---
title: Coverage
description: >-
  Assess Workload Protection coverage across hosts, ECS Fargate, and EKS Fargate
  workloads, including Agent, policy, and rule deployment status.
breadcrumbs: Docs > Datadog Security > Workload Protection > Coverage
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Coverage

Workload Protection [Coverage](https://app.datadoghq.com/security/workload-protection/inventory/coverage) provides a real-time view of security coverage across your hosts, ECS Fargate, and EKS Fargate workloads. Use Coverage to assess protection posture, identify gaps, and act on unprotected or misconfigured workloads.

Coverage reflects whether the policies and Agent rules on each resource loaded successfully. For how policies reach your Agents, see [Enable and deploy policies](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/agent_rules/policy_management.md#enable-and-deploy-policies).

To identify and address coverage gaps, see [Review and Improve Coverage](https://docs.datadoghq.com/security/workload_protection/inventory/review_improve_coverage.md).

{% image
   source="https://docs.dd-static.net/images/security/workload_protection/coverage_page/coverage_explorer.1ea0fc55557b416d3650ef6cec7a7b76.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/workload_protection/coverage_page/coverage_explorer.1ea0fc55557b416d3650ef6cec7a7b76.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Explorer view of the Coverage page showing resources in a faceted table" /%}

## Views{% #views %}

Coverage has two views. Use the toggle at the top of the page to switch between them:

- Explorer: A faceted table of your resources. Search and filter resources by Agent, Rule, Policy, Infrastructure, and Container facets, then open a resource to inspect its Agent rules and policy deployment status.

- Map: A visual map where each resource appears as a hexagon colored by its coverage status severity.

{% image
   source="https://docs.dd-static.net/images/security/workload_protection/coverage_page/coverage_map.da7615099a841654d1922024923b4da4.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/workload_protection/coverage_page/coverage_map.da7615099a841654d1922024923b4da4.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Map view of the Coverage page showing resources as hexagons colored by coverage status" /%}

In both views, you can:

- Group by Cloud Provider, OS, Agent Version, Severity, or Kubernetes Cluster.
- Refresh the view on demand.

A resource appears in Coverage as soon as its Agent loads its ruleset. When a resource goes offline, it is removed from Coverage within 15 minutes.

## Coverage statuses{% #coverage-statuses %}

### Resource coverage status{% #resource-coverage-status %}

Each resource's coverage status falls into one of two severity categories, based on the rules loaded on it:

| Severity | Meaning                                                                                        |
| -------- | ---------------------------------------------------------------------------------------------- |
| Pass     | All rules loaded successfully or were filtered as expected.                                    |
| Error    | One or more rules have errors that need to be fixed, or the resource reported incomplete data. |

In the Map view, resources are displayed as hexagons colored by severity. Click a hexagon to inspect a resource and view its policies and rules.

### Policy statuses{% #policy-statuses %}

Each policy loaded on a resource has one of the following statuses:

- Loaded: All of the policy's rules pass.
- Error: One or more of the policy's rules are in error.

### Rule statuses{% #rule-statuses %}

Each rule reports one of the following statuses:

- Loaded: The rule loaded successfully.
- Filtered: The rule was intentionally not applied (for example, the Agent version is too low or the event type is disabled).
- Error: The rule failed to load.

When a rule is filtered or in error, a **verdict** explains why:

| Verdict                        | Meaning                                          |
| ------------------------------ | ------------------------------------------------ |
| `syntax_error`                 | The rule expression is invalid.                  |
| `unknown`                      | The Agent could not load the rule.               |
| `filtered_agent_version`       | The Agent version is too low for this rule.      |
| `filtered_event_type_disabled` | The event type is disabled in the configuration. |
| `filtered_rule_filter`         | The rule was excluded by a rule filter.          |

To understand why a rule is failing, select the resource to open its side panel. The side panel lists the resource's policies and rules. For each rule, it shows the expression, the status and verdict, and the error message reported by the Agent.

{% image
   source="https://docs.dd-static.net/images/security/workload_protection/coverage_page/coverage_side_panel.070f59a951719ede137f384073a4d672.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/workload_protection/coverage_page/coverage_side_panel.070f59a951719ede137f384073a4d672.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Resource side panel showing policy and rule statuses with verdicts" /%}

## Further reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [MITRE ATT&CK map](https://docs.datadoghq.com/security/detection_rules.md#mitre-attck-map)
- [Review your Workload Protection coverage with the Coverage map](https://app.datadoghq.com/release-notes/review-your-workload-protection-coverage-with-the-coverage-map)