August 2026 Summaries

Datadog Bits Database Optimization aims to validate query rewrites before recommending them by benchmarking original and revised queries in disposable database instances that recreate production schemas, indexes, constraints, and key data characteristics through synthetic data based on collected table and column statistics. This controlled approach avoids production security and workload risks while reducing variability from cache states, locks, and resource contention; cache warm-up is performed within rolled-back transactions to preserve database state. Datadog evaluates simulation accuracy through cost fidelity, which compares query planner estimates, and read fidelity, which compares data blocks accessed, reporting substantially closer results than randomly generated data across many query types while continuing work on weaker cases such as correlated multi-column AND conditions. Bits judges proposed optimizations using server-reported execution time, logical reads, and dirtied blocks over 50 repeated runs, requiring improvements greater than 20 percent in at least three of four statistics—average, median, p95, and maximum—to ensure gains are meaningful and consistent. Currently available for Postgres, the feature identifies and tests query rewrites and index changes, withholding recommendations that do not meet its performance criteria, with support for MySQL, Microsoft SQL Server, and Oracle planned.

Tines and Datadog Observability Pipelines are presented as complementary tools for automating security-log processing and response, enabling teams to standardize, enrich, tag, filter, and route logs before they reach a SIEM. Observability Pipelines manages log transformation and routing, while Tines orchestrates workflows across systems such as Okta, ServiceNow, Slack, MDM platforms, and CMDBs, using APIs and Reference Tables to update pipeline logic in real time. Example workflows include automatically tagging activity associated with an offboarded employee as high risk, suppressing alert storms generated by known vulnerability scanners while escalating unfamiliar sources with threat context, and allowing analysts to tag a suspicious user’s activity during an investigation. By linking operational decisions and analyst judgments directly to log-processing rules, the integration aims to reduce manual triage, alert fatigue, maintenance work, and response times while improving visibility into potentially risky activity.

Datadog’s Bitbucket Cloud Source Code integration connects selected repositories with Datadog’s observability, testing, and security tools, helping developers, SREs, and security teams link production issues and automated findings to the relevant files, branches, and commits. The integration supports Code Security scans for first-party code, dependencies, secrets, and infrastructure-as-code configurations without requiring CI pipeline redesigns, while source code service mapping associates telemetry with repository URLs and commit SHAs to provide contextual code snippets in APM, Error Tracking, and Continuous Profiler. It also enables Datadog to post test coverage, flaky or failed test results, vulnerabilities, quality issues, and configuration findings directly on Bitbucket pull requests through summary or inline comments. Available generally for Bitbucket Cloud Premium users, with Standard support planned in preview, the integration aims to shorten troubleshooting, centralize review feedback, and help teams address quality and security issues before merging code.

Datadog’s build-time allowlisting feature for Browser SDK v7 aims to preserve readable Real User Monitoring action names while limiting exposure of sensitive runtime-generated data. When applications use the `mask-unless-allowlisted` privacy setting with action-name privacy enabled, a build plugin analyzes compiled artifacts and source maps to extract static application text, such as fixed labels, into an allowlist; the SDK then displays only matching text while masking unknown, dynamic, or customer-specific values in both RUM and Session Replay. This approach reduces reliance on potentially error-prone HTML privacy overrides, allowing teams to retain useful context such as “Click on Checkout” while concealing values like prices, addresses, and other runtime data. The plugin supports ESBuild, Rollup, Rspack, Vite, and Webpack, can be incorporated into CI/CD workflows, and offers include, exclude, and code-level opt-out controls to fit different application structures and privacy requirements.

Datadog describes an approach to securing AI agents by collecting telemetry across their full execution paths rather than relying only on application logs or model inputs and outputs. It recommends maintaining an AI bill of materials that records exact model versions, prompts, frameworks, tools, connected services, gateways, component provenance, and ownership, including applications operating outside approved infrastructure. The approach emphasizes tracing prompts, retrieved content, model responses, tool calls, policy decisions, sensitive-data flows, and downstream actions to identify prompt injection, attempted data exfiltration, and other risks before they reach protected resources. Datadog also advises prioritizing controls according to an agent’s exposure and the consequences of its tools, enforcing authorization and sandboxing, separating human, agent, and authenticated-service identities, and using human approval for consequential actions. Rather than treating isolated alerts or operational changes as conclusive evidence, teams should correlate related events within a session and compare behavior with established baselines, while using inline guardrails and detailed traces to block unsafe actions and support investigations.

