implementing-security-monitoring-with-datadog

name	implementing-security-monitoring-with-datadog
description	Use when implementing security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection to detect threats, enforce compliance, and respond to security events across cloud and hybrid infrastructure. Covers Agent deployment, log source ingestion, detection rule creation, security dashboards, and automated notification workflows. Activates for requests involving Datadog security setup, Cloud SIEM configuration, CSM threat detection, or security monitoring das...
domain	cybersecurity
tags	["siem","monitoring","datadog","cloud-security","log-analysis","detection-rules","CSM","workload-protection"]
subdomain	security-operations
version	1.0.0
author	oyi77
license	Apache-2.0
nist_ai_rmf	["GOVERN-1.1","MEASURE-2.7","MANAGE-3.1","GOVERN-4.2","MAP-2.3"]
d3fend_techniques	["Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access"]
nist_csf	["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"]

Implementing Security Monitoring With Datadog

Overview

Cybersecurity skill for implementing security monitoring with datadog. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "implementing security monitoring with datadog"

• "Implements security monitoring using Datadog Cloud SIEM, Cloud Security Manageme"

• Deploying Cloud SIEM to detect real-time threats across cloud infrastructure (AWS, Azure, GCP)

• Creating custom detection rules for attacker techniques, credential abuse, or anomalous behavior

• Enabling Workload Protection (CSM Threats) to monitor file, process, and network activity on hosts and containers

• Meeting compliance requirements (PCI-DSS, SOC 2, HIPAA) that mandate centralized log monitoring and alerting

• Building security dashboards to provide SOC visibility into threat signals, investigation context, and response metrics

Do not use for endpoint-only monitoring without cloud infrastructure; use a dedicated EDR solution for purely on-premises endpoint detection.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Datadog account with Security Monitoring (Cloud SIEM) and/or Cloud Security Management enabled
• Datadog API Key and Application Key from Organization Settings > API Keys
• Datadog Agent v7+ installed on hosts/containers that generate security-relevant logs
• Log sources configured for ingestion: AWS CloudTrail, VPC Flow Logs, GuardDuty, Azure Activity Logs, GCP Audit Logs, or on-host logs (auth.log, syslog, Windows Security Events)
• Python 3.9+ with datadog-api-client library for programmatic rule management
• Network access from monitored hosts to Datadog intake endpoints (port 443)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    : ,
}

 () -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}