How to Use the Datadog Cloud SIEM MCP in Mastra AI

Q: What happens if a security filter blocks too many logs?

Your agent can call listsecurityfilters to audit what is getting blocked. If a high-volume log source is missing, the agent can notify your team to adjust the compute budget settings.

Build automated incident response workflows with Mastra AI and Datadog Cloud SIEM.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Datadog Cloud SIEM MCP to Mastra AI

Create your Vinkius account to connect Datadog Cloud SIEM to Mastra AI and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Datadog Cloud SIEM with Mastra AI

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Automated Incident Triage Workflows

The `triage_signal` tool updates the status of security alerts based on custom logic defined in your Mastra AI workflows. When a high-severity alert fires, your agent evaluates the payload and automatically transitions the state from open to archived if it matches a known testing pattern. If the API call fails due to network issues, Mastra retries the operation using exponential backoff. This ensures your Datadog Cloud SIEM state changes complete even during transient outages.

Branching Threat Hunts via Mastra AI

The `search_signals` tool queries your security alerts from the last 24 hours to find critical patterns like admin account abuse. If the agent finds a matching signal, Mastra's workflow engine branches to run `get_raw_log_context` for deeper inspection. Workflows built this way let you run complex multi-step security playbooks. You can deploy these automated threat-hunting agents to any cloud provider with a single command.

Human-in-the-Loop Rule Deployments

The `create_detection_rule` tool constructs new security rules using Lucene queries to catch cloud infrastructure deviations. Mastra AI intercepts this action using its built-in tool approval guardrails, forcing a human operator to sign off before the rule goes live. Once approved, the agent activates the rule and uses `security_system_ping` to confirm the Datadog API connection is healthy. Running this MCP tool keeps your production environment safe from accidental rule deployments.

Setup guide

Set up Datadog Cloud SIEM MCP in Mastra AI

Prerequisites

Node.js 18+ and a TypeScript project
@mastra/mcp + @mastra/core packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run npm install @mastra/mcp @mastra/core plus your preferred model provider (e.g. @ai-sdk/openai).
2

Configure the MCPClient
Create an MCPClient with your Vinkius endpoint as a URL object. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com.
3

Discover and inject tools
Call mcpClient.listTools() and spread the result into your agent's tools object. All Datadog Cloud SIEM tools become native Mastra tools.
4

Run with any model
Swap openai("gpt-4o") for any AI SDK-compatible provider. Call agent.generate() and the agent routes tool calls through MCP automatically.

agent.ts

import { MCPClient } from "@mastra/mcp";
import { Agent } from "@mastra/core/agent";
import { openai } from "@ai-sdk/openai";

const mcpClient = new MCPClient({
  id: "datadog-cloud-siem-mcp-client",
  servers: {
    "datadog-cloud-siem-mcp": {
      url: new URL(
        "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
      ),
    },
  },
});

const agent = new Agent({
  name: "Datadog Cloud SIEM Agent",
  model: openai("gpt-4o"),
  instructions: "You have access to Datadog Cloud SIEM tools.",
  tools: {
    ...(await mcpClient.listTools()),
  },
});

const result = await agent.generate(
  "List recent Datadog Cloud SIEM transactions"
);
console.log(result.text);

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Datadog Security. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Datadog Cloud SIEM now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Datadog Cloud SIEM MCP in Mastra AI

Mastra AI uses its built-in workflow engine to handle retries. If search_raw_logs hits Datadog rate limits, the framework pauses and retries the query automatically without failing your security pipeline.

Yes, you can write workflows that check alert severity using search_signals. If the severity is critical, your Mastra agent can trigger an escalation branch, and if it is low, it calls triage_signal to archive it.

Install the @mastra/mcp package and instantiate MCPClient with the Vinkius server URL. Then, spread the returned tools into your agent configuration to give it full access to your security filters and logs.

Your agent can call list_security_filters to audit what is getting blocked. If a high-volume log source is missing, the agent can notify your team to adjust the compute budget settings.

Yes, Vinkius handles the credentials inside an isolated V8 sandbox. Your Mastra AI code only interacts with the secure MCP endpoint, meaning your raw Datadog API keys are never exposed to your application environment or logs.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript