Skip to content

Commit 80b591d

Browse files
sezen-datadogsezen-datadog
committed
Set up pages for application security for java
Signed-off-by: sezen.leblay <[email protected]>
1 parent 28d2a91 commit 80b591d

File tree

13 files changed

+1066
-131
lines changed

13 files changed

+1066
-131
lines changed

‎config/_default/params.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,7 @@ code_language_ids:
102102
native: Native
103103
other: Other
104104
linux: Linux
105+
macos: macOS
105106
windows: Windows
106107
opentelemetry: OpenTelemetry
107108
ddprof: "Rust/C/C++"

‎content/en/security/application_security/setup/aws/fargate/java.md

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
---
2+
title: Setup App and API Protection for Java on AWS Fargate
3+
further_reading:
4+
- link: "/security/application_security/how-it-works/"
5+
tag: "Documentation"
6+
text: "How App and API Protection Works"
7+
- link: "/security/default_rules/?category=cat-application-security"
8+
tag: "Documentation"
9+
text: "OOTB App and API Protection Rules"
10+
- link: "/security/application_security/troubleshooting"
11+
tag: "Documentation"
12+
text: "Troubleshooting App and API Protection"
13+
---
14+
15+
{{< partial name="api_security/callout.html" >}}
16+
17+
{{< partial name="api_security/java/overview.html" >}}
18+
19+
This guide explains how to set up App and API Protection (AAP) for Java applications running on AWS Fargate. The setup involves:
20+
1. Installing the Datadog Agent
21+
2. Configuring your Java application
22+
3. Enabling AAP monitoring
23+
24+
## Prerequisites
25+
26+
- AWS Fargate environment
27+
- Java application containerized with Docker
28+
- AWS CLI configured with appropriate permissions
29+
- Datadog Agent installed
30+
31+
## Setup
32+
33+
### 1. Install the Datadog Agent
34+
35+
Install the Datadog Agent in your Fargate task definition:
36+
37+
```json
38+
{
39+
"containerDefinitions": [
40+
{
41+
"name": "datadog-agent",
42+
"image": "public.ecr.aws/datadog/agent:latest",
43+
"environment": [
44+
{
45+
"name": "DD_API_KEY",
46+
"value": "<YOUR_API_KEY>"
47+
},
48+
{
49+
"name": "DD_APM_ENABLED",
50+
"value": "true"
51+
},
52+
{
53+
"name": "DD_APM_NON_LOCAL_TRAFFIC",
54+
"value": "true"
55+
}
56+
]
57+
}
58+
]
59+
}
60+
```
61+
62+
## Library setup
63+
64+
To enable AAP capabilities, you need the Datadog Java tracing library (version 0.94.0 or higher) installed in your application environment.
65+
66+
### Download the library
67+
68+
Add the following to your application's Dockerfile:
69+
70+
```dockerfile
71+
ADD 'https://dtdg.co/latest-java-tracer' /dd-java-agent.jar
72+
```
73+
74+
### Verify compatibility
75+
76+
To check that your service's language and framework versions are supported for AAP capabilities, see [Single Step Instrumentation Compatibility][2].
77+
78+
## Service configuration
79+
80+
### Standalone billing alternative
81+
82+
If you want to use Application Security Management without APM tracing functionality, you can deploy with [Standalone App and API Protection][4]. This configuration reduces the amount of APM data sent to Datadog to the minimum required by App and API Protection products.
83+
84+
To enable standalone mode:
85+
1. Set `DD_APM_TRACING_ENABLED=false` environment variable
86+
2. Keep `DD_APPSEC_ENABLED=true` environment variable
87+
3. This configuration will minimize APM data while maintaining full security monitoring capabilities
88+
89+
### Enabling AAP
90+
91+
#### Run your application with AAP enabled
92+
93+
Update your task definition to include the Java agent and AAP configuration:
94+
95+
```json
96+
{
97+
"containerDefinitions": [
98+
{
99+
"name": "your-java-app",
100+
"image": "your-java-app-image",
101+
"environment": [
102+
{
103+
"name": "DD_APPSEC_ENABLED",
104+
"value": "true"
105+
},
106+
{
107+
"name": "DD_SERVICE",
108+
"value": "<YOUR_SERVICE_NAME>"
109+
},
110+
{
111+
"name": "DD_ENV",
112+
"value": "<YOUR_ENVIRONMENT>"
113+
}
114+
],
115+
"command": [
116+
"java",
117+
"-javaagent:/dd-java-agent.jar",
118+
"-jar",
119+
"/app.jar"
120+
]
121+
}
122+
]
123+
}
124+
```
125+
126+
**Important considerations:**
127+
- **File system requirements**: Read-only file systems are not currently supported. The application must have access to a writable `/tmp` directory.
128+
- **Service identification**: Always specify `DD_SERVICE` (or `-Ddd.service`) and `DD_ENV` (or `-Ddd.env`) for proper service identification in Datadog.
129+
130+
## Verify setup
131+
132+
To verify that AAP is working correctly:
133+
134+
1. Send some traffic to your application
135+
2. Check the [Application Signals Explorer][5] in Datadog
136+
3. Look for security signals and vulnerabilities
137+
138+
## Troubleshooting
139+
140+
If you encounter issues while setting up App and API Protection for your Java application, see the [Java App and API Protection troubleshooting guide][3].
141+
142+
## Further Reading
143+
144+
{{< partial name="whats-next/whats-next.html" >}}
145+
146+
[1]: https://docs.datadoghq.com/tracing/trace_collection/automatic_instrumentation/single-step-apm/?tab=awsfargate
147+
[2]: https://app.datadoghq.com/security/appsec
148+
[3]: /security/application_security/setup/environments/java/troubleshooting
149+
[4]: /security/application_security/setup/java/standalone
150+
[5]: https://app.datadoghq.com/security/appsec

