November 2025 Summaries

Datadog Forms offers engineering teams a streamlined solution for creating and managing interactive forms directly within Datadog, addressing the inefficiencies of traditional form processes that rely on disjointed tools like spreadsheets and external builders. By embedding forms into their existing workflows, teams can automate tasks such as developer onboarding, production readiness checklists, developer experience surveys, and service request routing, all while maintaining data consistency and visibility. This integration allows for automated workflows triggered by form submissions, providing structured data collection that enhances compliance, resource allocation, and feedback analysis. Datadog Forms enables teams to visualize and analyze form responses, correlating them with performance metrics to identify areas for improvement and automation opportunities, ultimately aiming to reduce manual effort, improve data traceability, and ensure consistent adherence to organizational standards.

Rehydration for Observability Pipelines is a newly available feature that allows organizations to efficiently manage and access archived log data from storage solutions like Amazon S3, Google Cloud Storage, and Azure Blob Storage. By enabling the retrieval and replay of these logs through existing observability pipelines, Rehydration maintains the same parsing, enrichment, and routing logic used for live data, ensuring consistent formatting and context. This feature is particularly useful for security, network, and DevOps teams, as it helps them conduct investigations, audits, and testing by pulling specific time frames of archived logs without manual intervention. By using pre-configured Packs, teams can filter and manage log data effectively, balancing the need for full data visibility against storage costs. Rehydration thus offers an automated, on-demand solution for accessing historical data, supporting both performance investigations and compliance requirements, while eliminating the need for scripts or manual file handling.

Datadog's LLM Observability offers a comprehensive solution for evaluating the quality of Large Language Model (LLM) applications by closing the gap between operational metrics and qualitative assessments like factual accuracy, safety, and tone. While many teams measure speed and cost, few assess response quality, creating a significant observability shortfall. Datadog addresses this by tracing requests from prompt to response and providing built-in evaluations for common issues such as hallucinations and toxicity. The platform introduces custom LLM-as-a-judge evaluations, allowing teams to define domain-specific quality standards using supported LLM providers like OpenAI and Anthropic. These evaluations run automatically, scoring responses in real-time and integrating with existing dashboards to track trends, set monitors, and debug failures. This enables teams to tailor evaluations to specific applications, such as financial chatbots or medical assistants, and iterate improvements based on real-world data. Datadog's approach facilitates faster deployment of reliable LLM applications by combining qualitative insights with operational data in a unified framework.

Datadog's App Builder is a low-code tool enhanced with conversational AI, allowing engineering teams to create internal applications efficiently by using natural language descriptions instead of manual setups. This tool streamlines the app development process by automatically generating layouts, data bindings, and logic based on user prompts, which accelerates learning and iteration for both new and experienced developers. Teams can build and refine applications such as queue managers and infrastructure provisioning tools without digging through documentation or writing code, thanks to App Builder's ability to suggest improvements and provide interactive walkthroughs. By integrating with Datadog and other platforms, the App Builder allows seamless monitoring and management of workflows, reducing context switching and improving response times. The conversational AI feature also facilitates the maintenance and enhancement of existing app blueprints by interpreting natural language requests and updating UI and logic automatically, fostering easier collaboration and encouraging experimentation across roles.

Datadog App and API Protection provides real-time threat detection and blocking capabilities at the network edge for various proxies and load balancers, including integrations with Envoy, Istio, NGINX, and Google Cloud Load Balancers. These integrations allow malicious activities such as credential stuffing, API abuse, and injection attacks to be intercepted and blocked before reaching the application layer, enhancing security by reducing unnecessary resource consumption. Additionally, the system offers both inline and asynchronous traffic inspection modes, allowing for real-time blocking or passive monitoring without latency. Datadog's solution maintains an updated inventory of production endpoints, evaluates security contexts, and supports the configuration of Web Application Firewall (WAF) rules to address threats like account takeover attempts. The layered defense strategy is further bolstered by in-app instrumentation, providing comprehensive protection by pairing edge-level blocking with detailed application code analysis. This unification of edge and in-app protections within the Datadog Security platform enables swift, organization-wide threat neutralization, ensuring robust security coverage across diverse environments like VMs, containers, and microservices.

