As Workload Protection evaluates runtime activity, it produces agent events, signals, and findings. Use the Agent Events Explorer to investigate runtime activity, the Signals Explorer to investigate threats, and the Findings Explorer to review runtime security posture issues.

For how each one is produced, see How Workload Protection works.

Agent events

Agent events are the raw telemetry generated by the Datadog Agent when runtime activity matches an agent rule. Use the Agent Events Explorer to investigate this activity.

Signals

Signals are generated when agent events match a backend detection rule. Use the Signals Explorer to investigate threats, triage signals, and take response actions.

Findings

Findings are generated when agent events match a finding rule. Use the Findings Explorer to review runtime security posture issues.