September 2020 Summaries

Auth0 is an identity as a service (IDaaS) that provides secure authentication and authorization for applications without the need to write custom code. It supports social identity providers like Google and Facebook, as well as enterprise identity providers such as LDAP for single sign-on across multiple apps. Datadog's Auth0 integration allows users to monitor and analyze Auth0 logs, detect security concerns, and better understand user interactions with applications. The integration includes features like log processing pipeline, visualization of key events, anomaly detection, and threat notifications based on custom rules or out-of-the-box options. By using Datadog's Security Monitoring, users can receive real-time alerts for potential threats detected in Auth0 logs, enabling quick investigation and remediation.

Auth0 provides identity as a service (IDaaS) capabilities to secure apps and APIs without requiring custom authorization code. Datadog's Auth0 integration allows for monitoring and analysis of Auth0 logs to detect security concerns, analyze user activity, and visualize key events. The integration also includes anomaly detection features and threat notifications that alert teams via email or other collaboration tools when suspicious behavior is detected. Additionally, Datadog Security Monitoring provides out-of-the-box rules for common threats in real-time, allowing teams to extend their security visibility with the Auth0 integration.

Steve Harrington and Datadog have announced a new partnership with Microsoft Azure, enabling streamlined experiences for purchasing, configuring, and managing Datadog directly inside the Azure portal. This integration reduces the learning curve for using Datadog to monitor applications in Azure, allowing users to purchase plans through the Azure Marketplace, configure single sign-on, and send logs and metrics from Azure platform resources to Datadog with just a few clicks. The partnership also simplifies the setup process, automating log-forwarding and providing a native resource blade for managing the integration, as well as enabling consolidation of costs in a single invoice.

Istio is a service mesh that enables teams to manage traffic in distributed workloads without modifying the workloads themselves, making it easier to implement load balancing, canarying, circuit breakers, and other design choices. Istio's monolithic architecture has two main implications for monitoring: you'll need to monitor istiod alongside the services it manages, and since Mixer is no longer used in newer versions of Istio, you'll need to ensure that your environment is configured to collect mesh metrics directly from Envoy containers. Istio works as a service mesh by deploying an Envoy sidecar to each pod that runs application workloads, which routes traffic through the sidecars within their local pods. istiod manages the Envoy proxies in your mesh, running four services: an xDS server, a sidecar injection webhook, a configuration validation webhook, and a certificate authority. Istio's telemetry component has changed over time, with newer versions using Envoy's WebAssembly-based plugin system to collect metrics automatically from traffic handled by Envoy proxies. To monitor istiod and understand the health and performance of your mesh, you should track key metrics such as istio_requests_total, istio_request_duration_milliseconds, istio_response_bytes, istio_tcp_received_bytes_total, istio_tcp_connections_opened_total, and istio_tcp_connections_closed_total. You can use these metrics to optimize performance, troubleshoot issues, and ensure that your Istio deployment is working correctly. Additionally, you should monitor istiod's xDS server, sidecar injection webhook, configuration validation webhook, and certificate authority, as well as Envoy proxies, to gain comprehensive visibility into your Istio cluster. You can use monitoring tools such as Datadog to get the visibility you need into istiod's performance, automate alerts, and reduce the time it takes to identify issues in a complex Istio deployment.

AWS CloudTrail is a service that helps to add visibility and auditability to an AWS environment by tracking the who, what, where, and when of activity in your AWS accounts. It records each instance of activity as an event, which is a JSON object containing details such as the time at which it occurred, who performed the action, the resources affected, etc. These events are available for up to 90 days after they occur and can be filtered on the Event History page in the AWS CloudTrail console. Datadog helps you collect and monitor your CloudTrail logs by integrating directly with AWS services like CloudTrail, Amazon S3, Kinesis Firehose, and Lambda. It automatically parses all incoming AWS CloudTrail logs using log processing pipelines and provides cost-effective collection and archiving of these logs through its Logging without Limits™ feature. Datadog's Threat Detection Rules can be used to detect critical security and operational issues in real-time, including those related to unauthorized activity, S3 bucket enumeration or modification, and networking component misconfigurations. Additionally, Datadog Cloud SIEM allows you to apply strict detection rules to your entire event stream as it is ingested, helping you catch threats as they occur. To export CloudTrail logs from AWS to Datadog, you can use Amazon Kinesis Data Firehose, a fully managed service that automates the delivery of real-time streaming data to external data storage and analysis repositories. Once your audit logs are streaming into Datadog's Log Explorer, you can filter and search them or build custom dashboards with data visualizations for high-level perspectives on your AWS environment's health and security.

AWS CloudTrail is a service that tracks and records all API calls made within an AWS account. It provides visibility and auditability into the actions performed across your AWS environment, allowing you to monitor activity, identify possible malicious behavior, and surface parts of your infrastructure that might not be configured properly. CloudTrail logs contain information on management events, data events, and insight events, which are three types of events that are recorded by CloudTrail. Management events include all management operations performed on resources in your account, such as security group configuration changes and IAM role permission adjustments. Data events provide details on the operations performed on or within a resource or service, while insight events reflect unusual API activity in comparison to historical API usage. CloudTrail saves your audit logs in gzip archive form to an S3 bucket specified when creating the trail, and you can set up single-Region trails or organization trails to monitor all of the logs generated by AWS accounts within an AWS Organization. To collect and analyze CloudTrail logs with Datadog, you can use a direct integration with AWS CloudTrail, automatic field parsing of log events, cost-effective collection and archiving of logs, and expanded scope of log context for security and compliance analysis. Additionally, you can use Datadog's built-in Threat Detection Rules to detect critical security and operational issues as they occur, and explore CloudTrail logs in Datadog's Log Explorer to filter and search them to find the most important logs for your particular use case.

