Datadog Glossary

Introduction

The expansive realm of monitoring and alerting solutions often appears intricate and daunting without a solid grasp of essential terminology and principles.

Delve into our comprehensive Datadog glossary to unravel pivotal terms associated with monitoring, alerting, and performance enhancement. Elevate your comprehension of Datadog and elevate your expertise in monitoring systems effortlessly.

Datalog Terms

A

Absolute Change: Datadog CI Test Visibility calculates the absolute change as the unsigned difference between a test's current runtime and its mean runtime in the baseline.

Action: In Datadog Real User Monitoring (RUM), an action is a specific kind of event that captures user interactions at various stages of their experience on your site or app.

Administrative Status: The administrative status of a port (up/down) refers to whether the port is disabled.

Agent: The Datadog Agent is an open-source software that is installed on a host, where it gathers metrics and events from the host and transmits them to Datadog. It can be deployed on local machines (Windows, macOS), containerized environments (Docker, Kubernetes), and on-premises infrastructure.

Alert: Alerts are triggered by Datadog monitors when specific conditions are met, signaling that a predefined threshold has been reached.

Alert Graph: Alert graphs are timeseries visualizations that display the real-time status of the majority of monitors configured in your system.

Alert Value: The Alert Value widget showcases the present query result of a simple-alert metric monitor. Simple-alert monitors feature a metric query that is ungrouped and yields a single value. Utilize Alert Value widgets on your dashboard to gain insights into your monitor activities and alert conditions.

Alerting Type: Alerts are automatically categorized into groups according to your chosen aggregation step when setting up your metric. Introducing additional aggregations creates a 'multi-alert' category, while no aggregation results in a 'simple alert' classification.

Amazon Elastic Container Service (ECS): ECS is a container orchestration service.

Amazon Elastic Kubernetes Service (EKS): EKS is a managed Kubernetes service.

Amazon Resource Name (ARN): An ARN is a string that uniquely identifies an AWS resource.

Analytics: Log analytics involves querying, aggregating, and visualizing log data to facilitate investigation and exploration.

Annotation: Kubernetes annotations are key-value pairs that allow attaching metadata to Kubernetes objects.

Anomaly: Anomaly detection is a computational capability that recognizes deviations in a metric's behavior compared to historical patterns, considering trends, seasonal variations, and daily time patterns. This method is ideal for monitoring metrics with pronounced trends and repetitive patterns that are challenging to track using threshold-based alerts.

API key: An API key is a token utilized for authenticating a user or application. To transmit metrics and events to Datadog, the Datadog Agent necessitates an API key.

API Test: In Datadog Synthetic Monitoring, API tests enable you to initiate requests through specific network protocols.

APM: Application Performance Monitoring (APM) tracks requests, errors, and latency within your application. By incorporating distributed traces across your application, you can link them to browser sessions, logs, profiles, synthetic checks, network data, processes, and infrastructure metrics spanning hosts, containers, proxies, and serverless functions.

Approval Wait Time: Approval wait time refers to the period during which pipelines and jobs or stages within a pipeline are stalled, awaiting manual approval before proceeding.

Archive: An archive serves as a cloud-based storage option for retaining logs over extended periods, whether they are indexed or not.

Attribute: An attribute represents a detail or characteristic associated with a log entry.

Autodiscovery: Datadog's Autodiscovery feature automatically detects services running within containers, allowing you to create configuration templates for Agent checks and specify which containers each check should target.

AWS Fargate: Serving as a serverless compute engine, AWS Fargate offers computational capabilities.

Azure Kubernetes Service (AKS): AKS is a managed Kubernetes service that provides a managed environment for deploying and managing Kubernetes clusters.

B

Baseline Mean: In Datadog CI Test Visibility, the baseline mean represents the average duration of a specific test in the default branch, computed over the previous week's test runs.

Baseline Standard Deviation: In Datadog CI Test Visibility, the baseline standard deviation represents the standard deviation of a specific test in the default branch, computed over the previous week's test runs.

Browser Test: In Datadog Synthetic Monitoring, a browser test observes web-based business transactions or user journeys on the web. Each test can encompass multiple actions and pages to ensure the successful completion of tasks like account registration and checkout processes.

C

Cardinality: In Datadog, cardinality refers to the quantity of tag values linked to a specific tag key for a given metric.

Center for Internet Security (CIS): The CIS is an entity responsible for upholding CIS Controls and CIS Benchmarks, offering recommendations and guidelines for optimal security practices.

Change: The change visualization in Datadog displays the change in a metric over a specific period, comparing the absolute or relative (%) change in value between a specified time period ago and the current time against a defined threshold.

Change Alert: A change alert evaluates the absolute or relative (%) change in value between a specified time N minutes ago and the present time against a defined threshold. The data points compared are not individual points but are calculated based on the parameters specified in the alert conditions section.

