Datadog Cloud SIEM pricing in 2026: per-host, per-GB, and the real total

Datadog packages Cloud SIEM as an add-on layered on top of Datadog Logs. That structural decision has the largest single effect on what your real bill becomes. Cloud SIEM by itself is genuinely inexpensive at $0.20 per analyzed log GB. The line item that swallows budgets is the underlying Logs product, where indexed retention runs $1.70 per million events at 15 days and $2.50 per million events at 30. Most enterprise log mixes average 6,000 to 10,000 events per GB, which means a 50 GB-per-day environment indexes roughly 9 to 15 billion events per month, generating an indexed-log bill of $15K to $40K per month before any Cloud SIEM charge appears.

Datadog also charges separately for the host telemetry that originates many of those logs. Infrastructure Pro lists at $15 per host per month, Enterprise at $23. For a 200-host environment, that base alone is $36K to $55K per year before any log spend at all. Customers who arrived at Datadog through Application Performance Monitoring or Infrastructure Monitoring already absorb this cost; customers buying Datadog as a standalone SIEM see it as a Cloud SIEM line item even though it lives on a different product.

The Cloud SIEM analyzed-log line is small relative to the underlying Logs spend it implies. Cloud SIEM's $0.20 per analyzed GB on the 50 GB-per-day environment above is roughly $3,650 per year. The Logs bill it sits on top of is $74K. That ratio is the reason single-line-item comparisons against Splunk or Sentinel mislead: Cloud SIEM's headline rate is the smallest part of the real bill.

Datadog launched Flex Logs in 2024 to address the indexing tax. Flex Logs combines ingestion ($0.05 per GB) with long-term storage ($0.0017 per GB per month) and removes the per-event indexing line. Queries against Flex Logs run in minutes rather than seconds and are not interactive, which suits compliance retention but not real-time investigation. Cloud SIEM detections work against Flex Logs data, so security signal generation continues even when you have moved 90-day-plus retention out of the indexed tier. For organisations where most logs are written once and read rarely, Flex Logs cuts the long-tail retention bill by roughly an order of magnitude.

Discounts are routine. Datadog's quarter-end pressure produces 20-30 percent off list at committed annual spend above $250K, and multi-year commitments push that towards 35 percent. List pricing is genuinely the worst price you should pay on any meaningful deployment.

Datadog Cloud SIEM is unambiguously the right pick in three buyer profiles. First, organisations already on Datadog for application performance monitoring or infrastructure monitoring who want to consolidate security on the same data plane. The marginal cost of adding Cloud SIEM is genuinely small once the underlying Logs spend is sunk. Second, cloud-native engineering teams who value the API-first product and the one-vendor billing model over best-of-breed depth. Third, security teams whose detection content is built around application telemetry rather than network and endpoint correlation, where Datadog's APM and trace data is a real edge.

Datadog is the wrong pick for compliance-heavy regulated industries that need long-running investigations across 24-month data sets. The indexed-retention bill at that profile is brutal, and even Flex Logs has interactive-query limitations that workflow-heavy SOCs find frustrating. It is also wrong for environments where logs originate primarily from network appliances and endpoints rather than hosts: the per-host base inverts the unit-economics argument, and Sentinel or QRadar typically win cleanly.

Pricing model evolution worth watching: Datadog has been adding bundled Cloud SIEM allowances to enterprise contracts since late 2024. If your renewal comes up in 2026, push hard for a bundle that absorbs Cloud SIEM into committed Logs spend rather than billing it separately. The negotiation lever exists and is being used.