Detection on the logs you already send,
with a human on the signal at 2am.
Datadog Cloud SIEM runs detection rules on the logs already flowing into Datadog, from cloud audit trails, identity providers, source hosts and the applications themselves, and raises a signal when a rule matches. We connect the sources that carry signal, tune the rules until the signals are worth waking for, and operate it every month. Under Critical Support, our engineers are the ones who wake.
Quick facts
Related
- Log Management, the pipelines and indexes the rules read from
- Cloud Workload Protection, the threat seen on the host rather than in the log
- Incident Management, where the signal becomes the incident we run
The SIEM that reads the logs the engineers were already paying to send
A separate SIEM means a second pipeline, a second agent, a second set of parsers and a second retention policy to maintain. Datadog Cloud SIEM reads the logs that are already arriving for the operations team. The console-login-from-a-new-country rule runs on the same CloudTrail stream the on-call engineer uses to find out who changed the security group.
Detection in seconds, with the logs kept. Rules run on logs as they arrive, so a signal fires within seconds of the event. On the current product the logs Cloud SIEM analyses are indexed and searchable for twelve months, so the investigation reads the same data the rule did.
A pack per source, with health built in. Content Packs bundle the rules, parsers, dashboards and workflows for a source. The pack reports whether the source is arriving and parsing, so a rule with nothing to match is visible as such.
Signals that become cases, with the trail kept. Signals are grouped by rule and severity, explored in one place, and promoted into Case Management when they need a record. Each signal is kept for fifteen months.
The security view the on-call already has. The signal, the log that fired it, the host, the trace and the deploy that preceded it are one screen. Bits Security Analyst can draft the investigation. Bits Threat Hunting, in Preview, surfaces indicators nobody wrote a rule for.
Every log analysed, every rule on, and a signal channel nobody is on the rota for
How it bills. Cloud SIEM is billed on the logs it analyses. On Standalone, the default product for new organisations, the meter is gigabytes analysed per month, and indexing those logs with twelve months of retention is included in it. Organisations on the older Cloud SIEM products are metered in millions of analysed events, with indexing billed separately under Log Management. Datadog publishes the meters and rates. The lever is the analysed scope. An application's debug stream and its authentication events cost the same to analyse, and only one of them has a rule worth writing. We set the scope by source before the first rule is enabled.
The configuration traps. Cloud SIEM enabled on every log in the organisation, so the analysed meter is set by whichever service logs the most and the bill arrives before the first useful signal. Every Content Pack rule switched on with the defaults, so the first week produces hundreds of signals, most of them the same rule firing on a scheduled job. Cloud audit logs, identity provider logs and source host audit logs never connected, so the rules that detect credential misuse have nothing to read, and the dashboard shows green because the application logs are flowing. Signals routed to a shared channel with no rota behind it, so the signal that matters arrives at 2am and is read at 9. Suppressions added during the noisy first week with no expiry, so a rule that was tuned out for a migration never fires again.
Field noteThe most common gap we see is that the security sources are not the ones in Datadog. The application logs are there because the engineers needed them. CloudTrail, the identity provider and the GitHub audit log were never sent, because nobody on the operations side needed them, and the SIEM was switched on over the logs that were there.
Field noteThe pattern we keep finding is a rule set that was tuned once, in the first fortnight, and never again. The scheduled job that fired the rule was suppressed. The suppression outlived the job, and the next thing to match that rule was not a scheduled job.
Field noteThe pattern we keep finding is a security signal routed to a shared channel that no rota covers. Cloud SIEM raises it with a severity, the channel receives it, and the people who would act on it are asleep. The signal that mattered is read the next morning, after the session it described has ended.
Field noteThe analysed-logs bill is the one that surprises finance, because it moved when a service turned on verbose logging and nobody connected the two. Log volume is an operations decision with a security price attached.
Sources first. Scope second. A rota before the first rule is allowed to page.
The Threat Management Accelerator is a four-week, fixed-scope delivery. If Log Management is not yet in good order, with pipelines parsing and unified service tags in place, that is fixed first, because every rule depends on the fields the parser produced. The sequence inside the accelerator is the same either way.
- List the sources that carry signal. Cloud audit trails, identity provider logs, source host audit logs, endpoint and network tooling, and the application logs that record authentication. Each with its owner and whether it is already in Datadog.
- Connect what is missing and activate the packs. Each source through its Content Pack, with the parser checked against real events. Health monitoring confirmed green before any rule is trusted.
- Set the analysed scope. The sources that need detection are analysed. Everything else is excluded from the analysed meter in writing, and its index and archive decisions stay with Log Management.
- Choose the rules and run them quiet. Pack rules enabled for the sources in scope, run for a fortnight with no paging. Each signal is read. Rules firing on known-good activity are tuned, and every suppression gets a reason and an expiry.
- Route by severity, to a rota. High-severity signals page the on-call. Under Critical Support that is our engineers, 24x7. Lower severities open a case or a ticket to a named team. The escalation into your security team or MDR provider is written down and tested.
