<style>p { margin: 0; }span.fr-emoticon.fr-emoticon-img { background-repeat: no-repeat !important; font-size: inherit; height: 1em; width: 1em; min-height: 20px; min-width: 20px; display: inline-block; margin: -0.1em 0.1em 0.1em; line-height: 1; vertical-align: middle; } span.fr-emoticon { font-weight: normal; font-family: "Apple Color Emoji", "Segoe UI Emoji", "NotoColorEmoji", "Segoe UI Symbol", "Android Emoji", "EmojiSymbols"; display: inline; line-height: 0; } blockquote { border-left: solid 2px #5e35b1; color: #5e35b1; margin-left:0; padding-left:5px;}blockquote blockquote{ border-color: #00bcd4; color: #00bcd4;}blockquote blockquote blockquote{ border-color: #43a047; color: #43a047;} table.grid{ border-collapse: collapse;} table.grid td, table.grid th { border: 1px solid #ddd;} .fr-fic.fr-dib{ display: block; margin: 5px auto;}.fr-fic.fr-dib.fr-fir{ text-align: right; margin: 5px 0 5px auto;}.fr-fic.fr-dib.fr-fil{ text-align: left; margin: 5px auto 5px 0;}.fr-fic.fr-dii{ float: none; margin: 5px auto;}.fr-fic.fr-dii.fr-fil{ float: left; margin: 5px auto;}.fr-fic.fr-dii.fr-fir{ float: right; margin: 5px auto;}img.fr-dib.fr-fir { margin-right: 0; text-align: right;}img.fr-dib.fr-fil { margin-left: 0; text-align: left;}img.fr-dib { margin: 5px auto; display: block; float: none;}img.fr-bordered { box-sizing: content-box; border: solid 5px #CCC;}img.fr-shadow { box-shadow: 10px 10px 5px 0px #cccccc;}img.fr-rounded { border-radius: 10px; -moz-border-radius: 10px; -webkit-border-radius: 10px; -moz-background-clip: padding; -webkit-background-clip: padding-box; background-clip: padding-box;}</style><p><span style="font-size: 14px;"><strong>In this guide we will cover:</strong></span></p><p><span style="font-size: 14px;"><strong>- What is the Datadog Integration?</strong></span></p><p><span style="font-size: 14px;"><strong>- Connecting to Datadog</strong></span></p><p><span style="font-size: 14px;"><strong>- Creating an Authorisation Application</strong></span></p><p><span style="font-size: 14px;"><strong>- Additional Configuration for Security Alerts</strong></span></p><p><span style="font-size: 14px;"><strong>- Default Ticket Type and End User</strong></span></p><p><span style="font-size: 14px;"><strong>- Creating the Webhooks</strong></span></p><p><span style="font-size: 14px;"><strong>- Triggering Webhooks for Monitoring Alerts</strong></span></p><p><span style="font-size: 14px;"><strong>- Triggering Webhooks for Security Alerts</strong></span></p><p><span style="font-size: 14px;"><strong>- Customise the Created Alert Ticket</strong></span></p><p><br></p><p><br></p><p><span style="font-size: 14pt;"><strong>What is the Datadog Integration?<br></strong></span></p><p><span style="font-size: 14px;">The Datadog integration is used to process alerts from Datadog into tickets in Halo. This allows you to monitor alerts within Halo and archive security alerts. </span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 18px;"><strong>Connecting to Datadog</strong></span></p><p><span style="font-size: 14px;">Head to Configuration > Integrations, here there will be a module for Datadog, enable the module by selecting the '+' icon. </span></p><p><span style="font-size: 14px;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjE1NzBlNTA4LTRkNDYtNGNhNC05YWQ0LTQ4MDgzZTZhM2JmNiJ9.AVoL0SJCFdMlOYgAY8UQ38Yyhpq8Ixuk3rzOtps4E2s" class="fr-fic fr-fil fr-dib" width="381" style="width: 383px; height: 180.281px;" height="180"></span></p><p><span style="font-size: 10pt;"><strong>Fig 1. Enable Module.</strong></span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Now open up the module, to connect you will need to enter the URL of your Datadog site and your API key. The site URL can be obtained from your browser when you have logged into Datadog, this will follow the forma</span>t '<a data-fr-linked="true" href="https://app.datadoghq.HOSTEDREGION" id="isPasted">https://app.datadoghq.HOSTEDREGION</a>'<span style="font-size: 14px;">. Once obtained paste this into the 'Datadog Site' field in Halo. </span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">To obtain your API key you will need to open the Datadog 'Agent Manager' application on your device. Under 'settings' you will see your API key, see figure 2 for reference. </span></p><p><br></p><p><span style="font-size: 14px;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjA2YzZiNjAzLTg2NzAtNDhjNy05OWE2LTNkNTk2YjdkMmQ0NCJ9._J_nUf3QhPw6hv9F6iZdOLCtXSrKt65cr0ZkFJ0Snik" class="fr-fic fr-fil fr-dib" width="1208" style="width: 1210px; height: 602.246px;" height="602"></span></p><p><span style="font-size: 10pt;"><strong>Fig 2. API key in Datadog Agent Manager.