Detection as Code 101: How It's Done at Datadog

Sun, 18 Oct 2026 00:00:00 +0000

It’s Friday afternoon. Someone tunes a noisy rule directly in the SIEM console, saves it, and logs off. Monday morning the queue is either flooded with alerts or eerily quiet, and nobody can say what changed, who changed it, or how to put it back.

That’s the problem in one scene: click-ops detection doesn’t scale. Detection as code is how mature teams fix it. This post breaks down one of the clearest public examples, Datadog’s Threat Detection team, as described by Christine Le and Christopher Camacho in How we use Datadog for detection as code (Datadog, October 11, 2024). The tooling is Datadog’s. The ideas carry over to any SIEM, and I’ll show how after each section.

MITRE ATT&CK on CybersecurityOS

Detection as Code 101: How It's Done at Datadog