[DOCS-15474] Add default Standalone product info to Cloud SIEM docs by janine-c · Pull Request #39641 · DataDog/documentation

janine-c · 2026-09-01T20:40:14Z

What does this PR do? What is the motivation?

Fixes DOCS-15474

Documents Standalone as the default Cloud SIEM product for new organizations, and stops describing products as "SKUs" in user-facing content.

Determine the Cloud SIEM product your organization is using

Adds a Standalone summary to the overview: usage measured in gigabytes of analyzed logs (not millions of events), ingestion included for logs indexed in the Cloud SIEM index, and a 12-month signal retention period.
Notes that earlier Standalone organizations have a 15-month retention period, and that both are called Standalone because the feature sets are identical.
Adds a Features by Cloud SIEM product table comparing Standalone, Add-on with Flex Logs, and Legacy.

Detect and monitor

Rule deprecation no longer hardcodes 15 months. The window now follows the signal retention period for the reader's product (12 months for Standalone, 15 months for Add-on with Flex Logs and Legacy).

MITRE ATT&CK Map

Replaces "legacy SKU" with "Cloud SIEM Legacy", linked to the product-determination guide. Also capitalizes Security Filters to match the rest of the docs.

Customize which logs Cloud SIEM analyzes

Notes that Standalone is the default product for new organizations.
Drive-by typo fix: "logs that would the main filter query would otherwise process".

Reviewer notes

Merge order: the features table links to /security/cloud_siem/detect_and_monitor/critical_assets/, which Rename Cloud SIEM Critical Assets to Dynamic Severity #39624 renames to dynamic_severity. Whichever PR merges second needs a one-line link update.
Retention scope: Standalone retention is documented here as 365 days (12 months) applying to data generally, not only to security signals (the docs previously described 15 months as specifically the signal retention period). Please confirm that signals and indexed logs share a single retention period, rather than differing.
Features table omissions: the source feature mapping lists content anomaly detection, detections on Audit Trail events, and detections on events as available in all products but flags that availability as still under review, so those rows are left out for now. Behavior AI, UEBA user inventory, Bits AI SOC agent, risk-based alerting, and Threat Hunting are also omitted because they have no public documentation to link to. Happy to add any of these if they should be listed.
Out of scope, flagging for a follow-up: Pricing still defines an analyzed log as billed "based on the millions of events per month analyzed". That needs updating for gigabyte-based usage, but the correct wording for Add-on and Legacy organizations wasn't clear to me.

Merge readiness

Ready for merge

For Datadog employees:

⚠️ Your branch name MUST follow the <name>/<description> convention and include the forward slash (/). If you've already created your PR with an incorrect branch name, please rename your branch and open a fresh PR.
🤖 New: Comment with /review to run an automated check that catches common issues before a Documentation team member reviews your PR.

AI assistance

Claude Code read the Jira ticket, the linked internal resources, and the exported feature-mapping spreadsheet, then drafted the edits and this description. Reviewed and edited by me.

Additional notes

Documents Standalone as the default Cloud SIEM product for new organizations, including gigabyte-based analyzed log usage, included ingestion for logs indexed in the Cloud SIEM index, and the 12-month signal retention period. Adds a features-by-product table to the "Determine the Cloud SIEM product your organization is using" guide, makes the rule deprecation retention period product-dependent, and replaces "legacy SKU" with "Cloud SIEM Legacy" on the MITRE ATT&CK Map page. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

github-actions · 2026-09-01T21:03:52Z

Preview links (active after the `build_preview` check completes)

Modified Files

Retention for Standalone is 365 days (12 months) and applies to data, not only to security signals. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

shrey4b · 2026-10-07T18:25:36Z

    - [Rule editor][3] for that specific rule
-2. Once the rule is deprecated, there is a 15 month period before the rule is deleted. This is due to the signal retention period of 15 months. During this time, you can re-enable the rule by [cloning the rule][3] in the UI.
-3. Once the rule is deleted, you can no longer clone and re-enable it.
+2. After the rule is deprecated, the rule remains available for the length of your retention period before it is deleted. During this time, you can re-enable the rule by [cloning the rule][3] in the UI. The retention period depends on your [Cloud SIEM product][7]:


For the 12m Standalone SKU, while logs are retained and indexed for 12mo, signals are actually still retained for 15mo

referenc: https://www.datadoghq.com/pricing/?gad_source=1&gad_campaignid=24039696658&gbraid=0AAAABDQBvCYcHRz0tCnFgLaWDT__nw1Fp&gclid=CjwKCAjw25fWBhAVEiwAMopNjktiemNpyQLNu_Lp1UImbA3LrwIpgqq6z-LN5IVrwZIR90P2JdtFfRoCwbwQAvD_BwE&product=cloud-siem#products

shrey4b · 2026-10-07T18:27:07Z

-2. Once the rule is deprecated, there is a 15 month period before the rule is deleted. This is due to the signal retention period of 15 months. During this time, you can re-enable the rule by [cloning the rule][3] in the UI.
-3. Once the rule is deleted, you can no longer clone and re-enable it.
+2. After the rule is deprecated, the rule remains available for the length of your retention period before it is deleted. During this time, you can re-enable the rule by [cloning the rule][3] in the UI. The retention period depends on your [Cloud SIEM product][7]:
+    - Standalone: 365 days (12 months)


