# Datadog Cloud SIEM MCP for AI Agents AI Agent Connect

> Datadog Cloud SIEM lets you manage cloud security directly from your AI agent. You can search for security signals, triage active alerts, audit detection rules, and hunt for threats in raw logs without switching tabs. It connects your Datadog security module to your workflow so you can handle incident response and rule orchestration through natural conversation.

## Overview
- **Category:** fort-knox
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_ovIPwgyUhVJJzxEVUJaVUxAH4E83Ffjb7HsAdaJt/ai-agent-connect
- **Tags:** cloud-siem, threat-detection, security-signals, vulnerability-scanning, incident-response, mitre-att-ck

## Description

Managing cloud security usually means jumping between different dashboards and hunting through endless logs to find a single malicious IP. This Connector changes that by putting your Datadog security module right inside your AI client. Instead of manually filtering signals or hunting for AWS CloudTrail deviations, you can just ask your agent to find what happened. You'll get a clear view of critical threats, see the exact logic behind your existing rules, and even create new detection rules using plain language. It handles the heavy lifting of navigating the Datadog interface so you can focus on actually stopping threats. Because Vinkius hosts this in its catalog, you can get it running in minutes alongside your other tools. It's about moving from clicking buttons to making decisions based on the data your agent pulls for you. You can verify your exclusion policies or jump into raw log context to see exactly what an attacker did, all without leaving your chat window. This turns your AI into a dedicated security operations teammate that knows your Datadog environment inside and out.

## Tools

### create_detection_rule
Create a new Cloud SIEM Log Detection Rule with Lucene queries and severity levels. It auto-activates upon creation.

### security_system_ping
Check if your API authentication with the Security Module is working correctly. Use this to verify your connection.

### delete_detection_rule
Permanently delete a custom JSON rule you created in Datadog. This does not work for pre-packaged Datadog rules.

### get_raw_log_context
Extract the last 100 messages from a specific log bound. Use this to get deep context after finding an attacker.

### get_detection_rule
Retrieve the exact logic, severity, and notification hooks for a specific rule. See how your alerts are routed.

### list_security_filters
List the global exclusion policies that block logs from reaching the SIEM. Use this to audit your compute budgets.

### list_detection_rules
List all active rules identifying AWS, GCP, and Kubernetes deviations. Verify your proactive detections instantly.

### search_raw_logs
Query raw Datadog logs over the last 15 minutes. This is essential for rapid threat hunting and finding VPC flow logs.

### search_signals
Filter high-severity indicators over the last 24 hours using Lucene queries. Find threats mapping to MITRE ATT&CK.

### triage_signal
Change the state of a signal to open or archived. You must provide a reason like false_positive when archiving.

## Prompt Examples

**Prompt:** 
```
List all critical security signals from the last 24h
```

**Response:** 
```
I found 3 critical signals from the last 24 hours:

| Signal ID | Type | Severity | Environment |
| :--- | :--- | :--- | :--- |
| `sig_992` | Brute Force Attempt | Critical | Production |
| `sig_881` | Unauthorized S3 Access | Critical | Staging |
| `sig_774` | Root Escalation | High | Kubernetes |

Would you like me to triage any of these for you?
```

**Prompt:** 
```
Search logs for IP '1.2.3.4' to hunt for threats
```

**Response:** 
```
Searching Datadog logs for `1.2.3.4`... 

I found 15 related events in the last 15 minutes. The IP is attempting to access `/admin/login` with multiple incorrect passwords. 

**Summary of activity:**
* **Source IP:** 1.2.3.4
* **Target:** api-server
* **Status:** 401 Unauthorized

I can provide the full contextual logs if you'd like to see the exact headers.
```

**Prompt:** 
```
Archive security signal 'sig_123' as a false positive
```

**Response:** 
```
Signal `sig_123` has been archived!

* **Status:** Archived
* **Reason:** false_positive

This action has been logged in your Datadog security timeline for auditing purposes.
```

## Capabilities

### Search security signals
Find critical threats detected by Datadog SIEM and CSPM that match specific MITRE ATT&CK vectors.

