Protecting cloud-based systems while maintaining clear oversight of security data has become increasingly complex for organisations. SIEM (Security Information and Event Management) platforms are central to addressing this challenge, combining event collection, analysis, and response capabilities to help teams detect and act on threats across distributed environments. As cloud adoption continues to grow, selecting a SIEM that aligns with infrastructure and operational needs is more important than ever.
Datadog Cloud SIEM and Trellix Enterprise Security Manager represent two distinct approaches within this space. Although both deliver core monitoring and threat detection functions, they differ in how they handle data, integrate with environments, and support security operations.
Datadog Cloud SIEM is designed with cloud-first environments in mind. It brings together telemetry from applications, infrastructure, and services into a unified view, applying machine learning to surface anomalies and potential risks. Its emphasis on real-time visibility and streamlined dashboards makes it well suited to teams operating in fast-moving, cloud-centric ecosystems.
Trellix Enterprise Security Manager takes a broader enterprise approach, supporting both on-premises and cloud-based systems. It is particularly strong in areas such as log analysis, compliance reporting, and deep event investigation, making it a good fit for organisations managing hybrid environments or more traditional infrastructure alongside cloud assets.
This comparison breaks down how each solution performs across factors such as deployment models, scalability, usability, and overall capability, helping organisations identify which platform better supports their security strategy and operational setup.
Overview of Datadog Cloud SIEM
Datadog entered the SIEM application market with the launch of Datadog Cloud SIEM in 2020. Datadog Cloud SIEM (Security Information and Event Management) is a SaaS-based solution that provides end-to-end security coverage of dynamic, distributed systems. It is part of the Datadog Cloud Security Platform and is designed to provide a single centralized platform for the collection, monitoring, and management of security-related events and log data from across the enterprise. This enables security teams to identify and respond to suspicious behavior patterns more effectively than possible by looking at data from individual systems.
With Datadog Cloud SIEM, you can analyze operational and security logs in real-time regardless of their volume. Developers, security, and operations teams can leverage detailed observability data to accelerate security investigations in a single, unified platform.
Key features and capabilities include:
- Observability and security See all of your security data in one place and correlate them with runtime events, application and service logs, and more. Development, security, and operations teams can access the same observability data and drive security investigations in a single, unified platform.
- Out-of-the-box dashboards The Security Overview dashboard allows you to have a high-level view of your security posture. The IP Investigation and User Investigation dashboards enable users to correlate specific IP addresses and users with security signals, events, and logs, so they can quickly hone in on malicious activity patterns.
- Out-of-the-box threat detection rules Datadog Cloud SIEM comes equipped with rules that don’t require a query language for widespread attacker techniques and misconfigurations that are mapped to the MITRE ATT&CK framework.
- Built-in vendor-backed security integrations Built-in security integrations with AWS CloudTrail, Okta, G Suite, and more enable users to ingest additional security data in minutes, which provides deeper context and helps accelerate investigations.
A free 14-day-trial with full access to all the features is available on request. After that, the software is generally sold through monthly subscription plans based on hosts, events, or logs.
Overview of Trellix Enterprise Security Manager
Trellix Enterprise Security Manager (ESM), previously branded as McAfee Enterprise Security Manager, is a SIEM solution built to give organisations continuous visibility into security events and faster response capabilities. The shift to the Trellix name signals a move toward a more intelligence-driven security model, while the platform itself continues to deliver the core monitoring and analysis functions it has long been known for.
At its core, Trellix ESM brings together log management, event monitoring, correlation, and threat detection into a single system. It is engineered to handle large-scale data ingestion, allowing security teams to process and interpret vast amounts of event data across their environment. By analysing this information in context, the platform helps uncover irregular behaviour, investigate incidents, and support regulatory compliance efforts. Its compatibility with existing infrastructure, along with support for both cloud and on-premises deployments, makes it adaptable to a range of enterprise setups.
Key modules in Trellix Enterprise Security Manager include:
- Event Receiver: Aggregates event data from across the network, endpoints, and applications, creating a unified intake point for security information.
- Advanced Correlation Engine: Links related activities in real time to expose complex attack chains that might otherwise go unnoticed.
- Enterprise Log Manager: Oversees the collection and organisation of log data, ensuring it is stored efficiently and remains audit-ready.
- Enterprise Log Search: Provides high-speed search functionality, enabling teams to quickly extract relevant data during investigations.
- Application Data Monitor: Observes how data moves between applications, flagging unusual patterns or unauthorised access attempts.
- Direct Attached Storage (DAS): Uses locally attached storage to optimise performance and improve access speeds for large datasets.
- Global Threat Intelligence: Enriches internal data with external threat insights, helping teams stay informed about evolving attack methods.
