Hybrid Cloud Security Monitoring with Datadog: What Covers On-Premises Servers

Hybrid cloud security monitoring applies the same detection, vulnerability scanning, and configuration checks to on-premises servers as to cloud workloads, and Datadog covers most of it from one platform. The Datadog Agent brings runtime detection, file integrity monitoring, vulnerability scanning, CIS benchmarks, and Cloud SIEM log collection to on-premises Linux and Windows servers. The open questions are devices that cannot run the Agent and where security data may go.

Which Datadog Security Features Work on On-Premises Servers

Datadog security features that run through the Agent work on on-premises servers. Features that read cloud provider APIs apply only to AWS, Azure, and GCP. With one Agent and one console, a hybrid company can cover runtime detection, file integrity monitoring, host vulnerability scanning, hardening checks, and log-based detection in both environments.

Datadog Workload Protection Adds File Integrity Monitoring to On-Premises Servers

Datadog Workload Protection monitors process, file, network, and kernel activity on each host and alerts on threats in real time. It covers more than 40 event types, using eBPF on Linux and a kernel driver on Windows. Rules can also respond to a threat by terminating a process or container, or blocking network traffic with an eBPF-based filter.

File integrity monitoring is the Workload Protection feature that on-premises teams tend to need most for audits. PCI DSS requires a change-detection mechanism on critical files, and SOC 2 CC6.8 asks how the company prevents or detects unauthorized or malicious software. Cloud workloads often rely on immutable images and redeployment for this. On a long-lived physical server, file integrity monitoring is typically the main evidence that changes to system files, configuration files, and binaries were expected.

The SOC 2 endpoint security guide for on-premises environments covers how that evidence fits alongside endpoint protection.

Datadog Vulnerability Scanning and CIS Benchmarks Cover On-Premises Hosts

Agent-based vulnerability scanning works on AWS, Azure, GCP, and on-premises Linux and Windows hosts, and evaluates hosts and containers every hour. Agentless scanning needs no Agent but works only in the three public clouds.

Datadog host misconfiguration checks cover CIS benchmarks for Ubuntu 20.04, 22.04, and 24.04, Red Hat 7, 8, and 9, Amazon Linux 2 and 2023, AlmaLinux 9, Docker, and Kubernetes. They run on the host through the Agent's compliance setting, wherever the host is.

An on-premises vulnerability scanning program needs two adjustments:

• Devices without an Agent need another method. Firewalls, switches, storage controllers, hypervisor management interfaces, and out-of-band management cards cannot run the Datadog Agent. They need a network scanner or a documented manual version check.
• Scanning cadence can follow risk tiers. One company we worked with had run entirely on-premises for over 15 years and was setting up its first vulnerability scanning program. It scanned internet-facing and management systems (VPN, jump servers) weekly, internal systems quarterly, and low-risk device management interfaces annually by manual version review. SOC 2 CC7.1 requires vulnerability identification and leaves the cadence to the company. With the Agent, the first two tiers get hourly scanning; the third stays manual.

The on-prem vulnerability scanning guide and the on-prem patch management guide cover the policy side. The Datadog Cloud Security Management guide covers these features in more depth, and the Datadog vs Wazuh vs Nessus scanner comparison covers scanning the devices the Agent cannot reach.

Datadog Compliance Reports Cover Cloud Resources; CIS Results Cover On-Premises Hosts

Datadog's supported frameworks list labels SOC 2, ISO 27001, HIPAA, and PCI DSS as Cloud rules, and the CIS Linux, Docker, and Kubernetes benchmarks as Infrastructure rules that apply to Agent installations. A hybrid company therefore ends up with two sets of configuration evidence:

• Cloud accounts: the Datadog SOC 2 or ISO 27001 framework report, with pass/fail by control.
• On-premises hosts: CIS benchmark results per host, plus the company's hardening standard naming the benchmark it follows and the exceptions it accepts.

