---
title: Agent Rules
description: >-
  Learn how Agent rules determine which runtime activity the Datadog Agent
  collects and sends to Datadog as Agent events.
breadcrumbs: >-
  Docs > Datadog Security > Workload Protection > Detect and Monitor > Agent
  Rules
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Agent Rules

Agent rules determine which runtime activity the Datadog Agent collects and sends to Datadog as Agent events. These events provide the telemetry that Workload Protection uses for threat detection and runtime security posture evaluation. Detection rules and finding rules in the Datadog backend analyze those events to generate security signals and findings. Agent events capture low-level runtime activity from workloads and provide the raw, high-fidelity data needed to understand what is actually happening on a system, rather than relying solely on static configuration or periodic scans.

To reduce noise, data volume, and performance impact, the Agent filters benign or low-risk activity before sending events to Datadog. Agent rules use Datadog Security Language (SECL) to define this filtering. Policies deploy Agent rules through Remote Configuration, Agent configuration files, or Terraform.

## Out-of-the-box Agent rules{% #ootb-rules %}

Workload Protection includes out-of-the-box (OOTB) Agent rules, called default rules, that Datadog manages. To view them, see [Agent Rules](https://app.datadoghq.com/security/workload-protection/agent-rules?ruleQuery=defaultRule%3Atrue) in Datadog. Datadog security engineers maintain these rules. They add rules for emerging malware behavior, evolving attack techniques, and other security-relevant activity.

You can deploy default rules selectively to environments or workloads, clone them to customize their expressions, refine their filtering logic, or add actions. For deployment options, see [Policy Management](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/agent_rules/policy_management.md).

Agent rules can collect contextual telemetry or match high-confidence activity and execute Agent actions. Backend detection rules analyze Agent events and generate security signals.

## Write custom Agent rules in SECL{% #write-custom-agent-rules-in-secl %}

Workload Protection Agent rules use a custom expression language called SecL to specify which events to observe, match, and send to Datadog based on runtime context. For more information, see the [SecL guide](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/agent_rules/secl_guide.md).

To create an Agent rule and threat detection rule together, use the Assisted rule creator or manual flow. See [Create the custom Agent and detection rules together](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/detection_and_finding_rules/detection_rules.md#create-the-custom-agent-and-detection-rules-together) in the [Detection Rules](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/detection_and_finding_rules/detection_rules.md) documentation.

## Deploy Agent rules with policies{% #deploy-agent-rules-with-policies %}

Agent rules are packaged and deployed in policies. Manage policies centrally in Datadog or using Terraform, and deploy them to the Agent with Remote Configuration or by manually modifying the Agent configuration files. For more information, see [Policy Management](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/agent_rules/policy_management.md).

## Use variables and actions{% #use-variables-and-actions %}

Variables and actions extend Agent rules beyond event matching. Actions can collect additional telemetry, such as file hashes, respond to threats, or operate on SECL variables. SECL variables enable the construction of advanced, stateful detection logic based on state machines. For more information, see [Variables and actions](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/agent_rules/variables_and_actions.md).