Agentless Docs Update for Cloud Security Management by leo-wang-dd · Pull Request #34641 · DataDog/documentation

leo-wang-dd · 2026-02-17T16:25:03Z

What does this PR do? What is the motivation?

Comprehensive audit and improvement of the Agentless Scanning documentation. Key changes:

Architecture explainer: Rewrote the "How it works" section to clearly explain Datadog's in-environment scanning approach and data
privacy model (SBOM is the only data that leaves the customer's environment)
Cost transparency: Replaced vague "$1/host/year" with a detailed cost breakdown table (~$80/mo fixed per scanner, ~$0.10/mo per scanned
host)
Deployment playbook: Rewrote deployment_methods.md as a structured decision tree (single vs multi-account → regional distribution →
capacity limits → enterprise networking)
Compatibility fixes: Added Kubernetes support row (EKS/AKS/GKE with caveats), fixed registry scanning caveats (ECR at-rest vs GAR/ACR
running-only), added Host Images and SDS rows
Troubleshooting page: Created new troubleshooting/agentless_scanning.md covering common deployment issues
Multi-cloud language: Fixed AWS-only wording across setup and vulnerabilities pages to reflect Azure and GCP GA support
Consistency pass: Standardized "Agentless Scanning" capitalization, defined SBOM at first use in every file, aligned timelines across
pages

Fixes DOCS-XXXXX

Merge instructions

Merge readiness:

Ready for merge

Additional notes

The compatibility table now includes "coming soon" entries for Azure Container Apps, Azure Container Instances, and ACR. These are not yet
GA.
S3/RDS scanning callout was changed from "Preview" to "private beta" to match current availability.
On-demand scanning section is scoped to AWS only.

…g overview - Add prominent explanation of Datadog's in-environment scanning architecture (data never leaves customer account) as key differentiator - Replace vague "$1/host/year" cost section with detailed cost breakdown table ($80/mo fixed per scanner, $0.10/mo per scanned host) - Add regional scanner guidance (150+ hosts threshold) - Add GovCloud/FIPS not-supported callout - Fix "Leveraging" → "Using" per style guide - Note 24-hour scanner rotation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Replace thin cross-account/same-account tabs with a 4-step decision tree: 1. Single vs multi-account topology 2. Regional scanner distribution (150+ host threshold, down from 250) 3. Scanner capacity limits (4 per region, 200 hosts per cycle) 4. Enterprise networking (existing VPC for SCP-restricted environments) - Add capacity limits table and ASG hard cap warning - Add scanner reboot/queue reset note - Consolidate recommended configuration section Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Registry scanning caveats: - ECR: clarify it scans running images + last 1,000 pushed at-rest - GAR: clarify running workloads only, no at-rest scanning - ACR: add as coming ~end of March 2026, running containers only - Add registry comparison table with clear support levels Kubernetes caveats: - EKS: EC2 nodes only, no Fargate, scans underlying instances - AKS: VMs only, not VMSS, not ACI - GKE: Standard only, no Autopilot, no image streaming Additional coverage: - Add Kubernetes row to main compatibility table - Add Host Images row (AMI only) - Add Sensitive Data row (S3, RDS private beta) - Add Azure Container Apps/Instances coming ~end of March 2026 - Clarify GCP Cloud Run container deployment type limitation - Add GovCloud Remote Config dependency and FIPS note Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- setup/_index.md: Change "AWS hosts, Lambda functions, AMIs" to "AWS, Azure, and GCP cloud hosts, containers, serverless functions, and host images" to reflect multi-cloud GA support - vulnerabilities/_index.md: Add caveats to registry table — ECR supports running + at-rest, GAR supports running workloads only. Clarify Cloud Run container deployment type limitation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Add expected timeline after deployment (0-15 min discovery, 15-30 min scanning, 30-60 min results) so users know the product is not broken during the initial wait - Add callout that first results appear within ~1 hour - Add CF parameter guidance: note that non-CSM parameters can be left at defaults for vulnerability management-only setups - Improve Terraform section intro with multi-region recommendation and link to deployment topology guide Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

