Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ Use the following instructions to enable Misconfigurations and Vulnerability Man
analyzers: ["os", "languages"]

# Enables runtime package prioritization (Preview, Agent 7.79+)
# See Runtime Package Tracking section below.
# See Runtime Package Prioritization section below.
enrichment:
usage:
enabled: true
Expand Down Expand Up @@ -99,7 +99,7 @@ Use the following instructions to enable Misconfigurations and Vulnerability Man
analyzers: ["os", "languages"]
# Enables runtime package prioritization (Preview, Agent 7.79+)
# See Runtime Package Tracking section below.
# See Runtime Package Prioritization section below.
enrichment:
usage:
enabled: true
Expand All @@ -111,7 +111,7 @@ Use the following instructions to enable Misconfigurations and Vulnerability Man

{{% tab "DaemonSet" %}}

1. Add the following environment variables to every Agent container in the `daemonset.yaml` file, including `agent`, `security-agent`, and `system-probe`. These variables enable Misconfigurations, Vulnerability Management, mount-based container image scanning, and runtime package tracking.
1. Add the following environment variables to every Agent container in the `daemonset.yaml` file, including `agent`, `security-agent`, and `system-probe`. These variables enable Misconfigurations, Vulnerability Management, mount-based container image scanning, and runtime package prioritization.

```yaml
- name: DD_COMPLIANCE_CONFIG_ENABLED
Expand Down Expand Up @@ -166,7 +166,7 @@ Use the following instructions to enable Misconfigurations and Vulnerability Man

{{< /tabs >}}

**Note**: `enrichment.usage.enabled: true` is in Preview and requires Datadog Agent **7.79.0 or later**. From 7.79.0, runtime package tracking runs independently of [Workload Protection][8] and does not affect its usage. See the [Runtime Package Tracking](#runtime-package-tracking-preview) section for more details.
**Note**: `enrichment.usage.enabled: true` is in Preview and requires Datadog Agent **7.79.0 or later**. From 7.79.0, runtime package prioritization runs independently of [Workload Protection][8] and does not affect its usage. See the [Runtime Package Prioritization](#runtime-package-prioritization-preview) section for more details.

**Note**: The `languages` analyzer requires Datadog Agent **7.70 or later**. When enabled, it detects vulnerabilities in application libraries managed by the package managers below, in addition to OS packages. When the `analyzers` field is omitted, Datadog only scans OS packages for container images.

Expand All @@ -190,9 +190,9 @@ The `languages` analyzer covers the following package ecosystems:
| Elixir | Mix lock |
| Julia | Julia |

## Runtime Package Tracking (Preview)
## Runtime Package Prioritization (Preview)

Runtime package tracking enriches each vulnerability finding with real-time signals from the running environment. When enabled, the Agent uses eBPF to monitor file access at runtime and records how packages are actually used by running processes.
Runtime package prioritization enriches each vulnerability finding with real-time signals from the running environment. When enabled, the Agent uses eBPF to monitor file access at runtime and records how packages are actually used by running processes.

Each vulnerability finding is enriched with the following signals:

Expand All @@ -208,7 +208,7 @@ These signals power vulnerability prioritization in Cloud Security, surfacing fi
- Datadog Agent **7.79.0 or later**
- Linux only (eBPF dependency)

**Note**: Use Datadog Agent **7.79.0 or later**. Earlier Agent versions enable this feature through [Workload Protection][8] and can affect its usage. From 7.79.0, runtime package tracking runs independently and does not affect its usage.
**Note**: Use Datadog Agent **7.79.0 or later**. Earlier Agent versions enable this feature through [Workload Protection][8] and can affect its usage. From 7.79.0, runtime package prioritization runs independently and does not affect its usage.

{{< tabs >}}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -45,13 +45,13 @@ sbom:
# Enables scanning of application libraries in addition to OS packages (Agent 7.70+)
analyzers: ["os", "languages"]
# Enables runtime package prioritization (Preview, Agent 7.79+)
# See Runtime Package Tracking section below.
# See Runtime Package Prioritization section below.
enrichment:
usage:
enabled: true
{{< /code-block >}}

**Note**: `enrichment.usage.enabled: true` is in Preview and requires Datadog Agent **7.79.0 or later**. From 7.79.0, runtime package tracking runs independently of [Workload Protection][7] and does not affect its usage. See the [Runtime Package Tracking](#runtime-package-tracking-preview) section for more details.
**Note**: `enrichment.usage.enabled: true` is in Preview and requires Datadog Agent **7.79.0 or later**. From 7.79.0, runtime package prioritization runs independently of [Workload Protection][7] and does not affect its usage. See the [Runtime Package Prioritization](#runtime-package-prioritization-preview) section for more details.

{{< code-block lang="bash" filename="/etc/datadog-agent/security-agent.yaml" disable_copy="false" collapsible="true" >}}
compliance_config:
Expand Down Expand Up @@ -85,9 +85,9 @@ The `languages` analyzer covers the following package ecosystems:
| Elixir | Mix lock |
| Julia | Julia |

## Runtime Package Tracking (Preview)
## Runtime Package Prioritization (Preview)

Runtime package tracking enriches each vulnerability finding with real-time signals from the running environment. When enabled, the Agent uses eBPF to monitor file access at runtime and records how packages are actually used by running processes.
Runtime package prioritization enriches each vulnerability finding with real-time signals from the running environment. When enabled, the Agent uses eBPF to monitor file access at runtime and records how packages are actually used by running processes.

Each vulnerability finding is enriched with the following signals:

Expand All @@ -103,7 +103,7 @@ These signals power vulnerability prioritization in Cloud Security, surfacing fi
- Datadog Agent **7.79.0 or later**
- Linux only (eBPF dependency)

**Note**: Use Datadog Agent **7.79.0 or later**. Earlier Agent versions enable this feature through [Workload Protection][7] and can affect its usage. From 7.79.0, runtime package tracking runs independently and does not affect its usage.
**Note**: Use Datadog Agent **7.79.0 or later**. Earlier Agent versions enable this feature through [Workload Protection][7] and can affect its usage. From 7.79.0, runtime package prioritization runs independently and does not affect its usage.

Add the `enrichment` block to the `sbom` section of your `datadog.yaml` file:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -47,23 +47,23 @@ Crown Jewels update continuously as your environment changes. You can also add y

When ownership is known, the engine can route findings to the right team instead of leaving security teams to manually chase remediation owners.


## Get started

1. Deploy the Datadog Agent version 7.79 or later with Cloud Security enabled. See [Setting Up Cloud Security][3].
2. Enable [Runtime Package Tracking][4] on the Agent to surface the *package in use* signal on vulnerability findings.
2. Enable Runtime Package Prioritization on the Agent to surface the *Package is running* signal on vulnerability findings. See the instructions to do so for [Kubernetes][4], [Docker][9], or [Linux][10] deployments.
3. Open the [{{< ui >}}Cloud Security Summary{{< /ui >}}][5] in Datadog. Prioritized findings are surfaced at the top of each funnel and in the [{{< ui >}}Security Inbox{{< /ui >}}][6].


## Further reading

{{< partial name="whats-next/whats-next.html" >}}

[1]: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
[2]: https://www.first.org/epss/
[3]: /security/cloud_security_management/setup/
[4]: /security/cloud_security_management/setup/agent/
[4]: /security/cloud_security_management/setup/agent/kubernetes/#runtime-package-prioritization-preview
[5]: https://app.datadoghq.com/security/csm
[6]: /security/security_inbox/
[7]: /security/cloud_security_management/guide/frontier_group/ownership_agent/
[8]: /security/cloud_security_management/crown_jewels/
[8]: /security/cloud_security_management/crown_jewels/
[9]: /security/cloud_security_management/setup/agent/docker/#runtime-package-prioritization-preview
[10]: /security/cloud_security_management/setup/agent/linux/#runtime-package-prioritization-preview
Loading