proomt

Search

Search posts, papers, and topics

All posts

DatadogChakib Hamie5 min readintermediate

Enforce custom rules in Datadog IaC Security scanning

Read on datadoghq.com

Summary

Datadog now lets you write organization‑specific IaC security checks as Rego policies that run alongside its built‑in rule set. You can author, test, version, and publish custom rules via the UI (or AI‑assisted generation), then see violations in PR comments, IDE extensions, or automation pipelines.

  • Custom rules are written in OPA’s Rego language and support Terraform, CloudFormation, Ansible, Dockerfile, Kubernetes, and GitHub Actions.
  • The UI provides a starter policy, sample IaC file, and an AI‑driven “natural language → Rego” helper; you can also clone existing rules.
  • Policies can be evaluated against sample files before publishing, and each edit creates a version with diff/restore capabilities.
  • Findings appear in the same workflows as default IaC checks – PR comments, VS Code extension, PR Gates, and Security Automation Pipelines.

Large orgs often have internal IaC standards (tags, approved instance types, naming) that generic scanners don’t cover. Embedding those checks as Rego policies lets security teams enforce compliance early, reduces manual review, and keeps policy changes auditable.

5/10
devopssecurityiacopaterraform

Related reading

  1. How energy teams turn theft detection into governed action with Genie and AI business processes

    Databricks shows how to turn energy‑theft ML scores into a governed, end‑to‑end workflow using a Databricks App, Lakebase for live case state, Unity Catalog for data governance, and Genie One for natural‑language executive reporting. The pattern lets utilities act on alerts faster while staying compliant, and can be reused for other fraud‑type use cases.

    Databricksdatabricks.com6 min

  2. Transform and route security logs to Microsoft Sentinel tables using Observability Pipelines

    Datadog Observability Pipelines now ships pre‑built Microsoft Sentinel Packs that map logs from Palo Alto, Fortinet, Cisco ASA, Cisco Meraki, and ExtraHop into Sentinel’s CommonSecurityLog or Syslog tables. Packs handle field extraction, severity derivation, and device‑action mapping, letting you filter or drop low‑value events before ingest, validate mappings with Live Capture, and reduce per‑GB…

    Datadogdatadoghq.com5 min

  4. Manage Cursor costs with Datadog Cloud Cost Management

    Datadog Cloud Cost Management now integrates Cursor AI‑coding usage, exposing per‑user, per‑model, and mode breakdowns, out‑of‑the‑box dashboards, anomaly detection, and budget/monitoring tools so FinOps can track and control AI coding spend alongside other cloud and SaaS costs.

    Datadogdatadoghq.com5 min

  5. How to Review AI-Generated Python Code Efficiently

    A practical five‑step workflow for reviewing AI‑generated Python code, covering intent clarification, automated quality checks (linters, type checkers, security scanners, tests), risk‑first manual reading, a checklist of common AI mistakes, and fix‑verify loops, plus a ready‑to‑use dev‑environment setup.

    Real Pythonrealpython.com26 min