diff --git a/hugo/content/en/security/cloud_siem/detect_and_monitor/_index.md b/hugo/content/en/security/cloud_siem/detect_and_monitor/_index.md index 3e0c59b9a41..1d74e9b0f2e 100644 --- a/hugo/content/en/security/cloud_siem/detect_and_monitor/_index.md +++ b/hugo/content/en/security/cloud_siem/detect_and_monitor/_index.md @@ -59,8 +59,14 @@ The rule deprecation process is as follows: 1. There is a warning with the deprecation date on the rule. In the UI, the warning is shown in the: - Signal side panel's {{< ui >}}Rule Details{{< /ui >}} > {{< ui >}}Playbook{{< /ui >}} section - [Rule editor][3] for that specific rule -2. Once the rule is deprecated, there is a 15 month period before the rule is deleted. This is due to the signal retention period of 15 months. During this time, you can re-enable the rule by [cloning the rule][3] in the UI. -3. Once the rule is deleted, you can no longer clone and re-enable it. +2. After the rule is deprecated, the rule remains available for the length of your retention period before it is deleted. During this time, you can re-enable the rule by [cloning the rule][3] in the UI. The retention period depends on your [Cloud SIEM product][6]: + - Standalone + - 12 months (365 days, usage measured in GB) + - 15 months (450 days, usage measured in millions of events) + - Add-on with Flex Logs and Legacy: 15 months + + Organizations that adopted Standalone before gigabyte-based usage was introduced have a 15-month retention period. +3. After the rule is deleted, you can no longer clone and re-enable it. ## Suppressions @@ -72,7 +78,7 @@ See [Suppressions][4] for more information. You can adjust the severity of security signals based on the assets they affect. You can customize severity levels, apply custom tags, and isolate changes to specific rules. -See [Dynamic Severity][6] for more information. +See [Dynamic Severity][7] for more information. ## MITRE ATT&CK Map @@ -87,4 +93,5 @@ After setting up your detection rules, use the Cloud SIEM [MITRE ATT&CK Map][5] [3]: /security/detection_rules/#clone-a-rule [4]: /security/cloud_siem/detect_and_monitor/suppressions [5]: /security/cloud_siem/detection_rules/mitre_attack_map/ -[6]: /security/cloud_siem/detect_and_monitor/dynamic_severity \ No newline at end of file +[6]: /security/cloud_siem/guide/determine-cloud-siem-product/ +[7]: /security/cloud_siem/detect_and_monitor/dynamic_severity diff --git a/hugo/content/en/security/cloud_siem/detect_and_monitor/mitre_attack_map.md b/hugo/content/en/security/cloud_siem/detect_and_monitor/mitre_attack_map.md index 329fed63300..cd55cbd485a 100644 --- a/hugo/content/en/security/cloud_siem/detect_and_monitor/mitre_attack_map.md +++ b/hugo/content/en/security/cloud_siem/detect_and_monitor/mitre_attack_map.md @@ -28,7 +28,7 @@ To view detection rules against the MITRE ATT&CK Framework: The default view of the map shows all Datadog out-of-the-box and custom rules for active sources, broken down into different attack techniques. Active sources are the sources of logs found and analyzed in the Cloud SIEM index. -**Note**: For the legacy SKU, all ingested logs are analyzed by Cloud SIEM unless [security filters][2] have been set up. +**Note**: For [Cloud SIEM Legacy][5], all ingested logs are analyzed by Cloud SIEM unless [Security Filters][2] have been set up. To view the map for all sources, in the {{< ui >}}Visualize{{< /ui >}} dropdown menu, select {{< ui >}}All Sources{{< /ui >}}. This shows all out-of-the-box rules, including those that are not currently used to detect threats from your logs. @@ -73,3 +73,4 @@ Note the following formatting details: [2]: /security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes/ [3]: https://app.datadoghq.com/security/siem/rules?query=product=siem&sort=date&viz=attck-map [4]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/?tab=threshold +[5]: /security/cloud_siem/guide/determine-cloud-siem-product/ diff --git a/hugo/content/en/security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes.md b/hugo/content/en/security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes.md index 3f21ea1f63f..a7745bfe6dc 100644 --- a/hugo/content/en/security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes.md +++ b/hugo/content/en/security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes.md @@ -36,7 +36,7 @@ The filtering tools and configuration methods available depend on your Cloud SIE | Add-on with Flex Logs | Security Filters | [UI](#configure-security-filters-in-the-ui-add-on-with-flex-logs) and [API](#configure-security-filters-with-the-api) | | Legacy | Security Filters | [API](#configure-security-filters-with-the-api) | -If you're not sure which Cloud SIEM product your organization uses, see [Determine the Cloud SIEM product your organization is using][2]. +Standalone with 12 months of retention is the default product for new Cloud SIEM organizations. If you're not sure which Cloud SIEM product your organization uses, see [Determine the Cloud SIEM product your organization is using][2].
Security Filters and log index filters control only the logs analyzed by Cloud SIEM. Logs generated by the Datadog Agent for Workload Protection (source:runtime-security-agent) and Cloud Security Misconfigurations (source:compliance-agent) are not billed as analyzed logs regardless of filter configuration.
