PAGES
← all tools
◆ SIEM

Datadog Security

commercial

Datadog Security is a cloud monitoring platform that detects threats, vulnerabilities, and compliance risks across applications and infrastructure.

Summary

Datadog Security is a commercial SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. that provides security monitoring and cloud security functions by collecting data via agents, APIs, and integration libraries. It is run as a service that connects to many platforms, including AWS, Azure, and Google Cloud. The tool is for security practitioners who manage cloud-native environments. Its documentation positions it alongside cloud SIEM solutions. The product has been available since 2010.

Datadog Security is a cloud monitoring platform that detects threats, vulnerabilities, and compliance risks across applications and infrastructure.

How Datadog Security helps

Which cloud accounts have configuration drift that puts them at risk?

continuously checks AWS, Azure, and Google Cloud resource configurations against built-in rules and flags the ones that violate compliance or security best practice

Which of my hosts or containers are running software with a known vulnerability?

correlates the software inventory it collects via the agent against vulnerability data and lists affected hosts, images, and libraries

Is there an attacker active in my environment right now?

analyzes logs, network traffic, and cloud audit trails collected through its integrations against detection rules and raises a signal naming the affected resource and the rule that fired

Who touched this resource before the incident, and from where?

keeps ingested logs and traces searchable together so an investigator can trace a chain of activity across the same timeline without stitching together separate tools

Which of my running services could be exploited through their code?

inspects application libraries and running processes for known flaws and reports which services carry them, without needing a separate scan step

Are my cloud credentials and secrets exposed anywhere they shouldn't be?

scans collected data for exposed sensitive values and reports where they were found so access can be revoked or rotated

all 13 features, with the evidence for each →

Languages

Not documented

Features

13 capabilities

Built from Datadog Security's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What Datadog Security offers you

  • Role-based access control2
  • Ticketing integration1
  • User-defined detection rules1
All capabilities 13 capabilities
Database Monitoring documented Supports monitoring of database activity, including MariaDB, for investigation and detection purposes. 109 other sources

docs 109 total

  • Infrastructure Modes VRL Processor Resource Renaming Rules Set Up DBM Postgres MariaDB SQL Server MongoDB Explore DBM Database Hosts Query Metrics Query Samples Database Schemas Dashboard Reporter Agent Offline Experiments Online Experiments External Sources Federated Logs Migration Query Translation seen Oct 2026 · source
  • Missing Log Bytes Use Bits Chat Embed Apps Embed App Builder Apps GitHub App Connection Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Entity Risks User Inventory Capacity Planning Page Recommended Settings for DNS Failover seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
Code Execution documented suggested Provides the ability to execute code for investigation and automation purposes. 31 other sources

Suggested capability: Response playbook automation. This is our guess, not confirmed.

docs 31 total

  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Browser Rules-Based Evaluation Supply Chain Firewall (SCFW) Training Page Request Access Query Code… seen Oct 2026 · source
  • Code Execution Improve Bits Investigation Accuracy Code Channels in Slack Env Remapping Rules Dynamic Severity Data Access Control Object Storage Request Estimation seen Sep 2026 · source
  • Code Execution Improve Bits Investigation Accuracy Code Channels in Slack Env Remapping Rules Dynamic Severity Data Access Control Object Storage Request Estimation seen Sep 2026 · source
  • Code Execution Improve Bits Investigation Accuracy Code Channels in Slack Env Remapping Rules Dynamic Severity Data Access Control Object Storage Request Estimation Palo Alto Networks Firewall Windows Event Logs Wiz seen Sep 2026 · source
  • Code Execution Improve Bits Investigation Accuracy Code Channels in Slack Env Remapping Rules Dynamic Severity Data Access Control Object Storage Request Estimation seen Sep 2026 · source
  • Code Execution Improve Bits Investigation Accuracy Code Channels in Slack Env Remapping Rules Dynamic Severity Data Access Control Object Storage Request Estimation seen Sep 2026 · source
Responder Roles documented Provides role-based access controls for responders, governing what actions and data each responder role can access within the cyber toolchain. 29 other sources

