--- title: Triage and Act on Security Signals description: >- Triage, escalate, automate, and respond to a Workload Protection signal from the signal side panel. breadcrumbs: >- Docs > Datadog Security > Workload Protection > Investigate and Triage > Signals > Triage and Act on Security Signals --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Triage and Act on Security Signals {% callout %} # Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com {% alert level="danger" %} This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}). {% /alert %} {% /callout %} After you review a Workload Protection signal, use the Next Steps section in the signal side panel to triage, escalate, automate, or respond to the threat. Workload Protection signals share the same triage and response workflows as other Datadog Security signals. For an overview of security signals across Cloud SIEM, App and API Protection, and Workload Protection, see [Detection rules](https://docs.datadoghq.com/security/detection_rules.md) and the unified [Security Signals Explorer](https://app.datadoghq.com/security/signals). ## Triage a signal{% #triage-a-signal %} You can triage a signal by assigning it to a user for further investigation. The assigned user can then track their review by updating the signal's status. {% alert level="info" %} To modify security signals, you must have the `security_monitoring_signals_write` permission. See [Role Based Access Control](https://docs.datadoghq.com/account_management/rbac/permissions.md#cloud-security-platform) for more information about Datadog's default roles and granular role-based access control permissions available for Workload Protection. {% /alert %} 1. On the [Signals Explorer](https://app.datadoghq.com/security/workload-protection/signals), select a security signal. 1. In the Triage section, click Assign Signal, then select a user. 1. To update the status of the security signal, click the triage status dropdown menu and select a status. The default status is Open. - Open: The signal has not yet been resolved. - Under Review: The signal is actively being investigated. From the Under Review state, you can move the signal to Archived or Open as needed. - Archived: The detection that caused the signal has been resolved. From the Archived state, you can move the signal back to Open if it's within 30 days of when the signal was originally detected. ## Create a case{% #create-a-case %} {% callout %} # Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com {% alert level="danger" %} Case Management is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md) ({% placeholder "user-datadog-site-name" /%}). {% /alert %} {% /callout %} Use [Case Management](https://docs.datadoghq.com/incident_response/work_management.md) to track, triage, and investigate security signals. 1. On the [Signals Explorer](https://app.datadoghq.com/security/workload-protection/signals), select a security signal. 1. On the signal side panel, under Next Steps, find the Respond section and click Create Security Case. To add the signal to an existing case, open the dropdown next to Create Security Case and select Add to existing Security Case. 1. Enter a title and optional description. 1. Click Create Case. ## Declare an incident{% #declare-an-incident %} Use [Incident Management](https://docs.datadoghq.com/incident_response/incident_management.md) to create an incident for a security signal. 1. On the [Signals Explorer](https://app.datadoghq.com/security/workload-protection/signals), select a security signal. 1. In the Respond section of the signal side panel, expand More actions. 1. Under Escalate, do one of the following: - To create an incident, click Declare Incident. Configure the incident by specifying details such as the severity level and incident commander, then click Declare Incident. - To add the signal to an existing incident, open the dropdown next to Declare Incident, select an incident, and click Confirm. ## Run a workflow{% #run-a-workflow %} Use [Workflow Automation](https://docs.datadoghq.com/service_management/workflows.md) to manually trigger a workflow for a security signal. See [Trigger a workflow from a security signal](https://docs.datadoghq.com/security/cloud_security_management/workflows.md) for more information. 1. On the [Signals Explorer](https://app.datadoghq.com/security/workload-protection/signals), select a security signal. 1. In the Respond section of the signal side panel, click Run Workflow. 1. On the workflow modal, select the workflow you want to run. The workflow must have a security trigger to appear in the list. Depending on the workflow, you may be required to enter additional input parameters. 1. Click Run Workflow. Alternatively, click the Workflows tab in the signal side panel to see which workflows were triggered for the signal and suggested workflows to run. ## Kill containers or processes{% #kill-containers-or-processes %} From the signal side panel, you can terminate a malicious process or container directly. Under Respond, click Kill Containers or Processes. This action requires enforcement to be enabled on the Datadog Agent. The Agent terminates the targeted process or all processes in a compromised container depending on the configured scope. See [Manual response](https://docs.datadoghq.com/security/workload_protection/respond_and_report.md#response) for requirements, configuration, and action statuses. ## Network isolation{% #network-isolation %} From the signal side panel, you can isolate a compromised process or container from the network. Under Respond, click Network Isolation to block network traffic for the affected workload using an eBPF-based filter. Network isolation requires enforcement to be enabled on the Agent, along with the network probes that the Agent enables by default. See [Manual response](https://docs.datadoghq.com/security/workload_protection/respond_and_report.md#response) for requirements and available enforcement options.