Use the following instructions to enable Misconfigurations and Vulnerability Management.

Prerequisites

• Datadog Agent version 7.46 or later.

Installation

For a package-based deployment, install the Datadog package with your package manager, and then update the files listed below.

compliance_config:
  ## @param enabled - boolean - optional - default: false
  ## Set to true to enable CIS benchmarks for Misconfigurations.
  #
  enabled: true
  host_benchmarks:
    enabled: true

# Vulnerabilities are evaluated and scanned against your containers and hosts every hour.
sbom:
  enabled: true
  # Set to true to enable Container Vulnerability Management
  container_image:
    enabled: true
    # Enables scanning of application libraries in addition to OS packages (Agent 7.70+)
    analyzers: ["os", "languages"]
  # Set to true to enable Host Vulnerability Management
  host:
    enabled: true
    # Enables scanning of application libraries in addition to OS packages (Agent 7.70+)
    analyzers: ["os", "languages"]
  # Enables runtime package prioritization (Agent 7.79+)
  # See Runtime Package Prioritization section below.
  enrichment:
    usage:
      enabled: true

Note: enrichment.usage.enabled: true requires Datadog Agent 7.79.0 or later. See the Runtime Package Prioritization section for requirements.

compliance_config:
  ## @param enabled - boolean - optional - default: false
  ## Set to true to enable CIS benchmarks for Misconfigurations.
  #
  enabled: true
  host_benchmarks:
    enabled: true

Note: The languages analyzer requires Datadog Agent 7.70 or later. When enabled, it detects vulnerabilities in application libraries managed by package managers such as npm, pip, Maven/Gradle, NuGet, Go modules, Cargo, and Bundler, in addition to OS packages. When the analyzers field is omitted, only OS packages are scanned for container images. See Supported application library package managers for the full list.

Supported application library package managers

The languages analyzer covers the following package ecosystems:

Runtime Package Prioritization

Runtime package prioritization identifies which packages in a container image are used at runtime, so you can prioritize vulnerabilities in code that runs over vulnerabilities in packages that are installed but never executed.

When enabled, the Agent uses eBPF to observe file access on your workloads and adds these signals to vulnerability findings for that image:

Package is running feeds the Reachability dimension of the Runtime Prioritization Engine. To query these signals directly, see Filter findings by runtime signals.

Requirements:

• Datadog Agent 7.79.0 or later.
• Linux only (eBPF dependency). See Workload Protection setup for supported distributions and kernel versions.

Runtime signals apply to packages installed by an operating system package manager (apt, yum, or apk) in container image vulnerability findings.

Add the enrichment block to the sbom section of your datadog.yaml file:

sbom:
  enabled: true
  container_image:
    enabled: true
  # Enables runtime package prioritization (Agent 7.79+)
  enrichment:
    usage:
      enabled: true

Restart the Agent after applying the changes.

To verify the setup, filter vulnerability findings by runtime signals.

Notes:

• You can also use the following Agent install script to automatically enable Misconfigurations and Threat Detection:

  DD_COMPLIANCE_CONFIG_ENABLED=true DD_API_KEY=<DATADOG_API_KEY> DD_SITE="datadoghq.com" bash -c "$(curl -L https://install.datadoghq.com/scripts/install_script_agent7.sh)"
  

• If you use the Agent install script to enable Misconfigurations and Vulnerability Management, you must manually update the datadog.yaml file to enable host_benchmarks for Misconfigurations, and sbom and container_image for Vulnerability Management.

sudo cp /etc/datadog-agent/security-agent.yaml.example /etc/datadog-agent/security-agent.yaml
sudo chmod 640 /etc/datadog-agent/security-agent.yaml
sudo chgrp dd-agent /etc/datadog-agent/security-agent.yaml