diff --git a/changelog/fragments/1669049916-CHANGELOG.asciidoc.yaml b/changelog/fragments/1669049916-CHANGELOG.asciidoc.yaml
new file mode 100644
index 00000000000..6582f2404a6
--- /dev/null
+++ b/changelog/fragments/1669049916-CHANGELOG.asciidoc.yaml
@@ -0,0 +1,31 @@
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: feature
+
+# Change summary; a 80ish characters long description of the change.
+summary: Adds support for a new executable used to prevent container drift.
+
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+#description:
+
+# Affected component; a word indicating the component this changeset affects.
+component: cloud-defend
+
+# PR number; optional; the PR number that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+pr: 1764
+
+# Issue number; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+#issue: 1234
diff --git a/internal/pkg/agent/application/monitoring/v1_monitor.go b/internal/pkg/agent/application/monitoring/v1_monitor.go
index e8d809a546d..77d6525f59e 100644
--- a/internal/pkg/agent/application/monitoring/v1_monitor.go
+++ b/internal/pkg/agent/application/monitoring/v1_monitor.go
@@ -54,7 +54,7 @@ const (
 )
 
 var (
-	supportedComponents      = []string{"filebeat", "metricbeat", "apm-server", "auditbeat", "cloudbeat", "endpoint-security", "fleet-server", "heartbeat", "osquerybeat", "packetbeat"}
+	supportedComponents      = []string{"filebeat", "metricbeat", "apm-server", "auditbeat", "cloudbeat", "cloud-defend", "endpoint-security", "fleet-server", "heartbeat", "osquerybeat", "packetbeat"}
 	supportedBeatsComponents = []string{"filebeat", "metricbeat", "apm-server", "fleet-server", "auditbeat", "cloudbeat", "heartbeat", "osquerybeat", "packetbeat"}
 )
 
diff --git a/pkg/component/load_test.go b/pkg/component/load_test.go
index f9d88ebba26..2133655d75f 100644
--- a/pkg/component/load_test.go
+++ b/pkg/component/load_test.go
@@ -59,6 +59,10 @@ func TestLoadSpec_Components(t *testing.T) {
 			Name: "Cloudbeat",
 			Path: "cloudbeat.spec.yml",
 		},
+		{
+			Name: "Cloud Defend",
+			Path: "cloud-defend.spec.yml",
+		},
 		{
 			Name: "Endpoint Security",
 			Path: "endpoint-security.spec.yml",
diff --git a/specs/cloud-defend.spec.yml b/specs/cloud-defend.spec.yml
new file mode 100644
index 00000000000..901eb7d16d8
--- /dev/null
+++ b/specs/cloud-defend.spec.yml
@@ -0,0 +1,14 @@
+version: 2
+inputs:
+  - name: cloud_defend
+    description: "Cloud defend for containers"
+    platforms: &platforms
+      - container/amd64
+      - container/arm64
+    outputs: &outputs
+      - elasticsearch
+    command:
+      args: &args
+        - "run"
+        - "--fleet-managed"
+        - "--process-managed"