ddbackfill

Publish your Cased audit events to DataDog logs.

Usage

1. Reach out to your Cased account representative to obtain an export of your Cased Audit events.
2. Download the latest release of ddbackfill for your operating system.
3. Setup DataDog Logs
4. Run ddbackfill

export DD_SITE="datadoghq.com" DD_API_KEY="<API-KEY>" DD_APP_KEY="<APP-KEY>"
ddbackfill ~/path-to-audit-events

If ddbackfill stops for any reason, it will resume where it left off.

Notice

To overcome DataDog's limitation to dropping events that happened more than 18 hours ago ddbackfill will update the .cased.published_at timestamp to the current time.

Debug

If any issues arise while running ddbackfill, you can enable debug mode by running:

DEBUG=1 ddbackfill ~/path-to-audit-events