Edwin AI Datadog Integration

The LogicMonitor Edwin AI Datadog Integration enables Edwin AI to receive event data from your Datadog environment in real time using webhooks. This facilitates automated response, alert enrichment, and cross-platform incident correlation.

This integration supports structured JSON payloads using the Edwin Common Event Format (CEF) and can be configured to enrich event data with tags and assignments. All setup actions are explicitly required and Edwin AI cannot process data until configurations are completed.

Setting up the Edwin AI Datadog integration involves the following:

• Installing and configuring the webhook integration in Datadog
• Mapping multiple webhooks to severity levels
• Assigning webhooks to monitors
• Using enrichments in webhook payloads for custom data

Requirements for Configuring Edwin AI Datadog Integration

To install and configure your Edwin AI Datadog Integration, you need the following: 

• Datadog Operator v1.0 or later
• Access to Datadog with integration permissions
• An Edwin AI Client ID and Client Secret, provided by your Edwin AI administrator

Installing and Configuring Edwin AI Datadog Integration in your Datadog Account

1. In Datadog, navigate to Integrations > Webhooks.
2. To create a new webhook integration, select New Integration. 
3. Navigate to Auth Methods tab > select New Auth Method.
4. Configure the OAuth2.0 Authentication by doing the following
   1. In the Name field, enter the Edwin AI Auth. 
   2. In the Protocol field, enter OAuth 2.2 Client Credentials. 
   3. In the Access Token URL field, enter the following URL: “https://accountname.dexda.ai/auth/token“
   4. In the Client ID field, enter the “<client_id>.” 
   5. In the Client Secret field, enter the “<client_secret>.”
      Do not enter values in any other fields. 
      For more information on configuring OAuth2.0 authentication, see Authentication – Webhooks from Datadog. 
5. Select Save. 
6. To define the webhook payload, navigate to the Configurations tab > Webhooks > select New. 
7. Enter in the following details:
   1. In then name field, enter in “LM-Edwin-Sev0.”
   2. In the URL field, enter in the following URL: “https://accountname.dexda.ai/integration/event/v1“
   3. In the Auth Method field, enter in “Edwin AI Auth.”
   4. In the Payload Type field, enter in “Monitor.”
   5. In the Payload field, paste in the Edwin CEF-formatted JSON payload. 
      For more information, see Event Records. 

For more information, see Webhooks and Webhooks Integration from Datadog. 

Mapping Multiple Webhooks to Severity Levels

In this step of mapping multiple webhooks to severity levels, you need to know the following:

• Understanding Severity Levels
• Creating Multiple Webhooks for Alert Severities
• Conditional Webhook Usage

Understanding Severity Levels

To enable severity-based routing, you need to define individual webhooks for each severity level. 

The following table describes severity values:

Creating Multiple Webhooks for Alert Severities

Datadog does not support inline payload transformation. As a result, you must create separate webhook integrations for each severity level. 

The following table provides an example mapping of webhook names to severity levels:

Conditional Webhook Usage

Use conditional tags in your monitor configuration to control when each webhook is triggered based on the alert state.

The following tags are evaluated by Datadog and determine the appropriate severity-based webhook to call:

The following example displays how conditional webhook tags can be used for your Edwin AI Datadog integration:

{{#is_alert}} @webhook-lm-edwin-sev5 {{/is_alert}}
{{#is_warning}} @webhook-lm-edwin-sev4 {{/is_warning}}
{{#is_alert_recovery}} @webhook-lm-edwin-sev0 {{/is_alert_recovery}}
{{#is_warning_recovery}} @webhook-lm-edwin-sev0 {{/is_warning_recovery}}
{{#is_alert_to_warning}} @webhook-lm-edwin-sev4 {{/is_alert_to_warning}}

Assigning Webhooks to a Monitor

1. In Datadog, navigate to the Monitors tab. 
2. Select or create a monitor.
3. In the Configure notifications & automations section, add the appropriate conditional webhook references.

For more information, see Webhooks from Datadog.

Using Enrichments in Webhook Payloads

You can use the enrichments section to include custom fields in each event. These enrichments display as new columns in Edwin AI.

The following JSON snippet illustrates how the enrichment displays in the payload:

"enrichments": {
  "dd_tags": "$TAGS",
  "assignment_group": "network_support"
}