Agentless Scanning Compatibility

This product is not supported for your selected Datadog site. ().

Availability

Agentless Scanning is supported on AWS, Azure, and GCP.

The following table provides a summary of Agentless Scanning technologies in relation to their corresponding components for each supported cloud provider:

ComponentAWSAzureGCP
Operating SystemLinux; Windows Server 2016 or later; Windows 10 or laterLinux; Windows Server 2016 or later; Windows 10 or laterLinux; Windows Server 2016 or later; Windows 10 or later
Host File SystemBtrfs, Ext2, Ext3, Ext4, xfs, NTFSBtrfs, Ext2, Ext3, Ext4, xfs, NTFSBtrfs, Ext2, Ext3, Ext4, xfs, NTFS
Package ManagerDeb (debian, ubuntu)
RPM (amazon-linux, fedora, redhat, centos)
APK (alpine)		Deb (debian, ubuntu)
RPM (fedora, redhat, centos)
APK (alpine)		Deb (debian, ubuntu)
RPM (fedora, redhat, centos)
APK (alpine)
EncryptionAWS
Unencrypted
Encrypted - Platform Managed Key (PMK) and Customer Managed Key (CMK)		Encrypted - Platform Managed Key (PMK): Azure Disk Storage Server-Side Encryption, Encryption at host
Note: Encrypted - Customer Managed Key (CMK) is not supported		Encrypted - Platform Managed Key (PMK): Persistent Disk Encryption, Confidential VM
Note: Encrypted - Customer Managed Encryption Key (CMEK) and Customer-Supplied Encryption Keys (CSEK) are not supported
Container runtimeDocker, containerd
Note: CRI-O is not supported		Docker, containerd
Note: CRI-O is not supported		Docker, containerd
Note: CRI-O is not supported
ServerlessAWS Lambda
AWS Fargate for ECS		Azure Container Apps and Azure Container Instances (in Preview; to join, contact Datadog Support)Cloud Run (container deployment only — not from GitHub repos or inline editors)
KubernetesEKS on EC2 nodes only
Note: Fargate-backed EKS nodes are not supported		AKS on virtual machines and Virtual Machine Scale Sets (VMSS)
Note: AKS on ACI is not supported		GKE Standard only
Note: GKE Autopilot and image streaming are not supported
Application languages (in hosts and containers)Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, CondaJava, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, CondaJava, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda
Container RegistriesAmazon ECR (public and private): scans running container images and the last 1,000 pushed images at restACR: coming soon for running container images only
Note: To request at-rest registry scanning, contact Datadog Support		Google Artifact Registry: scans images from running workloads only
Note: To request at-rest registry scanning, contact Datadog Support
Host ImagesAMINot supportedNot supported
Sensitive Data (SDS)S3, RDS (private beta)Not supportedNot supported

Note: AMIs must be stored in an account that uses Datadog’s AWS integration. Otherwise, Datadog can’t read the AMI’s underlying Amazon Elastic Block Store (EBS) snapshot, so it can’t scan or report on the AMI.

Linux distributions

The following Linux distributions are supported for hosts and containers scans:

Operating SystemSupported VersionsPackage ManagersSecurity Advisories
Alpine Linux2.2-2.7, 3.0-3.19 (edge is not supported)apkhttps://secdb.alpinelinux.org/
Wolfi LinuxN/Aapkhttps://packages.wolfi.dev/os/security.json
ChainguardN/Aapkhttps://packages.cgr.dev/chainguard/security.json
Red Hat Enterprise Linux6, 7, 8dnf/yum/rpmhttps://www.redhat.com/security/data/metrics/ and https://www.redhat.com/security/data/oval/v2/
CentOS6, 7, 8dnf/yum/rpmhttps://www.redhat.com/security/data/metrics/ and https://www.redhat.com/security/data/oval/v2/
AlmaLinux8, 9dnf/yum/rpmhttps://errata.almalinux.org/
Rocky Linux8, 9dnf/yum/rpmhttps://download.rockylinux.org/pub/rocky/
Oracle Linux5, 6, 7, 8dnf/yum/rpmhttps://linux.oracle.com/security/oval/
CBL-Mariner1.0, 2.0dnf/yum/rpmhttps://github.com/microsoft/CBL-MarinerVulnerabilityData/
Amazon Linux1, 2, 2023dnf/yum/rpmhttps://alas.aws.amazon.com/
openSUSE Leap42, 15zypper/rpmhttp://ftp.suse.com/pub/projects/security/cvrf/
SUSE Linux Enterprise11, 12, 15zypper/rpmhttp://ftp.suse.com/pub/projects/security/cvrf/
Photon OS1.0, 2.0, 3.0, 4.0tdnf/yum/rpmhttps://packages.vmware.com/photon/photon_cve_metadata/
Debian GNU/Linux7, 8, 9, 10, 11, 12 (unstable/sid is not supported)apt/dpkghttps://security-tracker.debian.org/tracker/ and https://www.debian.org/security/oval/
UbuntuAll versions supported by Canonicalapt/dpkghttps://ubuntu.com/security/cve

Application libraries

The following application languages and libraries are supported for vulnerability scans on container images, Lambda functions, and containers running in hosts:

LanguageSupported Package ManagerSupported Files
RubybundlerGemfile.lock, gemspec
.NETnugetpackages.lock.json, packages.config, .deps.json, *packages.props
GomodBinaries built by Go, go.mod
JavaGradle, Mavenpom.xml, *gradle.lockfile, JAR/WAR/PAR/EAR (with pom.properties)
Node.jsnpm, pnpm, yarnpackage-lock.json, yarn.lock, pnpm-lock.yaml, package.json
PHPcomposercomposer.lock
Pythonpip, poetrypipfile.lock, poetry.lock, egg package, wheel package, conda package

Container image registries

The following container image registries are supported for container image scans:

RegistrySupport levelNotes
Amazon ECR (public and private)GAScans running container images and the last 1,000 pushed images at rest (by date). This is the only registry with at-rest scanning support
Google Artifact Registry (GAR)GAScans images tied to running workloads (Cloud Run, GKE) only
Note: To request at-rest registry scanning, contact Datadog Support
Azure Container Registry (ACR)Coming soonScans running container images from Azure Container Apps and Azure Container Instances only
Note: To request at-rest registry scanning, contact Datadog Support

Note: Container image scanning from registry is only supported if you have installed Agentless with:

  • CloudFormation Integrations >= v2.0.8
  • Terraform Agentless Module >= v0.11.7

Container runtimes

The following container runtimes are supported:

  • containerd: v1.5.6 or later
  • Docker

Note for container observations: Agentless Scanning requires uncompressed container image layers. As a workaround, you can set the configuration option discard_unpacked_layers=false in the containerd configuration file.