Also counts toward: Role-based access control

docs 29 total

  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
Rules-Based Evaluation documented Allows defining and applying rule-based logic to evaluate events or entities for detection and policy enforcement purposes. 27 other sources

Also counts toward: User-defined detection rules

docs 27 total

  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
Supply Chain Firewall documented Provides a supply chain firewall capability to inspect and control software supply chain activity. 27 other sources

docs 27 total

  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
Risk Scoring documented Computes and displays a risk score for entities based on contributing signals, misconfigurations, and identity risks. 12 other sources

docs 12 total

  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Flag Key Obfuscation Browser Rules-Based Evaluation Entity Risks User Inventory Supply Chain Firewall… seen Oct 2026 · source
Data Integration documented suggested Connects to external data sources such as firewalls, event logs, and cloud platforms for enriched analysis. 3 other sources

Suggested capability: Log enrichment. This is our guess, not confirmed.

Also counts toward: Role-based access control

docs

  • Home Docs API Agents Essentials Getting Started Agent API APM Tracing Containers Autodiscovery Datadog Operator Dashboards Database Monitoring Datadog Datadog Site DevSecOps Incident Management Integrations AWS Azure Google Cloud OCI Terraform Stripe Internal Developer Portal Logs Monitors Notebooks OpenTelemetry… seen Oct 2026 · source
  • Missing Log Bytes Responder Roles Embed Apps Embed App Builder Apps GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Bits in RUM Optimize Performance Investigate Regressions Bits Chat in RUM Browser Rules-Based Evaluation Supply Chain Firewall (SCFW) Training Page Request Access Zscaler Internet… seen Oct 2026 · source
  • Code Execution Improve Bits Investigation Accuracy Code Channels in Slack Env Remapping Rules Dynamic Severity Data Access Control Object Storage Request Estimation Microsoft Sysmon Palo Alto Networks Firewall Windows Event Logs Wiz seen Sep 2026 · source
Dynamic Severity documented Allows adjusting the severity of security signals based on context such as affected assets. 3 other sources

docs

  • Code Execution Improve Bits Investigation Accuracy Code Channels in Slack Env Remapping Rules Dynamic Severity Data Access Control Object Storage Request Estimation seen Sep 2026 · source
  • Code Execution Improve Bits Investigation Accuracy Code Channels in Slack Env Remapping Rules Dynamic Severity Data Access Control Object Storage Request Estimation Dynamic severity You can adjust the severity of security signals based on the assets they affect. seen Sep 2026 · source
  • Code Execution Improve Bits Investigation Accuracy Code Channels in Slack Env Remapping Rules Dynamic Severity Data Access Control Object Storage Request Estimation dynamic severity rules Restrict access to dynamic severity rules dynamic severity rules . seen Sep 2026 · source
Identity and Access Management Integrations documented suggested Connects to identity and access management platforms such as 1Password, Auth0, BeyondTrust, Bitwarden, Cisco Duo, and Delinea to ingest and analyse access-related data. 3 other sources

Suggested capability: Log collection. This is our guess, not confirmed.

docs

  • Responder Roles GitHub App Connection Setting Up MariaDB Database Monitoring Workbench Browser Rules-Based Evaluation Supply Chain Firewall (SCFW) Training Page Request Access : 1Password, Datadog Audit Trail, Auth0, BeyondTrust Identity Security Insights, BeyondTrust Password Safe, BeyondTrust Privileged Remote… seen Oct 2026 · source
  • Responder Roles GitHub App Connection Setting Up MariaDB Browser Rules-Based Evaluation Supply Chain Firewall (SCFW) Training Page Request Access : 1Password, Datadog Audit Trail, Auth0, BeyondTrust Identity Security Insights, BeyondTrust Password Safe, BeyondTrust Privileged Remote Access, Bitwarden, Cisco Duo,… seen Oct 2026 · source
  • Responder Roles Setting Up MariaDB Browser Rules-Based Evaluation Supply Chain Firewall (SCFW) Training Page Request Access : 1Password, Datadog Audit Trail, Auth0, BeyondTrust Identity Security Insights, BeyondTrust Password Safe, BeyondTrust Privileged Remote Access, Bitwarden, Cisco Duo, Delinea Privilege Manager,… seen Oct 2026 · source
Suppression documented Enables the suppression of security signals to reduce noise. 3 other sources

