From b792057b73d5085afaae4cf763c8a5a9dfcf679e Mon Sep 17 00:00:00 2001 From: Janine Chan Date: Tue, 1 Sep 2026 14:39:42 -0600 Subject: [PATCH 1/3] Add default Standalone product info to Cloud SIEM docs Documents Standalone as the default Cloud SIEM product for new organizations, including gigabyte-based analyzed log usage, included ingestion for logs indexed in the Cloud SIEM index, and the 12-month signal retention period. Adds a features-by-product table to the "Determine the Cloud SIEM product your organization is using" guide, makes the rule deprecation retention period product-dependent, and replaces "legacy SKU" with "Cloud SIEM Legacy" on the MITRE ATT&CK Map page. Co-Authored-By: Claude Opus 5 (1M context) --- .../cloud_siem/detect_and_monitor/_index.md | 11 +++-- .../detect_and_monitor/mitre_attack_map.md | 3 +- ...ustomize-which-logs-cloud-siem-analyzes.md | 4 +- .../guide/determine-cloud-siem-product.md | 45 ++++++++++++++++++- 4 files changed, 56 insertions(+), 7 deletions(-) diff --git a/hugo/content/en/security/cloud_siem/detect_and_monitor/_index.md b/hugo/content/en/security/cloud_siem/detect_and_monitor/_index.md index 57537553da4..96799088056 100644 --- a/hugo/content/en/security/cloud_siem/detect_and_monitor/_index.md +++ b/hugo/content/en/security/cloud_siem/detect_and_monitor/_index.md @@ -59,8 +59,12 @@ The rule deprecation process is as follows: 1. There is a warning with the deprecation date on the rule. In the UI, the warning is shown in the: - Signal side panel's {{< ui >}}Rule Details{{< /ui >}} > {{< ui >}}Playbook{{< /ui >}} section - [Rule editor][3] for that specific rule -2. Once the rule is deprecated, there is a 15 month period before the rule is deleted. This is due to the signal retention period of 15 months. During this time, you can re-enable the rule by [cloning the rule][3] in the UI. -3. Once the rule is deleted, you can no longer clone and re-enable it. +2. After the rule is deprecated, the rule remains available for the length of your signal retention period before it is deleted. During this time, you can re-enable the rule by [cloning the rule][3] in the UI. The retention period depends on your [Cloud SIEM product][7]: + - Standalone: 12 months + - Add-on with Flex Logs and Legacy: 15 months + + Organizations that adopted Standalone before gigabyte-based usage was introduced have a 15-month retention period. +3. After the rule is deleted, you can no longer clone and re-enable it. ## Suppressions @@ -87,4 +91,5 @@ After setting up your detection rules, use the Cloud SIEM [MITRE ATT&CK Map][5] [3]: /security/detection_rules/#clone-a-rule [4]: /security/cloud_siem/detect_and_monitor/suppressions [5]: /security/cloud_siem/detection_rules/mitre_attack_map/ -[6]: /security/cloud_siem/detect_and_monitor/critical_assets \ No newline at end of file +[6]: /security/cloud_siem/detect_and_monitor/critical_assets +[7]: /security/cloud_siem/guide/determine-cloud-siem-product/ \ No newline at end of file diff --git a/hugo/content/en/security/cloud_siem/detect_and_monitor/mitre_attack_map.md b/hugo/content/en/security/cloud_siem/detect_and_monitor/mitre_attack_map.md index 329fed63300..cd55cbd485a 100644 --- a/hugo/content/en/security/cloud_siem/detect_and_monitor/mitre_attack_map.md +++ b/hugo/content/en/security/cloud_siem/detect_and_monitor/mitre_attack_map.md @@ -28,7 +28,7 @@ To view detection rules against the MITRE ATT&CK Framework: The default view of the map shows all Datadog out-of-the-box and custom rules for active sources, broken down into different attack techniques. Active sources are the sources of logs found and analyzed in the Cloud SIEM index. -**Note**: For the legacy SKU, all ingested logs are analyzed by Cloud SIEM unless [security filters][2] have been set up. +**Note**: For [Cloud SIEM Legacy][5], all ingested logs are analyzed by Cloud SIEM unless [Security Filters][2] have been set up. To view the map for all sources, in the {{< ui >}}Visualize{{< /ui >}} dropdown menu, select {{< ui >}}All Sources{{< /ui >}}. This shows all out-of-the-box rules, including those that are not currently used to detect threats from your logs. @@ -73,3 +73,4 @@ Note the following formatting details: [2]: /security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes/ [3]: https://app.datadoghq.com/security/siem/rules?query=product=siem&sort=date&viz=attck-map [4]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/?tab=threshold +[5]: /security/cloud_siem/guide/determine-cloud-siem-product/ diff --git a/hugo/content/en/security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes.md b/hugo/content/en/security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes.md index c1c9f8fa8e6..302ba0a9e8b 100644 --- a/hugo/content/en/security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes.md +++ b/hugo/content/en/security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes.md @@ -36,7 +36,7 @@ The filtering tools and configuration methods available depend on your Cloud SIE | Add-on with Flex Logs | Security Filters | [UI](#configure-security-filters-in-the-ui-add-on-with-flex-logs) and [API](#configure-security-filters-with-the-api) | | Legacy | Security Filters | [API](#configure-security-filters-with-the-api) | -If you're not sure which Cloud SIEM product your organization uses, see [Determine the Cloud SIEM product your organization is using][2]. +Standalone is the default product for new Cloud SIEM organizations. If you're not sure which Cloud SIEM product your organization uses, see [Determine the Cloud SIEM product your organization is using][2].