Datadog’s Live Debugger is presented as a way for developers to investigate production-only bugs without modifying code, restarting services, or waiting through review and deployment cycles. It uses temporary, expiring logpoints attached to running services to capture variables, method arguments, execution context, and targeted snapshots, including in third-party library code, enabling teams to observe how real requests, configurations, feature flags, and dependency responses affect behavior. Conditional logpoints limit collection to relevant cases, while sensitive-data scrubbing, configurable scanning, audit trails, and automatic expiration support security and compliance requirements. The post also describes how Bits AI can use linked source code and a plain-language problem description to identify relevant locations, place logpoints across possible code paths, analyze production evidence, test several hypotheses in parallel, and propose a code fix supported by captured runtime data. Datadog plans to extend this workflow to its MCP Server and offers access through a Bits Live Debugger preview.

Datadog describes how it reduced AI-related engineering spending by monitoring usage across providers, models, token types, teams, and workflows through its Cloud Cost Management platform and an AI gateway. After evaluating models against more than 140 Datadog-specific engineering tasks, the company changed its default model from Claude Opus 4.8 to Sonnet 4.6, accepting an 8% reduction in measured proficiency for a 36.7% cost reduction and attributing more than $687,000 in monthly savings to the shift. It also lowered Claude Code’s default effort setting from high to medium, reporting over $288,000 in monthly savings. Automated cost alerts and workflow-based Slack notifications encouraged users with high spending to adopt savings practices, reducing spending by more than $150,000 over one week among newly alerted users. Datadog also tested the context-optimization tool Headroom, which filters, deduplicates, and compresses tool results before they reach language models; a pilot involving over 1,000 engineers showed 27% lower cost per user and substantially lower token consumption. The company emphasizes continuous evaluation and daily benchmarking to balance model performance, workflow quality, and AI costs.

Federal agencies using discounted enterprise AI offerings through the OneGov initiative face FY27 renewal decisions as promotional pricing for platforms such as OpenAI, Anthropic, and Google Gemini begins expiring on September 30, 2026. The article argues that agencies should establish an evidence-based baseline covering AI licensing, model consumption, infrastructure, support, usage growth, organizational ownership, and vendor-switching costs before choosing whether to renew, reduce, replace, or retire services. Datadog Cloud Cost Management is presented as a tool for consolidating supported AI and cloud cost data, attributing spending to agencies’ internal teams and applications, monitoring anomalies such as unexpected token use or inactive API keys, and forecasting spending under possible new pricing structures. It also recommends assessing costs alongside operational outcomes such as reliability, performance, and mission efficiency, while documenting dependencies including workflows, integrations, training, prompts, and migration requirements. Although OneGov’s low-cost offers reportedly generated substantial federal savings, agencies are encouraged to use the remaining promotional period to evaluate long-term value, control spending, and retain flexibility as procurement terms evolve.

As autonomous AI agents increasingly use self-service platforms, platform teams must adapt Golden Paths—standardized development workflows—to account for agents’ varying needs for low latency, durable execution, and isolated code-running environments. Agent-facing paths should combine probabilistic agent reasoning with deterministic controls such as policy checks, approvals, tests, security scans, and deployment rules, ensuring agents cannot independently bypass consequential safeguards. Platform capabilities must be exposed through structured, machine-consumable interfaces with typed schemas, clear side effects, enforceable limits, idempotency protections, and machine-readable errors, while authoritative service catalogs provide reliable metadata about ownership, dependencies, environments, and permitted actions. Each agent run should begin with an explicit dispatch process that validates a triggering signal, creates a unique task identity, grants short-lived least-privilege access, selects an execution environment, and records outcomes. Workflows also require checkpoints, retry and cost budgets, terminal states, rollback or containment procedures, and comprehensive telemetry and audit records linking agent actions to the user or system authority behind them. The recommended approach is to begin with narrowly bounded workflows, verify that agents operate safely within defined constraints, and expand their authority gradually.

