Integrations · Infra Monitoring Providers

Datadog

ProofTrail connects to Datadog through its API, as infrastructure monitoring, incident management, access review. Each sync feeds the checks below, and a failing check opens a task for its owner.

Try the demo Every integration

Cloud Monitoring Data

Track cloud resources and their configuration: encryption, backups, network exposure, logging and identities. Synced every 12 hours.

Infra provider should be configured
Infrastructure resource should have an owner
Database should be encrypted at rest
Storage should be encrypted at rest
Database backups should be enabled
Storage versioning should be enabled
Resource should be protected from direct internet traffic
Network access rules should deny by default
TLS should be enforced for connections
Production endpoints should be served over HTTPS
Audit logs should be enabled
Resource health should be monitored
Cloud console users should have MFA enabled
Cloud root account should be protected with MFA and unused
Cloud credentials unused for 90 days should be disabled
Threat detection should be enabled
Compute disks should be encrypted
Administrative ports should not be open to the internet
Network flow logs should be enabled
Production databases should have deletion protection
Production databases should be highly available
Database backups should be kept for at least 7 days
Encryption keys should be rotated automatically
Secret vaults should be protected against deletion
Cloud console password policy should be strong
Cloud root account should not be used for daily work
Cloud access keys should be rotated every 90 days
Container images should be scanned on push
Container registry admin user should be disabled
Audit log file integrity validation should be enabled
Storage access logging should be enabled
Instance metadata service should require session tokens
Load balancers should only negotiate TLS 1.2 or later
Monitoring alerts should notify an on-call channel
Infra entity should be classified
Disks and analytics workspaces should be backed up
Database infrastructure double encryption should be enabled

Incidents Data

Import and track security incidents to keep visibility on threats to the organization. Synced every 12 hours.

Incident management process should be configured
Reported incident should be closed

Access Control Data

Sync user accounts to ensure access is granted only to authorized personnel. Synced every 24 hours.

Rules for who can access critical systems should be configured
User access to critical system should be valid
User should be identified
User should have MFA enabled
MFA should be enforced on critical system
Periodic review of access to critical systems should be completed
Access should be removed for offboarded user
User should be identified (for access systems outside the audit scope)
User access to critical system should be valid (for access systems outside the audit scope)
User should have MFA enabled (for access systems outside the audit scope)
MFA should be enforced on critical system (for access systems outside the audit scope)
Access should be removed for offboarded user (for access systems outside the audit scope)