Overview

Datadog Application Security Management (ASM) helps secure your web applications and APIs in production. ASM provides visibility into application-level vulnerabilities in your services, and protects in real-time from attacks and attackers that aim to exploit these vulnerabilities.

This guide walks you through best practices for getting your team up and running with ASM.

Identify services that have security risk

Identify services vulnerable or exposed to attacks that would benefit from ASM. On the Service Catalog > Security page, view and select the services you wish to enable.

These security insights are detected from data reported by APM. The insights help prioritize your security efforts. ASM identifies, prioritizes, and helps remediate all security risks on your services.

Note: If no vulnerabilities or suspicious requests are reported, ensure your services are using a recent Datadog tracing library version. From the Security Service Catalog, open any service’s side panel and look at its Tracing Configuration.

Enable ASM

Enable ASM with in-app instructions

On the ASM landing page, follow the instructions to get started. This includes:

• Guided selection of services that would benefit from ASM.
• Configuring your Datadog tracing libraries with an environment variable.
• Restarting your services.
  

1. Click Get Started with ASM.

2. Select Get Started to detect vulnerabilities in open-source libraries (Software Composition Analysis), find and fix code-level vulnerabilities (Code Security), and find and enable threat detection on your services (Threat Management).

3. Follow the instructions to get started with ASM.

Enable ASM with Remote Configuration

Prerequisites:

• Datadog Agent versions 7.42.0 or higher installed on your hosts or containers.
• Datadog Tracer versions are compatible with Remote Configuration.

Setup Remote Configuration (if not enabled already)

Follow the steps to enable Remote Configuration in your Datadog UI. This includes:

1. Activate Remote Config capability for your organization.
2. Add Remote Configuration capability to an existing API key, or create a new one.
3. Update your Datadog Agent configuration to use the API key with Remote Configuration capability.

See Setting up Remote Configuration for more information.

Test ASM

Once enabled, ASM immediately identifies application vulnerabilities and detects attacks and attackers targeting your services.

1. Validate vulnerabilities: Navigate to the Vulnerabilities tab, triage and remediate your vulnerabilities.
2. Validate attacks: Send attack patterns to trigger a test detection rule. From your terminal, run the following script:

  for ((i=1;i<=250;i++)); do
  # Target existing service's routes
  curl https://your-application-url/<EXISTING ROUTE> -A
  'dd-test-scanner-log';
  # Target non existing service's routes
  curl https://your-application-url/<NON-EXISTING ROUTE> -A
  'dd-test-scanner-log';
  done

3. Go to Security Signals Explorer to see the signal that is generated after a few seconds.

Disable ASM

For information on disabling ASM or its features, see the following:

• Disabling threat management and protection
• Disabling Software Composition Analysis
• Disabling Code Security

Reports and notifications

1. Set up notification rules to receive alerts using Slack, Jira, email, and more.
2. Subscribe to the weekly threat digest reports to begin investigation and remediation of the most important security threats discovered in the last seven days.

Interested in best practices to go further? View the in-product Quickstart Guide.

Further reading

Additional helpful documentation, links, and articles:

Application Security terms and conceptsDOCUMENTATION How Application Security Management worksDOCUMENTATION Join an interactive session to elevate your security and threat detectionFOUNDATION ENABLEMENT Getting Started with Software Composition AnalysisGUIDE Security research, reports, tips, and videos from DatadogSECURITY LABS