After the Agent forwards Agent events to Datadog, backend rules analyze that telemetry to produce security outcomes. Workload Protection provides two types of backend rules:

• Detection rules detect threats and generate security signals when suspicious activity matches your criteria. They surface real runtime security threats—for example, a reverse shell or credential access attempt.
• Finding rules evaluate runtime security posture and generate findings with recommendations for resources that fail a policy. They track ongoing bad practices and misconfigurations on a host or container—for example, package manager usage in a production container.

Both rule types query the same backend event schema. Each event includes all fields collected by the Agent, plus additional enrichment such as infrastructure context and threat intelligence. When you write a search query for a detection or finding rule, you can filter on any field in this schema. See Linux backend syntax and Windows backend syntax for the full set of available fields.

Detection rules versus finding rules

For example, Sudoers Policy File Modification Detection flags modifications to /etc/sudoers and files in /etc/sudoers.d/. Modifying those files is a bad practice, but it can be part of a legitimate process. Treating it as a detection rule generates excessive noise. As a finding rule, it tracks which resources have this configuration without triggering a signal for every file write.

Next steps

• Read Detection rules to explore out-of-the-box (OOTB) threat detection rules and create custom detection rules.
• Read Finding rules to explore OOTB posture rules and create custom finding rules.
• Browse Linux backend syntax and Windows backend syntax to see every field you can use in rule queries.