Auditors typically accept both when the control narrative states that the CIS benchmark is the configuration baseline for physical servers and that Datadog checks it automatically. Teams that want a single view can build a custom framework in Datadog that combines cloud and infrastructure rules. The hybrid and on-prem SOC 2 scoping guide covers how to draw the boundary between the cloud and on-premises parts of the audit scope.

Datadog Sends On-Premises Security Data to Its Cloud

Datadog analyzes, stores, and alerts on security data in its own cloud. On-premises servers need outbound access to Datadog's intake endpoints, directly or through an HTTP proxy. Datadog recommends a proxy such as Squid for hosts without direct internet access.

For many hybrid companies, the data review takes more work than the network path. Companies that run on-premises for cost or performance, such as GPU clusters or high-throughput databases, are often comfortable sending security telemetry to a SaaS vendor. Companies whose customers or regulators restrict where data goes need a closer look: security logs can contain user names, IP addresses, file paths, and fragments of customer data.

Two steps keep that review straightforward:

1. Treat Datadog as a vendor in the audit scope. Datadog's trust center lists a SOC 2 Type 2 report and ISO/IEC 27001 certification. SOC 2 CC9.2 and ISO 27001 supplier controls expect the company to review that report and any complementary user entity controls it lists.
2. Decide what leaves the building. Limit log collection to security-relevant sources. Datadog Sensitive Data Scanner redacts sensitive values; to redact before logs leave the premises, run it in Observability Pipelines, since the cloud version redacts after ingestion. If customer contracts prohibit third-party log processing, a self-hosted stack fits better. The SOC 2 logging and SIEM guide for bare-metal environments covers self-hosted options such as Wazuh.

How to Roll Out Datadog Security Across a Hybrid Environment

A company running cloud and on-premises servers can roll out Datadog security in seven steps, starting with coverage.

1. Map the scope. List every in-scope system in both environments and mark which can run the Agent and which cannot (network devices, storage, appliances).
2. Confirm outbound connectivity. Route on-premises Agents through a proxy where direct internet access is restricted, and record the data flow in the system description.
3. Review the data flow. Check customer contracts and privacy commitments for limits on third-party log processing, and review Datadog's SOC 2 report.
4. Turn on host security features. Enable vulnerability scanning, CIS benchmark checks, and Workload Protection on a pilot group of on-premises hosts, then expand.
5. Connect cloud accounts. Enable CSPM and agentless scanning for AWS, Azure, or GCP.
6. Send security logs to Cloud SIEM from both environments, starting with identity, authentication, and administrator activity. The Datadog Cloud SIEM guide covers which sources to start with.
7. Cover the gaps. Assign a network scanner or manual review, on a documented cadence, to every device without an Agent.

The Agent closes most of the gap between modern cloud tooling and manual checks on physical servers. The SOC 2 consulting for Datadog users page covers how Truvo Cyber builds this program for companies on Datadog.

Frequently Asked Questions About Datadog in Hybrid Environments

Does Datadog work on premises?

Yes. The Datadog Agent runs on on-premises Linux and Windows servers and sends data to Datadog's SaaS platform, which is the only way Datadog is offered.

Can Datadog do file integrity monitoring on on-premises servers?

Yes. Datadog Workload Protection includes file integrity monitoring on Linux and Windows hosts through the Agent, including on-premises servers.

Does Datadog CSPM cover on-premises servers?

Cloud Security Posture Management checks AWS, Azure, and GCP accounts. On-premises hosts are checked against CIS benchmarks for Linux, Docker, and Kubernetes through the Agent.

Can Datadog run in an air-gapped network?

No. Agents need outbound connectivity to Datadog's cloud, directly or through a proxy. Air-gapped environments need a self-hosted security stack.

Is Datadog enough for SOC 2 in a hybrid environment?

Datadog supplies much of the tooling for SOC 2 monitoring, vulnerability, and configuration controls across cloud and on-premises hosts. Devices without an Agent, external scans, penetration testing, policies, and evidence of review across the observation period need their own owners.