# cloud siem Published articles for cloud siem. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Centralize human and agentic work with Datadog Work Management DevFeed: [Centralize human and agentic work with Datadog Work Management]() Original publisher: [Read original article]() Author: Roxanne Moslehi Published: 2026-08-18T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [AI Agent](), [incident](), [site-reliability-engineering](), [Slack](), [SRE](), [SIEM, Security](), [GitHub](), [error tracking](), [dashboards](), [Traces]() Tags: [agentic](), [ai](), [ai-agent](), [cloud-siem](), [dashboards](), [devops](), [devsecops](), [error-tracking](), [github](), [incident](), [management](), [slack](), [sre](), [traces](), [work-management](), [workflow-automation]() ### AI overview Datadog Work Management centralizes work created by people, automations, and Datadog AI agents. It preserves context from logs, traces, monitors, alerts, ownership, assignments, approvals, artifacts, and activity while integrating with Datadog and external collaboration systems. ### Source excerpt Learn how Datadog Work Management helps you coordinate human and AI agent-driven work while preserving context, ownership, and activity across tools. ## How to manage risk from unfixed Kubernetes CVEs DevFeed: [How to manage risk from unfixed Kubernetes CVEs]() Original publisher: [Read original article]() Author: Mallory Mooney Published: 2026-08-10T00:00:00Z Content type: tutorial Language: en Sources: [Datadog | The Monitor blog]() Topics: [vulnerability](), [telemetry](), [Amazon Elastic Kubernetes Service]() Tags: [cloud-siem](), [how-to](), [kubernetes](), [logs](), [security](), [threat-detection](), [vulnerability]() ### AI overview The article explains how to assess exposure to four unfixed Kubernetes CVEs and use audit-log detection queries to investigate relevant activity. ### Source excerpt Learn how to confirm whether your cluster is exposed to unfixed Kubernetes CVEs and build detection queries using Kubernetes audit logs. ## Investigate every security event with an AI agent, without the frontier bill DevFeed: [Investigate every security event with an AI agent, without the frontier bill]() Original publisher: [Read original article]() Author: Nicolas Grislain Published: 2026-07-28T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [AI Bots]() Tags: [ai](), [ai-agent](), [ai-research](), [ai-security](), [bits-ai](), [cloud-siem](), [llm](), [logs](), [security]() ### AI overview Datadog describes a two-stage security detection pipeline in which Mambark scores audit-log events and routes only the most suspicious ones to an AI agent for deeper investigation. ### Source excerpt Learn how Datadog built Mambark, a small state-space model that scores every security event and enables heavier AI agents to investigate only the events that matter. ## Entra Agent ID: Protect, detect, respond DevFeed: [Entra Agent ID: Protect, detect, respond]() Original publisher: [Read original article]() Author: Katie Knowles Published: 2026-07-06T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [Entra ID](), [Security](), [Authorization](), [SIEM, Security]() Tags: [agent](), [agents](), [cloud-siem](), [entra-id](), [identity](), [secrets](), [security]() ### AI overview This concluding article in the Agent ID series explains how administrators and security teams can protect Entra agent blueprints and identities, detect suspicious activity, and respond to compromises. It recommends limiting privileged roles and permissions, reducing reliance on secrets, reviewing third-party blueprints, monitoring agent activity, and disabling or deleting compromised identities or blueprints. ### Source excerpt This post continues and concludes our series on Agent ID, by outlining steps that an administrator or security team can take to secure blueprints and agent identities created in their local Entra ID tenant. ## Preparing for OMB M-26-14: How Datadog supports federal logging maturity DevFeed: [Preparing for OMB M-26-14: How Datadog supports federal logging maturity]() Original publisher: [Read original article]() Author: Chris Leffler; Sophie Wang Published: 2026-06-29T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [SIEM, Security, Observability](), [log management](), [Monitoring](), [threat detection](), [incident](), [Incident response](), [observability](), [Security](), [Security Operations Center](), [Resilience](), [Cybersecurity]() Tags: [bits-ai](), [cloud-siem](), [compliance](), [cybersecurity](), [fedramp](), [govcloud](), [incident-response](), [log-management](), [logging](), [monitoring](), [observability](), [resilience](), [security](), [security-operations-center](), [soc](), [systems](), [telemetry](), [threat-detection](), [workflow-automation]() ### AI overview This article explains how OMB Memorandum M-26-14 changes federal logging guidance from prescriptive requirements to a risk- and maturity-based model. It describes continuous event monitoring and threat hunting, investigation, response, and forensics, including centralized security telemetry, visibility across IT, OT, and IoT environments, threat detection, searchable and retrievable logs, cross-source correlation, incident response, and forensic analysis. It also presents Datadog as a unified observability and security platform for helping agencies meet these requirements. ### Source excerpt Learn how Datadog helps federal agencies prepare for OMB M-26-14 by providing centralized telemetry data, threat detection, and automated incident response. ## Automatically enrich security logs with MITRE ATT&CK context before they reach your SIEM DevFeed: [Automatically enrich security logs with MITRE ATT&CK context before they reach your SIEM]() Original publisher: [Read original article]() Author: Danielle Park Published: 2026-06-24T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [observability pipelines](), [SIEM, Security](), [SIEM, Security, Observability](), [log management](), [Incident response](), [Threat Hunting & Intel](), [Firewall](), [MFA](), [Amazon Web Services](), [DDoS]() Tags: [api](), [aws](), [cloud-siem](), [devsecops](), [firewall](), [incident](), [incident-response](), [log-management](), [logs](), [malware](), [mfa](), [network](), [observability](), [observability-pipelines](), [security](), [techniques](), [threat-detection]() ### AI overview This article explains how Observability Pipelines uses MITRE ATT&CK Enrichment Packs to automatically map security logs and events to common attacker tactics and techniques before they reach a SIEM, data lake, or archive. It describes the initial packs for Okta, Palo Alto, FortiGate, and AWS WAF, covering identity, firewall, network, and web security activity. ### Source excerpt Learn how Observability Pipelines enriches security logs with MITRE ATT&CK tactics and techniques before routing them to your SIEM or storage destination. ## Detecting the Klue supply chain attack in Salesforce instances DevFeed: [Detecting the Klue supply chain attack in Salesforce instances]() Original publisher: [Read original article]() Author: Julie Agnes Sparks Published: 2026-06-22T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [SIEM, Security](), [REST API](), [OAuth](), [API](), [incident](), [Python](), [data](), [Back end](), [Network]() Tags: [api](), [backend](), [cloud-siem](), [data](), [external](), [incident](), [infrastructure](), [integration](), [logs](), [oauth](), [python](), [rest-api](), [salesforce](), [supply-chain](), [tokens]() ### AI overview This article summarizes the Klue supply chain attack, in which a threat actor abused a dormant integration credential to obtain OAuth tokens and query connected Salesforce environments through automated Python REST API calls. It reconstructs the attack timeline and provides detection guidance for Salesforce environments monitored by Datadog Cloud SIEM. ### Source excerpt We summarize the Klue supply chain attack and provide detection guidance for Salesforce environments monitored by Datadog Cloud SIEM. ## Automate threat hunting with Datadog Cloud SIEM DevFeed: [Automate threat hunting with Datadog Cloud SIEM]() Original publisher: [Read original article]() Author: Vera Chan; Sean Storer Published: 2026-06-09T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [AI Bots]() Tags: [agent](), [ai](), [attacks](), [autonomous](), [cloud-siem](), [devsecops](), [incident-response](), [logs](), [security](), [telemetry](), [threat-detection]() ### AI overview Datadog introduces Bits Threat Hunting, an autonomous Cloud SIEM agent that performs AI-driven, hypothesis-based searches of telemetry to identify attacker behavior and deviations before alerts fire. ### Source excerpt Learn how Bits Threat Hunting helps security teams proactively identify attacker behavior with AI-driven, hypothesis-based threat hunting. ## DASH 2026 Security & Compliance: Guide to Datadog's newest announcements DevFeed: [DASH 2026 Security & Compliance: Guide to Datadog's newest announcements]() Original publisher: [Read original article]() Author: Datadog Published: 2026-06-09T00:00:00Z Content type: news Language: en Sources: [Datadog | The Monitor blog]() Topics: [Security](), [SIEM, Security, Observability](), [MCP](), [Securing AI](), [MCP Server](), [Artificial Intelligence](), [Routing (disambiguation)](), [Authentication]() Tags: [agents](), [ai](), [ai-agents](), [ai-security](), [announcements](), [api](), [authentication](), [claude](), [claude-code](), [cloud-siem](), [codex](), [compliance](), [cursor](), [dash](), [mcp](), [mcp-server](), [openai](), [security](), [slack](), [sql](), [ticketing]() ### AI overview A roundup of Datadog security and compliance announcements presented at DASH, covering AI-assisted investigation and remediation across code, cloud, APIs, and sensitive data. It highlights expanded SIEM capabilities, the Security MCP toolset for governed AI-agent access, and dynamic routing of security notifications to team channels. ### Source excerpt A roundup of everything we announced at DASH 2025, including Datadog's new API authentication model, Bits AI Threat Hunting for Cloud SIEM, and Bits AI Security Analyst.