Security with Datadog

1. The products #

A common platform.

Overview #

The main benefit is working on the same data and the same tags as observability: a security signal on a container links to its logs, its traces and its owning team.

Good to know: The names and breakdown of Datadog's security products change regularly: refer to the documentation for the offerings available in your contract.

2. Cloud SIEM #

Detecting on logs.

Rules #

• Ready-to-use rules (suspicious logins, CloudTrail disabled, privilege escalation) and custom rules.
• The generated signals are triaged, assigned and linked to an incident.
• Security logs can be analyzed without being indexed in an expensive index.

Good practice: Start with high-value, low-volume sources: cloud audit logs (CloudTrail, Azure Activity, GCP Audit), authentication (IdP), VPN.

3. Application and cloud security #

Preventing and detecting.

Practices #

• Posture: configuration checks (public storage, encryption, overly broad IAM) mapped to compliance frameworks.
• Runtime threats: abnormal behavior in containers (unexpected shell, modified binary).
• App and API Protection: attack detection directly in the APM library, with optional blocking.
• Code Security: vulnerable libraries actually loaded in production, prioritized.