Overview

This integration enables the collection of Workday User Activity Logs to capture user activity within a Workday tenant. This integration allows you to:

• Control your Workday data retention.
• Build custom widgets and dashboards.
• Set up Cloud SIEM detection rules using the out-of-the-box Logs Pipeline.
• Cross-reference Workday events with the data from other services across your stack.

Datadog’s Workday integration collects logs using Workday’s User Activity Logging API, which generates logs that allow insight into:

• Which users are making requests in Workday
• What type of requests are being made
• The total amount of requests made
• Other metadata related to the event, such as device type and IP address

Setup

Installation

Step 1: Enable user activity logging at the tenant level

1. Access the Edit Tenant Setup - System task.
   • Ensure that the Enable User Activity Logging checkbox is selected
2. Access the Edit Tenant Setup - Security task.
   • Ensure that the OAuth 2.0 Clients Enabled checkbox is selected

Step 2: Create an integration system user

1. Access the Create Integration System User task.
   • Username: < ISU_Datadog >
   • Session Timeout Minutes: 0 (disable session expiration)
   • Don’t Allow UI Sessions: Yes (select this checkbox)
2. Access the Create Security Group task.
   • Type of Tenanted Security Group: Integration System Security Group (Unconstrained)
   • Name: < ISSG_Datadog_Monitoring >
3. Access the Edit Integration System Security Group (Unconstrained) task for the group you just created.
   • Integration System Users: < ISU_Datadog >
4. Access the View Domain task for the domain System Auditing.
   • Select Domain > Edit Security Policy Permissions from the System Auditing related actions menu
5. Add the group that you created, Remote Security Monitoring, to both tables:
   • Report/Task Permissions table: View access
   • Integration Permissions table: Get access
6. Access the Activate Pending Security Policy Changes task.
   • Activate the changes

Step 3: Register the API client for integrations in your tenant

Access the Register API Clients for Integrations task and register the client using the following settings:

• Client Name: < Datadog User Activity Monitor >
• Non-Expiring Refresh Tokens: Yes
• Scope: System

Step 4: Retrieve configuration values needed to set up the Datadog Monitor

1. Access the View API Clients task.
2. Select the API Clients for Integrations tab and confirm the following settings are enabled:
   • Client Grant Type: Authorization Code Grant
   • Access Token Type: Bearer
3. Copy the following values for use on the Datadog Workday integration tile.
   • Client ID
   • Client Secret
4. Navigate to the View API Clients page in Workday.
   • Locate the Workday REST API Endpoint
   • Copy the domain and tenant from the URL for use on the Datadog Workday integration tile
     • For example, if your endpoint is: https://wd1-impl.myworkday.com/ccx/api/v1/myorg1
     • Domain: wd-01-services.myworkday.com
     • Tenant: myorg1
5. From the Client Related Actions menu, select API Client > Manage Refresh Token for Integrations.
   • Workday Account: < ISU_Datadog >
6. Select the Generate New Refresh Token checkbox.
   • Save the refresh token for use on the Datadog Workday integration tile

Step 5: Create a new account in the accounts table on the Datadog Workday integration tile

1. In Datadog, navigate to Integrations > Workday.
2. Click the Add New button in the accounts table.
3. Enter the values that you saved in the previous steps into their respective fields.
4. Click the Save button to create the account.

Data Collected

Metrics

Workday does not include any metrics.

Logs

Events

The Workday integration does not include any events.

Service Checks

The Workday integration does not include any service checks.

See service_checks.json for a list of service checks provided by this integration.

Troubleshooting

Need help? Contact Datadog support.