diff --git a/hugo/content/en/security/workload_protection/setup/_index.md b/hugo/content/en/security/workload_protection/setup/_index.md index 89e73046946..6667b530280 100644 --- a/hugo/content/en/security/workload_protection/setup/_index.md +++ b/hugo/content/en/security/workload_protection/setup/_index.md @@ -15,28 +15,22 @@ After the Agent is running, you can try Workload Protection safely using the pla For what happens to the activity the Agent collects, see [How Workload Protection works][6]. -## 1) Enable Workload Protection in Datadog - -To get started with Workload Protection, you need to enable the Workload Protection product in Datadog. To do so, log in to your Datadog account, and click [Get Started][1]. You can follow the Agent deployment steps in Datadog, or come back to this page for more details. - -
Activating Workload Protection requires the Org Management permission.
- -## 2) Deploy the Datadog Agent +## Requirements Workload Protection relies on the Datadog Agent to monitor your workloads and collect security relevant events for threats detection and security posture monitoring. -### Requirements +### Agent options Workload Protection offers 3 different flavors depending on your environment and operating system: - On **Linux**, install **the eBPF agent**. It offers the best performance and feature support. - On **AWS Fargate**, install **the eBPF-less agent**. Fargate does not provide eBPF access, so this agent uses ptrace instead. It covers the major features of Workload Protection (File Integrity Monitoring, process execution monitoring). - On **Windows**, the Workload Protection agent installs a Windows driver to collect events and telemetry. -#### Supported Linux flavors +### Linux support On Linux, you need to look at the Linux kernel version and distribution version, as well as the underlying Cloud environment (when applicable) since some Cloud computing services prevent access to eBPF. -##### Workload Protection's eBPF agent supports the following Linux flavors +#### Supported Linux distributions | Linux Distributions | Supported Versions | |---------------------------------------------------------------|---------------------------------------| @@ -56,7 +50,7 @@ On Linux, you need to look at the Linux kernel version and distribution version, - Datadog requires, at minimum, platforms that have underlying Linux kernel versions of 4.14.0+ or have eBPF features backported (for example, Centos/RHEL 7 with kernel 3.10 has eBPF features backported, so it is supported). - For compatibility issues with a custom Kubernetes network plugin like Cilium or Calico, see [Troubleshooting Workload Protection][2]. -##### Supported cloud environments +#### Supported cloud environments | Cloud environments | Supported | |-----------------------------------------|----------------------| @@ -74,43 +68,53 @@ On Linux, you need to look at the Linux kernel version and distribution version, - The underlying Linux distribution and system configuration used by these cloud environments are the primary factors determining whether Workload Protection is supported. - For cloud environments where you can choose the Linux distribution and kernel version, select a configuration that meets the requirements listed above. -#### Supported Windows flavors +### Windows support Workload Protection's Windows agent supports Windows Server 2019 and higher. -### Deployment methods +## Enable Workload Protection in Datadog + +To get started with Workload Protection, you need to enable the Workload Protection product in Datadog. To do so, log in to your Datadog account, and click [Get Started][1]. You can follow the Agent deployment steps in Datadog, or come back to this page for more details. + +
Activating Workload Protection requires the Org Management permission.
+ +## Deploy the Datadog Agent -#### Workload Protection's eBPF agent (Linux) +### Linux Use the following instructions to enable the eBPF agent of Workload Protection in the Datadog Agent. {{< partial name="workload-protection/wp-ebpf-tiles.html" >}} -#### Workload Protection's eBPF-less agent (AWS Fargate) +### AWS Fargate Use the following instructions to enable the eBPF-less agent of Workload Protection in the Datadog Agent. {{< partial name="workload-protection/wp-ebpfless-tiles.html" >}} -#### Workload Protection Windows agent +### Windows Use the following instructions to enable the Windows agent of Workload Protection in the Datadog Agent. {{< partial name="workload-protection/wp-windows-tiles.html" >}} -## 3) Discover and explore Workload Protection capabilities +## Next steps + +After setup, you can explore Workload Protection, configure the Agent for your environment, or request access to Automated Response. + +### Explore Workload Protection Datadog provides a testing playground for discovering Workload Protection and learning its capabilities. The playground offers various scenarios you can run safely in a test environment, simulating threats and real world attacks that Workload Protection can detect and protect you from. See the [playground repository][3] to get started. -## 4) (Optional) Request access to enforcement capabilities +### Configure the Agent -
Contact Datadog Support to enable Automated response.
+The [advanced Agent configuration page][5] describes how to configure and tune the Agent to better fit your environment and needs. -After you are granted access to Automated response, see the [Automated response][4] page. +### Enable automated response -## 5) (Optional) Advanced Agent configurations +
Contact Datadog Support to enable Automated response.
-The [advanced Agent configuration page][5] describes how to configure and tune the Agent to better fit your environment and needs. +After you are granted access to Automated response, see the [Automated response][4] page. [1]: https://app.datadoghq.com/security/workload-protection/onboarding [2]: /security/workload_protection/troubleshooting/threats