Controls

Overview

Governance Console Controls audit and enforce organizational standards. You can use these controls to automate hygiene and quality tasks that typically require manual effort, such as managing unused API keys or enforcing tagging standards.

Using controls

1. On the Governance Console Controls page, select a control.

2. Configure detection.

   Under Scope detections, enter parameters to define the control’s behavior. Datadog’s defaults are based on best practices, but you can adjust the value of each parameter to relax or tighten the standard for your organization.

   If you are using multiple Datadog sub-organizations, control behavior and scoping is defined per organization and does not span across organizations.

   To verify your configuration, use the Manual Mitigation tab to see what is being detected by this control.

3. Configure notifications.

   Under Notify users, select your notification recipients and frequency. The notification email summarizes identified and unresolved control detections and includes a link back to the Governance Console control to review and mitigate.

4. Configure automatic enforcement.

   When Enforce control is disabled, a control requires manual mitigation. Toggling on Enforce control enables automated enforcement actions. Automation allows administrators to automate cleanup activity without having to manually review and apply each change.

   For Select automated mitigation, select a mitigation. If you select Manual (default), the control detects noncompliant assets, and you can manually take actions based on these detections. See manual mitigation.

   To delay mitigation, enter a number of days under Remediation Delay. You can delay remediation for up to 1 week. This grants additional time for administrators to take additional actions before automatic enforcement occurs.

Manual mitigation

Use the Manual Mitigation tab to view all detections.

Hover over each detection for options:

• Delay mitigation: Delay mitigation of this asset for up to 1 week. This grants additional time for the administrator or owner to take additional actions before automated enforcement takes place.
• Ignore detection: Ignore this detection and remove it from consideration for mitigation.
• Mitigate now: Noncompliant assets are mitigated according to the configuration of the control. This action applies only once, and does not carry over to incoming detections. Mitigation requires the associated permission for modifying that asset.

All available controls

Controls are organized by usage concern: security, cost optimization, and data hygiene.

Request a personalized demo