Manage cloud workload protection

Cloud workload protection detects threats on your Linux VMs and Kubernetes workloads while they run, and can block some of them. It also sends process, file, and network activity to Elastic Security, where Elastic's prebuilt detection rules and machine learning models can use it to find threats.

To deploy cloud workload protection first, refer to Set up. To review cloud configuration findings and benchmarks instead, refer to Cloud Security.

Cloud workload protection uses one integration for VMs and another for Kubernetes containers:

• Linux VMs: Use Elastic Defend, the same integration that protects your other hosts. It detects and prevents malicious behavior, memory threats, and malware. To collect session data by default, select one of the Cloud workloads presets when you configure the integration.
• Serverless Beta Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Beta This functionality is in beta and is not ready for production usage. For beta features, the design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Stack Beta 9.3+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Beta since 9.3 This functionality is in beta and is not ready for production usage. For beta features, the design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Kubernetes containers: Use the Defend for Containers (D4C) integration. Each D4C policy has selectors, which match file and process operations, and responses, which log, alert on, or block the operations that match. The default policy logs process activity for threat detection, and alerts on drift, which is a change to a container's executables.

After you configure cloud workload protection, you can:

• Manage Elastic Defend to tune policies and exceptions for your Linux VMs.
• Install prebuilt rules that detect threats in container and cloud workload data.
• Review a Linux process session in Session View to investigate suspicious activity.