cyber.hendryadrian.com
Detection & Defense · socprime.com

How to Export Datadog Cloud SIEM Logs for Investigation

· Original article ↗

Summary

A guide to exporting Datadog logs for Cloud SIEM investigations using the Logs Search API, cursor-based pagination, or cloud-storage archives, with notes on access, retention, rate limits, and separate security-signal APIs.

Key points

  • Cloud SIEM logs are exported from Datadog Log Management using the Logs Search API; security signals use a separate API.
  • API requests require an API key and an application key with log-read access, and must use the API host for the correct Datadog site.
  • Search results are limited to 1,000 logs per page; follow the returned cursor to retrieve additional results.
  • Logs older than index retention may be available in configured S3, GCS, or Azure Storage archives, or through rehydration.
  • The guide recommends backing off after HTTP 429 responses and links common 403, wrong-site, retention, and pagination issues to fixes.
  • It describes uploading exported logs to LogTotal for sanitization and review.

Article Details

Defense Focus
Export and review Datadog Cloud SIEM logs for investigations, including indexed logs and older archived logs.
Detection Methods
  • Search logs using host, source, and time-range filters, then review the returned log messages.
  • Follow the pagination cursor until no next page remains to retrieve all matching results.
Data Sources
  • Datadog Log Management indexed logs
  • Datadog log archives stored in S3, GCS, or Azure Storage
  • Security signals through the separate Security Monitoring API
Rule Types
  • Datadog Logs Search API filter queries using host, source, and time-range criteria
Defensive Actions
  • Use an API key and an application key belonging to a user or service account with log-read access.
  • Use the API host corresponding to the Datadog site in use.
  • For older data, retrieve configured log archives or rehydrate logs when available.
  • When rate limited, wait and continue pagination with the same cursor.
  • Export the logs behind security signals when investigating them in LogTotal.

Vendors

DatadogCloud SIEM runs on top of Datadog Log Management, so exporting “Cloud SIEM logs” means exporting the logs behind it.

Products

Datadog Log ManagementCloud SIEM runs on top of Datadog Log Management, so exporting “Cloud SIEM logs” means exporting the logs behind it.LogTotalBelow is how to get logs out, sanitize them, and investigate them for free in LogTotal.

Related Articles