このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Application Security capabilities

The following application security capabilities are supported in the Java library, for the specified tracer version:

Application Security capabilityMinimum Java tracer version
Threat Detection1.8.0
API Security1.31.0
Threat Protection1.9.0
Customize response to blocked requests1.11.0
Software Composition Analysis (SCA)1.1.4
Code Security1.15.0
Automatic user activity event tracking1.20.0

The minimum tracer version to get all supported application security capabilities for Java is 1.31.0.

Note: Threat Protection requires enabling Remote Configuration, which is included in the listed minimum tracer version.

Supported deployment types

TypeThreat Detection supportSoftware Composition Analysis
Docker
Kubernetes
Amazon ECS
AWS Fargate
AWS Lambda
Azure App Service

Note: Azure App Service is supported for web applications only. Application Security doesn’t support Azure Functions.

Language and framework compatibility

Supported Java versions

The Java Tracer supports automatic instrumentation for the following Oracle JDK and OpenJDK JVM runtimes.

JVM versionsOperating SystemsSupport levelTracer version
8 to 17Windows (x86-64)
Linux (glibc, musl) (arm64, x86-64)
MacOS (arm64, x86-64)
SupportedLatest

Datadog does not officially support any early-access versions of Java.

Web framework compatibility

  • Attacker source HTTP request details
  • Tags for the HTTP request (status code, method, etc)
  • Distributed Tracing to see attack flows through your applications
Application Security Capability Notes
  • Software Composition Analysis is supported on all frameworks
  • If Code Security does not support your framework, it will still detect Weak Cipher, Weak Hashing, Insecure Cookie, Cookie without HttpOnly Flag, and Cookie without SameSite Flag vulnerabilities.
FrameworkVersionsThreat Detection supported?Threat Protection supported?Code Security?
Grizzly2.0+
Glassfish
Java Servlet2.3+, 3.0+
Jetty7.0-9.x, 10.x
Spring Boot1.5
Spring Web (MVC)4.0+
Spring WebFlux5.0+
Tomcat5.5+
Vert.x3.4-3.9.x

Note: Many application servers are Servlet compatible and are automatically covered by that instrumentation, such as Websphere, Weblogic, and JBoss. Also, frameworks like Spring Boot (version 3) inherently work because they usually use a supported embedded application server, such as Tomcat, Jetty, or Netty.

If you don't see your framework of choice listed, let us know! Fill out this short form to send details.

Networking framework compatibility

dd-java-agent includes support for automatically tracing the following networking frameworks.

Networking tracing provides:

  • Distributed tracing through your applications
  • Request-based blocking
Application Security Capability Notes
  • Software Composition Analysis is supported on all frameworks
  • If Code Security does not support your framework, it will still detect Weak Cipher, Weak Hashing, Insecure Cookie, Cookie without HttpOnly Flag, and Cookie without SameSite Flag vulnerabilities.
FrameworkVersionsThreat Detection supported?Threat Protection supported?Code Security?
Apache HTTP Client4.0+
gRPC1.5+
HttpURLConnectionall
Jax RS Clients2.0+
Jersey Server1.9-2.29
Netty HTTP Server3.8+
RESTEasy3.0.x
Spring SessionAwareMessageListener3.1+
If you don't see your framework of choice listed, let us know! Fill out this short form to send details.

Data store compatibility

dd-java-agent includes support for automatically tracing the following database frameworks/drivers.

Datastore tracing provides:

  • Timing request to response
  • Query info (for example, a sanitized query string)
  • Error and stacktrace capturing
Application Security Capability Notes
  • Software Composition Analysis is supported on all frameworks
  • Threat Protection also works at the HTTP request (input) layer, and so works for all databases by default, even those not listed in the table below.
  • If your framework is not supported below, Code Security won’t detect SQL Injection vulnerabilities, but will still detect the rest of vulnerability types listed here.
DatabaseVersionsThreat Detection supported?Code Security?
Aerospike4.0+
Couchbase2.0+
JDBCN/A
MongoDB3.0-4.0+

dd-java-agent is also compatible with common JDBC drivers for Threat Detection, such as:

  • Apache Derby
  • Firebird SQL
  • H2 Database Engine
  • HSQLDB
  • IBM DB2
  • MariaDB
  • MSSQL (Microsoft SQL Server)
  • MySQL
  • Oracle
  • Postgres SQL
  • ScalikeJDBC
If you don't see your framework of choice listed, let us know! Fill out this short form to send details.

User Authentication Frameworks compatibility

Integrations to User Authentication Frameworks provide:

  • User login events, including the user IDs
  • Account Takeover detection monitoring for user login events
FrameworkMinimum Framework Version
Spring Security5.5+