There are two types of monitoring that the Datadog Agent uses for Cloud Workload Security:
File Integrity Monitoring to watch for changes to key files and directories on hosts or containers in real-time.
Process Execution Monitoring to watch process executions for malicious activity on hosts or containers in real-time.
Requirements
Datadog Agent >= 7.27.0
Data collection is done using eBPF, so Datadog minimally requires platforms that have underlying Linux kernel versions of 4.15.0+ or have eBPF features backported. CWS supports the following Linux distributions:
Ubuntu 18.04+
Debian 10+
Amazon Linux 2
Fedora 26+
SUSE 15+
CentOS/RHEL 7.6+
Custom kernel builds are not supported.
Installation
If you have not already, install the Datadog Agent (version 7.27+).
Add the following to the datadog section of the values.yaml file:
# values.yaml filedatadog:# Add this to enable Cloud Workload SecuritysecurityAgent:runtime:enabled:true# Add this to enable the collection of CWS network events, only for Datadog Agent version 7.36network:enabled:true
Restart the Agent.
Optional, if Cloud SIEM is checked Follow these instructions to collect audit logs for Kubernetes.
The following command can be used to start the Runtime Security Agent and system-probe in a Docker environment:
For a package-based deployment, the Datadog package has to be deployed: run dkpg -i datadog-agent_7….deb
By default Runtime Security is disabled. To enable it, both the datadog.yaml and the system-probe.yaml files need to be adapted. Run the following commands to enable these configurations:
debian-runtime-security.sh
echo"runtime_security_config.enabled: true" >> /etc/datadog-agent/security-agent.yaml
echo"runtime_security_config.enabled: true" >> /etc/datadog-agent/system-probe.yaml
# For [Datadog Agent][1] version 7.36 only, to enable the collection of CWS network eventsecho"runtime_security_config.network.enabled: true" >> /etc/datadog-agent/system-probe.yaml
systemctl restart datadog-agent
Once you apply the changes, restart both the Security Agent and the system-probe.
For a package-based deployment, the Datadog package has to be deployed: run yum/dnf install datadog-agent_7….rpm
fedora-centos-runtime-security.sh
echo"runtime_security_config.enabled: true" >> /etc/datadog-agent/security-agent.yaml
echo"runtime_security_config.enabled: true" >> /etc/datadog-agent/system-probe.yaml
# For [Datadog Agent][1] version 7.36 only, to enable the collection of CWS network eventsecho"runtime_security_config.network.enabled: true" >> /etc/datadog-agent/system-probe.yaml
systemctl restart datadog-agent
Further Reading
Additional helpful documentation, links, and articles: