OOTB Rules

Datadog provides out-of-the-box (OOTB) detection rules to flag attacker techniques and potential misconfigurations so you can immediately take steps to remediate. Datadog continuously develops new default rules, which are automatically imported into your account, your Application Security Monitoring library, and the Agent, depending on your configuration. For more information, see the Detection Rules documentation.

Click on the buttons below to filter by different parts of the Datadog Security Platform. OOTB rules are available for Cloud SIEM, Posture Management, which is divided into cloud or infrastructure configuration, Workload Security, and Application Security Monitoring.

azure.activity_log
Azure.Activity Log
>
azure.activity_log User has 'Create or Update Load Balancer' activity log alert configured
azure.activity_log User has 'Create or Update Network Security Group' activity log alert configured
azure.activity_log User has 'Create or Update Security Solutions' activity log alert configured
azure.activity_log User has 'Create or Update SQL Server Firewall Rule' activity log alert configured
azure.activity_log User has 'Create or Update Storage Accounts' activity log alert configured
azure.activity_log User has 'Create or Update Virtual Machines' activity log alert configured
azure.activity_log User has 'Create Policy Assignement' activity log alert configured
azure.activity_log User has 'Create Update Azure SQL Database' activity log alert configured
azure.activity_log User has 'Create Update MySQL Database' activity log alert configured
azure.activity_log User has 'Create Update PostgreSQL Database' activity log alert configured
azure.activity_log User has 'Deallocate Virtual Machines' activity log alert configured
azure.activity_log User has 'Delete Azure SQL Database' activity log alert configured
azure.activity_log User has 'Delete Key Vault' activity log alert configured
azure.activity_log User has 'Delete Load Balancer' activity log alert configured
azure.activity_log User has 'Delete MySQL Database' activity log alert configured
azure.activity_log User has 'Delete Network Security Group' activity log alert configured
azure.activity_log User has 'Delete Policy Assignement' activity log alert configured
azure.activity_log User has 'Delete PostgreSQL Database' activity log alert configured
azure.activity_log User has 'Delete Security Solution' activity log alert configured
azure.activity_log User has 'Delete SQL Server Firewall Rule' activity log alert configured
azure.activity_log User has 'Delete Storage Accounts' activity log alert configured
azure.activity_log User has 'Delete Virtual Machines' activity log alert configured
azure.activity_log User has 'Power Off Virtual Machine' activity log alert configured
azure.activity_log User has 'Rename Azure SQL Database' activity log alert configured
azure.activity_log User has 'Update Key Vault' activity log alert configured
azure.activity_log User has 'Update Security Policy' activity log alert configured
cloudtrail
Cloudtrail
>
cloudtrail A user received multiple AccessDenied errors
cloudtrail An AWS account attempted to leave the AWS Organization
cloudtrail An AWS S3 bucket lifecycle expiration policy was set to disabled
cloudtrail An AWS S3 bucket lifecycle policy expiration is set to < 90 days
cloudtrail An AWS S3 bucket lifecycle policy was deleted
cloudtrail An AWS S3 bucket mfaDelete is disabled
cloudtrail An EC2 instance attempted to enumerate S3 bucket
cloudtrail Anomalous amount of access denied events for AWS EC2 Instance
cloudtrail Anomalous amount of Autoscaling Group events
cloudtrail Anomalous API Gateway API key reads by user
cloudtrail Anomalous number of assumed roles from user
cloudtrail Anomalous number of S3 buckets accessed
cloudtrail Anomalous S3 bucket activity from user ARN
cloudtrail AWS AMI Made Public
cloudtrail AWS CloudTrail configuration modified
cloudtrail AWS CloudWatch log group deleted
cloudtrail AWS CloudWatch rule disabled or deleted
cloudtrail AWS Config modified
cloudtrail AWS Console login without MFA
cloudtrail AWS ConsoleLogin with MFA triggered Impossible Travel scenario
cloudtrail AWS ConsoleLogin without MFA triggered Impossible Travel scenario
cloudtrail AWS Detective Graph deleted
cloudtrail AWS Disable Cloudtrail with event selectors
cloudtrail AWS EBS default encryption disabled
cloudtrail AWS EBS Snapshot Made Public
cloudtrail AWS EBS Snapshot possible exfiltration
cloudtrail AWS EC2 new event for application
cloudtrail AWS EC2 new event for EKS Node Group
cloudtrail AWS EC2 subnet deleted
cloudtrail AWS ECS cluster deleted
cloudtrail AWS EventBridge rule disabled or deleted
cloudtrail AWS FlowLogs removed
cloudtrail AWS GuardDuty detector deleted
cloudtrail AWS GuardDuty publishing destination deleted
cloudtrail AWS GuardDuty threat intel set deleted
cloudtrail AWS IAM policy changed
cloudtrail AWS IAM privileged policy was applied to a group
cloudtrail AWS IAM privileged policy was applied to a role
cloudtrail AWS IAM privileged policy was applied to a user
cloudtrail AWS Kinesis Firehose stream destination modified
cloudtrail AWS KMS key deleted or scheduled for deletion
cloudtrail AWS Network Access Control List created or modified
cloudtrail AWS Network Gateway created or modified
cloudtrail AWS RDS Cluster deleted
cloudtrail AWS root account activity
cloudtrail AWS Route 53 DNS query logging disabled
cloudtrail AWS Route 53 VPC disassociated from query logging configuration
cloudtrail AWS Route Table created or modified
cloudtrail AWS S3 Bucket ACL Made Public
cloudtrail AWS S3 Public Access Block removed
cloudtrail AWS security group created, modified or deleted
cloudtrail AWS Security Hub disabled
cloudtrail AWS VPC created or modified
cloudtrail AWS WAF traffic blocked by specific rule
cloudtrail AWS WAF traffic blocked by specific rule on multiple IPs
cloudtrail AWS WAF web access control list deleted
cloudtrail AWS WAF web access control list modified
cloudtrail CloudTrail global services are enabled
cloudtrail CloudTrail log file validation is enabled
cloudtrail CloudTrail logs are encrypted at rest using KMS CMKs
cloudtrail CloudTrail multi-region is enabled
cloudtrail Compromised AWS EC2 Instance
cloudtrail Compromised AWS IAM User Access Key
cloudtrail Encrypted administrator password retrieved for Windows EC2 instance
cloudtrail New AWS Account Seen Assuming a Role into AWS Account
cloudtrail New EC2 Instance Type
cloudtrail New Private Repository Container Image detected in AWS ECR
cloudtrail New Public Repository Container Image detected in AWS ECR
cloudtrail New user seen executing a command in an ECS task
cloudtrail Possible AWS EC2 privilege escalation via the modification of user data
cloudtrail Possible Privilege Escalation via AWS IAM CreateLoginProfile
cloudtrail Possible RDS Snapshot Exfiltration
cloudtrail Potential administrative port open to the world via AWS security group
cloudtrail Potential brute force attack on AWS ConsoleLogin
cloudtrail Potential database port open to the world via AWS security group
cloudtrail S3 bucket access logging is enabled on the CloudTrail S3 bucket
cloudtrail S3 bucket policy modified
cloudtrail Security group open to the world
cloudtrail User enumerated AWS Secrets Manager - Anomaly
cloudtrail User enumerated AWS Systems Manager parameters - Anomaly
cloudtrail User travel was impossible in AWS CloudTrail IAM log
docker
Docker
>
docker Auditing for Docker Daemon executable is configured
docker Auditing for Docker local storage is configured
docker Auditing for the containerd executable is configured
docker Auditing for the default Docker configuration file is configured
docker Auditing for the default Docker configuration file is configured - RHEL
docker Auditing for the Docker daemon configuration file is configured
docker Auditing for the docker.service file is configured
docker Auditing for the docker.socket file is configured
docker Auditing for the runc executable is configured
docker Auditing is configured for Docker-related files
docker Container has memory usage limits configured
docker Container health is monitored when not supported by default
docker Container image includes HealthCheck instructions
docker Container is restricted from acquiring additional privileges
docker Container root file sytem is set to read-only
docker Container's PIDs cgroup limit parameter is set
docker Containers do not use the root user
docker Containers have an AppArmor profile enabled
docker Containers use the cgroup configured in Docker
docker CPU priorities are set to ensure critical containers do not become unresponsive
docker Default Docker configuration file cannot be altered by non-owners
docker Default Docker configuration file cannot be altered by non-owners - RHEL
docker Default Docker configuration file is owned by the root account and group
docker Default Docker configuration file is owned by the root account and group - RHEL
docker Docker daemon logging level is set to 'info'
docker Docker does not use AUFS storage driver
docker Docker is authorized to make firewall configuration changes
docker Docker local storage is mounted on a separate disk partition
docker Docker related files are owned by the root account and group
docker Docker related files cannot be altered by non-owners
docker Docker server certificate file permissions are set to read-only or more restrictive
docker Docker socket is not allowed to mount inside any containers
docker Host's IPC namespace is isolated from containers
docker Host's network namespace is not shared with containers
docker Host's process namespace is isolated from containers
docker Host's user namespaces are not shared with containers
docker Host's UTS namespace is not shared
docker Linux kernel capabilities are restricted to only those which are required
docker Network traffic is restricted between containers on the default network bridge
docker Only the owner of the server certificate key file can read its contents
docker Only the root account and Docker group members can control the Docker daemon
docker Only the root account and Docker group members can read and write to the Docker socket file
docker Only the root account and Docker group members have ownership of the Docker socket file
docker Only the root account and group have ownership of the daemon.json file