Datadog's Internal Developer Portal (IDP) introduces IDP Campaigns, an extension of its existing Scorecards feature, to help engineering leaders efficiently manage and track organization-wide initiatives such as reducing cloud costs, accelerating migration projects, and strengthening security controls. IDP Campaigns provide a structured framework with clear goals, defined audiences, and specific timeframes, allowing teams to measure progress using scorecard rules that assess completion rates and identify top-performing teams. This approach enhances visibility and accountability by automatically tracking compliance across services, facilitating real-time updates, and eliminating reliance on manual check-ins or external spreadsheets. The tool supports platform engineers and FinOps leaders in optimizing cloud costs by standardizing practices and tracking adoption trends, while also aiding in the management of complex version migration projects by highlighting blockers and showcasing team progress. Furthermore, IDP Campaigns ensure security standards are enforced and auditable post-audit, providing transparency and ease of tracking compliance with updated protocols across the organization. Now available in preview, IDP Campaigns aim to streamline collaboration and drive best practices across teams.

Datadog App and API Protection offers a robust security solution by integrating with popular edge proxies and load balancers like Envoy, Istio, NGINX, and Google Cloud Load Balancers, including HAProxy support in Preview. This integration allows for real-time threat detection and blocking at the network edge, preventing malicious requests from reaching applications and consuming resources. By inspecting all incoming traffic, the system enables both inline blocking and asynchronous monitoring, offering deep visibility into API activity and potential threats without latency. The solution also maintains an up-to-date inventory of endpoints, providing valuable insights into public exposure, authentication methods, and attack activity. Pairing edge protection with in-app instrumentation creates a layered defense, enhancing security by blocking threats at both the network edge and within application code execution. Datadog's unified security approach allows real-time action on detected threats, offering comprehensive protection across various environments while simplifying deployment and ensuring consistent protection across VMs, containers, and microservices.

In today's complex, hybrid, and multi-vendor environments, DevOps and security teams are increasingly adopting OpenTelemetry (OTel) for telemetry data instrumentation to avoid vendor lock-in. However, OTel alone lacks advanced processing functions and volume control, leading to fragmented setups. Datadog Observability Pipelines address these gaps by supporting OTel as a logs source, enabling teams to collect, process, and route telemetry data while maintaining a vendor-neutral architecture. This integration allows for unified data collection with pre-ingestion volume control, parsing rules, and automatic handling of OTLP protobuf for simplified data manipulation. Observability Pipelines support open-source frameworks, offering out-of-the-box normalization to the Open Cybersecurity Schema Framework (OCSF) and providing advanced data transformation capabilities. This solution ensures teams can process and route data efficiently across both on-premises and cloud-native environments without disrupting existing workflows or compromising visibility, ultimately enabling organizations to manage growing data volumes while adhering to budget constraints and compliance requirements.

The interconnected nature of modern systems means that failures like the AWS October 2025 outage can lead to widespread disruptions, affecting services even if the primary application isn't hosted on AWS. Datadog Feature Flags demonstrated resilience during such an outage by leveraging an architecture focused on local evaluation and global distribution of configuration data via CDNs. This design ensures independence from cloud provider outages by caching configuration data locally and evaluating feature flags within applications, thereby maintaining performance and service continuity. The system's resilience is further reinforced by using Fastly for distributing configuration files, which allows applications to initialize and operate using cached data even when primary servers are down. Datadog's approach exemplifies how feature flagging can enhance reliability and facilitate safe deployments during external system failures, with services like Updog.ai providing early outage detection to minimize impact. Datadog Feature Flags is available in preview, offering a robust solution for maintaining application functionality amidst cloud provider issues.

Ruby has become a crucial component in modern web development, significantly impacting application development, testing, and CI/CD workflows. A study using data from continuous profiling of over 3,000 services reveals that Ruby applications are compute-intensive, often spending around 82% of their CPU time in library code, highlighting the importance of selecting efficient libraries. Notably, libraries like stdlib, activerecord, and activesupport are major contributors to CPU usage, with limited alternatives available. However, some libraries, such as mysql2, can be replaced for better performance, and others like pg and modern versions of json are both popular and resource-efficient. While web server choice does not significantly affect CPU consumption, upgrading to Ruby 3 can result in lower library CPU usage compared to Ruby 2, and Ruby 3.5 is anticipated to offer further performance enhancements. Despite these improvements, garbage collection remains a consistent CPU overhead across Ruby versions. The findings emphasize the importance of strategic library choices and version upgrades to optimize Ruby performance.

