Refactor datadog/duosec expressions

Signed-off-by: Austin Seipp <aseipp@pobox.com>
Add tarsnap module

Signed-off-by: Austin Seipp <aseipp@pobox.com>