# Source: https://docs.datadoghq.com/security/default_rules/def-000-jg6.md

---
title: Orca Security CDR alert detected
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Orca Security CDR alert detected
---

# Orca Security CDR alert detected

{% alert level="danger" %}
This rule is part of a beta feature. To learn more, [contact Support](https://docs.datadoghq.com/help/).
{% /alert %}
Classification:attack 
## Goal{% #goal %}

Detect and respond to Cloud Detection and Response (CDR) alerts generated by Orca Security to prevent potential security breaches.

## Strategy{% #strategy %}

Identify and trigger notifications for CDR alerts issued by Orca Security, indicating potential security threats.

## Triage and response{% #triage-and-response %}

1. Assess the alert details, focusing on the category, type, and risk level.
1. Analyze the alert context to determine the potential impact and scope of activity.
1. Evaluate the risk associated with the alert, considering the sensitivity of the affected assets, potential compliance violations, and the likelihood of a security incident to guide decision-making and response prioritization.
1. Follow the recommended course of action as described in the alert recommendation to contain and mitigate the threat.
1. Implement mitigation measures to contain and remediate the activity that generated the alert, such as isolating affected systems, blocking malicious communication channels, and applying security controls to prevent further unauthorized access or data compromise.
1. Report findings from the investigation, response actions taken, and recommendations for improving security controls to relevant stakeholders, security teams, and management to enhance visibility, communication, and incident response coordination.