このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Overview
Events Forwarding sends logs, audit logs, security spans, security signals, and cloud workload security events from Datadog to custom destinations such as Splunk, Elasticsearch, and HTTP endpoints. Use Events Forwarding to route security and observability data to third-party SIEMs, data lakes, or internal tools.
Events Forwarding supports the following data types:
Note: For logs, additional destination types are available (Microsoft Sentinel, Google Chronicle). See Forwarding Logs to Custom Destinations for details.
Prerequisites
Permissions
Forwarding rules require data-type-specific permissions. The following table lists the required permission for each data type.
Set up events forwarding
Events Forwarding uses the same destination types and configuration as log forwarding. For detailed instructions on setting up destinations, see Forwarding Logs to Custom Destinations.
Sending events to a custom destination is outside of the Datadog GovCloud environment, which is outside the control of Datadog. Datadog shall not be responsible for any events that have left the Datadog GovCloud environment, including without limitation, any obligations or requirements that the user may have related to FedRAMP, DoD Impact Levels, ITAR, export compliance, data residency or similar regulations applicable to such events.
To set up a forwarding rule:
- Navigate to Security Settings > Events Forwarding.
- Click New Destination.
- Select the data type you want to forward.
- Enter a query to filter events. Only matching events are forwarded.
- Select and configure the destination type.
- Click Save.
Supported destination types
The following destination types are available for all data types:
- HTTP - Send events to any HTTPS endpoint with basic authentication or custom headers.
- Splunk - Forward events using Splunk’s HTTP Event Collector (HEC).
- Elasticsearch - Send events to an Elasticsearch cluster with configurable index rotation.
For logs, these destinations are also supported: Microsoft Sentinel and Google Chronicle. See Forwarding Logs to Custom Destinations for setup details.
Monitoring
The following metrics report on events that have been forwarded successfully, including events that were sent successfully after retries, as well as events that were dropped:
datadog.forwarding.<data_type>.bytesdatadog.forwarding.<data_type>.count
Where <data_type> corresponds to the forwarded data type (for example, logs, trace, signal, secruntime).
Further reading
