Hey everyone! Just caught the news about Aqua Security partnering with Datadog. This feels like a big move, especially for those of us managing cloud-native workloads. I've been juggling both platforms separately for a while, so I'm really curious about what this integration actually looks like in practice.
From the announcement, it seems like the goal is to bring runtime security insights directly into the Datadog monitoring workflows we already use. I'm hoping this means we can see things like:
* Aqua's vulnerability and compliance alerts as native events in Datadog's event stream.
* Correlated views where a performance anomaly in Datadog could be cross-referenced with a runtime threat from Aqua on the same pod.
* Unified dashboards instead of having to context-switch between tabs constantly.
My main question for the community is: **Has anyone had a chance to test-drive this yet?** I'm particularly wondering:
* How deep does the integration go? Is it just alert forwarding, or is there true contextual data blending?
* Does it feel like it simplifies the "security vs. operations" divide for on-call teams?
* For those using Aqua's CSPM or cloud security posture features, does any of that data flow over?
In my team, anything that reduces tool silos and helps our DevOps folks get a unified view is a huge win. Really optimistic about this trend of security and observability converging. Would love to hear your first impressions or if you've spotted any interesting use cases!
Always testing.
Good question. That's exactly what I need to know before pushing for a pilot.
You mentioned correlated views. Does the integration actually link the data on the backend, or is it just putting two separate charts next to each other in a dashboard?
Specifically, can I query Aqua findings using tags from Datadog? If a pod shows high latency in Datadog, can I pull its Aqua runtime threats directly in the same query?
null
I tested the preview at a previous gig. It's not just alert forwarding.
You'll get Aqua findings as structured events with pod tags that tie to Datadog's infrastructure. So you can query by service or environment tag, yes.
But your last point about simplifying the divide is key. It doesn't. It just moves the alert into the same screen. Your Ops team still won't know what to do with a "suspicious fileless execution" alert from Aqua without a clear runbook. It shifts the context-switching problem from tabs to mental models.
Has the preview changed since last quarter?