May 2026 Summaries

Datadog AI Agent Monitoring offers comprehensive visibility into AI agents, addressing the challenges of black-box operations by providing tools to trace agent workflows, analyze performance, and evaluate output quality. By using LLM Observability, it allows users to visualize workflows with flame graphs, trace full agent runs, and automate evaluations of response quality. The system is designed to work with LangGraph, enabling the integration of various tools like Tavily for web search and Amazon SNS for routing output. Key features include the ability to monitor tool invocation status, processing time, token usage, and cost, while also allowing for the correlation of agent traces with APM, logs, and infrastructure data. This helps in identifying latency bottlenecks, understanding cost impacts, and spotting recurring errors. Datadog's solution provides an end-to-end perspective that aids in troubleshooting and optimizing agent performance, ensuring that teams can effectively manage and improve AI agent applications.

Alibaba Cloud, a leading cloud provider in the Asia Pacific region, offers a robust suite of services including AI models, managed databases, and Kubernetes through its Container Service for Kubernetes (ACK). The integration with Datadog enhances its utility by allowing seamless collection of metrics and logs across Alibaba Cloud's services, such as ECS, CDN, and ApsaraDB, without the need to switch platforms. This integration facilitates detailed monitoring and diagnostics by correlating infrastructure metrics with application performance data, thereby improving incident response times and clarity. The Datadog Agent, when deployed on ECS instances and ACK clusters, enables collection of distributed traces, which helps in tracing requests through various services to identify latency issues. Additionally, Datadog's Bring Your Own Cloud (BYOC) Logs supports data residency compliance by processing logs within the customer's Alibaba Cloud environment. This comprehensive integration streamlines operations for teams using multiple cloud providers and fulfills compliance needs, offering full-stack visibility and efficient troubleshooting capabilities.

Datadog Kubernetes Autoscaling offers a streamlined approach to managing resource efficiency in Kubernetes environments, addressing common issues like overprovisioning and idle resource allocation. By leveraging tools such as the Datadog Pod Autoscaler, platform teams can dynamically adjust CPU and memory resources at both the node and workload levels without disrupting existing workflows. The system supports three main deployment methods: an in-app setup for centralized management, GitOps cluster profiles for policy-as-code management, and AI-assisted onboarding to simplify the creation of scaling manifests. These methods allow for efficient autoscaling implementation across a Kubernetes fleet, reducing idle costs and minimizing operational risks. Additionally, the Datadog Pod Autoscaler features in-place vertical resizing, which enables real-time adjustments to resource requests, ensuring optimal performance without the need for disruptive pod recreations. This comprehensive solution empowers organizations to optimize their Kubernetes resource usage while maintaining consistency and control over their deployment processes.

Azure Managed Redis is a fully managed, enterprise-tier in-memory data store by Microsoft designed to support low-latency caching, session storage, and real-time data needs of modern applications, including those involving AI workloads. The integration with Datadog provides comprehensive visibility into cache activity, utilization, and performance without requiring an agent. Once set up, over 20 metrics from Azure Managed Redis caches are automatically collected and displayed on out-of-the-box dashboards, helping teams monitor workload activity, cache efficiency, and resource pressure. This integration enables proactive identification and resolution of performance regressions, optimizing cache efficiency and capacity by utilizing metrics like cache hit rates, memory usage, and latency indicators. The Datadog integration also offers alerts for high server loads and low cache hit rates, allowing for quick response and adjustment to prevent user experience degradation. New users can explore these features by signing up for a 14-day free trial to monitor Azure Managed Redis caches effectively.

Apache HTTP Server, a widely used web server, faces vulnerabilities in its mod_http2 module, notably CVE-2026-23918, a double-free vulnerability that can lead to remote code execution if exploited, especially for servers not using Apache's MPM prefork. This vulnerability, along with others like CVE-2023-44487 and CVE-2023-45802, exploits the HTTP/2 feature RST_STREAM, which allows multiple requests in a single TCP connection, making detection more complex than with HTTP/1.1. To counteract these threats, configuring Apache to use debug logging is advised for capturing stream-level activities, which is crucial for forensic analysis but too verbose for regular use. Tools like Datadog can assist in monitoring these potential exploits by providing insights into server activity, allowing operators to detect signs of abuse such as latency spikes, high-volume stream resets, and worker process crashes, and to apply appropriate measures such as blocking IPs or updating server patches.

