From 6c3eceaf223aebcc3c2b205b00b13ded0efa4a22 Mon Sep 17 00:00:00 2001 From: DeForest Richards Date: Fri, 14 Aug 2026 16:40:05 -0600 Subject: [PATCH 01/10] docs: split Coverage reference and tasks --- hugo/config/_default/menus/main.en.yaml | 5 ++ .../workload_protection/inventory/_index.md | 61 +---------------- .../inventory/review_improve_coverage.md | 68 +++++++++++++++++++ 3 files changed, 76 insertions(+), 58 deletions(-) create mode 100644 hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md diff --git a/hugo/config/_default/menus/main.en.yaml b/hugo/config/_default/menus/main.en.yaml index 9facaa422e3..14a174f35e5 100644 --- a/hugo/config/_default/menus/main.en.yaml +++ b/hugo/config/_default/menus/main.en.yaml @@ -8855,6 +8855,11 @@ menu: parent: workload_protection identifier: workload_protection_inventory weight: 205 + - name: Review and Improve Coverage + url: security/workload_protection/inventory/review_improve_coverage + parent: workload_protection_inventory + identifier: workload_protection_inventory_review_improve_coverage + weight: 10 - name: Guides url: security/workload_protection/guide parent: workload_protection diff --git a/hugo/content/en/security/workload_protection/inventory/_index.md b/hugo/content/en/security/workload_protection/inventory/_index.md index 4d1d88a05fe..3a6b55e2757 100644 --- a/hugo/content/en/security/workload_protection/inventory/_index.md +++ b/hugo/content/en/security/workload_protection/inventory/_index.md @@ -93,69 +93,14 @@ To understand why a rule is failing, select the resource to open its side panel. {{< img src="security/workload_protection/coverage/coverage_side_panel.png" alt="Resource side panel showing policy and rule statuses with verdicts" width="100%">}} -## Use cases +## Review and improve coverage -Here are some ways to use Coverage to improve your workload security. - -### Detect and respond to policy deployment issues - -To find and fix resources with rule errors: - -1. In the Explorer, filter by severity **Error**, or in the Map, select an **Error** hexagon. -2. Select a failing resource to open its side panel and review its policies. Policies with failing rules show a status of **Error**. -3. Review a failing rule's verdict (for example, `syntax_error` or `unknown`) and error message to understand why it failed. -4. [Edit the rule][4] as needed. -5. Redeploy and confirm the fix in Coverage. - -### Review agent deployment coverage - -The widget at the top of the Coverage page shows the percentage of your resources secured with Workload Protection, along with any findings. Use the widget's buttons to investigate: - -{{< img src="security/workload_protection/coverage/coverage_top_widgets.png" alt="Coverage page top widgets showing resource coverage, rule loading status, Workload Protection adoption, and Remote Config deployment" width="100%">}} - -- **View outdated**: Resources running an agent version older than the minimum supported version (`7.65.0`), which might not support the latest Workload Protection features. -- **View incomplete**: Resources reporting incomplete or invalid data. -- **View without WP**: Hosts running the Datadog Agent without Workload Protection enabled. This opens Fleet Automation, where you can [set up Workload Protection][3]. -- **View without Agents**: Hosts not running the Datadog Agent, which can't be evaluated by Workload Protection. This opens the Infrastructure Catalog. - -Update or deploy the Datadog Agent to help ensure complete coverage. - -### Search assets by MITRE ATT&CK techniques and tactics - -Use the Explorer facets (under the **Rule** and **Policy** groups) to filter resources by the detection content applied to them, including MITRE ATT&CK tactics and techniques. This shows which parts of the MITRE ATT&CK framework are covered across your infrastructure. - -For information about the MITRE ATT&CK map available in SIEM or Workload Protection, see [MITRE ATT&CK map][2]. - -### Experiment with new rules - -You can use Coverage to test and iterate on custom security rules: - -1. Write and deploy a [new custom rule][4]. -2. In Coverage, search for the rule by rule ID, policy ID, or hostname. -3. Confirm that the agent has loaded the rule successfully. -4. If errors appear, review the verdict, fix the rule, and redeploy. - -## Workload coverage triage and response cycle - -As an example of how to use Coverage to triage and respond to coverage issues, here is a sequence that starts by establishing a baseline, closing blind spots, and securing the most critical assets. It then verifies enforcement mechanisms, restores agent health, and aligns detection coverage with known adversary behaviors. Finally, it applies rule updates, confirms effectiveness, and records the state for audit and incident reference. - -1. Do a full environment view to establish baseline coverage status. -2. Focus on assets that appear fully covered. Validate that their policies, rules, and agents are working as intended before addressing visible gaps. This uncovers silent failures in trusted systems that would otherwise be ignored. -3. Identify all unprotected or partially protected workloads. -4. Prioritize assets with the highest business impact and exposure. -5. Verify policy deployment and enforcement on those