Incidents

Incidents triages the alerts your SIEM raises. Connect Datadog, and every Cloud SIEM signal or monitor alert you route to Pensar is investigated by an agent that decides whether it is a real attack and tells you what to do about it.

Incidents is in early access. Contact Pensar to enable it for your workspace. Workspace admins and owners connect Datadog; every member can view and act on incidents.

How it works

Receive

Datadog posts the alert to your workspace’s webhook. An alert that fires again is counted on the same incident rather than opening a new one, and recovery notifications are ignored.

Investigate

The triage agent reads the alert and checks it against what Pensar knows about your workspace: whether a Pensar pentest was running against the same asset at the time, and which open findings exist on the hosts the alert names. If you gave Pensar log access, it also searches your Datadog logs around the alert, for example to see whether a burst of failed logins ended in a successful one.

Decide

The incident gets a verdict, a confidence level and an assessed severity, along with the evidence behind it and the indicators involved.

Verdict	Meaning
True positive	Real malicious or unauthorized activity
Benign positive	The rule fired correctly on activity that is expected, such as a Pensar pentest or an admin task
False positive	The rule fired on activity it is not meant to catch
Inconclusive	The available evidence cannot settle it; the analysis says what data would

The verdict is advice. Resolve or Dismiss an incident once you have acted on it; Triage again re-runs the agent, for example after you add log access.

Connecting Datadog

Connect

Open Incidents in your workspace sidebar. Choose your Datadog site, decide whether every new alert should be triaged automatically, and click Connect Datadog.

Copy the token

Pensar shows a webhook token once. Copy the URL, Custom headers and Payload snippets from Setup instructions before leaving the page. If you lose the token, use Rotate token and update the header in Datadog.

Create the webhook in Datadog

In Datadog, go to Integrations → Webhooks and add a webhook named pensar. Paste the URL, enable custom headers and paste the header snippet, and replace the payload with the Pensar payload.

Route alerts

Add @webhook-pensar to the notification message of each Cloud SIEM detection rule or monitor you want triaged.

If Datadog reports a failed delivery, a 400 means the payload is not the Pensar template and a 401 means the Authorization header does not match your current token.

Log access (optional)

Without keys, the agent triages from the alert alone and its confidence is lower. To let it search your logs, enter a Datadog API key and an application key with the logs_read_data scope, either when connecting or later with Add keys. Pensar checks the keys with Datadog before saving them. Log searches run on Pensar’s servers; the keys are never given to the agent.

Use Intake to pause receiving alerts and Auto-triage to triage only when someone asks. Disconnect deletes the token and keys; incidents already received stay on the page.