---
title: "Connect Datadog"
description: "Send Datadog monitor alerts and recoveries to Firefight through the Webhooks integration."
canonical: https://firefight.app/docs/alerts/datadog
---

# Connect Datadog

Firefight has a dedicated alert source for Datadog monitors. Datadog lets you write the webhook's body yourself, so the source's setup gives you a payload template to paste, and every alert recovers in Firefight when the monitor recovers.

## Set up the Firefight side

Go to **Settings → Alert Sources**, click **Add source**, give it a name like "Datadog monitors", and pick the **Datadog** provider. When you create it, Firefight opens the source's setup. It shows the ingest URL and a **Copy token** button for the source's secret token, and the same steps as this page.

## Set up the Datadog side

1. In Datadog, open the **Webhooks** integration and add a webhook. Name it, for example `firefight`, and paste the ingest URL as its URL.
2. Replace its payload with the template from the source's setup (click **Copy template**). Leave **Encode as form** off.
3. Under **Custom Headers**, enter `{"X-Firefight-Token": "<token>"}` with the source's token, and save.
4. Mention `@webhook-firefight`, or the name you chose, in the message of each monitor that should alert.

Requests that fail the check are rejected with `401`, and the source's row in **Settings → Alert Sources** shows the rejection.

:::caution
Datadog's default webhook body says nothing about whether a monitor triggered or recovered. Firefight refuses it as an unrecognized payload, so the template is required.
:::

## What Firefight reads

Each alert gets these fields, which you can match in your [routing rules](https://firefight.app/docs/alerts/routing-rules.md).

| Field | Value |
|---|---|
| `title` | The monitor's event title, without the leading `[Triggered on ...]` |
| `description` | The monitor's message |
| `service` | The monitor's `service` tag |
| `environment` | The monitor's `env` tag |
| `team` | The monitor's `team` tag |
| `severity_raw` | The monitor's priority, such as `P1` |
| `url` | The event in Datadog |

The alert's title in Slack and on the dashboard links to its page in Datadog.

## Firing and resolving

Every transition except **Recovered** fires, including warnings, no data and renotifications, and each counts on the same alert until the monitor recovers. The recovery resolves it.

See [Grouping & deduplication](https://firefight.app/docs/alerts/grouping-and-deduplication.md) for how repeat firings collapse into one alert.