Restructure Workload Protection overview and standardize landing page openers - #39127
Merged
drichards-87 merged 10 commits intoAug 14, 2026
Merged
Conversation
drichards-87
added
WORK IN PROGRESS
Contributor
This comment has been minimized.
This comment has been minimized.
drichards-87
changed the title
theop-dd
reviewed
Aug 12, 2026
|
|
||
| Datadog Workload Protection provides real-time visibility and defense for your infrastructure by continuously monitoring file, network, and process activity across your environments. It detects threats as they occur, helping you identify, investigate, and stop malicious behaviors before they impact your workloads. | ||
|
|
||
| ### Actionable, prioritized and contextualized threat detection in real-time |
Contributor
There was a problem hiding this comment.
I would keep this paragraph
theop-dd
reviewed
Aug 12, 2026
| Workload Protection relies on event correlation to surface contextualized and prioritized alerts. As part of the Datadog Security platform, Workload Protection correlates runtime threat detection with findings from misconfiguration scans, vulnerability assessments, and code security. This deep integration enables you to link runtime attacks with preexisting weaknesses, providing the complete context you need to investigate and remediate security incidents. Because Workload Protection is built on the Datadog platform, it also connects with your infrastructure telemetry, including metrics, traces, and logs, so you can understand the scope and impact of threats across your systems. Investigations are enriched with full context, so you can reconstruct the entire attack story from detection to resolution. | ||
| Many organizations use Workload Protection across a range of security and operational use cases: | ||
|
|
||
| ### Response and hardening capabilities |
theop-dd
reviewed
Aug 12, 2026
| You can also take action directly in Datadog to block malicious behaviors, trigger workflows, or integrate with your existing response pipelines. Whether your goal is to enforce compliance, strengthen your runtime security posture, or address workload hardening use cases, Workload Protection can take action on your behalf to keep your environments secure and resilient. | ||
| - **Runtime Security Posture:** Workload Protection improves your security posture by identifying unsafe runtime practices and sensitive configuration drifts, helping you catch weaknesses before they can be exploited. | ||
|
|
||
| ### Beyond threat detection: expanded use cases |
Contributor
There was a problem hiding this comment.
I would keep this wording
theop-dd
reviewed
Aug 12, 2026
| Datadog Workload Protection provides real-time visibility and defense for your infrastructure by continuously monitoring file, network, and process activity across your environments. It detects threats as they occur, helping you identify, investigate, and stop malicious behaviors before they impact your workloads. | ||
|
|
||
| ### Actionable, prioritized and contextualized threat detection in real-time | ||
| ## Use cases |
Contributor
There was a problem hiding this comment.
Here we only talk about expanded use cases
theop-dd
reviewed
Aug 12, 2026
Comment on lines
+80
to
+94
| ### Evaluating activity | ||
|
|
||
| Agent rules perform lightweight filtering so they run efficiently on every host. Datadog evaluates the more complex correlations across time and processes: | ||
|
|
||
| 1. The [agent rules][6] evaluate system activity on the Agent host. | ||
| 2. When activity matches an agent rule expression, the Agent generates an [agent event][7] and passes it to Datadog. | ||
| 3. Datadog evaluates the agent events against [detection rules][8] and [finding rules][9]. | ||
| 4. If a detection rule matches, a signal is generated and displayed in [Signals][10]. | ||
| 5. If a finding rule matches, a finding is generated and displayed in [Findings][11]. | ||
| 6. If an agent event attribute matches a [threat intelligence indicator][13], a signal is generated and displayed in [Signals][10]. | ||
| 7. Any [notification rules][12] matching the signal's severity, rule type, tags, and attributes are triggered. | ||
|
|
||
| Workload Protection ships with over 350 agent rules and 200 detection rules, covering most MITRE ATT&CK tactics and techniques. You can also write your own, including in-agent state machines that alert only on complex indicators of compromise. | ||
|
|
||
| Because Workload Protection runs on the Datadog platform, signals and findings correlate with misconfiguration scans, vulnerability assessments, code security findings, and your infrastructure telemetry. Features shared across Datadog Security apply too, including [notification rules][12] that route signals to your team. |
Contributor
There was a problem hiding this comment.
