You can use Datadog Software Composition Analysis (SCA) to monitor the open source libraries in your apps.

SCA is configured by setting the -Ddd.appsec.sca.enabled flag or the DD_APPSEC_SCA_ENABLED environment variable to true in supported languages:

• Java
• .NET
• Go
• Ruby
• PHP
• Node.js
• Python

This topic explains how to set up SCA using a Java example.

Example: enabling Software Composition Analysis in Java

1. Update your Datadog Java library to at least version 0.94.0 (at least version 1.1.4 for Software Composition Analysis detection features):

   wget -O dd-java-agent.jar 'https://dtdg.co/latest-java-tracer'
   

   curl -Lo dd-java-agent.jar 'https://dtdg.co/latest-java-tracer'
   

   ADD 'https://dtdg.co/latest-java-tracer' dd-java-agent.jar
   

   To check that your service’s language and framework versions are supported for ASM capabilities, see Compatibility.

2. Run your Java application with SCA enabled. From the command line:

   java -javaagent:/path/to/dd-java-agent.jar -Ddd.appsec.sca.enabled=true -Ddd.service=<MY SERVICE> -Ddd.env=<MY_ENV> -jar path/to/app.jar
   

   Or one of the following methods, depending on where your application runs:

   Note: Read-only file systems are not supported at this time. The application must have access to a writable /tmp directory.

   Update your configuration container for APM by adding the following argument in your docker run command:

   docker run [...] -e DD_APPSEC_SCA_ENABLED=true [...]
   

   Add the following environment variable value to your container Dockerfile:

   ENV DD_APPSEC_SCA_ENABLED=true
   

   Update your deployment configuration file for APM and add the SCA environment variable:

   spec:
     template:
       spec:
         containers:
           - name: <CONTAINER_NAME>
             image: <CONTAINER_IMAGE>/<TAG>
             env:
               - name: DD_APPSEC_SCA_ENABLED
                 value: "true"
   

   Update your ECS task definition JSON file, by adding this in the environment section:

   "environment": [
     ...,
     {
       "name": "DD_APPSEC_SCA_ENABLED",
       "value": "true"
     }
   ]
   

   Set the -Ddd.appsec.sca.enabled flag or the DD_APPSEC_SCA_ENABLED environment variable to true in your service invocation:

   java -javaagent:dd-java-agent.jar \
        -Ddd.appsec.sca.enabled=true \
        -jar <YOUR_SERVICE>.jar \
        <YOUR_SERVICE_FLAGS>