Bits Security Analyst
AI agent by Datadog
AI-powered security agent for automated threat detection and response.
Bits Security Analyst is an AI-powered security agent that automates threat detection, investigation, and response within the Datadog platform. It correlates security signals with real-time observability data to reduce alert fatigue and speed up incident response, achieving up to a 93% reduction in investigation time.
Agent specs
- What it does
- Bits Security Analyst is an AI agent that automates security operations, including threat detection and incident response, within the Datadog platform.
- For
- Security and engineering teams responsible for protecting and governing AI agents.
- Actions
- Automate security operations, Threat detection, Incident response
- Integrations
- AI Guard, Jira
- Channels
- AI Guard, Third-party SIEM
- Monthly bundle
- $500 per 500 credits
- On-demand
- $1.30 per credit
- Availability
- Generally available as part of Datadog Cloud SIEM.
- Price
- From 1.3 USD per credit
- Languages
- English
Category: AI Agents
- Autonomy
- Autonomous
- Works in
- Microsoft Teams
- Up to 93% reduction in investigation time
- Automated root cause analysis and impact summarization
- Unified security and observability telemetry correlation
- Built-in SOAR and incident response integration
Overview
Bits Security Analyst is an AI-powered security agent designed for security engineers and IT operations teams to automate threat detection and response. Integrated within Datadog's Cloud SIEM and security platform, it solves the problem of alert fatigue and slow incident response by correlating security signals with real-time observability data. The agent performs autonomous investigations that can reduce the time required to identify root causes and summarize impact by up to 93%. It operates with deep runtime context, using live APM traces and logs to map entities and services during an attack. By providing surgical precision in threat containment and integrating with built-in SOAR capabilities, Bits Security Analyst enables organizations to neutralize threats at the speed of modern cloud environments.
Threat Detection and Analysis
- Automated Investigations: The agent automatically investigates security alerts by correlating telemetry across the stack to identify root causes and summarize impact.
- Real-time Threat Detection: It analyzes operational and security logs in real time to detect sophisticated threats and malicious patterns.
- Deep Runtime Context: The agent provides deep runtime context by correlating security signals with live APM traces, logs, and service dependencies.
- Signal Prioritization: It assists security teams in triaging prioritized signals grouped by agent, session, and attack category.
Incident Response and Remediation
- Surgical Remediation: The agent applies remediations to contain threats at the source with surgical precision.
- SOAR Automation: It integrates with built-in SOAR and incident response tools to automate security operations.
- Flexible Investigation Workflows: Users can investigate signals and take action from within the Datadog platform or through third-party SIEM integrations.
- Automated Response Workflows: The agent can trigger automated response workflows to block attacking IPs or create security cases in tools like Jira.
Governance and Control
- Centralized Signal Review: Security signals reviewed by the team are centrally captured and reviewed to ensure no issues are missed.
- Audit Evidence Generation: The agent generates audit evidence tied to specific sessions, including evaluation details and access logs.
- Human Review and Annotation: Human analysts can review and grade agent outputs with annotations to refine system behavior.
What it does
- Automatically investigate alerts\nCorrelate telemetry across the stack\nIdentify root causes of security incidents\nSummarize impact of threats\nApply remediations to contain attacks\nAnalyze security logs in real time
Published results
- Up to 93% reduction in investigation time
Highlights
- Up to 93% reduction in investigation time
- Automated root cause analysis and impact summarization
- Unified security and observability telemetry correlation
- Built-in SOAR and incident response integration
Use cases
- Security engineers use the agent to automatically investigate SIEM alerts and identify the root cause of potential breaches.
- Incident response teams automate threat containment using the agent's built-in SOAR workflows to block malicious IPs.
- Security analysts correlate security signals with live APM traces to understand the business impact of a runtime attack.
How it works
- Platform Integration: The agent is part of the Datadog Security platform and requires the Datadog Agent to be deployed for telemetry collection.
- Data Ingestion and Correlation: The agent ingests and correlates telemetry across the stack, including APM traces, logs, and service dependencies.
- Autonomous Investigation: When a security alert is triggered, the agent automatically begins an investigation to identify the root cause and summarize the impact.
- Review and Remediation: Security teams review the prioritized signals and can execute automated remediation workflows or manual fixes.
Specifications
- Channels: In-app\nAPI\nSlack
- Integrations: Datadog Cloud SIEM\nDatadog Cloud Security Management\nJira\nThird-party SIEMs
- Human control: Human review and annotation for labeling outputs\nManual triage of prioritized signals\nPolicy Simulator for previewing verdicts before production enforcement
- Investigation Time Reduction: 93%
- Out-of-the-Box Detections: 900+
- Estimated Credits Per Investigation: ~4 credits
- Platform Requirements: Datadog Cloud SIEM
Plans
- AI Credits (per 500 credits): 500 per month (billed annually)
- On-demand AI Credit: 1.3 per credit
FAQ
What is Bits Security Analyst?
Bits Security Analyst is an AI-powered security agent that automates threat detection, investigation, and response within the Datadog platform. It helps security teams reduce investigation time by up to 93% by correlating security signals with live observability data.
How much does it speed up security investigations?
The agent uses AI-assisted investigation to reduce the time spent on security investigations by approximately 93%. It achieves this by automatically correlating telemetry across the stack to map entities and live execution.
Does it support automated incident response?
Yes, it integrates with Datadog's built-in SOAR and incident response tools, allowing teams to automate security operations and contain threats at the source.
How is the usage of Bits Security Analyst billed?
Bits Security Analyst is part of the Bits AI suite and consumes AI Credits. A single autonomous investigation typically consumes approximately 4 credits, though actual consumption may vary based on task complexity.
Added by AntSpace from public sources (datadoghq.com).