Follow Cloud SIEM runs on top of Datadog Log Management, so exporting “Cloud SIEM logs” means exporting the logs behind it. Use the Logs Search API, POST /api/v2/logs/events/search, with an API key and an application key, and follow the cursor until there’s no next page; each page holds up to 1,000 logs. For history beyond your index retention, read your log archives in S3, GCS or Azure Storage, or rehydrate them. Security signals are a separate API.
Datadog is where many cloud-native teams already keep their logs, which makes it the natural source for an investigation slice. Prime Core has 23,983 detection rules for Datadog, mapped to 676 MITRE ATT&CK techniques. Below is how to get logs out, sanitize them, and investigate them for free in LogTotal.
Before you start
Two keys. The Logs Search API needs an API key (DD-API-KEY) and an application key (DD-APPLICATION-KEY). The application key must belong to a user, or a service account, that can read the logs, and if it’s scoped, it needs log read access.
Your Datadog site. The API host follows your site: api.datadoghq.com (US1), api.us3.datadoghq.com, api.us5.datadoghq.com, api.datadoghq.eu, api.ap1.datadoghq.com and others. Use the one matching your login URL.
Retention. Indexed logs are searchable for as long as their index keeps them. Older logs exist only in archives, if you set any up.
Export with the Logs Search API
DD="https://api.datadoghq.eu"
BODY='{"filter": {"query": "host:web-03 source:sshd", "from": "2026-10-19T00:00:00Z", "to": "2026-10-20T00:00:00Z"}, "page": {"limit": 1000}, "sort": "timestamp"}'
: > dd_web03_1019.jsonl
CURSOR=""
while :; do
REQ=$(echo "$BODY" | jq --arg c "$CURSOR" 'if $c != "" then .page.cursor = $c else . end')
RESP=$(curl -sS -X POST "$DD/api/v2/logs/events/search" \
-H "DD-API-KEY: $DD_API_KEY" -H "DD-APPLICATION-KEY: $DD_APP_KEY" \
-H 'Content-Type: application/json' -d "$REQ")
echo "$RESP" | jq -c '.data[]' >> dd_web03_1019.jsonl
CURSOR=$(echo "$RESP" | jq -r '.meta.page.after // empty')
[ -z "$CURSOR" ] && break
done
# raw messages only
jq -r '.attributes.message' dd_web03_1019.jsonl > dd_web03_1019.log
The API is rate limited. For big windows, expect it to take a while, and back off when you see 429.
Older logs: archives
If you configured log archives, Datadog writes compressed JSON files to your bucket, organized by date and hour. Download the hours you need and decompress them:
aws s3 cp s3://my-dd-archive/dt=20261019/ ./dd-archive/ --recursive
zcat ./dd-archive/*/*.json.gz > dd_archive_1019.jsonl
Upload, sanitize and review in LogTotal
- Upload. Open logtotal.com and drop in the file.]
- Sanitize.
- Review.
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| 403 Forbidden | Application key lacks log read access | Use a key from a user or service account that can read logs |
| Valid keys, no data | Wrong Datadog site | Use your site’s API host |
| Nothing older than a few days | Index retention | Read the archives, or rehydrate |
| 429 Too Many Requests | Rate limit | Wait, then continue with the same cursor |
| Only 1,000 results | Cursor not followed | Loop until meta.page.after is empty |
FAQ
How do I export Cloud SIEM signals?
Signals have their own endpoint under the Security Monitoring API. For LogTotal, export the logs behind them.
What about Flex Logs?
Flex-tier logs are searchable in Datadog but may behave differently in the API.
