• FALSE POSITIVE
  • TRUE POSITIVE
  • NEEDS HUMAN
  • NOISE

How to triage security signals with your AI

Connect Datadog Cloud SIEM to your agent. From there, your agent handles the repetitive work of scanning alerts and clearing out noise.

Ask AI about this page

Short answer

How do I triage security signals with my AI?

Your agent pulls recent alerts from Datadog Cloud SIEM and evaluates them against your security context. It then archives false positives by adding a written justification for why the signal was dismissed. You get a cleaner alert queue and a clear audit trail.

Signal outcomes

Where every signal lands.

The agent sorts your incoming data into these specific outcomes.

FALSE POSITIVE

Archived with reason

The agent identifies noise and archives it. You get a documented justification for why the signal was dismissed.

TRUE POSITIVE

Ready for review

Real threats are identified and kept active. Your agent highlights the specific signal details that require your attention.

NEEDS HUMAN

Escalated for action

Ambiguous signals that don't fit a clear pattern are flagged for you. The agent provides the context so you don't start from scratch.

NOISE

Filtered out

Low-priority or repetitive events are identified. The agent keeps these out of your primary view.

The workflow

What your AI does when a signal arrives.

The agent acts as a first responder to filter your Datadog Cloud SIEM feed.

  1. Fetch recent alerts

    The agent pulls the latest security events from your Datadog environment to begin the review process.

    search_signals

  2. Analyze signal context

    The agent looks at the metadata and patterns within each signal to determine if it's a legitimate threat.

    search_signals

  3. Dismiss false positives

    When a signal is clearly benign, the agent marks it as a false positive and adds a written explanation.

    triage_signal

  4. Finalize triage

    The agent completes the triage process, ensuring the signal status is updated in Datadog.

    triage_signal

Try it

Copy these to start.

Use these prompts to kick off the triage process.

Starting points

These are starting points. You should swap out the specific signal names or timeframes to match your current needs.

Datadog Security Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_ovIPwgyUhVJJzxEVUJaVUxAH4E83Ffjb7HsAdaJt/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Datadog Security capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "datadog-cloud-siem-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_ovIPwgyUhVJJzxEVUJaVUxAH4E83Ffjb7HsAdaJt/mcp"
    }
  }
}
Copy into chat04

  • Search for all security signals in Datadog from the last 24 hours.

  • Review the most recent signal from the production cluster and triage it.

  • Find all false positives from the last hour and archive them with a reason.

  • Triage the signal with ID 'sig-12345' and tell me why it's a false positive.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Datadog Cloud SIEM once, then ask.

You only need to link your account once. Your credentials stay encrypted, and you can immediately start asking your agent to handle your Datadog signals.

Connect Datadog Cloud SIEM to your AI

FAQ

How the triage task behaves

  • 01

    Can the AI delete signals from Datadog?

    No. The agent can only triage and archive signals using the provided tools.

  • 02

    Does the AI make final decisions on critical threats?

    No. While the agent can archive false positives, you should always review high-severity signals that it flags for human intervention.

  • 03

    Can I see the justification the AI wrote for an archived signal?

    Yes. The agent includes a documented justification whenever it uses the triage tool to archive a false positive.

  • 04

    Will the AI change my Datadog configuration?

    No. The agent only interacts with security signals through the specific tools provided in the manifest.

  • 05

    How does the agent know what a false positive is?

    The agent evaluates the signal data against the context you provide in your prompt or through its general reasoning.

  • More questions about Datadog Cloud SIEM? See everything the Datadog Cloud SIEM Connector can do

Connect Datadog Security to Claude, Cursor, ChatGPT & more