Datadog has expanded observability for Microsoft Azure Functions to address visibility challenges across different runtimes and hosting plans, where traditional agent- or extension-based telemetry collection is not always available. Its Serverless Compatibility Layer supports .NET, Python, Node.js, and Java applications on Linux or Windows, collecting and batching telemetry directly alongside function code. Datadog APM provides distributed tracing across functions, HTTP services, databases, Azure Service Bus, Azure Event Hubs, and Cosmos DB, while linking backend traces to Real User Monitoring sessions and Session Replay for frontend-to-backend investigation. Enhanced CPU metrics sample function usage every second and publish data every 10 seconds, improving detection of brief spikes and enabling proactive alerts. Continuous Profiler, currently in preview for Python and Node.js Azure Functions, captures call stacks and presents flame graphs to help teams identify code paths responsible for CPU or I/O overhead.

OpenTelemetry tail-based sampling reduces observability costs and trace noise by buffering completed traces in the Collector and retaining those that contain errors, exceed latency thresholds, match debugging criteria, or meet other configured policies, unlike head-based sampling, which decides before a request finishes. Reliable tail sampling requires a gateway collector pattern that routes all spans with the same trace ID to one instance, while Span Metrics or RED metrics must be computed before sampling to preserve complete request, error, and latency visibility. Using a synthetic rideshare application, the guide demonstrates a layered policy approach that retains all error and slow traces, explicitly drops low-value successful health checks, reduces sampling for high-volume services, and applies probabilistic fallback sampling to ordinary traffic, reducing exported traces by about 98% while retaining accurate service-health metrics. It also addresses developer workflows through full sampling in development environments and force-sampling attributes, explains that explicit drop policies override sampling policies, and recommends monitoring collector metrics, sizing memory for buffered in-flight traces, tuning decision wait times and trace limits, and gradually refining policies to balance diagnostic value, system performance, and cost.

Datadog Code Security’s AI-native SAST is designed to identify LLM-specific security vulnerabilities earlier in development, addressing limitations of conventional pattern-based static analysis tools. It aligns its coverage with the OWASP Top 10 for LLM Applications, including prompt injection, sensitive-information disclosure, excessive agency, supply-chain risks, data and model poisoning, unbounded consumption, misinformation, hidden-context exposure, vector and embedding weaknesses, and improper output handling. Available for Python, Go, Java, C#, TypeScript, and JavaScript, the system uses LLM-based reasoning about code context and data flow, independently verifies findings, and delivers results through the Datadog platform, pull-request comments, and CI checks. Examples include taint analysis to trace unsanitized user input into LLM prompts, control-flow analysis to detect agents given unrestricted shell or file-system access without authorization checks, and pattern matching to find system prompts or other hidden context exposed through logs or API responses.

Datadog’s Risk Engineering team is developing a Systemic Risk Detection Pipeline and Risk AI Agents to help security teams prioritize organizational exposure by correlating vulnerabilities, incidents, misconfigurations, identities, permissions, asset criticality, and other signals rather than assessing findings in isolation. The approach identifies “risk paths,” where interconnected conditions—such as an internet-facing vulnerable application, excessive workload privileges, and access to sensitive production data—can combine into a more serious threat than any individual finding suggests. Deterministic systems detect known patterns consistently, while AI agents investigate relationships, collect evidence, evaluate contextual factors, map risks to security domains, and suggest mitigations under practitioner oversight. Risks are prioritized using factors including exploitability, internet exposure, privilege levels, potential blast radius, business importance, existing controls, and related incidents, with explainable evidence provided for AI-generated assessments. Datadog also integrates this process with Work Management, Workflow Automation, and Agent Observability to route remediation work, track resolution, and evaluate AI output quality over time.

