---
title: Cofense Triage
description: Monitor Cofense Triage phishing incidents in Datadog
breadcrumbs: Docs > Integrations > Cofense Triage
---

# Cofense Triage
Supported OS marketplaceIntegration version1.0.0
{% callout %}
# Important note for users on the following Datadog sites: us2.ddog-gov.com

{% alert level="info" %}
To find out if this integration is available in your organization, see your [Datadog Integrations](https://app.datadoghq.com/integrations) page or ask your organization administrator.

To initiate an exception request to enable this integration for your organization, email [support@ddog-gov.com](mailto:support@ddog-gov.com).
{% /alert %}

{% /callout %}
        Cofense Triage - OverviewCofense Triage - System StatusCofense Triage - Executive SummaryCofense Triage - Reporting Output
## Overview{% #overview %}

Cofense Triage is a phishing threat management platform that automates the detection, analysis, and response to phishing emails by leveraging user-reported data. This integration enhances security workflows by providing real-time visibility into phishing incidents identified by Cofense Triage directly within Datadog for faster, coordinated responses.

This integration collects the following:

### Metrics{% #metrics %}

|  |
|  |
| **cds.cofense\_triage.health.cpu\_usage\_percent**(gauge)                    | CPU usage percentage of Cofense Triage server*Shown as percent*      |
| **cds.cofense\_triage.health.memory\_in\_kilobytes.active\_memory**(gauge)   | Active memory of Cofense Triage server*Shown as kilobyte*            |
| **cds.cofense\_triage.health.memory\_in\_kilobytes.free\_memory**(gauge)     | Free memory of Cofense Triage server*Shown as kilobyte*              |
| **cds.cofense\_triage.health.memory\_in\_kilobytes.inactive\_memory**(gauge) | Inactive memory of Cofense Triage server*Shown as kilobyte*          |
| **cds.cofense\_triage.health.memory\_in\_kilobytes.total\_memory**(gauge)    | Total memory of Cofense Triage server*Shown as kilobyte*             |
| **cds.cofense\_triage.health.memory\_in\_kilobytes.used\_memory**(gauge)     | Used memory of Cofense Triage server*Shown as kilobyte*              |
| **cds.cofense\_triage.partition\_used\_percent**(gauge)                      | partition_used_percentage of Cofense Triage server*Shown as percent* |
| **cds.cofense\_triage.status**(gauge)                                        | System status of Cofense Triage server                               |
| **cds.cofense\_triage.statistics.new\_reports**(gauge)                       | New reports on Cofense Triage                                        |
| **cds.cofense\_triage.statistics.processed\_reports**(gauge)                 | Processed reports on Cofense Triage                                  |
| **cds.cofense\_triage.statistics.unprocessed\_reports**(gauge)               | Unprocessed reports on Cofense Triage                                |
| **cds.cofense\_triage.statistics.unparsed\_emails**(gauge)                   | Unparsed emails on Cofense Triage                                    |
| **cds.cofense\_triage.top\_categories.count**(gauge)                         | Counts of top categories                                             |
| **cds.cofense\_triage.top\_processing\_api\_applications.count**(gauge)      | Counts of top api applications                                       |
| **cds.cofense\_triage.top\_processing\_operators.count**(gauge)              | Counts of top processing operators                                   |
| **cds.cofense\_triage.top\_reporters.count**(gauge)                          | Counts of top reporters                                              |
| **cds.cofense\_triage.top\_rules.count**(gauge)                              | Counts of top rules                                                  |

### Logs{% #logs %}

- Reports
- Threat Indicators
- Urls
- Domains
- Attachments
- Attachment Payloads
- Clusters
- Headers
- Hostnames
- Playbooks
- Rules
- Categories
- Comments
- Identity Providers
- Integrations
- Dynamic Reporting Outputs

### Events{% #events %}

- Authentication
- Configuration Validation

### Dashboards{% #dashboards %}

This integration includes the following out-of-the-box dashboards:

1. **Status**: Provides system status information, including CPU usage and partition usage of the Cofense Triage server.
1. **Executive Summary**: Offers a summary of the Cofense Triage reporting data.
1. **Reporting Output**: Displays a detailed reporting output, consisting of reports and their corresponding data.
1. **Overview**: Includes handpicked details taken from the aforementioned dashboards.

## Data Collected{% #data-collected %}

### Metrics{% #metrics-1 %}

### Service Checks{% #service-checks %}

**cds.cofense\_triage.status**

Returns `CRITICAL` if configurations are invalid or authentication fails. Returns `OK` otherwise.

*Statuses: ok, critical*

## Support{% #support %}

For support or feature requests, contact Crest Data through the following channels:

- Support email: [datadog.integrations@crestdata.ai](mailto:datadog.integrations@crestdata.ai)
- Sales email: [datadog-sales@crestdata.ai](mailto:datadog-sales@crestdata.ai)
- Website: [crestdata.ai](https://www.crestdata.ai/)
- FAQs: [Crest Data Datadog Marketplace Integrations FAQ](https://www.crestdatasys.com/datadog-integrations-readme/Crest_Data_Datadog_Integrations_FAQ.pdf)

## Troubleshooting{% #troubleshooting %}

Need help? Contact [Datadog support](https://docs.datadoghq.com/help/).

This application is made available through the Marketplace and is supported by a Datadog Technology Partner. Click Here to purchase this application.