I think this is a bit repetitive with the first sentence of the paragraph How it works.
We could focus more on "Saving resources by design" and take the paragraph we removed from the other page
Contributor
There was a problem hiding this comment.
We can keep it maybe. In that case, we could put the second diagram that we removed
theop-dd
reviewed
Aug 12, 2026
Comment on lines
+92
to
+93
| Workload Protection ships with over 350 agent rules and 200 detection rules, covering most MITRE ATT&CK tactics and techniques. You can also write your own, including in-agent state machines that alert only on complex indicators of compromise. | ||
|
|
Contributor
There was a problem hiding this comment.
I would put that in the policy paragraph below
github-actions
Bot
added
Architecture
github-actions
Bot
removed
Architecture
drichards-87
added a commit
that referenced
this pull request
Aug 21, 2026
* WIP * New Toc * Agent rules and secl guide * req fix * remove some * coverage in main page * fix link * policy management * add links to OOTB rules and create rule and detection * WIP detection rule * first change in Agent events * WIP repond and report * Content pack WIP * WIP signals * WIP 2 detection * coverage remove old pages * Rewrite Coverage page for reworked Workload Protection coverage map First draft: update Coverage doc to match current product (Explorer/Map views, group by, Pass/Error severity, policy and rule statuses with verdicts, top widget findings). Add screenshots. * docs: finding rules/finding explorer * variables and actions * fix agent events * remove useless guides * remove ebpfless setup * Agent events * rename automated response * rename remeditation response * signal overview * combine response pages * Advanced config static * Add Workload Protection-specific threat intelligence page * feat: update automated response doc * Add deployment strategies section with managed deployment and deploy instantly guides * Apply formatting normalization * remove useless part of guide * remove useless image * move response rbac * Remove advanced use cases for now * fix nav * last fix actions * fix link in response * Apply style guide and formatting fixes to Workload Protection docs (#38502) * Improve Workload Protection agent and backend rule documentation. Update SecL examples to full rule syntax, move backend syntax under detection rules in the nav, and document backend event schema fields for detection and finding rule queries. Co-authored-by: Cursor <cursoragent@cursor.com> * Reorganize detection and finding rules documentation under a shared section. Add a parent overview page, move detection and finding rules into a dedicated subsection, group backend syntax references there, and update internal links with aliases for the previous URLs. Co-authored-by: Cursor <cursoragent@cursor.com> * fix SecL examples identation * Structural Changes for Workload Protection PR (#38623) * Consolidate duplicate Workload Protection nav blocks * Restore site-wide Detection Rules navigation entry * Delete Workload Protection pages superseded by aliases * Delete superseded Workload Protection pages and retarget inbound links * Rename Workload Protection getting_started section to setup * Scope eBPF-less agent docs to AWS Fargate * Retarget broken agent_expressions and notification rules links * Add redirects for moved and deleted Workload Protection pages * Rename Workload Protection setup page title to Setting up Workload Protection * Global edit of screenshots * Edit troubleshooting * small review and rewording * Restructure Workload Protection overview and standardize landing page openers (#39127) * Restructure Workload Protection overview and standardize landing page openers * Move Use cases above How it works on the Workload Protection overview * Rename Use cases to Beyond threat detection and consolidate policy content * Add product purpose and Datadog platform context to Workload Protection overview * rename eBPFLess by cws-instrumentation tracer * add Saving resources by design and reorder eval steps * Minor edits --------- Co-authored-by: Theo Putegnat <theo.putegnat@datadoghq.com> * docs: reorganize Workload Protection setup (#39216) * Workload Protection reorg: Detect and Monitor content revisions (#39215) * docs: refine Detect