Explain the internal working of Cloud Workload Security (CWS)?

CWS uses eBPF probes attached to relevant kernel syscalls - process execution, file access, network activity - to observe what's actually happening on a host or inside a container at runtime, with low overhead since the observation happens in-kernel rather than through expensive userspace interception of every call.

Observed events are streamed to a CWS module within the local Agent, which enriches each event with process ancestry (the chain of parent processes that led to it) and container/orchestration context (which pod, which image), since raw syscall data alone rarely tells you enough about intent or origin.

Enriched events are evaluated against detection rules - Datadog ships default, curated rulesets (for common attack patterns like privilege escalation or suspicious file access) and also supports custom rules written for specific environments and threat models.

When a rule matches, CWS generates a signal that's sent to Datadog, carrying the full enriched context (process tree, container, host) needed to investigate the event without having to separately reconstruct that context after the fact from raw logs.

Because detection happens locally at the kernel level in near-real time rather than through periodic scanning, CWS can catch and surface active runtime threats as they happen, complementing posture management tools that instead look for static misconfigurations before anything has actually run.

flowchart TD
  A[eBPF probes on syscalls] --> B[Local CWS module: enrich with process ancestry + container context]
  B --> C{Match detection rule?}
  C -- Yes --> D[Generate signal with full context]
  C -- No --> A
  D --> E[Send to Datadog for investigation]

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.