Datadog Cloud SIEM

Name: Datadog Cloud SIEM
Brand: Datadog
Rating: 4.4 (1425 reviews)

Leader

Datadog provides cloud-scale monitoring and security for metrics, traces and logs in one unified platform.

Est 2010|Valuation $91.4B|Raised $795.9M

LinkedIn 546K|Website|Web traffic 4.6M|FTEs 8,100|HQ New York, New York, US

MarketsSecurity Information and Event Management (SIEM)

01Competitive Landscape

Narrative analysis

- Datadog’s differentiator is the single-platform approach: organizations that already centralize telemetry in Datadog can add SIEM analysis and route detections into the platform’s incident workflows and case management. - Competitor strengths by vendor category: - Microsoft Sentinel: favorable for organizations heavily invested in Microsoft cloud and productivity services due to native connectors and content, but ingestion management is required to control costs. - Splunk: historically a widely used enterprise SIEM with deep functionality and ecosystem support, balanced against pricing and operational overhead. - Elastic/OpenSearch: may offer lower-cost architectures for teams willing to operate infrastructure and tuning, providing search-centric workflows.

	Datadog Cloud SIEM	Microsoft Sentinel	Splunk Cloud (Platform / ES)
Starting Price	Published usage-based pricing; additional log storage and retention charges may apply	Published consumption-based pricing with optional commitment tiers available	Pricing typically negotiated via sales/contract; options include ingestion-based or workload-based models
Best suited for	Organizations that have standardized on Datadog for observability and want to add SIEM capabilities within the same platform	Organizations heavily using Microsoft cloud and productivity services that can leverage native connectors and content	Organizations with mature SOCs that require deep search capabilities, long-standing SIEM workflows, and a broad ecosystem
Key Strength	Integration with Datadog logs and telemetry; a single-platform approach that routes detections into incident workflows and case management	Native Microsoft integrations and content, cloud scale, and flexible commitment options	Depth and maturity of SIEM functionality; extensive ecosystem and long-standing customer base
Key Weakness	Cost predictability at scale; some community feedback suggests out-of-the-box SIEM content may require significant tuning	Ingestion costs can be significant if not managed; billing complexity is a common topic	Pricing and operational overhead can be high; requires substantial admin expertise and cost governance

01Competitive Landscape

Narrative analysis

Datadog’s differentiator is the single-platform approach: organizations that already centralize telemetry in Datadog can add SIEM analysis and route detections into the platform’s incident workflows and case management.
Competitor strengths by vendor category:
- Microsoft Sentinel: favorable for organizations heavily invested in Microsoft cloud and productivity services due to native connectors and content, but ingestion management is required to control costs.
- Splunk: historically a widely used enterprise SIEM with deep functionality and ecosystem support, balanced against pricing and operational overhead.
- Elastic/OpenSearch: may offer lower-cost architectures for teams willing to operate infrastructure and tuning, providing search-centric workflows.

	Datadog Cloud SIEM	Microsoft Sentinel	Splunk Cloud (Platform / ES)
Starting Price	Published usage-based pricing; additional log storage and retention charges may apply	Published consumption-based pricing with optional commitment tiers available	Pricing typically negotiated via sales/contract; options include ingestion-based or workload-based models
Best suited for	Organizations that have standardized on Datadog for observability and want to add SIEM capabilities within the same platform	Organizations heavily using Microsoft cloud and productivity services that can leverage native connectors and content	Organizations with mature SOCs that require deep search capabilities, long-standing SIEM workflows, and a broad ecosystem
Key Strength	Integration with Datadog logs and telemetry; a single-platform approach that routes detections into incident workflows and case management	Native Microsoft integrations and content, cloud scale, and flexible commitment options	Depth and maturity of SIEM functionality; extensive ecosystem and long-standing customer base
Key Weakness	Cost predictability at scale; some community feedback suggests out-of-the-box SIEM content may require significant tuning	Ingestion costs can be significant if not managed; billing complexity is a common topic	Pricing and operational overhead can be high; requires substantial admin expertise and cost governance