---
title: Findings Automation Pipelines
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > Findings Automation Pipelines
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Findings Automation Pipelines

Automation Pipelines allows you to set up automated rules for newly discovered findings, thus accelerating triage and remediation efforts at scale.

## Availability{% #availability %}

Automation Pipelines is available for:

- Runtime Code Vulnerabilities
- Static Code Vulnerabilities
- Library Vulnerabilities
- Secrets
- Infrastructure as Code
- Container Image Vulnerabilities
- Host Vulnerabilities
- Misconfigurations
- Attack Paths
- Identity Risks
- API Security
- Workload Activity

## How it works{% #how-it-works %}

Automation Pipelines operates through a rules-based system that allows you to automate how new findings are managed. Here's how it works:

- **Rule configuration**: Each rule consists of multiple criteria, designed to filter findings based on specific attributes. Within a rule, the combination of these criteria operates as a logical AND; however, if any criteria include multiple values, those values operate as a logical OR. This structure gives you the flexibility to create rules that precisely target your needs.
- **Rule matching**: Automation Pipelines evaluates findings against your rules in the order you've listed them. As each finding is processed, Automation Pipelines moves through the list until it finds a matching rule, at which point the specified action—such as muting non-urgent issues or highlighting critical threats—is triggered. Automation Pipeline rules apply immediately to new findings. For existing findings, updates can take up to two hours.

{% callout %}
# Important note for users on the following Datadog sites: app.datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, app.datadoghq.eu, ap1.datadoghq.com, ap2.datadoghq.com, uk1.datadoghq.com



## Rule suggestions{% #rule-suggestions %}

Datadog suggests automation rules tailored to your organization. An AI agent investigates your findings, your existing rules, and the triage your teams perform manually, to identify the patterns worth automating. Each suggestion shows the scope it covers, the action it takes, how many findings it matches, and the observation that justifies it.

{% image
   source="https://docs.dd-static.net/images/security/automation_pipelines/suggestions.938f211c863c4f749a99a261b7a24d91.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/automation_pipelines/suggestions.938f211c863c4f749a99a261b7a24d91.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="The Suggested for your environment panel on the Findings Automation page, showing three suggestion cards: each names the action, the finding types and query it covers, how many findings it matches, and the reason Datadog suggested it, with Review and Approve buttons" /%}

Your suggestions are listed on the [Findings Automation](https://app.datadoghq.com/security/configuration/findings-automation) page. They also come to you as you work: depending on the findings you are looking at in an explorer, or the action you are about to take on them, Datadog can surface the suggestions relevant to that context.

Clicking **Review** opens the rule creation form prefilled with the suggested scope and action, so you can adjust anything before saving. Datadog learns from the suggestions you approve and dismiss, and adapts to changes in your environment, to keep offering relevant suggestions.


{% /callout %}

## Use cases{% #use-cases %}

### Adjust finding severities to reflect your business context{% #adjust-finding-severities-to-reflect-your-business-context %}

Override the default severity of findings to match your organization's risk profile. This allows you to:

- **Downgrade low-risk findings**: Reduce the severity of findings on isolated environments, which pose limited real-world risk.
- **Upgrade high-value targets**: Increase the severity of findings on critical systems, such as databases containing personally identifiable information or services with elevated compliance requirements.
- **Calibrate severity to your organization's priorities**: Establish consistent severity standards to reflect your organization's priorities, rather than relying solely on out-of-the-box scoring.

### Mute non-urgent findings to focus on what matters{% #mute-non-urgent-findings-to-focus-on-what-matters %}

Reduce alert fatigue and prioritize critical threats by automatically muting non-urgent findings. This allows you to:

- **Automatically ignore low-priority issues**: Suppress known false positives, accepted risks, and other findings that don't require immediate action. No manual review is needed.
- **Prioritize real threats**: Keep your attention on high-impact alerts that demand investigation and remediation.
- **Declutter your alert stream**: Eliminate noise from false positives, non-critical resources, test or staging environments, and short-lived resources that trigger alerts but pose no long-term risk.

### Set due dates for findings to align with your security SLAs{% #set-due-dates-for-findings-to-align-with-your-security-slas %}

Assign remediation deadlines to findings to improve accountability and stay compliant with your security policies. This allows you to:

- **Stay compliant by design**: Automatically apply due dates that align with industry standards, such as FedRAMP, PCI, and others.
- **Drive accountability across teams**: Use SLAs to ensure timely remediation without constant follow-ups, giving security and engineering clear expectations.
- **Promote proactive risk management**: Encourage faster response times and reduce exposure by using SLAs to prioritize and track remediation efforts.

### Customize the Security Inbox to highlight what's important to your organization{% #customize-the-security-inbox-to-highlight-whats-important-to-your-organization %}

Datadog provides a set of default inbox rules that populate the Security Inbox. You can review those rules, disable the ones that do not fit your organization, and add your own rules that define which findings are highlighted. This allows you to:

- **Resurface findings not captured by default**: Use custom rules to highlight findings that the default rules do not match, to ensure critical findings are not overlooked.
- **Strengthen compliance and address key system concerns**: Address concerns affecting regulatory compliance or important business systems, regardless of severity.
- **Prioritize current risks**: Focus on immediate threats, such as identity risks after an incident, or industry-wide findings.

### Automatically create tickets to route findings into engineering workflows{% #automatically-create-tickets-to-route-findings-into-engineering-workflows %}

Route security findings directly into Jira or Case Management as soon as they are discovered. This allows you to:

- **Eliminate manual triage**: Automatically generate tickets for findings that match your criteria, removing the need for security teams to create tickets by hand.
- **Integrate with existing engineering workflows**: Meet engineering teams where they already work by routing security work into the same tools they use for other tasks.
- **Reduce time to remediation**: Get findings into engineering queues immediately after detection, eliminating the delay between discovery and assignment.

## Further reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Severity Modifier Rules](https://docs.datadoghq.com/security/automation_pipelines/modify_severity.md)
- [Mute Rules](https://docs.datadoghq.com/security/automation_pipelines/mute.md)
- [Set Due Date Rules](https://docs.datadoghq.com/security/automation_pipelines/set_due_date.md)
- [Add to Security Inbox Rules](https://docs.datadoghq.com/security/automation_pipelines/security_inbox.md)
- [Ticket Creation Rules](https://docs.datadoghq.com/security/automation_pipelines/create_ticket.md)
- [Prevent cloud misconfigurations from reaching production with Datadog IaC Security](https://www.datadoghq.com/blog/datadog-iac-security/)