assets. -6. Check for outdated or unhealthy agents on all remaining workloads. -7. Map current detection coverage to MITRE ATT&CK to find gaps in tactics and techniques. -8. Deploy or update detection rules to close those gaps. -9. Reassess coverage to confirm posture changes took effect. -10. Log the final state for compliance and future comparison. +For steps to identify and address coverage gaps, see [Review and Improve Coverage][6]. ## Further reading {{< partial name="whats-next/whats-next.html" >}} [1]: https://app.datadoghq.com/security/workload-protection/inventory/coverage -[2]: /security/detection_rules/#mitre-attck-map -[3]: /security/workload_protection/setup/ -[4]: /security/workload_protection/detect_and_monitor/detection_and_finding_rules/detection_rules [5]: /security/workload_protection/detect_and_monitor/agent_rules/policy_management#enable-and-deploy-policies +[6]: /security/workload_protection/inventory/review_improve_coverage diff --git a/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md new file mode 100644 index 00000000000..b5bf51d37c1 --- /dev/null +++ b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md @@ -0,0 +1,68 @@ +--- +title: Review and Improve Coverage +disable_toc: false +--- + +For information about Coverage views and statuses, see [Coverage][1]. + +## Use cases + +Here are some ways to use Coverage to improve your workload security. + +### Detect and respond to policy deployment issues + +To find and fix resources with rule errors: + +1. In the Explorer, filter by severity **Error**, or in the Map, select an **Error** hexagon. +2. Select a failing resource to open its side panel and review its policies. Policies with failing rules show a status of **Error**. +3. Review a failing rule's verdict (for example, `syntax_error` or `unknown`) and error message to understand why it failed. +4. [Edit the rule][4] as needed. +5. Redeploy and confirm the fix in Coverage. + +### Review agent deployment coverage + +The widget at the top of the Coverage page shows the percentage of your resources secured with Workload Protection, along with any findings. Use the widget's buttons to investigate: + +{{< img src="security/workload_protection/coverage/coverage_top_widgets.png" alt="Coverage page top widgets showing resource coverage, rule loading status, Workload Protection adoption, and Remote Config deployment" width="100%">}} + +- **View outdated**: Resources running an agent version older than the minimum supported version (`7.65.0`), which might not support the latest Workload Protection features. +- **View incomplete**: Resources reporting incomplete or invalid data. +- **View without WP**: Hosts running the Datadog Agent without Workload Protection enabled. This opens Fleet Automation, where you can [set up Workload Protection][3]. +- **View without Agents**: Hosts not running the Datadog Agent, which can't be evaluated by Workload Protection. This opens the Infrastructure Catalog. + +Update or deploy the Datadog Agent to help ensure complete coverage. + +### Search assets by MITRE ATT&CK techniques and tactics + +Use the Explorer facets (under the **Rule** and **Policy** groups) to filter resources by the detection content applied to them, including MITRE ATT&CK tactics and techniques. This shows which parts of the MITRE ATT&CK framework are covered across your infrastructure. + +For information about the MITRE ATT&CK map available in SIEM or Workload Protection, see [MITRE ATT&CK map][2]. + +### Experiment with new rules + +You can use Coverage to test and iterate on custom security rules: + +1. Write and deploy a [new custom rule][4]. +2. In Coverage, search for the rule by rule ID, policy ID, or hostname. +3. Confirm that the agent has loaded the rule successfully. +4. If errors appear, review the verdict, fix the rule, and redeploy. + +## Workload coverage triage and response cycle + +As an example of how to use Coverage to triage and respond to coverage issues, here is a sequence that starts by establishing a baseline, closing blind spots, and securing the most critical assets. It then verifies enforcement mechanisms, restores agent health, and aligns detection coverage with known adversary behaviors. Finally, it applies rule updates, confirms effectiveness, and records the state for audit and incident reference. + +1. Do a full environment view to establish baseline coverage status. +2. Focus on assets that appear fully covered. Validate that their policies, rules, and agents are working as intended before addressing visible gaps. This uncovers silent failures in trusted systems that would otherwise be ignored. +3. Identify all unprotected or partially protected workloads. +4. Prioritize assets with the highest business impact and exposure. +5. Verify policy deployment and enforcement on those assets. +6. Check for outdated or unhealthy agents on all remaining workloads. +7. Map current detection coverage to MITRE ATT&CK to find gaps in tactics and techniques. +8. Deploy or update detection rules to close those gaps. +9. Reassess coverage to confirm posture changes took effect. +10. Log the final state for compliance and future comparison. + +[1]: /security/workload_protection/inventory/ +[2]: /security/detection_rules/#mitre-attck-map +[3]: /security/workload_protection/setup/ +[4]: /security/workload_protection/detect_and_monitor/detection_and_finding_rules/detection_rules From fa14a75457ae80545a6c1f1aa1442d10eed97fa3 Mon Sep 17 00:00:00 2001 From: DeForest Richards Date: Fri, 14 Aug 2026 16:44:17 -0600 Subject: [PATCH 02/10] docs: consolidate Coverage functionality --- .../security/workload_protection/inventory/_index.md | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/hugo/content/en/security/workload_protection/inventory/_index.md b/hugo/content/en/security/workload_protection/inventory/_index.md index 3a6b55e2757..25738a24980 100644 --- a/hugo/content/en/security/workload_protection/inventory/_index.md +++ b/hugo/content/en/security/workload_protection/inventory/_index.md @@ -24,7 +24,7 @@ Coverage reflects whether the policies and agent rules on each resource loaded s Coverage has two views. Use the toggle at the top of the page to switch between them: -- **Explorer**: A faceted table of your resources. Filter with the facet groups in the sidebar (**Agent**, **Rule**, **Policy**, **Infrastructure**, and **Container**), then open a resource to inspect its agent rules and policies deployment status. +- **Explorer**: A faceted table of your resources. Search and filter resources by **Agent**, **Rule**, **Policy**, **Infrastructure**, and **Container** facets, then open a resource to inspect its agent rules and policies deployment status. - **Map**: A visual map where each resource appears as a hexagon colored by its coverage status severity. {{< img src="security/workload_protection/coverage/coverage_explorer.png" alt="Explorer view of the Coverage page showing resources in a faceted table" width="100%">}} @@ -36,14 +36,6 @@ In both views, you can: A resource appears in Coverage as soon as its agent loads its ruleset. When a resource goes offline, it is removed from Coverage within 15 minutes. -## Key functionality - -* **Real-time visibility**: Resources appear as soon as their agent loads a ruleset, and are removed within 15 minutes of going offline. -* **Granular filtering**: Search and filter by agent, rule, policy, infrastructure, and container facets. -* **Detailed inspection**: Navigate from a high-level map or table to a detailed resource, policy, or rule view. -* **Actionable findings**: Highlight resources in a warning or error state so you can respond promptly. -* **Coverage analytics**: Track rule deployment health, outdated agents, and incomplete data. - ## Key benefits * Reduce blind spots by monitoring for unprotected workloads. From 86814f480f6db5686caa371ec94bdd58ee2eef7d Mon Sep 17 00:00:00 2001 From: DeForest Richards Date: Fri, 14 Aug 2026 16:46:49 -0600 Subject: [PATCH 03/10] docs: consolidate Coverage benefits --- .../en/security/workload_protection/inventory/_index.md | 7 ------- .../inventory/review_improve_coverage.md | 2 ++ 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/hugo/content/en/security/workload_protection/inventory/_index.md b/hugo/content/en/security/workload_protection/inventory/_index.md index 25738a24980..2d9b410e5ec 100644 --- a/hugo/content/en/security/workload_protection/inventory/_index.md +++ b/hugo/content/en/security/workload_protection/inventory/_index.md @@ -36,13 +36,6 @@ In both views, you can: A resource appears in Coverage as soon as its agent loads its ruleset. When a resource goes offline, it is removed from Coverage within 15 minutes. -## Key benefits - -* Reduce blind spots by monitoring for unprotected workloads. -* Shorten detection and response times with direct response workflows. -* Maintain continuous compliance and policy alignment. -* Integrate posture checks into CI/CD and infrastructure reviews. - ## Coverage statuses ### Resource coverage status diff --git a/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md index b5bf51d37c1..45c12d9c517 100644 --- a/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md +++ b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md @@ -5,6 +5,8 @@ disable_toc: false For information about Coverage views and statuses, see [Coverage][1]. +Use the procedures on this page to reduce blind spots, verify policy alignment, and help Workload Protection detect and respond to threats across your environment. You can incorporate these checks into compliance, CI/CD, and infrastructure reviews. + ## Use cases Here are some ways to use Coverage to improve your workload security. From b85ec0e4d565c5b880b8d92f74dc9356b24846bb Mon Sep 17 00:00:00 2001 From: DeForest Richards Date: Fri, 14 Aug 2026 16:51:42 -0600 Subject: [PATCH 04/10] docs: organize Coverage review tasks --- .../inventory/review_improve_coverage.md | 41 +++++++++---------- 1 file changed, 20 insertions(+), 21 deletions(-) diff --git a/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md index 45c12d9c517..4a631bdbaba 100644 --- a/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md +++ b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md @@ -7,40 +7,33 @@ For information about Coverage views and statuses, see [Coverage][1]. Use the procedures on this page to reduce blind spots, verify policy alignment, and help Workload Protection detect and respond to threats across your environment. You can incorporate these checks into compliance, CI/CD, and infrastructure