Check: Checks are small Python scripts executed at regular intervals by the Agent. Each Check performs an action, collects the result, which the Agent then stores and reports to the Datadog platform. These programs are flexible and commonly used to gather metrics from custom environments or applications. It's important to note that the term "check" (without capitalization) refers to the general act of taking a measurement.

Check status: The check status widget shows the current status or number of results for any check performed.

Child org: A child organization is affiliated with a parent organization and manages its distinct data, separate from both the parent organization and other child organizations.

Cluster Agent: The Cluster Agent is a variant of the Datadog Agent designed to provide a simplified, centralized method for collecting monitoring data at the cluster level.

Cold start: Computing experiences a cold start when a system or component has been recently generated or restarted. In serverless computing, a cold start specifically indicates the problems, including heightened latency, that may emerge when a function is called for the first time or after an idle interval.

Collector: The collector, known as the Agent process, performs system checks and gathers metrics.

Conditional variables: Conditional variables employ if-else statements to present a unique message based on the monitor's status and the specific circumstances that prompted its activation.

ConfigMap: A ConfigMap is an API object that stores data in key-value pairs. These ConfigMaps can be made available to Pods in various ways, such as environment variables, command-line arguments, or configuration files within a volume.

Container Agent: The Container Agent is the Datadog Agent specifically designed to operate within a containerized environment.

Container runtime: A container runtime is the component within a container engine responsible for mounting the container and managing its lifecycle, including starting and stopping the containerization process.

Container Runtime Interface (CRI): The Container Runtime Interface (CRI) enables a kubelet to interact with various container runtimes.

Containerd: Containerd is a container runtime.

Control: A control is a specific recommendation for managing technology, people, and processes, often derived from regulations or industry standards.

Core Web Vitals: Core Web Vitals are a set of metrics defined by Google to assess user experience. These metrics focus on aspects such as page load time, interactivity, and visual stability, providing meaningful insights into the overall quality of a web page.

Count: The 'Count' metric type aggregates all the submitted values within a specified time interval.

Crawler Delay: A crawler delay refers to a lag in metrics from Datadog cloud integrations caused by limitations within the cloud provider's API.

Cross-Cite Request Forgery (CSRF): CSRF is a form of exploit in which an attacker leverages a web client, like a browser, to gain unauthorized access to or tamper with information.

Custom Measure: A custom measure is a quantitative aspect (a numerical value) that enables aggregating values across multiple pipeline traces, filtering pipeline traces based on a specified range, or sorting pipeline traces according to a particular value.

Custom Span: Custom spans allow integrating command-level events in CI Pipeline Visibility, which are then depicted in the pipeline's flame graph visualization.

Custom Tag: Custom tags are qualitative aspects (string values) that enable aggregating values across multiple pipeline traces, filtering pipeline traces based on a specified range, or sorting pipeline traces according to a particular value.

D

DaemonSet: In Kubernetes, a DaemonSet is a controller responsible for managing groups of Pods. You can define a DaemonSet using a YAML configuration file.

Dashboard: Datadog's dashboard is a tool that allows you to visually track, analyze, and display critical performance metrics, enabling effective monitoring of your infrastructure's health. Dashboards utilize a grid-based layout and can incorporate various elements such as images, graphs, and logs. They have a maximum width of 12 grid squares and are well-suited for debugging purposes.

datadog.yaml: The datadog.yaml serves as the primary Agent configuration file used to toggle various features on and off.

Delay: An evaluation delay instructs the monitor to wait for a specified number of seconds before initiating the evaluation process.

Distributed Tracing: Distributed tracing is a technique for tracking application requests as they traverse from frontend devices to backend services and databases. Developers can leverage distributed tracing to identify and troubleshoot requests exhibiting high latency or errors.

Distribution: A distribution is a metric type that aggregates values (such as count, min, max, sum, avg, p50, p75, p90, p95, and p99) from multiple hosts during a specified flush interval. The distribution visualization displays aggregated data across one or multiple tags, such as hosts. Unlike the heatmap, the distribution graph's x-axis represents quantity rather than time.

Docker: Docker is a framework designed for managing and orchestrating containers.

DogStatsD: DogStatsD encompasses two interconnected components: a protocol derived from StatsD and an application for metric reporting that adheres to this protocol. The DogStatsD protocol extends the functionality of the StatsD protocol, incorporating specific modifications tailored for the Datadog platform. The DogStatsD application is a service bundled with the Agent, serving as a lightweight tool for metric reporting.

Downtime: Downtimes are predefined time intervals when alerts and notifications from monitors are temporarily muted.

Dynamic Application Security Testing (DAST): DAST (Dynamic Application Security Testing) is a security testing approach that examines a running application without accessing its source code.

E

eBPF: eBPF is a Linux kernel technology enabling users to execute bytecode without requiring modifications to the kernel or the addition of kernel modules.

