Workload Protection Agent configuration
The Workload Protection Agent has several configuration settings to modify the agent and its behavior. The following parameters are available for system-probe and the security-agent, two components that are required for Workload Protection to function properly.
system-probe configuration parameters
The following settings can be configured under runtime_security_config in the system-probe configuration file.
Parameters can be provided in two different manners: through environment variables (given to the Datadog Agent container for example) or by editing the /etc/datadog-agent/system-probe.yaml configuration file.
| Setting | Type | Default | Description |
|---|
Environment variable
DD_RUNTIME_SECURITY_CONFIG_ENABLED
YAML attribute
runtime_security_config.enabled | bool | false | Enables Workload Protection |
Environment variable
DD_RUNTIME_SECURITY_CONFIG_ENFORCEMENT_EXCLUDE_BINARIES
YAML attribute
runtime_security_config.enforcement.exclude_binaries | []string | [] | EnforcementBinaryExcluded defines the list of binaries that are excluded from the enforcement |
Environment variable
DD_RUNTIME_SECURITY_CONFIG_ENFORCEMENT_RULE_SOURCE_ALLOWED
YAML attribute
runtime_security_config.enforcement.rule_source_allowed | []string | [“file”, “remote-config”] | EnforcementRuleSourceAllowed defines the list of rule sources that are allowed |
Environment variable
DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_CACHE_SIZE
YAML attribute
runtime_security_config.hash_resolver.cache_size | int | 500 | HashResolverCacheSize defines the number of hashes to keep in cache |
Environment variable
DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_ENABLED
YAML attribute
runtime_security_config.hash_resolver.enabled | bool | true | HashResolverEnabled defines whether the hash resolver should be enabled |
Environment variable
DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_EVENT_TYPES
YAML attribute
runtime_security_config.hash_resolver.event_types | []model.EventType | [“exec”, “open”] | HashResolverEventTypes defines the list of event which files may be hashed |
Environment variable
DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_HASH_ALGORITHMS
YAML attribute
runtime_security_config.hash_resolver.hash_algorithms | []model.HashAlgorithm | [“sha1”, “sha256”, “ssdeep”] | HashResolverHashAlgorithms defines the hashes that hash resolver needs to compute. Possible values are sha1, sha256, md5, ssdeep. |
Environment variable
DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_MAX_FILE_SIZE
YAML attribute
runtime_security_config.hash_resolver.max_file_size | int64 | 5242880 | HashResolverMaxFileSize defines the maximum size of the files that the hash resolver is allowed to hash |
Environment variable
DD_RUNTIME_SECURITY_CONFIG_HASH_RESOLVER_MAX_HASH_RATE
YAML attribute
runtime_security_config.hash_resolver.max_hash_rate | int | 500 | HashResolverMaxHashRate defines the rate at which the hash resolver may compute hashes |
Environment variable
DD_RUNTIME_SECURITY_CONFIG_USER_SESSIONS_SSH_ENABLED
YAML attribute
runtime_security_config.user_sessions.ssh.enabled | bool | true | SSHUserSessionsEnabled defines whether SSH user session features should be enabled |
system-probe advanced settings
The following settings are intended for advanced use cases only. Modifying them without fully understanding their impact may disrupt Datadog Workload Protection or affect the behavior of the Datadog Agent and the host system.
| Setting | Type | Default | Description |
|---|
Environment variable
DD_RUNTIME_SECURITY_CONFIG_SYSCALLS_CAPTURE_ALL_ERRORS_ENABLED
YAML attribute
runtime_security_config.syscalls.capture_all_errors.enabled | bool | false | CaptureAllSyscallErrorsEnabled defines whether the agent should capture all syscall errors |
security-agent configuration parameters
From 7.77, the security-agent runtime for CWS is effectively deprecated: it is not used anymore and this section can be ignored.
Parameters can be provided in two different manners: through environment variables (given to the Datadog Agent container for example) or by editing the /etc/datadog-agent/security-agent.yaml configuration file.
| Setting | Type | Default | Description |
|---|
Environment variable
DD_RUNTIME_SECURITY_CONFIG_ENABLED
YAML attribute
runtime_security_config.enabled | bool | false | Enables Workload Protection for agent versions < 7.77. |
