From e905fcae7f8f171812387ba61cd38140682fc8d3 Mon Sep 17 00:00:00 2001 From: DeForest Richards Date: Thu, 11 Jun 2026 16:15:19 -0600 Subject: [PATCH 1/2] Initial commit --- config/_default/menus/main.en.yaml | 31 ++++++++++------- .../threat_protection/_index.md | 34 +++++++++++++++++++ layouts/partials/nav/left-nav.html | 2 +- 3 files changed, 53 insertions(+), 14 deletions(-) create mode 100644 content/en/security/application_security/threat_protection/_index.md diff --git a/config/_default/menus/main.en.yaml b/config/_default/menus/main.en.yaml index 1331c833030..1e3330dee04 100644 --- a/config/_default/menus/main.en.yaml +++ b/config/_default/menus/main.en.yaml @@ -8185,11 +8185,16 @@ menu: parent: application_security identifier: application_security_overview weight: 4 + - name: Threat Protection + url: security/application_security/threat_protection/ + parent: application_security + identifier: application_security_threat_protection + weight: 5 - name: Security Signals url: security/application_security/security_signals - parent: application_security + parent: application_security_threat_protection identifier: application_security_security_signals - weight: 5 + weight: 1 - name: Attackers Explorer url: security/application_security/security_signals/attacker-explorer/ parent: application_security_security_signals @@ -8212,9 +8217,9 @@ menu: weight: 4 - name: Policies url: security/application_security/policies/ - parent: application_security + parent: application_security_threat_protection identifier: application_security_policies - weight: 6 + weight: 2 - name: Custom Rules url: security/application_security/policies/custom_rules/ parent: application_security_policies @@ -8237,24 +8242,24 @@ menu: weight: 4 - name: Exploit Prevention url: security/application_security/exploit-prevention/ - parent: application_security + parent: application_security_threat_protection identifier: exploit_prevention - weight: 7 + weight: 3 - name: WAF Integrations url: security/application_security/waf-integration/ - parent: application_security + parent: application_security_threat_protection identifier: aws_waf_int - weight: 8 + weight: 4 - name: Account Takeover Protection url: security/application_security/account_takeover_protection/ - parent: application_security + parent: application_security_threat_protection identifier: security_ato_protection - weight: 9 + weight: 5 - name: API Posture url: security/application_security/api_posture/ parent: application_security identifier: application_security_api_security - weight: 10 + weight: 6 - name: API Inventory url: security/application_security/api_posture/api_inventory/ parent: application_security_api_security @@ -8289,12 +8294,12 @@ menu: url: security/application_security/guide/ parent: application_security identifier: appsec_guides - weight: 11 + weight: 7 - name: Troubleshooting url: security/application_security/troubleshooting/ parent: application_security identifier: appsec_troubleshooting - weight: 12 + weight: 8 - name: AI Guard url: /security/ai_guard/ pre: siem diff --git a/content/en/security/application_security/threat_protection/_index.md b/content/en/security/application_security/threat_protection/_index.md new file mode 100644 index 00000000000..a5de9688b6e --- /dev/null +++ b/content/en/security/application_security/threat_protection/_index.md @@ -0,0 +1,34 @@ +--- +title: Threat Protection +description: Detect, investigate, and block application and API attacks in real time with Threat Protection in App and API Protection. +further_reading: +- link: "https://www.datadoghq.com/blog/datadog-exploit-prevention/" + tag: "Blog" + text: "Protect your applications from zero-day attacks with Datadog Exploit Prevention" +--- + +Use Threat Protection in [App and API Protection][1] (AAP) to detect attacks against your applications and APIs, investigate them, and block malicious traffic in real time. + +To get started, [set up AAP][2] on your services so they report security traces. AAP then detects threats from your live application traffic and lets you respond to them. + +## How Threat Protection works + +Threat Protection brings together several capabilities, all built on the same live application data. With them, you can: + +- Detect and investigate threats with [Security Signals][3]. Datadog creates a security signal when it detects a threat from a detection rule, so you can triage, filter, and investigate attacks in the Signals Explorer. +- Block attacks and attackers with [Policies][4]. Block malicious IP addresses and users in real time from the Datadog UI, manually or through automated rules. +- Stop exploit attempts in code with [Exploit Prevention][5]. Detect and block attempts to exploit vulnerabilities, including zero-day attacks, from within the running application. +- Extend protection to the perimeter with [WAF Integrations][6]. Combine in-app protection with edge defenses such as AWS WAF for a defense-in-depth approach. +- Defend user accounts with [Account Takeover Protection][7]. Detect and mitigate account takeover attacks, such as credential stuffing, and disable compromised users. + +## Further reading + +{{< partial name="whats-next/whats-next.html" >}} + +[1]: /security/application_security/ +[2]: /security/application_security/setup/ +[3]: /security/application_security/security_signals/ +[4]: /security/application_security/policies/ +[5]: /security/application_security/exploit-prevention/ +[6]: /security/application_security/waf-integration/ +[7]: /security/application_security/account_takeover_protection/ diff --git a/layouts/partials/nav/left-nav.html b/layouts/partials/nav/left-nav.html index d82babd2756..99bc259e1e9 100644 --- a/layouts/partials/nav/left-nav.html +++ b/layouts/partials/nav/left-nav.html @@ -69,7 +69,7 @@