October 2024 Summaries

The Datadog Microsoft Teams integration enables users to easily access critical observability insights and take action on them without leaving Teams. With this integration, users can receive notifications for critical issues, begin triaging them in the platform, and integrate Teams into automated Datadog workflows to streamline engineering processes further. The integration also allows users to quickly detect and respond to issues by receiving monitor notifications directly within their channels, and enables automation of complex workflows using Teams actions. Additionally, the integration provides a centralized incident communication hub and supports 40+ Azure integrations.

To ensure that an organization's cloud spend is efficient, it needs detailed and granular visibility to understand what comprises its costs, how they change, and how the cloud services and resources are enabling business goals. Datadog Scorecards evaluate compliance against observability, reliability, and documentation standards, providing visibility into each service's ownership data. By tagging resources for complete cost allocation, maximizing use of commitment-based discounts, alerting on unexpected cost changes, and adopting best practices for continual cost optimization, organizations can position themselves to successfully adopt FinOps and maximize the value they get from their cloud spend. Datadog provides tools such as Workflow Automation to help with these tasks, including a blueprint titled "At least 80 percent of a service's costs are allocated using the team tag" that calculates the percentage of each service's costs tagged appropriately.

Anand Mattah Chenna Kesavalu discusses the issue of bot traffic on e-commerce websites, which can significantly impact performance metrics and inflate monitoring costs. He highlights that understanding and mitigating the influence of bots is critical for maintaining accurate insights and controlling costs in today's digital landscape. To address this, he shares strategies to identify and filter unwanted traffic from RUM sessions, such as avoiding overt bot traffic injection, ignoring one-page sessions, or using a targeted approach with browser local storage and referrer domain checks. By implementing these methods, Kesavalu achieved a 50% cost savings on RUM expenses while improving the accuracy of user behavior analysis and enhancing the experiences of real users.

Mallory Mooney discusses the leading cause of cloud security incidents, which are compromised secrets such as leaked API and SSH keys, credentials, and session tokens. To minimize these risks, it's recommended to implement processes that prevent storing secrets in the first place, creating auto-expiration policies, and using centralized identity management tools. The article highlights the importance of visibility into existing secrets, monitoring when secrets need to be revoked or have expired, detecting anomalies and their usage, and tracking changes to secrets or their policies. It also emphasizes the need to phase out vulnerable secrets with secure alternatives, such as Datadog's security capabilities.

The Datadog Summit in Tokyo was a successful one-day event that brought together hundreds of people from the Datadog community. The day featured talks and panels from various Datadog customers, including NTT Docomo, One Career, Toshiba Digital Solutions, Kakehashi, BicCamera, Wantedly, Plaid, and Coconala, who shared their experiences on how they use Datadog to improve developer productivity, achieve success, and enhance reliability practices. The event also included hands-on workshops, an interactive GameDay with AWS, and product demos. Keynote speakers such as Takumi Masai, Adam Blitzer, Hiroki Nobe, Paula Miki Watanabe, Ichiro Kano, Shogo Ito, and others provided valuable insights into the use of Datadog's products and services in various industries and applications. The event concluded with a message from the organizers thanking everyone who attended and looking forward to seeing them at future summits.

Calculated Fields in the Log Explorer allow users to transform and enrich their log data on the fly during searches and investigations, providing more flexibility and control. This feature enables ad-hoc analysis, adds new dimensions to logs, and helps teams quickly adapt to rapidly changing environments. It also allows for standardizing and storing data transformations long-term via Pipelines, which can be customized and reused by different members of the team. With Calculated Fields, users can manipulate log data dynamically, eliminating the need to reprocess logs, and making it easier to conduct historical investigations over a large period of time.

Threat actors can use various tactics to access cloud environments, services, and data through lateral movement techniques. These methods involve pivoting from one host to another within an environment, often using other tactics such as initial access and privilege escalation. Microsoft Entra ID (formerly Azure Active Directory) is a cloud-based directory service that can be exploited by threat actors for lateral movement in hybrid Azure environments. Common entry points include misconfigurations in devices, overly permissive service accounts, and exposed secrets, keys, and user credentials. Detecting initial signs of unusual activity and tracking them to determine a threat actor's next steps is crucial in preventing lateral movement from advancing. Datadog Cloud SIEM can help users detect and respond to malicious activity captured in their logs, while also linking actions directly to specific identities such as users or service principals.

