---
title: Security Inbox
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > Security Inbox
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Security Inbox
Available for:
{% icon name="icon-cloud-security-management" /%}
 Cloud Security | 
{% icon name="icon-security-code-security" /%}
 Code Security | 
{% icon name="icon-app-sec" /%}
 App and API Protection | 
{% icon name="icon-security-workload-security" /%}
 Workload Protection 
Security Inbox provides a consolidated, actionable list of your most important security findings. It correlates and contextualizes findings from across Datadog security products—vulnerabilities, misconfigurations, identity risks, and attack paths—into a single prioritized view of the work that most reduces risk in your environment.

Security Inbox answers three questions:

- **What should my team work on next?** Findings are ranked by severity, then by correlated risk, then by the number of resources and services they affect.
- **What is overdue?** Due date rules attach remediation deadlines to findings, so you can track progress against the service level agreements (SLAs) your organization commits to.
- **Why is this finding in my inbox?** Every finding reaches the inbox through an inbox rule. You can review the default rules, disable the ones that do not fit your organization, and create your own.

{% image
   source="https://docs.dd-static.net/images/security/security_inbox_8.3620022e1938fe6ba59001b5e877d3aa.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/security_inbox_8.3620022e1938fe6ba59001b5e877d3aa.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="The Security Inbox shows prioritized security findings with severity, triage status, and remediation SLA summaries" /%}

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com



{% alert level="danger" %}
Some of the products that feed Security Inbox are not available on this site ({% placeholder "user-datadog-site-name" /%}). Code Security findings do not reach the inbox, and Linear is unavailable for ticketing.
{% /alert %}


{% /callout %}

{% callout %}
# Important note for users on the following Datadog sites: us2.ddog-gov.com



{% alert level="danger" %}
Some of the products that feed Security Inbox are not available on this site ({% placeholder "user-datadog-site-name" /%}). Code Security and App and API Protection findings do not reach the inbox. Linear ticketing, Datadog Case Management, and assignee management are also unavailable.
{% /alert %}


{% /callout %}

## What appears in Security Inbox{% #what-appears-in-security-inbox %}

Inbox rules control which findings reach Security Inbox. Datadog provides a set of default inbox rules, compiled by the Datadog Security Research team, that surface the findings most likely to represent real risk. You can review these rules, turn individual rules off, and add rules of your own.

Rules are evaluated in order. For each finding, Datadog checks your rules from the top until one matches, and then stops. If no rule matches, the finding does not enter the inbox.

To see the rules that populate your inbox, click **Customize inbox** in the Security Inbox filter bar, or go to **Security** > **Settings** > [**Findings Automation**](https://app.datadoghq.com/security/configuration/findings-automation?opened-sections=add_to_inbox).

### Supported finding types{% #supported-finding-types %}

Inbox rules can match any of the following finding types:

| Finding type                                                                                                      | Source                 |
| ----------------------------------------------------------------------------------------------------------------- | ---------------------- |
| [Misconfiguration](https://docs.datadoghq.com/security/cloud_security_management/misconfigurations.md)            | Cloud Security         |
| [Identity Risk](https://docs.datadoghq.com/security/cloud_security_management/identity_risks.md)                  | Cloud Security         |
| [Attack Path](https://docs.datadoghq.com/security/default_rules.md?category=all#all)                              | Cloud Security         |
| [Host Vulnerability](https://docs.datadoghq.com/security/cloud_security_management/vulnerabilities.md)            | Cloud Security         |
| [Container Image Vulnerability](https://docs.datadoghq.com/security/cloud_security_management/vulnerabilities.md) | Cloud Security         |
| [Workload Activity](https://docs.datadoghq.com/security/workload_protection.md)                                   | Workload Protection    |
| [Library Vulnerability](https://docs.datadoghq.com/security/code_security/software_composition_analysis.md)       | Code Security          |
| [Static Code Vulnerability](https://docs.datadoghq.com/security/code_security/static_analysis.md)                 | Code Security          |
| [Runtime Code Vulnerability](https://docs.datadoghq.com/security/code_security/iast.md)                           | Code Security          |
| [Infrastructure as Code](https://docs.datadoghq.com/security/code_security/iac_security.md)                       | Code Security          |
| [Secret](https://docs.datadoghq.com/security/code_security/secret_scanning.md)                                    | Code Security          |
| [API Security](https://docs.datadoghq.com/security/application_security/api_posture.md)                           | App and API Protection |

Security Inbox shows only the finding types you have permission to read. A finding you cannot open in its own explorer does not appear in your inbox.