@@ -186,7 +186,7 @@ Example response: ### Add an exclusion to an existing Security Filter -You can refine existing Security Filters using exclusion filters. These are useful to remove logs that would the main filter query would otherwise process. This example excludes logs tagged `env:staging`. +You can refine existing Security Filters using exclusion filters. These are useful to remove logs that the main filter query would otherwise process. This example excludes logs tagged `env:staging`. 1. GET existing Security Filters to find the filter's `id`: ```bash diff --git a/hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md b/hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md index 46679f0f1a4..80eb5f68ee2 100644 --- a/hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md +++ b/hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md @@ -1,18 +1,28 @@ --- title: Determine the Cloud SIEM product your organization is using -description: Cloud SIEM is available in Standalone, Add-on with Flex Logs, and Legacy products. Follow this guide to determine which product your organization is using. +description: Cloud SIEM is available in Standalone, Add-on with Flex Logs, and Legacy products. Follow this guide to determine which product your organization is using and compare the features available in each. --- ## Overview Cloud SIEM is available as the following products: - Standalone + - 12 months (365 days, usage measured in GB) + - 15 months (450 days, usage measured in millions of events) +
Organizations that adopted Standalone before 12-month retention was introduced have a 15-month retention period. The documentation refers to both as Standalone, because they provide the same features.
- Add-on with Flex Logs - Legacy +Standalone 12 months is the default product for new Cloud SIEM organizations. In Standalone: +- Usage is measured in gigabytes of analyzed logs, rather than in millions of analyzed events. +- Ingestion of logs indexed in the Cloud SIEM index is included in the analyzed log cost, rather than billed separately. +- Data is retained for 365 days (12 months), rather than for 15 months. + There are two ways to see which Cloud SIEM product your organization is using: - [Check the Plan & Usage page](#plan-usage) - [Check the Cloud SIEM settings page](#settings) +To compare what each product includes, see [Features by Cloud SIEM product](#features). + ## Check the Plan & Usage page{#plan-usage}
You may not be able to use this option if: @@ -74,7 +84,7 @@ In Datadog, go to the [Cloud SIEM settings][2] page. The page shows either a {{< Core Configuration section with Security Filters Configuration
- {{< img src="security/cloud_siem/guide/config_core_security_filters.png" alt="Configuration settings including a Core Configuration heading, which contains an Index Configuration section" width="80%">}} + {{< img src="security/cloud_siem/guide/config_core_security_filters.png" alt="Configuration settings including a Core Configuration heading, which contains an Security Filters Configuration section." width="80%">}} Add-on with Flex Logs @@ -87,8 +97,40 @@ In Datadog, go to the [Cloud SIEM settings][2] page. The page shows either a {{< -Need additional assistance? Contact [Datadog support][3]. +## Features by Cloud SIEM product{#features} + +The following table lists the Cloud SIEM features available in each product. + +| Feature | Standalone | Add-on with Flex Logs | Legacy | +|---------|:----------:|:---------------------:|:------:| +| [Content Packs][4] | {{< X >}} | {{< X >}} | {{< X >}} | +| [Editing default detection rules][5] | {{< X >}} | {{< X >}} | {{< X >}} | +| [MITRE ATT&CK Map][6] | {{< X >}} | {{< X >}} | {{< X >}} | +| [Security Filters][7] | | {{< X >}} | {{< X >}} | +| [Log index filters][8] | {{< X >}} | | | +| [MITRE ATT&CK Map compact view][6] | {{< X >}} | {{< X >}} | | +| [Scheduled rules][9] | {{< X >}} | {{< X >}} | | +| [Sequence detections][10] | {{< X >}} | {{< X >}} | | +| [Historical jobs][11] | {{< X >}} | {{< X >}} | | +| [Risk Insights][12] | {{< X >}} | {{< X >}} | | +| [Dynamic Severity][13] | {{< X >}} | {{< X >}} | | +| [Open Cybersecurity Schema Framework (OCSF)][14] | {{< X >}} | {{< X >}} | | +| [Threat intelligence][15] | {{< X >}} | {{< X >}} | | + +For help identifying your product, or to use a feature your product does not include, contact your Datadog account team or [Datadog support][3]. [1]: https://app.datadoghq.com/billing/usage [2]: https://app.datadoghq.com/security/configuration/siem/setup [3]: /help/ +[4]: /security/cloud_siem/ingest_and_enrich/content_packs/ +[5]: /security/detection_rules/ +[6]: /security/cloud_siem/detect_and_monitor/mitre_attack_map/ +[7]: /security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes/#how-security-filters-work +[8]: /security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes/#cloud-siem-standalone-filter-the-cloud-siem-index +[9]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/ +[10]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/sequence/ +[11]: /security/cloud_siem/detect_and_monitor/historical_jobs/ +[12]: /security/cloud_siem/triage_and_investigate/entities_and_risk_scoring/ +[13]: /security/cloud_siem/detect_and_monitor/dynamic_severity/ +[14]: /security/cloud_siem/ingest_and_enrich/open_cybersecurity_schema_framework/ +[15]: /security/cloud_siem/ingest_and_enrich/threat_intelligence/ \ No newline at end of file