Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clarify expected agentless costs #27350

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
+13 −1
Open

Clarify expected agentless costs #27350

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
edb6720
SEC-18536: clarify agentless costs
aviat Jan 28, 2025
0b48fb1
Merge branch 'master' into jeanbaptiste.aviat/al-costs
aviat Jan 28, 2025
c09f893
Fix doc
aviat Feb 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion .../en/security/cloud_security_management/agentless_scanning/deployment_methods.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,10 +17,12 @@

There are two recommended ways to deploy Agentless scanners in your environment, either using cross-account scanning, or same account scanning.

**Note**: When using Agentless Scanning, there are additional costs for running scanners in your cloud environments. To optimize on costs while being able to reliably scan every 12 hours, Datadog recommends setting up Agentless Scanning with Terraform as the default template, as this also avoids cross-region networking.
**Note**: When using Agentless Scanning, there are additional costs for running scanners in your cloud environments. To optimize on costs while being able to reliably scan every 12 hours, Datadog recommends setting up Agentless Scanning with Terraform as the default template, as this also avoids cross-region networking.

Check notice on line 20 in content/en/security/cloud_security_management/agentless_scanning/deployment_methods.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.sentencelength 

Suggestion: Try to keep your sentence length to 25 words or fewer.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this is related to configuration, recommend moving to the "Recommended configuration" section.

Suggested change
**Note**: When using Agentless Scanning, there are additional costs for running scanners in your cloud environments. To optimize on costs while being able to reliably scan every 12 hours, Datadog recommends setting up Agentless Scanning with Terraform as the default template, as this also avoids cross-region networking.


To establish estimates on scanner costs, reach out to your [Datadog Customer Success Manager][1].

The scanner cost is under $1 per scanned host per year for accounts following the [recommended configuration](#recommended-configuration).

{{< tabs >}}
{{% tab "Cross-account scanning" %}}

Expand All @@ -47,6 +49,16 @@
{{% /tab %}}
{{< /tabs >}}

## Recommended configuration

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a suggestion from above to move the note to down to the recommended config section.

Suggested change
Agentless Scanning incurs additional costs for running scanners in your cloud environments. To manage costs while ensuring reliable scans every 12 hours, Datadog recommends setting up Agentless Scanning with Terraform as the default template, which also prevents cross-region networking.

To improve the scanner's efficacy, ensure your setup follows those guidelines:

- Scanners are deployed in a single AWS account
- A scanner is deployed in each region that has either:
- More than 250 hosts
- Any data store if using [Cloud Storage Scanning](/security/cloud_security_management/agentless_scanning#cloud-storage-scanning)
Comment on lines +56 to +59
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- Scanners are deployed in a single AWS account
- A scanner is deployed in each region that has either:
- More than 250 hosts
- Any data store if using [Cloud Storage Scanning](/security/cloud_security_management/agentless_scanning#cloud-storage-scanning)
- Deploy scanners within a single AWS account
- Deploy a scanner in each region that has more than 250 hosts
- Deploy a scanner in any region containing a data store if using [Cloud Storage Scanning][2]

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add the link to the bottom of the page [2]: /security/cloud_security_management/agentless_scanning#cloud-storage-scanning


Datadog automatically schedules scans to the right region to minimize the cross region costs.

**Note**: The actual scanned data remains in your infrastructure, and only the collected list of packages, as well as information related to collected hosts (hostnames/EC2 Instances), are reported back to Datadog.

Expand Down
Loading