Datadog & Splunk Integration

TealTiger exports governance telemetry via OpenTelemetry (OTLP), which means any platform that accepts OTLP data works out of the box — including Datadog, Splunk, New Relic, Elastic, and Grafana Cloud.

Architecture

TealTiger emits traces, metrics, and logs via OTLP. The OpenTelemetry Collector routes them to your SIEM/APM platform.

Datadog

Step 1: Configure TealTiger OTLP export

import { TealEngine } from 'tealtiger';

const engine = new TealEngine({
  policies: { /* ... */ },
  telemetry: {
    opentelemetry: {
      enabled: true,
      endpoint: 'http://localhost:4318',  // OTel Collector
      serviceName: 'tealtiger-governance',
      exportDecisions: true,
      exportCosts: true,
      exportMetrics: true,
    }
  }
});

from tealtiger import TealEngine

engine = TealEngine({
    "policies": {},
    "telemetry": {
        "opentelemetry": {
            "enabled": True,
            "endpoint": "http://localhost:4318",
            "serviceName": "tealtiger-governance",
            "exportDecisions": True,
            "exportCosts": True,
            "exportMetrics": True,
        }
    }
})

Step 2: Configure OTel Collector for Datadog

receivers:
  otlp:
    protocols:
      grpc:
        endpoint: 0.0.0.0:4317
      http:
        endpoint: 0.0.0.0:4318

processors:
  batch:
    timeout: 5s
    send_batch_size: 1000

  attributes:
    actions:
      - key: deployment.environment
        value: production
        action: upsert

exporters:
  datadog:
    api:
      key: ${DD_API_KEY}
      site: datadoghq.com
    traces:
      span_name_as_resource_name: true
    metrics:
      resource_attributes_as_tags: true

service:
  pipelines:
    traces:
      receivers: [otlp]
      processors: [batch, attributes]
      exporters: [datadog]
    metrics:
      receivers: [otlp]
      processors: [batch]
      exporters: [datadog]
    logs:
      receivers: [otlp]
      processors: [batch]
      exporters: [datadog]

Step 3: Run the Collector

docker run -d \
  -e DD_API_KEY=your-datadog-api-key \
  -p 4317:4317 \
  -p 4318:4318 \
  -v $(pwd)/otel-collector-config.yaml:/etc/otelcol/config.yaml \
  otel/opentelemetry-collector-contrib:latest

Datadog Dashboard

Once data flows, you’ll see in Datadog:

APM Traces: Each engine.evaluate() call appears as a span with decision, reason codes, and risk score
Custom Metrics: tealtiger.decisions.total, tealtiger.decisions.denied, tealtiger.cost.total
Logs: Audit events with full decision context

Create a Datadog dashboard with:

Decision rate (ALLOW vs DENY over time)
P95 evaluation latency
Cost per provider/model
Top reason codes for denials
Risk score distribution

Splunk

Step 1: Configure TealTiger OTLP export

Same as Datadog — TealTiger exports to the OTel Collector.

Step 2: Configure OTel Collector for Splunk

# otel-collector-config.yaml
receivers:
  otlp:
    protocols:
      grpc:
        endpoint: 0.0.0.0:4317
      http:
        endpoint: 0.0.0.0:4318

processors:
  batch:
    timeout: 5s

exporters:
  splunk_hec:
    token: ${SPLUNK_HEC_TOKEN}
    endpoint: https://your-splunk-instance:8088/services/collector
    source: tealtiger
    sourcetype: tealtiger:governance
    index: main
    tls:
      insecure_skip_verify: false

  # For Splunk Observability Cloud (SignalFx)
  signalfx:
    access_token: ${SPLUNK_ACCESS_TOKEN}
    realm: us1

service:
  pipelines:
    traces:
      receivers: [otlp]
      processors: [batch]
      exporters: [splunk_hec]
    metrics:
      receivers: [otlp]
      processors: [batch]
      exporters: [signalfx]
    logs:
      receivers: [otlp]
      processors: [batch]
      exporters: [splunk_hec]

Step 3: Run the Collector

docker run -d \
  -e SPLUNK_HEC_TOKEN=your-hec-token \
  -p 4317:4317 \
  -p 4318:4318 \
  -v $(pwd)/otel-collector-config.yaml:/etc/otelcol/config.yaml \
  otel/opentelemetry-collector-contrib:latest

