Overview

This topic describes threat intelligence for App and API Protection (AAP).

Datadog provides built-in threat intelligence datasets for AAP. This provides additional evidence when acting on security activity and reduces detection thresholds for some business logic detections.

Additionally, AAP supports bring your own threat intelligence. This functionality enriches detections with business-specific threat intelligence.

Best practices

Datadog recommends the following methods for consuming threat intelligence:

1. Reducing detection rule thresholds for business logic threats such as credential stuffing. Users can clone the default Credential Stuffing rule and modify it to meet their needs.
2. Using threat intelligence as a indicator of reputation with security activity.

Datadog recommends against the following:

1. Blocking threat intelligence traces without corresponding security activity. IP addresses might have many hosts behind them. Detection of a residential proxy means that the associated activity has been observed by a host behind that IP. It does not guarantee that the host running the malware or proxy is the same host communicating with your services.
2. Blocking on all threat intelligence categories, as this is inclusive of benign traffic from corporate VPNs and blocks unmalicious traffic.

Filtering on threat intelligence in AAP

Users can filter threat intelligence on the Signals and Traces explorers using facets and the search bar.

To search for all traces flagged by a specific source, use the following query with the source name:

@threat_intel.results.source.name:<SOURCE_NAME> 

To query for all traces containing threat intelligence from any source, use the following query:

@appsec.threat_intel:true 

Bring your own threat intelligence

AAP supports enriching and searching traces with threat intelligence indicators of compromise stored in Datadog reference tables. Reference Tables allow you to combine metadata with information already in Datadog.

Storing indicators of compromise in reference tables

Threat intelligence is supported in the CSV format and requires the following columns:

CSV Structure

The full list of supported categories and intents is available at Threat Intelligence Facets.

ip_address,additional_data,category,intention,source
192.0.2.1,"{""ref"":""hxxp://example.org""}",scanner,suspicious,"{""name"":""internal_security_team"", ""url"":""https://teamwiki.example.org""}"
192.0.2.2,"{""ref"":""hxxp://example.org""}",scanner,suspicious,"{""name"":""internal_security_team"", ""url"":""https://teamwiki.example.org""}"
192.0.2.3,"{""ref"":""hxxp://example.org""}",scanner,suspicious,"{""name"":""internal_security_team"", ""url"":""https://teamwiki.example.org""}"

Uploading and enabling your own threat intel

Datadog supports creating reference tables through a manual upload, or by periodically retrieving the data from Amazon S3, Azure storage, or Google Cloud storage.

Notes:

• It can take 10 to 30 minutes to start enriching AAP traces after creating a table.
• If a primary key is duplicated, it is skipped and an error message about the key is displayed.

On a new references table page:

1. Name the table. The table name is referenced in AAP’s Threat Intel config.

2. Upload a local CSV or import a CSV from a cloud storage bucket. The file is normalized and validated.

3. Preview the table schema and choose the IP address as the Primary Key.

4. Save the table.

5. In Threat Intel, locate the new table, and then select the toggle to enable it.

Using cloud storage

When the reference table is created from cloud storage, it is refreshed periodically. The entire table is replaced. Data is not merged.

See the related reference table documentation for:

• Amazon S3
• Azure storage
• Google Cloud storage

Troubleshooting cloud imports

If the reference tables are not refreshing, select the View Change Events link from the settings on the reference table detail page.

View Change Events opens a page in Event Management showing potential error events for the ingestion. You can also filter in Event Management using the reference table name.

Other useful cloud import details to remember:

• The expected latency before updated enrichments are available when a source is uploaded or updated is 10 to 30 minutes.
• How to know when the updates are applied: The changes are visible in the reference table or in the spans. Select the View Change Events link from settings on the reference table detail page to see the related events.
• The update replaces the entire table with the new data.
• In case of a duplicated primary key, the rows with the duplicated key are not written, and an error is shown in the reference table detail page.

Filter traces by joining the list with a Reference Table

You can filter AAP traces in Datadog by joining a trace table with a Reference Table.

To join a Reference Table with a trace query, you combine rows from the Datadog trace table and a Reference Table based on a related column between them. The traces query returns only those traces where there is a match in both tables.

Using a join with a Reference Table enables you to evaluate impact before enrichment by searching for historical matches with existing traces.

You can use any fields, not just IP addresses. For example, by associating security traces with specific URLs from a reference table, you can identify which parts of your application are being targeted by attacks. This can help pinpoint vulnerabilities or high-risk areas within the application.

Examples:

• Investigation and incident response. You can upload and join using IPs or other fields from attacks and see the traffic related to that incident.
• By using security traces with the IP addresses from a Reference Table, such as associating IP addresses with geographic locations or organizational details, security teams can gain better context around attack attempts. This can help in understanding the origin and potential motivation behind the attacks.

To join a trace with a Reference Table:

1. Upload the Reference Table you want to use as described in Uploading and enabling your own threat intel.
2. To join a trace with a Reference Table, in Traces, select Add, and then select Join with Reference Table.
3. In Inner join with reference table, select the Reference Table to use.
4. In where field, select the Datadog traces field to use for the join.
5. In column, select the Reference Table field to use for the join.

Enriching traces for detection rules

Enriching traces includes the threat intelligence attributes in AAP traces when the indicator of compromise matches the value of the http.client_ip key in the AAP trace. This enables searching for traces with threat intelligence matches using existing facets and using threat intelligence with detection rules.

Threat intelligence in the user interface

When viewing the traces in the AAP Traces Explorer, you can see threat intelligence data under the @appsec attribute. The category and security_activity attributes are both set.

Under @threat_intel.results you can always see the full details of what was matched from which source:

Further Reading

Additional helpful documentation, links, and articles:

Threat Intelligence at DatadogDOCUMENTATION Protect against threats with Datadog App and API ProtectionDOCUMENTATION