Datadog Cloud SIEM MCP Server

Accepts raw name/message fields, specific Lucene query bindings filtering for malicious activity, and severity levels (info, low, medium, high, critical). Auto-activates upon creation. Construct a new Cloud SIEM Log Detection Rule

Irreversible action. Pre-packaged rules provided by Datadog typically cannot be outright deleted (only disabled), making this primarily for user-created custom JSON rules. Permanently delete a Datadog Security Detection Rule

g. > 5 occurrences in 5 mins), severity bindings, tagging matrices, and Notification routing hooks tying into PagerDuty or Slack. Retrieve the exact logic/queries for a specific Detection Rule

Use this immediately after verifying an attacker footprint. Additional threat hunt tool extracting exact log bounds (100 msgs)

Verifies the existence of proactive detections identifying AWS CloudTrail deviations, GCP anomalous IAM usage, and Kubernetes root escalations. List configured Datadog Security Detection Rules

These filters inherently block high-volume, low-value logging vectors from ever reaching the SIEM evaluation engine in order to preserve compute budgets. List Security Filter configurations

Essential for rapid Threat Hunting before detection rules alert. Useful for extracting contextual VPC Flow Logs or application stack traces related to an active breach. Directly query raw Datadog Logs over the past 15/m for Threat Hunting

Use lucene-based queries like "status:critical OR @usr.id:admin" to filter high severity indicators mapping to MITRE ATT&CK vectors. Search Cloud SIEM Security Signals (Alerts) over the last 24h

Test API authentication validity against the Security Module

Transition signals directly from "open" to "archived", or from "archived" back to "open". If archiving, an official reason (e.g. "false_positive" or "testing_or_maintenance") must be assigned. Modify the state of a Datadog SIEM Security Signal