From b1851e19afcbc832a883f2ad533a06957cbef9d7 Mon Sep 17 00:00:00 2001 From: Janine Chan <64388808+janine-c@users.noreply.github.com> Date: Mon, 16 Mar 2026 19:00:58 -0600 Subject: [PATCH 1/4] Bits AI Security Analyst docs --- config/_default/menus/main.en.yaml | 11 ++- content/en/bits_ai/_index.md | 2 +- .../en/bits_ai/bits_ai_security_analyst.md | 92 ++++++++++++++++++ .../bits_ai_security_analyst_example.png | Bin 0 -> 374594 bytes ...s_ai_security_analyst_signals_explorer.png | Bin 0 -> 643714 bytes 5 files changed, 101 insertions(+), 4 deletions(-) create mode 100644 content/en/bits_ai/bits_ai_security_analyst.md create mode 100644 static/images/bits_ai/bits_ai_security_analyst_example.png create mode 100644 static/images/bits_ai/bits_ai_security_analyst_signals_explorer.png diff --git a/config/_default/menus/main.en.yaml b/config/_default/menus/main.en.yaml index 21f512e55cf..fe0517be670 100644 --- a/config/_default/menus/main.en.yaml +++ b/config/_default/menus/main.en.yaml @@ -1438,21 +1438,26 @@ menu: parent: bits_ai_dev_agent identifier: bits_ai_dev_agent_setup weight: 200 + - name: Bits AI Security Analyst + url: bits_ai/bits_ai_security_analyst + identifier: bits_ai_bits_ai_security_analyst + parent: bits_ai + weight: 3 - name: Bits Assistant url: bits_ai/bits_assistant identifier: bits_ai_bits_assistant parent: bits_ai - weight: 3 + weight: 4 - name: MCP Server url: bits_ai/mcp_server identifier: bits_ai_mcp_server parent: bits_ai - weight: 4 + weight: 5 - name: Setup url: bits_ai/mcp_server/setup identifier: bits_ai_mcp_server_setup parent: bits_ai_mcp_server - weight: 401 + weight: 501 - name: Dashboards url: dashboards/ pre: dashboard diff --git a/content/en/bits_ai/_index.md b/content/en/bits_ai/_index.md index b45a2cd0b11..09ab3e8a23d 100644 --- a/content/en/bits_ai/_index.md +++ b/content/en/bits_ai/_index.md @@ -27,7 +27,7 @@ Bits AI is your agentic teammate in Datadog, built to automate development, secu {{< whatsnext desc="Learn about how you can use Bits AI:" >}} {{< nextlink href="bits_ai/bits_ai_sre" >}}Investigate alerts with Bits AI SRE{{< /nextlink >}} {{< nextlink href="bits_ai/bits_ai_dev_agent" >}}Automate code fixes with Bits AI Dev Agent{{< /nextlink >}} - + {{< nextlink href="bits_ai/bits_ai_security_analyst" >}}Triage security threat signals with Bits AI Security Analyst{{< /nextlink >}} {{< nextlink href="bits_ai/bits_assistant" >}}Explore your observability data with Bits Assistant{{< /nextlink >}} {{< nextlink href="bits_ai/mcp_server" >}}Get observability insights from AI agents with the Datadog MCP server{{< /nextlink >}} {{< /whatsnext >}} diff --git a/content/en/bits_ai/bits_ai_security_analyst.md b/content/en/bits_ai/bits_ai_security_analyst.md new file mode 100644 index 00000000000..e3d13f9e602 --- /dev/null +++ b/content/en/bits_ai/bits_ai_security_analyst.md @@ -0,0 +1,92 @@ +--- +title: Bits AI Security Analyst +further_reading: + - link: https://www.datadoghq.com/blog/bits-ai-security-analyst/ + tag: Blog + text: Automate Cloud SIEM investigations with Bits AI Security Analyst +--- + +## Overview + +Bits AI Security Analyst is an autonomous AI agent that investigates Cloud SIEM signals end to end. It queries security signals and logs, and uses data-based reasoning to help security engineers investigate threat alerts and make a recommendation on the verdict of each alert signal. By reducing manual effort and analyst fatigue, Bits AI Security Analyst makes security operations smoother and more efficient. + +### Key capabilities + +Bits AI Security Analyst investigations are autonomous. If a detection rule is enabled, Bits AI autonomously investigates signals associated with it. + +In the [Cloud SIEM Signals Explorer][5], you can click the **Bits AI Security Analyst** tab to only show signals that Bits AI investigated. In the Severity column, a Bits AI status displays as Investigating, Benign, or Suspicious. + +{{< img src="bits_ai/bits_ai_security_analyst_signals_explorer.png" alt="The Cloud SIEM signals explorer, on the Bits AI Security Analyst tab" style="width:100%;" >}} + +When you click a row with a Bits AI investigation, the Bits AI Investigation side panel opens: + +{{< img src="bits_ai/bits_ai_security_analyst_example.png" alt="Bits AI Security Analyst example detection, titled 'Okta phishing detection with FastPass origin check'." style="width:100%;" >}} + +In the side panel, you can see Bits AI's investigative findings, including: +- Overall conclusion +- Key evidence used to come to that conclusion +- Investigative steps showing Bits AI's data queries, including embedded results and links to full queries +- Analysis on each investigative step + +You can also take additional steps directly from the side panel: +- Create a case with pre-populated Bits AI investigation results +- Run a workflow with a SOAR blueprint +- Declare an incident +- Add a rule suppression +- Archive the signal, or view the signal with the usual Cloud SIEM interface +- Give Bits AI feedback on its analysis + +Additionally, when you use Cloud SIEM notifications to send new signal alerts to Slack or Jira, Bits AI automatically updates those notifications. It includes replies showing the Bits AI investigative conclusion, with a link to the full investigation. + +### Supported sources + +Bits AI can run investigations on the following Security log sources: +- AWS CloudTrail +- Azure +- GCP +- Kubernetes +- EntraID +- Okta +- Google Workspace +- Microsoft 365 +- GitHub +- Snowflake +- SentinelOne +- Email phishing + +## Set up Bits AI Security Analyst + +### Prerequisites + +To use Bits AI Security Analyst: +- Ensure your organization is using a non-legacy version of Cloud SIEM. If you need assistance, contact [Datadog support][1]. +- To set up Bits AI Security Analyst, you need the **Bits AI Security Analyst Config Write** [permission][2]. +- To view investigations, you must have 14 days or more of log history. If you have a shorter log history, you can still set up Bits AI Security