Developing an effective File Integrity Monitoring (FIM) system for large-scale infrastructures like Datadog's poses significant challenges that traditional methods cannot adequately address. Existing techniques, such as periodic filesystem scans and legacy event-based Linux monitoring technologies like inotify and auditd, fail to provide the necessary real-time insights and system-level context. By leveraging eBPF, Datadog's engineering team was able to observe real-time file activity directly from the kernel, offering detailed insights into which process or container triggered file changes. This approach, however, generated an overwhelming volume of data, necessitating innovative solutions to handle billions of events per minute without degrading performance. Datadog addressed this by implementing Agent-side rules and in-kernel filtering techniques, specifically using "approvers" and "discarders," to pre-filter up to 94% of events directly in the kernel. This method allowed for efficient processing and transmission of only critical events, significantly reducing data loads while maintaining full detection coverage. The overarching goal is not just to detect file changes but to enrich these events with context, providing security teams with actionable insights for effective investigation and response.

Datadog has introduced Agent Builder, a tool that allows users to create custom AI agents for automating complex workflows by leveraging Datadog's observability data and third-party signals. Instead of hardcoding numerous logic branches, these agents can analyze data, make decisions, and adapt to changing inputs in real time. The tool supports AI-driven orchestration for workflows that can intelligently react and scale with systems, offering seamless integration with Datadog's Action Catalog, which includes over 2,000 prebuilt actions for various services such as Kubernetes and cloud services. Agent Builder enables the automation of tasks like application error investigations, critical vulnerability responses, and service documentation updates, all without requiring custom code. By orchestrating agents to specialize in distinct steps of operational processes, teams can maintain automation efficiency and control, with all data, logic, and actions centralized within Datadog. Agent Builder is currently available in Preview, with early access provided to users through the Datadog platform.

Security and SRE teams are facing challenges in managing the growing volume of log data, which is complicated by ingestion-based pricing models that can make storing high-volume logs from sources like CDNs, firewalls, and AWS expensive. Datadog Packs, part of Observability Pipelines, offer a solution by providing predefined configurations that include processors, filters, and rules for common log sources, helping teams reduce noise, control costs, and standardize data flow. These Packs enable quick deployment of best-practice logic without the need for extensive manual configuration, allowing teams to manage logs efficiently and maintain visibility for security investigations and compliance. Additionally, Packs can be customized and extended to fit specific organizational needs, supporting teams in building tailored log-processing frameworks while ensuring consistent and efficient data handling across various systems.

Backstage is an open-source framework used by organizations to create internal developer portals (IDPs) that centralize service metadata for software developers. However, data stored in Backstage can become siloed, complicating integration with monitoring tools like Datadog. To address this, a Datadog Plugin for Backstage was developed by engineers at Cvent, allowing users to unify service metadata and telemetry by integrating Backstage data into the Datadog Software Catalog. This integration enhances observability, streamlines incident response, and maintains a single source of truth while allowing engineers to correlate telemetry signals with comprehensive service metadata. By automatically syncing Backstage data with Datadog, teams can visualize service dependencies and maintain existing workflows without metadata duplication, ultimately improving software delivery and system health monitoring.

The Department of Veterans Affairs (VA) prioritizes maintaining accessible, reliable, and secure digital services to provide quality care and benefits to veterans, their families, and caregivers across the United States. As the largest integrated healthcare system and benefits provider in the country, the VA faces the challenge of managing 2.7 million pieces of equipment and supporting millions of users on its digital platforms. The passage of the PACT Act in 2022, which expanded eligibility for healthcare and benefits, significantly increased demand on the VA's digital systems, prompting the agency to quickly scale its infrastructure. To address this, the VA implemented Datadog’s observability platform for real-time monitoring and optimization, ensuring system reliability and performance while complying with FedRAMP® security standards. This strategy allowed the VA to maintain a high level of service continuity, crucial for healthcare operations where even minor disruptions can have significant impacts. The VA's commitment to modernization and observability reflects its dedication to operational excellence and resilience, ensuring veterans receive the care and benefits they deserve.

Datadog Storage Management offers a comprehensive solution for managing cloud object storage costs and efficiency, particularly as data scales to petabyte levels. It provides granular visibility into which teams, services, workloads, or datasets are driving storage expenses and identifies cold data that can be archived to cheaper tiers. By leveraging prefix-level metrics, organizations can attribute expenses directly to specific cost drivers, such as database tables or media workload prefixes, and make informed decisions to optimize storage. Storage Management also delivers actionable cost-saving recommendations, allowing users to transition data to more economical storage classes, implement expiration rules, and consolidate small files to reduce overhead. A practical example is provided where a DevOps team used Storage Management to investigate a sudden 40% increase in their AWS bill, identifying inefficiencies and potential savings by consolidating small files and transitioning older logs to infrequent access tiers. This tool empowers users to confidently manage storage policies, reduce costs, and maintain performance without compromising compliance.

The 2025 State of Cloud Security study reveals key insights into the security practices of organizations using AWS, Azure, and Google Cloud, highlighting the persistent challenges and emerging strategies in cloud security. The study found that many organizations manage multi-account environments via AWS Organizations but often lack centralized control when adopting data perimeters, leading to risks from long-lived cloud credentials and lagging adoption of security measures like IMDSv2 on EC2 instances. Recommendations include using AWS multi-account architecture with guardrails, implementing data perimeters, minimizing long-lived credentials, enforcing IMDSv2, and setting guardrails against public access in cloud storage services. Datadog Cloud Security offers tools to enhance security posture by providing centralized visibility, identifying misconfigurations, and suggesting remediation steps for risky cloud identities and workloads. Despite strides in adopting secure-by-default mechanisms and refining IAM permissions, many cloud environments remain vulnerable to exploits, underscoring the importance of deliberate configuration and management to protect against potential attacks.

Reference Tables enhance the ability of engineering, operations, and security teams to interpret telemetry data by integrating external metadata from SaaS providers like Snowflake, Salesforce, ServiceNow, and Databricks into a unified observability and security platform. This integration mitigates the visibility gaps that hinder incident response, cost control, and analytics by allowing direct enrichment of logs, metrics, and events with contextual information such as ownership, location, and priority. By automating the import of metadata, Reference Tables enable more efficient cost management, faster incident triage, enriched network traffic logs, and improved product usage analysis across customer segments. They also facilitate the detection of permissions misconfigurations in Databricks deployments, providing a comprehensive solution to combine business, ownership, and security context without manual data handling. These capabilities empower teams to make informed decisions and respond swiftly to issues, ultimately enhancing operational efficiency and reducing potential risks.

The 2025 State of Containers and Serverless report by Datadog highlights significant trends in cloud infrastructure, revealing how organizations are leveraging container orchestration platforms and serverless offerings to optimize workloads for efficiency, cost, and simplicity. With increasing adoption of GPUs to enable AI workloads, the report emphasizes the importance of planning for greater demand on specialized compute resources like FPGAs and ASICs. It also stresses the need for fine-tuning autoscaling to improve efficiency and advises selecting the best compute model—whether serverless, managed container platforms, or self-managed Kubernetes clusters—for each workload to balance performance, cost, and operational simplicity. The report underscores the growing interest in Arm-based compute for its cost efficiency and performance benefits, and highlights how Datadog's comprehensive monitoring tools can facilitate these optimizations by providing visibility into workload performance and resource utilization. With Datadog, organizations can continuously refine their compute strategies, ensuring workloads are placed in the most efficient environments while tracking costs and performance metrics.

Datadog offers an integrated troubleshooting experience for Amazon ECS users, aiming to reduce operational overhead and expedite incident resolution by providing default monitors and the ECS Explorer tool. These tools enable quick identification and resolution of common ECS issues such as CPU, memory, network, and ephemeral storage failures, by allowing users to pivot directly from alerts to detailed insights about affected clusters, services, and tasks. The ECS Explorer provides visibility into cluster-level issues before they cascade, allowing users to compare resource utilization and make informed decisions about adjusting limits or scaling clusters. It also offers task-level visibility, especially for AWS Fargate tasks, to quickly address failures related to resource limits, networking errors, and storage constraints. By highlighting changes in configurations or image tags, the ECS Explorer facilitates regression analysis after deployments, ensuring that new releases do not introduce new issues. Datadog's system streamlines the troubleshooting process, enabling users to investigate and resolve problems without switching between various tools or manually correlating symptoms.

Datadog Workload Protection has introduced new features to enhance threat detection and analysis by transforming individual runtime alerts into cohesive narratives, allowing security teams to manage detection coverage without succumbing to alert fatigue. This includes Execution Contexts that automatically group related events, the Investigation Graph for visual exploration of complex attacks, and the Threat Timeline for chronological reconstruction of incidents. These features help analysts connect related events, prioritize genuine threats, and visualize the full attack path, enabling a shift from isolated alert management to a comprehensive understanding of threats. As Datadog plans to extend correlation beyond runtime data to include infrastructure and application performance insights, this evolution aims to provide a more holistic view of security incidents, accelerating investigations and reducing noise for security teams.

In the latest episode of "This Month in Datadog," viewers are introduced to a range of new features and updates designed to enhance user experience and operational efficiency. The DDSQL Editor now enables users to generate SQL queries using natural language with the aid of AI, eliminating the need for extensive SQL knowledge. The platform also offers improved cost management tools through Instance Explorer and a new Cloud Cost Management integration for Oracle Cloud Infrastructure, allowing users to compare instance costs and monitor their cloud spending effectively. Additionally, Datadog has introduced tools to keep teams aligned during outages with real-time visibility into the health of over 40 providers and the ability to manage flaky tests through a centralized view. The platform's new OTLP Metrics API facilitates the ingestion of OpenTelemetry Protocol metrics from serverless and third-party SaaS environments without the need for deploying collectors. Other noteworthy updates include video replay for mobile test investigations, runtime security alerts via Falco integration, and the expansion of data source options in Reference Tables. These tools collectively aim to optimize performance, streamline operations, and ensure transparency across services.

Datadog developed a managed data replication platform to address the complexities of moving data between diverse systems, which was necessary to support the company's growth and operational needs. Initially, a shared Postgres database managed key product pages efficiently, but as data volumes increased, it faced scaling challenges, prompting Datadog to re-architect its system. They implemented a dedicated search platform, leading to significant improvements in query latencies and user experience. The platform evolved to support diverse use cases by employing asynchronous replication, utilizing technologies like Debezium and Kafka Connect, and ensuring schema compatibility to handle constant changes. Automation through Temporal workflows reduced operational overhead, enabling reliable, modular pipeline provisioning. This approach allowed Datadog to transition from a single-purpose solution to a scalable, multi-tenant platform, supporting various replication scenarios and enhancing data locality and resilience. The company emphasized flexibility and customization, empowering teams to tailor data flows to their needs using Kafka Sink Connector transformations and a custom enrichment API. Through strategic architectural decisions, Datadog achieved a robust, extensible platform while continuing to innovate in the data replication space.

Datadog has introduced a new, streamlined onboarding process for integrating with Microsoft Azure environments, addressing the traditionally complex and error-prone setup procedures. This new automated process allows users to connect their Azure accounts and configure necessary permissions, app registrations, and log forwarding directly through the Datadog platform, eliminating the need for manual steps across various portals and scripts. Users can choose from three setup methods—Quickstart via Azure CLI, Terraform for infrastructure as code, or existing app registration—to best fit their workflow and organizational needs, ensuring a quick and efficient integration. The new guided flow not only minimizes manual intervention but also enables users to specify which subscriptions, services, and resources to monitor, applying filters to collect only relevant metrics and logs. This approach facilitates rapid deployment and reduces the risk of misconfigurations, allowing teams to start monitoring their Azure environments with Datadog in just a few minutes.

Datadog's Synthetic Monitoring now includes Network Path, a feature designed to enhance the diagnosis of application slowdowns and failures by providing a comprehensive view of network performance issues. This tool allows teams to identify whether problems originate from application code or the underlying network, facilitating quicker resolution of user-facing issues. By simulating real-world conditions from global locations, Network Path provides detailed insights into network behavior, helping to pinpoint latency and packet loss. This proactive monitoring approach enables teams to set alerts for network conditions, reducing the time spent on reactive troubleshooting and minimizing user impact. The integration of browser, API, and network tests offers a unified context for understanding and addressing issues, ensuring more reliable and resilient digital experiences. Network Path tests are now available to all Synthetic Monitoring customers, supporting faster root cause analysis and improved service-level health.

The Model Context Protocol (MCP) is a framework for connecting AI agents to data sources such as APIs and databases, but its early-stage security standards make MCP servers vulnerable to attacks like tool poisoning, rug pulls, and injection attacks. Effective monitoring of MCP server interactions requires understanding operational and audit logs, which provide insights into routine events and security-relevant actions. Since MCP servers facilitate connections between models and external resources, attackers often target these servers to exploit vulnerabilities through tool calls. Monitoring abnormal tool call patterns, such as spikes in frequency or unauthorized access attempts, can help detect potential threats. Self-hosted MCP servers allow for more control over logging, crucial for detecting SQL and command injection attempts, which can occur via tool calls if harmful query inputs are not sanitized. Correlating MCP logs with other identity and activity logs can enhance the detection of compromised accounts, and fine-tuning detection rules based on specific characteristics of MCP servers can improve the identification of unusual activities. As MCP implementations mature, monitoring additional patterns like tool substitution or credential exposure can broaden detection coverage, and using tools like Datadog Cloud SIEM can aid in enriching and investigating MCP logs for security purposes.