Datadog Workload Protection Can Now Kill Processes and Isolate Workloads Mid-Attack

Runtime security has always had a gap between detection and remediation: you get the alert, you investigate, you decide to act, you find the runbook, you execute the intervention. Each handoff costs minutes. Datadog has collapsed that sequence into a single decision.

What Makes This Different

Datadog’s Workload Protection can now kill offending processes and isolate compromised workloads — either automatically through Agent rules or manually from within the investigation interface. Datadog’s announcement describes a “tighter loop between detection and response without requiring a handoff,” which is the precise architectural change this capability introduces.

Two mechanisms are available:

Process termination operates at the kernel level. The Datadog Agent issues termination commands targeting a process’s namespace-independent PID from both user space and kernel — ensuring immediate cessation even in containerized environments where namespace isolation would otherwise complicate process killing.

Network isolation uses eBPF-based traffic filtering at the kernel’s traffic control (TC) hooks. Filters inspect ingress and egress packets and drop those matching isolation rules while allowing other traffic to pass. The filtering targets specific PIDs, cgroups, ports, and protocols — meaning isolation is granular: you can cut a specific compromised container’s external communication while leaving the rest of the workload running.

Both actions are audited with timestamps and require elevated RBAC permissions, which is the appropriate guard against accidental or unauthorized use.

The Problem This Solves

The classic crypto-mining attack scenario illustrates the value precisely: detection fires, an alert enters the queue, an on-call engineer reviews it and confirms it’s real, and somewhere in that window the miner is running and accumulating costs. With automated response rules, the detection and the termination happen in the same moment. The attacker’s window closes when the Agent finds the match, not when a human processes the alert.

For container workloads on Kubernetes — where a compromised workload may span multiple pods with external egress — the eBPF-based isolation approach is particularly relevant. Pulling network connectivity from a compromised container without restarting or redeploying the entire service preserves observability (you can still see what the container is doing after isolation) while stopping the attacker’s ability to exfiltrate data or establish persistence.

Both automated and manual modes serve different operational contexts. Automated rules are appropriate for high-confidence, low-ambiguity threats where speed matters more than review. Manual mode is appropriate when a human needs to investigate the signal before deciding — the action is still available from the investigation UI with a single click rather than a separate remediation workflow.

Source: Datadog

Content created with AI assistance and reviewed for accuracy.