Datadog Cloud SIEM pricing in 2026: per-host, per-GB, and the real total

Datadog packages Cloud SIEM as an add-on layered on top of Datadog Logs. That structural decision has the largest single effect on what your real bill becomes. Cloud SIEM meters on analyzed-event volume, listing at $5 per million analyzed events per month (annual billing) rather than a flat per-GB rate. The other line item that swallows budgets is the underlying Logs product, where indexed retention runs $1.70 per million events at 15 days and $2.50 per million events at 30. The events-per-GB ratio of your logs is therefore the number that decides the bill, and Datadog does not publish one. Our scenarios assume 1 million events per GB (an average event of about 1 KB): on that basis a 50 GB-per-day environment indexes about 1.5 billion events a month, an indexed-log bill of about $3.8K per month at 30-day retention, and analyzing the same events in Cloud SIEM adds about $7.6K per month. Compact sources with smaller events push the ratio, and both lines, up proportionally.

Datadog also charges separately for the host telemetry that originates many of those logs. Infrastructure Pro lists at $15 per host per month, Enterprise at $23. For a 200-host environment, that base alone is $36K to $55K per year before any log spend at all. Customers who arrived at Datadog through Application Performance Monitoring or Infrastructure Monitoring already absorb this cost; customers buying Datadog as a standalone SIEM see it as a Cloud SIEM line item even though it lives on a different product.

Because Cloud SIEM meters per analyzed event, its cost tracks how many events you route through detection, not how many gigabytes you ingest. That makes it highly sensitive to log source mix and to how selectively you send logs to Cloud SIEM: compact, high-frequency sources like firewall and NetFlow generate far more analyzed events per GB than verbose JSON cloud logs. Model this line on your own analyzed-event count using Datadog's pricing calculator rather than a per-GB rule of thumb. The broader point holds regardless: single-line-item rate comparisons against Splunk or Sentinel mislead, because Datadog's real bill is the sum of infrastructure hosts, per-GB and per-event Logs charges, and the analyzed-event Cloud SIEM line together.

Datadog launched Flex Logs in 2024 to address the indexing tax. Flex Logs combines standard ingestion ($0.10 per GB) with long-term storage ($0.05 per million events stored per month, annual billing) and removes the per-event indexing line. Queries against Flex Logs run in minutes rather than seconds and are not interactive, which suits compliance retention but not real-time investigation. Cloud SIEM detections work against Flex Logs data, so security signal generation continues even when you have moved 90-day-plus retention out of the indexed tier. For organisations where most logs are written once and read rarely, Flex Logs cuts the long-tail retention bill by roughly an order of magnitude.

Discounts are routine but unpublished. Our estimate, from buyer reports rather than any Datadog document, is 20-30 percent off list at committed annual spend above $250K, with multi-year commitments pushing towards 35 percent. List pricing is the worst price you should pay on any meaningful deployment.

Datadog Cloud SIEM is unambiguously the right pick in three buyer profiles. First, organisations already on Datadog for application performance monitoring or infrastructure monitoring who want to consolidate security on the same data plane. The marginal cost of adding Cloud SIEM is genuinely small once the underlying Logs spend is sunk. Second, cloud-native engineering teams who value the API-first product and the one-vendor billing model over best-of-breed depth. Third, security teams whose detection content is built around application telemetry rather than network and endpoint correlation, where Datadog's APM and trace data is a real edge.

Datadog is the wrong pick for compliance-heavy regulated industries that need long-running investigations across 24-month data sets. The indexed-retention bill at that profile is brutal, and even Flex Logs has interactive-query limitations that workflow-heavy SOCs find frustrating. It is also wrong for environments where logs originate primarily from network appliances and endpoints rather than hosts: the per-host base inverts the unit-economics argument, and Sentinel or QRadar typically win cleanly.

Pricing model evolution worth watching: Datadog has been adding bundled Cloud SIEM allowances to enterprise contracts since late 2024. If your renewal comes up in 2026, push hard for a bundle that absorbs Cloud SIEM into committed Logs spend rather than billing it separately. The negotiation lever exists and is being used.