Every signal investigated.
Every verdict decided by a person.
Datadog Bits Security Analyst takes a Cloud SIEM signal and runs the investigation an analyst would run across the related logs and identities. It returns a conclusion, the evidence behind it and the suggested next steps. We scope it by rule and severity, load the context about your estate, and keep the decision where it belongs: an engineer reads the conclusion and takes the action. Agents own the analysis. Humans own the outcome.
Quick facts
Related
- Cloud SIEM, the detection rules that raise the signals
- Cloud Workload Protection, the runtime threats behind some of them
- Bits AI, the whole family and the guardrails
The triage an analyst would do, done on every signal, with the working shown
Cloud SIEM raises a signal: a user signed in from a new country and then created an access key. A good analyst would check the identity provider for the session, the recent activity for that user, whether the key was used, and from where. That takes a person real time on every signal, and there are more signals than people. Bits Security Analyst runs those checks on each eligible signal and writes down what it found.
Input: the signal, and the logs around it. Signals from eligible Cloud SIEM rules above medium severity, with the related logs from sources such as AWS CloudTrail, Amazon GuardDuty, Okta, Microsoft Entra ID, GitHub and Slack. Some sources need credentials stored through Actions Catalog connections.
Output: a conclusion you can audit. The side panel shows an overall conclusion, the key evidence it rests on, each investigative step with its query, its result and its analysis, and suggested next steps, including suppressions for specific attributes. It makes a recommendation on the verdict.
Where the engineer sits: on the action. The agent recommends. The person reads the conclusion and, from the same side panel, creates a work item, runs a SOAR workflow, declares an incident, adds a suppression, or archives the signal. Under Critical Support that person is our engineer for the operated runtime.
Context that makes it yours. Knowledge sources, including the general organisation context and situational entries, tell the analyst which accounts are service accounts, which countries the team works from and which activity is expected. Feedback on each analysis is recorded.
Scoped to every rule, with no context about the estate, and a recommendation treated as a decision
How it bills. Bits Security Analyst is part of Cloud SIEM and requires a non-legacy Cloud SIEM plan. Datadog announced it generally available in March 2026. Datadog's Cloud SIEM pricing includes a monthly allotment of Bits Security Analyst investigations that scales with the volume of data analysed, with a minimum. Datadog does not publish how investigations beyond the allotment are billed, so we confirm that with Datadog at the start of each engagement. We publish no rates. The lever is scope: which rules, above which severity, are investigated.
The configuration traps. The analyst is enabled for every eligible rule with the default minimum severity, so it spends its effort on signals the team had already decided to ignore. The knowledge sources are empty, so a deployment pipeline that signs in from a data centre is investigated as a suspicious user every day. Log sources that need credentials were never connected, so the investigation runs without those sources and the conclusion is drawn from half the evidence. The conclusion is read as a verdict, a Benign label closes the signal without a person looking at the evidence, and the one that was wrong is found during the next audit. None of these is the agent failing. It is an agent investigating within a scope nobody set, with context nobody gave it.
Field noteThe most common gap we see is the missing context. The analyst is accurate about the logs and knows nothing about the estate. The nightly batch job that assumes a role from a fixed address is investigated as a credential misuse until a sentence in the knowledge sources says what it is.
Field noteThe pattern we keep finding is the Benign label treated as closure. The analyst recommends, the signal is archived in bulk because the label said Benign, and the one mislabelled signal in the batch is found at the next audit, not at a review.
Field noteLog sources that need credentials are left unconnected because the credentials sit with another team and the connection was never scheduled. The analyst needs those credentials to run or enrich investigations on that source, so the signals that depend on the identity provider get a thinner investigation, or none.
Field noteThe signals that most reward the analyst are the ones with a long investigation path across several sources, which are also the ones the team had been skipping. Once those are scoped in, the team reads fewer signals and the ones they read matter.
Scope by rule and severity. Connect every source it needs. Decide who reads the conclusion.
The Threat Management Accelerator is a four-week, fixed-scope delivery that sets up Cloud SIEM, its Content Packs and Bits Security Analyst together. The analyst is configured in the final week, after the detection rules are tuned, because an analyst investigating signals from rules that will be rewritten is effort spent on the wrong rules. Where Cloud SIEM is already running, a Datadog HealthScan reports the rule set and the signal volumes first.
- Tune the rules before the analyst sees them. Cloud SIEM rules reviewed against the estate, with the noisy and irrelevant ones disabled or suppressed. The analyst is pointed at signals a person would have wanted investigated.
- Scope the analyst per rule. In Security settings, enable it for the rules that matter, each with a minimum severity, or with a signal query filter. Everything else stays out of scope until the first month's review.
- Connect the log sources it needs. Credentials for sources such as the identity provider stored through Actions Catalog connections, so each investigative step can actually run. An investigation that stops at step two is not an investigation.
- Write the knowledge sources. The general organisation context: service accounts, expected countries and addresses, scheduled jobs, pipelines that assume roles. Situational entries for anything temporary. This is where false conclusions are prevented.
