> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pensar.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pensar.dev/_mcp/server.

# Incidents

> Send Datadog SIEM alerts to Pensar and get each one triaged into a true or false positive with recommended remediation

# Incidents

Incidents triages the alerts your SIEM raises. Connect Datadog, and every Cloud SIEM signal or monitor alert you route to Pensar is investigated by an agent that decides whether it is a real attack and tells you what to do about it.

> **Note**
>
> Incidents is in early access. Contact Pensar to enable it for your workspace. Workspace **admins** and **owners** connect Datadog; every member can view and act on incidents.

## How it works

#### Receive

Datadog posts the alert to your workspace's webhook. An alert that fires again is counted on the same incident rather than opening a new one, and recovery notifications are ignored.

#### Investigate

The triage agent reads the alert and checks it against what Pensar knows about your workspace: whether a Pensar pentest was running against the same asset at the time, and which open findings exist on the hosts the alert names. If you gave Pensar log access, it also searches your Datadog logs around the alert, for example to see whether a burst of failed logins ended in a successful one.

#### Decide

The incident gets a verdict, a confidence level and an assessed severity, along with the evidence behind it and the indicators involved.

#### Recommend

You get prioritized remediation: containment steps first for a real attack, or how to tune the detection rule so it stops firing on a false or benign positive.

| Verdict             | Meaning                                                                                          |
| ------------------- | ------------------------------------------------------------------------------------------------ |
| **True positive**   | Real malicious or unauthorized activity                                                          |
| **Benign positive** | The rule fired correctly on activity that is expected, such as a Pensar pentest or an admin task |
| **False positive**  | The rule fired on activity it is not meant to catch                                              |
| **Inconclusive**    | The available evidence cannot settle it; the analysis says what data would                       |

The verdict is advice. **Resolve** or **Dismiss** an incident once you have acted on it; **Triage again** re-runs the agent, for example after you add log access.

## Connecting Datadog

#### Connect

Open **Incidents** in your workspace sidebar. Choose your **Datadog site**, decide whether every new alert should be triaged automatically, and click **Connect Datadog**.

#### Copy the token

Pensar shows a webhook token once. Copy the **URL**, **Custom headers** and **Payload** snippets from **Setup instructions** before leaving the page. If you lose the token, use **Rotate token** and update the header in Datadog.

#### Create the webhook in Datadog

In Datadog, go to **Integrations** → **Webhooks** and add a webhook named `pensar`. Paste the URL, enable custom headers and paste the header snippet, and replace the payload with the Pensar payload.

#### Route alerts

Add `@webhook-pensar` to the notification message of each Cloud SIEM detection rule or monitor you want triaged.

> **Note**
>
> If Datadog reports a failed delivery, a `400` means the payload is not the Pensar template and a `401` means the `Authorization` header does not match your current token.

### Log access (optional)

Without keys, the agent triages from the alert alone and its confidence is lower. To let it search your logs, enter a Datadog **API key** and an **application key** with the `logs_read_data` scope, either when connecting or later with **Add keys**. Pensar checks the keys with Datadog before saving them. Log searches run on Pensar's servers; the keys are never given to the agent.

Use **Intake** to pause receiving alerts and **Auto-triage** to triage only when someone asks. **Disconnect** deletes the token and keys; incidents already received stay on the page.