Datadog has been recognized as a Leader in the inaugural 2024 Gartner Magic Quadrant for Digital Experience Monitoring, notably excelling in its Ability to Execute. The company is celebrated for its comprehensive observability platform that consolidates various signals from across a tech stack, facilitating improved digital experiences by breaking down organizational silos. Datadog's suite of tools, including Real User Monitoring, Session Replay, Synthetic Testing, and AI-driven insights, provides deep visibility into user interactions and application performance, enabling proactive issue resolution and seamless digital operations. This recognition is seen as a testament to Datadog's commitment to innovation and customer satisfaction, with continued advancements in AI-driven impact analysis and product analytics aimed at enhancing user experiences across mobile and web applications.

As organizations increasingly adopt OpenTelemetry (OTel) for vendor-neutral system instrumentation, they face challenges in effectively tracing activities across their tech stacks, from frontend interactions to backend services. To address these issues, Datadog has enhanced its platform to fully support OTel Tracing APIs, allowing for the seamless integration of advanced features like Continuous Profiler and Real User Monitoring (RUM). This integration enables teams to connect frontend user activity with backend traces, facilitating more comprehensive end-to-end monitoring and troubleshooting. Datadog's mobile SDKs for iOS and Android now also support OTel, allowing for detailed tracing of mobile applications. Additionally, Datadog's support for OTel allows users to leverage various frameworks to extend tracing capabilities across their systems. By combining OTel and Datadog, teams can maintain vendor-neutral instrumentation while accessing Datadog's powerful observability tools to improve performance monitoring and issue resolution.

Flaky tests can significantly impact software development teams, causing delays and frustration. Flakiness compounds testing costs by increasing creation, execution, fixing, and psychological costs. When left unchecked, flaky tests erode developer trust in testing and CI, leading to a decrease in job satisfaction. To combat flakiness, it's essential to create workflows and implement tooling that detect flaky tests, re-run them when they flake, and track their prevalence across the codebase. Automatic flaky test detection tools help identify flaky tests sooner, while quality gates can block commits that introduce new flaky tests from being merged. Additionally, configuring automatic retries and quarantining tests that frequently flake can help mitigate the issue. Tools like Datadog Test Visibility provide features to detect new flaky tests, track their impact, and minimize their impact on CI workflows.

Datadog's Windows event log integration enables security teams to efficiently detect, triage, and respond to threats in real-time. The platform provides out-of-the-box (OOTB) threat detection rules aligned with the MITRE ATT&CK framework, allowing for continuous scanning of Windows event logs for potentially malicious activity. Datadog also offers customizable dashboards and visualizations to provide a high-level overview of activity across the environment, including top lists of most frequent events and security signals. With this integration, teams can gain deeper security visibility into their Windows environments, enabling them to identify potential security threats earlier and respond more effectively.

The Azure OpenAI Service, a managed platform by Microsoft for deploying generative AI services powered by OpenAI, now integrates with Datadog LLM Observability to enhance application performance monitoring and troubleshooting. This integration provides organizations with extensive visibility across over 60 Azure services, enabling efficient management of enterprise-scale LLM applications by offering real-time metrics, distributed traces, and quality checks. Datadog’s tools help identify and resolve latency and error issues, optimize resource usage, and ensure application safety and reliability by detecting toxicity, bias, and potential security risks. By using Datadog, Azure OpenAI users can gain comprehensive insights into their applications' health, performance, and security, ultimately facilitating more effective and ethical AI operations.

The 2024 State of Cloud Security study highlights various security risks and misconfigurations in cloud environments. Long-lived cloud credentials, insecure IAM roles for third-party integrations, and public access to storage services are among the key issues identified. The study recommends minimizing long-lived cloud credentials, using Datadog Cloud Security Management (CSM) to identify and track down stale cloud credentials, enforcing the use of IMDSv2 on Amazon EC2 instances, blocking public access proactively on cloud storage services, limiting privileges assigned to cloud workloads, applying cloud-specific tuning to managed Kubernetes clusters, securing IAM roles used for third-party integrations, and securing infrastructure against common cloud risks. CSM can help identify and mitigate these risks, providing a more secure posture for organizations in the cloud.

Datadog's Observability Pipelines is a tool that allows users to extract metrics from ingested logs without having to sift through them all, reducing the costs associated with log management. By using this feature, users can generate metrics from their high-volume logs and store only the most important information in cost-effective long-term storage solutions, while still being able to track performance in real-time, analyze trends, and correlate with other infrastructure and application metrics. Additionally, Observability Pipelines can reduce the volume of logs that need to be ingested, stored, and routed, without compromising analytics capabilities or developer efficiency. This allows users to maintain optimal performance, avoid unnecessary egress and network costs, and take advantage of cost-efficient storage solutions as their log volumes scale.