Datadog developed gitretriever, a distributed Git mirroring system designed to reduce CI bottlenecks caused by expensive repository fetches, particularly from large monorepos and increasing traffic from automated services and AI coding agents. Rather than scaling its replicated GitLab backend, which increased replication overhead, the company separated a small set of GitHub-synchronized mirrors from an autoscaled fleet of relays that distribute repository updates without consensus or repeated upstream fetches. Gitretriever reduces work through branch-level synchronization, content-addressed packfile replication, and a cache for identical fetch requests, while a read-only API lets many workloads retrieve specific Git information without cloning entire repositories. Following a gradual, feature-flagged rollout with automatic fallback, the service handled more than a billion requests across roughly 5,500 repositories, grew traffic about 20-fold in four months while maintaining median latency near 40 milliseconds, and reduced fetch-serving CPU on the prior backend by three to four times. The project was built by two engineers using Claude Code alongside detailed design documentation, integration testing, metrics, and logs, with future plans including wider rollout, expanded API capabilities, and repository copies directly on CI nodes.

CISA’s Binding Operational Directive 26-04 requires U.S. federal agencies to prioritize vulnerability remediation according to asset exposure, inclusion in the Known Exploited Vulnerabilities Catalog, exploit automation potential, and the level of technical control gained by an attacker, with the highest-risk issues requiring fixes within three days and, in some cases, forensic investigation. Replacing the earlier CVSS-centered approach under BOD 19-02, the directive emphasizes risk-based decisions that account for whether vulnerable code is running, reachable, exploitable, business-critical, and assigned to an accountable owner. The post notes that organizations often struggle to gather this context across cloud environments because of fragmented tools, incomplete metadata, and disconnected security and engineering workflows. Datadog presents its Runtime Prioritization Engine as a way to address these challenges by combining runtime, exposure, exploit intelligence, business criticality, ownership, and remediation data to identify actionable vulnerabilities, infer critical assets and responsible teams, and integrate triage and remediation into existing workflows, including AI-assisted operations through its Security MCP toolset.

Cumulative impact from experimentation programs cannot be accurately measured by simply adding observed lifts from statistically significant winning A/B tests, because the winner’s curse causes selected results to be inflated by sampling noise. A randomized holdout offers the most direct estimate by comparing users who retain the original product experience with users who receive all shipped winning variants, and it can capture long-term effects and interactions among changes, but it requires advance setup, sustained feature flags, traffic allocation, and time. Datadog’s Cumulative Impact feature provides a faster model-based alternative for historical or ongoing experiments by using empirical Bayes shrinkage to correct individual estimates and aggregate their likely true effects. This approach depends on experiments being comparable, their effect distribution remaining stable, and treatment interactions being limited, making it suitable when a holdout is impractical but its assumptions are reasonable. Teams may use model-based estimates for routine reporting while reserving holdouts for high-stakes decisions, long-term measurement, or validation.

Datadog Work Management, formerly Case Management, centralizes operational work that is often fragmented across alerts, chat threads, tickets, and AI-agent activities into auditable work items containing telemetry, ownership, status, approvals, artifacts, and history. It integrates with Datadog products including Monitors, Cloud SIEM, Error Tracking, Incident Management, Workflow Automation, and AI agents, while synchronizing with external tools such as Slack, GitHub, Jira, Linear, and ServiceNow. For incident response, alerts can automatically generate work items, preserve Slack discussions, escalate into incidents, and create linked follow-up tickets; for development, AI agents can clarify feature requirements, generate GitHub pull requests, and operate under human approval controls; and for security, Cloud SIEM signals can create cases that support investigation, automation, remediation, and caseload analytics. Custom work types, statuses, kanban views, automation rules, and multiple creation interfaces allow SRE, development, and security teams to retain their existing processes while maintaining a shared record from detection or request intake through resolution.