docker Only the root account and group have ownership of the Docker server certificate file
docker Only the root account and group have ownership of the Docker server certificate key file
docker Only the root account and group have ownership of the docker.service file
docker Only the root account and group have ownership of the TLS CA certificate file
docker Only the root account and group have ownership over the docker.socket file
docker Only the root account and group have ownership over the registry certificate file
docker Only the root account has write permissions to the daemon.json file
docker Only the root account has write permissions to the docker.service file
docker Only the root account has write permissions to the docker.socket file
docker Private registry uses TLS encryption
docker Privileged containers are not used
docker Privileged ports are not mapped within containers
docker Registry certificate file permissions are set to read-only or more restrictive
docker Restart attempts on container failure is limited to 5 attempts
docker Seccomp profiles are enabled for filtering incoming system calls
docker SELinux security options are configured
docker Sensitive host system directories are not mounted on containers
docker TLS authentication is configured for Docker daemon
docker TLS CA certificate file permissions are set to read-only or more restrictive
google_cloud_asset_inventory
Google Cloud Asset Inventory
>
google_sql_database_instance
Google SQL Database Instance
>
google_sql_database_instance '3625 (trace flag)' database flag is set to 'off' for SQL Server Instance
google_sql_database_instance 'cloudsql.enable_pgaudit' database flag is set to 'on' for centralized logging on Postgresql Instance
google_sql_database_instance 'contained database authentication' database flag is set to 'off' for SQL Server Instance
google_sql_database_instance 'cross db ownership chaining' database flag is set to 'off' for SQL Server Instance
google_sql_database_instance 'external scripts enabled' database flag is set to 'off' for SQL Server Instance
google_sql_database_instance 'local_infile' database flag is set to 'off' for MySQL Instance
google_sql_database_instance 'log_connections' database flag is set to 'on' for PostgreSQL Instance
google_sql_database_instance 'log_disconnections' database flag is set to 'on' for PostgreSQL Instance
google_sql_database_instance 'log_error_verbosity' database flag is set to 'DEFAULT or Stricter' for PostgreSQL Instance
google_sql_database_instance 'log_hostname' database flag is set to 'on' for PostgreSQL Instance
google_sql_database_instance 'log_min_duration_statement' database flag is set to '-1' (disabled) for PostgreSQL Instance
google_sql_database_instance 'log_min_error_statement' database flag is set to 'ERROR' or stricter for PostgreSQL Instance
google_sql_database_instance 'log_min_messages' database flag is set to at least 'WARNING' for PostgreSQL Instance
google_sql_database_instance 'log_statement' database flag is set appropriately for PostgreSQL Instance
google_sql_database_instance 'remote access' database flag is set to 'off' for SQL Server Instance
google_sql_database_instance 'skip_show_database' flag is set to 'on' for MySQL Instance
google_sql_database_instance 'user connections' database flag is set to a non-limiting value for SQL Server Instance
google_sql_database_instance 'user options' database flag is not configured for SQL Server Instance
google_sql_database_instance Automated backups are configured for SQL Database Instances
google_sql_database_instance SQL database instance uses SSL for all incoming connections
google_sql_database_instance SQL Database Instances do not implicitly accept all public IP addresses
kubernetes
Kubernetes
>
kubernetes A Kubernetes user attempted to perform a high number of actions that were denied
kubernetes A Kubernetes user was assigned cluster administrator permissions
kubernetes A minimal audit policy exists
kubernetes A new Kubernetes admission controller was created
kubernetes Admission controller AlwaysAdmin is not enabled
kubernetes Admission controller NamespaceLifecycle is enabled
kubernetes Admission controller NodeRestriction is enabled
kubernetes Admission controller PodSecurityPolicy is enabled
kubernetes Admission controller ServiceAccount is enabled
kubernetes All namespaces have network policies defined
kubernetes Allow Kubelets to manage changes to the iptables
kubernetes Anonymous Request Authorized
kubernetes API server anonymous-auth argument is set to false
kubernetes API server audit log files are retained for at least 10 log file rotations
kubernetes API server audit log files are rotated once the file reaches 100 MB or more
kubernetes API server audit logs are enabled
kubernetes API server audit logs are retained for at least 30 days
kubernetes API server does not bind the API service to an insecure port
kubernetes API server does not bind to an insecure API service address
kubernetes API server does not use token based authentication
kubernetes API server only allows explicitly authorized requests
kubernetes API server pod specification file cannot be altered by non-owners
kubernetes API server profiling is disabled
kubernetes API server request timeout exceeds 60 seconds only if required
kubernetes API Server requires HTTPS connections
kubernetes API server secure port is enabled
kubernetes API server uses a service account public key file for service accounts
kubernetes API server uses TLS certificate client authentication
kubernetes API server validates the service account token exists in etcd
kubernetes API server verifies the kubelet's certificate before establishing connection
kubernetes Basic authentication is disabled for the API server
kubernetes Certificate authorities file cannot be altered by non-owners
kubernetes Certificate-based kubelet authentication is required
kubernetes Client authentication is enabled for etcd
kubernetes Client certificate authorities file is owned by root
kubernetes Controller Manager API service is bound to localhost
kubernetes Controller manager has a service account private key file set
kubernetes Controller manager pod specification file cannot be altered by non-owners
kubernetes Controller manager pod specification file is owned by root
kubernetes Controller Manager profiling is disabled
kubernetes controller-manager.conf file cannot be altered by non-owners
kubernetes Default Kubelet kernel parameter values are protected
kubernetes Default service accounts are not used
kubernetes Each controller uses individual service account credentials
kubernetes Enable kubelet server certificate rotation on controller-manager
kubernetes Etcd data directory is owned by the etcd user and group
kubernetes Etcd data directory permissions cannot be accessed by non-owners
kubernetes etcd does not allow the use of self-signed client certificates
kubernetes etcd is configured for peer authentication
kubernetes etcd is configured with TLS encryption
kubernetes etcd is encrypted at rest
kubernetes Etcd pod specification file cannot be altered by non-owners
kubernetes Etcd pod specification file is owned by root
kubernetes etcd server requires API servers present a client certificate and key when connecting
kubernetes etcd server requires API servers present an SSL CA file when connecting
kubernetes etcd uses TLS encryption for peer connections
kubernetes Kube-proxy configuration file cannot be altered by non-owners
kubernetes Kube-proxy configuration file ownership is assigned to root
kubernetes Kubelet client certificate rotation is enabled
kubernetes Kubelet configuration file is owned by root
kubernetes Kubelet connections use HTTPS
kubernetes Kubelet nodes are only authorized to read objects they are associated with
kubernetes Kubelet only allows explicitly authorized requests
kubernetes Kubelet read-only port is disabled
kubernetes Kubelet requires HTTPS connections
kubernetes Kubelet server certificate rotation is enabled
kubernetes Kubelet service file is owned by root
kubernetes Kubelet uses TLS certificate client authentication
kubernetes Kubernetes PKI certificate file cannot be altered by non-owners
kubernetes Kubernetes PKI directory is owned by root
kubernetes Kubernetes Pod Created in Kube Namespace
kubernetes Kubernetes Pod Created with hostNetwork
kubernetes Kubernetes principal attempted to enumerate their permissions
kubernetes Kubernetes Service Account Created in Kube Namespace
kubernetes Kubernetes Service Created with NodePort
kubernetes Limit admission of containers sharing the host IPC namespace
kubernetes Limit admission of containers sharing the host PID namespace
kubernetes Limit admission of containers that do not block privilege escalation
kubernetes Minimize the admission of containers wishing to share the host network namespace
kubernetes New Kubernetes Namespace Created
kubernetes New Kubernetes privileged pod created
kubernetes Only the root account and group have ownership of the admin.conf file
kubernetes Only the root account and group have ownership of the API server pod specification file
kubernetes Only the root account has write permissions to the admin.conf file
kubernetes Pods utilize `root-ca-file` to pass serving certificates to the API server
kubernetes Prevent use of self-signed certificates for TLS connections between etcd peers
kubernetes RBAC is enabled for the API server
kubernetes Resources are not created in the default namespace
kubernetes Scheduler API service is bound to localhost
kubernetes Scheduler configuration file cannot be altered by non-owners
kubernetes Scheduler configuration file ownership is assigned to root
kubernetes Scheduler pod specification file cannot be altered by non-owners
kubernetes Scheduler pod specification file ownership is assigned to root
kubernetes Scheduler profiling is disabled
kubernetes The controller-manager.conf file is owned by root
kubernetes The kubelet configuration file cannot be altered by non-owners
kubernetes The kubelet service file cannot be altered by non-owners
kubernetes The kubelet.conf file cannot be altered by non-owners
kubernetes The kubelet.conf file is owned by root
kubernetes Timeouts on streaming connections are enabled
kubernetes User Attached to a Pod
kubernetes User Exec into a Pod