Datadog Adds Case Management Integration to Cloud SIEM's Signal Explorer: what changed

Datadog updated Cloud SIEM to let analysts escalate signals into structured cases, surface case context inside the Signal Explorer, and automate response steps and ticketing synchronization.

Datadog has extended Cloud SIEM so analysts can escalate detections from the Signal Explorer directly into a structured Case Management workflow without leaving the platform. The change is designed to reduce context switching by anchoring investigation work to the originating telemetry and keeping the transition from detection to investigation within a single interface.

Within the Signal Explorer queue, each signal now shows a Cases indicator that tells analysts whether a detection is already linked to an active investigation. Hovering over that indicator surfaces inline details — status, ownership and a timeline — allowing triage to continue without opening separate pages. When a signal is escalated, Datadog automatically populates the new case with metadata and investigation details pulled from the originating detection.

Investigations then continue inside the Cases workspace, which tracks ownership, status, evidence and activity for each case. The workspace keeps related logs, signals and entity context together, preserving the telemetry trail that led to the detection. That built‑in lifecycle management is intended to remove routine reliance on external trackers for case handling and to keep investigation context centralized.

Datadog also highlights integrations and automation to close operational gaps. Case Management can be synchronized bidirectionally with ticketing systems such as Jira and with messaging platforms so external workflows reflect in‑platform activity. Workflow Automation lets teams script and run automated response steps and can be used to automate the conversion of received signals into new cases to cut down on manual handoffs during busy triage periods.

The update addresses a common security operations pain point: analysts frequently juggle triage, documentation and remediation across multiple tools, which can slow response and increase the risk of duplicated or missed work. By tracking the relationship between signals and cases and surfacing that state in the queue, the platform aims to provide shared visibility so multiple analysts can quickly see whether work is already underway.

For security teams and builders, the practical benefits are concrete: faster handoffs from detection to investigation, preserved context and telemetry within cases, fewer repetitive data transfers and the potential to accelerate response through automation and ticketing syncs. The design emphasizes workflow continuity — inline case indicators, auto‑populated cases, a centralized Cases workspace and automation hooks for response and ticketing — rather than shifting investigations into a separate external platform. The announcement was authored by Eitan Moriano and Vera Chan.