‎content/en/security/application_security/setup/environments/java/compatibility.md

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
---
2+
title: Java Compatibility Requirements
3+
code_lang: java
4+
type: multi-code-lang
5+
code_lang_weight: 20
6+
aliases:
7+
- /security/application_security/threats/setup/compatibility/java
8+
---
9+
10+
## App and API Protection capabilities
11+
12+
The following App and API Protection capabilities are supported in the Java library, for the specified tracer version:
13+
14+
| App and API Protection capability | Minimum Java tracer version |
15+
| -------------------------------------------------- | --------------------------- |
16+
| Threat Detection | 0.94.0 |
17+
| Threat Protection | 0.94.0 |
18+
| Customize response to blocked requests | 0.94.0 |
19+
| Automatic user activity event tracking | 0.94.0 |
20+
| API Security | 0.94.0 |
21+
22+
The minimum tracer version to get all supported App and API Protection capabilities for Java is 0.94.0.
23+
24+
**Note**: Threat Protection requires enabling [Remote Configuration][1], which is included in the listed minimum tracer version.
25+
26+
### Supported deployment types
27+
| Type | Threat Detection support |
28+
|------------------ | ------------------------ |
29+
| Docker | {{< X >}} |
30+
| Kubernetes | {{< X >}} |
31+
| Amazon ECS | {{< X >}} |
32+
| AWS Fargate | {{< X >}} |
33+
| AWS Lambda | {{< X >}} |
34+
| Google Cloud Run | {{< X >}} |
35+
36+
## Language and framework compatibility
37+
38+
### Supported Java versions
39+
40+
The Datadog Java Tracing library is open source. View the [GitHub repository][2] for more information.
41+
42+
The Datadog Java Tracing Library supports Java 8 and newer versions. For optimal performance and feature support, we recommend using the latest LTS version of Java.
43+
44+
You must be running Datadog Agent v7.41.1+ for App and API Protection features.
45+
46+
## Integrations
47+
48+
The Java tracer includes support for the following frameworks, data stores, and libraries:
49+
50+
### Web frameworks
51+
- Spring Boot
52+
- Spring Web
53+
- Spring WebFlux
54+
- JAX-RS
55+
- Play Framework
56+
- Spark Java
57+
- Vert.x
58+
- gRPC
59+
60+
### Data stores
61+
- JDBC
62+
- MongoDB
63+
- Redis
64+
- Elasticsearch
65+
- Cassandra
66+
- Couchbase
67+
68+
### Message brokers
69+
- Kafka
70+
- RabbitMQ
71+
- JMS
72+
73+
### Other
74+
- OkHttp
75+
- Apache HttpClient
76+
- JSP
77+
- Servlet
78+
- GraphQL
79+
80+
For a complete list of supported integrations and their versions, see the [Java tracer documentation][3].
81+
82+
[1]: /agent/remote_config/#enabling-remote-configuration
83+
[2]: https://github.com/DataDog/dd-trace-java
84+
[3]: /tracing/trace_collection/compatibility_requirements/java

‎content/en/security/application_security/setup/environments/java/docker.md

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
---
2+
title: Setup App and API Protection for Java in Docker
3+
code_lang: docker
4+
type: multi-code-lang
5+
code_lang_weight: 10
6+
further_reading:
7+
- link: "/security/application_security/how-it-works/"
8+
tag: "Documentation"
9+
text: "How App and API Protection Works"
10+
- link: "/security/default_rules/?category=cat-application-security"
11+
tag: "Documentation"
12+
text: "OOTB App and API Protection Rules"
13+
- link: "/security/application_security/troubleshooting"
14+
tag: "Documentation"
15+
text: "Troubleshooting App and API Protection"
16+
---
17+
18+
{{< partial name="api_security/callout.html" >}}
19+
20+
{{< partial name="api_security/java/overview.html" >}}
21+
22+
This guide explains how to set up App and API Protection (AAP) for Java applications running in Docker containers. The setup involves:
23+
1. Installing the Datadog Agent
24+
2. Configuring your Java application container
25+
3. Enabling AAP monitoring
26+
27+
## Prerequisites
28+
29+
- Docker installed on your host
30+
- Java application containerized with Docker
31+
- Datadog Agent installed on the host or as a container
32+
33+
# Setup
34+
35+
## 1. Install and run the Datadog Agent
36+
37+
If you haven't already, install the Datadog Agent on your host or as a container. For containerized installation:
38+
39+
```bash
40+
docker run -d --name datadog-agent \
41+
-v /var/run/docker.sock:/var/run/docker.sock:ro \
42+
-v /proc/:/host/proc/:ro \
43+
-v /sys/fs/cgroup/:/host/sys/fs/cgroup:ro \
44+
-e DD_API_KEY=<YOUR_API_KEY> \
45+
-e DD_APM_ENABLED=true \
46+
-e DD_APM_NON_LOCAL_TRAFFIC=true \
47+
datadog/agent:latest
48+
```
49+
50+
### Library setup
51+
52+
To enable AAP capabilities, you need the Datadog Java tracing library (version 0.94.0 or higher) installed in your application environment. Normally, this is done with the run command above, however, if it does not, you can download the agent manually.
53+
54+
#### Download the library
55+
56+
Download the latest version of the Datadog Java library:
57+
58+
```dockerfile
59+
ADD 'https://dtdg.co/latest-java-tracer' /dd-java-agent.jar
60+
```
61+
62+
#### Verify compatibility
63+
64+
To check that your service's language and framework versions are supported for AAP capabilities, see [Single Step Instrumentation Compatibility][2].
65+
66+
## Service configuration
67+
68+
### Run your application with AAP enabled
69+
{{% tabs %}}
70+
{{% tab "APM Tracing Enabled" %}}
71+
72+
Start your Java application with the Datadog agent and AAP enabled:
73+
74+
```dockerfile
75+
ENTRYPOINT ["java", "-javaagent:/dd-java-agent.jar", "-Ddd.appsec.enabled=true", "-Ddd.service=<MY_SERVICE>", "-Ddd.env=<MY_ENV>", "-jar", "/app.jar"]
76+
```
77+
{{% /tab %}}
78+
{{% tab "APM Tracing Disabled (Standalone Billing)" %}}
79+
80+
If you want to use Application Security Management without APM tracing functionality, you can deploy with [Standalone App and API Protection][2]. This configuration reduces the amount of APM data sent to Datadog to the minimum required by App and API Protection products.
81+
82+
To enable standalone mode:
83+
1. Set `DD_APM_TRACING_ENABLED=false` environment variable
84+
2. Keep `DD_APPSEC_ENABLED=true` environment variable
85+
3. This configuration will minimize APM data while maintaining full security monitoring capabilities
86+
87+
```dockerfile
88+
ENTRYPOINT ["java", "-javaagent:/dd-java-agent.jar", "-Ddd.appsec.enabled=true", "-Ddd.apm.tracing.enabled=false", "-Ddd.service=<MY_SERVICE>", "-Ddd.env=<MY_ENV>", "-jar", "/app.jar"]
89+
```
90+
91+
**Important considerations:**
92+
- **File system requirements**: Read-only file systems are not currently supported. The application must have access to a writable `/tmp` directory.
93+
- **Service identification**: Always specify `DD_SERVICE` (or `-Ddd.service`) and `DD_ENV` (or `-Ddd.env`) for proper service identification in Datadog.
94+
{{% /tab %}}
95+
{{% /tabs %}}
96+
97+
## 2. Configure your Java application container
98+
99+
Add the following to your Dockerfile:
100+
101+
```dockerfile
102+
# Download the Datadog Java agent
103+
ADD 'https://dtdg.co/latest-java-tracer' /dd-java-agent.jar
104+
105+
# Set environment variables
106+
ENV DD_APPSEC_ENABLED=true
107+
ENV DD_SERVICE=<YOUR_SERVICE_NAME>
108+
ENV DD_ENV=<YOUR_ENVIRONMENT>
109+
110+
# Add the Java agent to your application's startup command
111+
ENTRYPOINT ["java", "-javaagent:/dd-java-agent.jar", "-jar", "/app.jar"]
112+
```
113+
114+
## 3. Run your container
115+
116+
When running your container, make sure to:
117+
1. Connect it to the same Docker network as the Datadog Agent
118+
2. Set the required environment variables
119+
120+
```bash
121+
docker run -d \
122+
--name your-java-app \
123+
--network datadog-network \
124+
-e DD_APPSEC_ENABLED=true \
125+
-e DD_SERVICE=<YOUR_SERVICE_NAME> \
126+
-e DD_ENV=<YOUR_ENVIRONMENT> \
127+
your-java-app-image
128+
```
129+
130+
### Verify setup
131+
132+
To verify that AAP is working correctly:
133+
134+
1. Send some traffic to your application
135+
2. Check the [Application Signals Explorer][5] in Datadog
136+
3. Look for security signals and vulnerabilities
137+
138+
## Troubleshooting
139+
140+
If you encounter issues while setting up App and API Protection for your Java application, see the [Java App and API Protection troubleshooting guide][3].
141+
142+
## Further Reading
143+
144+
{{< partial name="whats-next/whats-next.html" >}}
145+
146+
[1]: https://docs.datadoghq.com/tracing/trace_collection/automatic_instrumentation/single-step-apm/?tab=docker
147+
[2]: /security/application_security/setup/environments/java/compatibility
148+
[3]: /security/application_security/setup/environments/java/troubleshooting
149+
[4]: /security/application_security/setup/java/standalone
150+
[5]: https://app.datadoghq.com/security/appsec

0 commit comments

Comments
 (0)