### Detected risks{% #detected-risks %}

Security Inbox takes the following detected risks into account when it evaluates a finding:

- **Public accessibility**: Publicly exposed resources carry elevated risk, especially if they contain vulnerabilities or misconfigurations. To learn more, see [How Datadog Determines if Resources are Publicly Accessible](https://docs.datadoghq.com/security/cloud_security_management/guide/public-accessibility-logic.md).
- **Privileged access**: Resources with privileged access carry elevated risk as they grant elevated permissions that can expand the attack surface.
- **Under attack**: Resources that are seeing suspicious security activity carry elevated risks. Resources are flagged as "Under Attack" if a security signal has been detected on the resource in the last 15 days.
- **Exploit available**: Vulnerabilities with public exploits available carry elevated risks. The availability of a public exploit is verified with different exploit databases, such as [cisa.gov](https://www.cisa.gov/), [exploit-db.com](https://www.exploit-db.com/), and [nvd.nist.gov](https://nvd.nist.gov/).
- **In production**: Vulnerabilities in production environments carry elevated risks. The environment is computed from the `env` and `environment` tags.

## How Security Inbox prioritization works{% #how-security-inbox-prioritization-works %}

Security Inbox ranks findings by considering the severity of a finding first, followed by the number of correlated risks, and then the number of impacted resources and services.

- **Severity (Critical, High, Medium, and Low)**: Severity is determined by the [Datadog Security Scoring Framework](https://docs.datadoghq.com/security/cloud_security_management/severity_scoring.md#cloud-security-severity-scoring-framework) for cloud misconfigurations and identity risks, and by CVSS 3.1 for vulnerabilities.
- **Number of detected risks**: When two findings have the same severity, the one with a greater number of detected risks is given higher priority.
- **Number of impacted resources and services**: If two findings share both the same severity and the same number of detected risks, the finding that impacts a greater number of resources and services is prioritized higher.

**Note**: The type of finding, detected risk, or impacted resource does not influence prioritization.

## Track remediation against due dates{% #track-remediation-against-due-dates %}

[Due date rules](https://docs.datadoghq.com/security/automation_pipelines/set_due_date.md) assign a remediation deadline to a finding based on its severity and type. When due dates are configured, the **Remediation SLA** card at the top of Security Inbox reports progress against them:

| Status      | Meaning                                        |
| ----------- | ---------------------------------------------- |
| Overdue     | The finding is past its remediation due date.  |
| Due soon    | The finding is due within the next seven days. |
| Not due yet | The finding is due in more than seven days.    |

Click a status to filter the list to those findings. You can also filter on **Overdue Status** from the filter bar.

Two other cards summarize the same set of findings:

- **Severity**: The number of Critical and High findings.
- **Status**:
  - **Pending triage**: The number of findings with no ticket and no assignee.
  - **In flight**: The number of findings that have at least one.

## Investigate findings{% #investigate-findings %}

### Filter and group{% #filter-and-group %}

Apply filters to narrow the inbox by any facet in the findings schema, including team, severity, finding type, service, and resource. To filter on an attribute that is not offered as a facet, type its name into the **Edit Filters** menu and add it as a custom filter.

Use **Group by** to aggregate findings by up to two fields at once. The inbox groups by finding title by default, which collapses every occurrence of the same underlying issue into a single row. Set **Group by** to **None** to see one row per finding.

### Change the columns{% #change-the-columns %}

Click the gear icon above the table to add, remove, or reorder columns. The default columns are finding type, title, severity, risks, resource, and triage status.

{% alert level="info" %}
Column options are available on ungrouped tables, and on tables inside expanded groups. They are unavailable on the outer table of a grouped view.
{% /alert %}

### Saved views{% #saved-views %}

Save the current combination of filters, grouping, and columns as a saved view, so you can return to it later or share it with your team. Saved views are listed in the **Views** sidebar.

