Datadog

Primary DomainCloud SIEM & DevSecOps

HeadquartersNew York, New York, USA

Founded2010

DeploymentCloud-Native SaaS, Datadog Host/Container Agent, eBPF System Probe

Vendor & Platform Overview

Datadog is a leading cloud-native observability and security platform, unifying infrastructure monitoring, application performance monitoring (APM), Cloud SIEM, and Cloud Security Posture Management (CSPM). By analyzing telemetry directly across modern cloud stacks, microservices, and Kubernetes clusters, Datadog provides end-to-end security visibility for modern engineering teams.

Architecture & Detection Telemetry

Datadog utilizes an open-source, unified agent written in Go and Python, incorporating an eBPF system probe on Linux hosts to capture kernel system calls, socket creation, process lifecycles, and file mutations with minimal CPU overhead. Telemetry is streamed into Datadog's cloud platform, where real-time detection rules identify misconfigurations, unauthorized container escapes, and suspicious cloud API calls across AWS, Azure, and GCP.

Mitigated Threat Types & Incident Playbooks

Targeted malware classifications and primary attack vectors defended by Datadog's security stack:

Kubernetes Container Escapes & Cryptojacking →Cloud IAM Misconfiguration & Credential Theft →Server-Side Request Forgery (SSRF) & Web Exploits →API Abuse & Supply Chain Infiltration →

SOC Incident Response & Containment Workflow

Recommended operational sequence for security operations teams triaging alerts generated by Datadog:

When Datadog Cloud SIEM detects an anomalous container mutation or unauthorized cloud API call, incident engineers examine the correlated distributed trace and host logs in a single pane. Responders trigger automated Webhook or AWS Lambda actions to terminate rogue container pods, revoke compromised IAM access keys, and restrict Kubernetes cluster network security groups.

Enterprise Security Products

Datadog Cloud SIEM
Datadog Cloud Security Management

Other Products & Solutions

Non-catalog offerings, enterprise IT platforms, and consumer productivity solutions provided by Datadog:

Datadog Infrastructure Monitoring (Host, server, container, and Kubernetes cluster metrics)
Application Performance Monitoring (APM, distributed tracing, and continuous profiler)
Datadog Log Management (Streaming ingestion, parsing, indexing, and long-term cloud archival)
Synthetic & Real User Monitoring (RUM browser rendering and mobile end-user diagnostics)
Database Monitoring (Execution plan analysis for PostgreSQL, MySQL, SQL Server, and Oracle)
Network Device Monitoring & NetFlow Traffic Telemetry

Frequently Asked Questions

How does Datadog Cloud Workload Security (CWS) monitor containers?

Datadog CWS uses eBPF (extended Berkeley Packet Filter) technology within the Linux kernel to monitor file integrity, process execution, and network activity across all containers running on a host without requiring sidecar containers or application rewrites.

What is Datadog Cloud SIEM?

Datadog Cloud SIEM automatically analyzes ingested application, platform, and cloud logs in real time using out-of-the-box detection rules aligned with MITRE ATT&CK, alerting teams to active attacks across cloud environments without indexing delays.

Can Datadog detect cloud infrastructure misconfigurations?

Yes. Datadog Cloud Security Posture Management (CSPM) continuously audits cloud accounts across AWS, Azure, and Google Cloud against CIS benchmarks and compliance frameworks to flag exposed S3 buckets and vulnerable IAM roles.