• DETECTION
  • CONTEXT
  • ANALYSIS
  • HUMAN

How to hunt for threats in logs with your AI

Connect Datadog Cloud SIEM to your agent to turn raw log data into actionable security context.

Ask AI about this page

Short answer

How can I use my AI to hunt for threats in Datadog logs?

Your AI searches raw logs for specific patterns and pulls the surrounding message context to help you investigate suspicious activity. You'll get a clear view of the events surrounding a potential threat.

Investigation outcomes

Where your investigation leads.

The AI handles the heavy lifting of data retrieval so you can focus on the actual threat.

DETECTION

Identify suspicious patterns

The AI scans through your Datadog logs to find specific indicators of compromise or unusual activity.

CONTEXT

Pull surrounding log data

Once a threat is found, the AI grabs the specific message windows needed to see what happened before and after the event.

ANALYSIS

Build a threat timeline

The AI organizes the retrieved logs into a coherent sequence of events for your review.

HUMAN

Final security decision

You review the compiled context to decide if the activity requires an incident response or if it's a false positive.

The workflow

What your AI does when a threat is suspected.

The AI acts as your primary interface for querying and inspecting Datadog data.

  1. Locate the anomaly

    The AI looks for specific error codes, IP addresses, or user behaviors within your Datadog environment.

    search_raw_logs

  2. Gather surrounding data

    After finding a match, the AI pulls the logs immediately preceding and following the hit to provide context.

    get_raw_log_context

  3. Filter for relevance

    The AI uses your instructions to narrow down the log volume to only the most pertinent security events.

    search_raw_logs

  4. Summarize the event

    The AI presents the findings in a way that highlights the specific malicious actions detected.

    get_raw_log_context

Try it

Copy these to start.

Use these prompts to kick off an investigation.

Starting points

These are starting points. Swap out the specific IP addresses, usernames, or error codes with your actual data.

Datadog Security Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_ovIPwgyUhVJJzxEVUJaVUxAH4E83Ffjb7HsAdaJt/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Datadog Security capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "datadog-cloud-siem-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_ovIPwgyUhVJJzxEVUJaVUxAH4E83Ffjb7HsAdaJt/mcp"
    }
  }
}
Copy into chat04

  • Search Datadog logs for any activity from IP address 192.168.1.45 in the last hour.

  • Find all logs related to failed login attempts for user 'admin_service' from this morning.

  • I see a suspicious request in my logs. Pull the context around the log entry with ID 'abc-123'.

  • Search for all logs containing 'Unauthorized Access' and show me the messages around those events.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Datadog Cloud SIEM once, then ask.

You only need to link your account once. Your credentials stay encrypted, and you can immediately start querying logs through your preferred AI client.

Connect Datadog Cloud SIEM to your AI

FAQ

How the Datadog Cloud SIEM MCP behaves

  • 01

    Can the AI delete logs in Datadog?

    No. The AI only has permission to search and read logs. It cannot modify or delete any data in your Datadog account.

  • 02

    Can the AI create new Datadog monitors?

    No. This MCP is designed for log investigation and retrieval, not for managing Datadog configurations or monitors.

  • 03

    Does the AI see all my Datadog data?

    The AI only accesses the specific log data it needs to answer your specific questions or perform the requested search.

  • 04

    How does the AI get the context around a log?

    It uses the log context tool to pull a specific window of messages surrounding a target log entry.

  • 05

    Can I use this with any AI client?

    Yes, as long as the client supports the Model Context Protocol (MCP).

  • More questions about Datadog Cloud SIEM? The Connector page answers them. See everything the Datadog Cloud SIEM Connector can do

Connect Datadog Security to Claude, Cursor, ChatGPT & more