Security Inbox provides a consolidated, actionable list of your most important security findings. It correlates and contextualizes findings from across Datadog security products—vulnerabilities, misconfigurations, identity risks, and attack paths—into a single prioritized view of the work that most reduces risk in your environment.

Security Inbox answers three questions:

• What should my team work on next? Findings are ranked by severity, then by correlated risk, then by the number of resources and services they affect.
• What is overdue? Due date rules attach remediation deadlines to findings, so you can track progress against the service level agreements (SLAs) your organization commits to.
• Why is this finding in my inbox? Every finding reaches the inbox through an inbox rule. You can review the default rules, disable the ones that do not fit your organization, and create your own.

What appears in Security Inbox

Inbox rules control which findings reach Security Inbox. Datadog provides a set of default inbox rules, compiled by the Datadog Security Research team, that surface the findings most likely to represent real risk. You can review these rules, turn individual rules off, and add rules of your own.

Rules are evaluated in order. For each finding, Datadog checks your rules from the top until one matches, and then stops. If no rule matches, the finding does not enter the inbox.

To see the rules that populate your inbox, click Customize inbox in the Security Inbox filter bar, or go to Security > Settings > Findings Automation.

Supported finding types

Inbox rules can match any of the following finding types:

Security Inbox shows only the finding types you have permission to read. A finding you cannot open in its own explorer does not appear in your inbox.

Detected risks

Security Inbox takes the following detected risks into account when it evaluates a finding:

• Public accessibility: Publicly exposed resources carry elevated risk, especially if they contain vulnerabilities or misconfigurations. To learn more, see How Datadog Determines if Resources are Publicly Accessible.
• Privileged access: Resources with privileged access carry elevated risk as they grant elevated permissions that can expand the attack surface.
• Under attack: Resources that are seeing suspicious security activity carry elevated risks. Resources are flagged as “Under Attack” if a security signal has been detected on the resource in the last 15 days.
• Exploit available: Vulnerabilities with public exploits available carry elevated risks. The availability of a public exploit is verified with different exploit databases, such as cisa.gov, exploit-db.com, and nvd.nist.gov.
• In production: Vulnerabilities in production environments carry elevated risks. The environment is computed from the env and environment tags.

How Security Inbox prioritization works

Security Inbox ranks findings by considering the severity of a finding first, followed by the number of correlated risks, and then the number of impacted resources and services.

• Severity (Critical, High, Medium, and Low): Severity is determined by the Datadog Security Scoring Framework for cloud misconfigurations and identity risks, and by CVSS 3.1 for vulnerabilities.
• Number of detected risks: When two findings have the same severity, the one with a greater number of detected risks is given higher priority.
• Number of impacted resources and services: If two findings share both the same severity and the same number of detected risks, the finding that impacts a greater number of resources and services is prioritized higher.

Note: The type of finding, detected risk, or impacted resource does not influence prioritization.

Track remediation against due dates

Due date rules assign a remediation deadline to a finding based on its severity and type. When due dates are configured, the Remediation SLA card at the top of Security Inbox reports progress against them:

Click a status to filter the list to those findings. You can also filter on Overdue Status from the filter bar.

Two other cards summarize the same set of findings:

• Severity: The number of Critical and High findings.
• Status:
  • Pending triage: The number of findings with no ticket and no assignee.
  • In flight: The number of findings that have at least one.

Investigate findings

Filter and group

Apply filters to narrow the inbox by any facet in the findings schema, including team, severity, finding type, service, and resource. To filter on an attribute that is not offered as a facet, type its name into the Edit Filters menu and add it as a custom filter.

Use Group by to aggregate findings by up to two fields at once. The inbox groups by finding title by default, which collapses every occurrence of the same underlying issue into a single row. Set Group by to None to see one row per finding.

Change the columns

Click the gear icon above the table to add, remove, or reorder columns. The default columns are finding type, title, severity, risks, resource, and triage status.

Saved views

Save the current combination of filters, grouping, and columns as a saved view, so you can return to it later or share it with your team. Saved views are listed in the Views sidebar.

Export

Click Export above the table to export your findings to other tools:

• Export to Sheets: Send the findings to Datadog Sheets for deeper exploration and reporting.
• Open in DDSQL Editor: Open the equivalent query in the DDSQL Editor for complex aggregations and custom analysis.
• Download as CSV: Download the findings as a CSV file.
• Copy as cURL: Copy the equivalent API request to your clipboard.

Triage and remediate

The Triage column carries actions for a single finding. Click Assign to set an assignee, or Add Ticket to create or link a ticket, without leaving the table.

To act on several findings at once, select them and use:

• Ticketing: Create a Jira issue, a ServiceNow incident, a Linear issue, or a Datadog security case for the selected findings; or unlink an existing one. For setup and bidirectional syncing, see Ticketing Integrations.
• Assignee: Set or clear the assignee on the selected findings.
• Muting: Mute findings that you have assessed and accepted.
• Severity: Adjust the severity of the selected findings.

Bulk selection is available on ungrouped tables and inside expanded groups. Click any finding to open its side panel, which shows the full detection detail and remediation guidance for that finding type.

Report on your inbox

The Reporting tab shows a dashboard of Security Inbox trends over time, so you can track whether remediation is keeping pace with detection.

Use the security context map to identify and mitigate vulnerabilities

The security context map for Attack Paths provides a comprehensive view to help identify and address potential breach points. It maps interconnected misconfigurations, permission gaps, and vulnerabilities that attackers might exploit.

Key features include:

• Risk assessment: The map enables security teams to assess the broader impact of vulnerabilities and misconfigurations. This includes evaluating whether security policies—such as access paths and permissions—need updating, and understanding the compliance implications of exposure, particularly when sensitive data is at risk within the blast radius.
• Actionable context for immediate response: The map includes service ownership information and other relevant context, allowing teams to make informed, real-time decisions. Teams can take action directly from the map by running integrated workflows, sharing security issue links, and accessing the AWS console view of resources for efficient remediation, all without switching tools.

Customize Security Inbox

Automation Pipelines let you configure the rules that decide what reaches your inbox and when remediations are due for each finding. Use automations to:

• Resurface findings not captured by default: Use custom rules to highlight findings that the default rules do not match, to ensure critical findings are not overlooked.
• Strengthen compliance and address key system concerns: Address concerns affecting regulatory compliance or important business systems, regardless of severity.
• Prioritize current risks: Focus on immediate threats, such as identity risks after an incident or industry-wide vulnerabilities.
• Enforce remediation timelines: Attach due dates by severity, so overdue work is visible to the whole team.

For more information, see Add to Security Inbox Rules and Set Due Date Rules.

Further Reading

Additional helpful documentation, links, and articles:

Add to Security Inbox RulesDOCUMENTATION Set Due Date RulesDOCUMENTATION Learn more about Cloud SecurityDOCUMENTATION Learn more about Code SecurityDOCUMENTATION Learn more about App and API ProtectionDOCUMENTATION Out-of-the-box Detection RulesDOCUMENTATION How Datadog Security Inbox prioritizes security risksBLOG