Overview

Datadog Application Security Management (ASM) provides App and API Protection (AAP) capabilities including:

• Application Security Monitoring: Real-time threat detection and protection against attacks like SQL injection, XSS, and more
• Software Composition Analysis (SCA): Identification of vulnerable dependencies in your codebase
• Interactive Application Security Testing (IAST): Runtime vulnerability detection during testing

ASM works by leveraging the Datadog Java tracing library to monitor HTTP requests, analyze patterns, and detect security threats in real-time. The library integrates seamlessly with your existing application without requiring code changes.

For detailed compatibility information, including supported Java versions, frameworks, and deployment environments, see Single Step Instrumentation Compatibility.

This guide explains how to set up App and API Protection (AAP) for Java applications running on macOS. The setup involves:

1. Installing the Datadog Agent
2. Configuring your Java application
3. Enabling AAP monitoring

Prerequisites

• macOS operating system
• Java application
• Homebrew (recommended for Agent installation)
• Administrator privileges for some configuration steps

Setup

1. Install the Datadog Agent

Using Homebrew (recommended)

brew install datadog/datadog/datadog-agent

Manual installation

1. Download the macOS installer from the Datadog Agent installation page
2. Open the downloaded .dmg file
3. Follow the installation wizard

Library setup

To enable AAP capabilities, you need the Datadog Java tracing library (version 0.94.0 or higher) installed in your application environment.

Download the library

Download the latest version of the Datadog Java library:

curl -Lo dd-java-agent.jar 'https://dtdg.co/latest-java-tracer'

Verify compatibility

To check that your service’s language and framework versions are supported for AAP capabilities, see Single Step Instrumentation Compatibility.

Service configuration

Run your application with AAP enabled

java -javaagent:/path/to/dd-java-agent.jar -Ddd.appsec.enabled=true -Ddd.service=<MY_SERVICE> -Ddd.env=<MY_ENV> -jar path/to/app.jar

java -javaagent:/path/to/dd-java-agent.jar -Ddd.appsec.enabled=true -Ddd.apm.tracing.enabled=false -Ddd.service=<MY_SERVICE> -Ddd.env=<MY_ENV> -jar path/to/app.jar

2. Configure the Datadog Agent

1. Create or edit the Agent configuration file:

   sudo nano /opt/datadog-agent/etc/datadog/datadog.yaml
   

2. Add the following configuration:

   api_key: <YOUR_API_KEY>
   site: <YOUR_DD_SITE>
   apm_config:
     enabled: true
   logs_config:
     enabled: true
   

3. Start the Agent:

   sudo launchctl load -w /Library/LaunchDaemons/com.datadoghq.agent.plist
   

3. Configure your Java application

Set environment variables

Set the required environment variables in your shell:

export DD_APPSEC_ENABLED=true
export DD_SERVICE=<YOUR_SERVICE_NAME>
export DD_ENV=<YOUR_ENVIRONMENT>

For permanent environment variables, add them to your shell profile (e.g., ~/.zshrc or ~/.bash_profile):

echo 'export DD_APPSEC_ENABLED=true' >> ~/.zshrc
echo 'export DD_SERVICE=<YOUR_SERVICE_NAME>' >> ~/.zshrc
echo 'export DD_ENV=<YOUR_ENVIRONMENT>' >> ~/.zshrc

Verify setup

To verify that AAP is working correctly:

1. Send some traffic to your application
2. Check the Application Signals Explorer in Datadog
3. Look for security signals and vulnerabilities

Troubleshooting

If you encounter issues while setting up App and API Protection for your Java application, see the Java App and API Protection troubleshooting guide.

Further Reading

Additional helpful documentation, links, and articles:

How App and API Protection WorksDOCUMENTATION OOTB App and API Protection RulesDOCUMENTATION Troubleshooting App and API ProtectionDOCUMENTATION