We offer 2 standalone SKUs actually - one that has 12 mo retention measured in GB and another that has 15 mo retention measured in events

reference: https://datadoghq.atlassian.net/wiki/spaces/PMM/pages/7142343276/Cloud+SIEM+SKUs+FAQs+Updated+9+2026

shrey4b · 2026-10-07T18:29:44Z

 - Add-on with Flex Logs
 - Legacy

+Standalone is the default product for new Cloud SIEM organizations. In Standalone:


There are 2 versions of standalone - sorry that's a bit confusing. Open to different naming
https://datadoghq.atlassian.net/wiki/spaces/PMM/pages/7142343276/Cloud+SIEM+SKUs+FAQs+Updated+9+2026

shrey4b · 2026-10-07T18:30:25Z

+## Features by Cloud SIEM product{#features}
+
+The following table lists the Cloud SIEM features available in each product.
+


I would say let's leave Add-on out of this table as it maps to exactly what Standalone offers

Is this true? Security and log index filters don't match in the below table

Oops yes you're right

We just don't publicly advertise Add on today - I'm wondering if it makes sense to keep it as a discoverability item - like to understand if you are on Add on, but not to have customers inquire about Add on, if that makes sense

Yeah, I think docs tend to describe what's possible rather than trying to encourage people to go one way or the other

maxvp · 2026-10-09T21:30:33Z

+Standalone 12 months is the default product for new Cloud SIEM organizations. In Standalone:
+- Usage is measured in gigabytes of analyzed logs, rather than in millions of analyzed events.
+- Ingestion of logs indexed in the Cloud SIEM index is included in the analyzed log cost, rather than billed separately.
+- Data is retained for 365 days (12 months), rather than for 15 months.


Does "data" here refer to logs AND signals? If so, we should clarify they have different retention periods here as well.

@shrey4b let me know how to make this clearer!

maxvp · 2026-10-09T21:36:21Z

+- Ingestion of logs indexed in the Cloud SIEM index is included in the analyzed log cost, rather than billed separately.
+- Data is retained for 365 days (12 months), rather than for 15 months.
+
+Organizations that adopted Standalone before gigabyte-based usage was introduced have a 15-month retention period. Both are referred to as Standalone in the documentation, because they provide the same features.


Suggested change

Organizations that adopted Standalone before gigabyte-based usage was introduced have a 15-month retention period. Both are referred to as Standalone in the documentation, because they provide the same features.

Organizations that adopted Standalone before gigabyte-based usage was introduced have a 15-month retention period. Both are referred to as Standalone in the documentation because they provide the same features.

Suggesting a small nit fix, but bigger question: I wonder if it makes more sense to consolidate this explanation with the list above (L10) since it introduces both the 12 and 15 month products as Standalone.

maxvp

Left a few comments and suggestions for clarity!

Co-authored-by: Max Phillips <maxvphillips@gmail.com>

janine-c · 2026-10-09T23:44:14Z

 - Standalone
+  - 12 months (365 days, usage measured in GB)
+  - 15 months (450 days, usage measured in millions of events)
+  <div class="alert alert-info">Organizations that adopted Standalone before 12-month retention was introduced have a 15-month retention period. The documentation refers to both as Standalone, because they provide the same features.</div>


@maxvp This is ready for re-review when you have a second! Thanks for the suggestion to move this - how does this look to you?

janine-c requested a review from a team as a code owner September 1, 2026 20:40

janine-c added the WORK IN PROGRESS No review needed, it's a wip ;) label Sep 1, 2026

janine-c and others added 2 commits September 1, 2026 15:14

Correct Cloud SIEM Standalone retention period

bdc1bfe

Retention for Standalone is 365 days (12 months) and applies to data, not only to security signals. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Combine account team and support contact notes

6001558

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

shrey4b reviewed Oct 7, 2026

View reviewed changes

janine-c and others added 2 commits October 7, 2026 18:34

Merge branch 'master' into janine/docs-15474-siem-standalone-sku

8eb6f69

Apply updates and fix conflict

228e56b

janine-c removed the WORK IN PROGRESS No review needed, it's a wip ;) label Oct 9, 2026

maxvp reviewed Oct 9, 2026

View reviewed changes

Comment thread hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md Outdated

maxvp reviewed Oct 9, 2026

View reviewed changes

Comment thread hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md Outdated

maxvp reviewed Oct 9, 2026

View reviewed changes

Comment thread hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md Outdated

maxvp reviewed Oct 9, 2026

View reviewed changes

janine-c and others added 2 commits October 9, 2026 19:35

Apply batched suggestions from code review

50ff996

Co-authored-by: Max Phillips <maxvphillips@gmail.com>

Move note; rephrase slightly

eeedaf5

janine-c commented Oct 9, 2026

View reviewed changes

		## Features by Cloud SIEM product{#features}

		The following table lists the Cloud SIEM features available in each product.

	Organizations that adopted Standalone before gigabyte-based usage was introduced have a 15-month retention period. Both are referred to as Standalone in the documentation, because they provide the same features.
	Organizations that adopted Standalone before gigabyte-based usage was introduced have a 15-month retention period. Both are referred to as Standalone in the documentation because they provide the same features.

Conversation

janine-c commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do? What is the motivation?

Reviewer notes

Merge readiness

For Datadog employees:

AI assistance

Additional notes

Uh oh!

github-actions Bot commented Sep 1, 2026

Preview links (active after the build_preview check completes)

Modified Files

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

maxvp left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

janine-c commented Sep 1, 2026 •

edited

Loading

Preview links (active after the `build_preview` check completes)