Secure your Datadog surface
Retention shorter than your investigation window, monitors muted indefinitely, and API keys with no owner. We don’t connect to Datadog to collect evidence for its own sake — we connect to secure it, and the compliance artefacts follow from that work.
Book a Demo[01] What This Surface Exposes
Where Datadog goes wrong
Datadog goes wrong through muting: a monitor silenced during an incident and never restored is a control switched off without a decision.
- Log retention configured below the window you would need to investigate a breach
- Monitors muted during an incident and never unmuted
- API and application keys held by former employees or unidentified services
- Sensitive data flowing into logs without scrubbing rules
- Agent coverage gaps on hosts that matter
[02] What We Secure
What we watch, catch and fix on Datadog
On Datadog we monitor mute state and check retention against your investigation window rather than against cost targets.
- Retention checked against your incident response and regulatory requirement, not against cost targets alone
- Mute state monitored, because an indefinitely muted monitor is a control that has been switched off without a decision
- Key inventory with owner and last use
- Log scrubbing verified, since logs are a common uncontrolled store of personal data
- Agent coverage reconciled against your asset register
[03] Where It Lands
Where Datadog lands in your registers
Logging and alerting platforms enter the asset register as critical dependencies, since losing them blinds every detective control you own. Access reviews cover who can alter retention, silence alerts, or read logs containing personal data. The risk register carries what a monitoring gap actually means: an incident window you would not be able to reconstruct.
[04] How We Engage
On Datadog specifically
On Datadog, we unmute stale monitors, rotate ownerless keys, and add scrubbing rules. Retention changes and log volume redesign we plan with you because both carry real cost implications.
Platform licence
Everything you need to find and fix it yourself, with no ceiling on the depth of the answer.
- Every connected tool monitored for misconfiguration and drift, with findings mapped to the assets and risks they affect
- Remediation guidance that tells you what is wrong and exactly how to fix it — however deep or awkward the issue is. We are engineers running a security company, so the answer is the real one, not a link to vendor documentation
- Assets, access reviews, and risk register populated from the tools themselves rather than from spreadsheets
- Unlimited integrations and unlimited users, with anything missing built within two weeks
Managed service
Every tool you connect through Konfirmity comes under our care, with our team doing the work.
- Continuous misconfiguration and drift monitoring across every connected tool, watched by our analysts rather than by a dashboard waiting for you
- Incident response led by us, with containment coordinated with your team
- Remediation performed directly wherever you have granted us the authority to act — and where we cannot act, we project-manage the fix to completion rather than handing you a ticket
- Decision support on the tools themselves: where something is failing you on capability or costing more than it returns, we will tell you, and help you replace it
[05] Datadog FAQs
What Datadog access does Konfirmity need?
Konfirmity needs an API key plus an application key belonging to a read-only user, covering monitors, logs configuration, hosts and usage. We read configuration and coverage, not your log contents.
How do you decide whether our retention is long enough?
By working back from your incident response and regulatory obligations rather than from a default. If your breach notification window is 72 hours but investigation regularly starts weeks after the event, retention shorter than that window means the evidence is already gone.
Splunk
Amazon CloudWatch
Grafana
New Relic
Elastic