Datadog built a two-stage security detection pipeline to make AI-driven threat investigation practical at fleet scale. The first stage is Mambark, a 96.9M-parameter Mamba selective state-space model pretrained on hundreds of billions of audit log events. It scores every event using next-token prediction as an anomaly signal (no labels required), running in linear time to handle sequences of tens of thousands of events. From 10 billion daily events, it surfaces roughly 10,000 suspicious candidates at a cost of tens of dollars per day on commodity GPUs. The second stage is an LLM agent that performs full multi-step investigations only on this prescreened shortlist, keeping its cost similarly low — roughly four orders of magnitude cheaper than applying a frontier model to the raw stream. Mambark uses a uniform tokenization scheme across syslog, authentication, network, and insider-threat data with no hand-engineered features, and matches or exceeds state-of-the-art results on benchmarks including Thunderbird (F1 1.000), BGL (F1 0.999), and UNSW-NB15 (F1 0.994). The pipeline is currently in limited testing with Datadog Cloud SIEM design partners.