reviews. -## Use cases +The widget at the top of the Coverage page shows the percentage of your resources secured with Workload Protection, along with any findings. -Here are some ways to use Coverage to improve your workload security. - -### Detect and respond to policy deployment issues - -To find and fix resources with rule errors: - -1. In the Explorer, filter by severity **Error**, or in the Map, select an **Error** hexagon. -2. Select a failing resource to open its side panel and review its policies. Policies with failing rules show a status of **Error**. -3. Review a failing rule's verdict (for example, `syntax_error` or `unknown`) and error message to understand why it failed. -4. [Edit the rule][4] as needed. -5. Redeploy and confirm the fix in Coverage. +{{< img src="security/workload_protection/coverage/coverage_top_widgets.png" alt="Coverage page top widgets showing resource coverage, rule loading status, Workload Protection adoption, and Remote Config deployment" width="100%">}} -### Review agent deployment coverage +## Find workloads without protection -The widget at the top of the Coverage page shows the percentage of your resources secured with Workload Protection, along with any findings. Use the widget's buttons to investigate: +- **View without WP**: Hosts running the Datadog Agent without Workload Protection enabled. This opens Fleet Automation, where you can [set up Workload Protection][3]. +- **View without Agents**: Hosts not running the Datadog Agent, which can't be evaluated by Workload Protection. This opens the Infrastructure Catalog. -{{< img src="security/workload_protection/coverage/coverage_top_widgets.png" alt="Coverage page top widgets showing resource coverage, rule loading status, Workload Protection adoption, and Remote Config deployment" width="100%">}} +## Find outdated or incomplete Agents - **View outdated**: Resources running an agent version older than the minimum supported version (`7.65.0`), which might not support the latest Workload Protection features. - **View incomplete**: Resources reporting incomplete or invalid data. -- **View without WP**: Hosts running the Datadog Agent without Workload Protection enabled. This opens Fleet Automation, where you can [set up Workload Protection][3]. -- **View without Agents**: Hosts not running the Datadog Agent, which can't be evaluated by Workload Protection. This opens the Infrastructure Catalog. Update or deploy the Datadog Agent to help ensure complete coverage. -### Search assets by MITRE ATT&CK techniques and tactics +## Fix policy or rule deployment errors -Use the Explorer facets (under the **Rule** and **Policy** groups) to filter resources by the detection content applied to them, including MITRE ATT&CK tactics and techniques. This shows which parts of the MITRE ATT&CK framework are covered across your infrastructure. +To find and fix resources with rule errors: -For information about the MITRE ATT&CK map available in SIEM or Workload Protection, see [MITRE ATT&CK map][2]. +1. In the Explorer, filter by severity **Error**, or in the Map, select an **Error** hexagon. +2. Select a failing resource to open its side panel and review its policies. Policies with failing rules show a status of **Error**. +3. Review a failing rule's verdict (for example, `syntax_error` or `unknown`) and error message to understand why it failed. +4. [Edit the rule][4] as needed. +5. Redeploy and confirm the fix in Coverage. -### Experiment with new rules +## Confirm that new rules loaded You can use Coverage to test and iterate on custom security rules: @@ -49,6 +42,12 @@ You can use Coverage to test and iterate on custom security rules: 3. Confirm that the agent has loaded the rule successfully. 4. If errors appear, review the verdict, fix the rule, and redeploy. +## Review detection coverage + +Use the Explorer facets (under the **Rule** and **Policy** groups) to filter resources by the detection content applied to them, including MITRE ATT&CK tactics and techniques. This shows which parts of the MITRE ATT&CK framework are covered across your infrastructure. + +For information about the MITRE ATT&CK map available in SIEM or Workload Protection, see [MITRE ATT&CK map][2]. + ## Workload coverage triage and response cycle As an example of how to use Coverage to triage and respond to coverage issues, here is a sequence that starts by establishing a baseline, closing blind spots, and securing the most critical assets. It then verifies enforcement mechanisms, restores agent health, and aligns detection coverage with known adversary behaviors. Finally, it applies rule updates, confirms effectiveness, and records the state for audit and incident reference. From de7fdebb21e6b6bf2fb9fbbb4ea4758c31438b07 Mon Sep 17 00:00:00 2001 From: DeForest Richards Date: Fri, 14 Aug 2026 16:54:47 -0600 Subject: [PATCH 05/10] docs: simplify Coverage review order --- .../inventory/review_improve_coverage.md | 24 ++++++++----------- 1 file changed, 10 insertions(+), 14 deletions(-) diff --git a/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md index 4a631bdbaba..dd340916700 100644 --- a/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md +++ b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md @@ -48,20 +48,16 @@ Use the Explorer facets (under the **Rule** and **Policy** groups) to filter res For information about the MITRE ATT&CK map available in SIEM or Workload Protection, see [MITRE ATT&CK map][2]. -## Workload coverage triage and response cycle - -As an example of how to use Coverage to triage and respond to coverage issues, here is a sequence that starts by establishing a baseline, closing blind spots, and securing the most critical assets. It then verifies enforcement mechanisms, restores agent health, and aligns detection coverage with known adversary behaviors. Finally, it applies rule updates, confirms effectiveness, and records the state for audit and incident reference. - -1. Do a full environment view to establish baseline coverage status. -2. Focus on assets that appear fully covered. Validate that their policies, rules, and agents are working as intended before addressing visible gaps. This uncovers silent failures in trusted systems that would otherwise be ignored. -3. Identify all unprotected or partially protected workloads. -4. Prioritize assets with the highest business impact and exposure. -5. Verify policy deployment and enforcement on those assets. -6. Check for outdated or unhealthy agents on all remaining workloads. -7. Map current detection coverage to MITRE ATT&CK to find gaps in tactics and techniques. -8. Deploy or update detection rules to close those gaps. -9. Reassess coverage to confirm posture changes took effect. -10. Log the final state for compliance and future comparison. +## Recommended review order + +Use this order to review coverage across your environment: + +1. Review the full environment to establish a baseline. Validate that resources appearing fully covered have working policies, rules, and Agents to uncover silent failures before addressing visible gaps. +2. Identify unprotected or partially protected workloads, then prioritize resources with the highest business impact and exposure. +3. Verify policy and rule deployment on prioritized resources, and check for outdated or unhealthy Agents on all remaining workloads. +4. Map detection coverage to MITRE ATT&CK, then deploy or update detection rules to close gaps. +5. Reassess Coverage to confirm that your changes took effect. +6. Record the final state for compliance, audits, incident reference, and future comparison. [1]: /security/workload_protection/inventory/ [2]: /security/detection_rules/#mitre-attck-map From c390e55c45bb1f37430cdc9c3e3f702c1f6768df Mon Sep 17 00:00:00 2001 From: DeForest Richards Date: Fri, 14 Aug 2026 16:57:21 -0600 Subject: [PATCH 06/10] docs: standardize Coverage terminology --- .../workload_protection/inventory/_index.md | 14 +++++++------- .../inventory/review_improve_coverage.md | 6 +++--- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/hugo/content/en/security/workload_protection/inventory/_index.md b/hugo/content/en/security/workload_protection/inventory/_index.md index 2d9b410e5ec..45f91cba15d 100644 --- a/hugo/content/en/security/workload_protection/inventory/_index.md +++ b/hugo/content/en/security/workload_protection/inventory/_index.md @@ -16,7 +16,7 @@ further_reading: Workload Protection [Coverage][1] provides a real-time view of security coverage across your hosts, ECS Fargate, and EKS Fargate workloads. Use Coverage to assess protection posture, identify gaps, and act on unprotected or misconfigured workloads. -Coverage reflects whether the policies and agent rules on each resource loaded successfully. For how policies reach your Agents, see [Enable and deploy policies][5]. +Coverage reflects whether the policies and Agent rules on each resource loaded successfully. For how policies reach your Agents, see [Enable and deploy policies][5]. {{< img src="security/workload_protection/coverage/coverage_map.png" alt="Use the Coverage page to get real-time visibility into Workload Protection status across all your resources and see which policies are applied" width="100%">}} @@ -24,7 +24,7 @@ Coverage reflects whether the policies and agent rules on each resource loaded s Coverage has two views. Use the toggle at the top of the page to switch between them: -- **Explorer**: A faceted table of your resources. Search and filter resources by **Agent**, **Rule**, **Policy**, **Infrastructure**, and **Container** facets, then open a resource to inspect its agent rules and policies deployment status. +- **Explorer**: A faceted table of your resources. Search and filter resources by **Agent**, **Rule**, **Policy**, **Infrastructure**, and **Container** facets, then open a resource to inspect its Agent rules and policy deployment status. - **Map**: A visual map where each resource appears as a hexagon colored by its coverage status severity. {{< img src="security/workload_protection/coverage/coverage_explorer.png" alt="Explorer view of the Coverage page showing resources in a faceted table" width="100%">}} @@ -34,7 +34,7 @@ In both views, you can: - **Group by** Cloud Provider, OS, Agent Version, Severity, or Kubernetes Cluster. - Refresh the view on demand. -A resource appears in Coverage as soon as its agent loads its ruleset. When a resource goes offline, it is removed from Coverage within 15 minutes. +A resource appears in Coverage as soon as its Agent loads its ruleset. When a resource goes