# Source: https://docs.datadoghq.com/security/automation_pipelines/security_inbox.md

# Source: https://docs.datadoghq.com/security/security_inbox.md

---
title: Security Inbox
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > Security Inbox
---

# Security Inbox
Available for:
{% icon name="icon-cloud-security-management" /%}
 Cloud Security | 
{% icon name="icon-app-sec" /%}
 App and API Protection 
Security Inbox provides a consolidated, actionable list of your most important security findings. It automatically contextualizes and correlates insights from Datadog security products across vulnerabilities, signals, misconfigurations, and identity risks into a unified, prioritized view of actions to take to strengthen your environment.

{% image
   source="https://datadog-docs.imgix.net/images/security/security_inbox_7.dd911d3d4cd8ce5662522eb8e1cd5eb8.png?auto=format"
   alt="The Security Inbox shows prioritized security issues for remediation" /%}

## Types of findings in Security Inbox{% #types-of-findings-in-security-inbox %}

The findings that appear in Security Inbox are generated from App and API Protection (AAP) and Cloud Security. By default, these include the following types of findings:

- A curated set of [misconfigurations](https://docs.datadoghq.com/security/default_rules/?category=all#all) for [Cloud Security Misconfigurations](https://docs.datadoghq.com/security/cloud_security_management/misconfigurations/), compiled by Datadog Security Research.
- A curated set of [identity risks](https://docs.datadoghq.com/security/default_rules/?category=all#all) for [Cloud Security Identity Risks](https://docs.datadoghq.com/security/cloud_security_management/identity_risks/), compiled by Datadog Security Research.
- Application library vulnerabilities for [Software Composition Analysis(SCA)](https://docs.datadoghq.com/security/code_security/software_composition_analysis). All high and critical application library vulnerabilities on production services under attack appear in the inbox.
- Application code vulnerabilities for [Code Security vulnerabilities](https://docs.datadoghq.com/security/code_security/iast). All high and critical application code vulnerabilities appear in the inbox.
- Emerging vulnerabilities, which are infrastructure vulnerabilities that have had CVEs published in the last 30 days and that have a [Datadog severity score](https://docs.datadoghq.com/security/cloud_security_management/severity_scoring/#cloud-security-severity-scoring-framework) of Critical, or that the Datadog Security Research team has published. When Datadog rates a vulnerability as Critical, that means it's an exploitable critical vulnerability that affects an internet-facing production resource.
- [Attack Paths](https://docs.datadoghq.com/security/default_rules/?category=all#all). An attack path outlines a series of interconnected misconfigurations, container image, host, and application vulnerabilities that malicious actors could leverage to gain unauthorized access, escalate privileges, or compromise sensitive data in your cloud environment. All attack paths are listed in Security Inbox by default.

Security Inbox also takes the following detected risks into consideration when determining which findings appear in the inbox:

- **Public accessibility**: Publicly exposed resources carry elevated risk, especially if they contain vulnerabilities or misconfigurations. To learn more, see [How Datadog Determines if Resources are Publicly Accessible](https://docs.datadoghq.com/security/cloud_security_management/guide/public-accessibility-logic/).
- **Privileged access**: Resources with privileged access carry elevated risk as they grant elevated permissions that can expand the attack surface.
- **Under attack**: Resources that are seeing suspicious security activity carry elevated risks. Resources are flagged as "Under Attack" if a security signal has been detected on the resource in the last 15 days.
- **Exploit available**: Vulnerabilities with public exploits available carry elevated risks. The availability of a public exploit is verified with different exploit databases, such as [cisa.gov](https://www.cisa.gov/), [exploit-db.com](https://www.exploit-db.com/), and [nvd.nist.gov](https://nvd.nist.gov/).
- **In production**: Vulnerabilities in production environments carry elevated risks. The environment is computed from the `env` and `environment` tags.

## How Security Inbox prioritization works{% #how-security-inbox-prioritization-works %}

Security Inbox ranks issues by considering the severity of a finding first, followed by the number of correlated risks, and then the number of impacted resources and services.

- **Severity (Critical, High, Medium, and Low)**: Severity is determined by the [Datadog Security Scoring Framework](https://docs.datadoghq.com/security/cloud_security_management/severity_scoring/#cloud-security-severity-scoring-framework) for cloud misconfigurations and identity risks, and by CVSS 3.1 for vulnerabilities.
- **Number of detected risks**: When two findings have the same severity, the one with a greater number of detected risks is given higher priority.
- **Number of impacted resources and services**: If two findings share both the same severity and the same number of detected risks, the finding that impacts a greater number of resources and services is prioritized higher.

**Note**: The type of finding, detected risk, or impacted resource does not influence prioritization.

## Use the security context map to identify and mitigate vulnerabilities{% #use-the-security-context-map-to-identify-and-mitigate-vulnerabilities %}

The security context map for Attack Paths provides a comprehensive view to help identify and address potential breach points. It effectively maps interconnected misconfigurations, permission gaps, and vulnerabilities that attackers might exploit.

Key features include:

- **Risk assessment**: The map enables security teams to assess the broader impact of vulnerabilities and misconfigurations. This includes evaluating whether security policiesâsuch as access paths and permissionsâneed updating, and understanding the compliance implications of exposure, particularly when sensitive data is at risk within the blast radius.
- **Actionable context for immediate response**: The map includes service ownership information and other relevant context, allowing teams to make informed, real-time decisions. Teams can take action directly from the map by running integrated workflows, sharing security issue links, and accessing the AWS console view of resources for efficient remediation, all without switching tools.

{% image
   source="https://datadog-docs.imgix.net/images/security/security_context_map.2c24dc99467ccae6ee39e9115aebc93c.png?auto=format"
   alt="The security context map showing a publicly accessible AWS EC2 instance with a critical misconfiguration" /%}

## Customize Security Inbox to highlight crucial issues{% #customize-security-inbox-to-highlight-crucial-issues %}

Automation Pipelines enables you to configure rules that customize your Security Inbox, allowing you to highlight issues that are critical to your organization. By setting up these automated rules, you can streamline the management of newly discovered vulnerabilities, enhancing triage and remediation efforts at scale. Leveraging both the Automation Pipelines and Add to Security Inbox rules, you can optimize your security operations in the following ways:

- **Resurface issues not captured by default**: Highlight issues that might be missed by default or custom detection rules, ensuring no critical issue is overlooked.
- **Strengthen compliance and address key system concerns**: Address concerns affecting regulatory compliance or important business systems, regardless of severity.
- **Prioritize current risks**: Focus on immediate threats, such as identity risks after an incident or industry-wide vulnerabilities.

For more information, see [Automation Pipelines](https://docs.datadoghq.com/security/automation_pipelines/) and [Add to Security Inbox Rules](https://docs.datadoghq.com/security/automation_pipelines/security_inbox).

## Further Reading{% #further-reading %}

- [Learn more about App and API Protection](https://docs.datadoghq.com/security/application_security/)
- [Learn more about Cloud Security](https://docs.datadoghq.com/security/cloud_security_management)
- [Out-of-the-box Detection Rules](https://docs.datadoghq.com/security/default_rules/#all)
- [How Datadog Security Inbox prioritizes security risks](https://www.datadoghq.com/blog/security-inbox-prioritization/)