Application Security Management
Application Security Management is not supported for your selected
Datadog site (
).
Datadog Application Security Management (ASM) provides protection against application-level attacks that aim to exploit code-level vulnerabilities, such as Server-Side-Request-Forgery (SSRF), SQL injection, Log4Shell, and Reflected Cross-Site-Scripting (XSS). You can monitor and protect apps hosted directly on a server, Docker, Kubernetes, Amazon ECS, and (for supported languages) AWS Fargate.
ASM leverages Datadog tracing libraries, and the Datadog Agent to identify services exposed to application attacks. Once configured, ASM leverages in-app detection rules to detect and protect against threats in your application environment and trigger security signals whenever an attack impacts your production system, or a vulnerability is triggered from the code.
When a threat is detected, a security signal is generated in Datadog. For HIGH or CRITICAL severity security signals, notifications can be sent to Slack, email, or PagerDuty to notify your team and provide real-time context around threats.
Once a security signal is triggered, quickly pivot to investigate and protect in Datadog. Leverage the deep observability data provided by ASM and APM distributed tracing, in one view, to resolve application issues. Analyze attack flows, view flame graphs, and review correlated trace and log data to pinpoint application vulnerabilities. Eliminate context switching by flowing through application data into remediation and mitigation steps, all within the same panel.
With ASM, you can cut through the noise of continuous trace data to focus on securing and protecting your environment.
Until you fully remediate the potential vulnerabilities in your application code, ASM enables you to slow down attackers by blocking their IPs temporarily or permanently, with a single click.
Understanding how application security is implemented in Datadog
If you’re curious how Application Security Management is structured and how it uses tracing data to identify security problems, read How Application Security Management Works.
Powered by provided out-of-the-box rules, ASM detects threats without manual configuration. If you already have Datadog APM configured on a physical or virtual host, setup only requires setting one environment variable to get started.
To start configuring your environment to detect and protect threats with ASM, follow the enabling documentation for each product. Once ASM is configured, you can begin investigating and remediating security signals in the Security Signals Explorer.
In the Security Signals Explorer, click on any security signal to see what happened and the suggested steps to mitigate the attack. In the same panel, view traces with their correlated attack flow and request information to gain further context.
Investigate risk introduced in upstream open source libraries and dependencies
Software Composition Analysis (SCA) shows you when your services are at risk because they use or have dependencies on open source libraries that have known vulnerabilities. Investigate vulnerability findings and secure your software by following remediation advice or researching the cause of the vulnerability.
Detect vulnerabilities in your application’s code
Code Security identifies code-level vulnerabilities in your services and provides actionable insights and recommended fixes. It uses an Interactive Application Security Testing (IAST) approach to find vulnerabilities within your application code. IAST uses instrumentation embedded in your code like application performance monitoring (APM) and it enables Datadog to identify vulnerabilities using legitimate application traffic instead of relying on external tests that could require extra configuration or periodic scheduling.
Disable ASM
For information on disabling ASM or its features, see the following:
Next steps
Additional helpful documentation, links, and articles:
