After you review a Workload Protection signal, use the Next Steps section in the signal side panel to triage, escalate, automate, or respond to the threat.

Workload Protection signals share the same triage and response workflows as other Datadog Security signals. For an overview of security signals across Cloud SIEM, App and API Protection, and Workload Protection, see Detection rules and the unified Security Signals Explorer.

Triage a signal

You can triage a signal by assigning it to a user for further investigation. The assigned user can then track their review by updating the signal’s status.

1. On the Signals Explorer, select a security signal.
2. In the Triage section, click Assign Signal, then select a user.
3. To update the status of the security signal, click the triage status dropdown menu and select a status. The default status is Open.
   • Open: The signal has not yet been resolved.
   • Under Review: The signal is actively being investigated. From the Under Review state, you can move the signal to Archived or Open as needed.
   • Archived: The detection that caused the signal has been resolved. From the Archived state, you can move the signal back to Open if it’s within 30 days of when the signal was originally detected.

Create a case

Use Case Management to track, triage, and investigate security signals.

1. On the Signals Explorer, select a security signal.
2. On the signal side panel, under Next Steps, find the Respond section and click Create Security Case. To add the signal to an existing case, open the dropdown next to Create Security Case and select Add to existing Security Case.
3. Enter a title and optional description.
4. Click Create Case.

Declare an incident

Use Incident Management to create an incident for a security signal.

1. On the Signals Explorer, select a security signal.
2. In the Respond section of the signal side panel, expand More actions.
3. Under Escalate, do one of the following:
   • To create an incident, click Declare Incident. Configure the incident by specifying details such as the severity level and incident commander, then click Declare Incident.
   • To add the signal to an existing incident, open the dropdown next to Declare Incident, select an incident, and click Confirm.

Run a workflow

Use Workflow Automation to manually trigger a workflow for a security signal. See Trigger a workflow from a security signal for more information.

1. On the Signals Explorer, select a security signal.
2. In the Respond section of the signal side panel, click Run Workflow.
3. On the workflow modal, select the workflow you want to run. The workflow must have a security trigger to appear in the list. Depending on the workflow, you may be required to enter additional input parameters.
4. Click Run Workflow.

Alternatively, click the Workflows tab in the signal side panel to see which workflows were triggered for the signal and suggested workflows to run.

Kill containers or processes

From the signal side panel, you can terminate a malicious process or container directly. Under Respond, click Kill Containers or Processes.

This action requires enforcement to be enabled on the Datadog Agent. The Agent terminates the targeted process or all processes in a compromised container depending on the configured scope. See Manual response for requirements, configuration, and action statuses.

Network isolation

From the signal side panel, you can isolate a compromised process or container from the network. Under Respond, click Network Isolation to block network traffic for the affected workload using an eBPF-based filter.

Network isolation requires enforcement to be enabled on the Agent, along with the network probes that the Agent enables by default. See Manual response for requirements and available enforcement options.