Workload Protection collects runtime activity through the Datadog Agent. Setting it up means enabling the product in Datadog, then deploying the Agent to the workloads you want to protect.

After the Agent is running, you can try Workload Protection safely using the playground scripts. Enforcement, which lets the Agent act on the threats it detects, requires separate access.

For what happens to the activity the Agent collects, see How Workload Protection works.

Requirements

Workload Protection relies on the Datadog Agent to monitor your workloads and collect security relevant events for threats detection and security posture monitoring.

Agent options

Workload Protection offers 3 different flavors depending on your environment and operating system:

• On Linux, install the eBPF agent. It offers the best performance and feature support.
• On AWS Fargate, install the Datadog Agent as a sidecar and instrument workloads with the the cws-instrumentation tracer. Fargate does not provide eBPF access, so this tracer uses ptrace instead.
• On Windows, the Workload Protection agent installs a Windows driver to collect events and telemetry.

Linux support

On Linux, you need to look at the Linux kernel version and distribution version, as well as the underlying cloud environment (when applicable) since some Cloud computing services prevent access to eBPF.

Supported Linux distributions

Notes:

• Custom kernel builds might modify critical hook points that the Agent requires to properly function. Support isn’t guaranteed.
• Workload Protection requires Linux kernel version 4.14.0 or higher.
• On distributions with an older kernel version, Workload Protection can run if the required eBPF features have been backported. However, it will operate in a degraded mode, as some features may require a more recent kernel version. For example, CentOS/RHEL 7 uses kernel 3.10 with backported eBPF features and is supported, but some features, such as network monitoring, are disabled.
• For compatibility issues with a custom Kubernetes network plugin like Cilium or Calico, see Troubleshooting Workload Protection.

Supported cloud environments

Notes:

• The underlying Linux distribution and system configuration used by these cloud environments are the primary factors determining whether Workload Protection is supported.
• For cloud environments where you can choose the Linux distribution and kernel version, select a configuration that meets the requirements listed above.

Windows support

Workload Protection’s Windows agent supports Windows Server 2019 and higher.

Enable Workload Protection in Datadog

To get started with Workload Protection, you need to enable the Workload Protection product in Datadog. To do so, log in to your Datadog account, and click Get Started. You can follow the Agent deployment steps in Datadog, or come back to this page for more details.

Deploy the Datadog Agent

Linux

Use the following instructions to enable the eBPF agent of Workload Protection in the Datadog Agent.

AWS Fargate

Use the following instructions to setup the cws-instrumentation tracer of Workload Protection on AWS Fargate.

Windows

Use the following instructions to enable the Windows agent of Workload Protection in the Datadog Agent.

Next steps

After setup, you can explore Workload Protection, configure the Agent for your environment, or request access to Automated response.

Explore Workload Protection

Datadog provides a testing playground for discovering Workload Protection and learning its capabilities. The playground offers various scenarios you can run safely in a test environment, simulating threats and real world attacks that Workload Protection can detect and protect you from. See the playground repository to get started.

Configure the Agent

The advanced Agent configuration page describes how to configure and tune the Agent to better fit your environment and needs.

Enable automated response

After you are granted access to Automated response, see the Automated response page.