and Monitor content * docs: use reference links for Agent Rules * tiny changes * Minor edits --------- Co-authored-by: Theo Putegnat <theo.putegnat@datadoghq.com> * Workload Protection reorg Coverage updates (#39213) * docs: split Coverage reference and tasks * docs: consolidate Coverage functionality * docs: consolidate Coverage benefits * docs: organize Coverage review tasks * docs: simplify Coverage review order * docs: standardize Coverage terminology * docs: refine Coverage review guidance * docs: align Coverage tasks with review order * docs: preserve Coverage review guidance * docs: finalize Coverage page structure * Add screenshots * docs: add Coverage page screenshots * add dual ship guide * Refine Workload Protection investigate and triage docs (#39256) * Refine Workload Protection investigate and triage docs * Rename signal actions page to Triage and Act on Security Signals * Refine Workload Protection response docs (#39302) * Refine Workload Protection response docs * Complete Workload Protection response cleanup * Fix response terminology, restore enforcement defaults and network probe config * Tighten response intro, remove duplicated action lists, lowercase automated response in prose * Lowercase automated response in prose and remove duplicated enforcement sentence * Add lead-in under Response requirements heading * Change respond report --------- Co-authored-by: Theo Putegnat <theo.putegnat@datadoghq.com> * Workload Protection reorg final review (#39348) * Apply review fixes: reference-style links, Vale wording, whitespace * Fix reference link scoping in tabs, comma and list marker consistency, rename tuning guide * Add page descriptions, apply ui shortcode to UI labels, capitalize Explorer, drop redundant Overview headings * Move backend rule callout into Agent rules intro and drop orphan paragraph * Drop How to from dual shipping guide title * Fix spacing before Manual response heading * Workload Protection reorg: Restore images and revert dependencies (#39349) * Restore deleted CWS images and revert requirements3.txt to master * Use card-grid shortcodes for Workload Protection setup tiles instead of deprecated tile partials * Restore threat_detection_pipeline_2.png at its original path for translated pages * Addressed yoann's changes * addressed john comments part1 * rename to wp * Fix App and API Protection incident link * Convert inline links to reference-style links in Workload Protection troubleshooting * Address john comments v2 * Last minute fixes for title casing of docs --------- Co-authored-by: gui774ume <gui774ume.fournier@gmail.com> Co-authored-by: Theo Putegnat <theo.putegnat@datadoghq.com> Co-authored-by: Bang NGUYEN <bang.nguyen@datadoghq.com> Co-authored-by: Danila <danila.ivanov@datadoghq.com> Co-authored-by: Axel Manuel <axel.manuel@datadoghq.com> Co-authored-by: thibaud.szymczak <thibaud.szymczak@datadoghq.com> Co-authored-by: DeForest Richards <56796055+drichards-87@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: DeForest Richards <deforest.richards@datadoghq.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do? What is the motivation?
This PR replaces #38829. The repo reorg moved all content into
hugo/, so #38829 could no longer merge. This one targetsreorg-fix/pr-38378instead.See #38829 for the full list of earlier changes.
This PR adds the changes @theop-dd asked for in review:
## Key capabilitiesfrom the overview page. It gave too much weight to threat detection.One more change, not from the review:
## Use casesnow comes before## How it works. Readers see what the product is for before they read how it works.The openers on five landing pages now link to the new overview sections: Setup, Detect and Monitor, Investigate and Triage, Respond and Report, and Coverage.
This changes 6 files. No new pages and no nav changes.
Merge readiness
For Datadog employees:
<name>/<description>convention and include the forward slash (/). If you've already created your PR with an incorrect branch name, please rename your branch and open a fresh PR./reviewto run an automated check that catches common issues before a Documentation team member reviews your PR.AI assistance
Used Claude Code to draft and restructure the pages and to check links. I reviewed all content myself.
Additional notes