---
title: Detect and Monitor
description: >-
  Understand the Agent rules, detection rules, finding rules, threat
  intelligence, and Content Packs that Workload Protection uses to detect
  threats.
breadcrumbs: Docs > Datadog Security > Workload Protection > Detect and Monitor
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Detect and Monitor

Workload Protection evaluates your workload activity against several kinds of rules. Together they detect threats, assess your runtime security posture, and provide granular audit capabilities. Agent rules select which activity reaches Datadog. Detection rules and finding rules analyze that activity. Threat intelligence enriches it with reputation context, and Content Packs bundle optional rules for specific software stacks and threat vectors.

For how these rules fit together in the detection pipeline, see [How Workload Protection works](https://docs.datadoghq.com/security/workload_protection.md#evaluating-activity).

## Agent rules{% #agent-rules %}

[Agent rules](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/agent_rules.md) define which system activity is sent to the Datadog backend for further analysis:

- [SECL guide](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/agent_rules/secl_guide.md) for writing custom agent rules with the SECL expression language
- [Policy management](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/agent_rules/policy_management.md) for deploying custom and default agent rules
- [Variables and actions](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/agent_rules/variables_and_actions.md) for stateful detections and additional telemetry collection
- [Linux expressions](https://docs.datadoghq.com/security/workload_protection/linux_expressions.md) and [Windows expressions](https://docs.datadoghq.com/security/workload_protection/windows_expressions.md) for the full set of queryable SECL fields

## Detection and finding rules{% #detection-and-finding-rules %}

[Detection and finding rules](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/detection_and_finding_rules.md) describe the backend logic used to analyze [Agent events](https://docs.datadoghq.com/security/workload_protection/investigate_and_triage/agent_events.md) and generate [signals](https://docs.datadoghq.com/security/workload_protection/investigate_and_triage/security_signals.md) or [findings](https://docs.datadoghq.com/security/workload_protection/investigate_and_triage/security_findings.md):

- [Detection rules](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/detection_and_finding_rules/detection_rules.md) for threat detection and incident response
- [Finding rules](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/detection_and_finding_rules/finding_rules.md) for runtime posture and hardening
- [Linux backend syntax](https://docs.datadoghq.com/security/workload_protection/backend_linux.md) and [Windows backend syntax](https://docs.datadoghq.com/security/workload_protection/backend_windows.md) for the full set of queryable event fields

## Threat intelligence{% #threat-intelligence %}

Workload Protection uses threat intelligence databases to enrich your [Agent Events](https://docs.datadoghq.com/security/workload_protection/investigate_and_triage/agent_events.md) and detect malware and known malicious entities. The [Threat Intelligence](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/threat_intelligence.md) page helps you:

- Explore the threat intelligence databases that are provided out-of-the-box (OOTB) with Workload Protection
- Import your own threat intelligence database and configure it to work with Workload Protection

## Content Packs{% #content-packs %}

Workload Protection provides targeted, Datadog-crafted [Content Packs](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/content_packs.md) built for specific software stacks, threat vectors, and emerging vulnerabilities. The [Content Packs](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/content_packs.md) page helps you:

- Explore and enable Content Packs for key workload security use cases
- Deploy optional detections only to the workloads where they apply
- Stay current with emerging threats through Datadog-managed rule updates