Code Security capabilities

The following code security capabilities are supported in the Java library, for the specified tracer version:

The minimum tracer version to get all supported code security capabilities for Java is 1.15.0.

Note: Static Software Composition Analysis (SCA) and Static Code Analysis (SAST) capabilities do not require Datadog’s tracing library. Therefore, the requirements listd above do not apply to these two Code Security capabilities.

Supported deployment types

Note: Azure App Service is supported for web applications only. Code Security doesn’t support Azure Functions.

Language and framework compatibility

Supported Java versions

The Java Tracer supports automatic instrumentation for the following Oracle JDK and OpenJDK JVM runtimes.

Datadog does not officially support any early-access versions of Java.

Web framework compatibility

• Tags for the HTTP request (status code, method, etc)
• Distributed Tracing to see attack flows through your applications

Code Security Capability Notes

• Runtime Software Composition Analysis (SCA) is supported on all frameworks
• If Runtime Code Analysis (IAST) does not support your framework, it will still detect Weak Cipher, Weak Hashing, Insecure Cookie, Cookie without HttpOnly Flag, and Cookie without SameSite Flag vulnerabilities.

Note: Many application servers are Servlet compatible and are automatically covered by that instrumentation, such as Websphere, Weblogic, and JBoss. Also, frameworks like Spring Boot (version 3) inherently work because they usually use a supported embedded application server, such as Tomcat, Jetty, or Netty.

Networking framework compatibility

dd-java-agent includes support for automatically tracing the following networking frameworks.

Networking tracing provides:

Code Security Capability Notes

• Runtime Software Composition Analysis (SCA) is supported on all frameworks
• If Runtime Code Analysis (IAST) does not support your framework, it will still detect Weak Cipher, Weak Hashing, Insecure Cookie, Cookie without HttpOnly Flag, and Cookie without SameSite Flag vulnerabilities.

Data store compatibility

dd-java-agent includes support for automatically tracing the following database frameworks/drivers.

Datastore tracing provides:

• Query info (for example, a sanitized query string)
• Error and stacktrace capturing

Code Security Capability Notes

• Runtime Software Composition Analysis (SCA) is supported on all frameworks
• If your framework is not supported below, Runtime Code Analysis (IAST) won’t detect SQL Injection vulnerabilities, but will still detect the rest of vulnerability types listed here.