integrations from the Client related actions menu.
    • Workday Account:< ISU_Datadog >
  4. Select the Generate New Refresh Token checkbox, then save that token.
  5. Create the Datadog Integration
    • Enter the values that you saved into the Datadog Configuration Tab.
    • Enter the domain part of the URL: https://DOMAIN/

Data Collected

Metrics

Workday does not include any metrics.

Logs

Events

The Workday integration does not include any events.

Service Checks

Troubleshooting

Need help? Contact Datadog support.