Integrate Datadog with basic authentication

task australia Updated Nov 6, 2026 3 min read datadog-events-webhook.md
Raw file servicenow.com

Integrate Datadog with Event Management by adding a standard webhook in the Datadog console.

Before you begin

Ensure that the Event Management Connectors (sn_em_connector) plugin is installed on the ServiceNow AI Platform instance.

  • Role required: evt_mgmt_integration
  • Confirm you have created a user with an Identify Type of Machine and the evt_mgmt_integration role.
  • The Event Management plugin must be installed on the ServiceNow AI Platform instance.
  • Verify Configuration Items for the hosts managed by Datadog exist in ServiceNow. These CIs can be physical or virtual, and can be either manually created or discovered using IP discovery or Cloud discovery.

About this task

Configure the Event Management environment for the collection of events from Datadog. In your Datadog console, set your ServiceNow AI Platform instance as the rest endpoint using a standard webhook.

Procedure

  1. In the Datadog console, add cloud provider tags:

    1. Navigate to Menu > Infrastructure > Hosts.

    2. Click Inspect for the VM on which the Datadog agent is installed.

    3. Click Edit Tags and add the cloud_provider tag.

      The tag should be suffixed with the value of aws, azure, or gcp to identify the AWS, Microsoft Azure, or Google Cloud Platform (GCP) provider options. For example: cloud_provider:aws

    4. Click Save Tags to save the new tag.

      Note: Datadog adds the cloud_provider tag by default when the Azure and Google integration is installed on the Datadog agent. Tags can also be added at the cloud provider level. Datadog collects all the tags defined at the VM level on the cloud.

  2. In the Datadog console, add a webhook:

    1. Navigate to Menu > Integration > Integrations, and search for webhooks.

    2. Create a webhook that includes the user ID and password of the ServiceNow user in the endpoint.

      For example, use https://<username>:<password>@<instance-name>.service-now.com/api/sn_em_connector/em/inbound_event?source=datadog.

      Note: Verify that the selected user is assigned the evt_mgmt_integration role. To ensure proper authentication, use the least privileged user with the evt_mgmt_integration role, rather than a high privileged user.

    3. Add the required payload structure.

      • Add in the following payload structure for monitoring alerts.

        JSON
        {     "body": "$EVENT_MSG",     "last_updated": "$LAST_UPDATED",     "event_type": "$EVENT_TYPE",     "title": "$EVENT_TITLE",     "date": "$DATE",     "org": {         "id": "$ORG_ID",         "name": "$ORG_NAME"     },     "id": "$ID",     "alert_id": "$ALERT_ID",     "alert_metric": "$ALERT_METRIC",     "metric_namespace": "$METRIC_NAMESPACE",    "alert_priority": "$ALERT_PRIORITY",     "alert_transition": "$ALERT_TRANSITION",     "alert_status": "$ALERT_STATUS",     "alert_title": "$ALERT_TITLE",     "alert_type": "$ALERT_TYPE",     "host_name": "$HOSTNAME",     "priority": "$PRIORITY",     "tags": "$TAGS",     "alert_scope": "$ALERT_SCOPE" }

      • Add in the following payload structure for monitoring work items.

        Shell
        {  "id": "$CASE_ID",  "type": "$CASE_TYPE",  "status": "$CASE_STATUS",  "priority": "$CASE_PRIORITY",  "title": "$EVENT_TITLE",  "body": "$EVENT_MSG",  "assignee": {    "id": "$CASE_ASSIGNEE_ID",    "name": "$CASE_ASSIGNEE_NAME",    "email": "$CASE_ASSIGNEE_EMAIL"  },  "attributes": $CASE_ATTRIBUTES,  "correlated_alerts": $CASE_CORRELATED_ALERTS,  "date_created": "$DATE",  "date_updated": "$LAST_UPDATED",  "tags": "$TAGS"}

      ServiceNow auto-detects the case payload and represents it as a work Item alert (message key Datadog_Case_<case_id>).

  3. In the Datadog console, define rules:

    1. Navigate to Menu > Monitors > Manage Monitors, and configure rules on when to create a problem from Datadog on the managed hosts.

    2. In the Notify your team section, select the webhook on which the problem should be notified.

    Similarly, create a rule for case or work items that triggers on events such as created, priority changed, status changed, closed and so on. It then notifies your ServiceNow webhook.

Result

Alerts start flowing from Datadog agents into the Event Management plugin. The plugin extracts information from the original Datadog alert message to populate the required event fields and inserts the event into the database. In your ServiceNow AI Platform instance, navigate to All Events to see the events.

For case or work items, while creating push connectors select the Configure Work Item Alerts button. You are redirected to the Datadog work Items pull connector instance form, where you configure related-alert fetch and bi-directional synchronization. For more information, see Configure a Datadog work item connector instance.

Note: By default, host binding is enabled for Datadog events for (AWS/Azure/GCP) providers. If all hosts in the environment are discovered using Cloud Discovery by providing credentials and discovered resources are in the cmdb_ci_vm_object list, then the VM binding may not occur. To resolve this, you must enable the Datadog - General event rule. For further information about Event rules, see Event rules.

Related topics

Configure a push connector

Configure a Datadog work item connector instance

Search documentation
Search document titles and file paths on the australia branch