Assignee management lets you assign a Datadog user directly to a security finding to establish ownership during triage. You can assign a user without creating a Case or a third-party ticket first.

If a finding is linked to a Case or ticket, the finding’s assignee and the linked Case or ticket assignee stay in sync. Cases and tickets remain optional.

Supported products

You can assign users to findings in the following products:

• Cloud Security
• Code Security
• App and API Protection
• Workload Protection

Assign a user to a finding

You can assign a user from the findings explorer, the finding side panel, or the finding detail page:

1. Open a finding, or hover over a finding in the explorer.
2. In the Assignee control, select a Datadog user.

To unassign a finding, open the Assignee control and clear the selected user.

Assign multiple findings at once

To assign one user to several findings in a single action:

1. In the findings explorer, select up to 50 findings.

2. Click Assign and select a Datadog user.

3. If some selected findings already have an assignee, choose how to handle them:

   • Exclude Vulnerabilities with Existing Assignees: skip findings that already have an assignee.
   • Override Existing Assignees: reassign all selected findings to the new user.

4. If any selected findings are linked to shared tickets, Datadog warns you that reassigning updates the ticket assignee and affects all findings linked to those tickets.

5. Confirm to apply the assignment.

Assignees, Cases, and tickets

Assignment works independently of Cases, and the finding assignee and any linked Case or ticket assignee stay in sync.

Bidirectional sync

When bidirectional syncing is set up, assigning or unassigning a finding that is linked to a Case or ticket also updates the linked Case or ticket assignee. Assignee changes made in the external tool propagate back to the finding.

Assignee sync is supported for Jira and Linear. ServiceNow ticket assignees are not synced.

Case creation carryover

When you create a Case for a finding that already has an assignee, the assignee carries over to the new Case.

Assignee precedence

The finding assignee is resolved as follows:

Permissions for linked Cases and tickets

Updating a linked Case or ticket assignee is subject to Case Management project permissions. If you or the target assignee are not authorized for the Case’s project, Datadog still assigns the finding, leaves the Case assignee unchanged, and notifies you that the Case was not updated.

Shared tickets

When several findings are linked to one ticket, assigning or unassigning one finding’s assignee updates the ticket and all other findings linked to that ticket.

Assignee facet

The following facet is available for filtering findings by assignee:

• Assignee: the assigned user’s name.

You can query this facet and build dashboards with it.

Permissions

To assign or unassign findings, you must have the security_monitoring_findings_write or appsec_vm_write permission. See Role Based Access Control for more information about Datadog’s default roles and granular role-based access control permissions.

Further reading

Additional helpful documentation, links, and articles:

Manage security findings with third-party ticketing toolsDOCUMENTATION Case ManagementDOCUMENTATION