Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,8 @@ The Ownership Agent reads multiple data sources and combines them into a ranked
| Priority | Signal | Description |
| -------- | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1 | **Owner tags** | Cloud resource tags with keys such as `owner`, `dd-team`, or `team`. An explicit ownership tag is the strongest signal. |
| 2 | **Ownership preferences** | Custom tag mappings and rules you define in a [reference table](/reference_tables). These act as organization-level overrides and are evaluated alongside direct tags. Learn more at [set up ownership preferences](/security/cloud_security_management/review_remediate/ownership_preferences/). |
| 3 | **Service Catalog** | Team ownership data from the Datadog Service Catalog, matched against the resource's service, application, or component tags. |
| 2 | **Ownership preferences** | Tag mappings, exclusions, and custom instructions you define on the [Ownership Agent settings page](https://app.datadoghq.com/security/configuration/csm/ownership-agent). These act as organization-level overrides. Datadog evaluates ownership preferences alongside direct tags. Learn more at [Set Up Ownership Preferences](/security/cloud_security_management/review_remediate/ownership_preferences/). |
| 3 | **Software Catalog** | Team ownership data from the Datadog Software Catalog, matched against the resource's service, application, or component tags. |
| 4 | **Cloud audit logs** | The identity of the user or principal that created the resource, extracted from cloud provider audit logs (for example, AWS CloudTrail). Automation accounts and CI principals are filtered out. |
| 5 | **Container and host catalog** | Registry and host metadata for container images and host VMs, including image labels and host annotations. |
| 6 | **Naming patterns** | Heuristics that infer ownership from resource names, service identifiers, or tag values that match known team naming conventions. |
Expand Down
Loading
Loading