</strong></span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Copy the API key and paste this into the 'API Key' field in Halo. </span></p><p><br></p><p><span style="font-size: 14px;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImRhMWEwZjE5LTk3ZmUtNDUxZS05MTc5LTBhMDIyODY3MTk2MCJ9.2_727HHWuNzpBEmYJ2IQmJABNb-wWpWVsl_FI6IKShM" class="fr-fic fr-fil fr-dib" width="973" style="width: 975px; height: 336.563px;" height="337"></span></p><p><span style="font-size: 10pt;"><strong>Fig 3. Fields to paste site URL and API key into.</strong></span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14pt;"><strong>Creating an Authorization Application</strong></span></p><p><span style="font-size: 14px;">Before we create the webhooks in Datadog, we need to create an authorization method for the webhook in Halo. Head to Configuration > Integrations > Halo API > View Applications > New. Here, name the application something like 'Datadog authentication'. Set the Authentication Method to be 'Client ID and Secret'. Set the login type to be 'Agent' and the 'Agent to log in as' to be an agent with admin permissions. This may be an admin agent in your instance or you may have a specific API agent you would like to use. </span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Now head to the permissions tab, you will need to give the application the following permissions:</span></p><ul><li style="font-size: 14px;">all:teams</li><li style="font-size: 14px;">read:tickets</li><li style="font-size: 14px;">edit:tickets</li></ul><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Before saving, head back to the details tab and copy both the client ID and the Client secret for the application. </span></p><p><br></p><p><span style="font-size: 14px;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImM0NjMzNzMxLTRiYjEtNDdmNi04NzU2LWJkMWI5NjQ2YTBkNCJ9._Tu68kmNxKqcluoZfWf6bZrdhi1vs4_hUmsN10n5fbo" class="fr-fic fr-fil fr-dib" width="1033" style="width: 1035px; height: 636.483px;" height="636"></span><br></p><p><span style="font-size: 10pt;"><strong>Fig 4. Client ID and secret for API application.</strong></span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Save the application, now head into Datadog. </span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Once in Datadog head to the 'integrations' area and open 'webhooks', if you do not have webhooks installed already you will need to install this. </span></p><p><br></p><p><span style="font-size: 14px;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjcxZmZjZWUxLTE2MjAtNDI0YS04YTcxLWRiMTYwMjQ2YmU0OSJ9.Gik0e7nxMiETq8u1_un6vOKjrj8MRk2oCJe6RhExUjc" class="fr-fic fr-fil fr-dib" width="1205" style="width: 1207px; height: 646.105px;" height="646"></span></p><p><span style="font-size: 10pt;"><strong>Fig 5. Webhooks in Datadog.</strong></span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Open the webhook integration area and go to the 'Auth Methods' tab, create new Auth Method, Call this something sensible like 'Halo Authentication' and set the protocol as 'OAuth 2.0 Client Credentials'. </span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">In the 'Access token URL field enter YOURHALODOMAIN/auth/token?tenant=TENANTNAME, your tenant name can be found by going to Configuration > Halo API, here you can see your tenant name under the 'Tenant' field. </span></p><p><br></p><p><span style="font-size: 14px;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjgzNjk1ZDQwLTg2NDUtNGVkYi1hY2QzLTkxYzIyMGY0MTQ5ZSJ9.ruhWUcFiZtQcFgzoQsX1hYGj1u5tXEHnudW8726GIks" class="fr-fic fr-fil fr-dib" width="1195" style="width: 1197px; height: 395.443px;" height="395"></span></p><p><span style="font-size: 10pt;"><strong>Fig 6. Tenant Name.</strong></span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">In the 'Client ID' and 'Client Secret' fields paste the ID and secret from the application you set up in Halo. </span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">In the 'Scope' field enter the following: 'read:tickets edit:tickets' </span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Save this auth method. See figure 7 for an example on how the auth method should appear.</span></p><p><br></p><p><span style="font-size: 14px;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImVjNmJiMTQ3LTY0NjUtNGZkMS1hZDg3LTc2YmQ1YWY1NzUzNiJ9.KvCiEM1HIGP45EBSxYUFWGw2Byah_2MZc1oXRzHD1P0" class="fr-fic fr-fil fr-dib" width="1210" style="width: 1212px; height: 1123.27px;" height="1123"></span></p><p><span style="font-size: 10pt;"><strong>Fig 7. Auth method in Datadog.