diff --git a/content/en/security/cloud_security_management/setup/agent/kubernetes.md b/content/en/security/cloud_security_management/setup/agent/kubernetes.md index ad844e9aad3..6e8c7343b0d 100644 --- a/content/en/security/cloud_security_management/setup/agent/kubernetes.md +++ b/content/en/security/cloud_security_management/setup/agent/kubernetes.md @@ -58,7 +58,7 @@ Use the following instructions to enable Misconfigurations and Vulnerability Man analyzers: ["os", "languages"] # Enables runtime package prioritization (Preview, Agent 7.79+) - # See Runtime Package Tracking section below. + # See Runtime Package Prioritization section below. enrichment: usage: enabled: true @@ -99,7 +99,7 @@ Use the following instructions to enable Misconfigurations and Vulnerability Man analyzers: ["os", "languages"] # Enables runtime package prioritization (Preview, Agent 7.79+) - # See Runtime Package Tracking section below. + # See Runtime Package Prioritization section below. enrichment: usage: enabled: true @@ -111,7 +111,7 @@ Use the following instructions to enable Misconfigurations and Vulnerability Man {{% tab "DaemonSet" %}} -1. Add the following environment variables to every Agent container in the `daemonset.yaml` file, including `agent`, `security-agent`, and `system-probe`. These variables enable Misconfigurations, Vulnerability Management, mount-based container image scanning, and runtime package tracking. +1. Add the following environment variables to every Agent container in the `daemonset.yaml` file, including `agent`, `security-agent`, and `system-probe`. These variables enable Misconfigurations, Vulnerability Management, mount-based container image scanning, and runtime package prioritization. ```yaml - name: DD_COMPLIANCE_CONFIG_ENABLED @@ -166,7 +166,7 @@ Use the following instructions to enable Misconfigurations and Vulnerability Man {{< /tabs >}} -**Note**: `enrichment.usage.enabled: true` is in Preview and requires Datadog Agent **7.79.0 or later**. From 7.79.0, runtime package tracking runs independently of [Workload Protection][8] and does not affect its usage. See the [Runtime Package Tracking](#runtime-package-tracking-preview) section for more details. +**Note**: `enrichment.usage.enabled: true` is in Preview and requires Datadog Agent **7.79.0 or later**. From 7.79.0, runtime package prioritization runs independently of [Workload Protection][8] and does not affect its usage. See the [Runtime Package Prioritization](#runtime-package-prioritization-preview) section for more details. **Note**: The `languages` analyzer requires Datadog Agent **7.70 or later**. When enabled, it detects vulnerabilities in application libraries managed by the package managers below, in addition to OS packages. When the `analyzers` field is omitted, Datadog only scans OS packages for container images. @@ -190,9 +190,9 @@ The `languages` analyzer covers the following package ecosystems: | Elixir | Mix lock | | Julia | Julia | -## Runtime Package Tracking (Preview) +## Runtime Package Prioritization (Preview) -Runtime package tracking enriches each vulnerability finding with real-time signals from the running environment. When enabled, the Agent uses eBPF to monitor file access at runtime and records how packages are actually used by running processes. +Runtime package prioritization enriches each vulnerability finding with real-time signals from the running environment. When enabled, the Agent uses eBPF to monitor file access at runtime and records how packages are actually used by running processes. Each vulnerability finding is enriched with the following signals: @@ -208,7 +208,7 @@ These signals power vulnerability prioritization in Cloud Security, surfacing fi - Datadog Agent **7.79.0 or later** - Linux only (eBPF dependency) -**Note**: Use Datadog Agent **7.79.0 or later**. Earlier Agent versions enable this feature through [Workload Protection][8] and can affect its usage. From 7.79.0, runtime package tracking runs independently and does not affect its usage. +**Note**: Use Datadog Agent **7.79.0 or later**. Earlier Agent versions enable this feature through [Workload Protection][8] and can affect its usage. From 7.79.0, runtime package prioritization runs independently and does not affect its usage. {{< tabs >}} diff --git a/content/en/security/cloud_security_management/setup/agent/linux.md b/content/en/security/cloud_security_management/setup/agent/linux.md index 5cda464280d..35a1d292932 100644 --- a/content/en/security/cloud_security_management/setup/agent/linux.md +++ b/content/en/security/cloud_security_management/setup/agent/linux.md @@ -45,13 +45,13 @@ sbom: # Enables scanning of application libraries in addition to OS packages (Agent 7.70+) analyzers: ["os", "languages"] # Enables runtime package prioritization (Preview, Agent 