Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Datadog Security Monitoring (BYOK) — connector documentation

  • MCP endpoint: https://byok-datadog-security.connectorbay.com/mcp
  • REST API: POST https://byok-datadog-security.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-datadog-security.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Datadog Security Monitoring Datadog API key (US1 site, datadoghq.com), sent in the X-Upstream-Key header and the Datadog application key (needs the security_monitoring_rules_read scope) in X-Upstream-Key-2 of every request (never stored, logged or cached)
  • Health: https://byok-datadog-security.connectorbay.com/health · Tool schemas: https://byok-datadog-security.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-datadog-security · agent@connectorbay.com

What Datadog Security Monitoring (BYOK) is for

Datadog Security Monitoring (BYOK) lets an AI assistant read your own Datadog Security Monitoring data through the Datadog Security Monitoring API with a key you supply (Datadog API key (US1 site, datadoghq.com)). Read-only: 7 tools (list_rules, get_rule, list_suppressions, list_security_filters, get_content_pack_states, list_critical_assets, list_signal_notification_rules). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.datadoghq.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Datadog Security Monitoring. Datadog Security Monitoring and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which Datadog security detection rules are enabled for Okta?"
  • "Show the Datadog security rule abc-def-ghi"
  • "Which Datadog security suppressions are active?"
  • "Which Datadog security filters are enabled?"
  • "Which Cloud SIEM content packs are active in Datadog?"
  • "Which assets does Datadog Cloud SIEM treat as critical?"

What it does

  • list_rules: List security detection rules with name, type, enabled and default flags, tags, version and message. Filter with a query on type, source or tags and sort by name, date, severity or type.
  • get_rule: Get one detection rule by id with its message, tags, severity cases (condition, status, notifications) and queries.
  • list_suppressions: List suppression rules that silence matching detection signals: name, queries, enabled flag, start and expiry dates (Unix ms). Creator names are left out.
  • list_security_filters: List Cloud SIEM security filters: name, query, filtered data type, enabled and built-in flags, exclusion filters.
  • get_content_pack_states: Show the activation state of every Cloud SIEM content pack (integration status and log collection status) plus the SIEM retention and SKU.
  • list_critical_assets: List critical assets whose signals get raised severity: query, rule query, severity, tags and enabled flag. Creator names are left out.
  • list_signal_notification_rules: List notification rules for security signals: name, enabled flag, selectors (query, rule types, severities), targets and time aggregation.

BYOK key

You bring your own Datadog Security Monitoring Datadog API key (US1 site, datadoghq.com) (https://app.datadoghq.com/organization-settings/api-keys). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.datadoghq.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Datadog Security Monitoring API (api.datadoghq.com) with a BYOK key; documentation: https://docs.datadoghq.com/api/latest/security-monitoring/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Datadog Security Monitoring. Datadog Security Monitoring and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Datadog Security Monitoring account.

Built for: Worldwide. Languages: English.