Datadog Cloud SIEM

No entries match these filters. Clear filters

1. docs update Oct 10, 2026 · issue 100

   Cloud SIEM introduces Entity Packs, a new content category enabling per-user risk scoring, user context in signals, and user-based investigations.

   • New integration Entity Packs — new user-identity integrations for Cloud SIEM
   • New integration Compliance and audit Content Packs
   • New integration Threat-enrichment Content Packs
   • New integration Supply Chain Firewall (SCFW) Content Pack
   • New detection Oracle Fusion Applications activity detection
   • New detection Workload Protection detections
2. docs update Oct 10, 2026 · issue 100

   Datadog Cloud SIEM: Adds content packs for Claude Compliance, AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions., Azure Security, GCP Audit Logs, Greenhouse, Kubernetes Audit Logs, Linux Audit Logs, and Oracle

3. docs update Oct 10, 2026 · issue 100

   Datadog Cloud SIEM gains a User Inventory view for triaging and investigating user activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds a User Inventory page under Cloud SIEM's Triage and Investigate section, giving practitioners a dedicated view of users for security investigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

4. docs update Oct 10, 2026 · issue 100

   Cloud SIEM's Risk Insights is now Entity Risks, adding federated user identity grouping, rolled-up risk scores, and user-identity notification rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Identify a person whose total risk is high across many federated accounts, even when no single account crosses your individual threshold.
   📍In Cloud SIEM, go to Entity Risks. Find any row showing an expand arrow and an entity count. Click the arrow to see every account resolved to that person — their IAM user, assumed roles, email aliases — each with its own risk score, type, source, and signal count.
   Create a notification rule that fires when one person's rolled-up risk score across all their accounts exceeds your threshold, reducing noise from individually-low-risk accounts.
   📍In Cloud SIEM, go to Entity Risks › Notifications, click Create a new Entity Risk notification, set Group risk by to User identity, filter by identity provider / department / job title as needed, set your severity or score threshold, and save. Datadog sends one notification when the user identity first crosses the threshold and re-notifies on the cadence you configure.
   • Renames Risk Insights to Entity Risks and adds a dedicated Entity Risks page where entities can be filtered by provider, type, name, risk score, and configuration risks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Group risk by User identity mode that resolves all accounts belonging to one person (email aliases, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. users, assumed roles, repo accounts) into a single row with a summed risk score, after configuring an Entity Pack for Okta, Google Workspace, or Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments..
   • Adds user-identity notification rules (Group risk by: User identity) that trigger when one person's rolled-up risk score crosses a threshold, with template variables for display name, identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., rolled-up score, contributing entity count, and top contributing entities.
   • Adds a User identity grouping option to notification rule creation — distinct from the existing Individual entity grouping — with both types coexisting under a shared limit of 100 notification rules per organization.
   • Adds inline triage actions in the Risk Contributors side panel: set a triage state, assign an item, create a security case, declare an incident, or create a suppression, selectable per contributing signal, misconfiguration, or identity risk.

   +2 more show less

   • User-identity notification links open directly to the user identity's side panel in User Inventory.
   • Score-impact changes on the Entity Risks settings page are applied immediately and retroactively to all existing entity risk scores.
   • Renames Risk Insights to Entity Risks and adds a dedicated Entity Risks page where entities can be filtered by provider, type, name, risk score, and configuration risks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Group risk by User identity mode that resolves all accounts belonging to one person (email aliases, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. users, assumed roles, repo accounts) into a single row with a summed risk score, after configuring an Entity Pack for Okta, Google Workspace, or Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments..
   • Adds user-identity notification rules (Group risk by: User identity) that trigger when one person's rolled-up risk score crosses a threshold, with template variables for display name, identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., rolled-up score, contributing entity count, and top contributing entities.
   • Adds a User identity grouping option to notification rule creation — distinct from the existing Individual entity grouping — with both types coexisting under a shared limit of 100 notification rules per organization.
   • Adds inline triage actions in the Risk Contributors side panel: set a triage state, assign an item, create a security case, declare an incident, or create a suppression, selectable per contributing signal, misconfiguration, or identity risk.

   +1 more show less

   • User-identity notification links open directly to the user identity's side panel in User Inventory.

   1 more in Everything

5. docs update Oct 10, 2026 · issue 100

   Cloud SIEM Content Packs introduces a new Entity Packs category enabling user risk scoring, user context in signals, and user-based investigations.

   • New integration Entity Packs — identity provider integrations
   • New integration Content Pack integrations — compliance and audit
   • New integration Content Pack integrations — threat and vulnerability enrichment
   • New detection Oracle Fusion Applications — user activity detection
   • New detection Workload Protection — Runtime Security Posture, File Integrity Monitoring, Intrusion Detection, and Malware Prevention
6. docs update Oct 8, 2026 · issue 097

   Cloud SIEM adds Entity Packs — a new Content Pack category enabling user context in signals, risk scoring per user, and user-based investigations.

