Security Monitoring
If your security team monitors the tools your company uses, AgileNotes.AI can feed them directly. You can stream your organization's audit log into your own Datadog, and point your own uptime monitoring at our health endpoint. Both are set up by an organization admin and need no involvement from us.
Send your audit log to Datadog
AgileNotes.AI records who did what, and when. Once you connect Datadog, new audit events arrive in your Datadog Logs within about a minute of happening, tagged so your security team can filter and alert on them.
What you need first
- A Datadog API key. In Datadog, go to Organization Settings, then API Keys. This is an API key, not an Application key.
- Your Datadog site — the one you sign in at. If you are not sure, look at the address bar when you are logged in to Datadog.
- Organization admin rights in AgileNotes.AI.
Connect it
- Open the profile menu, then Organization, then the Integrations tab.
- Choose + Connect integration, then Datadog.
- Pick your Datadog site, paste your API key, and choose Next.
- AgileNotes.AI sends a test event. When it succeeds, the connection is saved.
- In Datadog, search your Logs for source:agilenotes to see the test event land.
Forwarding starts from the moment you connect. Events from before you connected are not sent, because Datadog does not accept events older than 18 hours.
What gets sent
Every event carries the security details your SOC needs, and nothing more:
| Field | What it tells you |
|---|---|
| Event type and category | What happened — a sign-in, a permission change, an export, a deletion. |
| Result | Whether it succeeded or failed. Failures arrive as warnings. |
| Actor | The user id and email address of whoever performed the action. |
| Target | What was acted on. |
| Request details | IP address, browser user agent, and a request id. |
| Vendor support access | Present only when an AgileNotes.AI support operator performed the action rather than one of your own people. See below. |
Events are tagged with your organization, the category, the result and the event type, so you can build Datadog monitors on them straight away. You can add your own tags and change the service name when you connect.
Watching for vendor access
Occasionally an AgileNotes.AI support operator needs to work inside your account to reproduce a problem you have reported. Those actions are recorded like any other, and additionally carry the tag vendor_support:true.
That means you can alert on it. A Datadog monitor on source:agilenotes vendor_support:true tells your security team whenever one of our people acts in your tenant, without you having to ask us.
The event tells you that it happened, not which of our staff did it. We record the operator, the reason they gave, and the account they were working in, and we will tell you who and why on request. Every such session requires a stated reason before it can begin.
What is not sent. By default AgileNotes.AI sends security information only. The contents of your notes, tickets and reports stay in AgileNotes.AI.
If you would rather your SIEM held the full picture of changes, turn on Include changed and deleted record contents when you connect. Edits and deletions then carry the record itself, so a deleted item can be reconstructed from your Datadog. This means your work content leaves AgileNotes.AI, so it is off unless you choose it.
Keeping it running
The Integrations tab shows when events were last sent.
If Datadog rejects your API key — usually because it was rotated or revoked, or because the key belongs to a different site — forwarding pauses and the row says so. Nothing is lost while it is paused, but nothing is sent either. Reconnect with a valid key and forwarding resumes.
Use Test at any time to confirm the connection still works. A passing test clears a paused feed.
Disconnecting stops the feed immediately. Events recorded while disconnected are not sent later, even if you reconnect.
Monitor availability
Point your own uptime monitoring at these two addresses. Between them they tell you whether the service is up and whether it is usable.
| Address | What a healthy response proves |
|---|---|
| https://api.agilenotes.ai/health | The API and its database are answering. |
| https://app.agilenotes.ai/ | The application itself is being served. |
The health address needs no credentials. It answers 200 with a short JSON body when everything is reachable, and 503 when it is not, so you can alert on the status code alone.
When you set up the check, allow at least a 10 second timeout and alert only when two or more locations fail. That avoids paging your team over a single slow response.