Datadog now provides tracing for AWS Lambda durable functions, which support long-running, multi-step workflows that can pause, resume, retry, and maintain state across multiple Lambda invocations. Its Node.js and Python tracers automatically instrument durable operations including steps, waits, callbacks, parallel tasks, maps, invokes, and child contexts, combining their telemetry into a single trace and flame graph rather than separate invocation-level traces. Cross-invocation context is stored in an additional Datadog checkpoint that preserves the trace ID without modifying user checkpoint data, enabling users to move from the AWS console to the associated Datadog trace. The integration helps investigate errors, retries, and replayed operations through span tags, attached error details, execution-level operation summaries, and filtering by execution ARN or status. No workflow code changes are required for Lambda functions already using the Datadog Lambda Library and Extension, although retention filters are recommended for very long-running executions. Datadog also offers Serverless View dashboards and metrics to monitor durable execution status, duration, utilization, failures, timeouts, and other behavior across workflows.

Data pipelines ingest, transform, route, store, and deliver data for AI/ML, analytics, and business intelligence systems, making end-to-end monitoring essential for data quality, availability, and application performance. Despite varied architectures such as streaming, ELT, lakehouse, and event-driven systems, effective monitoring focuses on shared priorities including freshness, volume, schema consistency, value distributions, infrastructure health, and job health. Comprehensive visibility depends on standardized traces, metrics, logs, and data lineage, with OpenTelemetry supporting cross-component telemetry and OpenLineage helping trace data transformations and job executions. Key failure modes differ across orchestration, ingestion, storage, processing, serving, and governance layers, ranging from scheduler outages, consumer lag, schema drift, incomplete writes, resource contention, stale warehouse tables, API failures, and access-policy changes. Recommended signals include job success and duration, queue depth, throughput, error rates, storage volumes, query latency, resource use, quality-test results, cache health, and authorization failures, correlated with underlying infrastructure metrics. Datadog’s Data Observability, Data Streams Monitoring, APM, Cloud SIEM, and technology integrations are presented as tools for detecting issues proactively, troubleshooting root causes, tracking lineage, and maintaining reliable data delivery across modern pipeline environments.

Datadog’s Azure integration now supports secretless authentication, replacing client secrets with a federated identity relationship between an Azure app registration in Microsoft Entra ID and Datadog’s OpenID Connect issuer. Rather than storing and rotating long-lived credentials, Datadog presents an OIDC token when requesting Azure telemetry, and Entra ID validates the trust relationship before issuing a short-lived access token. The approach is available for new integrations configured through the Quickstart workflow or Terraform, and existing client-secret-based integrations can migrate without creating a new app registration using the Azure CLI, Terraform, or Azure portal. By eliminating recurring secret rotation and reducing reliance on persistent credentials, the feature aims to lower operational maintenance and prevent telemetry ingestion disruptions caused by expired secrets.

Datadog Product Analytics account segments combine account-level business data, such as ARR, plan, renewal date, region, and customer success owner, with product behavior captured through Real User Monitoring, allowing teams to assess engagement and churn risk at the organization level rather than only by individual user. After enriching account profiles from sources such as Salesforce or Snowflake, teams can create dynamic reusable segments based on both attributes and events, such as enterprise accounts above $50,000 ARR where no user has activated a feature in 30 days. These segments can be applied across retention analyses, funnels, and Pathways to quantify risk, identify points of abandonment, and reveal navigation patterns that may indicate product blockers. In the example, accounts that had not adopted a collaboration feature showed lower retention and failed at the teammate-invitation step, with pathway data suggesting that permissions and role-management confusion prevented administrators from inviting users. Account-level findings can then be filtered by ownership or renewal details and shared with customer success teams to support targeted outreach and investigation.