In 2023, Datadog launched its Ambassadors program, which has since experienced significant growth, leading to the introduction of the 2026 cohort, encompassing cloud security experts, SRE practitioners, platform engineers, DevOps leaders, and AI observability specialists from diverse global locations. The Ambassadors have made notable contributions, such as organizing user groups and workshops and sharing practical insights within the community. In addition to the Ambassadors, Datadog introduced the Champions program to recognize individuals contributing to the ecosystem by publishing content and engaging with their communities. The inaugural 2026 Champions cohort consists of 25 practitioners from 11 countries, selected for their impactful work, including infrastructure management, feedback integration into product development, and running long-term learning communities. Being a Champion includes benefits such as content amplification, public recognition, and direct engagement with Datadog's product teams.

Datadog AI Impact provides a comprehensive solution for organizations seeking to understand the real impact of AI coding tools on software delivery by linking AI usage data with DORA metrics to evaluate both velocity and stability. By correlating AI-assisted code with outcomes like lead time and change failure rate, it enables teams to measure how AI influences engineering performance beyond simple adoption metrics. The platform allows for detailed analysis of delivery performance, comparing AI-assisted and unassisted work, and evaluates the stability of AI-assisted code in production by attributing failure impacts proportionally. It also facilitates the comparison of different AI coding tools by assessing their effects on throughput, cycle times, and production stability, turning tool selection into a data-driven decision. Additionally, AI Impact supports the testing of new AI models in controlled environments to assess their performance and cost-effectiveness before broader implementation, providing organizations with the insights needed to make informed decisions about AI adoption based on real-world outcomes rather than assumptions or external benchmarks.

Yuki Matsuzaki discusses the importance of guardrail placement in AI agents, particularly in managed systems like Amazon Bedrock and self-orchestrated setups with Datadog AI Guard. The article explores a demo scenario involving an indirect prompt injection attack to highlight how the placement of guardrails impacts security. In managed environments like Amazon Bedrock, guardrails are limited to the edges of the orchestration loop, offering convenience but less control. In contrast, self-orchestrated agents with Datadog AI Guard allow for more granular guardrail placement throughout the orchestration loop, providing enhanced security by evaluating prompts, tool calls, and outputs at multiple points. The trade-offs between managed convenience and in-depth governance are examined, offering insights into choosing the right guardrail strategy based on threat models, compliance requirements, and the sophistication of potential attacks.

Datadog App & API Protection offers enhanced API authentication detection to help organizations manage the security of their numerous API endpoints more effectively. This update reduces manual effort by focusing on verifiable signals and providing customization options, helping security teams minimize false positives and address real risks. The system clearly labels API endpoints as authenticated, unauthenticated, or undetected based on explicit evidence, which aids in prioritizing security investigations. The platform also allows organizations to customize detection logic using endpoint tagging rules to accommodate nonstandard authentication mechanisms, ensuring accurate detection without needing redeployments. Additionally, the API Inventory includes a dedicated authentication status column and provides guidance for next steps in addressing authentication issues, helping teams maintain a strong security posture by understanding and acting on their API authentication status with confidence.

