At Datadog’s scale, with over 18,000 customers sending trillions of data points per day, analyzing the volume of data coming in can be challenging. One of the largest log sources internally at Datadog are networking logs. Being able to analyze and make sense of them is critical to keep Datadog secure. To help with the task, we have built a flow analysis pipeline that alerts against network level Indicators of Compromise (IOCs) like IP address, port combinations, and data exchanged.

Security vulnerabilities can show up anywhere in production. In this talk, Nick Davis from Datadog describes an approach to improve the response to new security vulnerabilities, with specifics around the DirtyPipe vulnerability.