Manually adjust the severity of a finding to reflect your organization’s business context, without creating a severity modifier rule.

Supported products

You can manually adjust the severity of findings in the following products:

• Cloud Security
• Code Security
• App and API Protection
• Workload Protection

Permissions

To adjust the severity of findings, you must have the security_monitoring_findings_write or appsec_vm_write permission. See Role Based Access Control for more information about Datadog’s default roles and granular role-based access control permissions.

Adjust the severity of a finding

1. Open a finding.
2. Click Adjust Severity. The Adjust Severity dialog opens.
3. Select the new severity, for example, Critical.
4. Enter an optional description.
5. Click Adjust Severity.

To automatically adjust the severity of findings that meet certain criteria, see Severity Modifier Rules.

Adjust the severity of multiple findings

To adjust the severity of multiple findings at once:

1. In the findings explorer, select up to 50 findings.
2. Click Severity. The Adjust Severity dialog opens.
3. Select the new severity, for example, Critical.
4. Enter an optional description.
5. Click Adjust Severity.

Identify modified findings

Findings with a manually adjusted severity display a visual indicator in explorer list views and in the finding’s side panel header. Hover over the indicator to see who adjusted the severity and any description they entered.

For findings that have a CVSS score (Container Image Vulnerability, Host Vulnerability, Library Vulnerability, and Runtime Code Vulnerability), the side panel severity section also includes a breakdown showing:

• The original severity level, CVSS score, and CVSS vector before adjustment.
• The name of the user who made the adjustment, and any description entered.
• The resulting severity level and adjusted CVSS score.

Vulnerability findings and CVSS scores

For vulnerability findings that have a Datadog-adjusted CVSS score, manually adjusting the severity also updates the adjusted score stored in @severity_details.user_adjusted. The updated score is set to approximately the midpoint of the target severity’s CVSS v3 range:

The original CVSS vector is never modified. No synthetic vector is generated to match the adjusted score.

Further reading

Additional helpful documentation, links, and articles:

Severity Modifier RulesDOCUMENTATION