How to Export Datadog Cloud SIEM Logs

Cloud SIEM runs on top of Datadog Log Management, so exporting “Cloud SIEM logs” means exporting the logs behind it. Use the Logs Search API, POST /api/v2/logs/events/search, with an API key and an application key, and follow the cursor until there’s no next page; each page holds up to 1,000 logs. For history beyond your index retention, read your log archives in S3, GCS or Azure Storage, or rehydrate them. Security signals are a separate API.

Datadog is where many cloud-native teams already keep their logs, which makes it the natural source for an investigation slice. Prime Core has 23,983 detection rules for Datadog, mapped to 676 MITRE ATT&CK techniques. Below is how to get logs out, sanitize them, and investigate them for free in LogTotal.

Get Started For Free

Before you start

Two keys. The Logs Search API needs an API key (DD-API-KEY) and an application key (DD-APPLICATION-KEY). The application key must belong to a user, or a service account, that can read the logs, and if it’s scoped, it needs log read access.

Your Datadog site. The API host follows your site: api.datadoghq.com (US1), api.us3.datadoghq.com, api.us5.datadoghq.com, api.datadoghq.eu, api.ap1.datadoghq.com and others. Use the one matching your login URL.

Retention. Indexed logs are searchable for as long as their index keeps them. Older logs exist only in archives, if you set any up.

Export with the Logs Search API

DD="https://api.datadoghq.eu"
BODY='{"filter": {"query": "host:web-03 source:sshd", "from": "2026-10-19T00:00:00Z", "to": "2026-10-20T00:00:00Z"}, "page": {"limit": 1000}, "sort": "timestamp"}'

: > dd_web03_1019.jsonl
CURSOR=""
while :; do
  REQ=$(echo "$BODY" | jq --arg c "$CURSOR" 'if $c != "" then .page.cursor = $c else . end')
  RESP=$(curl -sS -X POST "$DD/api/v2/logs/events/search" \
    -H "DD-API-KEY: $DD_API_KEY" -H "DD-APPLICATION-KEY: $DD_APP_KEY" \
    -H 'Content-Type: application/json' -d "$REQ")
  echo "$RESP" | jq -c '.data[]' >> dd_web03_1019.jsonl
  CURSOR=$(echo "$RESP" | jq -r '.meta.page.after // empty')
  [ -z "$CURSOR" ] && break
done

# raw messages only
jq -r '.attributes.message' dd_web03_1019.jsonl > dd_web03_1019.log

The API is rate limited. For big windows, expect it to take a while, and back off when you see 429.

Older logs: archives

If you configured log archives, Datadog writes compressed JSON files to your bucket, organized by date and hour. Download the hours you need and decompress them:

aws s3 cp s3://my-dd-archive/dt=20261019/ ./dd-archive/ --recursive
zcat ./dd-archive/*/*.json.gz > dd_archive_1019.jsonl

Upload, sanitize and review in LogTotal

1. Upload. Open logtotal.com and drop in the file.]
2. Sanitize. 
3. Review. 

When it goes wrong