AI coding assistants have significantly increased PR counts, commit frequency, and lines of code, highlighting the inadequacy of traditional individual output metrics to assess developer productivity. GitClear's analysis of over 200 million lines of code revealed that code churn nearly doubled with widespread AI adoption, underscoring the need to focus on developer experience (DevEx) instead. DevEx, which encompasses systems, workflows, tools, and culture, influences developer productivity and is linked to faster development cycles and lower operational costs. Datadog emphasizes measuring DevEx through feedback loops, cognitive load, and flow state, and has added AI adoption as a fourth dimension to their framework. By tracking system-level and workflow-level metrics alongside developer sentiment surveys, Datadog aims to identify bottlenecks and improve software delivery performance. They employ metrics like process efficiency, tool quality, and cognitive load, and utilize the DORA framework to align DevEx signals with performance outcomes. Datadog's approach includes maintaining up-to-date service catalogs to reduce discovery friction and leveraging AI tools to enhance the operational context for both human and AI collaborators.

Cloud and SaaS spending is rising rapidly, challenging traditional cost management workflows that rely on outdated reports and spreadsheets, leading to unforeseen budget overruns. Datadog Cloud Cost Management (CCM) addresses this issue by incorporating budget forecasting, which uses machine learning models to predict future spending patterns based on real billing data, offering a proactive approach to cost management. This system allows engineers and FinOps professionals to monitor spending trends, receive alerts for potential budget breaches, and share insights through reports and dashboards, facilitating forward planning rather than retrospective analysis. The forecasting tool is versatile, covering various cloud providers and SaaS services, and integrates with existing workflows to provide a comprehensive view of both current and projected expenses. By offering real-time updates and alerts, CCM helps teams adjust usage patterns promptly, ensuring they remain within budget and align cost management with operational goals.

The Datadog team aimed to enhance their Database Monitoring (DBM) system's automated query optimization recommendations by integrating an AI agent with the existing multi-source heuristic engine. Using Karpathy's autoresearch tool, they conducted 23 autonomous experiments, which improved the AI agent's precision from P=0.54 to P=0.86 by optimizing the prompting and tool chains, adjusting the model for cost-performance balance, and implementing a two-pass approach. The heuristic engine was precise, achieving P=0.903, but the AI agent, while less precise initially, could identify a broader set of potential optimizations, leading the team to develop a rigorous evaluation dataset and experiment infrastructure for rapid iteration. The iterative process involved optimizing the agent's system prompt and tool descriptions, compressing solutions to a smaller model, and using a two-pass system to reach precision goals. The team's methodology, supported by LLM Observability Experiments, provided a structured approach to experimentation, enabling detailed tracking and analysis, which can be applied broadly to AI agent development beyond query optimization.

Alert fatigue and blind spots in monitoring systems can arise from inadequate coverage and misconfigured alerts, leading teams to reactively add monitors and adjust thresholds without a comprehensive assessment of their setup. Effective monitoring requires focusing on both coverage, ensuring all system layers are adequately monitored, and quality, creating alerts that are actionable, clear, and stable. To address these issues, teams should conduct audits, starting with an inventory of current monitors, mapping critical architectures and paths, and identifying coverage gaps and misconfigurations. Prioritizing remediation efforts based on user impact and noise reduction can enhance alert reliability. Tools like Datadog assist in automating these processes, offering templates and governance models to maintain a clean and effective monitoring environment. Regular reviews and adherence to best practices in monitor creation and maintenance can help preempt issues and improve incident response times, ultimately building trust in the monitoring system.

Software Composition Analysis (SCA) tools are crucial in modern security programs for identifying vulnerabilities in software supply chains by comparing component fingerprints against Common Vulnerabilities and Exposures (CVE) databases. However, these tools can flag vulnerabilities that might not pose real risks, placing the burden on security teams to assess the severity without complete information. To aid in this challenge, Datadog offers the Public Artifact Vulnerabilities page, which provides visibility and exploitability assessments for its software using the OpenVEX specification. OpenVEX, a lightweight format endorsed by the Cybersecurity and Infrastructure Security Agency (CISA), details the status, justification, impact, and recommended actions for vulnerabilities in machine-readable documents. Datadog combines automated scans with expert analysis to generate and validate VEX statements, which are published weekly and can be integrated into security pipelines to prioritize actionable issues. This approach helps reduce noise in scans and enhances decision-making regarding potential risks within Datadog-managed software.

