Overview

Agentless Scanning provides visibility into vulnerabilities that exist within your AWS hosts, running containers, Lambda functions, and Amazon Machine Images (AMIs) without requiring you to install the Datadog Agent. Datadog recommends enabling Agentless Scanning as a first step to gain complete visibility into your cloud resources, and then installing the Datadog Agent on your core assets over time for deeper security and observability context.

Availability

The following table provides a summary of Agentless scanning technologies in relation to their corresponding components:

How it works

After setting up Agentless scanning for your resources, Datadog schedules automated scans in 12-hour intervals through Remote Configuration. During a scan cycle, Agentless scanners gather Lambda code dependencies and create snapshots of your EC2 instances. With these snapshots, the Agentless scanners scan, generate, and transmit a list of packages to Datadog to check for vulnerabilities, along with Lambda code dependencies. When scans of a snapshot are completed, the snapshot is deleted. No confidential or private personal information is ever transmitted outside of your infrastructure.

The following diagram illustrates how Agentless Scanning works:

1. Datadog schedules a scan and sends which resources to scan through Remote Configuration.

   Note: Scheduled scans ignore hosts that already have the Datadog Agent installed with Cloud Security Management enabled. Datadog schedules a continuous re-scanning of resources every 12 hours to provide up-to-date insights into potential vulnerabilities and weaknesses.

2. For Lambda functions, the scanners fetch the function’s code.

3. The scanner creates snapshots of EBS volumes used by EC2 instances. These snapshots serve as the basis for conducting scans. Using the snapshots, or the code, the scanner generates a list of packages.

4. After the scan is complete, only the list of packages is transmitted to Datadog, while all other data remains within your infrastructure. Snapshots created during the scan cycle are deleted.

5. Leveraging the collected package list along with Datadog’s access to the Trivy vulnerabilities database, Datadog finds matching affected vulnerabilities in your resources and code.

Notes:

• The scanner operates as a separate EC2 instance within your infrastructure, ensuring minimal impact on existing systems and resources.
• The scanner securely collects a list of packages from your hosts without transmitting any confidential or private personal information outside your infrastructure.
• The scanner limits its use of the AWS API to prevent reaching the AWS rate limit, and uses exponential backoff if needed.

What data is sent to Datadog

The Agentless scanner uses the OWASP cycloneDX format to transmit a list of packages to Datadog. No confidential or private information is ever transmitted outside of your infrastructure.

Datadog does not send:

• System and package configurations
• Encryption keys and certificates
• Logs and Audit Trails
• Sensitive business data

Security considerations

Because the scanner instances grant permissions to create and copy EBS snapshots, and describe volumes, Datadog advises restricting access to these instances solely to administrative users.

To further mitigate this risk, Datadog implements the following security measures:

• The Datadog scanner operates within your infrastructure, ensuring that all data, including snapshots and list of packages, remain isolated and secure.
• All data transmission between the scanner and Datadog is encrypted using industry standard protocols (such as HTTPS) to ensure data confidentiality and integrity.
• The Datadog scanner operates under the principle of least privilege. This means that it is granted only the minimum permissions necessary to perform its intended functions effectively.
• Datadog carefully reviews and limits the permissions granted to the scanner to ensure that it can conduct scans without unnecessary access to sensitive data or resources.
• Unattended security updates are enabled on Datadog’s scanner instances. This feature automates the process of installing critical security patches and updates without requiring manual intervention.
• The Datadog scanner instances are automatically rotated every 24 hours. This rotation ensures that the scanner instances are continually updated with the latest Ubuntu Amazon Machine Images (AMIs).
• Access to the scanner instances is tightly controlled through the use of security groups. No inbound access to the scanner is allowed, restricting possibility to compromise the instance.
• No confidential or private personal information is ever transmitted outside of your infrastructure.

Agentless Scanning with existing Agent installations

When installed, the Datadog Agent offers real-time, deep visibility into risks and vulnerabilities that exist in your cloud workloads. It is recommended to fully install the Datadog Agent.

As a result, Agentless Scanning excludes resources from its scans that have the Datadog Agent installed and configured for Vulnerability Management. In this way, Cloud Security Management offers complete visibility of your risk landscape without overriding the benefits received from installing the Datadog Agent with Vulnerability Management.

The following diagram illustrates how Agentless scanning works with existing Agent installations:

Cloud service provider cost

When using Agentless Scanning, there are additional costs for running scanners in your cloud environments. To optimize on costs while being able to reliably scan every 12 hours, Datadog recommends setting up Agentless Scanning with Terraform as the default template, as this also avoids cross-region networking.

To establish estimates on scanner costs, reach out to your Datadog Customer Success Manager.

Further reading

Additional helpful documentation, links, and articles:

Setting up Agentless ScanningDOCUMENTATION Detect vulnerabilities in minutes with Agentless Scanning for Cloud Security ManagementBLOG Read more about CSM VulnerabilitiesDOCUMENTATION