# Source: https://docs.datadoghq.com/getting_started/security/application_security.md

# Source: https://docs.datadoghq.com/security/application_security.md

---
title: App and API Protection
description: >-
  Monitor threats targeting production system, leveraging the execution context
  provided by distributed traces.
breadcrumbs: Docs > Datadog Security > App and API Protection
---

# App and API Protection

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site). ().
{% /alert %}

{% /callout %}

{% callout %}
##### Get real-time security guardrails for your AI apps and agents

AI Guard helps secure your AI apps and agents in real time against prompt injection, jailbreaking, tool misuse, and sensitive data exfiltration attacks. Try it today!

[JOIN THE PREVIEW](https://www.datadoghq.com/product-preview/ai-security/)
{% /callout %}

{% image
   source="https://datadog-docs.imgix.net/images/security/application_security/app-sec-landing-page.c2f5121538f63fd687263ebf1b8a430f.png?auto=format"
   alt="A security signal panel in Datadog, which displays attack flows and flame graphs" /%}

**App & API Protection (AAP)** provides unified visibility and security for your applications and APIs, helping you detect, investigate, and prevent threats across modern workloads.

Whether you're defending public-facing APIs, internal services, or user-facing applications, AAP equips your teams with realtime OOTB threat detection, posture assessment, and in-app protections.

{% alert level="info" %}
Formerly known as Application Security Monitoring (ASM), AAP now goes beyond runtime threat detection to include API discovery, posture management, and protection capabilities.
{% /alert %}

## Key capabilities{% #key-capabilities %}

### API discovery and posture management{% #api-discovery-and-posture-management %}

- Automatically detect all APIs exposed by your services.
- Identify unprotected, undocumented, or overly permissive endpoints.
- Get detailed, contextual findings tied to specific endpoints, misconfigurations, and observed behavior.
- Evaluate API configurations against posture rules based on security best practices and compliance frameworks (e.g., OWASP API Top 10).

### Runtime threat detection and protection{% #runtime-threat-detection-and-protection %}

- Detect real-time threats such as injection attacks, account takeover attempts, and application abuse.
- Correlate multi-signal attack patterns into actionable insights.
- Block malicious traffic with In-App WAF rules using attributes like IP, user agent, headers, and more.

## Use cases{% #use-cases %}

- Protect customer data in production APIs
- Detect and block credential stuffing and ATO attacks
- Maintain API posture compliance across teams and environments
- Investigate incidents with correlated trace, log, and security data

## AAP implementation in Datadog{% #aap-implementation-in-datadog %}

If you're curious how App and API Protection is structured and how it uses tracing data to identify security problems, read [How App and API Protection Works](https://docs.datadoghq.com/security/application_security/how-it-works/).

## Configure your environment{% #configure-your-environment %}

Powered by provided [out-of-the-box rules](https://docs.datadoghq.com/security/default_rules/?category=cat-application-security), AAP detects threats without manual configuration. If you already have Datadog [APM](https://docs.datadoghq.com/tracing/) configured on a physical or virtual host, [setup](https://docs.datadoghq.com/security/application_security/setup/) only requires setting one environment variable to get started.

To start configuring your environment to detect and protect threats with AAP, follow the enabling documentation for each product. Once AAP is configured, you can begin investigating and remediating security signals in the [Security Signals Explorer](https://app.datadoghq.com/security).

## Investigate and remediate security signals{% #investigate-and-remediate-security-signals %}

In the [Security Signals Explorer](https://app.datadoghq.com/security), click on any security signal to see what happened and the suggested steps to mitigate the attack. In the same panel, view traces with their correlated attack flow and request information to gain further context.

## Exploit Prevention vs. In-App WAF{% #exploit-prevention-vs-in-app-waf %}

This section provides a summary of Exploit Prevention and how it differs from In-App Web Application Firewall (WAF) rules.

Datadog AAP includes the [Exploit Prevention](https://docs.datadoghq.com/security/application_security/exploit-prevention/) and [In-App WAF](https://docs.datadoghq.com/security/application_security/waf-integration/) features to protect your applications against exploits. Exploit Prevention is an extension of In-App WAF. Exploit Prevention leverages In-App WAF as the first line of defense and then blocks attacks missed by the WAF.

Exploit Prevention leverages Runtime Application Self-Protection (RASP) technology to determine if an application request interacts with a vulnerable code path, and then protects it from specific vulnerability types:

- SQL injection (SQLi)
- Server-Side Request Forgery (SSRF)
- Local File Inclusion (LFI)
- Command Injection

For library compatibility, see [Exploit Prevention](https://docs.datadoghq.com/security/application_security/exploit-prevention/#library-compatibility).

In addition to detecting malicious patterns in the request, Exploit Prevention differs from In-App WAF by tracking the actions performed by the application (SQL query executed, files accessed, and so on). Exploit Prevention is able to determine if user input modified the SQL query or restricted a file detrimentally, and block it.

For example, in a SQL injection attack, the goal of the attacker is to take control of the SQL query and change its meaning. Exploit Prevention parses the SQL query before execution and checks for any user parameter in the query. If one is present, Exploit Prevention checks if the SQL parser interpreted the parameter as multiple SQL tokens (changing the meaning of the SQL query). In that case, Exploit Prevention flags the query as injected.

## Disable AAP{% #disable-aap %}

For information on disabling AAP or its features, see the following:

- [Disabling AAP](https://docs.datadoghq.com/security/application_security/troubleshooting/#disabling-aap)

## Next steps{% #next-steps %}

- [From discovery to defense: Securing APIs with Datadog App and API Protection](https://www.datadoghq.com/blog/secure-api-with-datadog)
- [How App and API Protection Works](https://docs.datadoghq.com/security/application_security/how-it-works/)
- [Datadog App and API Protection](https://www.datadoghq.com/product/security-platform/application-security-monitoring/)
- [Gain visibility into risks, vulnerabilities, and attacks with APM Security View](https://www.datadoghq.com/blog/apm-security-view/)
- [Monitor AWS WAF activity with Datadog](https://www.datadoghq.com/blog/aws-waf-datadog/)
- [How Datadog Security Inbox prioritizes security risks](https://www.datadoghq.com/blog/security-inbox-prioritization/)
- [Understanding your WAF: How to address common gaps in web application security](https://www.datadoghq.com/blog/understanding-your-waf/)
- [Mitigate account takeovers with Datadog App and API Protection](https://www.datadoghq.com/blog/mitigate-account-takeovers/)