Datadog

Datadog Cloud SIEM is the security information and event management product from Datadog, a company best known for infrastructure and application monitoring. It reads logs and other telemetry from cloud and on-premises systems, runs detection rules against them as they arrive, and raises security signals that analysts can investigate, group into cases and hand to automated workflows. It sits on top of Datadog Log Management, so the same ingested logs serve operations and security teams.

The vendor presents it as a cloud-native alternative to older SIEM tools that struggle with cloud-scale volume, and ships packaged content such as detection rules, dashboards and parsers to cut set-up time. It is sold as one product within the wider Datadog platform, and it is billed by the volume of logs it analyses. A natural buyer is an organization that already sends logs to Datadog and wants threat detection in the same console.

• Detection rules. More than 800 out-of-the-box rules are maintained by Datadog's detection engineers and are enabled automatically for existing customers. Rules map to MITRE ATT&CK, and a rule editor lets you change them or write your own without a proprietary query language.
• Content packs. Each pack bundles the integration set-up steps, detection rules, dashboards, parsers and SOAR workflows for a log source. After activation, a health view shows whether a pack is working and gives troubleshooting steps when it breaks.
• Log search and storage choices. Security logs can sit in standard indexing for frequent queries, Flex Logs for long retention with occasional urgent queries, or log archives for rarely used data. Log Explorer and Log Workspaces handle searches, tables and charts.
• Risk-based prioritisation. Entity analytics scores users, services and cloud resources, and risk insight notifications fire when an entity crosses a threshold you set. The vendor adds graph-based views to investigate root cause across more than 15 months of history.
• Bits Security Analyst. This AI agent investigates SIEM signals on its own and returns a reasoned conclusion with investigative context. The pricing note says 100 free investigations per month come with every 1 TB analysed, with a minimum of 50.
• SOAR workflows and case management. Pre-built workflows automate triage and remediation, with over 1,000 actions to assemble custom ones. Cases can be created automatically or by hand. Workflows triggered by security findings and signals are free, others are billed separately.
• Log routing and OCSF. Logs arrive through 1,000+ integrations, the API or Observability Pipelines. A guided processor normalises logs into OCSF, and routing can send network, firewall and audit logs where security needs them.

• A 200-person SaaS company already on Datadog. The platform team sends cloud audit logs, identity provider logs and Kubernetes logs it already ships, activates content packs for each, and gets detections without a second tool. Billing grows with every log source added.
• A security team replacing an on-premises SIEM. The vendor publishes migration material and offers packaged content for quick onboarding. The team can write custom rules for old detections, since custom rule analysis adds no charge beyond the analysed gigabytes.
• A small SOC drowning in alerts. Risk scoring, entity views and the Bits Security Analyst agent help rank signals and close false positives. Case management gathers evidence in one place and hooks into ticketing and chat integrations.

New customers start with a 14-day free trial of the whole Datadog product suite. Inside the app you open Cloud SIEM, click Enable Cloud SIEM and follow the onboarding steps, which guide you to activate content packs for your log sources and send logs through the Datadog Agent, an API integration or Observability Pipelines.

The Overview page then lists enabled content packs, their health, logs analysed, top signals by geography, MITRE ATT&CK coverage, and detection metrics such as mean time to detect. A separate getting started guide in the docs covers details. The vendor offers enablement webinars and a demo, and says packaged content spares teams from building their own rules and dashboards first.

Datadog Cloud SIEM bills per GB of logs analysed each month, with a published annual rate and a higher on-demand rate, and keeps 12 months of searchable security data. It suits teams already sending logs to Datadog.

The meter is the catch: every added log source raises the bill, workflows triggered by non-security events are billed separately, and volume discounts start only at 1.2 billion events a month.

In our SIEM software ranking Datadog stands at #7 of 12: the products next to it are Sumo Logic above and Rapid7 InsightIDR below. No numeric score is attached; established products follow the challengers in their ranked order.

By headquarters, 10 of the 12 are established in North America, as Datadog is in the United States.

Pricing as recorded: Per GB of logs analysed per month, published; trial offered; volume discounts from sales.

The pricing page prints Cloud SIEM from $5 per GB analysed per month on an annual commitment, or $7.50 per GB on demand, with 12 months of analysis and retention. Included: more than 800 detection rules, custom rules at no extra charge, 15 months of retention for generated security signals, and free investigations from Bits Security Analyst as described above. Automation workflows triggered by non-security events are billed separately. Multi-year and volume discounts are available from 1.2 billion events per month, on request. Storage in Log Management indexes, Flex Logs or archives is a separate Datadog log charge, and the page lists no flat per-seat price.

Source: the pricing material on datadoghq.com, as read for Best SIEM Software in 2026 and last reviewed on 5 November 2026.

Datadog covers more ground than anything else here, and the integrations mean a new service is visible the day it ships.

OTLP is supported, but profiling, database monitoring and live container views need the agent.

Datadog runs independent regional sites, and the docs list EU1 (Germany), UK1, three US sites, AP1 (Japan) and AP2 (Australia); data does not move between sites. The pricing page notes that Cloud SIEM is currently unavailable on the US-FED site.

Cloud SIEM analyses only the logs you send to it. Certifications, encryption details and data export options are not stated on the product and pricing pages fetched, so check the Trust Hub.

Integrations the vendor names (9):

• 1,000+ out-of-the-box integrations
• Datadog Agent
• Observability Pipelines
• OCSF processor
• Ticketing portals
• Chat systems
• Remediation tools
• MITRE ATT&CK mapping
• SOAR workflow actions

Also in our records:

• Datadog covers more ground than anything else here, and the integrations mean a new service is visible the day it ships.

4 products in this guide come closest to Datadog on tags, pricing and region.

A full write-up exists: Datadog alternatives, with reasons buyers leave and what moving involves.

• Elastic Security (#3 of 12): Aimed at: Teams with search skills that want per-gigabyte billing and a self-run exit. (Netherlands)
• Exabeam (#4 of 12): Not for: buyers who need public prices before a first conversation. Cloud SIEM or on-premises LogRhythm, both sold through sales.
• Microsoft Sentinel (#9 of 12): Not for: teams wanting a self-run SIEM or a flat per-organisation fee. Azure-native SIEM billed by ingestion, with a separate data lake tier. (United States)
• Splunk Enterprise Security (#11 of 12): Splunk's SIEM in Essentials and Premier editions, priced by quote. Suits: Large security teams that already run Splunk for logs and want one vendor.

When Datadog is still the right call: Datadog is worth keeping when coverage is the requirement: infrastructure, APM, logs, real user monitoring, synthetics and security in one console, with an integration for whatever you already run, so a new service is visible the day it ships. An organisation that wants every observability product from one vendor, and has someone watching tags and retention, will struggle to match that with one alternative.

Read from the vendor’s own pages on 5 November 2026.

• datadoghq.com/product/cloud-siem: Features, rule count, SOAR, integrations, 14-day trial
• datadoghq.com/pricing/?product=cloud-siem: Per-GB price, retention, Bits Security Analyst allowance, FAQ
• docs.datadoghq.com/security/cloud_siem: Overview, log storage options, content packs, getting started steps
• docs.datadoghq.com/getting_started/site: Datadog sites and locations

We rank on what separates products after the demo: time to useful, the real price, the exit and who the product is for. Datadog ends up at #7 among 12. Read the editorial process for the method and where paid visibility fits in.