Datadog pairs small AI model with reasoning agent to cut security log costs

Datadog announced Mambark, a state-space model designed to make AI-driven security investigation economical at fleet scale. The problem the company sought to solve is fundamental: AI reasoning agents excel at security investigation—given a suspicious authentication event, an agent can retrieve the user's recent activity, check an asset's patch level, consult threat intelligence, and explain whether the event represents a genuine threat. That kind of deep reasoning is what security analysts perform, but it cannot scale to raw event streams. For a large enterprise, scoring every security-relevant event with a frontier LLM would cost tens of millions of dollars a day. Reasoning is powerful, but too expensive to apply universally.

Mambark is a Mamba selective state-space model with approximately 96.9 million parameters. It begins from a simple premise: any next-token language model is already an anomaly detector. A model trained to predict the next event in a stream assigns each observed event a probability. If the model assigns low probability to an event because it did not expect it given everything that came before, the event is surprising by definition. Its negative log-likelihood becomes an anomaly score, requiring no labeled training data. The architecture choice matters because real attacks unfold slowly—a session can span thousands of events, and a slow-and-low intrusion many more. Unlike a transformer, whose attention cost grows quadratically with sequence length, a state-space model runs in linear time. Mambark can condition on contexts spanning tens of thousands of events on a single GPU, where a comparable transformer would not fit.

To make the model practical across diverse security sources, Datadog normalized every data type the same way. Security telemetry comes in many forms—syslog, authentication records, network flows, and insider-threat activity. The company groups events by entity, flattens each event into a fixed field structure, and hashes every field into a shared vocabulary. The model never sees which data source produced a token; only the set of fields changes from source to source. The architecture, tokenizer, and training recipe remain identical, with no hand-engineered features. Mambark was pretrained for next-event prediction across hundreds of billions of security events, teaching it the structure of normal activity.

In production, Mambark and the AI agent work as a two-stage detection pipeline. Stage one is Mambark: it scores every event in the stream in a single forward pass and promotes only the most surprising ones—on the order of 10,000 candidates a day out of 10 billion events. That sweep costs roughly tens of dollars per day on commodity GPUs. Stage two is the agent: it receives the shortlist, runs a full multistep investigation on each candidate, and produces an explained, actionable verdict. Because it operates only on a prescreened shortlist, its cost also remains in the tens of dollars per day, roughly four orders of magnitude less than applying an agent to the raw event stream.

Across public benchmarks, Mambark achieved strong results. On the established log anomaly benchmarks Thunderbird, BGL, HDFS, and UNSW-NB15, Mambark reached perfect or near-perfect performance, with F1 scores of 1.000 on Thunderbird, 0.999 on BGL, 0.941 on HDFS, and 0.994 on UNSW-NB15. On more challenging datasets where a small number of malicious events hide among millions of benign ones, it remained competitive with specialized, hand-tuned architectures: AUC 0.987 on LANL Cyber1 and AUC 0.879 on CERT Insider Threat. These results were achieved using the same backbone across every modality, demonstrating that a single backbone can generalize across diverse security tasks.

The value of the two-stage architecture extends beyond cost. Mambark provides recall at scale—every event is scored, rather than relying solely on human-authored rules to surface suspicious activity. The agent provides precision and explanation: each surfaced candidate is investigated with the full reasoning capacity of a frontier model. Running the agent only on prescreened candidates also bounds the blast radius of an overconfident or hallucinated action. The detection mode is currently being tested with a small group of Datadog Cloud SIEM design partners and is not yet a generally available product. Datadog shared it now because it points toward where its security products are headed: a next generation in which a small, universal model reads every event and an agent reasons over what it surfaces.

The core problem Datadog identified is a classic scale-cost tension in security: AI reasoning systems excel at investigation but are too expensive to apply universally, while rule-based systems miss novel threats. The company solved this by borrowing a two-stage design from information retrieval—a fast, cheap retriever (Mambark) narrows the field to the most anomalous events, and a slower, expensive reasoner (the AI agent) investigates only those candidates.

Mambark's design reflects two key insights. First, any language model trained to predict the next event in a sequence is implicitly an anomaly detector—events assigned low probability are surprising and suspicious by definition. Second, the Mamba state-space architecture runs in linear time with sequence length, allowing the model to condition on tens of thousands of events on a single GPU, where a transformer's quadratic attention cost would be prohibitive. This is critical because real attacks often unfold slowly across many events. The model generalizes across heterogeneous data sources (syslog, authentication records, network flows, insider-threat activity) by normalizing everything into a uniform structure and hashing fields into a shared vocabulary, eliminating the need for hand-engineered features.

On public benchmarks, Mambark achieves near-perfect performance on standard datasets (F1 1.000 on Thunderbird, 0.999 on BGL) and remains competitive on harder, real-world datasets where malicious events are sparse (AUC 0.987 on LANL Cyber1, 0.879 on CERT Insider Threat). The two-stage architecture combines the model's broad coverage with the agent's precision: Mambark guarantees that no event is missed, while the agent ensures each flagged candidate receives reasoned, explainable investigation. Neither component alone reaches the same operating point, and the combined cost structure makes agent-driven security practical at enterprise scale.

No comments yet. Be the first to share your thoughts!