Datadog · Audit Trail
Audit trail for Datadog in Saudi Arabia: who changed what in your monitoring, and when
An audit trail answers a simple question that auditors and security teams ask about every system: who did what, and when. Datadog Audit Trail records it for Datadog itself, from sign-ins and API key use to a deleted dashboard, a muted monitor or a changed log index. Those events can be searched, alerted on and kept as evidence for internal and regulatory audits. Interkey is an official Datadog partner in Saudi Arabia: it sells the licences, switches on and tunes Audit Trail, sets retention and archives with your security team, and provides technical support from Riyadh.
In short
- What it records: every request made to Datadog, and product events such as changes to dashboards, monitors, log indexes and pipelines, keys and roles.
- What it is for: investigating a change, proving to an auditor who has access and what they did, and alerting on risky changes.
- How long it keeps events: 90 days by default once enabled, per Datadog's documentation, with an archive to your own storage for longer.
- What it does not cover: activity in your own applications and databases; those audit logs belong in Log Management.
- What Interkey does: licences, set-up, retention and archive design, alerts, evidence reports and technical support.
At a glance: what Datadog Audit Trail records
Datadog describes two kinds of audit event: request events, which map each API request to the user or key that made it, and product events, which describe a change inside a Datadog product.
| Area | What is recorded | Who usually reads it |
|---|---|---|
| Sign-in and access | Logins, multi-factor authentication, API and application keys | Security team, auditors |
| Users, roles and policies | Users added or removed, role and permission changes, restriction policies, IP allowlists | Platform owners, auditors |
| Dashboards and notebooks | Who created, edited or deleted them, with the configuration before and after | Operations and service teams |
| Monitors and alerting | Monitors created, changed, muted or deleted | On-call engineers, service owners |
| Log and APM settings | Log indexes, exclusion filters, pipelines, log-based metrics and APM retention filters | Platform owners, finance |
| Audit Trail itself | Who enabled it, changed its retention or its archive | Security team, auditors |
What an audit trail for monitoring has to answer
Monitoring is where an organisation decides what it sees. A changed log index can stop a class of logs from being kept; a muted monitor can hide an outage; a new API key can send data out of the platform. When something goes wrong, or when an auditor asks, the team needs to show who made each change, when, from where, and what it looked like before.
Read more
A useful audit trail for a monitoring platform therefore covers four things: access (who signed in and with which key), configuration (what changed in dashboards, monitors and data settings), evidence (records kept long enough and out of reach of the people being audited), and response (an alert when a risky change happens, rather than finding it weeks later).
Audit trail in Datadog: who changed what, and when
Datadog Audit Trail is switched on in Organization Settings, under Compliance, by a user with the Audit Trail Write permission. From then on, events appear in the Audit Explorer, where they can be filtered by user email, client IP, HTTP method, status and event name. Viewing them needs the Audit Trail Read permission, so access to the record can be limited to security and audit staff.
Read more
Two features matter most in an investigation. Inspect Changes shows the configuration of a dashboard, notebook or monitor before and after an edit, side by side. Notable events are configuration changes that Datadog flags as likely to affect billing or security, such as changes to log indexes, exclusion filters, log-based metrics, APM retention filters and Synthetic tests; one query lists them all. Datadog also ships an out-of-the-box Audit Trail dashboard covering index retention, pipeline and dashboard changes, which can be cloned and adapted.
Retention, archives and access: the settings to decide
Most of the design work is a handful of settings. Each one should be agreed with your security and audit teams before Audit Trail goes live.
| Setting | What Datadog documents | What to decide |
|---|---|---|
| Retention in Datadog | 90 days by default once enabled; 3, 7, 15, 30 or 90 days can be chosen; 7 days if Audit Trail is turned off | How long events must stay searchable in Datadog |
| Archive | Events written to Amazon S3, Google Cloud Storage or Azure Storage, uploaded every 15 minutes | Which bucket, in which region, with which retention and access rules on your side |
| Who can switch it on or off | The Audit Trail Write permission | A small named group, kept apart from day-to-day administrators |
| Who can read events | The Audit Trail Read permission | Security, audit and the platform owner |
| Forwarding | Audit events sent as JSON to up to three destinations, such as an HTTPS endpoint | Whether a security tool you already run needs a copy |
| Export | Up to 100,000 events downloaded as CSV from a search | The evidence pack an auditor receives, and who prepares it |
For records that must outlive the retention period in Datadog, the archive is the answer: it sits in storage you own, under your own retention and access rules. Our Datadog data residency guide sets out how Interkey designs what leaves your environment and where it is kept.
Audit logs as evidence: compliance monitoring in Saudi Arabia
Saudi organisations often meet two sets of expectations about logs and accountability. The National Cybersecurity Authority (NCA) publishes cybersecurity controls that apply to government entities and many critical operators, and they expect security events to be logged, monitored and reviewed. The Personal Data Protection Law, overseen by the Saudi Data and AI Authority (SDAIA), expects an organisation to be able to show how personal data is accessed and protected. Read the authorities' own documents for what applies to you; our NCA ECC guide explains the controls in general terms.
