-
Notifications
You must be signed in to change notification settings - Fork 1.3k
docs(cloud-security): correct runtime package tracking version + remove WP cost warning #36954
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from 1 commit
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -70,10 +70,10 @@ Each vulnerability finding is enriched with the following signals: | |||||
| These signals power vulnerability prioritization in Cloud Security, surfacing findings where vulnerable code is confirmed running in production. | ||||||
|
|
||||||
| **Requirements**: | ||||||
| - Datadog Agent **7.78.0 or later** | ||||||
| - Datadog Agent **7.79.0 or later** | ||||||
| - Linux only (eBPF dependency) | ||||||
|
|
||||||
| **Important**: Enabling runtime package prioritization activates [Workload Protection][4] for runtime file access monitoring, which may trigger additional Workload Protection usage and costs. | ||||||
| **Note**: Use Datadog Agent **7.79.0 or later**. Earlier Agent versions enable this feature through Workload Protection, which can affect Workload Protection usage. From 7.79.0, runtime package prioritization runs independently and does not affect Workload Protection usage. | ||||||
|
|
||||||
| Add `DD_SBOM_ENRICHMENT_USAGE_ENABLED=true` to your Docker run command: | ||||||
|
|
||||||
|
|
@@ -87,7 +87,7 @@ docker run -d --name dd-agent \ | |||||
| registry.datadoghq.com/agent:7 | ||||||
| {{< /code-block >}} | ||||||
|
|
||||||
| **Note**: `DD_SBOM_ENRICHMENT_USAGE_ENABLED=true` is in Preview and requires Agent **7.78.0 or later**. It activates [Workload Protection][4] for runtime file access monitoring, which may trigger additional Workload Protection usage and costs. See the [Runtime Package Prioritization](#runtime-package-prioritization-preview) section for more details. | ||||||
| **Note**: `DD_SBOM_ENRICHMENT_USAGE_ENABLED=true` is in Preview and requires Datadog Agent **7.79.0 or later**. From 7.79.0, runtime package prioritization runs independently of [Workload Protection][4] and does not affect Workload Protection usage. See the [Runtime Package Prioritization](#runtime-package-prioritization-preview) section for more details. | ||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
This content is already in that section, so I don't think we need to link to itself |
||||||
|
|
||||||
| [1]: /security/cloud_security_management/misconfigurations/ | ||||||
| [2]: /security/threats | ||||||
|
|
||||||
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -57,8 +57,8 @@ Use the following instructions to enable Misconfigurations and Vulnerability Man | |||||
| # Enables scanning of application libraries in addition to OS packages (Agent 7.70+) | ||||||
| analyzers: ["os", "languages"] | ||||||
|
|
||||||
| # Enables runtime package prioritization (Preview, Agent 7.78+) | ||||||
| # Note: activates Workload Protection — may incur additional costs. See Runtime Package Prioritization section below. | ||||||
| # Enables runtime package prioritization (Preview, Agent 7.79+) | ||||||
| # See Runtime Package Tracking section below. | ||||||
| enrichment: | ||||||
| usage: | ||||||
| enabled: true | ||||||
|
|
@@ -98,8 +98,8 @@ Use the following instructions to enable Misconfigurations and Vulnerability Man | |||||
| # Enables scanning of application libraries in addition to OS packages (Agent 7.70+) | ||||||
| analyzers: ["os", "languages"] | ||||||
|
|
||||||
| # Enables runtime package prioritization (Preview, Agent 7.78+) | ||||||
| # Note: activates Workload Protection — may incur additional costs. See Runtime Package Prioritization section below. | ||||||
| # Enables runtime package prioritization (Preview, Agent 7.79+) | ||||||
| # See Runtime Package Tracking section below. | ||||||
| enrichment: | ||||||
| usage: | ||||||
| enabled: true | ||||||
|
|
@@ -111,7 +111,7 @@ Use the following instructions to enable Misconfigurations and Vulnerability Man | |||||
|
|
||||||
| {{< /tabs >}} | ||||||
|
|
||||||
| **Note**: `enrichment.usage.enabled: true` is in Preview and requires Agent **7.78.0 or later**. It activates [Workload Protection][8] for runtime file access monitoring, which may trigger additional Workload Protection usage and costs. See the [Runtime Package Prioritization](#runtime-package-prioritization-preview) section for more details. | ||||||
| **Note**: `enrichment.usage.enabled: true` is in Preview and requires Datadog Agent **7.79.0 or later**. From 7.79.0, runtime package tracking runs independently of [Workload Protection][8] and does not affect Workload Protection usage. See the [Runtime Package Tracking](#runtime-package-tracking-preview) section for more details. | ||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
|
||||||
|
|
||||||
| **Note**: The `languages` analyzer requires Datadog Agent **7.70 or later**. When enabled, it detects vulnerabilities in application libraries managed by the package managers below, in addition to OS packages. When the `analyzers` field is omitted, Datadog only scans OS packages for container images. | ||||||