Security Filters and log index filters control only the logs analyzed by Cloud SIEM. Logs generated by the Datadog Agent for Workload Protection (source:runtime-security-agent) and Cloud Security Misconfigurations (source:compliance-agent) are not billed as analyzed logs regardless of filter configuration.
@@ -186,7 +186,7 @@ Example response: ### Add an exclusion to an existing Security Filter -You can refine existing Security Filters using exclusion filters. These are useful to remove logs that would the main filter query would otherwise process. This example excludes logs tagged `env:staging`. +You can refine existing Security Filters using exclusion filters. These are useful to remove logs that the main filter query would otherwise process. This example excludes logs tagged `env:staging`. 1. GET existing Security Filters to find the filter's `id`: ```bash diff --git a/hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md b/hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md index 46679f0f1a4..fe15fa65995 100644 --- a/hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md +++ b/hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md @@ -1,6 +1,6 @@ --- title: Determine the Cloud SIEM product your organization is using -description: Cloud SIEM is available in Standalone, Add-on with Flex Logs, and Legacy products. Follow this guide to determine which product your organization is using. +description: Cloud SIEM is available in Standalone, Add-on with Flex Logs, and Legacy products. Follow this guide to determine which product your organization is using and compare the features available in each. --- ## Overview @@ -9,10 +9,19 @@ Cloud SIEM is available as the following products: - Add-on with Flex Logs - Legacy +Standalone is the default product for new Cloud SIEM organizations. In Standalone: +- Usage is measured in gigabytes of analyzed logs, rather than in millions of analyzed events. +- Ingestion of logs indexed in the Cloud SIEM index is included in the analyzed log cost, rather than billed separately. +- Security signals are retained for 12 months. + +Organizations that adopted Standalone before gigabyte-based usage was introduced have a 15-month signal retention period. Both are referred to as Standalone in the documentation, because they provide the same features. + There are two ways to see which Cloud SIEM product your organization is using: - [Check the Plan & Usage page](#plan-usage) - [Check the Cloud SIEM settings page](#settings) +To compare what each product includes, see [Features by Cloud SIEM product](#features). + ## Check the Plan & Usage page{#plan-usage}
You may not be able to use this option if: @@ -87,8 +96,42 @@ In Datadog, go to the [Cloud SIEM settings][2] page. The page shows either a {{< +## Features by Cloud SIEM product{#features} + +The following table lists the Cloud SIEM features available in each product. + +| Feature | Standalone | Add-on with Flex Logs | Legacy | +|---------|:----------:|:---------------------:|:------:| +| [Content Packs][4] | {{< X >}} | {{< X >}} | {{< X >}} | +| [Editing default detection rules][5] | {{< X >}} | {{< X >}} | {{< X >}} | +| [MITRE ATT&CK Map][6] | {{< X >}} | {{< X >}} | {{< X >}} | +| [Security Filters][7] | | {{< X >}} | {{< X >}} | +| [Log index filters][8] | {{< X >}} | | | +| [MITRE ATT&CK Map compact view][6] | {{< X >}} | {{< X >}} | | +| [Scheduled rules][9] | {{< X >}} | {{< X >}} | | +| [Sequence detections][10] | {{< X >}} | {{< X >}} | | +| [Historical jobs][11] | {{< X >}} | {{< X >}} | | +| [Risk Insights][12] | {{< X >}} | {{< X >}} | | +| [Critical Assets][13] | {{< X >}} | {{< X >}} | | +| [Open Cybersecurity Schema Framework (OCSF)][14] | {{< X >}} | {{< X >}} | | +| [Threat intelligence][15] | {{< X >}} | {{< X >}} | | + +If a feature you want to use is not available in your product, contact your Datadog account team. + Need additional assistance? Contact [Datadog support][3]. [1]: https://app.datadoghq.com/billing/usage [2]: https://app.datadoghq.com/security/configuration/siem/setup [3]: /help/ +[4]: /security/cloud_siem/ingest_and_enrich/content_packs/ +[5]: /security/detection_rules/ +[6]: /security/cloud_siem/detect_and_monitor/mitre_attack_map/ +[7]: /security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes/#how-security-filters-work +[8]: /security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes/#cloud-siem-standalone-filter-the-cloud-siem-index +[9]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/ +[10]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/sequence/ +[11]: /security/cloud_siem/detect_and_monitor/historical_jobs/ +[12]: /security/cloud_siem/triage_and_investigate/entities_and_risk_scoring/ +[13]: /security/cloud_siem/detect_and_monitor/critical_assets/ +[14]: /security/cloud_siem/ingest_and_enrich/open_cybersecurity_schema_framework/ +[15]: /security/cloud_siem/ingest_and_enrich/threat_intelligence/ \ No newline at end of file From bdc1bfe12bf1f93e8f2446a73f5cf86ec70c9d83 Mon Sep 17 00:00:00 2001 From: Janine Chan Date: Tue, 1 Sep 2026 15:14:24 -0600 Subject: [PATCH 2/3] Correct Cloud SIEM Standalone retention period Retention for Standalone is 365 days (12 months) and applies to data, not only to security signals. Co-Authored-By: Claude Opus 5 (1M context) --- .../en/security/cloud_siem/detect_and_monitor/_index.md | 4 ++-- .../security/cloud_siem/guide/determine-cloud-siem-product.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/hugo/content/en/security/cloud_siem/detect_and_monitor/_index.md b/hugo/content/en/security/cloud_siem/detect_and_monitor/_index.md index 96799088056..8f7d3cde153 100644 --- a/hugo/content/en/security/cloud_siem/detect_and_monitor/_index.md +++ b/hugo/content/en/security/cloud_siem/detect_and_monitor/_index.md @@ -59,8 +59,8 @@ The rule deprecation process is as follows: 1. There is a warning with the deprecation date on the rule. In the UI, the warning is shown in the: - Signal side panel's {{< ui >}}Rule Details{{< /ui >}} > {{< ui >}}Playbook{{< /ui >}} section - [Rule editor][3] for that specific rule -2. After the rule is deprecated, the rule remains available for the length of your signal retention period before it is deleted. During this time, you can re-enable the rule by [cloning the rule][3] in the UI. The retention period depends on your [Cloud SIEM product][7]: - - Standalone: 12 months +2. After the rule is deprecated, the rule remains available for the length of your retention period before it is deleted. During this time, you can re-enable the rule by [cloning the rule][3] in the UI. The retention period depends on your [Cloud SIEM product][7]: + - Standalone: 365 days (12 months) - Add-on with Flex Logs and Legacy: 15 months Organizations that adopted Standalone before gigabyte-based usage was introduced have a 15-month retention period. diff --git a/hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md b/hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md index fe15fa65995..81d65175c83 100644 --- a/hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md +++ b/hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md @@ -12,9 +12,9 @@ Cloud SIEM is available as the following products: Standalone is the default product for new Cloud SIEM organizations. In Standalone: - Usage is measured in gigabytes of analyzed logs, rather than in millions of analyzed events. - Ingestion of logs indexed in the Cloud SIEM index is included in the analyzed log cost, rather than billed separately. -- Security signals are retained for 12 months. +- Data is retained for 365 days (12 months), rather than for 15 months. -Organizations that adopted Standalone before gigabyte-based usage was introduced have a 15-month signal retention period. Both are referred to as Standalone in the documentation, because they provide the same features. +Organizations that adopted Standalone before gigabyte-based usage was introduced have a 15-month retention period. Both are referred to as Standalone in the documentation, because they provide the same features. There are two ways to see which Cloud SIEM product your organization is using: - [Check the Plan & Usage page](#plan-usage) From 60015588a84f3546c337ca735bdc9d5effc71458 Mon Sep 17 00:00:00 2001 From: Janine Chan Date: Tue, 1 Sep 2026 15:19:04 -0600 Subject: [PATCH 3/3] Combine account team and support contact notes Co-Authored-By: Claude Opus 5 (1M context) --- .../security/cloud_siem/guide/determine-cloud-siem-product.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md b/hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md index 81d65175c83..be69a4fb067 100644 --- a/hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md +++ b/hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md @@ -116,9 +116,7 @@ The following table lists the Cloud SIEM features available in each product. | [Open Cybersecurity Schema Framework (OCSF)][14] | {{< X >}} | {{< X >}} | | | [Threat intelligence][15] | {{< X >}} | {{< X >}} | | -If a feature you want to use is not available in your product, contact your Datadog account team. - -Need additional assistance? Contact [Datadog support][3]. +For help identifying your product, or to use a feature your product does not include, contact your Datadog account team or [Datadog support][3]. [1]: https://app.datadoghq.com/billing/usage [2]: https://app.datadoghq.com/security/configuration/siem/setup