The following App and API Protection capabilities are supported in the Java library, for the specified tracer version:
App and API Protection capability
Minimum Java tracer version
Threat Detection
1.8.0
API Security
1.31.0
Threat Protection
1.9.0
Customize response to blocked requests
1.11.0
Automatic user activity event tracking
1.20.0
The minimum tracer version to get all supported App and API Protection capabilities for Java is 1.31.0.
Note: Threat Protection requires enabling Remote Configuration, which is included in the listed minimum tracer version.
Supported deployment types
Threat Detection is supported in the following deployment types:
Docker
Kubernetes
Amazon ECS
AWS Fargate
AWS Lambda
Azure App Service
Note: Azure App Service is supported for web applications only. App and API Protection doesn’t support Azure Functions.
Language and framework compatibility
Supported Java versions
The Java Tracer supports automatic instrumentation for the following Oracle JDK and OpenJDK JVM runtimes.
JVM versions
Operating Systems
Support level
Tracer version
8 to 17
Windows (x86-64) Linux (glibc, musl) (arm64, x86-64) MacOS (arm64, x86-64)
Supported
Latest
Datadog does not officially support any early-access versions of Java.
Web framework compatibility
Attacker source HTTP request details
Tags for the HTTP request (status code, method, etc)
Distributed Tracing to see attack flows through your applications
Framework
Versions
Threat Detection supported?
Threat Protection supported?
Grizzly
2.0+
Glassfish
gRPC
1.5+
Blocking not yet available for gRPC
Java Servlet
2.3+, 3.0+
Jetty
7.0-9.x, 10.x
Spring Boot
1.5
Spring Web (MVC)
4.0+
Spring WebFlux
5.0+
Tomcat
5.5+
Vert.x
3.4-3.9.x
Note: Many application servers are Servlet compatible and are automatically covered by that instrumentation, such as Websphere, Weblogic, and JBoss. Also, frameworks like Spring Boot (version 3) inherently work because they usually use a supported embedded application server, such as Tomcat, Jetty, or Netty.