Splunk Queries

Search for TealTiger governance events:

index=main sourcetype="tealtiger:governance"
| stats count by decision_action
| sort -count

Top denial reasons:

index=main sourcetype="tealtiger:governance" decision_action="DENY"
| spath reason_codes{}
| mvexpand reason_codes{}
| stats count by reason_codes{}
| sort -count

Cost tracking:

index=main sourcetype="tealtiger:governance"
| timechart sum(estimated_cost) by provider

What TealTiger exports via OTLP

Traces (Spans)

Every engine.evaluate() call emits a span:

Attribute	Example	Description
`tealtiger.decision`	`ALLOW` / `DENY`	Policy decision
`tealtiger.reason_codes`	`["BUDGET_EXCEEDED"]`	Why the decision was made
`tealtiger.risk_score`	`75`	Computed risk score
`tealtiger.policy_id`	`budget.daily.v1`	Policy that triggered
`tealtiger.mode`	`ENFORCE`	Policy mode
`tealtiger.provider`	`openai`	LLM provider
`tealtiger.model`	`gpt-4`	Model used
`tealtiger.cost`	`0.05`	Estimated cost

Metrics

Metric	Type	Description
`tealtiger.decisions.total`	Counter	Total decisions made
`tealtiger.decisions.allowed`	Counter	Allowed decisions
`tealtiger.decisions.denied`	Counter	Denied decisions
`tealtiger.evaluation.duration_ms`	Histogram	Evaluation latency
`tealtiger.cost.total`	Counter	Total estimated cost
`tealtiger.tokens.input`	Counter	Input tokens processed
`tealtiger.tokens.output`	Counter	Output tokens generated

Logs

Audit events are exported as structured logs with the full decision payload.

Other Platforms

The same OTLP pattern works for any platform with an OTel Collector exporter:

Platform	Exporter	Docs
New Relic	`otlp` exporter	New Relic OTLP
Elastic	`elasticsearch` exporter	Elastic OTel
Grafana Cloud	`otlp` exporter	Grafana OTLP
Honeycomb	`otlp` exporter	Honeycomb OTel
Dynatrace	`otlphttp` exporter	Dynatrace OTel

Next Steps

OpenTelemetry

Core OTLP integration details

Audit Schema

Full audit event format

Slack / Discord

Real-time alert webhooks

All Integrations

View all integrations

Getting Started

Core Concepts

Governance Domains

Policy Authoring

Architecture

Integrations

Deployment

API Reference

Cookbook

Compliance & GRC

Guides

Reference

Versions

Playground

Dashboard

Blog

Datadog & Splunk Integration

Architecture

Datadog

Step 1: Configure TealTiger OTLP export

Step 2: Configure OTel Collector for Datadog

Step 3: Run the Collector

Datadog Dashboard

Splunk

Step 1: Configure TealTiger OTLP export

Step 2: Configure OTel Collector for Splunk

Step 3: Run the Collector

Splunk Queries

What TealTiger exports via OTLP

Traces (Spans)

Metrics

Logs

Other Platforms

Next Steps

OpenTelemetry

Audit Schema

Slack / Discord

All Integrations

​Architecture

​Datadog

​Step 1: Configure TealTiger OTLP export

​Step 2: Configure OTel Collector for Datadog

​Step 3: Run the Collector

​Datadog Dashboard

​Splunk

​Step 1: Configure TealTiger OTLP export

​Step 2: Configure OTel Collector for Splunk

​Step 3: Run the Collector

​Splunk Queries

​What TealTiger exports via OTLP

​Traces (Spans)

​Metrics

​Logs

​Other Platforms

​Next Steps

OpenTelemetry

Audit Schema

Slack / Discord

All Integrations

Architecture

Datadog

Step 1: Configure TealTiger OTLP export

Step 2: Configure OTel Collector for Datadog

Step 3: Run the Collector

Datadog Dashboard

Splunk

Step 1: Configure TealTiger OTLP export

Step 2: Configure OTel Collector for Splunk

Step 3: Run the Collector

Splunk Queries

What TealTiger exports via OTLP

Traces (Spans)

Metrics

Logs

Other Platforms

Next Steps