7.79+) - # See Runtime Package Tracking section below. + # See Runtime Package Prioritization section below. enrichment: usage: enabled: true {{< /code-block >}} -**Note**: `enrichment.usage.enabled: true` is in Preview and requires Datadog Agent **7.79.0 or later**. From 7.79.0, runtime package tracking runs independently of [Workload Protection][7] and does not affect its usage. See the [Runtime Package Tracking](#runtime-package-tracking-preview) section for more details. +**Note**: `enrichment.usage.enabled: true` is in Preview and requires Datadog Agent **7.79.0 or later**. From 7.79.0, runtime package prioritization runs independently of [Workload Protection][7] and does not affect its usage. See the [Runtime Package Prioritization](#runtime-package-prioritization-preview) section for more details. {{< code-block lang="bash" filename="/etc/datadog-agent/security-agent.yaml" disable_copy="false" collapsible="true" >}} compliance_config: @@ -85,9 +85,9 @@ The `languages` analyzer covers the following package ecosystems: | Elixir | Mix lock | | Julia | Julia | -## Runtime Package Tracking (Preview) +## Runtime Package Prioritization (Preview) -Runtime package tracking enriches each vulnerability finding with real-time signals from the running environment. When enabled, the Agent uses eBPF to monitor file access at runtime and records how packages are actually used by running processes. +Runtime package prioritization enriches each vulnerability finding with real-time signals from the running environment. When enabled, the Agent uses eBPF to monitor file access at runtime and records how packages are actually used by running processes. Each vulnerability finding is enriched with the following signals: @@ -103,7 +103,7 @@ These signals power vulnerability prioritization in Cloud Security, surfacing fi - Datadog Agent **7.79.0 or later** - Linux only (eBPF dependency) -**Note**: Use Datadog Agent **7.79.0 or later**. Earlier Agent versions enable this feature through [Workload Protection][7] and can affect its usage. From 7.79.0, runtime package tracking runs independently and does not affect its usage. +**Note**: Use Datadog Agent **7.79.0 or later**. Earlier Agent versions enable this feature through [Workload Protection][7] and can affect its usage. From 7.79.0, runtime package prioritization runs independently and does not affect its usage. Add the `enrichment` block to the `sbom` section of your `datadog.yaml` file: diff --git a/content/en/security/cloud_security_management/triage_and_prioritize/runtime_prioritization_engine.md b/content/en/security/cloud_security_management/triage_and_prioritize/runtime_prioritization_engine.md index 7d040f5f129..65a0502264f 100644 --- a/content/en/security/cloud_security_management/triage_and_prioritize/runtime_prioritization_engine.md +++ b/content/en/security/cloud_security_management/triage_and_prioritize/runtime_prioritization_engine.md @@ -47,14 +47,12 @@ Crown Jewels update continuously as your environment changes. You can also add y When ownership is known, the engine can route findings to the right team instead of leaving security teams to manually chase remediation owners. - ## Get started 1. Deploy the Datadog Agent version 7.79 or later with Cloud Security enabled. See [Setting Up Cloud Security][3]. -2. Enable [Runtime Package Tracking][4] on the Agent to surface the *package in use* signal on vulnerability findings. +2. Enable Runtime Package Prioritization on the Agent to surface the *Package is running* signal on vulnerability findings. See the instructions to do so for [Kubernetes][4], [Docker][9], or [Linux][10] deployments. 3. Open the [{{< ui >}}Cloud Security Summary{{< /ui >}}][5] in Datadog. Prioritized findings are surfaced at the top of each funnel and in the [{{< ui >}}Security Inbox{{< /ui >}}][6]. - ## Further reading {{< partial name="whats-next/whats-next.html" >}} @@ -62,8 +60,10 @@ When ownership is known, the engine can route findings to the right team instead [1]: https://www.cisa.gov/known-exploited-vulnerabilities-catalog [2]: https://www.first.org/epss/ [3]: /security/cloud_security_management/setup/ -[4]: /security/cloud_security_management/setup/agent/ +[4]: /security/cloud_security_management/setup/agent/kubernetes/#runtime-package-prioritization-preview [5]: https://app.datadoghq.com/security/csm [6]: /security/security_inbox/ [7]: /security/cloud_security_management/guide/frontier_group/ownership_agent/ -[8]: /security/cloud_security_management/crown_jewels/ \ No newline at end of file +[8]: /security/cloud_security_management/crown_jewels/ +[9]: /security/cloud_security_management/setup/agent/docker/#runtime-package-prioritization-preview +[10]: /security/cloud_security_management/setup/agent/linux/#runtime-package-prioritization-preview