offline, it is removed from Coverage within 15 minutes. ## Coverage statuses @@ -61,7 +61,7 @@ Each policy loaded on a resource has one of the following statuses: Each rule reports one of the following statuses: - **Loaded**: The rule loaded successfully. -- **Filtered**: The rule was intentionally not applied (for example, the agent version is too low or the event type is disabled). +- **Filtered**: The rule was intentionally not applied (for example, the Agent version is too low or the event type is disabled). - **Error**: The rule failed to load. When a rule is filtered or in error, a **verdict** explains why: @@ -69,12 +69,12 @@ When a rule is filtered or in error, a **verdict** explains why: | Verdict | Meaning | |---------|---------| | `syntax_error` | The rule expression is invalid. | -| `unknown` | The agent could not load the rule. | -| `filtered_agent_version` | The agent version is too low for this rule. | +| `unknown` | The Agent could not load the rule. | +| `filtered_agent_version` | The Agent version is too low for this rule. | | `filtered_event_type_disabled` | The event type is disabled in the configuration. | | `filtered_rule_filter` | The rule was excluded by a rule filter. | -To understand why a rule is failing, select the resource to open its side panel. The side panel lists the resource's policies and rules. For each rule, it shows the expression, the status and verdict, and the error message reported by the agent. +To understand why a rule is failing, select the resource to open its side panel. The side panel lists the resource's policies and rules. For each rule, it shows the expression, the status and verdict, and the error message reported by the Agent. {{< img src="security/workload_protection/coverage/coverage_side_panel.png" alt="Resource side panel showing policy and rule statuses with verdicts" width="100%">}} diff --git a/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md index dd340916700..24485a28d49 100644 --- a/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md +++ b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md @@ -18,7 +18,7 @@ The widget at the top of the Coverage page shows the percentage of your resource ## Find outdated or incomplete Agents -- **View outdated**: Resources running an agent version older than the minimum supported version (`7.65.0`), which might not support the latest Workload Protection features. +- **View outdated**: Resources running an Agent version older than the minimum supported version (`7.65.0`), which might not support the latest Workload Protection features. - **View incomplete**: Resources reporting incomplete or invalid data. Update or deploy the Datadog Agent to help ensure complete coverage. @@ -33,13 +33,13 @@ To find and fix resources with rule errors: 4. [Edit the rule][4] as needed. 5. Redeploy and confirm the fix in Coverage. -## Confirm that new rules loaded +## Confirm that new rules are loaded You can use Coverage to test and iterate on custom security rules: 1. Write and deploy a [new custom rule][4]. 2. In Coverage, search for the rule by rule ID, policy ID, or hostname. -3. Confirm that the agent has loaded the rule successfully. +3. Confirm that the Agent has loaded the rule successfully. 4. If errors appear, review the verdict, fix the rule, and redeploy. ## Review detection coverage From addbe2a1cae23efdeba8b661835709785d01eed9 Mon Sep 17 00:00:00 2001 From: DeForest Richards Date: Fri, 14 Aug 2026 17:00:57 -0600 Subject: [PATCH 07/10] docs: refine Coverage review guidance --- .../inventory/review_improve_coverage.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md index 24485a28d49..a24268d582a 100644 --- a/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md +++ b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md @@ -3,10 +3,10 @@ title: Review and Improve Coverage disable_toc: false --- -For information about Coverage views and statuses, see [Coverage][1]. - Use the procedures on this page to reduce blind spots, verify policy alignment, and help Workload Protection detect and respond to threats across your environment. You can incorporate these checks into compliance, CI/CD, and infrastructure reviews. +For information about Coverage views and statuses, see [Coverage][1]. + The widget at the top of the Coverage page shows the percentage of your resources secured with Workload Protection, along with any findings. {{< img src="security/workload_protection/coverage/coverage_top_widgets.png" alt="Coverage page top widgets showing resource coverage, rule loading status, Workload Protection adoption, and Remote Config deployment" width="100%">}} @@ -21,7 +21,7 @@ The widget at the top of the Coverage page shows the percentage of your resource - **View outdated**: Resources running an Agent version older than the minimum supported version (`7.65.0`), which might not support the latest Workload Protection features. - **View incomplete**: Resources reporting incomplete or invalid data. -Update or deploy the Datadog Agent to help ensure complete coverage. +Update or deploy the Datadog Agent, then confirm that the affected resources report complete coverage data. ## Fix policy or rule deployment errors @@ -44,7 +44,7 @@ You can use Coverage to test and iterate on custom security rules: ## Review detection coverage -Use the Explorer facets (under the **Rule** and **Policy** groups) to filter resources by the detection content applied to them, including MITRE ATT&CK tactics and techniques. This shows which parts of the MITRE ATT&CK framework are covered across your infrastructure. +Use the Explorer facets under the **Rule** and **Policy** groups to filter resources by applied detection content. Filter by MITRE ATT&CK tactics and techniques to see which parts of the framework are covered across your infrastructure. For information about the MITRE ATT&CK map available in SIEM or Workload Protection, see [MITRE ATT&CK map][2]. From a9692eed1c061648ca130e61ca27b7c951c169f7 Mon Sep 17 00:00:00 2001 From: DeForest Richards Date: Fri, 14 Aug 2026 17:11:46 -0600 Subject: [PATCH 08/10] docs: align Coverage tasks with review order --- .../inventory/review_improve_coverage.md | 42 +++++++++---------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md index a24268d582a..6fc70b69ee3 100644 --- a/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md +++ b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md @@ -7,6 +7,17 @@ Use the procedures on this page to reduce blind spots, verify policy alignment, For information about Coverage views and statuses, see [Coverage][1]. +## Recommended review order + +Use this order to review coverage across your environment: + +1. Review the full environment to establish a baseline. Validate that resources appearing fully covered have working policies, rules, and Agents to uncover silent failures before addressing visible gaps. +2. Identify unprotected or partially protected workloads, then prioritize resources with the highest business impact and exposure. +3. Verify policy and rule deployment on prioritized resources, and check for outdated or unhealthy Agents on all remaining workloads. +4. Map detection coverage to MITRE ATT&CK, then deploy or update detection rules to close gaps. +5. Reassess Coverage to confirm that your changes took effect. +6. Record the final state for compliance, audits, incident reference, and future comparison. + The widget at the top of the Coverage page shows the percentage of your resources secured with Workload Protection, along with any findings. {{< img src="security/workload_protection/coverage/coverage_top_widgets.png" alt="Coverage page top widgets showing resource coverage, rule loading status, Workload Protection adoption, and Remote Config deployment" width="100%">}} @@ -16,13 +27,6 @@ The widget at the top of the Coverage page shows the percentage of your resource - **View without WP**: Hosts running the Datadog Agent without Workload Protection enabled. This opens Fleet Automation, where you can [set up Workload Protection][3]. - **View without Agents**: Hosts not running the Datadog Agent, which can't be evaluated by Workload Protection. This opens the Infrastructure Catalog. -## Find outdated or incomplete Agents - -- **View outdated**: Resources running an Agent version older than the minimum supported version (`7.65.0`), which might not support the latest Workload Protection features. -- **View incomplete**: Resources reporting incomplete or invalid data. - -Update or deploy the Datadog Agent, then confirm that the affected resources report complete coverage data. - ## Fix policy or rule deployment errors To find and fix resources with rule errors: @@ -33,14 +37,12 @@ To find and fix resources with rule errors: 4. [Edit the rule][4] as needed. 5. Redeploy and confirm the fix in Coverage. -## Confirm that new rules are loaded +## Find outdated or incomplete Agents -You can use Coverage to test and iterate on custom security rules: +- **View outdated**: Resources running an Agent version older than the minimum supported version (`7.65.0`), which might not support the latest Workload Protection features. +- **View incomplete**: Resources reporting incomplete or invalid data. -1. Write and deploy a [new custom rule][4]. -2. In Coverage, search for the rule by rule ID, policy ID, or hostname. -3. Confirm that the Agent has loaded the rule successfully. -4. If errors appear, review the verdict, fix the rule, and redeploy. +Update or deploy the Datadog Agent, then confirm that the affected resources report complete coverage data. ## Review detection coverage @@ -48,16 +50,14 @@ Use the Explorer facets under the **Rule** and **Policy** groups to filter resou For information about the MITRE ATT&CK map available in SIEM or Workload Protection, see [MITRE ATT&CK map][2]. -## Recommended review order +## Confirm that new rules are loaded -Use this order to review coverage across your environment: +You can use Coverage to test and iterate on custom security rules: -1. Review the full environment to establish a baseline. Validate that resources appearing fully covered have working policies, rules, and Agents to uncover silent failures before addressing visible gaps. -2. Identify unprotected or partially protected workloads, then prioritize resources with the highest business impact and exposure. -3. Verify policy and rule deployment on prioritized resources, and check for outdated or unhealthy Agents on all remaining workloads. -4. Map detection coverage to MITRE ATT&CK, then deploy or update detection rules to close gaps. -5. Reassess Coverage to confirm that your changes took effect. -6. Record the final state for compliance, audits, incident reference, and future comparison. +1. Write and deploy a [new custom rule][4]. +2. In Coverage, search for the rule by rule ID, policy ID, or hostname. +3. Confirm that the Agent has loaded the rule successfully. +4. If errors appear, review the verdict, fix the rule, and redeploy. [1]: /security/workload_protection/inventory/ [2]: /security/detection_rules/#mitre-attck-map From d52eee22b2bf7b733ecb8a1219973f33c4cbc947 Mon Sep 17 00:00:00 2001 From: DeForest Richards Date: Fri, 14 Aug 2026 17:19:11 -0600 Subject: [PATCH 09/10] docs: preserve Coverage review guidance --- .../inventory/review_improve_coverage.