This guide explains why and how to dual ship Workload Protection data to two Datadog organizations—for example, a primary organization used by platform teams and a second organization used only by security teams.

Why dual ship Workload Protection data?

Dual shipping sends the same Workload Protection runtime events from a single Datadog Agent to two organizations. This is useful when different teams need access to different data in Datadog. For example, a security team needs Workload Protection signals, findings, and investigation workflows, while platform or application teams in the primary organization should not see security data.

In each destination organization, enable Workload Protection so Datadog can analyze the incoming runtime events and generate signals and findings.

Infrastructure Monitoring requirement

Workload Protection relies on Infrastructure Monitoring to deliver a complete experience:

• Backend rules enrich Agent events with infrastructure context (cloud provider, host, Kubernetes cluster, container, and image), which powers detection, findings, and investigation workflows.
• Host and container tags scope policy deployment and rule filters across your environment.
• The Coverage page and investigation workflows pivot to infrastructure views to identify unprotected hosts and reconstruct attack stories.

Without Infrastructure Monitoring, the Workload Protection experience is incomplete.

Dual shipping and sub-organizations

To configure dual shipping, see the following documentation:

• Dual Shipping: Agent configuration for Workload Protection runtime events, infrastructure metrics, and other telemetry types. See the Workload Protection section for runtime_security_config.endpoints settings.
• Managing Multiple-Organization Accounts: How sub-organizations work, including data isolation between organizations and usage tracking from a parent organization.

Further reading

Additional helpful documentation, links, and articles:

Dual ShippingDOCUMENTATION Managing Multiple-Organization AccountsDOCUMENTATION Infrastructure MonitoringDOCUMENTATION