Is Datadog a SIEM? How Datadog Cloud SIEM Handles SOC 2 Logging and Monitoring

Yes. Datadog Cloud SIEM is Datadog's security information and event management (SIEM) product. It applies threat detection rules to the logs already in Datadog Log Management, turning cloud, application, and server logs into the security monitoring evidence SOC 2 and ISO 27001 auditors ask for.

Teams planning to buy Splunk, Microsoft Sentinel, or a managed security operations center (SOC) can check first what the existing Datadog contract covers.

What Makes Datadog Cloud SIEM a SIEM

Datadog Cloud SIEM does the three jobs that define a SIEM: it collects security-relevant logs from many sources, correlates them with detection rules, and gives analysts a place to investigate and respond.

Compared with a standalone SIEM, Cloud SIEM shares logs, parsers, and retention settings with Datadog's observability products, so engineers already know the query language.

How Datadog Cloud SIEM Maps to SOC 2 and ISO 27001 Logging Controls

Datadog Cloud SIEM produces evidence for these monitoring controls once the in-scope sources are connected and someone reviews the signals.

The SOC 2 CC7.2 security monitoring guide and the ISO 27001 A.8.15 logging guide cover each control in detail. For vulnerability and configuration scanning, see the Datadog Cloud Security Management guide.

How to Document Datadog Security Signal Triage for SOC 2 CC7.3

SOC 2 CC7.3 asks for evidence that security events were evaluated. A cleared signal list shows that rules fired and someone closed them; a case record shows what was checked and why.

One SaaS company we worked with had a SIEM and intrusion detection catching real activity, such as SQL injection attempts and automated scanning. The team cleared alerts from the dashboard as they came in, so it had monitoring evidence and no response evidence. The fix: open a case for every alert worth investigating and record four things.

1. When the alert fired and when someone looked at it
2. What triggered it (the rule and the signal)
3. What was reviewed (the events, source IPs, user accounts, and related logs)
4. The conclusion, including benign, no action when that is the answer

Each case takes minutes. With a weekly review of open signals across the observation period, the Case Management history becomes the CC7.3 evidence the auditor samples.

Datadog Cloud SIEM Log Retention for Audits

Auditors also check how long logs are kept and whether they can be retrieved. Datadog Log Management offers three retention options, often combined:

• Standard indexing for frequently queried logs, such as recent security and application logs.
• Flex Logs for long-term retention with occasional queries, such as security logs searched during an investigation months later.
• Log Archives for low-cost long-term storage in the company's own cloud storage.

SOC 2 and ISO 27001 let the company set its retention period in its logging policy, and the auditor checks that it is followed. Many companies choose one year, which covers a full SOC 2 Type II observation window. PCI DSS Requirement 10.5.1 sets a minimum of 12 months of audit log history, with the latest three months immediately available for analysis.

The logging policy should name which index, Flex Logs tier, or archive holds each log type, with Datadog settings to match.

Datadog Cloud SIEM Pricing and the Volume Question

Datadog lists Cloud SIEM at $5 per million analyzed events per month on annual billing, $6 month-to-month, and $7.50 on-demand. Log ingestion and retention are separate Log Management line items, so a budget needs both. Cost scales with log volume, and two habits keep it predictable:

• Send security-relevant logs to the SIEM. Identity provider sign-ins, cloud control-plane activity, administrator actions, and authentication logs carry most of the detection value; debug logs and health checks carry very little.
• Estimate before enabling Content Packs. Check each source's daily log volume in Log Management and multiply it out first.

For teams already paying for Log Management, Cloud SIEM on a focused set of sources often costs less than a separate SIEM with duplicated ingestion.

When Datadog Cloud SIEM Fits and When Another SIEM Makes More Sense

Datadog Cloud SIEM tends to fit companies that already send most logs to Datadog, run mostly in AWS, Azure, or GCP, and want engineers to own detection. Another SIEM or a managed detection service may fit better in three cases:

• Signal triage needs more people than the team has. A managed detection and response (MDR) provider supplies the analysts for the weekly signal review.
• Logs must stay inside the environment. Datadog is SaaS, so logs go to Datadog's cloud. Data residency commitments, or customers who prohibit third-party log processing, may call for a self-hosted SIEM such as Wazuh or an on-premises Splunk deployment. The SOC 2 logging and SIEM guide for bare-metal environments covers the self-hosted options, and the Datadog hybrid cloud security monitoring guide covers what Datadog sends off-site from on-premises servers.
• The security team already runs a different SIEM. Organizations with an established Splunk or Sentinel deployment often forward Datadog data there to keep detection in one place.

How to Turn On Datadog Cloud SIEM for a SOC 2 Program

A team already on Datadog Log Management can typically produce audit-ready Cloud SIEM evidence within a few weeks.

1. List the in-scope log sources. For a typical SaaS company: cloud control-plane logs, the identity provider, the productivity suite, production hosts, Kubernetes, and the application's authentication events.
2. Confirm each source reaches Datadog. On-premises servers need the Agent or syslog forwarding; SaaS tools need their API integration.
3. Enable the matching Content Packs and tune out noise before the observation period starts.
4. Route signals to a person. Send high-severity signals to on-call and set a weekly review for everything else.
5. Add the triage procedure (open a case, record the four fields, close with a conclusion) to the incident response plan.
6. Set retention to match the logging policy across indexes, Flex Logs, and archives.
7. Export evidence on a schedule (case records, rule lists, retention settings) to the GRC platform or audit folder throughout the observation period.

Frequently Asked Questions About Datadog SIEM

Is Datadog a SIEM?

Yes. Datadog Cloud SIEM is Datadog's security information and event management product. It applies detection rules to logs in Datadog Log Management and supports investigation, case management, and automated response.

Can Datadog Cloud SIEM collect logs from on-premises servers?

Yes, through the Datadog Agent or syslog forwarding. The logs are processed in Datadog's cloud, so the servers need outbound connectivity to Datadog.

Is Datadog Cloud SIEM enough for SOC 2?

Cloud SIEM covers the tooling for SOC 2 CC7.2 and the case records for CC7.3. SOC 2 also requires policies, an incident response plan, and evidence the process was followed across the observation period.

How much does Datadog SIEM cost?

Datadog lists Cloud SIEM at $5 per million analyzed events per month on annual billing, with higher month-to-month and on-demand rates. Log ingestion and retention are billed separately through Log Management.

What is the difference between Datadog Cloud SIEM and Splunk?

Both are SIEMs. Datadog Cloud SIEM is SaaS-only and shares its logs and query language with Datadog's observability products. Splunk is available as SaaS or self-hosted and is common in larger security teams with established detection engineering.

Datadog Already Holds the Logs SOC 2 Auditors Ask For

Many companies preparing for SOC 2 or ISO 27001 already send the logs an auditor wants to Datadog for troubleshooting. Truvo Cyber builds the program around Cloud SIEM (source coverage, triage, case records, retention) alongside the company's GRC platform. The SOC 2 consulting for Datadog users page covers how.