Overview

This topic describes threat intelligence for Application Security Management (ASM).

Datadog provides built-in threat intelligence datasets for ASM. This provides additional evidence when acting on security activity and reduces detection thresholds for some business logic detections.

Additionally, ASM supports bring your own threat intelligence. This functionality enriches detections with business-specific threat intelligence.

Best practices

Datadog recommends the following methods for consuming threat intelligence:

1. Reducing detection rule thresholds for business logic threats such as credential stuffing. Users can clone the default Credential Stuffing rule and modify it to meet their needs.
2. Using threat intelligence as a indicator of reputation with security activity.

Datadog recommends against the following:

1. Blocking threat intelligence traces without corresponding security activity. IP addresses might have many hosts behind them. Detection of a residential proxy means that the associated activity has been observed by a host behind that IP. It does not guarantee that the host running the malware or proxy is the same host communicating with your services.
2. Blocking on all threat intelligence categories, as this is inclusive of benign traffic from corporate VPNs and blocks unmalicious traffic.

Filtering on threat intelligence in ASM

Users can filter threat intelligence on the Signals and Traces explorers using facets and the search bar.

To search for all traces flagged by a specific source, use the following query with the source name:

@threat_intel.results.source.name:<SOURCE_NAME> 

To query for all traces containing threat intelligence from any source, use the following query:

@appsec.threat_intel:true 

Bring your own threat intelligence

ASM supports enriching and searching traces with threat intelligence indicators of compromise stored in Datadog reference tables. Reference Tables allow you to combine metadata with information already in Datadog.

Storing indicators of compromise in reference tables

Threat intelligence is supported in the CSV format and requires 4 columns.

CSV Structure

The full list of supported categories and intents is available at Threat Intelligence Facets.

ip_address,additional_data,category,intention,source
192.0.2.1,"{""ref"":""hxxp://example.org""}",scanner,suspicious,"{""name"":""internal_security_team"", ""url"":""https://teamwiki.example.org""}"
192.0.2.2,"{""ref"":""hxxp://example.org""}",scanner,suspicious,"{""name"":""internal_security_team"", ""url"":""https://teamwiki.example.org""}"
192.0.2.3,"{""ref"":""hxxp://example.org""}",scanner,suspicious,"{""name"":""internal_security_team"", ""url"":""https://teamwiki.example.org""}"

Uploading and enabling your own threat intel

On a new references table page:

1. Name the table. The table name is referenced in ASM’s Threat Intel config.

2. Upload a CSV.

3. Preview the table schema and choose the IP address as the Primary Key.

4. Save the table.

5. In Threat Intel, locate the new table, and then select the toggle to enable it.

Enriching traces for detection rules

Enriching traces includes the threat intelligence attributes in ASM traces when the indicator of compromise matches the value of the http.client_ip key in the ASM trace. This enables searching for traces with threat intelligence matches using existing facets and using threat intelligence with detection rules.

Threat intelligence in the user interface

When viewing the traces in the ASM Traces Explorer, you can see threat intelligence data under the @appsec attribute. The category and security_activity attributes are both set.

Under @threat_intel.results you can always see the full details of what was matched from which source:

Further Reading

Additional helpful documentation, links, and articles:

Threat Intelligence at DatadogDOCUMENTATION Protect against threats with Datadog Application Security ManagementDOCUMENTATION