Enhanced Metric: Datadog produces a collection of advanced Lambda metrics derived from your Lambda runtime, supplementing the default Lambda metrics offered through the AWS Lambda integration. Enhanced Lambda metrics are prefixed with aws.lambda.enhanced.*.

Error: In Datadog RUM, an error is a specific type of event. An error event is triggered when the browser reports a frontend error.

Evaluation Frequency: The evaluation frequency determines the frequency at which Datadog executes the monitor query. Typically set at 1 minute for many configurations, this means that every minute, the monitor queries the specified data within the chosen evaluation window, comparing the aggregated value against the set thresholds.

Evaluation Window: The evaluation window is the retrospective timeframe from which the monitor aggregates data and uses for comparison against the defined thresholds.

Exclusion Filter: An exclusion filter specifies which logs should be excluded from indexing. However, these logs remain visible in Live Tail.

Execution Time: In APM, the execution time represents the cumulative duration during which a span remains active, excluding any time spent waiting for a child span to finish. This duration is computed by summing the time the span is actively processing, indicating it has no child spans.

Explorer: Events Explorer is a Datadog page that enables viewing and aggregating events. It displays the most recent events produced by the user's infrastructure and services, including code deployments, service health updates, configuration changes, or monitoring alerts.

Extract, Transform, and Load (ETL):A structured process involving extracting data, transforming it, and then loading the transformed data into a data warehouse.

F

Facet: A facet is a user-defined attribute or tag applied to indexed logs. It can be either quantitative or qualitative and is utilized in Log Explorer for searching logs, defining log patterns, and performing log analytics.

Faceted Search: A faceted search employs filters to refine and focus search outcomes.

Finding: A finding is the fundamental element for assessing a rule against a resource. Whenever a resource undergoes evaluation against a rule, a finding is produced indicating a pass or fail status.

Flaky Test: A flaky test is one that inconsistently produces both passing and failing results across multiple test runs for the same codebase commit. If a test fails during one CI run but passes in a subsequent run with no code changes, it is considered unreliable as an indicator of code quality.

Flame Graph: A flame graph is a visualization of a trace, where bars represent spans and display the span's execution time, the span that called it, and any spans it called. Flame graphs are also the default visualization for Continuous Profiler, depicting resource utilization (such as CPU usage) per method and the calling hierarchy of each method.

Flare: The flare command provides a rapid method to submit diagnostic data to the Datadog support team. It collects all configuration files and logs from the Agent, compiles them into an archive file, sanitizes sensitive details like passwords, and forwards the archive to Datadog support.

Flow: In computer networks, a flow represents the route followed when one endpoint communicates with another. Datadog's network map offers a visual representation of network data flow.

Flush Interval: The Datadog Agent consolidates data points and transmits them collectively within a flush time interval, rather than sending individual requests to Datadog's servers for each data point.

Forecast: Forecasts utilize algorithms to anticipate the future trends and values of a metric.

Forwarder (Agent): The forwarder is the component within the Agent that securely transmits metrics to Datadog over HTTPS.

Framework: A set of specifications that align with an industry benchmark or regulatory standard.

Free Text: The free text widget enables adding headings to a screenboard.

Function: In serverless computing, a function refers to a programmatic unit hosted on managed infrastructure.

Funnel: Funnel analysis assists in tracking conversion rates across critical workflows, enabling identification and resolution of any bottlenecks within end-to-end user journeys. The funnel widget provides a visual representation of conversion rates across user workflows and end-to-end user journeys.

Funnel Analysis: Funnel analysis examines a user's progression towards a specified outcome, like sign-up or purchase, by studying the sequence of events within this journey.

G

Gauge: A gauge is a metric type that considers the most recently reported value within the interval.

Geomap: The Geomap widget provides a geographic visualization using shaded regions or points. Leverage this widget to view user sessions by country, filter to see a list of all sessions in a new tab, or monitor performance metrics like load time, core web vitals, and percentage of views with errors.

Global Variable: In Datadog Synthetic Monitoring, a global variable is a variable that is accessible across all of a user's Synthetic tests.

Google Kubernetes Engine (GKE): GKE is a managed Kubernetes service.

Granularity: Granularity refers to the frequency at which data is collected or presented on graphs.

Grok: Grok is a technique for parsing and extracting attributes from semi-structured log messages.

Group: The groups widget enables grouping similar graphs together on a dashboard. Each group has a custom header, can contain one or more graphs, and is collapsible. Utilize groups to organize widgets on a dashboard.

H

Heatmap: The heatmap widget displays metrics aggregated across multiple tags. Leverage heatmap widgets to visualize OpenTelemetry histograms, distribution metrics, high resolution data, and data display.

Helm: Helm is an application for managing pre-configured Kubernetes resources.

Histogram: A histogram reports five distinct values that summarize the submitted values: the average, count, median, 95th percentile, and maximum.

