Runtime Package Prioritization: document enablement prerequisites and event volume tuning (#39354)

* Runtime Package Prioritization: document enablement prerequisites and event volume tuning

Adds the kernel, host PID namespace, and PodSecurity prerequisites, plus
enrichment interval tuning guidance for large fleets.

Co-Authored-By: Claude <noreply@anthropic.com>

* Soften system-probe memory guidance and add a verification step

Replaces the fixed memory recommendation with monitoring guidance, and
adds a verification step to each setup page.

Co-Authored-By: Claude <noreply@anthropic.com>

* Link kernel support instead of restating a version

Points at the Workload Protection distribution list rather than naming a
kernel version on three pages.

Co-Authored-By: Claude <noreply@anthropic.com>

* Correct claims that did not hold up against Agent source

- Drops the hostPID and --pid host requirements: the real dependency is the
  host /proc mount, and hostPID is baseline Agent configuration.
- States that the setting starts system-probe, which is the actual change to
  a node's footprint.
- Corrects the verification step: the Agent status output has no SBOM section,
  the sbom check appears under Collector.
- Corrects the enrichment interval trade-off: first observations bypass the
  interval, so only repeat observations are throttled.
- Drops the claim that system-probe memory grows with image count; its caches
  are fixed size.

Co-Authored-By: Claude <noreply@anthropic.com>

* Cut repeated version and Workload Protection notes, add Docker tuning

The version requirement and the Workload Protection statement each appeared
three or four times per page, and described pre-7.79 behavior the pages tell
readers not to use. Each now appears once. Adds the enrichment interval
guidance to the Docker page for parity.

Co-Authored-By: Claude <noreply@anthropic.com>

* Name the supported package managers in the scope line

"Operating system packages" was open to interpretation. States apt/dpkg,
yum/dnf/rpm, and apk, and that application libraries and unmanaged binaries
receive no runtime signals.

Co-Authored-By: Claude <noreply@anthropic.com>

* Trim wording to match the style of neighboring setup pages

Cuts mechanism explanations, the Agent status check that reported nothing
about this feature, and redundant qualifiers. Verification now leads with
the product outcome, matching the Verify sections on other setup pages.

Co-Authored-By: Claude <noreply@anthropic.com>

* State only what the feature supports, and align the RPE page

Drops two sentences that claimed more than needed. Adds the same scope
statement to the Runtime Prioritization Engine page and aligns its Agent
version guidance with the setup pages.

Co-Authored-By: Claude <noreply@anthropic.com>

* Remove the enrichment interval tuning guidance

The default is appropriate at customer scale, raising the interval reduces
signal freshness, and the effect is not observable from the Agent. Keeps the
system-probe memory note.

Co-Authored-By: Claude <noreply@anthropic.com>

* Keep only the requirements, the version risk, and the scope

Requirements now lists actual requirements. Restores the pre-7.79 Workload
Protection caveat as a single note, states signal scope once, and drops the
procfs, system-probe, and memory lines the proven enablement path never needed.

Co-Authored-By: Claude <noreply@anthropic.com>

* Remove the pre-7.79 Workload Protection note

The pages require 7.79.0 or later, so the note described a configuration
readers are not being pointed to. Removing it avoids suggesting the legacy
path is current.

Co-Authored-By: Claude <noreply@anthropic.com>

* Apply review feedback

- Add the missing period to the version bullet on the Docker and Linux pages.
- Split the runtime signals sentence on the engine page.
- Make the Agent version formatting consistent under Get started.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: agentzzk

hugo/content/en/security/cloud_security_management/setup/agent/docker.md

@@ -70,11 +70,10 @@ When enabled, the Agent uses eBPF to observe file access on your workloads and a
 *Package is running* feeds the **Reachability** dimension of the [Runtime Prioritization Engine][5]. To query these signals directly, see [Filter findings by runtime signals][6].
 
 **Requirements**:
-- Datadog Agent **7.79.0 or later**
-- Linux only (eBPF dependency)
-- Applies to operating system packages in container image vulnerability findings
+- Datadog Agent **7.79.0 or later**.
+- Linux only (eBPF dependency). See [Workload Protection setup][7] for supported distributions and kernel versions.
 
