Skip to content

docs(csm): document application library SBOM scanning (Agent 7.70+) #36253

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cyrbouchiat wants to merge 4 commits into
base: master
Choose a base branch
from
+64 −4
Open

docs(csm): document application library SBOM scanning (Agent 7.70+) #36253

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
fe7399a
docs(csm): document application library SBOM scanning for Kubernetes …
cyrbouchiat Apr 24, 2026
8f1ef9e
Update content/en/security/cloud_security_management/setup/agent/kube…
cyrbouchiat Apr 28, 2026
f60316a
Update content/en/security/cloud_security_management/setup/agent/linu…
cyrbouchiat Apr 28, 2026
37130f1
Merge branch 'master' into cyril/cloud-security-sbom-languages-analyzers
cyrbouchiat Apr 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 31 additions & 1 deletion content/en/security/cloud_security_management/setup/agent/kubernetes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,10 +48,14 @@ Use the following instructions to enable Misconfigurations and Vulnerability Man
# Enables Container Vulnerability Management
containerImage:
enabled: true

# Enables scanning of application libraries in addition to OS packages (Agent 7.70+)
analyzers: ["os", "languages"]

# Enables Host Vulnerability Management
host:
enabled: true
# Enables scanning of application libraries in addition to OS packages (Agent 7.70+)
analyzers: ["os", "languages"]
```

2. Apply the changes and restart the Agent.
Expand Down Expand Up @@ -79,10 +83,14 @@ Use the following instructions to enable Misconfigurations and Vulnerability Man
# Enables Container Vulnerability Management
containerImage:
enabled: true
# Enables scanning of application libraries in addition to OS packages (Agent 7.70+)
analyzers: ["os", "languages"]

# Enables Host Vulnerability Management
host:
enabled: true
# Enables scanning of application libraries in addition to OS packages (Agent 7.70+)
analyzers: ["os", "languages"]
```

2. Restart the Agent.
Expand All @@ -91,6 +99,28 @@ Use the following instructions to enable Misconfigurations and Vulnerability Man

{{< /tabs >}}

**Note**: The `languages` analyzer requires Datadog Agent **7.70 or later**. When enabled, it detects vulnerabilities in application libraries managed by package managers such as npm, pip, Maven/Gradle, NuGet, Go modules, Cargo, and Bundler, in addition to OS packages. When the `analyzers` field is omitted, only OS packages are scanned for container images. See [Supported application library package managers](#supported-application-library-package-managers) for the full list.

### Supported application library package managers

The `languages` analyzer covers the following package ecosystems:
Comment thread
cyrbouchiat marked this conversation as resolved.
Outdated

| Ecosystem | Package manager / format |
|-----------|--------------------------|
| Ruby | Bundler, GemSpec |
| Rust | Cargo, Rust binary |
| PHP | Composer |
| Java | Jar, Maven (pom.xml), Gradle lock, Sbt lock |
| JavaScript | npm (package-lock.json), Yarn, pnpm, Node package |
| .NET | NuGet, .NET Core, PackagesProps |
| Python | Python package (egg), pip, Pipenv, Poetry, uv, Conda package, Conda environment |
| Go | Go binary, Go modules |
| C/C++ | Conan lock |
| Swift / Objective-C | CocoaPods, Swift |
| Dart | PubSpec lock |
| Elixir | Mix lock |
| Julia | Julia |

[1]: /security/cloud_security_management/misconfigurations/
[2]: /security/threats
[3]: /security/cloud_security_management/vulnerabilities
Expand Down
32 changes: 29 additions & 3 deletions content/en/security/cloud_security_management/setup/agent/linux.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,9 +37,13 @@ sbom:
# Set to true to enable Container Vulnerability Management
container_image:
enabled: true
# Set to true to enable Host Vulnerability Management
# Enables scanning of application libraries in addition to OS packages (Agent 7.70+)
analyzers: ["os", "languages"]
# Set to true to enable Host Vulnerability Management
host:
enabled: true
# Enables scanning of application libraries in addition to OS packages (Agent 7.70+)
analyzers: ["os", "languages"]
{{< /code-block >}}

{{< code-block lang="bash" filename="/etc/datadog-agent/security-agent.yaml" disable_copy="false" collapsible="true" >}}
Expand All @@ -52,7 +56,29 @@ compliance_config:
enabled: true
{{< /code-block >}}

**Notes**:
**Note**: The `languages` analyzer requires Datadog Agent **7.70 or later**. When enabled, it detects vulnerabilities in application libraries managed by package managers such as npm, pip, Maven/Gradle, NuGet, Go modules, Cargo, and Bundler, in addition to OS packages. When the `analyzers` field is omitted, only OS packages are scanned for container images. See [Supported application library package managers](#supported-application-library-package-managers) for the full list.

### Supported application library package managers

The `languages` analyzer covers the following package ecosystems:
Comment thread
cyrbouchiat marked this conversation as resolved.
Outdated

| Ecosystem | Package manager / format |
|-----------|--------------------------|
| Ruby | Bundler, GemSpec |
| Rust | Cargo, Rust binary |
| PHP | Composer |
| Java | Jar, Maven (pom.xml), Gradle lock, Sbt lock |
| JavaScript | npm (package-lock.json), Yarn, pnpm, Node package |
| .NET | NuGet, .NET Core, PackagesProps |
| Python | Python package (egg), pip, Pipenv, Poetry, uv, Conda package, Conda environment |
| Go | Go binary, Go modules |
| C/C++ | Conan lock |
| Swift / Objective-C | CocoaPods, Swift |
| Dart | PubSpec lock |
| Elixir | Mix lock |
| Julia | Julia |

**Notes**:

- You can also use the following [Agent install script][5] to automatically enable Misconfigurations and Threat Detection:

Expand All @@ -73,4 +99,4 @@ sudo chgrp dd-agent /etc/datadog-agent/security-agent.yaml
[3]: /security/cloud_security_management/vulnerabilities
[4]: /security/cloud_security_management/setup#supported-deployment-types-and-features
[5]: /getting_started/agent/#installation
[6]: /agent/?tab=Linux
[6]: /agent/?tab=Linux
Loading