Cloud Security Posture Management (CSPM) makes it easier to assess and visualize the current and historic security posture of your cloud resources, automate audit evidence collection, and catch misconfigurations that leave your organization vulnerable to attacks.
CSPM provides agentless onboarding using existing Datadog integrations with cloud providers such as AWS, Azure, GCP, Docker, and Kubernetes. For details on how to configure CSPM, select your cloud provider and follow the instructions:
If you haven’t already, set up the Amazon Web Services integration. For CSPM, you must also add the necessary permissions for resource collection.
Use one of the following methods to enable CSPM for your AWS accounts:
If you haven’t already, set up the Microsoft Azure integration.
Use one of the following methods to enable CSPM for your Azure subscriptions:
If you haven’t already, set up the Google Cloud Platform integration and make sure that you have successfully completed the steps for enabling metric collection.
Use one of the following methods to enable CSPM for your GCP projects:
Note: If you do not see any data on the CSPM overview page, you may not have set up your GCP integration correctly. See the GCP metric collection instructions for more information.
If you haven’t already, install the Datadog Agent (version 7.27+).
Navigate to Security > Setup & Configuration.
Follow the in-app instructions to activate CSPM for your account.
Add the following to the datadog section of the values.yaml file:
# values.yaml file
datadog:
[...]
# Add this to enable Cloud Security Posture Management and Cloud Workload Security
securityAgent:
runtime:
enabled: true
compliance:
enabled: true
Restart the Agent.
CSPM evaluates resources in increments between 15 minutes and four hours (depending on type). New findings from each scan are generated as soon as the scan completes.
To view the findings for your cloud resources, go to the CSPM homepage.
CSPM comes with a set of out-of-the-box detection rules that evaluate the configuration of your cloud resources and identifies potential misconfigurations so you can immediately take steps to remediate. When new configuration detection rules are added, they are automatically imported into your account.
To filter the default detection rules by cloud provider:
After you explore the default detection rules, you can review and take action on your cloud misconfigurations in the Security Findings Explorer, customize how each rule scans your environment, and set up notification targets.
Once you’ve disabled CSPM, your previous findings and the homepage are still available in-app, and you do not incur additional billing costs.
To disable CSPM for your cloud providers:
DD_COMPLIANCE_CONFIG_ENABLED to false in your Docker configuration.datadog section of the values.yaml file, set compliance > enabled to false.Additional helpful documentation, links, and articles:
