AI agents can investigate suspicious security activity by pulling in context from across an environment and explaining whether an event represents a genuine threat. But applying that kind of reasoning to every security event is prohibitively expensive.
If you’re building AI agents that operate over large streams of events, you’ve likely encountered the same trade-off we faced in security: You can’t afford to apply expensive AI reasoning to every event, but you also can’t afford to miss the ones that matter. To make AI-driven security detection practical at fleet scale, we built a two-stage detection pipeline. Mambark, a small state-space model pretrained on sequences of audit logs, scores every event and forwards only the most suspicious ones to an AI agent for deeper investigation. We’re currently testing this detection mode with a small group of Datadog Cloud SIEM design partners.
In this post, we explain why a model like Mambark is necessary, how we built it, how it performs on public benchmarks, and how it fits together with AI agents in a detection pipeline that’s inexpensive enough to run at fleet scale and precise enough to perform investigations.
Why agents alone can’t watch your logs