</strong></span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14pt;"><strong>Additional Configuration for Security Alerts</strong></span></p><p><span style="font-size: 14px;">For security alerts only, you will need to generate an application key, this will allow you to change the status of the alert in Datadog when closing the associated ticket in Halo. </span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">To generate an application key head to personal settings > my organisation > application keys > new key, give the key a sensible name and generate it. Copy the key from Datadog and paste it into the integration setup page in Halo. It is the key itself (not the Key ID) that you will need to copy.</span></p><p><br></p><p><span style="font-size: 14px;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImNjYWQ3M2RhLWY3OTItNDdmMC1iNzQ1LWE1OGU0ZjJkNzU1YyJ9.kclLZr7UoIaCU5nB4DkCiEM8nM5l7OkT6WsrwA3M7DY" class="fr-fic fr-fil fr-dib" width="1220" style="width: 1222px; height: 351.166px;" height="351"></span></p><p><span style="font-size: 10pt;"><strong>Fig 8. Application Key in Datadog.</strong></span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14pt;"><strong>Default Ticket Type and End User</strong></span></p><p><span style="font-size: 14px;">Before creating webhooks ensure you have set the ticket type and end user that the alerts will be logged under when they come in. If you need the ticket type/end user to vary depending on the alert this can be changed using the payload for the webhook, but these fields still need to be set. You may want to create a new ticket type for these alerts.</span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14pt;"><strong>Creating the Webhooks</strong></span></p><p><span style="font-size: 14px;">There are at least two webhooks that need to be created, one to process monitoring alerts, one to process security alerts. However, you can create as many webhooks as you like, if you would like the ticket information/ticket type/user to vary depending on the alert you will need to create a different webhooks for each of these. </span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">With the webhook integration area still open in Datadog, head to the Configuration tab, create a new webhook. Call the webhook something sensible like 'Alerts-Halo'. </span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">In the 'URL' field enter the following 'YOURHALODOMAIN/api/notify/datadog'.</span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">In the 'Auth Method' field select the auth method we set up earlier. </span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">To get the payload head back to Halo, Configuration > Integrations > Datadog > Webhook, here is an example payload you can use for the webhook. This will create a ticket in Halo, populating the summary of the ticket to be the title of the event and setting the priority of the ticket to P1. This example payload can also be seen below:</span></p><p><span style="font-size: 14px;"><br></span></p><p id="isPasted"><span style="font-size: 14px;">{</span></p><p><span style="font-size: 14px;"> "datadog_id": "$ID",</span></p><p><span style="font-size: 14px;"> "security_signal_id": "$SECURITY_SIGNAL_ID",</span></p><p><span style="font-size: 14px;"> "summary": "$EVENT_TITLE",</span></p><p><span style="font-size: 14px;"> "priority_id": "1",</span></p><p><span style="font-size: 14px;"> "details": "$EVENT_MSG",</span></p><p><span style="font-size: 14px;"> "new_external_link": {</span></p><p><span style="font-size: 14px;"> "table_id": "1",</span></p><p><span style="font-size: 14px;"> "module_id": "391",</span></p><p><span style="font-size: 14px;"> "third_party_id": "$ID",</span></p><p><span style="font-size: 14px;"> "third_party_url": "$LINK",</span></p><p><span style="font-size: 14px;"> "third_party_desc": "$SECURITY_SIGNAL_ID"}</span></p><p><span style="font-size: 14px;">}</span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Enter your payload into the payload field and save the webhook. </span></p><p><br></p><p><span style="font-size: 14px;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImIwODM1MDZhLWZkYWItNDU2Yi04ZjQ2LWZiY2MxOWE4MjMzZCJ9.si9toew0vZqcFr0DPOBvwgJvEoxft0gZlLKtzE8K8Jc" class="fr-fic fr-fil fr-dib" width="911" style="width: 913px; height: 713.304px;" height="713"></span></p><p><span style="font-size: 10pt;"><strong>Fig 9. Webhook setup in Datadog.