New page covers: - Post-deployment wait (expected 0-60 min timeline, verification steps) - VPC creation failures due to SCP restrictions - Scanner capacity limits and ASG hard cap - Scanner instances appearing as vulnerable hosts (with filter guidance) - Agent deduplication behavior explanation - Cross-region cost troubleshooting - GovCloud/FIPS limitations Also updates troubleshooting index to link to new page. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

VMSS-backed AKS nodes are supported for agentless scanning. Only AKS on ACI remains unsupported. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Restructure opening to emphasize the 3-step flow: deploy in-environment, scan locally, only SBOM leaves - Frame Datadog's approach as a deliberate choice for data privacy - Lead with data privacy as core value in benefits list - Add data residency/sovereignty framing - Replace Lambda-specific references with cloud-agnostic "serverless functions" - Clarify that only the SBOM (not raw data) is transmitted to Datadog - Remove Trivy database mention from vulnerability matching step Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…initions, capitalization

…n-demand section

leo-wang-dd · 2026-02-17T16:25:30Z

Still adjusting a few changes

github-actions · 2026-02-17T16:32:11Z

Preview links (active after the `build_preview` check completes)

New or renamed files

Modified Files

…guidance

domalessi · 2026-02-17T20:38:21Z

Created DOCS-13425 for editorial review. Thanks for all the work here, @leo-wang-dd !

…page

…ssues - Add data flow statement to intro (SBOM-only, data stays in customer infra) - Add before-you-begin overview with time estimate and numbered steps - Remove contradictory Quick Start callouts from CloudFormation and Terraform - Deduplicate "After setup" links from 10 instances to 3 (one per cloud tab) - Add Terraform examples directory links to all three cloud providers - Add nested stack context to CloudFormation update instructions - Fix style: remove "straightforward", "not yet", danger->warning for SDS callout, standardize bold nav formatting, merge redundant GCP steps, split long sentences, fix step numbering, add alt text to images - Clean up orphaned link references across tab scopes - Fix shortcodes: "refer to" -> "see", "Click on" -> "Click"

Hugo's tabs shortcode flattens nested {{< tabs >}} into a single tab bar, causing "New AWS account", "Existing AWS account", etc. to appear as empty top-level tabs. Replace inner tabs within CloudFormation, Terraform, and Azure ARM sections with h5 headings to keep New/Existing paths visually separated without breaking the outer cloud-provider tabs.

…ontent cleanup - Remove Kubernetes EC2 implementation detail from compatibility table - Rewrite regional distribution section for clarity in deployment_methods - Simplify recommended config section to just summary bullets - Convert numbered link refs to inline links (fix broken refs in collapse-content) - Wrap Azure ARM and GCP Cloud Shell in collapse-content for consistency - Trim Quick Start to minimal description with first-time-only callout - Add multi-subscription Terraform recommendation for Azure - Remove CloudFormation template parameters and exclude resources sections - Update verify timing to 20-minute first scan cycle

…iew and setup - Move "Updating your deployment" to dedicated update.md page - Reorder overview: cloud provider cost above security considerations, on-demand scanning to bottom - Condense security considerations from 8 bullets to 4 - Replace "Agent installations" section with inline info callout - Fix setup overview: agentless provides breadth, Agent adds depth - Trim enable.md: permissions transparency note, 30-min scan cycle

…ify cloud storage - Replace deployment topology callout with inline Step 1: Plan your deployment - Add Step 2: Deploy heading for cloud provider tabs - Remove Cloud Storage Scanning private beta callout (now GA) - Shorten Cloud Storage section to concise description - Update permissions transparency wording - Set first scan cycle to 30 minutes

leo-wang-dd · 2026-02-20T21:17:56Z

Finished changes on my side

mohamed-challal

Great job Leo! I think we should reword some sections before merging.
I will continue the review on Monday

content/en/security/cloud_security_management/troubleshooting/agentless_scanning.md

content/en/security/cloud_security_management/setup/_index.md

content/en/security/cloud_security_management/setup/agentless_scanning/_index.md

mohamed-challal · 2026-02-20T22:25:34Z

content/en/security/cloud_security_management/setup/agentless_scanning/_index.md

-This is useful when you need to:
- Verify a vulnerability has been patched
- Get immediate results for newly deployed resources
- Validate security posture before production deployment
-
-For more information, see the [On-Demand Scanning API documentation][14].


