Datadog · Cloud SIEM
SIEM solution: Datadog Cloud SIEM, licensed and supported in Saudi Arabia
A SIEM solution collects security-relevant logs from across your systems, applies detection rules to them, and gives your security team signals to investigate instead of raw log files. Datadog Cloud SIEM does this on the same platform as your Datadog logs, metrics and traces. Interkey, an official Datadog partner, sells Datadog licences in Saudi Arabia, helps you connect the log sources, and provides technical support after go-live.
In short
- What it is: Datadog describes Cloud SIEM as a security data analysis and correlation system for viewing, detecting, investigating and responding to security issues.
- What it reads: telemetry from cloud and on-premises systems, collected by the Datadog Agent and API-based integrations.
- What it produces: security signals, correlated across sources by detection rules, shown by severity in the Signal Explorer.
- Who it is for: security and IT teams that want security monitoring on the platform they already use for operations.
- Where the data goes: to your Datadog site. As of November 2026 Datadog lists no site in the Middle East.
- What Interkey does: licences, log-source onboarding, storage design, masking of personal data, rule checks, case routing and technical support.
What a SIEM solution has to do, and how Cloud SIEM does it
A SIEM is judged by what a security analyst can do with it at three in the morning, not by the length of its feature list. These are the jobs, in the order an alert travels.
| Job | What Datadog documents | Where you work |
|---|---|---|
| Collect | Telemetry from cloud and on-premises systems through the Datadog Agent and API-based integrations | Content Packs, Log Management |
| Detect | Continuous analysis of incoming data with detection rules, out-of-the-box or custom, which you can test against sample logs | Detection rules |
| Triage | Signals correlated across sources, grouped by rule name and sorted by severity | Signal Explorer |
| Investigate | Searches over the underlying logs: group-by, lookups against reference tables, pattern analysis and visualisations | Log Explorer |
| Track | Signals that need more analysis are followed through in cases | Case Management |
| Respond | SOAR workflows that ship inside Content Packs | Workflows from Content Packs |
| See the picture | Detection coverage by MITRE ATT&CK tactic and technique, and a threat map of where signals originate | MITRE ATT&CK view, Threat map |
Getting security logs in: Content Packs
A SIEM with no logs sees nothing, so the first design question is which systems feed it. Datadog groups the work into Content Packs: curated sets of Datadog integrations for security teams. Each pack has set-up instructions and says what it includes, such as detection rules, dashboards, parsers and SOAR workflows. Once a pack is active, Datadog shows its health status and troubleshooting steps.
Read more
Because Cloud SIEM runs on Datadog Log Management, the collection methods are the ones described on our Datadog Log Management page: the Agent on hosts and containers, cloud integrations and the HTTP API. Interkey starts from a short list of sources, usually identity, cloud audit, network and endpoint logs, and adds more once those are producing signals your team acts on.
RelatedDatadog Log Management page
Where security logs are stored
Cloud SIEM lets you choose the retention and query capability for each kind of security log, instead of paying for one setting across everything.
| Option | Use it for |
|---|---|
| Standard indexing | Logs your analysts query often |
| Flex Logs | Logs retained for a long time that sometimes need to be queried urgently |
| Log Archives | Logs that are rarely queried and stored long term |
Datadog's Cloud SIEM page does not state retention periods, so confirm them against your own obligations when the quote is prepared. Our Datadog log cost guide explains how these choices drive the bill.
Security logs and personal data
Security logs name people: user accounts, source addresses, device names and, in some applications, national ID or mobile numbers. Datadog is a SaaS platform, and as of November 2026 its documented sites are in the US, Germany, Japan, Australia and the UK, none in the Middle East. That is a design input, not a reason to stop. Decide which log classes may leave your network, mask or drop the rest before they are sent, and keep an audit trail of the decision.
Read more
Our Datadog data residency guide sets out the options, and the guide to masking personal data in logs and traces covers the masking step. This is not legal advice: read your regulator's own text, and ask your supplier in writing where data is stored.
RelatedDatadog data residency guideguide to masking personal data in logs and traces
A tool raises signals; people close them
Cloud SIEM detects and correlates. It does not decide who looks at a signal at night, or what counts as an incident in your organisation. Settle that before go-live:
- Who triages signals, inside your team or with a provider you appoint.
- Which severities page someone, and which wait for the morning.
- How a signal becomes a case, using Case Management or your existing ticketing.
- Which rules stay on. Datadog's out-of-the-box rules are meant to cover most threat scenarios; check which are enabled for the sources you actually send, and test any custom rule against sample logs before relying on it.
How Interkey sets up Cloud SIEM
-
List the sources and the owners.
Which systems matter first, and who answers when a signal fires.
-
Quote the licences.
Datadog licences for the log volumes and retention you need, together with implementation and technical support.
-
Connect the sources.
Content Packs, the Agent and integrations, with the network path agreed with your security team.
-
Design storage per log class.
Standard indexing, Flex Logs or archive for each kind of security log.
-
Mask personal data.
Masking rules written and tested before production logs are sent.
-
Check the rules.
Review which detection rules are on, test custom rules against sample logs, and tune the noisy ones.
-
Operate or hand over.
Interkey operates the platform from Riyadh, or hands it over with documentation and stays on as technical support.
Questions buyers ask
Which systems can feed Cloud SIEM?
Cloud and on-premises systems, through the Datadog Agent and API-based integrations. Content Packs bundle the integrations, parsers, rules and dashboards for a given source.
Do we have to index every security log?
No. You can index the logs analysts query often, keep long-term logs in Flex Logs, and archive the rest. Confirm retention periods with us when the quote is prepared.
Can security logs stay inside the Kingdom?
Logs you send are processed on your Datadog site, and as of November 2026 none is in the Middle East. To keep chosen fields or logs from leaving, mask or drop them inside your network before sending.
Does Cloud SIEM replace our security team?
No. It raises and correlates signals. Your team, or a provider you appoint, still triages them and decides what is an incident.
Can Interkey supply the licences?
Yes. Interkey sells Datadog licences in Saudi Arabia and quotes them together with implementation and technical support.
Next
Read next
Next step
Discuss a SIEM rollout
Tell us which systems should feed the SIEM, roughly how much log volume they produce, and who will triage the signals. We can quote the Datadog licences, the set-up and technical support together.
Or directly
+966-11-2180999 [email protected]Tawuniya Towers, North Tower, 7th Floor, King Fahad Highway, Olaya, P.O. Box 56835, Riyadh 11564, Saudi Arabia