SaaS Account Auditing and Monitoring

2 posts · Aug 2017 – May 2022

What this trail covers

Datadog developed an internal tool called 'Clarity' to automate the auditing of third-party SaaS accounts against its HRIS (Workday). This system flags accounts that do not match active employee records, ensuring security and cost-efficiency. The tool generates metrics and logs for each flagged account, providing detailed information for investigation and remediation. The system was expanded into Clarity License Manager (CLM) to optimize software licensing efficiency, monitor account activity, and provide a centralized dashboard for IT teams.

All Datadog trails

May 2022How Datadog’s IT team automated account inactivity and SaaS spend management | DatadogThis post details the expansion of the Clarity tool into Clarity License Manager (CLM) to optimize software licensing efficiency and reduce SaaS spend. It describes the goals of monitoring account activity, deactivating unused accounts, reducing security risks from stale credentials, limiting bad actor impact, reducing SaaS spend, and minimizing employee productivity impact. The solution involves direct API integrations and Google Workspace SAML Audit logs, a backend using Amazon RDS, and a microservice architecture with Python AWS Lambdas interacting with a Postgres database. Application-specific adapters were developed to bridge microservices with SaaS APIs, adhering to the principle of single responsibility, and providing flexibility and reusability. The post also outlines the general workflow of CLM, including employee notifications via Slack and automated deactivation/reactivation.
Apr 2021How Datadog’s IT team automated monitoring third-party accounts | DatadogThis post details the development of 'Clarity', an internal tool for automating the auditing of third-party SaaS accounts against Workday (HRIS). It outlines the requirements for the tool, including a single source of truth, frequent execution, manual run capability, and integration with common tooling (Slack, Freshservice, Datadog). The solution involves retrieving reports of active users from SaaS applications and Workday, auditing for discrepancies, sending logs and metrics to Datadog, generating Freshservice tickets, logging to DynamoDB, and sending Slack notifications. Specific technical details include using AWS Lambda, Cloudwatch Event Rules, Datadog metrics (gauge and count types) with custom tags, and Datadog Log Management with facets for detailed auditing information.
Aug 2017Improving cloud security visibility with ChatOps | DatadogThis post details the initial implementation of a security monitoring and alerting pipeline for AWS cloud operations. It describes the use of Cloudwatch Event Rules, SNS, SQS, and Lambda for cross-account data collection and processing. The core logic for parsing API calls and determining actions (log, notify, alert) is handled by the Komand security orchestration platform, augmented with custom plugins. The user notification flow leverages Slack for interactive messages and Duo for multi-factor authentication. All workflow details are logged to Elasticsearch.
Advertisement