docs

  • Code Execution Improve Bits Investigation Accuracy Code Channels in Slack Env Remapping Rules Dynamic Severity Data Access Control Object Storage Request Estimation + New seen Sep 2026 · source
  • Code Execution Improve Bits Investigation Accuracy Code Channels in Slack Env Remapping Rules Dynamic Severity Data Access Control Object Storage Request Estimation + New Suppression seen Sep 2026 · source
  • Code Execution Improve Bits Investigation Accuracy Code Channels in Slack Env Remapping Rules Dynamic Severity Data Access Control Object Storage Request Estimation + New Suppression seen Sep 2026 · source
Infrastructure as Code Custom Rules Authoring documented Generates, validates, and publishes Rego-based Infrastructure as Code custom rules from a natural-language description. 2 other sources

docs

  • Responder Roles GitHub App Connection Setting Up MariaDB Browser Rules-Based Evaluation Supply Chain Firewall (SCFW) Training Page Request Access Author IaC custom rules : Generate, validate, and publish Rego-based Infrastructure as Code custom rules from a natural-language description. seen Oct 2026 · source
  • Responder Roles Setting Up MariaDB Browser Rules-Based Evaluation Supply Chain Firewall (SCFW) Training Page Request Access Author IaC custom rules : Generate, validate, and publish Rego-based Infrastructure as Code custom rules from a natural-language description. seen Oct 2026 · source
Sensitive Data Scrubbing documented Allows configured scrubbing of sensitive data within the cyber toolchain. 1 other source

Also counts toward: Ticketing integration

docs

  • Bits Release Change Types Sensitive Data Scrubbing Configure Journeys Journey Overview Page Status Overview Page Muted Indicators Capacity Planning Training Inference Provision with ServiceNow seen Oct 2026 · source
Threshold Detection documented suggested Detects when query counts meet specified thresholds, including above-threshold and below-threshold cases. 1 other source

Suggested capability: Metrics collection. This is our guess, not confirmed.

docs

  • Code Execution Improve Bits Investigation Accuracy Code Channels in Slack Env Remapping Rules Dynamic Severity Data Access Control Object Storage Request Estimation Threshold: Detects when the query count meets a specified case, including above-threshold ( a > N ) or below-threshold ( a < N or a <= 0 ) cases. seen Sep 2026 · source

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface

Five scores for Datadog Security, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail Datadog Security puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Commercials

pricing & packaging history · Datadog vendor page

59 readings of Datadog's pricing page since Sep 2021, with 27 relaunches of its plan lineup and 21 changes to what its plans include — each one dated, compared with the reading before it, and explained for someone buying the tool.

Pricing and packaging history is included with Researcher and Business. See how every vendor we track sells, and how that has changed over time, using data we don't publish anywhere else.

See plans →

Website history

datadoghq.com, every change

Datadog's home page and 40 more pages as they looked each month from August 2021 to October 2026: 52 renders, 7 changes of tagline or palette. Step through them, play them, or put any two months side by side.

Website history is included with Researcher and Business.

See plans →

Releases

Nothing shipped since we started watching. Releases and docs updates land here as they happen.

last release Oct 20, 2026 · watching since Sep 6, 2026

Add the badge to your README

Maintain this project? The badge links readers straight to this page, so they can follow every release here.

Tracked by Cyber Toolchain Choose a badge style and copy the code →
browse all tools → score card for your toolchain →