Datadog’s Java APM agent improves application observability by instrumenting selected classes during JVM startup, but this requires efficient class matching because broad instrumentation can slow startup and increase overhead. To filter large numbers of uninteresting classes before more expensive structural and hierarchy checks, the team replaced a difficult-to-maintain code-based prefix matcher with ClassNameTrie, a compact prefix trie encoded directly as a JVM string constant. This design avoids resource loading and I/O during the constrained premain phase, when Java 8 lacks JIT compilation and loading certain classes can create unwanted application side effects. The encoded trie stores branches, matching outcomes, inline segments, and jump offsets in character values, enabling fast binary-search-based matching with favorable cache locality. Cold-start benchmarks found it nearly five times faster than the prior matcher on Java 8 and faster than a conventional radix trie, while production Spring Boot tests showed that class-name filtering reduced instrumented startup time by 20%, with ClassNameTrie and a related known-types index contributing additional savings for total improvements exceeding 24%. Originally developed for instrumentation filtering, the approach is now also used by Datadog’s Live Debugger and CI Visibility features, illustrating how carefully encoded data can outperform executable code during early JVM startup.

Datadog’s serverless agentic onboarding is designed to reduce the manual effort of instrumenting applications running on AWS Lambda, Google Cloud Run, and Azure Container Apps across varied runtimes and deployment tools. Users can initiate setup through an MCP-compatible AI coding assistant connected to the Datadog MCP Server or through the AI Setup CLI, which examines a local project and generates suitable configuration changes. The system supports AWS SAM, AWS CDK, Serverless Framework, Terraform, and datadog-ci for Lambda workloads, as well as sidecar or in-container approaches for Cloud Run and Azure Container Apps, adapting generated files to each project’s existing structure. It also configures relevant environment variables and standard service, environment, and version tags to support consistent observability. Safety measures include scoped setup questions, local staged changes, permission requirements for AI assistants, and user-controlled review, testing, approval, and deployment, while applying Datadog-recommended Agent versions and telemetry settings.

Kubernetes Security Response Committee record updates for four older, unfixed CVEs may cause scanners to flag more clusters, but affected versions alone do not establish exploitability because each issue requires specific permissions, configurations, and network conditions. The guidance examines CVE-2020-8554 service traffic redirection through ExternalIPs or Service status changes, CVE-2021-25740 endpoint manipulation that can enable cross-namespace routing, CVE-2020-8561 admission webhook abuse combined with highly verbose API server logging, and CVE-2020-8562 proxy or StorageClass-related access to private networks through DNS inconsistencies. It recommends prioritizing multi-tenant and managed clusters, evaluating RBAC, admission controls, network reachability, DNS behavior, and provider-managed settings, then using Kubernetes audit logs to detect relevant Service, endpoint, webhook, verbosity, and proxy activity. Audit logs can identify API actions, identities, and resources but often cannot prove successful exploitation, making network, DNS, and kube-apiserver process logs important for investigations. Organizations are advised to document exposure conditions, controls, detection coverage, approved controller behavior, ownership, and residual risk for each cluster so they can manage findings consistently when patching would disrupt Kubernetes functionality.

Datadog Session Replay, available through Real User Monitoring and Product Analytics, centralizes the process of finding, analyzing, and discussing user-session issues for engineering, product, design, and support teams. Users can locate relevant replays through correlated errors, funnel drop-offs, and filters for attributes such as user, device, browser, and error type, while AI-generated summaries, smart chapters, and timeline friction signals help identify important moments without reviewing an entire recording. Timestamped comments and team mentions remain attached to specific replay moments, notify collaborators, and can be shared through tools such as Jira, Slack, and Confluence, with playlists collecting relevant mentions and commented sessions. The platform is presented as a shared investigation workspace that preserves evidence and discussion from an initial discovery, such as a checkout failure, through engineering fixes and design improvements.

July’s This Month in Datadog highlights conversations about safely evaluating AI-generated code, testing nondeterministic agent behavior, and using natural language through Bits Chat to search, understand, and act on Datadog data. Key preview releases include Bits Release, which validates code changes from pull requests through production rollout, Bits Testing, which autonomously identifies user journeys and creates synthetic test suites, and Bits Memories, which retains team knowledge for use during investigations. Other updates include Bits Live Debugger for runtime code-level data, Datadog Apps for internal applications created by AI agents, RUM support for C and C++ applications, remote RUM configuration through the Datadog MCP Server, and phone-number detection in logs through Sensitive Data Scanner.