Setting up Cloud Security Management

Cloud Security Management Misconfigurations is not supported for your selected Datadog site ().


Cloud Security Management (CSM) delivers real-time threat detection and continuous configuration audits across your entire cloud infrastructure, all in a unified view for seamless collaboration and faster remediation.

CSM is available in three packages: CSM Enterprise, CSM Pro, and CSM Workload Security. For more information, see Changes to Datadog Cloud Security Management. Each package includes access to a specific set of features, as shown in the following table:

Note: You can enable features that aren’t included in your package at any time by following the instructions on the CSM Setup page.


The following table summarizes the CSM features available relative to each deployment type.

  • The minimum Datadog Agent version required for CSM is 7.46 or higher.
For more details, click each of the CSM feature headings to review additional requirements for that feature.

Supported deployment types and features

TypeAgent Required (7.46+)CSM MisconfigurationsCSM ThreatsCSM VulnerabilitiesCSM Identity Risks
Amazon ECS
AWS Account
Azure Account
GCP Account
AWS Fargatebeta

The following tables represent additional prerequisites relative to each CSM feature.

CSM Threats

CSM Threats supports the following Linux distributions:

Linux DistributionsSupported Versions
Ubuntu LTS18.04, 20.04, 22.04
Debian10 or later
Amazon Linux 2Kernels 4.15, 5.4, 5.10, and 2023
SUSE Linux Enterprise Server12 and 15
Red Hat Enterprise Linux7, 8, and 9
Oracle Linux7, 8, and 9


  • Custom kernel builds are not supported.
  • For compatibility with a custom Kubernetes network plugin like Cilium or Calico, see the Troubleshooting page.
  • Data collection is done using eBPF, so Datadog minimally requires platforms that have underlying Linux kernel versions of 4.15.0+ or have eBPF features backported.

CSM Vulnerabilities

Helm Chartv3.49.6 or later (Kubernetes only)
containerdv1.5.6 or later (Kubernetes and hosts only)

Note: CSM Vulnerabilities is not available for the following container runtimes:

  • CRI-O runtime
  • podman runtime

CSM Identity Risks

Note: At this time, CSM Identity Risks is available for AWS only.

To use CSM Identity Risks, you must enable resource collection for AWS. If you’ve already done this, no additional setup is required.


Next steps

To get started setting up CSM, navigate to the Security > Setup section in Datadog, which has detailed steps on how to configure CSM. For detailed setup instructions, see the CSM Enterprise, CSM Pro, and CSM Workload Security setup docs.

Further Reading