Explain the internal working of Cloud Workload Security (CWS)?

CWS uses eBPF probes attached to relevant kernel syscalls - process execution, file access, network activity - to observe what's actually happening on a host or inside a container at runtime, with low overhead since the observation happens in-kernel rather than through expensive userspace interception of every call.

Observed events are streamed to a CWS module within the local Agent, which enriches each event with process ancestry (the chain of parent processes that led to it) and container/orchestration context (which pod, which image), since raw syscall data alone rarely tells you enough about intent or origin.

Enriched events are evaluated against detection rules - Datadog ships default, curated rulesets (for common attack patterns like privilege escalation or suspicious file access) and also supports custom rules written for specific environments and threat models.

When a rule matches, CWS generates a signal that's sent to Datadog, carrying the full enriched context (process tree, container, host) needed to investigate the event without having to separately reconstruct that context after the fact from raw logs.

Because detection happens locally at the kernel level in near-real time rather than through periodic scanning, CWS can catch and surface active runtime threats as they happen, complementing posture management tools that instead look for static misconfigurations before anything has actually run.

flowchart TD
  A[eBPF probes on syscalls] --> B[Local CWS module: enrich with process ancestry + container context]
  B --> C{Match detection rule?}
  C -- Yes --> D[Generate signal with full context]
  C -- No --> A
  D --> E[Send to Datadog for investigation]