---
title: Workload Protection Agent configuration
description: Public Workload Protection Agent configuration settings
breadcrumbs: >-
  Docs > Datadog Security > Workload Protection > Setting up Workload Protection
  > Workload Protection Agent configuration
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Workload Protection Agent configuration

The Workload Protection Agent has several configuration settings to modify the agent and its behavior. The following parameters are available for both `system-probe` and the `security-agent`, two components that are required for Workload Protection to function properly.

## `security-agent` configuration parameters{% #security-agent-configuration-parameters %}

{% alert level="warning" %}
From `7.77`, the security-agent runtime for CWS is effectively deprecated: it is not used anymore and this section can be ignored.
{% /alert %}

{% alert level="info" %}
Parameters can be provided in two different manners: through environment variables (given to the Datadog Agent container for example) or by editing the `/etc/datadog-agent/security-agent.yaml` configuration file.
{% /alert %}

| Environment variable                 | `security-agent.yaml` attribute   | Type | Default | Description                                              |
| ------------------------------------ | --------------------------------- | ---- | ------- | -------------------------------------------------------- |
| `DD_RUNTIME_SECURITY_CONFIG_ENABLED` | `runtime_security_config.enabled` | bool | false   | Enables Workload Protection for agent versions < `7.77`. |

## `system-probe` configuration parameters{% #system-probe-configuration-parameters %}

The following settings can be configured under `runtime_security_config` in the system-probe configuration file.

{% alert level="info" %}
Parameters can be provided in two different manners: through environment variables (given to the Datadog Agent container for example) or by editing the `/etc/datadog-agent/system-probe.yaml` configuration file.
{% /alert %}

| Environment variable                                         | `system-probe.yaml` attribute                             | Type                  | Default                      | Description                                                                                             |
| ------------------------------------------------------------ | --------------------------------------------------------- | --------------------- | ---------------------------- | ------------------------------------------------------------------------------------------------------- |
| `DD_RUNTIME_SECURITY_CONFIG_ENABLED`                         | `runtime_security_config.enabled`                         | bool                  | false                        | Defines if the runtime security module should be enabled                                                |
| `DD_RUNTIME_SECURITY_CONFIG_ENFORCEMENT_EXCLUDE_BINARIES`    | `runtime_security_config.enforcement.exclude_binaries`    | []string              | []                           | EnforcementBinaryExcluded defines the list of binaries that are excluded from the enforcement           |
| `DD_RUNTIME_SECURITY_CONFIG_ENFORCEMENT_RULE_SOURCE_ALLOWED` | `runtime_security_config.enforcement.rule_source_allowed` | []string              | ["file", "remote-config"]    | EnforcementRuleSourceAllowed defines the list of rule sources that are allowed                          |
| `DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_CACHE_SIZE`        | `runtime_security_config.hash_resolver.cache_size`        | int                   | 500                          | HashResolverCacheSize defines the number of hashes to keep in cache                                     |
| `DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_ENABLED`           | `runtime_security_config.hash_resolver.enabled`           | bool                  | true                         | HashResolverEnabled defines if the hash resolver should be enabled                                      |
| `DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_EVENT_TYPES`       | `runtime_security_config.hash_resolver.event_types`       | []model.EventType     | ["exec", "open"]             | HashResolverEventTypes defines the list of event which files may be hashed                              |
| `DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_HASH_ALGORITHMS`   | `runtime_security_config.hash_resolver.hash_algorithms`   | []model.HashAlgorithm | ["sha1", "sha256", "ssdeep"] | HashResolverHashAlgorithms defines the hashes that hash resolver needs to compute                       |
| `DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_MAX_FILE_SIZE`     | `runtime_security_config.hash_resolver.max_file_size`     | int64                 | 5242880                      | HashResolverMaxFileSize defines the maximum size of the files that the hash resolver is allowed to hash |
| `DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_MAX_HASH_RATE`     | `runtime_security_config.hash_resolver.max_hash_rate`     | int                   | 500                          | HashResolverMaxHashRate defines the rate at which the hash resolver may compute hashes                  |
| `DD_RUNTIME_SECURITY_CONFIG_USER_SESSIONS_SSH_ENABLED`       | `runtime_security_config.user_sessions.ssh.enabled`       | bool                  | true                         | SSHUserSessionsEnabled defines if SSH user session features should be enabled                           |

### `system-probe` advanced settings{% #system-probe-advanced-settings %}

{% alert level="warning" %}
The following settings are intended for advanced use cases only. Modifying them without fully understanding their impact may disrupt Datadog Workload Protection or affect the behavior of the Datadog Agent and the host system.
{% /alert %}

| Environment variable                                             | `system-probe.yaml` attribute                                 | Type | Default | Description                                                                           |
| ---------------------------------------------------------------- | ------------------------------------------------------------- | ---- | ------- | ------------------------------------------------------------------------------------- |
| `DD_RUNTIME_SECURITY_CONFIG_SYSCALLS_CAPTURE_ALL_ERRORS_ENABLED` | `runtime_security_config.syscalls.capture_all_errors.enabled` | bool | false   | CaptureAllSyscallErrorsEnabled defines if the agent should capture all syscall errors |