{"id":20471834,"url":"https://github.com/signiant/datadog-deepsecurity-event-forwarder","last_synced_at":"2026-06-04T12:31:07.968Z","repository":{"id":93380060,"uuid":"133945564","full_name":"Signiant/datadog-deepsecurity-event-forwarder","owner":"Signiant","description":"AWS lambda function which formats and forwards events from Trend Micro Deep Security to Datadog","archived":false,"fork":false,"pushed_at":"2020-03-03T18:38:37.000Z","size":113,"stargazers_count":4,"open_issues_count":0,"forks_count":0,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-03-05T13:49:08.845Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Signiant.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-05-18T11:28:16.000Z","updated_at":"2023-03-14T12:58:14.000Z","dependencies_parsed_at":null,"dependency_job_id":"af476586-dda4-4a7f-b75d-b455e590bde6","html_url":"https://github.com/Signiant/datadog-deepsecurity-event-forwarder","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Signiant/datadog-deepsecurity-event-forwarder","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Signiant%2Fdatadog-deepsecurity-event-forwarder","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Signiant%2Fdatadog-deepsecurity-event-forwarder/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Signiant%2Fdatadog-deepsecurity-event-forwarder/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Signiant%2Fdatadog-deepsecurity-event-forwarder/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Signiant","download_url":"https://codeload.github.com/Signiant/datadog-deepsecurity-event-forwarder/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Signiant%2Fdatadog-deepsecurity-event-forwarder/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33905358,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-04T02:00:06.755Z","response_time":64,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-15T14:17:21.644Z","updated_at":"2026-06-04T12:31:07.918Z","avatar_url":"https://github.com/Signiant.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# datadog-deepsecurity-event-forwarder\nAWS lambda function which formats and forwards events from Trend Micro Deep Security to Datadog.\n\n## Sample Events\n\nDatadog does not support custom named event sources alas so for this solution, we have tagged the Deep Security events as Immunio (a Trend Micro owned solution that has a Datadog integration).  You can then search for all immunio events in the event stream to place on dashboards, filter, alert, etc. within Datadog\n\n![Sample Events](https://github.com/Signiant/datadog-deepsecurity-event-forwarder/blob/master/images/sample-dd-events.jpg?raw=true)\n\n---\n\n## Solution Overview\n\nThe solution is a small Lambda function which captures Deep Security events sent to an SNS topic.  Events are then formatted and sent to Datadog using their Python API\n\n![Solution Overview](https://github.com/Signiant/datadog-deepsecurity-event-forwarder/blob/master/images/deep-security-events-to-datadog.png?raw=true)\n\n---\n\n# Parameter Store Configuration\nBefore you can deploy the cloudformation solution, you must add your datadog API key and app key into AWS parameter store in the same region as you are creating the stack in.  These can have any name but must be a string (cloudformation does not support secure string yet).  You will be passing in the names of the parameters when deploying the solution\n\n# Deploying the Cloudformation stack\nDeployment consists of deploying a cloudformation template in AWS and configuring Trend Micro Deep Security to send events to an SNS topic (which is created by the Cloudformation template)\n\nThe Lambda function and other resources are packaged using [AWS SAM](https://github.com/awslabs/serverless-application-model).  Deployment is via 2 simple SAM commands.  You can run the `build.sh` script using the following parameters or the actual SAM commands are below\n\n## Using build.sh\n\nSee note below on environment variable values\n\n```\n./build.sh \u003cs3 bucket for function\u003e \u003caws cli profile\u003e \u003cDatadog Parameter store location for API key\u003e \u003cDatadog Parameter store location for app key\u003e tagname1=tagvalue1,tagname2=tagvalue2,tagname3=tagvalue3 \u003caws region\u003e\n```\n\n## Using AWS SAM directly\n\nThis will upload the lambda function to S3 and modify the `template.yaml` file to point to the uploaded function, producing a `packaged-template.yaml` file\n```\n\ncd lambda-src\npip install -r requirements.txt -t .\ncd ..\n\naws cloudformation package \\\n    --template-file template.yaml \\\n    --s3-bucket \u003ca bucket to store lambda function code in\u003e \\\n    --output-template-file packaged-template.yaml \\\n    --profile \u003cyour AWS CLI profile\u003e\n```\n\nThis will create or update a cloudformation stack (see note below on environment variable values)\n```\naws cloudformation deploy \\\n    --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM \\\n    --template-file packaged-template.yaml \\\n    --stack-name trend-deep-security-events-to-datadog \\\n    --parameter-overrides EventFilter=all DatadogAPIKey=\u003cyour parameter store name\u003e DatadogAppKey=\u003cyour parameter store name\u003e DatadogTags=tagname1=tagvalue1,tagname2=tagvalue2,tagname3=tagvalue3 \\\n    --profile \u003cyour AWS CLI profile\u003e \\\n    --region \u003cregion to create the stack in\u003e\n```\n# Environment Variables / Parameters\n\nThe function takes a few parameters to customize alert thresholds and add Datadog tags:\n\n* EventFilter - the keyword *all* to send all events or a commma seperated list of alert severities.  Only events matching one of the severities will be sent to Datadog\n* RankGreater - Any events greater than this rank will be sent to Datadog.  Default is 0 (ie. send all ranked events)\n* DatadogAPIKey - Name of a parameter in AWS Parameter Store containing a valid Datadog API key\n* DatadogAppKey - Name of a parameter in AWS Parameter Store containing a valid Datadog app key\n* DatadogTags - comma-seperated list of tag names and values to apply to events sent to Datadog.  ie. env=prod,service=myservice,foo=bar\n\n# Deep Security Configuration\nThe cloudformation template will create the required SNS topic and a user for which you will need to generate an access key/secret key for (please Trend Micro, role support would be great here!).  Find the SNS topic ARN and generate a key for the user and then in the Deep Security interface under Administration -\u003e Event Forwarding, configure the Amazon SNS section with the keys and SNS topic ARN.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsigniant%2Fdatadog-deepsecurity-event-forwarder","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsigniant%2Fdatadog-deepsecurity-event-forwarder","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsigniant%2Fdatadog-deepsecurity-event-forwarder/lists"}