</strong></span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Now we can have this webhook trigger when a particular alert takes place. The setup for the webhook trigger differs slightly for monitoring and security alerts</span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 18px;"><strong>Triggering Webhooks for Monitoring Alerts</strong></span></p><p><br></p><p><span style="font-size: 14px;">To do this, navigate to the 'Monitors' module and select 'New Monitor';</span></p><p><br></p><p><span style="font-size: 14px;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjVlOTBkNDcwLWViOWItNDdiZC1hY2QzLTFlNDBiOGJiMWRiMyJ9.Il1uXvuWSM240CWlV8u-RiVwqfCR7U24nSnIeyKoiMg" class="fr-fic fr-fil fr-dib" width="632" height="673"></span></p><p><br></p><p>Select a Monitor Type;</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImE1MTkxYzNjLTRjM2ItNGRlNi1hZDM0LTZjNjVlNTA2MDdhYiJ9.M8l0d02y5lIODKUkJt8HM9VQY1BvGpmvZOex1Vh9RtA" class="fr-fic fr-fil fr-dib" width="605" height="816"></p><p><br></p><p><span style="font-size: 14px;" id="isPasted">Configure your monitoring alert, at stage 4 'Configure notifications and automations' enter the following into the event message:</span></p><p><br></p><p id="isPasted"><span style="font-size: 14px;"><!--StartFragment--></span></p><p><span style="font-size: 14px;">@webhook-NAMEOFWEBHOOK</span></p><p><span style="font-size: 14px;"><!--EndFragment--></span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Now save the alert. You can test the webhook using the 'Test Notifications' button on the alert page.</span></p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjAyYjZmZTk2LTYxNTEtNDFhYy1hZDk2LWU0YmQyYjhmY2M0NSJ9.MBbUW7jyaBBATKpkcAloinDXDOhmxygs661LNtmoqjY" class="fr-fic fr-fil fr-dib" width="1169" height="862"></p><p id="isPasted"><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjYwYThjOGI2LTZhZjAtNGU4OC05NjRhLTE2OGYwODdlNGIxOCJ9.57HA_qus1gpfsbAEe8vG24NEHUBguFlV7i6pDsL1P9U" class="fr-fic fr-fil fr-dib" width="1216" style="width: 1218px; height: 666.011px;" height="666"></span></p><p><span style="font-size: 10pt;"><strong>Fig 10. Monitoring Alert setup page with webhook trigger.</strong></span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Once you test the notifications the tickets relating to the alert will be created in Halo almost instantly. If the test is successful, each time the alert is triggered a ticket will be created in Halo. See figure 11 to reference how the ticket will look in Halo using the example payload. Note the agent who 'opened' the ticket is the agent you set to log in as in the authentication application. </span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6Ijk0NjI4Yjk5LTA3N2ItNDEyNi05MDE4LTdiODFlNWY4NjAzMCJ9.nztWdQJdqegVDsZNTu5CZ1VTF4X7yyt30FK1tqCdEPw" class="fr-fic fr-fil fr-dib" width="1191" style="width: 1193px; height: 688.299px;" height="688"></span></p><p><span style="font-size: 10pt;"><strong>Fig 11. Ticket created from alert.</strong></span></p><p><span style="font-size: 14px;"><br></span></p><p id="isPasted"><span style="font-size: 18px;"><strong>Triggering Webhooks for Security Alerts</strong></span></p><p><span style="font-size: 14px;">Open the detection rule in Datadog that is used to trigger a security alert. At stage 3 of the rule 'Set rule cases' enter '@webhook-NAMEOFWEBHOOK' into the notify field, shown in figure 12.</span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjM3NjM3YjZmLWM0ZGEtNGI0OS05MjllLWI2NzQwNDc1MmYwNCJ9.kVkohbfki6gfeBddcdQlB_I8MKuiXTPPNM2tUaLTEHE" class="fr-fic fr-fil fr-dib" width="1213" style="width: 1215px; height: 156.096px;" height="156"></span></p><p><span style="font-size: 10pt;"><strong>Fig 12. Security Alert setup page with webhook trigger.</strong></span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Unlike monitoring alerts, you cannot 'test' security alerts/detection rules so once you have added the webhook trigger you will need to trigger the alert to test the webhook is successful. </span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Once a security alert has triggered a ticket being logged in Halo, closing the ticket will change the status of the alert in Datadog to 'archived'. </span></p><p><br></p><p><span style="font-size: 18px;"><strong>Customise the Created Alert Ticket</strong></span></p><p><span style="font-size: 14px;">You can adjust the example payload to control what information is pulled into the ticket in Halo, as well as change the details/ticket type/user of the ticket. </span></p><p><br></p><p><span style="font-size: 12pt;"><strong>Custom Fields<br></strong></span></p><p><span style="font-size: 14px;">To have custom fields on the ticket be populated with data from the Datadog alert, first ensure the custom fields are set against the ticket type the alert is going to create. For example, if you would like the Hostname that the alert is in regards to appear in the ticket details, create a custom field for this (it will need to be a text field) and add this to the ticket type. </span></p><p><br></p><p><span style="font-size: 14px;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjFmZmUwOTE1LWFkNjgtNDc5NS1hOGUzLWFkZWM2ZjA2NGYxOSJ9.AkTXrNDegrzq3pheTI8k0HWwQSAbFH0UspFzR_XBeP4" class="fr-fic fr-fil fr-dib" width="1215" style="width: 1217px; height: 539.197px;" height="539"></span></p><p><span style="font-size: 10pt;"><strong>Fig 13. Adding custom field to ticket type.