Datadog is a cloud-based monitoring and analytics platform that helps organizations ensure the resiliency of their financial data by providing powerful, AI-enriched data correlation to identify potential risks within their system. The platform enables users to patch vulnerabilities, implement robust business continuity plans, respond to incidents, and report security measures in compliance with regulations such as the Digital Operational Resilience Act (DORA). With its features including Cloud Security Management, Infrastructure Monitoring, Application Performance Monitoring, Incident Management, and Sensitive Data Scanner, Datadog provides end-to-end visibility into potential weak points and proactive handling of unusual activity within third-party services. By leveraging these tools, organizations can strengthen their app's resiliency, mitigate security risks, and ensure compliance with regulatory requirements.

Christine Le and Christopher Camacho from Datadog discuss the benefits of Detection as Code (DaC) methodology, which treats threat detection logic and security operations processes as code. They address pain points associated with traditional security operations, such as version control, consistency of review and approval, maintenance at scale, and more. The authors describe how they implement DaC using Datadog's Cloud SIEM, Application Security Management (ASM), and Cloud Security Management (CSM) products, leveraging software engineering best practices to manage detection rules and response runbooks. They outline their repository structure, CI/CD pipeline, and detection development flow, showcasing how these components work together to simplify and centralize detection rule creation. The authors conclude by highlighting the key benefits of DaC and encouraging readers to adopt this approach for creating effective security detections at scale.

To accelerate patient care and comply with the Health Insurance Portability and Accountability Act (HIPAA), healthcare organizations are under pressure to rapidly share personal information among providers, insurers, and patients within a rapidly evolving cloud environment. To protect patient data, Datadog's Sensitive Data Scanner helps entities subject to HIPAA discover PII at scale, classify sensitive healthcare data using granular rules, and redact results to prevent sensitive data from leaking into Datadog. The tool also provides real-time alerts, dashboards, and auditing capabilities to streamline investigations and reporting, enabling teams to take informed action based on the severity of the event.

SentinelOne is an endpoint detection and response (EDR) solution that provides real-time detection of and response to endpoint threats, including malware, zero-day exploits, advanced persistent threats, and more. Datadog Cloud SIEM can be integrated with SentinelOne to provide full security visibility into SentinelOne activity logs, threat detections, and more. The integration allows organizations to centralize alerts, threats, and telemetry from SentinelOne Singularity, enabling real-time analysis, long-term investigations, threat hunting, and custom detection development. Datadog's built-in threat detection rules can be used to detect specific threat indicators, such as credential access via registry hive dumping or process memory dumped using ProcDump or minidump function of comsvcs.dll. The integration also provides a centralized dashboard for visualizing logs and alert activity, enabling security teams to track threats over time by confidence level and identify patterns or escalation in threat severity. With Datadog Cloud SIEM and the SentinelOne integration, organizations can monitor, triage, and respond to threats across both endpoints and cloud environments from a unified platform.

AWS now enables customers to retry or redrive Step Functions executions directly from the Datadog platform, reducing error remediation time and costs. Previously, this feature was only available in the AWS console, causing a disjointed user experience for customers. With this new feature, customers can find and take action on failed executions directly from the Datadog UI using the App Builder, significantly reducing manual documentation and execution of retries or redrives. To use this feature, customers must already be monitoring Step Functions using Datadog native monitoring, and will need to configure an AWS connection for their first attempt at retrying a failed execution. Once configured, customers can immediately start redriving or retrying failed Standard Workflows and all monitored Workflows from within the Datadog platform.

The Camunda 8 process orchestration platform is used by organizations to automate and execute business processes at scale, requiring complete visibility into the environment to maintain health and performance. Bordant Technologies' integration with Datadog provides real-time monitoring of Camunda 8 components, simplifying operational oversight and enabling proactive identification of bottlenecks, resource health issues, and fine-tuning of performance. The integration offers a comprehensive dashboard that visualizes execution statistics, resource usage, throughput metrics, and more, allowing users to monitor the health of Zeebe components, identify errors, and ensure tasks are processed efficiently. Additionally, the integration enables users to set up custom alerts for Camunda 8 metrics, receive real-time notifications in case of an incident or performance issue, and customize alerts with Datadog monitors to strengthen the reliability of their entire system. The integration is available as a 14-day free trial, and Bordant Technologies offers a membership benefit through the Datadog Partner Network for partners interested in developing integrations or applications that promote branded marketing tools.