We are removing this part?

We moved it to the bottom of the page

Yes, but we removed the use cases examples, is it intentional?

content/en/security/cloud_security_management/troubleshooting/agentless_scanning.md

content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md

content/en/security/cloud_security_management/setup/agentless_scanning/enable.md

content/en/security/cloud_security_management/setup/agentless_scanning/update.md

…agentless_scanning.md Co-authored-by: Mohamed Challal <mohamed.challal@datadoghq.com>

- Reword Agent exclusion: SBOM collection → Vulnerability Management features - Link to docs page instead of app for Vulnerability Management - Expand scanner-as-vulnerable-host explanation (cause before fix) - Rename cross-region costs heading, softer wording - Add back exclude resources one-liner with link to resource filters - Remove "only" from AMI in compatibility table - Remove Azure Cloud Shell not-available callout

mohamed-challal

Could you add the new pages (upate and troobleshooting) to the navigation bar and the further reading sections, to access them easily, please

…g pages

leo-wang-dd and others added 14 commits February 16, 2026 11:59

Mark AKS on VMSS as supported in compatibility table

03580cc

VMSS-backed AKS nodes are supported for agentless scanning. Only AKS on ACI remains unsupported. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Make serverless function step cloud-agnostic with Lambda as example

4281f2d

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove unverified details from troubleshooting and deployment guides

16a9620

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Review fixes: consistent timelines, cloud-agnostic language, SBOM def…

bff4da1

…initions, capitalization

Scope on-demand scanning section to AWS only

2f9bdb6

Verification fixes: accurate timelines, specific instance IDs, trim o…

1ffa012

…n-demand section

Replace specific March 2026 dates with coming soon

86a66ce

leo-wang-dd requested a review from a team as a code owner February 17, 2026 16:25

Fix parity implication in setup overview, restore data store scanner …

f8f2f12

…guidance

domalessi added the editorial review Waiting on a more in-depth review label Feb 17, 2026

leo-wang-dd added 5 commits February 17, 2026 18:33

Add support ticket path for at-rest registry scanning requests

75e7911

Remove 24-hour reboot note from deployment methods

1e7ba1b

Remove hosts per cycle row from capacity table

1dfeefc

Add ACR coming soon to container registries table in vulnerabilities …

174aeb8

…page

github-actions bot added the Architecture Everything related to the Doc backend label Feb 19, 2026

Add cloud provider cost link to enable page intro

f673eb6

janine-c self-assigned this Feb 19, 2026

leo-wang-dd added 2 commits February 19, 2026 17:13

leo-wang-dd added 2 commits February 20, 2026 15:43

mohamed-challal reviewed Feb 20, 2026

View reviewed changes

leo-wang-dd and others added 2 commits February 23, 2026 13:19

Update content/en/security/cloud_security_management/troubleshooting/…

574a224

…agentless_scanning.md Co-authored-by: Mohamed Challal <mohamed.challal@datadoghq.com>

mohamed-challal reviewed Feb 24, 2026

View reviewed changes

Add nav sidebar entries and cross-links for update and troubleshootin…

2d2c6ae

…g pages

Conversation

leo-wang-dd commented Feb 17, 2026

What does this PR do? What is the motivation?

Merge instructions

Additional notes

Uh oh!

leo-wang-dd commented Feb 17, 2026

Uh oh!

github-actions bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Preview links (active after the build_preview check completes)

New or renamed files

Modified Files

Uh oh!

domalessi commented Feb 17, 2026

Uh oh!

leo-wang-dd commented Feb 20, 2026

Uh oh!

mohamed-challal left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mohamed-challal Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

leo-wang-dd Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

mohamed-challal Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mohamed-challal left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions bot commented Feb 17, 2026 •

edited

Loading

Preview links (active after the `build_preview` check completes)