Stop runtime threats with Workload Protection response actions

Datadog Workload Protection adds automated and manual runtime threat remediation to reduce the time between detecting malicious activity and stopping it. Automated Agent rules can terminate processes that match clear, unambiguous threats such as cryptomining, while manual actions allow security teams to investigate signals and then kill a process or container, isolate a workload, or combine both actions from the same interface. The system uses kernel-level visibility, namespace-independent process IDs, cgroup-based container mapping, and eBPF traffic filters to identify and target affected resources precisely without disrupting healthy workloads. Elevated permissions, audit logs, timestamps, and recorded signals provide authorization and accountability for each action, enabling organizations to contain threats while maintaining operational control.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.