---
title: Custom Detection Rules
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Cloud SIEM > Detect and Monitor > Custom Detection
  Rules
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Custom Detection Rules

## Overview{% #overview %}

Out-of-the-box detection rules help you cover the majority of threat scenarios, but you can also create custom detection rules for your specific use cases. For information on the types of rules you can create, and instructions on how to do so, see [Create a Custom Rule](https://docs.datadoghq.com/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule.md).

## Filter logs based on Reference Tables{% #filter-logs-based-on-reference-tables %}

{% alert level="warning" %}
Reference Tables containing over 1,000,000 rows cannot be used to filter events. See [Add Custom Metadata with Reference Tables](https://docs.datadoghq.com/integrations/guide/reference-tables.md) for more information on how to create and manage Reference Tables.
{% /alert %}

Reference Tables allow you to combine metadata with logs, providing more information to resolve application issues. When you define a query for a rule, you can add a query filter based on a Reference Table to perform lookup queries. For more information on creating and managing this feature, see the [Reference Tables](https://docs.datadoghq.com/integrations/guide/reference-tables.md) guide.

In the following example, a Reference Table containing product information is used to filter and enrich logs:

{% image
   source="https://docs.dd-static.net/images/security/security_monitoring/detection_rules/filter-by-reference-table.aba6e4777546fd022262f84f7aa4dde1.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/security_monitoring/detection_rules/filter-by-reference-table.aba6e4777546fd022262f84f7aa4dde1.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="The log detection rule query editor with the reference table search options highlighted" /%}

## Unit testing{% #unit-testing %}

Use unit testing to test your rules against sample logs and make sure the detection rule is working as expected. This can be helpful when you are creating a detection rule for an event that hasn't happened yet, so you don't have actual logs for the event. For example: You have logs with a `login_attempt` field and want to detect logs with `login_attempt:failed`, but you only have logs with `login_attempt:success`. To test the rule, you can construct a sample log by copying a log with `login_attempt:success` and changing the `login_attempt` field to `failed`.

## Further Reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Create a custom detection rule](https://docs.datadoghq.com/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule.md)
- [Configure default Cloud SIEM detection rules](https://docs.datadoghq.com/cloud_siem/default_rules.md)
- [Learn about the Security Signals Explorer](https://docs.datadoghq.com/cloud_siem/explorer.md)
- [Detect unauthorized third parties in your AWS account](https://www.datadoghq.com/blog/detect-unauthorized-third-parties-aws/)
- [Detect security threats with anomaly detection rules](https://www.datadoghq.com/blog/anomaly-detection-rules-datadog/)
- [Learn more about Security notification variables](https://docs.datadoghq.com/security/notifications/variables.md)
- [Monitor Cloudflare Zero Trust with Datadog Cloud SIEM](https://www.datadoghq.com/blog/monitor-cloudflare-zero-trust/)
- [Monitor 1Password with Datadog Cloud SIEM](https://www.datadoghq.com/blog/monitor-1password-datadog-cloud-siem/)
- [Detect anomalies beyond spikes and new values with Content Anomaly Detection in Cloud SIEM](https://www.datadoghq.com/blog/content-anomaly-detection-cloud-siem/)
- [Write Custom Cloud SIEM Detection Rules](https://learn.datadoghq.com/courses/cloud-siem-custom-rules)