HorizontalPodAutoscaler (HPA): Within Kubernetes, an HPA automatically scales by deploying additional Pods to meet demand.

Host: A host refers to a computer or virtual machine.

Hostmap: The host map widget visualizes any metric across your hosts using the same visualization as seen on the main Host Map page.

iframe: An inline frame (iframe) is an HTML element that loads another HTML page within the current document. The iframe widget enables embedding a section of any other web page on your dashboard.

Image: The image widget enables you to display an image on your dashboard. The image can be in PNG, JPG, or animated GIF format, hosted where it can be accessed via URL.

Impossible Travel: Impossible travel is a detection method that identifies access events from different locations, where the time elapsed between the two events is insufficient for a human to travel the distance between those locations.

Indexed: Indexed logs are logs that have been gathered, processed, and stored for analysis, alerting, and troubleshooting purposes. Indexed spans are spans that have been indexed by a retention filter and stored in Datadog for 15 days. These spans can be searched, queried, and monitored in Search Spans based on the tags associated with the span.

Ingested: All ingested logs and spans encompass all logs and spans gathered across your environment.

Ingestion Control: Ingestion control refers to the mechanisms and rules within the Agent and tracing libraries that determine which traces are sent from an application to Datadog.

Instrumentation: Instrumentation involves integrating code into your application to capture and report observability data to Datadog, including traces, metrics, and logs. Datadog offers instrumentation libraries for a variety of programming languages and frameworks.

Intelligent Retention Filter: A default retention filter in Datadog that remains constantly active preserves a representative selection of traces, true high latency instances, and varied error traces to aid in monitoring your applications' health. This retention is not random, meaning that traces solely retained by Intelligent Retention are excluded from trace metrics.

Interactive Application Security Testing (IAST): IAST is a security testing approach that integrates static and dynamic testing methodologies.

Investigator: Investigator is a graphical interface that enables users to navigate from one affected entity to another, while observing user behavior and its impact on their cloud environment.

Invocation: Within serverless computing, an invocation occurs when a deployed function is triggered.

J

Job Log: A job log is a record of all events, outputs, and actions that take place during the execution of a job in a CI/CD pipeline. Job logs contain information such as command outputs, system messages, error messages, and status updates.

K

Kubernetes: Kubernetes is a platform for managing containers.

L

Layer 2: Within the OSI model of computer networking, layer 2 specifies the network data format and encompasses frames and physical addressing.

Layer 3: In the OSI model of computer networking, layer 3 dictates the physical routing of data from its source to destination. Layer 3 is focused on packets and logical addressing.

List: The list widget presents a list of events and issues sourced from various places like Logs, RUM, or Events. You can search and query across these sources to refine the events you want the widget to highlight and display.

Live Tail: Live Tail encompasses all logs ingested by Datadog after processing but prior to indexing or archiving.

Log Indexing: Log indexing categorizes logs into distinct groups based on value for varying retention periods, quotas, usage monitoring, and billing purposes.

Manifest (Kubernetes): In Kubernetes, a manifest is a file that specifies the creation and management of resources in a cluster.

Manual step: A manual step occurs when there is a job with a manual approval phase in the pipeline.

Mean: The mean represents the average value in a dataset.

Metric: Metrics are numerical values that can track various aspects of your environment over time, including latency, error rates, and user signups.

Minified Code: Minified code (frequently JavaScript) has been stripped of comments, extra whitespace, unused code, and anything else that does not impact functionality. While minified code is less readable by humans, its smaller size enhances website performance.

MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK): MITRE ATT&CK is a knowledge base that catalogues cyber adversary tactics and techniques.

Mobile App Test: Within Datadog Synthetic Monitoring, a mobile app test oversees critical business flows that may encompass multiple actions and pages. This test ensures that users can successfully complete processes like account sign-up and checkout.

Mode: The mode represents the number that occurs most frequently in a dataset.

Monitor Summary: The monitor summary widget presents a summary view of all your Datadog monitors, or a subset based on a specified query.

Multi alert: A multi-alert applies the alert to each source based on the monitor's group parameter. An alert notification is dispatched for each group that satisfies the specified conditions.

Multi-org: Multi-org is a feature within an account that allows for the management of multiple child organizations under a single parent organization account. Users can be added to both the parent organization and multiple child organizations.

Multistep API test: In Datadog Synthetic Monitoring, a multistep API test comprises several interconnected HTTP requests designed to monitor user journeys on your services.

Mute: To silence alerts and notifications from a monitor, you can mute it.

N

NetFlow: NetFlow is a network protocol system that gathers IP network traffic upon entering or exiting an interface. Cisco introduced NetFlow in 1996.

Network Device Monitoring (NDM): Datadog's Network Device Monitoring (NDM) offers visibility into on-premise and virtual network devices, including routers, switches, and firewalls.