-**Note**: Use Datadog Agent **7.79.0 or later**. Earlier Agent versions enable this feature through [Workload Protection][4] and can affect its usage. From 7.79.0, runtime package prioritization runs independently and does not affect its usage.
+Runtime signals apply to packages installed by an operating system package manager (`apt`, `yum`, or `apk`) in container image vulnerability findings.
 
 Add `DD_SBOM_ENRICHMENT_USAGE_ENABLED=true` to your Docker run command:
 
@@ -88,11 +87,12 @@ docker run -d --name dd-agent \
   registry.datadoghq.com/agent:7
 {{< /code-block >}}
 
-**Note**: `DD_SBOM_ENRICHMENT_USAGE_ENABLED=true` is in Preview and requires Datadog Agent **7.79.0 or later**. From 7.79.0, runtime package prioritization runs independently of [Workload Protection][4] and does not affect its usage.
+To verify the setup, filter vulnerability findings by [runtime signals][6].
 
 [1]: /security/cloud_security_management/misconfigurations/
 [2]: /security/threats
 [3]: /security/cloud_security_management/setup#supported-deployment-types-and-features
 [4]: /security/workload_protection/
 [5]: /security/cloud_security_management/triage_and_prioritize/runtime_prioritization_engine/
-[6]: /security/cloud_security_management/triage_and_prioritize/runtime_prioritization_engine/#filter-findings-by-runtime-signals
+[6]: /security/cloud_security_management/triage_and_prioritize/runtime_prioritization_engine/#filter-findings-by-runtime-signals
+[7]: /security/workload_protection/setup/

hugo/content/en/security/cloud_security_management/setup/agent/kubernetes.md

@@ -166,7 +166,7 @@ Use the following instructions to enable Misconfigurations and Vulnerability Man
 
 {{< /tabs >}}
 
-**Note**: `enrichment.usage.enabled: true` is in Preview and requires Datadog Agent **7.79.0 or later**. From 7.79.0, runtime package prioritization runs independently of [Workload Protection][8] and does not affect its usage. See the [Runtime Package Prioritization](#runtime-package-prioritization-preview) section for more details.
+**Note**: `enrichment.usage.enabled: true` requires Datadog Agent **7.79.0 or later**. See the [Runtime Package Prioritization](#runtime-package-prioritization-preview) section for requirements.
 
 **Note**: The `languages` analyzer requires Datadog Agent **7.70 or later**. When enabled, it detects vulnerabilities in application libraries managed by the package managers below, in addition to OS packages. When the `analyzers` field is omitted, Datadog only scans OS packages for container images.
 
@@ -206,10 +206,9 @@ When enabled, the Agent uses eBPF to observe file access on your workloads and a
 
 **Requirements**:
 - Datadog Agent **7.79.0 or later**. On Kubernetes, use **7.81.0 or later** for the most complete signal coverage.
-- Linux only (eBPF dependency).
-- Applies to operating system packages in container image vulnerability findings.
+- Linux only (eBPF dependency). See [Workload Protection setup][11] for supported distributions and kernel versions.
 
-**Note**: Use Datadog Agent **7.79.0 or later**. Earlier Agent versions enable this feature through [Workload Protection][8] and can affect its usage. From 7.79.0, runtime package prioritization runs independently and does not affect its usage.
+Runtime signals apply to packages installed by an operating system package manager (`apt`, `yum`, or `apk`) in container image vulnerability findings.
 
 {{< tabs >}}
 
@@ -276,6 +275,8 @@ Restart the Agent.
 
 {{< /tabs >}}
 
+To verify the setup, filter vulnerability findings by [runtime signals][10].
+
 [1]: /security/cloud_security_management/misconfigurations/
 [2]: /security/threats
 [3]: /security/cloud_security_management/vulnerabilities
@@ -286,3 +287,4 @@ Restart the Agent.
 [8]: /security/workload_protection/
 [9]: /security/cloud_security_management/triage_and_prioritize/runtime_prioritization_engine/
 [10]: /security/cloud_security_management/triage_and_prioritize/runtime_prioritization_engine/#filter-findings-by-runtime-signals
+[11]: /security/workload_protection/setup/