   • New integration Entity Packs — user identity integrations
   • New integration Entity Pack — Security and Audit Log integrations
   • New integration Threat intelligence and posture Content Pack integrations
   • New detection Oracle Fusion Applications — user activity detection
   • New detection Workload Protection — Runtime Security Posture, File Integrity Monitoring, Intrusion Detection, and Malware Prevention
   • New integration Supply Chain Firewall (SCFW) Content Pack
7. docs update Oct 8, 2026 · issue 097

   Cloud SIEM introduces Entity Packs, a new pack category enabling user-context signals, per-user risk scoring, and user-based investigations.

   • New integration Entity Packs — user identity integrations
   • New integration Oracle Fusion Applications — user activity auditing
   • New detection Workload Protection pack
   • New integration Threat intelligence and enrichment pack integrations
   • New integration Supply Chain Firewall (SCFW) content pack
8. docs update Oct 8, 2026 · issue 097

   Cloud SIEM's Entity Risks adds federated user identity grouping, rolled-up risk scoring, and user-identity-targeted notification rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Set up a user-identity notification rule to catch risk spread thinly across many accounts that no single-entity rule would catch.
   📍In Cloud SIEM, go to Entity Risks › Notification Rules › Create a new Entity Risk notification. Under Group risk by, select User identity. Set a risk score or severity threshold, filter by identity provider or department, and configure re-notification intervals so you are reminded while the user identity stays above threshold.
   Investigate a federated user's total risk by expanding their rolled-up identity row and drilling into each resolved entity.
   📍In Cloud SIEM, open the Entity Risks page. Find a row with an expand arrow and an entity count. Click the arrow to see each resolved entity with its risk score, type, source, and signal count. Click an entity to open its Risk Contributors side panel, then use inline actions to assign, triage, or create a security case.
   • Adds Entity Risks (formerly Risk Insights) with filtering by entity provider, entity type, entity name, risk score, and configuration risks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports grouping risks by user identity to aggregate a single person's risk score across all resolved accounts, aliases, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles, and repository accounts via an Entity Pack for Okta, Google Workspace, or Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments..
   • Adds notification rules scoped to User identity grouping that trigger when one person's rolled-up risk score crosses a threshold — distinct from per-entity rules — with template variables for display name, identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., rolled-up risk score, contributing entity count, and top contributing entities.
   • Adds notification rules scoped to Individual entity grouping that evaluate each entity's own risk score independently.
   • Notification rules for both groupings count toward the same limit of 100 notification rules per organization.

   +1 more show less

   • Score-impact changes on the Entity Risks settings page are applied immediately and retroactively to all existing entity risk scores.
   • Adds Entity Risks (formerly Risk Insights) with filtering by entity provider, entity type, entity name, risk score, and configuration risks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports grouping risks by user identity to aggregate a single person's risk score across all resolved accounts, aliases, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles, and repository accounts via an Entity Pack for Okta, Google Workspace, or Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments..
   • Adds notification rules scoped to User identity grouping that trigger when one person's rolled-up risk score crosses a threshold — distinct from per-entity rules — with template variables for display name, identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., rolled-up risk score, contributing entity count, and top contributing entities.
   • Adds notification rules scoped to Individual entity grouping that evaluate each entity's own risk score independently.

   2 more in Everything

9. docs update Oct 8, 2026 · issue 097

   Datadog Cloud SIEM: Adds Zscaler Internet Access to Entity Pack integrations for user identity context.

   • Adds User Inventory and Entity Risks as new Cloud SIEM capabilities surfaced through Content Packs.

   1 detail in Everything

10. docs update Oct 6, 2026 · issue 096
    • New integration Oracle Fusion Applications content pack
    • New integration Zscaler Internet Access content pack
    • New integration Identity and access management content pack sources
    • New integration Compliance and cloud audit content pack sources
11. docs update Oct 6, 2026 · issue 096

    Introduces a Risk Contributors section that surfaces only score-affecting signals, misconfigurations, and identity risks on an entity detail view.

    • New integration Oracle Fusion Applications log source
    • New integration Zscaler Internet Access log source
12. docs update Oct 5, 2026 · issue 095
    • New integration Identity Security content pack sources
    • New integration Compliance and Cloud content pack sources
    • New detection Oracle Fusion Applications — user activity auditing
13. docs update Oct 5, 2026 · issue 095

    Datadog Cloud SIEM: Adds Supply Chain FirewallSupply Chain FirewallA policy-enforcement layer that intercepts package manager requests and blocks or quarantines dependencies that match known-malicious signatures, preventing compromised open-source packages from entering a build environment. (SCFW) as a new content pack.

