Security
The Cloud Security Management family
Datadog security splits into products that are easy to mix up. Cloud Security Posture Management (CSPM, part of CSM Misconfigurations) evaluates cloud resources and hosts against compliance rules; it leans on cloud integrations and can be agentless. Cloud Workload Security (CWS, part of CSM Threats) evaluates runtime activity - process, file, and network events - and requires the Agent with runtime security enabled. Cloud SIEM analyzes ingested logs against detection rules to produce security signals. Application Security Management (ASM) instruments running services through the APM tracing libraries to detect attacks and vulnerabilities.
Signals and rules
Detection rules come in several flavors: log detection, workload/agent rules, cloud configuration rules, and application (ASM) rules. A matching rule creates a security signal in the Security Signals explorer, where signals can be triaged, assigned, and muted. Vulnerability Management and Software Composition Analysis surface library and code weaknesses, while Code Security and IaC scanning catch problems before deploy.
Traps to watch
- ASM requires APM tracing; without instrumentation there is no runtime threat detection.
- CSM Threats requires a running Agent - a purely cloud-integrated account cannot run workload rules.
- Misconfiguration rules are evaluated on a schedule against cloud resource state, not on live traffic.
- Sensitive Data Scanner masks data in logs, it does not remediate vulnerabilities.
Rule of thumb: if the question mentions "process executed on a host", answer CWS/CSM Threats; if it mentions "S3 bucket is public", answer CSPM; if it mentions "SQL injection attempt in a request", answer ASM.