### Triage active alerts
Update the state of threat signals from open to archived with official justifications.

### Create detection rules
Build new Cloud SIEM Log Detection rules using raw fields and Lucene query bindings.

### Hunt raw logs
Query raw Datadog logs to capture localized context like malicious source IPs.

### Audit security filters
Retrieve global exclusion policies to see which low-value vectors are being blocked.

### Retrieve rule logic
Get the exact queries, severity levels, and notification hooks for any specific detection rule.

## Use Cases

### Triage a false positive alert
An analyst identifies a 'Brute Force' alert as a known test and uses `triage_signal` to archive it with the reason 'testing_or_maintenance'.

### Hunt for a malicious IP
An incident responder asks the agent to search logs for a specific IP and then uses `get_raw_log_context` to see the last 100 events.

### Deploy a new AWS detection rule
A security engineer describes a new CloudTrail deviation and uses `create_detection_rule` to push the Lucene query and severity levels.

### Audit security exclusion policies
A compliance officer uses `list_security_filters` to verify that no critical log pipelines are being blocked to save on costs.

## Benefits

- Speed up incident response by using `search_signals` to find critical threats matching MITRE ATT&CK vectors instantly.
- Reduce alert fatigue by using `triage_signal` to archive false positives with a logged justification in one step.
- Deploy security logic faster by using `create_detection_rule` to push raw fields and Lucene queries via natural language.
- Get deeper visibility during breaches by using `search_raw_logs` to pull VPC Flow Logs and stack traces in seconds.
- Maintain cleaner environments by using `list_security_filters` to audit which low-value vectors are being blocked.
- Audit your security posture by using `get_detection_rule` to see the exact logic and PagerDuty hooks for every rule.

## How It Works

The bottom line is you get a conversational interface for your entire Datadog security stack.

1. Subscribe to this Connector on the Vinkius Marketplace.
2. Enter your Datadog API Key and APP Key in your AI client settings.
3. Ask your agent to search for signals, triage alerts, or create new detection rules.

## Frequently Asked Questions

**Can I use Datadog Cloud SIEM to find malicious IPs?**
Yes, you can use this Connector to query raw logs for specific IP addresses to see exactly what they did in your environment during a hunt.

**How do I triage alerts with Datadog Cloud SIEM?**
You just tell your agent which signal to archive or open, and it updates the status in Datadog for you automatically.

**Can this Connector help me manage AWS CloudTrail deviations?**
Yes, it lets you list and retrieve the logic for rules that identify those specific deviations across your AWS environment.

**Does Datadog Cloud SIEM support creating new rules?**
You can create new Cloud SIEM Log Detection rules by describing the fields and queries you need in plain language.

**Can I audit my security filters?**
Use this Connector to list your global exclusion policies and see which log vectors are being blocked to preserve your compute budgets.

**Is this Connector good for incident response?**
It's built for it, allowing you to hunt raw logs and triage signals quickly during an active breach without leaving your chat client.

**Can my agent help me triage security alerts in Datadog?**
Yes. Use the 'triage_signal' tool. You can update active threats from 'open' to 'archived', providing a required justification like 'false_positive'. The agent will push the status update directly to the Datadog SIEM platform.

**How do I search for malicious activities matching specific IP addresses?**
Use the 'get_raw_log_context' tool. Provide the suspicious IP address, and the agent will perform a threat-hunting search with a 10s lookbehind to capture highly localized context matching that source, helping you verify attacker footprints.

**Can I see all active security detection rules through the agent?**
Absolutely. The 'list_detection_rules' tool returns all custom and prepackaged Datadog Cloud SIEM rules. Your agent can then inspect specific rule schemas to verify evaluation windows, trigger cases, and notification hooks.