14. docs update Oct 5, 2026 · issue 095

    Cloud SIEM entity risk score panels now separate score-contributing items from all related signals, misconfigurations, and identity risks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    When triaging a high-risk entity, use View All Related Signals to see signals that are associated but not yet scoring, helping you spot patterns before they escalate.
    📍In Cloud SIEM, open an entity panel › locate the Risk Contributors section › click View All Related Signals to expand to all associated signals regardless of score contribution.
15. docs update Oct 5, 2026 · issue 095
    • New integration Identity & Access Management content packs
    • New integration Compliance & audit content packs
    • New detection Oracle Fusion Applications user activity detection
16. changelog Oct 4, 2026 · issue 094
    └──▷ HOW TO FIND IT
    Navigate to the Risk Contributors panel for an entity to focus triage on only the signals and misconfigurations actively driving its risk score.
    📍In Cloud SIEM, open an entity's detail panel › locate the Risk Contributors section to see contributing signals, misconfigurations, and identity risks › click View All Related Signals to see all associated signals, or View in Vulnerability Explorer for misconfigurations and identity risks not affecting the score.
17. docs update Oct 3, 2026 · issue 093

    Cloud SIEM adds Zscaler Internet Access and Oracle Fusion Applications content packs with detection rules and configuration guides.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enable the Oracle Fusion Applications Content Pack in Cloud SIEM to start detecting user role changes and sign-in events.
    📍In the Cloud SIEM console, go to Security › Content Packs, search for Oracle Fusion Applications, and enable the pack to activate its detection rules and follow the linked configuration guide.
    • Adds Oracle Fusion Applications Content Pack covering user activity auditing — sign-in events, target user changes, user role assignment changes, and metadata permission checks — with detection rules and a configuration guide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Zscaler Internet Access Content Pack to the Authentication category.

    2 details in Everything

18. docs update Oct 3, 2026 · issue 093
    • New integration Identity and Access Management content pack sources
    • New integration Compliance and audit log content pack sources
    • New detection Oracle Fusion Applications user activity detection
19. docs update Oct 3, 2026 · issue 093

    Cloud SIEM entity risk scoring now surfaces risk contributors and links to all related signals and the Vulnerability Explorer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Triage a high-risk entity by reviewing only the findings that actually drive its score, then pivoting to the full signal list for broader context.
    📍In Cloud SIEM, open an entity panel › scroll to the Risk Contributors section to review score-affecting signals and misconfigurations › click View All Related Signals to see all signals including non-scoring ones › click View in Vulnerability Explorer for misconfigurations or identity risks.
    • Adds Risk Contributors sections to entity panels, showing only the signals, misconfigurations, and identity risks that contribute points to the entity's risk score.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds View All Related Signals action to see signals associated with an entity that do not affect its risk score.
    • Adds View in Vulnerability Explorer action for misconfigurations and identity risks that are associated with an entity.

    3 details in Everything

20. docs update Oct 3, 2026 · issue 093

    Datadog Cloud SIEM: Adds Supply Chain FirewallSupply Chain FirewallA policy-enforcement layer that intercepts package manager requests and blocks or quarantines dependencies that match known-malicious signatures, preventing compromised open-source packages from entering a build environment. (SCFW) content pack.

    • Adds Browser Rules-Based Evaluation content pack.
    • Expands identity and access management content pack coverage to include 1Password, BeyondTrust Identity Security Insights, BeyondTrust Password Safe, BeyondTrust Privileged Remote Access, Bitwarden, Delinea Privilege Manager, Delinea Secret Server, Have I Been Pwned, Ivanti nZTA, JumpCloud, Keeper Security, Keycloak, LastPass, PingFederate, PingOne Advanced Identity Cloud, PingOne, Push Security, and Symantec VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address..
    • Adds content packs for Greenhouse, Oracle Cloud Infrastructure, and Oracle Fusion Applications under the compliance and audit log category.
    • Adds Responder Roles content pack.
    • Adds Setting Up MariaDB content pack.

    +1 more show less

    • Adds Training Page and Request Access content packs.

    6 details in Everything

21. changelog Sep 22, 2026 · issue 082

    Datadog Cloud SIEM adds Dynamic Severity rules, Env Remapping, Code Channels in Slack, and Data Access Control for signals.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Scope a Dynamic Severity rule's edit access to specific roles or teams so only authorized staff can modify signal severity adjustments.
    📍In Cloud SIEM, open the Dynamic Severity rule list, click the vertical three-dot menu for the rule, select Restrict access, and use the dropdown to add one or more roles, teams, or users — ensuring your own role is included before saving.
    • Adds Dynamic Severity rules to adjust the severity of security signals based on the assets they affect, with customizable severity levels, custom tags, and rule-scoped isolation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds role-, team-, and user-level access controls for Dynamic Severity rules, requiring at least one editor role the current user belongs to before saving.
    • Adds Object Storage Request Estimation capability.
    • Adds out-of-the-box integrations for Palo Alto Networks Firewall, Windows Event Logs, and Wiz.
    • Adds New Suppression rules for Cloud SIEM detections.

    +2 more show less

    • Improves Bits Investigation accuracy.
    • Adds below-threshold (a < N and a <= 0) detection cases to Threshold detection rules alongside the existing above-threshold (a > N) case.
    • Adds Dynamic Severity rules to adjust the severity of security signals based on the assets they affect, with customizable severity levels, custom tags, and rule-scoped isolation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds role-, team-, and user-level access controls for Dynamic Severity rules, requiring at least one editor role the current user belongs to before saving.
    • Adds Object Storage Request Estimation capability.
    • Adds out-of-the-box integrations for Palo Alto Networks Firewall, Windows Event Logs, and Wiz.
    • Adds New Suppression rules for Cloud SIEM detections.

    2 more in Everything