Racheal Ou discusses how Natural Language Queries (NLQ) for Datadog metrics transform user interaction with data by allowing queries to be made in plain language, which are then automatically translated into structured Datadog queries. This innovation simplifies metric exploration, particularly for users who are not familiar with complex query syntax, making data insights more accessible and reducing the reliance on experts. NLQ supports a question-first workflow, enabling users to describe desired outcomes and see results without needing prior knowledge of Datadog's query language. It also facilitates iterative query refinement, allowing users to adjust parameters like filters and time ranges through natural language or a query editor. By streamlining the process of query construction, NLQ enables teams to focus more on gaining insights rather than building queries, enhancing the overall efficiency of data analysis.

Datadog Cloud Cost Management (CCM) offers a comprehensive solution for organizations to manage and analyze AI-related expenditures across multiple providers like OpenAI, Anthropic, and Google Gemini. With AI Costs, CCM provides a unified platform that consolidates fragmented billing data into a cohesive view, allowing FinOps and engineering teams to gain insights into AI spend alongside infrastructure costs. By standardizing tagging across providers and using out-of-the-box allocation rules, CCM simplifies the attribution of costs to specific users, services, and teams, thereby enhancing accountability and facilitating better budgeting and optimization decisions. The platform's centralized dashboards and automated reporting capabilities enable organizations to track spending trends, identify cost drivers, and optimize usage patterns without the need for manual data reconciliation or additional instrumentation.

Toto 2.0, a family of open-weight time series forecasting models released on Hugging Face, ranges from 4 million to 2.5 billion parameters and demonstrates that scaling improves model performance, as evidenced by its top rankings on benchmarks like BOOM, GIFT-Eval, and TIME. The models, which do not rely on public forecasting data for pretraining, show advancements over the previous Toto 1.0 in terms of parameter efficiency and inference speed, particularly through techniques like contiguous patch masking. Toto 2.0 models consistently sit on the Pareto frontier, indicating optimal quality-for-size tradeoffs, and outperform competitive models across various metrics such as CRPS and MASE. The release also includes model weights and infrastructure for distributed training, and it highlights the importance of data curation and the potential for future improvements in areas such as long-horizon stability and multimodal modeling for observability.

Database Investigator is a tool designed to simplify and expedite the process of diagnosing and resolving database performance issues by leveraging Datadog's comprehensive database and application context. It enables engineers, regardless of their database expertise, to quickly identify root causes and remediation steps for issues such as latency spikes, connection pool exhaustion, and replication lag. By correlating distributed traces, query metrics, and execution plans, Database Investigator provides a unified view that simplifies the identification of performance regressions and offers actionable solutions. The tool's ability to analyze low-level interactions and transaction states further aids in uncovering elusive problems like connection pool exhaustion. Additionally, it facilitates the diagnosis of replication lag by considering replication internals across clusters, thereby pinpointing specific queries or services that may be causing delays. Database Investigator's intuitive interface and plain language explanations empower teams to resolve complex issues efficiently, significantly reducing mean time to resolution and minimizing the need for escalations.

Datadog Sheets, in conjunction with Datadog Cloud Cost Management (CCM), offers a solution for FinOps teams needing adaptable cloud cost data analysis and reporting. By using structured tables and flexible spreadsheet-style tabs, users can analyze cost data across various providers, services, and teams, while remaining connected to live data. This setup allows for the creation of custom layouts, conversion of currencies, and aggregation of daily costs into monthly reports, ensuring data remains current and reflective of actual spending. Additionally, Datadog Sheets facilitates budget forecasting by integrating historical data with projections and business context, enabling real-time comparison of projected and actual expenditures. Overall, it streamlines cloud cost management workflows by eliminating the need for repeated manual updates and exporting data to external tools, offering a more integrated and efficient approach to cloud cost analysis.

