How to Use the Datadog Cloud SIEM MCP in Windsurf

Q: How do I filter out noise in Datadog Cloud SIEM using Windsurf?

Run listsecurityfilters to see which data points are currently being ignored. This helps you identify if high-volume logs are being suppressed by your existing configuration.

Q: Does Windsurf support bulk rule deletion for Datadog Cloud SIEM?

You can remove custom rules using deletedetectionrule. Note that this is permanent and cannot be undone for pre-packaged Datadog rules.

Manage your security posture directly inside Windsurf by searching signals and auditing rules without leaving your editor.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Datadog Cloud SIEM MCP to Windsurf

Create your Vinkius account to connect Datadog Cloud SIEM to Windsurf and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Datadog Cloud SIEM with Windsurf

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Automate Datadog Cloud SIEM rule creation in Windsurf

Cascade handles the heavy lifting when you need to define new detection logic. You just provide the query parameters, and it uses `create_detection_rule` to push those definitions into your security stack immediately. Stop switching tabs to configure alerts. The agent takes your intent and executes the full setup sequence, ensuring your custom Lucene queries are active the second they hit the API.

Windsurf threat hunting with raw log access

Dig into your infrastructure logs to find the source of an incident. By invoking `search_raw_logs`, the agent pulls specific VPC Flow Logs or application traces directly into your current context window. Use `get_raw_log_context` once you spot a suspicious footprint. This lets you pivot from a broad search to a surgical extraction of the exact data you need to prove a breach.

Triage security signals via Windsurf

Keep your dashboard clean by managing alerts without manual clicks. Use `triage_signal` to transition critical items to archived states when your investigation confirms a false positive. Keep track of your security hygiene by running `list_detection_rules` periodically. You get a clear view of your active defenses, allowing you to catch misconfigurations before they impact your production environment.

Setup guide

Set up Datadog Cloud SIEM MCP in Windsurf

Prerequisites

Windsurf IDE installed (macOS, Windows, or Linux)
Active Vinkius subscription with a valid endpoint token

1

Open MCP configuration

Click the Cascade assistant icon in the sidebar, then click the hammer icon (🔨) at the top of the panel. Select "Configure" to open ~/.codeium/windsurf/mcp_config.json.
2

Add the Datadog Cloud SIEM MCP

Paste the JSON snippet shown on the right into the mcpServers object. Replace [YOUR_TOKEN_HERE] with your endpoint token from cloud.vinkius.com.
3

Refresh MCPs

Go back to the hammer icon (🔨) in Cascade and click "Refresh". Windsurf will detect the new server. No full restart is needed — the connection is hot-reloaded.
4

Verify in Cascade

Start a new Cascade conversation and ask something like "Show my Datadog Cloud SIEM payment history." If connected, Cascade will call the Datadog Cloud SIEM tools directly. You will see a green dot next to the server name in the MCP panel.

mcp_config.json

{
  "mcpServers": {
    "datadog-cloud-siem-mcp": {
      "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    }
  }
}

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Datadog Security. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Datadog Cloud SIEM now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Datadog Cloud SIEM MCP in Windsurf

You trigger a search by asking the agent to look for specific patterns. It uses `search_signals` to query your environment for high-severity indicators over the last 24 hours.

Yes, you can pull the exact query logic for any rule. Just ask the agent to inspect a specific rule, and it uses `get_detection_rule` to show you the configuration.

The server only touches your log metadata and alert definitions. We enforce strict isolation, ensuring that your sensitive security logs never persist outside your session environment.

Run `list_security_filters` to see which data points are currently being ignored. This helps you identify if high-volume logs are being suppressed by your existing configuration.

You can remove custom rules using `delete_detection_rule`. Note that this is permanent and cannot be undone for pre-packaged Datadog rules.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python