Brainstorming a Datadog reporter

[tarkatronic]

I would love to be able to report out the state of vulnerabilities to Datadog so that all kinds of charts/trends can be built from the data. What I'm not sure about is exactly what format the information needs to be for sending to Datadog. I would love to hear some thoughts from other more familiar with that platform, and what will help facilitate those reports.

Some of the reports I would love to see come from this:

• Trend of open vs closed vulnerability counts for the entire org, over time.
• Number of vulnerabilities outside SLA for the entire org
• The above reports broken down by team
• The above reports broken down by repository

I guess the other aspect of this is, how can we provide templates for these Datadog reports, to make it easier for other users to set them up?

[tarkatronic]

I suppose another aspect of this is, what other reports might be useful?

[developerDemetri]

What I'm not sure about is exactly what format the information needs to be for sending to Datadog.

For other use cases, we have typically used DataDog StatsD COUNT metrics that we can call increment() on as events happen.
These increment() calls have tags passed in, and auto-attach tags from the application like service name, environment, container information, etc., enabling time series graphs by different tags.

Datadog StatsD also provides other metric types specifically for histograms and distribution percentiles:
https://docs.datadoghq.com/metrics/types

The number of Open, Closed, and Over SLA vulns sound like they could each be a COUNT metric with tags for repo, team, and org. I haven't used GAUGE metrics much, but that might fit these as well

The GAUGE metric submission type represents a snapshot of events in one time interval. This representative snapshot value is the last value submitted to the Agent during a time interval. A GAUGE can be used to take a measure of something reporting continuously

[tarkatronic]

I'm not sure StatsD applies here, since this isn't a long-running process. This would be more like, run once or twice per day and export the point-in-time results to Datadog.

[developerDemetri]

I guess the other aspect of this is, how can we provide templates for these Datadog reports, to make it easier for other users to set them up?

We can create an example dashboard and export its JSON, then anyone can import that JSON.
eg. Auth0 provides a Auth0SecDashboard.json file: https://auth0.com/docs/customize/log-streams/datadog-dashboard-templates

[tarkatronic]

That's awesome, I love it!