hugo/content/en/security/cloud_security_management/setup/agent/linux.md

@@ -51,7 +51,7 @@ sbom:
       enabled: true
 {{< /code-block >}}
 
-**Note**: `enrichment.usage.enabled: true` is in Preview and requires Datadog Agent **7.79.0 or later**. From 7.79.0, runtime package prioritization runs independently of [Workload Protection][7] and does not affect its usage. See the [Runtime Package Prioritization](#runtime-package-prioritization-preview) section for more details.
+**Note**: `enrichment.usage.enabled: true` requires Datadog Agent **7.79.0 or later**. See the [Runtime Package Prioritization](#runtime-package-prioritization-preview) section for requirements.
 
 {{< code-block lang="bash" filename="/etc/datadog-agent/security-agent.yaml" disable_copy="false" collapsible="true" >}}
 compliance_config:
@@ -100,11 +100,10 @@ When enabled, the Agent uses eBPF to observe file access on your workloads and a
 *Package is running* feeds the **Reachability** dimension of the [Runtime Prioritization Engine][8]. To query these signals directly, see [Filter findings by runtime signals][9].
 
 **Requirements**:
-- Datadog Agent **7.79.0 or later**
-- Linux only (eBPF dependency)
-- Applies to operating system packages in container image vulnerability findings
+- Datadog Agent **7.79.0 or later**.
+- Linux only (eBPF dependency). See [Workload Protection setup][10] for supported distributions and kernel versions.
 
-**Note**: Use Datadog Agent **7.79.0 or later**. Earlier Agent versions enable this feature through [Workload Protection][7] and can affect its usage. From 7.79.0, runtime package prioritization runs independently and does not affect its usage.
+Runtime signals apply to packages installed by an operating system package manager (`apt`, `yum`, or `apk`) in container image vulnerability findings.
 
 Add the `enrichment` block to the `sbom` section of your `datadog.yaml` file:
 
@@ -121,6 +120,8 @@ sbom:
 
 Restart the Agent after applying the changes.
 
+To verify the setup, filter vulnerability findings by [runtime signals][9].
+
 **Notes**:
 
 - You can also use the following [Agent install script][5] to automatically enable Misconfigurations and Threat Detection:
@@ -146,3 +147,4 @@ sudo chgrp dd-agent /etc/datadog-agent/security-agent.yaml
 [7]: /security/workload_protection/
 [8]: /security/cloud_security_management/triage_and_prioritize/runtime_prioritization_engine/
 [9]: /security/cloud_security_management/triage_and_prioritize/runtime_prioritization_engine/#filter-findings-by-runtime-signals
+[10]: /security/workload_protection/setup/

hugo/content/en/security/cloud_security_management/triage_and_prioritize/runtime_prioritization_engine.md

@@ -55,7 +55,7 @@ When ownership is known, the engine can route findings to the right team instead
 
 ## Filter findings by runtime signals
 
-When [Runtime Package Prioritization][4] is enabled, Datadog adds the runtime signals it observes to your vulnerability findings as tags, so you can search, filter, and group by them:
+When [Runtime Package Prioritization][4] is enabled, Datadog adds the runtime signals it observes to container image vulnerability findings for packages installed by an operating system package manager (`apt`, `yum`, or `apk`). Search, filter, and group by these tags:
 
 | Signal | Tag |
 |---|---|
@@ -75,7 +75,7 @@ Signals persist for the lifetime of an image version: after a package is observe
 
 ## Get started
 
-1. Deploy the Datadog Agent version 7.79 or later with Cloud Security enabled. See [Setting Up Cloud Security][3].
+1. Deploy the Datadog Agent, version **7.79.0** or later, with Cloud Security enabled. On Kubernetes, use **7.81.0** or later for the most complete signal coverage. See [Setting Up Cloud Security][3].
 2. Enable Runtime Package Prioritization on the Agent to surface the *Package is running* signal on vulnerability findings. See the instructions to do so for [Kubernetes][4], [Docker][9], or [Linux][10] deployments.
 3. Open the [{{< ui >}}Cloud Security Summary{{< /ui >}}][5] in Datadog. Prioritized findings are surfaced at the top of each funnel and in the [{{< ui >}}Security Inbox{{< /ui >}}][6].