Network Performance Monitoring (NPM): Datadog's Network Performance Monitoring (NPM) offers visibility into network traffic among services, containers, availability zones, and more.

Network Profile: A network profile is a collection of characteristics that detail the configuration of a network.

No Data: 'No Data' occurs when an integration or application ceases to send metrics to Datadog.

Node Agent: The Node Agent is the Datadog Agent version that operates on a host.

Notes and Links: The Notes and Links widget resembles the free text widget but offers additional formatting and display choices.

Notification Rule: A notification rule specifies the recipients of security issue notifications based on the source type, severity, tags, and attributes.

O

Object Identifier (OID): An OID is a standardized identifier used to name and distinguish an object.

Open Web Application Security Project (OWASP): OWASP is an organization that offers resources for securing web applications.

Operational status: The operational status of a port (up/down) indicates whether the port is currently active or inactive.

Orchestrator: In a containerized infrastructure, an orchestrator automates the management of containers by handling tasks such as provisioning, deployment, scaling, and networking.

Outlier: Outlier detection is an algorithmic feature that identifies when a specific metric group exhibits atypical behavior compared to its peers.

P

Parallelization: In Datadog Synthetic Monitoring, parallelization enables the concurrent execution of multiple tests in your CI/CD pipelines, enhancing the efficiency of your building, testing, and deployment workflows by running tasks simultaneously instead of sequentially.

Parameter: A parameter is a user-specified value that can be provided to a CI pipeline during execution. Parameters enable customization and control over a pipeline's behavior, making them valuable for scenarios like deploying to different environments, selecting specific test suites, or defining build versions.

Parent Org: AnswerA parent organization can oversee and monitor the usage of multiple child organizations under its management.

Partial Retry: A partial retry involves re-executing only a portion of stages, jobs, or steps in a CI pipeline following a failure, rather than restarting the entire pipeline.

Pattern: A pattern occurs when log messages share a common structure. Pattern aggregation consolidates these logs and presents them in the patterns view.

Percentile: A percentile indicates the relative position of a score compared to other scores within the same dataset, or the proportion of values in a dataset that are lower than a specified value.

Performance Regression: In Datadog CI Test Visibility, a performance regression refers to a quantifiable deterioration in performance metrics for a tested service.

Pie Chart: The pie chart widget can exhibit either a single dataset with associated proportions or multiple datasets with nested proportions.

Pipeline:

1. In Log Management, a pipeline is an ordered sequence of processors applied to a filtered subset of logs, occurring after log collection but before indexing.
2. In Observability Pipelines, a pipeline is a sequential flow of sources, transformations, and destinations for your observability data.

Pipeline Failure: A pipeline failure happens when one or more stages or jobs within a CI/CD pipeline do not execute successfully.

Pod: In Kubernetes, a Pod represents the most fundamental deployable computing unit.

Policy-Based Routing (PBR): In computer networks, Policy-Based Routing (PBR) is a method used to direct data based on specific policies and filters.

Powerpack: Powerpacks are pre-designed collections of widgets that encapsulate graphing expertise as reusable components for building dashboards. Powerpacks can be either preset (created by Datadog and accessible to all customers) or custom (created by a user and only available within their organization).

Private Location: In Datadog Synthetic Monitoring, a private location refers to a Docker container that users can deploy within a private network. This setup allows for monitoring internal applications or private URLs that are not reachable from the public internet.

Processing Pipeline: In Datadog Events, a processing pipeline is a predefined series of data manipulation steps applied to event attributes upon ingestion. Users have the ability to customize processing pipelines to standardize and enhance event data.

Processor: A processor consists of a series of commands carried out within a log pipeline to transform log data and create additional attributes to enhance log information.

Profile: A profile is a momentary capture of the workload (CPU usage, memory usage) being performed by code.

Profiling Flame Graph: The flame graph visualization for profiling illustrates a detailed breakdown of the most resource-intensive lines of code, including CPU and memory usage. Incorporate this widget to visualize the stack traces of your profiled applications and precisely pinpoint common resource demands.

Q

Quartile: Quartiles divide data into four equal sections, with each section containing 25% of the total data. Quartiles are employed to calculate the interquartile range, which serves as a measure of variability centered around the median value.

Query: A query is constructed from a combination of the metric name, time aggregation method, space aggregation method, and scope.

Query Value: Query values showcase the present value of a specified metric, APM, or log query. They incorporate conditional formatting, like a color-coded background, to indicate if the value falls within the anticipated range. Additionally, optional backgrounds from timeseries data can be included. The values presented by a query value do not necessarily represent an instantaneous measurement. The widget can exhibit either the most recent reported value or an aggregate derived from all query values within the defined time frame.

Queue Time: Queue time refers to the duration that a pipeline or job spends waiting in the queue before being executed.

R

Rate: Rate is a type of metric that involves dividing the count by the duration of the time interval.

