Agent rules determine which runtime activity the Datadog Agent collects and sends to Datadog as Agent events. These events provide the telemetry that Workload Protection uses for threat detection and runtime security posture evaluation. Detection rules and finding rules in the Datadog backend analyze those events to generate security signals and findings. Agent events capture low-level runtime activity from workloads and provide the raw, high-fidelity data needed to understand what is actually happening on a system, rather than relying solely on static configuration or periodic scans.

To reduce noise, data volume, and performance impact, the Agent filters benign or low-risk activity before sending events to Datadog. Agent rules use Datadog Security Language (SECL) to define this filtering. Policies deploy Agent rules through Remote Configuration, Agent configuration files, or Terraform.

Out-of-the-box Agent rules

Workload Protection includes out-of-the-box (OOTB) Agent rules, called default rules, that Datadog manages. To view them, see Agent Rules in Datadog. Datadog security engineers maintain these rules. They add rules for emerging malware behavior, evolving attack techniques, and other security-relevant activity.

You can deploy default rules selectively to environments or workloads, clone them to customize their expressions, refine their filtering logic, or add actions. For deployment options, see Policy Management.

Agent rules can collect contextual telemetry or match high-confidence activity and execute Agent actions. Backend detection rules analyze Agent events and generate security signals.

Write custom Agent rules in SECL

Workload Protection Agent rules use a custom expression language called SecL to specify which events to observe, match, and send to Datadog based on runtime context. For more information, see the SecL guide.

To create an Agent rule and threat detection rule together, use the Assisted rule creator or manual flow. See Create the custom Agent and detection rules together in the Detection Rules documentation.

Deploy Agent rules with policies

Agent rules are packaged and deployed in policies. Manage policies centrally in Datadog or using Terraform, and deploy them to the Agent with Remote Configuration or by manually modifying the Agent configuration files. For more information, see Policy Management.

Use variables and actions

Variables and actions extend Agent rules beyond event matching. Actions can collect additional telemetry, such as file hashes, respond to threats, or operate on SECL variables. SECL variables enable the construction of advanced, stateful detection logic based on state machines. For more information, see Variables and actions.