</strong></span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Now the custom field is on the ticket type you can adjust the payload. Add the following into the payload:</span></p><p><span style="font-size: 14px;"><br></span></p><p id="isPasted"><span style="font-size: 14px;">"customfields": [</span></p><p><span style="font-size: 14px;"> {"id": "239",</span></p><p><span style="font-size: 14px;"> "value": "$HOSTNAME"},</span></p><p><span style="font-size: 14px;"> ]</span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Let's break this down. The ID we are calling on is the ID of the custom field we want to populate. You can obtain the ID by heading to Configuration > Custom Objects > Custom Fields > select your custom field, once open the ID of the field will appear in the URL after 'id='</span></p><p><br></p><p><span style="font-size: 14px;">The value is the value that we would like to populate the field with. We can either assign a set value here, such as a set number/text, or use a variable to pull the data from Datadog. The variable in the above example will pull through the name of the host that triggered the alert. For a list of the variables Datadog uses see their guide <a data-fr-linked="true" href="https://docs.datadoghq.com/integrations/webhooks/" id="isPasted" target="_blank" rel="noopener noreferrer">here</a>.</span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">See below for how the payload should look once custom fields are included:</span></p><p><span style="font-size: 14px;"><br></span></p><p id="isPasted"><span style="font-size: 14px;">{</span></p><p><span style="font-size: 14px;"> "datadog_id": "$ID",</span></p><p><span style="font-size: 14px;"> "security_signal_id": "$SECURITY_SIGNAL_ID",</span></p><p><span style="font-size: 14px;"> "summary": "$EVENT_TITLE",</span></p><p><span style="font-size: 14px;"> "priority_id": "1",</span></p><p><span style="font-size: 14px;"> "customfields": [</span></p><p><span style="font-size: 14px;"> {"id": "239",</span></p><p><span style="font-size: 14px;"> "value": "$HOSTNAME"}],</span></p><p><span style="font-size: 14px;"> "new_external_link": {</span></p><p><span style="font-size: 14px;"> "table_id": "1",</span></p><p><span style="font-size: 14px;"> "module_id": "391",</span></p><p><span style="font-size: 14px;"> "third_party_id": "$ID",</span></p><p><span style="font-size: 14px;"> "third_party_url": "$LINK",</span></p><p><span style="font-size: 14px;"> "third_party_desc": "$SECURITY_SIGNAL_ID"}</span></p><p><span style="font-size: 14px;"> </span></p><p><span style="font-size: 14px;">}</span></p><p><br></p><p><span style="font-size: 12pt;"><strong>Changing ticket type/end user</strong></span></p><p><span style="font-size: 14px;">To change the user that the ticket is logged under following the alert, adjust the payload for the webhook the alert is triggering. In the payload you will need to add the following:</span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">"user_id": "X" </span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Where X is the id of the user that you would like the ticket to be logged under. To get the ID of a user head to the user's profile in Halo, the ID will appear in the URL following 'userid='.</span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">To change the ticket type of the ticket that is logged following the alert, add the following to the webhook payload:</span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">"tickettype_id": "X" </span></p><p><span style="font-size: 14px;"><br></span></p><p><span style="font-size: 14px;">Where X is the ID of the ticket type you would like the ticket to be logged as. The ID of a ticket type can be obtained by heading to the Configuration > Tickets > Ticket Types > select the required ticket type, here the ID of the ticket type can be found in the URL following 'id='. </span></p><p><span style="font-size: 14px;"><br></span></p><p><br></p>