Wouter de Bie, a Director of Engineering at Datadog, shares his experience of integrating advanced technology into his sailboat, Second Wind, to enhance sailing performance and safety. Originally from the Netherlands, de Bie combines his data expertise with his passion for sailing, using a Raspberry Pi and NMEA 2000 protocol to connect various instruments on his 37 ft Hunter Legend. This setup allows him to gather and analyze data related to speed, depth, wind conditions, and vessel positioning. By installing an AIS transponder and integrating a wind transducer, de Bie significantly improves navigational safety and data collection, allowing for real-time analysis and visualization via Datadog's APIs. His project not only enhances his sailing experience but also provides insights into optimizing routes and understanding environmental conditions. As he prepares to sail his boat from New York to New Orleans, de Bie reflects on the potential for turning data-driven hobbies into a career, inviting others to explore similar opportunities at Datadog.

Unified service tagging is an effective method of categorizing application components by using consistent tags across every application service, host, container, and more. Datadog's unified service tagging reserves three standard tags (env, service, and version) to automatically connect different data types in the monitoring platform, providing a single source of truth for monitoring data streaming from applications. This method simplifies the process of applying tags to all services once and using them everywhere (metrics, traces, logs, and profiles). It also helps identify problematic releases and their root causes with the version tag. Unified service tagging is flexible and can be applied in both non-containerized and containerized environments, such as Kubernetes, Docker, and ECS.

Datadog's unified service tagging provides a standardized configuration for adding key identifiers to applications, allowing teams to monitor their entire system at a high level, drill down to individual services, and easily correlate data across application components. This feature alleviates the pain of inconsistent tag schema implementation by reserving three standard tags (`env`, `service`, and `version`) that automatically connect different data types in Datadog, providing a single source of truth for monitoring data streaming from applications. By applying these standardized tags to services, teams can easily create consistent points of reference for monitoring application performance in one place, pivot between infrastructure metrics, logs, and traces, and identify problematic releases with the version tag. Additionally, unified service tagging enables developers to configure telemetry independently from other teams, making it easier to monitor performance without relying on manual configuration or external tools.

xMatters offers flexible tools for incident response and management, enabling automation of crucial tasks and enriched notifications to streamline team communications. With the new integration, Datadog alerts can be included in xMatters workflows, allowing teams to respond quickly to issues across their environment. The integration simplifies identifying and notifying the right people during a crisis by using automated on-call management and customizable workflows that collect data from integrated apps like Github or Jenkins. Additionally, Datadog event stream allows users to easily search, filter, and manage events while triggering notifications to specific groups or individuals through webhooks.

The text discusses the use of Boolean logic to define and redefine scopes for aggregating data across multiple overlapping dimensions, making it easier to understand and troubleshoot health and performance issues. It explains how Boolean-filtered metric queries can be used in Datadog dashboard widgets and notebooks to scope metrics within complex environments. The text also provides examples of using Boolean operators (AND, OR, NOT) and the IN operator to create more powerful metric queries for specific scopes. Additionally, it highlights how engineering managers can use these queries to get on-the-fly answers about teams within their organization, improving leadership decisions in microservices-based architectures.

Boolean-filtered metric queries in Datadog enable users to define and redefine scopes on the fly, making it easier to track data across overlapping scopes. By combining existing tags into complex expressions using Boolean logic, users can establish relationships between tags, group operations using parentheses, and use the `IN` operator to scope queries to specific tag keys. This technique allows for more concise and meaningful way to define the scope of metrics, providing visibility into complex environments, such as evolving requirements and microservices-based architectures. With this feature, users can quickly get on-the-fly answers to any question about teams within their organization, enabling informed leadership and monitoring of infrastructure in a comprehensive, flexible, and precise manner.

With xMatters and its new integration with Datadog, teams can automate incident response and management by sending enriched notifications to streamline team communications. The integration allows users to include Datadog alerts in their xMatters workflows, triggering other services in the toolchain to ensure timely responses to issues across the environment. Automated on-call management simplifies incident resolution by defining different individuals and groups to receive notifications according to severity, while integrating Datadog into workflows provides rich information from across the stack to those who need it. The integration also enables users to manage their response from inside Datadog events, including viewing the current escalation path for a given xMatters group directly within an event. With flexible incident response and management tools, teams can address and resolve issues efficiently, making all the difference in the crucial first steps of responding to a crisis.

Kubernetes audit logs are crucial for detecting misconfigurations and vulnerabilities in clusters but can be difficult to analyze due to their high volume. Alcide kAudit is a forensic tool that uses user-configured rules and machine learning algorithms to collect, analyze, and monitor Kubernetes audit logs in real time. Datadog's integration with Alcide kAudit enables users to create alerts and security rules based on kAudit logs and explore them within the context of system-wide monitoring data. The integration allows for custom security rules, log-based metrics visualization, and archiving of ingested logs in long-term cloud storage. This helps users efficiently investigate Kubernetes security incidents and minimize their impact without leaving the Datadog platform.

Alcide kAudit is a powerful forensic tool that leverages user-configured rules and machine learning to collect and analyze Kubernetes audit logs in real-time. It helps detect compliance violations, security incidents, and administration activity anomalies, providing users with valuable insights into their clusters. The integration with Datadog enables users to create custom security rules, generate log-based metrics, and contextualize kAudit logs within the context of system-wide monitoring data. This allows for efficient investigations, minimizing the impact of Kubernetes security incidents without leaving the Datadog platform. With Datadog's Logging without Limits, users can archive ingested logs in long-term cloud storage and rehydrate them on demand, ensuring a comprehensive record of all activities and anomalies.