---
title: Investigate attack paths with Security Graph
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Cloud Security > Investigate attack paths with
  Security Graph
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Investigate attack paths with Security Graph

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com



{% alert level="danger" %}
Security Graph is not available in the selected site ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}


{% /callout %}

One of the most persistent challenges in cloud security is understanding the resources and relationships associated with attack-path findings. With Security Graph, which supports AWS and Azure, you can use the **Context Graph** in a finding's side panel to understand how exposure, vulnerabilities, and permissions contribute to the detected risk.

The graph shows context for the selected finding. The resources and relationships shown depend on the detection rule and available cloud data.

{% image
   source="https://docs.dd-static.net/images/security/csm/security_graph.33a02b53cfce68b34d33b51c2dcfb8d4.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/csm/security_graph.33a02b53cfce68b34d33b51c2dcfb8d4.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Graph showing relationships between AWS EC2 instances, IAM roles, and S3 buckets" /%}

## Open an attack path's Context Graph{% #open-an-attack-paths-context-graph %}

1. In Datadog, go to **Security** > [**Inbox**](https://app.datadoghq.com/security/issues).
1. In the **Finding Type** list, beside **attack_path**, click **Only** to filter the Security Inbox findings.
1. Click a finding to view it in a side panel. If the Security Inbox has grouping applied, open a group, then click a finding in the group to view it.
1. Scroll to the **Context Graph** to inspect the resources and relationships associated with the finding.
1. Click a resource in the graph to view its details.

## Investigate the detected risk{% #investigate-the-detected-risk %}

Follow the relationships shown in the graph to understand the finding. For example, an AWS attack path can identify a publicly accessible EC2 instance with high or critical vulnerabilities that can read sensitive data in an S3 bucket. Its graph provides context for the exposure and access relationships involved in that finding.

Review the finding's description and remediation guidance alongside the graph to determine which resource configuration, permission, or vulnerability to address.

## Further reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Visualize cloud security relationships with Datadog Security Graph](https://www.datadoghq.com/blog/datadog-security-graph/)
- [Trace exposure routes between resources with Datadog Cloud Security](https://www.datadoghq.com/blog/security-graph-attack-paths)