Read more
Audit Trail helps with one part of that evidence: the monitoring platform itself. It shows who has access to your logs and dashboards, who changed a retention or exclusion setting, and whether an alert was muted before an incident. It does not record what happens inside your applications, databases or identity provider. Those audit logs are collected with Datadog Log Management and, where detection is needed, analysed in Datadog Cloud SIEM, which can also read Audit Trail events. Compliance remains a set of decisions your organisation makes; the tool provides records and alerts.
Access logging, alerts and reports on audit events
Access is where most audit questions start. Audit Trail records logins, multi-factor authentication, the creation and use of API and application keys, and changes to users, roles and IP allowlists.
Interkey usually sets up three checks: a monitor on sign-ins from outside your approved addresses, a monitor when an administrator role or a key is created, and a monthly review of who holds which role. With posture checks from Datadog cloud security, the security team sees access to the cloud estate and to the platform that watches it.
Read more
Monitors can also trigger on any audit event, such as a dashboard deletion or a changed log index. Dashboards chart audit events and can be sent as a scheduled report, and a saved search can be downloaded as CSV, so the evidence pack is the same query each time.
Data residency and local support for audit records
Audit events name people: user emails and client IP addresses are part of every record. Datadog is SaaS, and as of November 2026 its documented sites are in the US, Germany, Japan, Australia and the UK, none in the Middle East. Audit events are kept in the Datadog site your organisation uses, so Interkey agrees with your security team which site is used, how long events stay there, and whether the long-term archive goes to a storage bucket in a region you choose.
Support comes from Interkey's engineers in Riyadh, in Arabic and English, including help preparing the evidence an auditor asks for.
How an audit trail project runs with Interkey
-
Agree the questions.
What your auditors and security team need to answer, and for how long.
-
Quote the licences.
Audit Trail and any related Datadog products, quoted with set-up and support.
-
Switch on and set permissions.
Audit Trail enabled; Write and Read permissions given to named groups.
-
Design retention and the archive.
Retention in Datadog, the archive bucket and its access rules, reviewed by your security team.
-
Build alerts and views.
Monitors on risky changes and access, saved searches and a dashboard for reviews.
-
Prepare the evidence pack.
The saved queries, exports and scheduled reports an auditor will receive.
-
Operate or hand over.
Interkey runs the monthly reviews from Riyadh, or hands them over and stays on as technical support.
Datadog Audit Trail pricing and what drives the timeline
Datadog's public price list bills Audit Trail as a share of your Datadog spend, with a different rate for annual and monthly billing, rather than per event. So the Audit Trail line grows with the rest of the Datadog bill. The archive adds storage costs in your own cloud account, billed by that provider. Our Datadog pricing guide explains how each Datadog product is billed, and Interkey quotes Audit Trail together with your other licences.
Read more
The timeline is an estimate, not a promise. Switching Audit Trail on takes minutes, and events start from that moment, not before. Designing retention and the archive, building alerts and agreeing the evidence pack typically takes one to three weeks. The drivers are the number of Datadog organisations, how many teams must agree, and how fast security reviews finish.
Questions buyers ask
What does Datadog Audit Trail record about our users?
Every request made to Datadog, mapped to the user or key that made it, plus product changes such as edits to dashboards, monitors, log indexes, roles and keys. Each event carries the user, the client IP and the time.
How long does Datadog keep audit trail events?
Datadog documents 90 days by default once Audit Trail is enabled, with shorter periods available. For longer keeping, events can be archived to Amazon S3, Google Cloud Storage or Azure Storage that you own.
Can Datadog audit events be used as evidence in an NCA or internal audit in Saudi Arabia?
Yes, for the monitoring platform itself: who had access, what changed and when. Your applications and databases need their own audit logs. Which evidence an audit requires is set by the regulator and your policies.
Do Datadog audit events stay inside the Kingdom?
Not in Datadog itself: as of November 2026 Datadog lists no Middle East site. The long-term archive can go to a storage bucket in a region you choose, and Interkey designs that with your security team.
How is Datadog Audit Trail priced and bought in KSA?
Datadog bills Audit Trail as a share of your Datadog spend, per its public price list. Interkey sells Datadog licences in Saudi Arabia and quotes Audit Trail with set-up and support.
How quickly can we switch on an audit trail before an audit?
Enabling it takes minutes, but it records only from that moment. Retention, archive, alerts and the evidence pack typically take one to three weeks, depending on teams and security reviews.
Next
Read next
Next step
Set up your Datadog audit trail
Tell us how many Datadog organisations and users you have, which audits you prepare for, and how long records must be kept. We can quote the licences, the set-up and technical support together.
Or directly
+966-11-2180999 [email protected]Tawuniya Towers, North Tower, 7th Floor, King Fahad Highway, Olaya, P.O. Box 56835, Riyadh 11564, Saudi Arabia