Creating data-driven detections with DataDog and JupyterHub

This article explains Expel's approach to reducing noisy brute-force and password-spraying alerts by instrumenting threshold-based detections with DataDog metrics, using Jupyter Notebooks to visualize and simulate threshold changes, automating review recommendations, and correlating additional signals (e.g., successful logins, account lockouts, GreyNoise enrichment) and seasonal anomaly detection to improve true positive rates and SOC analyst effectiveness.