How we brought agentic workflows to Cloud SIEM with the Datadog MCP Server

Datadog engineers have developed a specialized set of security tools for the Model Context Protocol (MCP) Server to help AI agents assist with complex Cloud SIEM tasks, such as signal investigation and detection rule authoring. To prevent overwhelming the agent's limited context window, they implemented "progressive disclosure" for schemas and redesigned bulk triage tools to use search queries instead of long lists of individual IDs. These optimizations significantly reduce token usage and latency while allowing the security toolset to scale across various products.