TechPrufer
Sign inGet started

Blogs›Datadog›SaaS Account Auditing and Monitoring

SaaS Account Auditing and Monitoring

SaaS Account Auditing and Monitoring

2
posts
2017–2021

Datadog developed an internal tool called 'Clarity' to automate the auditing of third-party SaaS accounts against its HRIS (Workday). This system flags accounts that do not match active employee records, ensuring security and cost-efficiency. It leverages AWS Lambda, Slack, Freshservice, and Datadog for logging, alerting, and ticketing. The tool generates metrics and logs for each flagged account, providing detailed information for investigation and remediation. This post details the initial work to improve cloud security visibility with ChatOps, integrating with Slack, Duo, and PagerDuty to monitor AWS API activity. The pipeline uses Cloudwatch Event Rules, SNS, SQS, and Lambda for cross-account data collection and processing, with Komand used for security orchestration and automation to parse API calls, apply logic, and trigger alerts or notifications. User notifications are sent via Slack with Duo for verification. All workflow details are logged to Elasticsearch for visualization and analysis.

2021

How Datadog’s IT team automated monitoring third-party accounts | Datadog

4/30/2021

This post details the development of 'Clarity', an internal system for automated SaaS account auditing. It outlines the requirements, solution architecture involving AWS Lambda, Workday integration, and the use of Datadog for metrics and logging. Specific examples of Datadog metric submission (gauge for flagged accounts, count for ticket failures) and log formatting are provided, along with the integration with Freshservice for ticketing and Slack for notifications.

2017

Improving cloud security visibility with ChatOps | Datadog

8/15/2017

This post details the initial implementation of a security monitoring and alerting pipeline for AWS cloud operations. It describes the use of Cloudwatch Event Rules, SNS, SQS, and Lambda for cross-account data collection and processing. The core logic for parsing API calls and determining actions (log, notify, alert) is handled by the Komand security orchestration platform, augmented with custom plugins. The user notification flow leverages Slack for interactive messages and Duo for multi-factor authentication. All workflow details are logged to Elasticsearch.