--- title: Workload Protection description: >- Detect and respond to runtime threats across your hosts, containers, and serverless workloads with Datadog Workload Protection. breadcrumbs: Docs > Datadog Security > Workload Protection --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Workload Protection Datadog Workload Protection provides real-time visibility and defense for your infrastructure by continuously monitoring file, network, and process activity across your environments. It detects threats as they occur, generating security signals and findings. Use them to identify, investigate, and stop malicious behaviors before they impact your workloads. Workload Protection is part of the Datadog Security platform. Signals correlate with misconfiguration scans, vulnerability assessments, and code security findings, so you can link runtime attacks to preexisting weaknesses. Because it runs on the Datadog platform, it also connects with your infrastructure metrics, traces, and logs. That context helps you understand a threat's scope and reconstruct the attack story. ## Beyond runtime threat detection{% #beyond-runtime-threat-detection %} Workload Protection is not limited to runtime threat detection. Many organizations use it across a range of security and operational use cases: - **Compliance Validation:** Workload Protection helps you validate compliance with regulatory frameworks such as PCI, FedRAMP, and SOC 2 by continuously monitoring runtime activity for policy violations, risky configurations, and unauthorized changes. - **Runtime Security Posture:** Workload Protection improves your security posture by identifying unsafe runtime practices and sensitive configuration drifts, helping you catch weaknesses before they can be exploited. - **Infrastructure Monitoring:** Workload Protection tracks any kind of runtime behavior, whether security-related or not. From debugging custom workloads to monitoring system-level processes and remote user sessions, it offers real-time visibility into how your environments operate. {% image source="https://docs.dd-static.net/images/security/workload_protection/k8s_remote_access.5a9676edd33d6f3e99672f1e4095cec4.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/workload_protection/k8s_remote_access.5a9676edd33d6f3e99672f1e4095cec4.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Breakdown of Kubernetes remote user sessions" /%} ## How it works{% #how-it-works %} Workload Protection evaluates the activity it collects in two places: on the Datadog Agent, and in Datadog. ### Saving resources by design{% #saving-resources-by-design %} Workload Protection detection rules are complex, correlating several datapoints across time and processes. This complexity would result in considerable compute resource demands on the Agent host if all rules were evaluated there. Datadog solves this problem by keeping the Agent lightweight with efficient rules that filter out non-security-relevant activity from your workloads and processing the remaining activity using threat detection and finding rules on the Datadog backend. Agent rules are organized in [policies](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/agent_rules/policy_management.md), which you deploy with Remote Configuration or manually. You can manage rules and policies in Datadog, in Agent configuration files, or with the Datadog Terraform provider. {% image source="https://docs.dd-static.net/images/security/workload_protection/workload_protection_detection_architecture.036908a0fb21ddb798b1628e70dcf3bb.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/workload_protection/workload_protection_detection_architecture.036908a0fb21ddb798b1628e70dcf3bb.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Workload Protection architecture overview" /%} ### Collecting runtime activity{% #collecting-runtime-activity %} The Datadog Agent collects runtime activity from your workloads. The collection mechanism depends on the platform: - **Linux**: the eBPF Agent, which offers the broadest feature support. - **AWS Fargate**: the cws-instrumentation tracer. Fargate does not provide eBPF access, so this Agent uses ptrace instead. It covers the major Workload Protection features, including File Integrity Monitoring and process execution monitoring. - **Windows**: a Windows driver. Across Linux and Windows, Workload Protection covers over 40 event types, spanning process, file system, kernel, and network activity. For the distributions, versions, and cloud environments each Agent supports, see [Setup](https://docs.datadoghq.com/security/workload_protection/setup.md). ### Evaluating activity{% #evaluating-activity %} Agent rules perform lightweight filtering so they run efficiently on every host. Datadog evaluates the more complex correlations across time and processes: 1. The [agent rules](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/agent_rules.md) evaluate system activity on the Agent host. 1. When activity matches an agent rule expression, the Agent generates an [agent event](https://docs.datadoghq.com/security/workload_protection/investigate_and_triage/agent_events.md) and passes it to Datadog. 1. Datadog evaluates the agent events against [detection rules](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/detection_and_finding_rules/detection_rules.md) and [finding rules](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/detection_and_finding_rules/finding_rules.md). 1. If a detection rule matches, a signal is generated and displayed in [Signals](https://docs.datadoghq.com/security/workload_protection/investigate_and_triage/security_signals.md). If an agent event attribute matches a [threat intelligence indicator](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/threat_intelligence.md), the matching indicator is also displayed. 1. If a finding rule matches, a finding is generated and displayed in [Findings](https://docs.datadoghq.com/security/workload_protection/investigate_and_triage/security_findings.md). 1. Any [notification rules](https://docs.datadoghq.com/security/notifications/rules.md) matching the signal's severity, rule type, tags, and attributes are triggered. Workload Protection ships with over 350 agent rules and 200 detection rules, covering most MITRE ATT&CK tactics and techniques. You can also write your own, including in-agent state machines that alert only on complex indicators of compromise. ### Responding to threats{% #responding-to-threats %} Response actions run in the Agent. The Agent can terminate a process or container, or block network traffic using an eBPF-based filter. You can trigger these actions two ways: - **Automated response** attaches an action to an agent rule, so the Agent acts as soon as the rule matches. - **Manual response** lets you act from a signal after it is generated. Both depend on enforcement being enabled in the Agent. See [Respond to Threats](https://docs.datadoghq.com/security/workload_protection/respond_and_report.md). You can also respond from Datadog instead of the Agent. Trigger a [workflow](https://docs.datadoghq.com/actions/workflows.md) from a signal, or integrate signals with your existing response pipelines. See [Signal actions](https://docs.datadoghq.com/security/workload_protection/investigate_and_triage/security_signals/actions.md). ## Next steps{% #next-steps %} ### Setup{% #setup %} Begin with the [Setup](https://docs.datadoghq.com/security/workload_protection/setup.md) guide. It covers supported environments, how to deploy the Agent, and how to experiment with Workload Protection's features using the playground scripts. ### Detect and monitor{% #detect-and-monitor %} Read the [Detect and Monitor](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor.md) pages to understand how agent events translate into Workload Protection signals and findings. These pages help you explore the built-in (OOTB) detections and create your own detection logic. ### Investigate and triage{% #investigate-and-triage %} See the [Investigate and Triage](https://docs.datadoghq.com/security/workload_protection/investigate_and_triage.md) pages to discover the explorers and in-app views available in Workload Protection. These pages help you make the most of the events, signals, and findings generated by the platform. ### Respond to threats{% #respond-to-threats %} The [Respond to Threats](https://docs.datadoghq.com/security/workload_protection/respond_and_report.md) page explains how to configure automated and manual response. It covers the Agent enforcement requirements, the response actions available, and how to interpret their results. ### Coverage{% #coverage %} Use [Coverage](https://docs.datadoghq.com/security/workload_protection/inventory.md) to get a unified, real-time view of Workload Protection posture across hosts, containers, and serverless workloads. Identify policy deployment issues, unprotected assets, and detection gaps before they become exploitable risks. ### Guides{% #guides %} Use case driven examples to help you discover and learn about Workload Protection: - [Best Practices for Tuning Workload Protection Security Signals](https://docs.datadoghq.com/security/workload_protection/guide/tuning-rules.md)