Datadog > Case Studies > Detecting Malicious Activity in Real Time

Detecting Malicious Activity in Real Time

Customer Company Size

Large Corporate

Region

America

Country

Argentina

Product

Datadog Security Monitoring

Tech Stack

Datadog

Implementation Scale

Enterprise-wide Deployment

Impact Metrics

Cost Savings
Customer Satisfaction

Technology Category

Analytics & Modeling - Real Time Analytics

Applicable Industries

Food & Beverage

Applicable Functions

Sales & Marketing

Use Cases

Fraud Detection

Services

Cybersecurity Services

About The Customer

Founded in 2009, PedidosYa is a member of the Delivery Hero group and the market leader for online food ordering in Latin America. With an innovative web and mobile app, PedidosYa gives users access to 12,000 restaurants across six countries in the region. The company faced a challenge when it introduced free food vouchers for new users. Users were creating several accounts from different IP addresses to receive multiple vouchers, which was difficult to pinpoint and prevent at scale.

The Challenge

PedidosYa, a member of the Delivery Hero group, faced a challenge when the company introduced free food vouchers for new users. Users were creating several accounts from different IP addresses to receive multiple vouchers, but this behavior was difficult to pinpoint and prevent at scale. The team’s threat detection workflow at the time involved manually creating firewall detection rules for every domain they operate, which was grueling, time-consuming, and required lots of maintenance. As fraudulent activity increased, it became impossible to create individual rules for every IP address that needed to be blocked. This process led to a month-long delay in detection, which gave the malicious actors enough time to achieve their goal.

The Solution

PedidosYa selected Datadog because it offers customizable, out-of-the-box threat detection rules that facilitate comprehensive security analysis of malicious patterns across the entire tech stack. These flexible detection rules identify a wide range of attacker techniques in real time and are mapped to the MITRE ATT&CK framework. Datadog’s extensive tagging system allows users to group security signals in logical ways, such as by service, region, or IP address. This ability to group and visualize security data streamlines the threat detection process for complex systems, such as the one at PedidosYa. Datadog Security Monitoring also comes equipped with expert-built, out-of-the-box dashboards that provide overviews of all security-related data.

Operational Impact

Datadog played an important role in securing PedidosYa by detecting outliers and malicious patterns in real time.
The security team was able to create customized rules in our simple rules editor—without using a query language.
These rules require minimal setup and maintenance, and they also apply to all of PedidosYa’s domains automatically, which has dramatically accelerated their workflow.
Datadog’s tagging system has also enabled the PedidosYa team to filter and group security signals by specific attributes, such as a URL path.

Quantitative Benefit

37,000 unique fraudulent users detected using Datadog Security Monitoring.
Reduced Mean Time To Detection (MTTD).
1 Month Time taken to build effective threat detection rules to automatically catch malicious activity across their application.