---
title: Investigate Security Signals
description: >-
  Use the signal side panel to reconstruct the attack story, assess impact, and
  read the raw signal data.
breadcrumbs: >-
  Docs > Datadog Security > Workload Protection > Investigate and Triage >
  Signals > Investigate Security Signals
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Investigate Security Signals

When you select a Workload Protection signal in the [Signals Explorer](https://app.datadoghq.com/security/workload-protection/signals), the side panel provides investigation tools to reconstruct the attack story, understand impact, and access the raw signal data.

## What happened{% #what-happened %}

The What Happened section gives you a summary of the current signal:

- Attack chain: A human-readable description of the detected activity and how it fits into the broader threat story.
- Where: The infrastructure context where the signal occurred, including cloud provider, account, region, host, Kubernetes cluster, namespace, pod, container, and image.
- Detection rule: The backend detection rule that generated the signal, including its name, severity, and rule expression.
- Agent rule: The Agent rule that matched the underlying runtime activity, including the rule name, event name, and deployment policies.

## Investigation graph{% #investigation-graph %}

The Investigation tab displays an interactive graph that maps processes, resources, and runtime events involved in the signal. The investigation graph helps you see how an attack unfolded step by step.

{% image
   source="https://docs.dd-static.net/images/security/workload_protection/investigate_and_triage/security_signals/signal_investigation_graph.9b5e9c83224da2c2746b2b9558afbbb1.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/workload_protection/investigate_and_triage/security_signals/signal_investigation_graph.9b5e9c83224da2c2746b2b9558afbbb1.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Investigation graph showing an attack chain from attacker to compromised container, with correlated processes and suspicious actions" /%}

From the graph, you can pivot to other telemetry sources, such as Code Security or Infrastructure Monitoring, to validate code vulnerabilities or get more information about the specific resource.

### Correlated events{% #correlated-events %}

Use Correlated events on the investigation graph to expand the view beyond the initial signal. It uses [variables](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/agent_rules/variables_and_actions.md) to group runtime activity that belongs to the same process lineage or exploitation chain.

Each event detected by Workload Protection is tagged with a correlation key that associates it with other events in the same execution chain. This grouping helps you focus on the broader compromise attempt instead of responding to isolated alerts.

Workload Protection supports built-in Execution Context layers for common runtime scenarios, including:

- **Generic cgroup context**: Fallback context for unrelated events.
- **Generic auid context**: Groups events by user session.
- **Service context**: Isolates runtime activity within service boundaries.
- **Interactive shell context**: Correlates commands from the same shell session.
- **Kubernetes user session context**: Tracks Kubernetes user actions with fine-grained correlation.
- **Malware IOC**: Groups events that match the same malware indicator from [threat intelligence](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/threat_intelligence.md), such as a file hash or domain.

### Blast radius{% #blast-radius %}

Use Blast radius on the investigation graph to assess the potential impact of the detected threat. The blast radius view highlights the resources, services, and dependencies that could be affected if the compromise spreads beyond the initial detection point.

This helps you prioritize response efforts and understand which adjacent workloads, hosts, or containers require additional monitoring or hardening.

### Events timeline{% #events-timeline %}

The Events timeline presents a chronological narrative of every event within a correlated threat story. It combines correlated events, triage statuses, responses, and recommended actions into a single view. Use it to retrace an attacker's movements from the initial exploit to subsequent actions without switching between views.

Each event in the timeline includes contextual details and links to correlated metrics, logs, and traces.

## Context{% #context %}

The Context tab summarizes the key attributes of the host where the signal was triggered and links to related metrics, processes, and other information to help you assess the affected resource.

## Signal JSON{% #signal-json %}

The Signal JSON tab displays the raw content of the signal. Signal JSON is the underlying data structure that powers the Signals Explorer, dashboards, and programmatic queries.

Use Signal JSON when you need to:

- Write complex queries to group, count, or correlate signals in the [Signals Explorer](https://app.datadoghq.com/security/workload-protection/signals) or [dashboards](https://docs.datadoghq.com/dashboards.md).
- Build automations or integrations that consume signal data through the [Datadog API](https://docs.datadoghq.com/api/latest/security-monitoring.md).
- Share the full signal payload with colleagues or external tools during an investigation.

{% alert level="info" %}
Signal JSON is most useful for advanced users who want to query signals programmatically. For most investigations, the investigation graph, timeline, and context tabs provide the information you need.
{% /alert %}