• TRIAGE
  • ANALYSIS
  • FILTERING
  • HUMAN

How to investigate security incidents with your AI

Connect DataDome to your agent to pull technical threat data and behavioral patterns directly into your chat.

Ask AI about this page

Short answer

How can I use my AI to investigate security incidents?

Your agent uses DataDome to pull technical threat details and behavioral patterns for specific attacks. You'll get a clear breakdown of what happened and how the attacker behaved.

Investigation outcomes.

Where your data goes.

The AI handles the heavy lifting of data retrieval so you can focus on the response.

TRIAGE

Identify active threats

The AI scans recent activity to find ongoing attacks. You get a list of what's hitting your site right now.

ANALYSIS

Deep dive into patterns

Your agent pulls technical details and behavioral signatures. This helps you understand the specific mechanics of an attack.

FILTERING

Isolate specific attacks

The AI searches for specific threat types. You can quickly narrow your view to things like bot attacks or credential stuffing.

HUMAN

Decide on mitigation

The AI provides the technical context, but you make the final call. You decide which rules to apply to stop the threat.

The workflow

What your AI does when an incident occurs.

The agent acts as your first responder by querying DataDome for technical context.

  1. Scan recent activity

    The agent checks for the most recent security events to see if an attack is currently underway.

    list_recent_threats

  2. Filter by attack type

    If you're looking for a specific kind of threat, the agent narrows the search to that category.

    search_threats_by_type

  3. Extract technical details

    Once a threat is identified, the agent pulls the specific behavioral patterns and technical data for that event.

    get_threat_details

  4. Summarize findings

    The agent organizes the raw threat data into a readable report for your review.

    get_threat_details

Try it

Copy these to start.

Use these prompts to kick off an investigation.

Starting points

These are opening lines. Swap the bracketed text with your specific threat types or incident IDs.

DataDome Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_U4skwDhrbhMsnRWc1cemnUh4vfFrt24xjV6GWRkV/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — DataDome capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "datadome-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_U4skwDhrbhMsnRWc1cemnUh4vfFrt24xjV6GWRkV/mcp"
    }
  }
}
Copy into chat04

  • Show me the most recent threats from DataDome.

  • Find all recent bot attacks in the system.

  • Get the technical details for threat ID 98765.

  • What are the behavioral patterns for the latest credential stuffing attempt?

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect DataDome once, then ask.

Link your account once. Your credentials stay encrypted, and you can immediately start querying DataDome from your preferred AI client.

Connect DataDome to your AI

FAQ

How this task behaves

  • 01

    Can the AI block attacks automatically?

    No. The AI only pulls data and technical details. You must manually execute any blocking or mitigation actions in your security platform.

  • 02

    Can the AI delete threat logs?

    No. The tools only allow the AI to read and search threat data. It cannot modify or delete any records in DataDome.

  • 03

    How does the AI find specific types of attacks?

    It uses the search tool to filter the threat list by the specific category you ask for, like bot attacks or scraping.

  • 04

    Does the AI see all my security data?

    The AI only sees the data it retrieves through the specific DataDome tools provided in the connector.

  • 05

    Can I use this with Claude or Cursor?

    Yes. Any MCP-compatible client like Claude, Cursor, or Windsurf can use this connector once it's connected via Vinkius.

  • More questions about DataDome? The Connector page answers them. See everything the DataDome Connector can do

Connect DataDome to Claude, Cursor, ChatGPT & more