---
title: Add to Security Inbox Rules
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Findings Automation Pipelines > Add to Security
  Inbox Rules
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Add to Security Inbox Rules
Available for:
{% icon name="icon-cloud-security-management" /%}
 Cloud Security | 
{% icon name="icon-security-code-security" /%}
 Code Security | 
{% icon name="icon-app-sec" /%}
 App and API Protection | 
{% icon name="icon-security-workload-security" /%}
 Workload Protection 
Configure inbox rules to manage your Security Inbox effectively, ensuring only the most relevant security issues are highlighted. By customizing conditions, you can focus on critical concerns, prioritize key risks, support compliance, and bring attention to issues that might otherwise be overlooked.

## Default inbox rules{% #default-inbox-rules %}

Datadog provides a set of default inbox rules, compiled by the Datadog Security Research team, that populate your [Security Inbox](https://docs.datadoghq.com/security/security_inbox.md) automatically. These rules cover the findings most likely to represent real risk in a typical environment.

Default rules appear alongside your own rules on the [Findings Automation](https://app.datadoghq.com/security/configuration/findings-automation?opened-sections=add_to_inbox) page. You can disable a default rule if it does not match how your organization triages, and you can add your own rules to cover cases the defaults miss.

## Create an inbox rule{% #create-an-inbox-rule %}

1. In Datadog, go to **Security** > **Settings** > [Findings Automation](https://app.datadoghq.com/security/configuration/findings-automation?opened-sections=add_to_inbox). Click **Add a New Rule**, then select **Add to Security Inbox**. The Create a New Rule page opens.
1. Under **Rule name**, enter a descriptive name for the rule; for example, "Cloud Infrastructure Anomaly Warnings".
1. Add your rule criteria into the following fields:
   - **Any of these types**: The types of findings that the rule should check for. Available types include:
     - Runtime Code Vulnerability
     - Static Code Vulnerability
     - Library Vulnerability
     - Secrets (Code)
     - Infrastructure as Code
     - Container Image Vulnerability
     - Host Vulnerability
     - Misconfiguration
     - Attack Path
     - Identity Risk
     - API Security
     - Workload Activity
   - **Any of these tags or attributes**: The resource tags or attributes that must match for the rule to apply.
1. To add severity criteria to the rule, click **Add Severity**.
1. Click **Save**. The rule applies to new findings immediately and starts checking existing findings within the next hour.

## Rule matching order{% #rule-matching-order %}

When Datadog identifies a finding, it evaluates the finding against your sequence of inbox rules. Starting with the first rule, if there's a match, Datadog adds the finding to the Security Inbox and stops evaluating further. If no match occurs, Datadog moves to the next rule. This process continues until a match is found or all rules are checked without a match.

## Further reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Security Inbox](https://docs.datadoghq.com/security/security_inbox.md)
- [Automation Pipelines](https://docs.datadoghq.com/security/automation_pipelines.md)