# How we brought agentic workflows to Cloud SIEM with the Datadog MCP Server

DevFeed: [How we brought agentic workflows to Cloud SIEM with the Datadog MCP Server](<https://devfeed.tech/articles/how-we-brought-agentic-workflows-to-cloud-siem-with-the-datadog-mcp-server-2245.md>)

Original publisher: [Read original article](<https://www.datadoghq.com/blog/creating-mcp-tools-for-cloud-siem/>)

Author: Chelsea Xu; Eddie Cai; Romain Kirszbaum; Mohamed Hachem Ouertani

Published: 2026-07-17T00:00:00Z

Content type: article

Language: en

Sources: [Datadog | The Monitor blog](<https://devfeed.tech/sources/datadog-the-monitor-blog.md>)

Topics: [SIEM, Security](<https://devfeed.tech/topics/siem-security.md>), [MCP Server](<https://devfeed.tech/topics/mcp-server.md>), [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>), [Security & compliance, Cloud security](<https://devfeed.tech/topics/security-compliance-cloud-security.md>), [real user monitoring](<https://devfeed.tech/topics/real-user-monitoring.md>)

Tags: [agent-observability](<https://devfeed.tech/tags/agent-observability.md>), [agentic](<https://devfeed.tech/tags/agentic.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-impact](<https://devfeed.tech/tags/ai-impact.md>), [cloud-security](<https://devfeed.tech/tags/cloud-security.md>), [context-window](<https://devfeed.tech/tags/context-window.md>), [eval](<https://devfeed.tech/tags/eval.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [mcp-server](<https://devfeed.tech/tags/mcp-server.md>), [real-user-monitoring](<https://devfeed.tech/tags/real-user-monitoring.md>), [security](<https://devfeed.tech/tags/security.md>), [tool](<https://devfeed.tech/tags/tool.md>), [workflows](<https://devfeed.tech/tags/workflows.md>)

## AI overview

This article explains how Datadog built MCP tools for Cloud SIEM to support agentic security workflows. It covers tool scoping based on user behavior, progressive disclosure for managing a shared context window, custom evaluation of non-deterministic agent behavior, and governance of a growing multi-team toolset.

## Source excerpt

See how we built MCP tools for Cloud SIEM, using usage data, progressive disclosure, and a custom eval framework to keep a multi-team agentic toolset reliable.