Analyst, but won't see any investigations until you have that much history. + +### Setup + +As soon as you enable Bits AI Security Analyst, by default, it starts autonomously investigating signals for all eligible rules above medium severity. + +1. In Datadog, go to **Security** > **Settings** > **[Bits AI Security Analyst][3]**. +1. Turn on the toggle to enable Bits AI Security Analyst. Additional settings appear. +1. (Optional) Configure which rules and which severities you want Bits AI Security Analyst to automatically investigate signals for. There are two ways to do so: + - Click **Rule Settings** to configure investigations for individual rules. You can change the minimum severity for signals to be investigated, and enable or disable individual rules for investigation. +
omK9?xEO*27vGkxIewU(C##Xe>Y-8AXpw%<(_l!EqS{@6e+jzZ9`wgO|0M8gh0
zn*{}Uge9{O(=&Uq-_@i+g`OZ4>qsB>h7bg!uBpJ8MTzb$&Qp5 hD46&0
z3E6o$6rJ}5d{xs1Mvt@v>H5q{3^zXrWhC0#Sl4LlvyNuhewh~6>*iiYe+s!_tba4H
z<9WV{i)G(( +)Wq>7MO
zy2BpInO^wt%59a~hi8DRIlF#8k$PzQ7LUB!zG2l^Ew^zE0_VP=$Hhrx_Zu@|of*AK
zwSR#gcU3qB{GK~*a?^7QedZW3AaW3)nO-11KO^pwdv_ks#D>R18NrAtKnX;~3!|O2
zY~@gd!^B-4o=B$*3cw!n?cOLhR#mF6enB5AM_QTJa+Y$_iQl!28vCT*Uz6vbY%`S9
ziU#HyQB1Dh?Zu=sfa-3 aw^F5?Kc`Y>MTyxxj*PWTwdu8zPl~Gx@}>Ft5EMaAqSTJg
z)*u%dt776T7xns4^vHGm(vhd^@Vg#jM4}R{NMcN^LF}UIPhQU(sLVu*eq*wN6jc><
z*4IH7$j=zlBriz63Tj~Ud0H6HqE=d@vAq&-v&?B^r>bP_CO0(A@Lk03w$NOnJ8T1=
z0f#qs5qqVt^&cB3aB^0n3O55IfHepFXXcM%E2O^0Zw)v0R;RdvtH^E>^9ly0&jzB)
zy-qqO%zt5D@HOpb|KxEw9aL19qMF|4nvT`{ uf7t9TH?p}Ncw-3P{}imhC5K1p3q_pXsJCk{{$3ay
z@WiB*-2`Zp8XnbYqvZ~oxRsGY#fx>gg92b;4^npakAxp&C}78EA-ZtvA+HL4sG(v_Q9~WJJ4V5f$U%
z&lQ*}ui@>f0JfH~)vU(N{EDh3%NWEdd
zHu7Qgws(67uN`$E$|{00Y*vt&2=pt#^_nLS>FXXna+J;*-ro=XdF&4amU|tr(f6)6
zTTmdnR6QuTmA7VpARZ6Y<`P)XPf&uv#)&j9`SvyY{1bTjnnW*{zOH_CfD1fYX9{f}
zbC>ixM7?tfUp#*ha3Y`r!)nBB@3N2r%rt-fU}b-^A2&WibYWs%u;St()>Ho6I-=td
zDc!(+907j!C|*#ouBrphCc}&wa_`QQ5S;%VqxCoaOsUW~7$_z^GKk5yn9HG?&}&3J
z|0ZtHW_T1Ez_`wWdt3x&BXb@=nHwb+cpN*K^JsNmC%EXICP&stJ@sV$t`T#8aX#*{
zJ(uIu_D3TnK0$&|cjCal=8&-&vV1noY`s%JVdkjvN5jY7fwDf=a+@HL$95XIfr4-h
zTeEB4Z*<$;Mwa`vxHxV4X$1}<1NRK~V35e!V?olMJlMFQ9z$GzbUv`MyIf3Q%x)dV
zd9(TxNvQO@@l!u%2d}nyEV`dy3T7sif2qaf682Ikn|^TWDv{o2;aM3#AeX5y@7;&9
zBC(NP4Lw`@#G*_`loenlFh$U$X2monfo~3ST%|XLBLcC?+C7WHV#{HXO+vEp3ez4S
zUaBO}mH6578sRg;`E>_bOEDsPk|>b^q93)^C|4osXxTO6t}&92YC!EHLmU>q$TTYtpEqFIg8
zgV$o6e`3kLPbz1dkI7I%lJ+HZnBD9HFb?}5B%YyASCO$DtZ+K2+4k8j0Q#+>eH|Bd
zqh@Z|_XDze-!ARnbnu_b_>UV(ZPYhwxwL&3G|@ya(972-n@gTqQjJk{d=3v_l0jU3
zc#ZRAnU%KZb2zw-hlw@%c}LCgAlBhRUl0Do7p;cxg)35}m#9NS6?UD>lNC}8CqcY_
zY;KFD-lB|cedg;s7-eRuFL+|+-^K86=JcO-^&dC>#V?8{WuN`^fE~V{N{%=ui%N09
z^tTuGGMfXT(@Yk6EbB*rV!SVP&SdDoLyB0E&$!SR3>>e1aido24u+xIt(ZLTFO6jX
zMVxp`@=aFPQQJzjO9!R?-K*7_>Et?(5}8hpvZ_N`qW^=E{Zreb$&e!v+nrDlE6Pg!
zguR<8miRT=k6`7gD&KY)S5d7Vf&m3fblx`e4Tsl++_YTi;ijg#UrCg)C3z}oFI8wi
zp{7d*wC?P_iBVN`BoF*ALyn7|{Uj+^Q8-Nj6@*TyO*Y|MgZ{E2%TVX(o{fyzGz#>O
z-@>!kIPPagAz4c%%#aZkvkeNoKmLBNed-$v&z_5OJCCL~zwa?5g+8AJmaBPd=0~kx
zk9_$LVf<&`L{XJrWj`T$%1lS=FDUVZ`l
z)7Qfd((T_nLpJLl1)%4QObupUyri77t6}F