|
|
||||||
|
|
@@ -150,10 +150,10 @@ Each vulnerability finding is enriched with the following signals: | |||||
| These signals power vulnerability prioritization in Cloud Security, surfacing findings where vulnerable code is confirmed running in production. | ||||||
|
|
||||||
| **Requirements**: | ||||||
| - Datadog Agent **7.78.0 or later** | ||||||
| - Datadog Agent **7.79.0 or later** | ||||||
| - Linux only (eBPF dependency) | ||||||
|
|
||||||
| **Important**: Enabling runtime package tracking activates [Workload Protection][8] for runtime file access monitoring, which may trigger additional Workload Protection usage and costs. | ||||||
| **Note**: Use Datadog Agent **7.79.0 or later**. Earlier Agent versions enable this feature through [Workload Protection][8], which can affect Workload Protection usage. From 7.79.0, runtime package tracking runs independently and does not affect Workload Protection usage. | ||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
|
||||||
|
|
||||||
| {{< tabs >}} | ||||||
|
|
||||||
|
|
@@ -168,7 +168,7 @@ spec: | |||||
| enabled: true | ||||||
| containerImage: | ||||||
| enabled: true | ||||||
| # Enables runtime package prioritization (Preview, Agent 7.78+) | ||||||
| # Enables runtime package prioritization (Preview, Agent 7.79+) | ||||||
| enrichment: | ||||||
| usage: | ||||||
| enabled: true | ||||||
|
|
@@ -187,7 +187,7 @@ datadog: | |||||
| sbom: | ||||||
| containerImage: | ||||||
| enabled: true | ||||||
| # Enables runtime package prioritization (Preview, Agent 7.78+) | ||||||
| # Enables runtime package prioritization (Preview, Agent 7.79+) | ||||||
| enrichment: | ||||||
| usage: | ||||||
| enabled: true | ||||||
|
|
||||||
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -44,14 +44,14 @@ sbom: | |||||
| enabled: true | ||||||
| # Enables scanning of application libraries in addition to OS packages (Agent 7.70+) | ||||||
| analyzers: ["os", "languages"] | ||||||
| # Enables runtime package prioritization (Preview, Agent 7.78+) | ||||||
| # Note: activates Workload Protection — may incur additional costs. See Runtime Package Prioritization section below. | ||||||
| # Enables runtime package prioritization (Preview, Agent 7.79+) | ||||||
| # See Runtime Package Tracking section below. | ||||||
| enrichment: | ||||||
| usage: | ||||||
| enabled: true | ||||||
| {{< /code-block >}} | ||||||
|
|
||||||
| **Note**: `enrichment.usage.enabled: true` is in Preview and requires Agent **7.78.0 or later**. It activates [Workload Protection][7] for runtime file access monitoring, which may trigger additional Workload Protection usage and costs. See the [Runtime Package Prioritization](#runtime-package-prioritization-preview) section for more details. | ||||||
| **Note**: `enrichment.usage.enabled: true` is in Preview and requires Datadog Agent **7.79.0 or later**. From 7.79.0, runtime package tracking runs independently of [Workload Protection][7] and does not affect Workload Protection usage. See the [Runtime Package Tracking](#runtime-package-tracking-preview) section for more details. | ||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
|
||||||
|
|
||||||
| {{< code-block lang="bash" filename="/etc/datadog-agent/security-agent.yaml" disable_copy="false" collapsible="true" >}} | ||||||
| compliance_config: | ||||||
|
|
@@ -100,10 +100,10 @@ Each vulnerability finding is enriched with the following signals: | |||||
| These signals power vulnerability prioritization in Cloud Security, surfacing findings where vulnerable code is confirmed running in production. | ||||||
|
|
||||||
| **Requirements**: | ||||||
| - Datadog Agent **7.78.0 or later** | ||||||
| - Datadog Agent **7.79.0 or later** | ||||||
| - Linux only (eBPF dependency) | ||||||
|
|
||||||
| **Important**: Enabling runtime package tracking activates [Workload Protection][7] for runtime file access monitoring, which may trigger additional Workload Protection usage and costs. | ||||||
| **Note**: Use Datadog Agent **7.79.0 or later**. Earlier Agent versions enable this feature through [Workload Protection][7], which can affect Workload Protection usage. From 7.79.0, runtime package tracking runs independently and does not affect Workload Protection usage. | ||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
|
||||||
|
|
||||||
| Add the `enrichment` block to the `sbom` section of your `datadog.yaml` file: | ||||||
|
|
||||||
|
|
@@ -112,7 +112,7 @@ sbom: | |||||
| enabled: true | ||||||
| container_image: | ||||||
| enabled: true | ||||||
| # Enables runtime package prioritization (Preview, Agent 7.78+) | ||||||
| # Enables runtime package prioritization (Preview, Agent 7.79+) | ||||||
| enrichment: | ||||||
| usage: | ||||||
| enabled: true | ||||||
|
|
||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I noticed that other instances of this note linked out to WP, so added the link here as well; feel free to remove if you think it's too much