MCP For Claude Marketplace
Datadog Cloud SIEM

Datadog Cloud SIEM MCP Connector for Claude

A+

Manage cloud security via Datadog — search security signals, triage alerts, and audit detection rules directly from any AI agent.

10 tools Official Updated Jun 28, 2026 Official Vinkius Partner
More Details Connect to Claude

Connect your Datadog security module to any AI agent and take full control of your Cloud SIEM and threat hunting workflows through natural conversation.

What you can do

  • Security Signal Search — Execute ingestion searches returning critical threats detected by Datadog SIEM, CSPM, and CWS matching MITRE ATT&CK vectors
  • Signal Triaging — Update the state of active threat alerts, transitioning signals from open to archived with audited false-positive justifications
  • Detection Rule Management — List and retrieve exact logic for security rules identifying AWS CloudTrail deviations or Kubernetes root escalations
  • Rule Orchestration — Construct new Cloud SIEM Log Detection rules by pushing raw name/message fields and specific Lucene query bindings
  • Threat Hunting — Directly query raw Datadog logs with a 10s lookbehind to capture highly localized context matching malicious source IPs
  • Security Filter Auditing — Retrieve global exclusion policies mapping to SIEM log pipelines to verify which low-value vectors are blocked

How it works

  1. Subscribe to this server
  2. Enter your Datadog API Key and APP Key
  3. Start managing your cloud security from Claude, Cursor, or any MCP-compatible client

Who is this for?

  • Security Analysts & SOC — search for security signals and triage active threats in real-time
  • Incident Responders — hunt for threats using raw log context and malicous IP tracking
  • Security Engineers — manage and deploy new detection rules using natural language
  • Compliance Officers — audit security filters and detection rule configurations across environments
cloud-siemthreat-detectionsecurity-signalsvulnerability-scanningincident-responsemitre-att-ck

10 tools expose this connector's capabilities to your AI agent.

create_detection_rule

Accepts raw name/message fields, specific Lucene query bindings filtering for malicious activity, and severity levels (info, low, medium, high, critical). Auto-activates upon creation. Construct a new Cloud SIEM Log Detection Rule

security_system_ping

Test API authentication validity against the Security Module

delete_detection_rule

Irreversible action. Pre-packaged rules provided by Datadog typically cannot be outright deleted (only disabled), making this primarily for user-created custom JSON rules. Permanently delete a Datadog Security Detection Rule

get_raw_log_context

Use this immediately after verifying an attacker footprint. Additional threat hunt tool extracting exact log bounds (100 msgs)

get_detection_rule

g. > 5 occurrences in 5 mins), severity bindings, tagging matrices, and Notification routing hooks tying into PagerDuty or Slack. Retrieve the exact logic/queries for a specific Detection Rule

list_security_filters

These filters inherently block high-volume, low-value logging vectors from ever reaching the SIEM evaluation engine in order to preserve compute budgets. List Security Filter configurations

list_detection_rules

Verifies the existence of proactive detections identifying AWS CloudTrail deviations, GCP anomalous IAM usage, and Kubernetes root escalations. List configured Datadog Security Detection Rules

search_raw_logs

Essential for rapid Threat Hunting before detection rules alert. Useful for extracting contextual VPC Flow Logs or application stack traces related to an active breach. Directly query raw Datadog Logs over the past 15/m for Threat Hunting

search_signals

Use lucene-based queries like "status:critical OR @usr.id:admin" to filter high severity indicators mapping to MITRE ATT&CK vectors. Search Cloud SIEM Security Signals (Alerts) over the last 24h

triage_signal

Transition signals directly from "open" to "archived", or from "archived" back to "open". If archiving, an official reason (e.g. "false_positive" or "testing_or_maintenance") must be assigned. Modify the state of a Datadog SIEM Security Signal

See how to talk to your AI agent using Datadog Cloud SIEM.

List all critical security signals from the last 24h

I found 3 critical signals. Highlights include 'Brute Force Attempt' on 'api-server' and 'Unauthorized S3 Bucket Access' in 'production-env'. Would you like to triage any of these?

Search logs for IP '1.2.3.4' to hunt for threats

Searching Datadog logs for '1.2.3.4'... I found 15 related events in the last 15 minutes. The IP is attempting to access '/admin/login' with multiple incorrect passwords. I can provide the full contextual logs.

Archive security signal 'sig_123' as a false positive

Signal 'sig_123' has been archived! State updated to 'archived' with reason: 'false_positive'. This action is logged in your Datadog security timeline.

Yes. Use the 'triage_signal' tool. You can update active threats from 'open' to 'archived', providing a required justification like 'false_positive'. The agent will push the status update directly to the Datadog SIEM platform.

Related Connectors

SC

Snapchat Conversions MCP

12 tools Official

Send conversion events to Snapchat Ads via the Conversions API with AI agents.

A+ View details →
PD

Paleobiology Database MCP

27 tools Official

Access the world's largest fossil database — query occurrences, analyze taxonomic diversity, and explore geological intervals directly from your AI agent.

F View details →
OY

Oyster MCP

15 tools Official

Manage global HR, payroll, and compliance via Oyster — list engagements, track expenses, and manage time-off requests directly from any AI agent.

A+ View details →
TA

TaxJar MCP

12 tools Official

Calculate, collect, and remit sales tax automatically across every US state and jurisdiction with real-time rate accuracy.

A+ View details →