Real User Monitoring (RUM): RUM (Real User Monitoring) is a technology that captures user interactions with a website or application, providing insights into the user experience.

RED Metrics: The acronym RED represents Rate, Errors, and Duration, which are three crucial metrics used to assess the performance of certain code segments.

Reference Table: A reference table in Datadog compiles entities such as customer details, service names, IP addresses, and other information. Each entry in the table is identified by a primary key and includes relevant metadata.

Rehydration: Rehydration refers to the process of retrieving archived logs and reintroducing them into Datadog.

Relative Change: Within Datadog CI Test Visibility, a relative change represents the proportional difference between a test's duration and the baseline average.

Remote Configuration: Remote Configuration allows users to remotely adjust and modify the functionality of Datadog components (such as Agents, tracing libraries, and Observability Pipeline Workers) that are deployed within their environment.

Requirement: A cluster of controls that address a specific technical or operational area, like access management or networking. For instance, the PCI DSS regulatory framework consists of 12 requirements.

Resource:

• In APM, a resource refers to a specific aspect of an application, often an instrumented web endpoint, database query, or background task.
• In RUM, a resource denotes a category of event, with resource events being created for elements like images, XHR, Fetch requests, CSS, or JavaScript libraries loaded on a webpage.
• In Cloud Security Management Misconfigurations, a resource is an adjustable entity that requires ongoing scanning to ensure compliance with one or more controls. For instance, AWS instance resources encompass hosts, containers, security groups, users, and customer-managed IAM policies.

Retention Filter: Mechanisms and guidelines for selecting which traces are stored for a 15-day period. Datadog preserves a specific quantity (Intelligent Retention), and users have the ability to establish personalized filters.

Role: A role specifies the account access privileges for users. Datadog provides three predefined roles: Admin, Standard, and Read-only.

Role-Based Access Control (RBAC): RBAC is a system for managing read and write permissions to account resources by assigning roles with specific permissions to users.

Rule: A security rule assesses a resource's configuration to verify a component linked to one or more controls. These rules can align with multiple controls, requirements, and frameworks.

Run Workflow: The run workflow widget enables the automation of essential tasks directly from dashboards. Initiate workflows from a dashboard as soon as you detect an issue impacting system health. This approach enhances system uptime, accelerates issue resolution, and minimizes the risk of errors.

Running Pipeline: A live pipeline is one that is actively running within a CI/CD environment. Throughout its execution, the pipeline sequentially or concurrently handles different jobs or tasks based on its configuration.

Runtime Application Self-Protection (RASP): RASP is a security technology designed to identify and thwart attacks instantaneously.

Saved Views: In an Explorer view, saved views record various search queries, personalized default visualizations, and a chosen subset of facets. These saved views are accessible across the entire organization.

Scatter Plot: A scatter plot reveals a potential correlation between variations seen in two distinct sets of variables. It offers both a visual representation and a statistical method to assess the correlation strength between the two variables.

Scope: The scope uses tag(s) to filter the query.

Screnboard: Screenboards are flexible dashboards featuring custom layouts that can incorporate diverse elements like images, graphs, and logs. They are often utilized as status boards or narrative displays that either update in real-time or capture specific moments in the past.

Secrets (Kubernetes): In Kubernetes, a Secret is a resource designed to securely store confidential information like passwords, tokens, and keys.

Security Information and Event Management (SIEM): SIEM (Security Information and Event Management) is a domain in cybersecurity that leverages data from security events to facilitate threat detection, security incident management, and regulatory compliance.

Security Posture Score: For Cloud Security Management Misconfigurations, the security posture score indicates the proportion of your environment that meets all the active Datadog out-of-the-box Cloud and Infrastructure compliance rules.

Security Signal: A security signal is an event triggered by Datadog when a threat is detected based on a defined security rule.

Sensitive Data Scanner: The Sensitive Data Scanner is a pattern-matching service that operates in real-time to detect, label, and potentially mask or encrypt sensitive data.

Server-Side Request Forgery (SSRF): SSRF refers to a form of exploit in which an attacker leverages a server to gain unauthorized access to or manipulate data.

Serverless: Serverless is a cloud development and execution paradigm where server infrastructure management is delegated to a cloud service provider.

Serverless Insights: Serverless insights are automatically generated indicators (like high memory usage, cold start, out of memory, etc.) that Datadog uses to identify and flag Lambda functions that are experiencing issues or underperforming.

Service:

1. In APM, a service comprises related endpoints, queries, or tasks that execute specific functions within an application. A microservices architecture consists of multiple services, each handling a portion of the application's operations.
2. In serverless computing, a service is an autonomously deployable functional unit within the architecture. Serverless applications utilize managed services for their operation.

Service Account: A service account is a non-human user entity that can be assigned a role and possess application keys for authentication purposes.

Service Check: A service check is responsible for monitoring the operational status of a particular service to determine if it is active or inactive.

Service Entry Span: A span becomes a service entry span when it serves as the initial method for a request to a service. This distinction is visible in APM through a color variation in the immediate parent on a flame graph.

Service Level Agreement (SLA): An SLA represents a formal or informal contract between a client and a service provider outlining the client's expectations for reliability and the repercussions for the service provider if these expectations are not met.

Service Level Objective (SLO): An SLO represents a target percentage for application performance measured over a defined time period.

Service Map: In APM, the Service Map visualization offers a comprehensive view of your services and their status. It breaks down your application into individual services and illustrates the detected relationships among them.

Service Summary: A service comprises a collection of processes that perform a specific function, such as a web framework or database. Datadog offers pre-configured graphs for visualizing service details, accessible on the Service page. Utilize the service summary widget to showcase graphs related to a selected service on your dashboard.

Session: In Datadog RUM, a session is classified as an event. A user session commences upon a user's initiation of web application browsing, encompassing key user details such as their browser and device.

Session Replay: Session replay is a method used in UX testing to recreate a user's interaction with a website or application, showcasing their journey."

Signal Correlation: A signal correlation rule aggregates multiple signals to produce a new signal, enabling users to set alerts for more intricate and nuanced scenarios.

Simple Alert: Monitor alerts that consolidate data from all reporting sources. You will receive a single alert when the aggregated value satisfies the specified conditions.

Simple Network Management Protocol (SNMP): SNMP is a protocol designed to gather, organize, and update data related to managed devices within IP networks.

SLO list widget: The SLO List widget showcases a selection of SLOs within their main time frame. Additional configured time frames can be accessed through the SLO's side panel on the dedicated SLO page.

SLO Widget: The SLO widget illustrates the current status, budget, and remaining error budget of the active SLOs. It presents all associated groups of the SLO and allows for sorting these groups based on any of the time windows available in the widget. Leverage this widget to construct informative dashboards containing essential SLO details.

SNMP Management Information Base (MIB): An SNMP MIB is a comprehensive repository of definitions outlining the attributes of a managed object, including data types, access permissions, and other relevant details.

SNMP Trap: SNMP Traps are proactive notifications dispatched by SNMP-enabled devices to an SNMP manager. In response to unexpected network events, such as sudden equipment state changes, devices initiate SNMP Trap events to alert the manager.

Software Development Kit (SDK): An SDK, or Software Development Kit, is a collection of tools and resources that empower developers to build applications tailored for a particular technology, platform, or programming language.

Source: A log source is the location from which logs are gathered and imported into Datadog.

Source Map: A source map is a file that establishes a correspondence between minified, compressed JavaScript code and its original, uncompressed source.

Space Aggregation: Space aggregation divides a single metric into multiple timeseries based on tags like host, container, and region. Four aggregation methods are available: sum, minimum, maximum, and average.

Span: A span represents a coherent task within a distributed system for a specific duration. When combined, multiple spans form a trace.

Span ID: A span ID is a unique numerical identifier automatically generated by the tracing library for each span. Span IDs, in conjunction with trace IDs, enable the correlation of traces and logs within Datadog.

Span Summary: The APM span summary table presents metrics for spans aggregated across all traces, detailing the frequency of appearance, percentage of trace inclusion, average duration, and relative share of total execution time for each span. This analysis aids in identifying N+1 issues within your codebase, facilitating enhancements to your application's performance.

Span Tag: A span tag is a key-value pair that is attached to a span to associate a request with additional telemetry data (or to refine search results). These tags can be assigned to individual spans or universally across all spans.

Split Graph: A split graph enables the breakdown of a query across various tag values, facilitating the identification of outliers and trends. Leverage this functionality to explore metric performance across multiple dimensions, compare events based on diverse tags, or generate dynamic visualizations.

Standard Attribute: A standard attribute is one selected from a predefined set of attributes. These default attributes can be tailored to establish a consistent naming convention aligned with your organization's preferences.

Standard Deviation: A standard deviation quantifies the level of dispersion of a random variable in relation to its mean. It is computed as the square root of the variance, which involves assessing the deviation of each data point from the mean.

Standard Deviation Change: Within Datadog CI Test Visibility, a standard deviation shift refers to the number of standard deviations above the baseline mean.

Static Application Security Testing (SAST): SAST, or Static Application Security Testing, is a security testing approach that examines a program's source code or compiled binaries.

Sublayer Metric: A sublayer metric represents the execution time of a specific service or type within a trace. Certain Tracing Application Metrics are labeled with sublayer_service and sublayer_type tags, enabling the visualization of individual service execution times within a trace. Sublayer metrics are only accessible if a service has downstream dependencies.

T

Table: The table visualization presents aggregated data organized into columns based on tag keys. Utilize tables to compare values among various data groups, enabling the observation of trends, fluctuations, and anomalies.

