Who does what
Provider
- Investigate enabled, eligible signals automatically
- Show supporting queries, evidence and a recommended verdict
- Suggest follow-up steps for your team
Your team
- Connect data and select investigation rules
- Review findings and handle uncovered alerts
- Execute containment, remediation and recovery
Coverage
- Cloud Workloads
- Identity & Access
- SaaS Applications
Details
Service scope
Best for Teams operating Cloud SIEM that need help investigating alerts
Cloud SIEM deployment
This profile covers Bits Security Analyst inside Cloud SIEM. The separately advertised agent for other SIEMs is a preview.
Eligible investigations
Source and rule eligibility matter. An ingested log or enabled integration does not guarantee that Bits can investigate every alert.
Response stays with you
Findings can inform an incident or workflow. Your team decides and owns the actions taken after the investigation.
Full service analysis
Datadog Bits Security Analyst investigates eligible Cloud SIEM alerts and recommends a verdict with supporting evidence. Your team reviews the findings, handles uncovered alerts and owns containment, remediation and recovery.
- Your team owns
- Operating Cloud SIEM, connecting sources and maintaining required credentials
- Choosing investigation rules and supplying organization context
- Reviewing conclusions and investigating alerts outside the agent's scope
- Authorizing and executing containment, remediation and recovery
Investigation rather than containment
Bits performs investigative work on eligible alerts and supplies a recommended verdict with evidence. A user can create an incident or launch a workflow from the results. That does not establish that Bits owns containment or the wider SOC operation.
Check source and rule eligibility
Supported-source names describe investigation inputs. They do not establish response authority in those systems, and individual rules can remain ineligible even when their source is supported.
Scope the deployment before buying
This profile covers Bits inside Cloud SIEM. Datadog also advertises a standalone agent for other SIEMs as a preview. Confirm your deployment, region and commercial terms rather than assuming the same availability or billing.
Pricing & contract
Confirm the current Cloud SIEM billing basis, included Bits investigations and charges for additional investigations or workflows in the quote. Public Datadog pricing surfaces use different SIEM units, so no numeric rate is reproduced here.
Tradeoffs & buying questions
Strengths
-
Investigative work runs automatically for eligible alerts after configuration
-
Findings show the reasoning steps and underlying evidence for buyer review
-
Rule controls and organization context let the buyer shape investigation scope
Considerations
-
The buyer must operate Cloud SIEM and maintain source connectivity
-
Alerts outside eligibility and all subsequent response need a separate owner
-
Budgeting needs the exact SIEM package and investigation allowance
Ask before buying
- Which of our rules and log sources are eligible for automatic investigation?
- Who will review suspicious findings and act when our team is offline?
- What SIEM usage, investigation allowance and extra workflow charges apply?
Integrations
Platform / SIEM
- Datadog Cloud SIEM
Endpoint
- CrowdStrike
- SentinelOne
Cloud
- AWS
- Azure
- GCP
Other integrations
- Microsoft Entra ID
- Okta
- Microsoft 365
2 more integrations
- Slack
- Jira
Common questions
Is Bits Security Analyst a managed response service?
This profile covers AI-operated investigation within Cloud SIEM. Bits supplies findings and recommended next steps, while your team retains incident decisions, containment and recovery. It is not described here as MDR or a fully outsourced SOC.
Does Bits investigate every Cloud SIEM alert?
No. Eligibility depends on supported sources, rules and configuration. A supported integration can still generate alerts the agent cannot investigate. Validate the eligible rule set and decide who handles the remainder.
Can I use Bits with another SIEM?
Datadog advertises a standalone version for other SIEMs as a preview. That deployment is outside this profile, which covers Bits in Cloud SIEM. Ask Datadog about the separate offer's availability and terms.