--- title: Setting up Workload Protection description: >- Enable Workload Protection in Datadog, then deploy the Datadog Agent to the workloads you want to protect. breadcrumbs: Docs > Datadog Security > Workload Protection > Setting up Workload Protection --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Setting up Workload Protection {% alert level="info" %} Collecting events using Workload Protection will affect your billing. For more information, see [Datadog Pricing](https://www.datadoghq.com/pricing/?product=cloud-security-management#products). {% /alert %} Workload Protection collects runtime activity through the Datadog Agent. Setting it up means enabling the product in Datadog, then deploying the Agent to the workloads you want to protect. After the Agent is running, you can try Workload Protection safely using the playground scripts. Enforcement, which lets the Agent act on the threats it detects, requires separate access. For what happens to the activity the Agent collects, see [How Workload Protection works](https://docs.datadoghq.com/security/workload_protection.md#evaluating-activity). ## Requirements{% #requirements %} Workload Protection relies on the Datadog Agent to monitor your workloads and collect security relevant events for threats detection and security posture monitoring. {% alert level="info" %} Datadog does not recommend running Workload Protection on an organization or sub-organization that does not have Infrastructure Monitoring enabled. {% /alert %} ### Agent options{% #agent-options %} Workload Protection offers 3 different flavors depending on your environment and operating system: - On **Linux**, install **the eBPF agent**. It offers the best performance and feature support. - On **AWS Fargate**, install the Datadog Agent as a sidecar and instrument workloads with the **the cws-instrumentation** tracer. Fargate does not provide eBPF access, so this tracer uses ptrace instead. - On **Windows**, the Workload Protection agent installs a Windows driver to collect events and telemetry. ### Linux support{% #linux-support %} On Linux, you need to look at the Linux kernel version and distribution version, as well as the underlying cloud environment (when applicable) since some Cloud computing services prevent access to eBPF. #### Supported Linux distributions{% #supported-linux-distributions %} | Linux Distributions | Supported Versions | | -------------------------------------------------------- | ------------------------------------- | | Ubuntu LTS | 18.04, 20.04, 22.04, 24.04 and higher | | Debian | 10 and higher | | Amazon Linux 2 | Kernels 4.14 and higher | | Amazon Linux 2023 | All versions | | SUSE Linux Enterprise Server | 12 and 15 | | Red Hat Enterprise Linux | 7, 8, and 9 | | Oracle Linux | 7, 8, and 9 | | CentOS | 7 | | Google Container Optimized OS (default on GKE) (Preview) | 93 and higher | **Notes:** - Custom kernel builds might modify critical hook points that the Agent requires to properly function. Support isn't guaranteed. - Workload Protection requires Linux kernel version 4.14.0 or higher. - On distributions with an older kernel version, Workload Protection can run if the required eBPF features have been backported. However, it will operate in a degraded mode, as some features may require a more recent kernel version. For example, CentOS/RHEL 7 uses kernel 3.10 with backported eBPF features and is supported, but some features, such as network monitoring, are disabled. - For compatibility issues with a custom Kubernetes network plugin like Cilium or Calico, see [Troubleshooting Workload Protection](https://docs.datadoghq.com/security/workload_protection/troubleshooting/threats.md). #### Supported cloud environments{% #supported-cloud-environments %} | Cloud environments | Supported | | --------------------------------------- | ---------------------------------------- | | Amazon Elastic Compute Cloud (EC2) | ✅ | | Amazon Elastic Kubernetes Service (EKS) | ✅ | | Amazon Elastic Container Service (ECS) | ✅ | | AWS Fargate | ✅ (using the cws-instrumentation tracer) | | Azure Virtual Machines (Azure VMs) | ✅ | | Google Compute Engine (GCE) | ✅ | | Google Kubernetes Engine (GKE) | ✅ | **Notes:** - The underlying Linux distribution and system configuration used by these cloud environments are the primary factors determining whether Workload Protection is supported. - For cloud environments where you can choose the Linux distribution and kernel version, select a configuration that meets the requirements listed above. ### Windows support{% #windows-support %} Workload Protection's Windows agent supports Windows Server 2019 and higher. ## Enable Workload Protection in Datadog{% #enable-workload-protection-in-datadog %} To get started with Workload Protection, you need to enable the Workload Protection product in Datadog. To do so, log in to your Datadog account, and click [Get Started](https://app.datadoghq.com/security/workload-protection/onboarding). You can follow the Agent deployment steps in Datadog, or come back to this page for more details. {% alert level="info" %} Activating Workload Protection requires the Org Management [permission](https://docs.datadoghq.com/account_management/rbac/permissions.md). {% /alert %} ## Deploy the Datadog Agent{% #deploy-the-datadog-agent %} ### Linux{% #linux %} Use the following instructions to enable the eBPF agent of Workload Protection in the Datadog Agent. - [kubernetes](https://docs.datadoghq.com/security/workload_protection/setup/kubernetes.md) - [docker](https://docs.datadoghq.com/security/workload_protection/setup/docker.md) - [ecs_ec2](https://docs.datadoghq.com/security/workload_protection/setup/ecs_ec2.md) - [linux_ebpf](https://docs.datadoghq.com/security/workload_protection/setup/linux_ebpf.md) ### AWS Fargate{% #aws-fargate %} Use the following instructions to setup the cws-instrumentation tracer of Workload Protection on AWS Fargate. - [fargate](https://docs.datadoghq.com/security/workload_protection/setup/fargate.md) ### Windows{% #windows %} Use the following instructions to enable the Windows agent of Workload Protection in the Datadog Agent. - [windows](https://docs.datadoghq.com/security/workload_protection/setup/windows.md) ## Next steps{% #next-steps %} After setup, you can explore Workload Protection, configure the Agent for your environment, or request access to Automated response. ### Explore Workload Protection{% #explore-workload-protection %} Datadog provides a testing playground for discovering Workload Protection and learning its capabilities. The playground offers various scenarios you can run safely in a test environment, simulating threats and real world attacks that Workload Protection can detect and protect you from. See the [playground repository](https://github.com/DataDog/datadog-security-playground) to get started. ### Configure the Agent{% #configure-the-agent %} The [advanced Agent configuration page](https://docs.datadoghq.com/security/workload_protection/setup/advanced_configuration.md) describes how to configure and tune the Agent to better fit your environment and needs. ### Enable automated response{% #enable-automated-response %} {% alert level="danger" %} Contact [Datadog Support](https://docs.datadoghq.com/help/) to enable Automated response. {% /alert %} After you are granted access to Automated response, see the [Automated response](https://docs.datadoghq.com/security/workload_protection/respond_and_report.md#automated-response) page.