Tail: The term 'tail' originates from the tail command in Unix and Linux systems. Tailing provides an alternative to displaying the complete contents of a file. When tailing a file, it prints the most recent lines to the terminal. This technique is frequently employed with log files to retrieve the latest logged events for a specific process or service. The Datadog Agent can be configured to tail a log file.

Template Variable: A template variable is a feature utilized to personalize and direct monitor notifications according to alert specifics, or to offer diverse perspectives within a single dashboard.

Test Batch: Within Datadog Synthetic Monitoring, a test batch refers to a group of CI jobs executing concurrently in your CI pipelines.

Test Duration: Within Datadog CI Test Visibility, a test duration represents the time taken for a CI test to finish.

Test Regression: In Datadog CI Test Visibility, a test run is flagged as a regression if its duration exceeds both five times the mean and the maximum duration for that specific test in the default branch. A benchmark test run is marked as a regression when its duration is five times the standard deviation above the mean for the same test in the default branch. A benchmark test is identified by the @test.type:benchmark tag. The mean and maximum values for the default branch are computed based on the previous week's test runs.

Test Run: In Datadog Synthetic Monitoring and CI Test Visibility, a test run involves running a series of tests on software to verify its functionality. A browser test run simulates a web transaction, comprising up to 25 steps.

Test Service: In Datadog Synthetic Monitoring and CI Test Visibility, a test service typically represents a collection of tests associated with a specific project or repository. It encompasses all the individual tests for your codebase, with the optional organization of tests into suites, which function as folders.

Test Suite: In Datadog Synthetic Monitoring and CI Test Visibility, a test suite is commonly a group of tests designed to exercise the same unit of code, based on your programming language and testing framework. You can find an example of a test suite that aligns with a test file in the datadog-ci repository.

Threshold Alert: The monitoring detection technique that contrasts metric values with a fixed threshold. Threshold alerts serve as the primary detection method for metric monitors.

Time Aggregation: Time aggregation refers to how Datadog consolidates data points into time intervals. There are five aggregation choices available: sum, minimum, maximum, average, and count.

Timeboard: Timeboards feature predefined layouts and display a snapshot of data at a specific moment, whether fixed or real-time, across the entire dashboard. They are frequently utilized for troubleshooting, correlation, and general data analysis.

Timeline View: A timeline view is analogous to a flame graph, but with the addition of a time dimension. Each lane corresponds to a thread (or a goroutine for Go applications). Unlike the flame graph, the timeline view enables:

• Identification of spiky methods
• Exploration of intricate interactions between threads
• Surfacing of runtime activity affecting the process

Timeseries: The timeseries visualization enables the display of the temporal progression of one or multiple metrics, log events, or Indexed Spans.

Top List: The top list visualization allows you to present a ranked list of tag values based on the highest or lowest values of any metric or event, such as the top CPU consumers, hosts with the least available disk space, or cloud products with the highest costs.

Topology: The Topology Map widget presents a visual representation of data sources and their interconnections, aiding in the comprehension of data flow within your architecture.

Trace: A trace records the duration of processing a request and the status of that request. Each trace comprises one or more spans.

Trace ID: The trace ID is a numeric identifier created by the tracing library for a trace. Along with span IDs, they are utilized to associate traces and logs within Datadog.

Trace Metric: Trace metrics are automatically collected and retained for 15 months, similar to other Datadog metrics. They can be leveraged to identify and generate alerts based on hits, errors, or latency. Statistics and metrics are consistently calculated using all traces and are unaffected by ingestion controls.
Trace metrics are tagged by the host receiving traces, along with the associated service or resource. Trace metrics can be exported to a dashboard directly from the Service or Resource page. Alternatively, trace metrics can be queried and added to an existing dashboard.

Trace Root Span: A span is considered a trace root span when it serves as the initial span of a trace. The root span represents the entry-point method of the traced request, and its commencement signifies the start of the trace.

Transaction: A transaction consolidates indexed logs according to a series of events, like a user session or a request that traverses multiple microservices.

Treemap: The treemap widget enables the visualization of proportional representations of one or more datasets. It can display a single dataset with its corresponding proportions or multiple datasets with nested proportions.

U

User: A user in Datadog is an individual granted access to data according to their assigned role.

V

Variance: Variance quantifies the dispersion of values within a dataset. The square root of the variance yields the standard deviation.

View: Within Datadog RUM, a view is categorized as an event type. A view event is created whenever a user accesses a web application page.

W

Warning: A warning is an optional threshold setting for monitors that triggers a notification with a lower priority level than an alert, serving as an early indication of potential issues.

Web Application Firewall (WAF):A Web Application Firewall (WAF) is a security solution that oversees and filters HTTP traffic originating from a web application.

Webhook: A webhook employs a URL to establish connections between your services, and notifies your services when a metric alert is triggered.