Workload Protection Agent configuration
The Workload Protection Agent has several configuration settings to modify the agent and its behavior. The following parameters are available for both system-probe and the security-agent, two components that are required for Workload Protection to function properly.
security-agent configuration parameters
From 7.77, the security-agent runtime for CWS is effectively deprecated: it is not used anymore and this section can be ignored.
Parameters can be provided in two different manners: through environment variables (given to the Datadog Agent container for example) or by editing the /etc/datadog-agent/security-agent.yaml configuration file.
| Environment variable | security-agent.yaml attribute | Type | Default | Description |
|---|
DD_RUNTIME_SECURITY_CONFIG_ENABLED | runtime_security_config.enabled | bool | false | Enables Workload Protection for agent versions < 7.77. |
system-probe configuration parameters
The following settings can be configured under runtime_security_config in the system-probe configuration file.
Parameters can be provided in two different manners: through environment variables (given to the Datadog Agent container for example) or by editing the /etc/datadog-agent/system-probe.yaml configuration file.
| Environment variable | system-probe.yaml attribute | Type | Default | Description |
|---|
DD_RUNTIME_SECURITY_CONFIG_ENABLED | runtime_security_config.enabled | bool | false | Defines if the runtime security module should be enabled |
DD_RUNTIME_SECURITY_CONFIG_ENFORCEMENT_EXCLUDE_BINARIES | runtime_security_config.enforcement.exclude_binaries | []string | [] | EnforcementBinaryExcluded defines the list of binaries that are excluded from the enforcement |
DD_RUNTIME_SECURITY_CONFIG_ENFORCEMENT_RULE_SOURCE_ALLOWED | runtime_security_config.enforcement.rule_source_allowed | []string | [“file”, “remote-config”] | EnforcementRuleSourceAllowed defines the list of rule sources that are allowed |
DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_CACHE_SIZE | runtime_security_config.hash_resolver.cache_size | int | 500 | HashResolverCacheSize defines the number of hashes to keep in cache |
DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_ENABLED | runtime_security_config.hash_resolver.enabled | bool | true | HashResolverEnabled defines if the hash resolver should be enabled |
DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_EVENT_TYPES | runtime_security_config.hash_resolver.event_types | []model.EventType | [“exec”, “open”] | HashResolverEventTypes defines the list of event which files may be hashed |
DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_HASH_ALGORITHMS | runtime_security_config.hash_resolver.hash_algorithms | []model.HashAlgorithm | [“sha1”, “sha256”, “ssdeep”] | HashResolverHashAlgorithms defines the hashes that hash resolver needs to compute |
DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_MAX_FILE_SIZE | runtime_security_config.hash_resolver.max_file_size | int64 | 5242880 | HashResolverMaxFileSize defines the maximum size of the files that the hash resolver is allowed to hash |
DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_MAX_HASH_RATE | runtime_security_config.hash_resolver.max_hash_rate | int | 500 | HashResolverMaxHashRate defines the rate at which the hash resolver may compute hashes |
DD_RUNTIME_SECURITY_CONFIG_USER_SESSIONS_SSH_ENABLED | runtime_security_config.user_sessions.ssh.enabled | bool | true | SSHUserSessionsEnabled defines if SSH user session features should be enabled |
system-probe advanced settings
The following settings are intended for advanced use cases only. Modifying them without fully understanding their impact may disrupt Datadog Workload Protection or affect the behavior of the Datadog Agent and the host system.
| Environment variable | system-probe.yaml attribute | Type | Default | Description |
|---|
DD_RUNTIME_SECURITY_CONFIG_SYSCALLS_CAPTURE_ALL_ERRORS_ENABLED | runtime_security_config.syscalls.capture_all_errors.enabled | bool | false | CaptureAllSyscallErrorsEnabled defines if the agent should capture all syscall errors |
