---
title: Severity Adjustment
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > Severity Adjustment
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Severity Adjustment
Available for:
{% icon name="icon-cloud-security-management" /%}
 Cloud Security | 
{% icon name="icon-security-code-security" /%}
 Code Security | 
{% icon name="icon-app-sec" /%}
 App and API Protection | 
{% icon name="icon-security-workload-security" /%}
 Workload Protection 
Manually adjust the severity of a finding to reflect your organization's business context, without creating a [severity modifier rule](https://docs.datadoghq.com/security/automation_pipelines/modify_severity.md).

## Supported products{% #supported-products %}

You can manually adjust the severity of findings in the following products:

- [Cloud Security](https://app.datadoghq.com/security/compliance)
- [Code Security](https://app.datadoghq.com/security/code-security)
- [App and API Protection](https://app.datadoghq.com/security/appsec/inventory/finding)
- [Workload Protection](https://app.datadoghq.com/security/workload-protection/findings)

## Permissions{% #permissions %}

To adjust the severity of findings, you must have the `security_monitoring_findings_write` or `appsec_vm_write` permission. See [Role Based Access Control](https://docs.datadoghq.com/account_management/rbac/permissions.md#cloud-security-platform) for more information about Datadog's default roles and granular role-based access control permissions.

## Adjust the severity of a finding{% #adjust-the-severity-of-a-finding %}

{% image
   source="https://docs.dd-static.net/images/security/manual_severity_adjustment/finding_side_panel_button.3ad66ec4317b3b444c3cc1019bb090c5.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/manual_severity_adjustment/finding_side_panel_button.3ad66ec4317b3b444c3cc1019bb090c5.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="A finding's side panel with the Adjust Severity option highlighted in the overflow menu" /%}

1. Open a finding.
1. Click Adjust Severity. The **Adjust Severity** dialog opens.
1. Select the new severity, for example, **Critical**.
1. Enter an optional description.
1. Click Adjust Severity.

To automatically adjust the severity of findings that meet certain criteria, see [Severity Modifier Rules](https://docs.datadoghq.com/security/automation_pipelines/modify_severity.md).

## Adjust the severity of multiple findings{% #adjust-the-severity-of-multiple-findings %}

To adjust the severity of multiple findings at once:

1. In the findings explorer, select up to 50 findings.
1. Click Severity. The **Adjust Severity** dialog opens.
1. Select the new severity, for example, **Critical**.
1. Enter an optional description.
1. Click Adjust Severity.

## Identify modified findings{% #identify-modified-findings %}

Findings with a manually adjusted severity display a visual indicator in explorer list views and in the finding's side panel header. Hover over the indicator to see who adjusted the severity and any description they entered.

{% image
   source="https://docs.dd-static.net/images/security/manual_severity_adjustment/severity_pill_popover.3c5b5394b091e3a8dff1df4e5374db9f.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/manual_severity_adjustment/severity_pill_popover.3c5b5394b091e3a8dff1df4e5374db9f.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="A severity pill showing a severity increase, with a pop-over displaying who adjusted the severity and the description entered" /%}

For findings that have a CVSS score (Container Image Vulnerability, Host Vulnerability, Library Vulnerability, and Runtime Code Vulnerability), the side panel severity section also includes a breakdown showing:

- The original severity level, CVSS score, and CVSS vector before adjustment.
- The name of the user who made the adjustment, and any description entered.
- The resulting severity level and adjusted CVSS score.

{% image
   source="https://docs.dd-static.net/images/security/manual_severity_adjustment/severity_breakdown.58d90f2a9290d4546724f3606ec776e7.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/manual_severity_adjustment/severity_breakdown.58d90f2a9290d4546724f3606ec776e7.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="A finding side panel showing the severity breakdown, with the original severity, CVSS score, and CVSS vector; the user who made the adjustment; and the resulting severity level and adjusted CVSS score" /%}

## Vulnerability findings and CVSS scores{% #vulnerability-findings-and-cvss-scores %}

For vulnerability findings that have a Datadog-adjusted CVSS score, manually adjusting the severity also updates the adjusted score stored in `@severity_details.user_adjusted`. The updated score is set to approximately the midpoint of the target severity's CVSS v3 range:

| Target severity | CVSS v3 range |
| --------------- | ------------- |
| None            | 0.0           |
| Low             | 0.1–3.9       |
| Medium          | 4.0–6.9       |
| High            | 7.0–8.9       |
| Critical        | 9.0–10.0      |

The original CVSS vector is never modified. No synthetic vector is generated to match the adjusted score.

## Further reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Severity Modifier Rules](https://docs.datadoghq.com/security/automation_pipelines/modify_severity.md)