- Hand over, in writing. Sources connected and their health, analysed scope, rules in force, suppressions with reasons and expiries, routing and escalation map, and the open signals and cases on the day we finished.
Access is admin on the Datadog organisation and read access to the audit and identity log sources, through your cloud and identity integrations rather than through credentials we hold. We do not need access to your endpoints or your network tooling. Their logs reach us through Datadog, and their consoles stay yours.
A SIEM is only as current as the last source somebody connected
A new cloud account is created and its audit trail goes nowhere. A parser breaks when a vendor changes a log format. A suppression outlives the migration it was written for. Managed Observability is the monthly service that keeps the sources, the scope and the rules matching the estate as it is now.
Every month, the signals are reviewed by rule. Which rules fired, which were true, which were suppressed and why. Rules with a high false positive rate are tuned. Suppressions past their expiry are reopened or renewed with a reason.
Sources follow the estate. New accounts, tenants and repositories are connected when they appear, and their packs activated. Pack health is checked, so a parser that stopped matching is found before the rule it feeds is needed.
The analysed scope is kept honest. Analysed volume by source is read against the scope that was agreed. A service that started logging verbosely into an analysed source is raised with its owner before it sets the bill.
The signal is contained, not forwarded. Under Critical Support a high-severity signal pages our engineers, 24x7. They contain what sits in the runtime we operate, open the case, and hand the rest to your security team with the evidence attached.
We operate the stack. You own the product.
We are not a security company, and we are not a managed detection and response provider. We are a managed runtime operator. We run the detection rules inside your Datadog, keep the sources flowing and the scope honest, and take the signal when it fires. We contain what sits in the runtime we operate and hand the rest to your security team or your MDR provider with the evidence attached. We operate and evidence the runtime controls that support your compliance obligations. The security policy, the response decisions and the relationship with your regulator stay yours.
Datadog is our proof, not our headline. Datadog certified one managed provider globally. We are it. The Powered by Datadog accreditation means Datadog's own engineers reviewed how we instrument, alert, respond and report. We are also a Datadog Advanced Partner, ISO 27001 certified and Cyber Essentials Plus certified, with offices in Cardiff, London and Dublin.
Datadog Cloud SIEM, answered plainly
Do we need to index logs for Datadog Cloud SIEM to analyse them?
It depends on the Cloud SIEM product. On Standalone, the default for new organisations, Cloud SIEM analyses the logs that match the filter on its own index, and those logs are indexed and kept for twelve months as part of the product. A log that does not match that filter is neither indexed nor analysed. On the older Add-on and Legacy products, security filters decide what is analysed, separately from the Log Management indexes. Either way the trap is the same: the analysed scope is set in one place and the rest of the log estate in another. A source that was never sent to Datadog at all is analysed by nobody.
How is Datadog Cloud SIEM billed?
Cloud SIEM is billed on the logs it analyses. On Standalone, the default product for new organisations, the meter is gigabytes analysed per month, and indexing those logs with twelve months of retention is included. Organisations on the older Cloud SIEM products are metered in millions of analysed events, with indexing billed separately under Log Management. Datadog publishes the current meters and rates. We do not publish prices. We do decide, with you, which log sources are in the analysed scope, because an application's debug logs cost the same to analyse as its authentication logs and carry none of the signal.
What are Datadog Cloud SIEM Content Packs?
A Content Pack is the bundle for one log source: the detection rules written for it, the dashboards, the parsers that turn its logs into fields the rules can match, and the response workflows that fit it. There are packs for cloud audit trails, identity providers, source hosts, endpoint tools and more. Activating a pack is one step. Checking that the source is actually arriving, parsed and matching is the step after, and each pack has health monitoring that shows whether it is.
Is Critical Cloud a managed detection and response provider?
No. We are a managed runtime operator. We run the detection rules inside your Datadog, and keep the sources flowing and the rules tuned. Under Critical Support our engineers take the signal 24x7 and contain what sits in the runtime we operate. The rest goes to your security team or your MDR provider with the evidence attached. Threat hunting as a service, forensics and security strategy are not what we do. Where you already have an MDR provider, the signals reach them through the same routing.
What does Critical Cloud do with Cloud SIEM every month?
Managed Observability reviews the signals by rule and by false positive rate, and tunes or suppresses the rules that fired without cause. It checks that every Content Pack is still receiving and parsing its source, and re-confirms the analysed log scope as new services and accounts appear. It reports what fired, what was contained and what was routed. Under Critical Support a high-severity signal pages our engineers, 24x7, and they contain the runtime while the owner is told.
- Datadog products: every product, and how we implement and run each one
- Log Management and Bits Security Analyst: the logs the rules read, and the agent that drafts the investigation
- Threat Management Accelerator: sources, scope, rules and the rota, in four weeks
The sources connected. The rules tuned. Somebody awake.
Tell us which logs are already in Datadog and who is on the rota tonight. We will show you which security sources are missing, what Datadog Cloud SIEM would have raised last month, and what it takes to run it.