- Define who reads the conclusion. A written rule that no signal is archived or suppressed on the analyst's recommendation until a named engineer has read the evidence. Under Critical Support that engineer is ours for the operated runtime. Feedback is given on every analysis.
- Run it on last month's signals and hand over. The scoped analyst is compared with the decisions the team took on recent signals, the differences are written up, and the scope, the sources, the knowledge sources and the reading rule are documented.
Access is admin on the Datadog organisation including the Bits Security Analyst Config Write permission, and the credentials for the log sources the analyst needs, which you store in your own Actions Catalog connections. We do not hold them.
The analyst was right about the estate as it was when the knowledge sources were written
New accounts, new countries, new pipelines, new rules from Content Packs. Every one changes what a correct conclusion looks like. Managed Observability reviews the analyst's conclusions against the decisions engineers took every month, and under Critical Support our engineers take the response for anything in the runtime we operate. We operate the detection runtime. We do not pretend to be a security company.
Every month, conclusions meet decisions. Each analysis's conclusion against what the engineer decided after reading the evidence. Agreements, disagreements and the reasons. A rule whose signals are mostly mislabelled is rescoped or its context is fixed.
Scope follows the rule set. When Cloud SIEM rules are added, tuned or retired, the analyst's scope and minimum severities move with them, in the same change.
The knowledge sources are kept true. New service accounts, new office locations and new scheduled jobs go into the general organisation context the week they appear, so the analyst does not rediscover them as suspicious.
The response is ours when the runtime is. Under Critical Support our engineer reads the conclusion, takes the response action for anything in the operated runtime, 24x7, and records the decision against the signal. We operate and evidence the runtime controls that support your compliance obligations.
We operate the stack. You own the product.
We are not a security company, and we do not pretend to be. We are a managed runtime operator. We run Cloud SIEM and its analyst inside your Datadog, read what the analyst concludes, take the response for what sits in the runtime we operate, and route the rest with the evidence attached. The policy, the auditor and the decisions stay yours. The scope, the knowledge sources and the record of every decision stay in your Datadog.
Datadog is our proof, not our headline. Datadog certified one managed provider globally. We are it. The Powered by Datadog accreditation means Datadog's own engineers reviewed how we instrument, alert, respond and report. We are also a Datadog Advanced Partner, ISO 27001 certified and Cyber Essentials Plus certified, with offices in Cardiff, London and Dublin.
Datadog Bits Security Analyst, answered plainly
Is Bits Security Analyst generally available?
Yes. Datadog announced it in Preview in June 2025 and generally available in March 2026, as part of Cloud SIEM. It requires a non-legacy Cloud SIEM plan and is not available on the Datadog government sites. It is enabled by an administrator in the Security settings and scoped per rule, with a minimum severity, or by a signal query filter. We confirm its current status and scope options against Datadog's documentation at the start of each engagement.
How is Datadog Bits Security Analyst billed?
It is part of Cloud SIEM and requires a non-legacy Cloud SIEM plan. Datadog's Cloud SIEM pricing includes a monthly allotment of Bits Security Analyst investigations that scales with the volume of data analysed, with a minimum. Datadog does not publish how investigations beyond the allotment are billed, so we confirm that with Datadog before anything is enabled. We do not publish prices. The lever is scope: which rules, above which severity, the analyst investigates, which is set deliberately and reviewed monthly.
Does Bits Security Analyst take action on a threat?
It recommends. For each eligible signal it returns an overall conclusion, the key evidence, each investigative step with its query and result, and suggested next steps, including suppressions. The response actions, creating a work item, running a SOAR workflow, declaring an incident, adding a suppression or archiving the signal, are taken by a person from the signal side panel. Our rule is that no signal is archived or suppressed on the analyst's recommendation until a named engineer has read the evidence.
How does it know which activity is normal for us?
Only from what it is told. Knowledge sources hold the general organisation context, such as service accounts, expected countries and scheduled jobs, and situational entries for anything temporary. Without them the analyst investigates a nightly batch job assuming a role as a credential misuse, correctly on the logs and wrongly on the facts. Writing and maintaining those sources is a large part of the implementation and of the monthly review.
What does Critical Cloud do with Bits Security Analyst every month?
Under Managed Observability we review each analysis's conclusion against the decision an engineer took after reading the evidence. We rescope rules whose signals are mostly mislabelled, move the scope and severities when Cloud SIEM rules change, and update the knowledge sources with new accounts, locations and jobs. Under Critical Support our engineer takes the response action for anything in the runtime we operate, 24x7, and records the decision against the signal. We operate and evidence the runtime controls that support your compliance obligations.
- Datadog products: every product, and how we implement and run each one
- Cloud SIEM: the detection rules, Content Packs and signals the analyst investigates
- Threat Management Accelerator: Cloud SIEM and the analyst set up in four weeks
- Security operations: how we operate the detection runtime
Every signal investigated. Every decision made by a person.
Tell us how many Cloud SIEM signals arrived last month and how many were read. We will show you what the analyst would have concluded on them, what it needs to know about your estate first, and who should be taking the decision.