Skip to content

Commit bfcd8ec

Browse files
[K9VULN-16251] Add agentic Bits AI docs (#37511)
* add agentic Bits AI docs * rename section to agentic false positive filtering * Apply suggestion from @domalessi * Apply suggestion from @domalessi * scope agentic FP filtering to injection rules --------- Co-authored-by: domalessi <111786334+domalessi@users.noreply.github.com>
1 parent fe75ff5 commit bfcd8ec

1 file changed

Lines changed: 8 additions & 0 deletions

File tree

content/en/security/code_security/static_analysis/ai_enhanced_sast.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,14 @@ Bits AI Memories lets teams add rule-specific context that Bits AI uses when ass
151151

152152
In the SAST rule side panel, expand the false positive reports accordion to review reports shared by your organization for the selected rule. Use the custom context tab in the same section to add guidance for future Bits AI assessments. Memories apply at the organization and rule level for SAST. They apply only to security category SAST rules in Datadog's default rulesets and do not apply to custom rules.
153153

154+
### Agentic false positive filtering
155+
156+
Bits AI uses an agentic approach to gather repository context before classifying findings for injection-related SAST rules (for example, SQL injection and command injection). Support for additional rule categories is being rolled out over time.
157+
158+
Bits AI can read related files and search for symbols and patterns. It can also inspect nearby directory structure to verify definitions, call paths, sanitizers, and framework wiring that are not visible in a single file.
159+
160+
The additional repository context helps Bits AI distinguish true positives from false positives for findings that depend on cross-file behavior. Agentic false positive filtering applies only to SAST findings.
161+
154162
## Remediation
155163

156164
Datadog SAST uses [Bits Code][10] to generate code fixes for vulnerabilities. You can also create an [automation][13] to automatically generate fixes for vulnerabilities as they are found or on a schedule.

0 commit comments

Comments
 (0)