Datadog Security supports enriching and searching traces with threat intelligence indicators of compromise stored in Datadog reference tables. Reference Tables allow you to combine metadata with information already in Datadog.

Storing indicators of compromise in reference tables

Threat intelligence is supported in the CSV format and requires the following columns:

CSV Structure

The full list of supported categories and intents is available at Threat Intelligence Facets.

ip_address,additional_data,category,intention,source
192.0.2.1,"{""ref"":""hxxp://example.org""}",scanner,suspicious,"{""name"":""internal_security_team"", ""url"":""https://teamwiki.example.org""}"
192.0.2.2,"{""ref"":""hxxp://example.org""}",scanner,suspicious,"{""name"":""internal_security_team"", ""url"":""https://teamwiki.example.org""}"
192.0.2.3,"{""ref"":""hxxp://example.org""}",scanner,suspicious,"{""name"":""internal_security_team"", ""url"":""https://teamwiki.example.org""}"

Uploading and enabling your own threat intel

Datadog supports creating reference tables through a manual upload, or by periodically retrieving the data from Amazon S3, Azure storage, or Google Cloud storage.

Notes:

• It can take 10 to 30 minutes to start enriching AAP traces after creating a table.
• If a primary key is duplicated, it is skipped and an error message about the key is displayed.

On a new references table page:

1. Name the table. The table name is referenced in AAP’s Threat Intel config.

2. Upload a local CSV or import a CSV from a cloud storage bucket. The file is normalized and validated.

3. Preview the table schema and choose the IP address as the Primary Key.

4. Save the table.

5. In Threat Intel, locate the new table, and then select the toggle to enable it.

Using cloud storage

When the reference table is created from cloud storage, it is refreshed periodically. The entire table is replaced. Data is not merged.

See the related reference table documentation for:

• Amazon S3
• Azure storage
• Google Cloud storage

Troubleshooting cloud imports

If the reference tables are not refreshing, select the View Change Events link from the settings on the reference table detail page.

View Change Events opens a page in Event Management showing potential error events for the ingestion. You can also filter in Event Management using the reference table name.

Other useful cloud import details to remember:

• The expected latency before updated enrichments are available when a source is uploaded or updated is 10 to 30 minutes.
• How to know when the updates are applied: The changes are visible in the reference table or in the spans. Select the View Change Events link from settings on the reference table detail page to see the related events.
• The update replaces the entire table with the new data.
• In case of a duplicated primary key, the rows with the duplicated key are not written, and an error is shown in the reference table detail page.

Filter traces by joining the list with a Reference Table

You can filter AAP traces in Datadog by joining a trace table with a Reference Table.

To join a Reference Table with a trace query, you combine rows from the Datadog trace table and a Reference Table based on a related column between them. The traces query returns only those traces where there is a match in both tables.

Using a join with a Reference Table enables you to evaluate impact before enrichment by searching for historical matches with existing traces.

You can use any fields, not just IP addresses. For example, by associating security traces with specific URLs from a reference table, you can identify which parts of your application are being targeted by attacks. This can help pinpoint vulnerabilities or high-risk areas within the application.

Examples:

• Investigation and incident response. You can upload and join using IPs or other fields from attacks and see the traffic related to that incident.
• By using security traces with the IP addresses from a Reference Table, such as associating IP addresses with geographic locations or organizational details, security teams can gain better context around attack attempts. This can help in understanding the origin and potential motivation behind the attacks.

To join a trace with a Reference Table:

1. Upload the Reference Table you want to use as described in Uploading and enabling your own threat intel.
2. To join a trace with a Reference Table, in Traces, select Add, and then select Join with Reference Table.
3. In Inner join with reference table, select the Reference Table to use.
4. In where field, select the Datadog traces field to use for the join.
5. In column, select the Reference Table field to use for the join.

Enriching traces for detection rules

Enriching traces includes the threat intelligence attributes in AAP traces when the indicator of compromise matches the value of the http.client_ip key in the AAP trace. This enables searching for traces with threat intelligence matches using existing facets and using threat intelligence with detection rules.