Datadog for Government has achieved FedRAMP High certification, enabling it to support the federal government's most sensitive civilian workloads with a unified observability and security platform. This certification ensures compliance with NIST standards for confidentiality, integrity, and availability, allowing public sector teams to monitor, secure, and optimize critical systems without introducing new tools or workflows. The FedRAMP High certification is crucial for agencies managing high-impact services such as emergency response, law enforcement, and healthcare, as it ensures the platform can handle severe security incidents or service disruptions. Datadog for Government provides integrated workflows for earlier detection of issues, validation of changes, and rapid response to performance degradation. The platform's capabilities include Application Performance Monitoring, anomaly detection, and Synthetic Monitoring, which help maintain service stability and user experience during peak demand. This milestone highlights Datadog's ongoing commitment to supporting public sector needs, including future expansions to support national security workloads and progress toward Impact Level 5 authorization.

Datadog's AI Research Lab in Paris is at the forefront of developing foundational models and autonomous agents that aim to revolutionize observability, with a significant contribution from PhD students Viktoriya Zhukova and Salahidine Lemaachi, recruited through France's CIFRE program. This government-funded initiative facilitates collaboration between companies and academic institutions, allowing doctoral candidates to work on industry-grounded research. Viktoriya focuses on enhancing timeseries forecasting through multimodal data, leveraging Datadog's extensive observability resources, while Salahidine investigates the application of AI models in understanding environments for improved forecasting and anomaly detection. Both researchers praise Paris's vibrant tech ecosystem, which, combined with France's supportive academic environment, provides them with access to cutting-edge research opportunities. Their work on Datadog's open-source timeseries foundation model, Toto, has been pivotal, demonstrating the impact of applied research in real-world systems. Their contributions have gained recognition, with the Toto model being adopted across various industries and presented at major conferences like NeurIPS.

In the latest episode of This Month in Datadog, several new features and updates are highlighted, including autonomous Cloud SIEM investigations, vulnerability remediation with auto-generated fixes, and natural language exploration within Datadog. The episode introduces the Datadog MCP Server, which provides AI agents with real-time access to observability data, enhancing their ability to respond with relevant context. Datadog Experiments is showcased as a tool for analyzing the impact of product changes on user journeys, allowing for integrated analytics and monitoring. Additional innovations include Bits AI Security Analyst for automatic threat investigation, Bits AI Dev Agent for generating code fixes, and Bits Assistant for natural language interactions. The episode also highlights improved infrastructure visualization, AI-powered session replays, centralized observability management, and native Kubernetes exploration with OpenTelemetry data. The episode concludes by promoting the upcoming DASH 2026 event in New York City and encouraging viewers to subscribe for future updates.

Supabase, an open-source backend platform built on Postgres, is designed for developers who want to deploy applications without the need to manage infrastructure, making it particularly appealing to frontend developers and those with limited database expertise. Datadog’s integration with Supabase offers infrastructure metrics, but it is the Database Monitoring (DBM) for Supabase that provides the crucial query-level insights necessary for diagnosing and optimizing database performance. This agentless, one-click setup enables developers to detect performance regressions, trace application slowdowns to their database source, and receive optimization recommendations without requiring deep Postgres knowledge. The integration of Datadog's Application Performance Monitoring (APM) with DBM allows teams to seamlessly trace issues from the application layer to specific queries, facilitating a more efficient resolution process.

Datadog Observability Pipelines offers a centralized log enrichment solution using Reference Tables to enhance context for security and platform engineering teams. By integrating with various data sources such as Snowflake, ServiceNow CMDB, and cloud storage, it dynamically attaches metadata to logs before they leave the infrastructure, reducing the need for manual updates and improving the speed and accuracy of threat investigations. This approach allows enriched logs to be routed efficiently to downstream tools like SIEMs or data lakes, improving latency and consistency by avoiding repetitive lookups across different systems. The enriched data enables more informed routing and volume control decisions, ensuring that high-volume, low-risk data is stored cost-effectively while critical data is directed to appropriate analytics platforms for further investigation. The system efficiently handles updates in threat intelligence and other datasets, offering security engineers the ability to apply current context to historical data during investigations, ultimately streamlining operations and reducing costs.