---
title: Threat intelligence
description: >-
  Enrich Workload Protection Agent events with Datadog-curated threat
  intelligence, or import your own database.
breadcrumbs: >-
  Docs > Datadog Security > Workload Protection > Detect and Monitor > Threat
  intelligence
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Threat intelligence

Workload Protection enriches [Agent events](https://docs.datadoghq.com/security/workload_protection/investigate_and_triage/agent_events.md) with [Threat Intelligence](https://docs.datadoghq.com/security/threat_intelligence.md) curated by Datadog. This enrichment adds reputation context to entities observed on your hosts and containers, such as IP addresses and file hashes, to help you assess whether an event is part of a known malicious campaign.

For general concepts, sources, categories, intents, and life cycle information that apply across all Datadog security products, see [Threat Intelligence](https://docs.datadoghq.com/security/threat_intelligence.md). This page covers the details specific to Workload Protection.

## Entity types for Workload Protection{% #entity-types-for-workload-protection %}

Workload Protection supports the following [entity types](https://docs.datadoghq.com/security/threat_intelligence.md#entity-types):

- IP addresses
- Domains
- File hashes: `SHA1`, `SHA256`, and `ssdeep`

`ssdeep` hashes support fuzzy matching, which helps identify files that are similar, but not identical, to a known malicious file.

## Supported categories for Workload Protection{% #supported-categories-for-workload-protection %}

Workload Protection supports the following threat intelligence categories:

- `malware`
- `exploitation`
- `cryptomining`
- `supply_chain_attack_infrastructure`
- `custom`

For category definitions and intents that apply across Datadog security products, see [Threat intelligence categories](https://docs.datadoghq.com/security/threat_intelligence.md#threat-intelligence-categories).

## Using threat intelligence in detection rules{% #using-threat-intelligence-in-detection-rules %}

[Detection rules](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/detection_and_finding_rules/detection_rules.md) in Workload Protection can reference threat intelligence keys such as category (`@threat_intel.results.category`) and intent (`@threat_intel.results.intention`) in the search query or rule conditions. For example, a rule can trigger when a file executed on a workload matches the hash of a known malware sample, categorized as `malware` with intent `malicious`.

{% alert level="info" %}
Threat intelligence sources and categories are not configurable.
{% /alert %}

## Threat intelligence facets{% #threat-intelligence-facets %}

Threat intelligence [sources, categories, and intents](https://docs.datadoghq.com/security/threat_intelligence.md#threat-intelligence-facets) are available as facets and filters. You can see threat intelligence enrichments on matching events in the [Agent Events Explorer](https://docs.datadoghq.com/security/workload_protection/investigate_and_triage/agent_events.md) and on the resulting [security signals](https://docs.datadoghq.com/security/workload_protection/investigate_and_triage/security_signals.md).

## Threat intelligence on security signals{% #threat-intelligence-on-security-signals %}

When an Agent event matches a threat intelligence indicator, Workload Protection generates a security signal that displays the matched entity along with its source, category, and intent.

{% image
   source="https://docs.dd-static.net/images/security/workload_protection/detect_and_monitor/threat_intelligence_signal.288ea02462e84687379c51fa74ba585b.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/workload_protection/detect_and_monitor/threat_intelligence_signal.288ea02462e84687379c51fa74ba585b.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="A Workload Protection security signal displaying threat intelligence enrichment details" /%}

## Further reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Threat Intelligence at Datadog](https://docs.datadoghq.com/security/threat_intelligence.md)
- [Detection Rules](https://docs.datadoghq.com/security/detection_rules.md)