Datadog

Works with: Datadog Logs on every Datadog site: US1, US3, US5, EU1, UK1, AP1, AP2 and US1-FED.

1. Create an API key

In Datadog: Organisation Settings → API Keys → New Key, name it SafeHanded, and copy it. It must be an API key, not an application key.

2. Connect in SafeHanded

Settings → Integrations → Connect → Datadog: pick your site (the domain in your Datadog address bar: app.datadoghq.eu is EU1, uk1.datadoghq.com is UK1), paste the API key and choose a format. Save, then Send test event.

Start from defaults to New events only, because Datadog drops logs older than 18 hours. History older than that can be exported from the audit log.

3. Find the events

Logs → Search for source:safehanded. Each log has:

service:safehanded, host:safehanded, and tags org_id, event and level;
a status from the level (info, warn, error, or critical for security events);
a one-line message such as revealed by Jane Smith;
the full record under the safehanded attribute, e.g. @safehanded.request_id.

Troubleshooting

Rejected the credentials (HTTP 403): the key is wrong, revoked, or from a different site than the one selected.
Events don’t appear: check the time range. Each log carries the time it happened in SafeHanded.