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md index 6fc70b69ee3..e09ed42d8e6 100644 --- a/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md +++ b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md @@ -15,10 +15,10 @@ Use this order to review coverage across your environment: 2. Identify unprotected or partially protected workloads, then prioritize resources with the highest business impact and exposure. 3. Verify policy and rule deployment on prioritized resources, and check for outdated or unhealthy Agents on all remaining workloads. 4. Map detection coverage to MITRE ATT&CK, then deploy or update detection rules to close gaps. -5. Reassess Coverage to confirm that your changes took effect. +5. Reassess coverage to confirm that your changes took effect. 6. Record the final state for compliance, audits, incident reference, and future comparison. -The widget at the top of the Coverage page shows the percentage of your resources secured with Workload Protection, along with any findings. +The widget at the top of the Coverage page shows the percentage of your resources secured with Workload Protection, along with any findings. Use the widget's buttons to investigate: {{< img src="security/workload_protection/coverage/coverage_top_widgets.png" alt="Coverage page top widgets showing resource coverage, rule loading status, Workload Protection adoption, and Remote Config deployment" width="100%">}} @@ -48,7 +48,7 @@ Update or deploy the Datadog Agent, then confirm that the affected resources rep Use the Explorer facets under the **Rule** and **Policy** groups to filter resources by applied detection content. Filter by MITRE ATT&CK tactics and techniques to see which parts of the framework are covered across your infrastructure. -For information about the MITRE ATT&CK map available in SIEM or Workload Protection, see [MITRE ATT&CK map][2]. +For information about the MITRE ATT&CK map available in Cloud SIEM or Workload Protection, see [MITRE ATT&CK map][2]. ## Confirm that new rules are loaded From 309aa7023bcc5e3c85cee7eeb53635dcfa6828c8 Mon Sep 17 00:00:00 2001 From: DeForest Richards Date: Fri, 14 Aug 2026 17:24:32 -0600 Subject: [PATCH 10/10] docs: finalize Coverage page structure --- .../en/security/workload_protection/inventory/_index.md | 7 +++---- .../inventory/review_improve_coverage.md | 1 + 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/hugo/content/en/security/workload_protection/inventory/_index.md b/hugo/content/en/security/workload_protection/inventory/_index.md index 45f91cba15d..6338d19f929 100644 --- a/hugo/content/en/security/workload_protection/inventory/_index.md +++ b/hugo/content/en/security/workload_protection/inventory/_index.md @@ -1,5 +1,6 @@ --- title: Coverage +description: Assess Workload Protection coverage across hosts, ECS Fargate, and EKS Fargate workloads, including Agent, policy, and rule deployment status. disable_toc: false aliases: - /security/workload_protection/inventory/coverage_map @@ -18,6 +19,8 @@ Workload Protection [Coverage][1] provides a real-time view of security coverage Coverage reflects whether the policies and Agent rules on each resource loaded successfully. For how policies reach your Agents, see [Enable and deploy policies][5]. +To identify and address coverage gaps, see [Review and Improve Coverage][6]. + {{< img src="security/workload_protection/coverage/coverage_map.png" alt="Use the Coverage page to get real-time visibility into Workload Protection status across all your resources and see which policies are applied" width="100%">}} ## Views @@ -78,10 +81,6 @@ To understand why a rule is failing, select the resource to open its side panel. {{< img src="security/workload_protection/coverage/coverage_side_panel.png" alt="Resource side panel showing policy and rule statuses with verdicts" width="100%">}} -## Review and improve coverage - -For steps to identify and address coverage gaps, see [Review and Improve Coverage][6]. - ## Further reading {{< partial name="whats-next/whats-next.html" >}} diff --git a/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md index e09ed42d8e6..52fa82fff30 100644 --- a/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md +++ b/hugo/content/en/security/workload_protection/inventory/review_improve_coverage.md @@ -1,5 +1,6 @@ --- title: Review and Improve Coverage +description: Identify and address Workload Protection coverage gaps, troubleshoot Agent and rule deployment issues, and review detection coverage across your environment. disable_toc: false ---