### Export{% #export %}

Click **Export** above the table to export your findings to other tools:

- **Export to Sheets**: Send the findings to [Datadog Sheets](https://docs.datadoghq.com/sheets.md) for deeper exploration and reporting.
- **Open in DDSQL Editor**: Open the equivalent query in the [DDSQL Editor](https://docs.datadoghq.com/ddsql_editor.md) for complex aggregations and custom analysis.
- **Download as CSV**: Download the findings as a CSV file.
- **Copy as cURL**: Copy the equivalent API request to your clipboard.

## Triage and remediate{% #triage-and-remediate %}

The **Triage** column carries actions for a single finding. Click **Assign** to set an [assignee](https://docs.datadoghq.com/security/assignee_management.md), or **Add Ticket** to create or link a ticket, without leaving the table.

To act on several findings at once, select them and use:

- **Ticketing**: Create a Jira issue, a ServiceNow incident, a Linear issue, or a Datadog security case for the selected findings; or unlink an existing one. For setup and bidirectional syncing, see [Ticketing Integrations](https://docs.datadoghq.com/security/ticketing_integrations.md).
- **Assignee**: Set or clear the [assignee](https://docs.datadoghq.com/security/assignee_management.md) on the selected findings.
- **Muting**: Mute findings that you have assessed and accepted.
- **Severity**: Adjust the severity of the selected findings.

Bulk selection is available on ungrouped tables and inside expanded groups. Click any finding to open its side panel, which shows the full detection detail and remediation guidance for that finding type.

## Report on your inbox{% #report-on-your-inbox %}

The **Reporting** tab shows a dashboard of Security Inbox trends over time, so you can track whether remediation is keeping pace with detection.

## Use the security context map to identify and mitigate vulnerabilities{% #use-the-security-context-map-to-identify-and-mitigate-vulnerabilities %}

The security context map for Attack Paths provides a comprehensive view to help identify and address potential breach points. It maps interconnected misconfigurations, permission gaps, and vulnerabilities that attackers might exploit.

Key features include:

- **Risk assessment**: The map enables security teams to assess the broader impact of vulnerabilities and misconfigurations. This includes evaluating whether security policies—such as access paths and permissions—need updating, and understanding the compliance implications of exposure, particularly when sensitive data is at risk within the blast radius.
- **Actionable context for immediate response**: The map includes service ownership information and other relevant context, allowing teams to make informed, real-time decisions. Teams can take action directly from the map by running integrated workflows, sharing security issue links, and accessing the AWS console view of resources for efficient remediation, all without switching tools.

{% image
   source="https://docs.dd-static.net/images/security/security_context_map.2c24dc99467ccae6ee39e9115aebc93c.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/security_context_map.2c24dc99467ccae6ee39e9115aebc93c.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="The security context map showing a publicly accessible AWS EC2 instance with a critical misconfiguration" /%}

## Customize Security Inbox{% #customize-security-inbox %}

[Automation Pipelines](https://docs.datadoghq.com/security/automation_pipelines.md) let you configure the rules that decide what reaches your inbox and when remediations are due for each finding. Use automations to:

- **Resurface findings not captured by default**: Use custom rules to highlight findings that the default rules do not match, to ensure critical findings are not overlooked.
- **Strengthen compliance and address key system concerns**: Address concerns affecting regulatory compliance or important business systems, regardless of severity.
- **Prioritize current risks**: Focus on immediate threats, such as identity risks after an incident or industry-wide vulnerabilities.
- **Enforce remediation timelines**: Attach due dates by severity, so overdue work is visible to the whole team.

For more information, see [Add to Security Inbox Rules](https://docs.datadoghq.com/security/automation_pipelines/security_inbox.md) and [Set Due Date Rules](https://docs.datadoghq.com/security/automation_pipelines/set_due_date.md).

## Further Reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Add to Security Inbox Rules](https://docs.datadoghq.com/security/automation_pipelines/security_inbox.md)
- [Set Due Date Rules](https://docs.datadoghq.com/security/automation_pipelines/set_due_date.md)
- [Learn more about Cloud Security](https://docs.datadoghq.com/security/cloud_security_management.md)
- [Learn more about Code Security](https://docs.datadoghq.com/security/code_security.md)
- [Learn more about App and API Protection](https://docs.datadoghq.com/security/application_security.md)
- [Out-of-the-box Detection Rules](https://docs.datadoghq.com/security/default_rules.md#all)
- [How Datadog Security Inbox prioritizes security risks](https://www.datadoghq.com/blog/security-inbox-prioritization/)