VOOZH about

URL: https://docs.datadoghq.com/security/application_security/guide/standalone_application_security/

⇱ Set Up App and API Protection Without APM or Infrastructure Monitoring

For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/application_security/guide/standalone_application_security.md. A documentation index is available at /llms.txt.

Set Up App and API Protection Without APM or Infrastructure Monitoring

This product is not supported for your selected Datadog site. ().

Datadog App and API Protection (AAP) is built on top of APM and runs alongside Infrastructure Monitoring by default. While Datadog recommends using AAP together with APM and Infrastructure Monitoring to adopt DevSecOps practices, you can also run AAP on its own. This configuration is referred to as Standalone App and API Protection.

Running standalone allows to be billed primarily for App and API Protection. Some APM intake is still present to support AAP features (for example, security traces), and is expected to appear on your bill.

This guide explains how to disable APM tracing and infrastructure monitoring.

Prerequisites

This guide assumes you have the following:

  • Datadog Agent: Install the Datadog Agent and configure it for your application’s operating system, container, cloud, or virtual environment. Disabling Infrastructure Monitoring requires Datadog Agent version 7.77.0 or newer.
  • Supported SDK: The Datadog SDK used by your application or service supports App and API Protection. For more details, see the guide for App and API Protection.

Compatibility

Standalone App and API Protection is supported for the following SDK versions:

LanguageVersion
.NET3.12.0
Go1.73.0
Java1.47.0
Node.js5.40.0
PHP1.8.0
Python3.2.0
Ruby2.13.0

Setup

Standalone App and API Protection requires two pieces of configuration: disabling Infrastructure Monitoring on the Datadog Agent, and disabling APM tracing on the SDK while enabling AAP.

Disable Infrastructure Monitoring on the Datadog Agent

Standalone App and API Protection uses the same Datadog Agent installation as APM. For installation steps, see Install the Datadog Agent.

To disable Infrastructure Monitoring, set the Datadog Agent infrastructure mode to none (requires Datadog Agent 7.77.0 or newer) using either:

  • The DD_INFRASTRUCTURE_MODE=none environment variable
  • The infrastructure_mode: none setting in the datadog.yaml configuration file

For more details, see Datadog Agent infrastructure mode.

Disable APM tracing and enable AAP on the service

On the instrumented service, set the following environment variables:

  • DD_APM_TRACING_ENABLED=false
  • DD_APPSEC_ENABLED=true

DD_APM_TRACING_ENABLED=false disabled APM tracing and limits the amount of APM data sent to the minimum required by App and API Protection. This environment variable can be combined with other App and API Protection configuration options.