Working together, these components provide a layered view of security activity, enabling quicker detection, deeper analysis, and more effective incident handling. With the addition of analytics and machine learning, Trellix ESM supports a more forward-looking approach to identifying and managing threats across modern IT environments.
Datadog Cloud SIEM vs Trellix Enterprise Security Manager: How They Compare
Deployment Model
Just as the name implies, Datadog Cloud SIEM is a cloud-based application for cloud-native environments; which means there are no on-premise system requirements and no installation hassles other than the usual sign-up process using an internet-connected device with a supported browser. However, you’ll be required to install local agents specific to the device or service you wish to monitor for the most part. This deployment makes it ideal for organizations that don’t want to burden themselves with any resource-intensive on-premise SIEM solution.
Trellix Enterprise Security Manager can also be deployed as a cloud-based solution, using locally installed agents on servers and cloud platforms to collect data. These agents forward event and log information to a central cloud environment, where processing and analysis take place. Users then access the management console through a standard web browser, allowing secure, remote visibility into security events without the need for dedicated local interfaces.
Data Collection and Analytics
Datadog Cloud SIEM collects logs from many different sources into Datadog. All ingested logs are first parsed and normalized (reformatted) for consistency, easy correlation, and analysis. This helps to uncover malicious activities on the network, preventing bad actors from concealing their tracks. Once logs are collected, ingested, and processed, they are available in Log Explorer. Log Explorer is where you can search, enrich, and view alerts on your logs. This makes it easy to search and filter log data across your entire infrastructure for threat detection and investigation.
Similarly, the Trellix ESM uses what it calls “Event Receivers” as data collectors which can be distributed as needed throughout your network. Valuable data is collected from hundreds of third-party security devices and threat intelligence feeds. The Trellix Global Threat Intelligence (GTI) for example brings in data from more than 100 million Trellix Labs global sensors, offering a constantly updated feed of known malicious IP addresses. The Trellix Enterprise Log Manager also collects and stores logs from various sources which are then parsed and normalized for correlation and analyses to uncover incidents and possible threats and to meet compliance requirements.
Incident/Threat Detection and Mitigation
Datadog detects threats based on rules and creates a security signal. Datadog provides out-of-the-box rules for widespread attacker techniques, mapped to the MITRE ATT&CK framework. Detection rules take full advantage of Datadog’s “Logging without Limits”, which lets you customize what logs you want to index while still ingesting, processing, and archiving everything. Rules apply to the full stream of ingested, parsed, and enriched logs so that you can maximize detection coverage without any of the traditionally associated performance or cost concerns of indexing all of your log data.
On the other hand, Trellix’s SIEM solution detects incidents and threats using a variety of tools such as McAfee Advanced Correlation Engine, Trellix GTI, and others. The Trellix GTI enables organizations to quickly identify attack paths and past interactions with known bad actors and increase threat detection accuracy while reducing response time.
The capabilities of McAfee SIEM can be greatly enhanced by integrating it with McAfee Behavioral Analytics—a dedicated user and entity behavior analytics (UEBA) solution that distills billions of security events down to hundreds of anomalies to produce a handful of prioritized threat leads and allows analysts to discover unusual and high-risk security threats, often unidentifiable by other solutions. The McAfee ePolicy Orchestrator enables faster response. McAfee also works with independent SOAR solution providers such as D3 SOAR which delivers the automation capabilities you need to respond to incidents and cyber threats. The D3 SOAR platform is the first and only platform that combines automation and orchestration with MITRE ATT&CK Intelligence.
Notifications and Alerts
Datadog’s approach to alerts and notifications is based on machine learning (ML), which it calls Watchdog. Watchdog uses ML techniques to identify problems in your infrastructure, applications efficiency, and services, and flag anomalies. Alerts in Datadog are called Monitors. Users can receive alerts using Pagerduty, Slack, and email. These can be based on nearly any metric that Datadog can capture. As a result, every alert is specific, actionable, and contextual—even in large and temporary environments. This unique approach to alerts and notifications makes Datadog stand out and helps to minimize downtime and prevent alert fatigue.
Trellix Enterprise Security Manager notifications and alerts are based on the concept of alarms. Alarms drive actions in response to specific threat events. Trellix ESM allows you to define conditions that trigger alarms and what happens when alarms trigger. Security admins can respond to triggered alarms from the dashboard. Yellow, orange, or red alerts can be generated to notify you of increasing threats against key systems and services. However, there is limited information about receiving alerts on external applications such as email, SMS, Slack, and others. This is where Datadog has an edge.
Compliance and Integration
Instead of generating the usual out-of-the-box reports that most network admins expect, Datadog’s approach to reporting aims to make metrics easily searchable, and it does excellently. Cloud SIEM is fully integrated with all of Datadog’s application and infrastructure monitoring products, which allows users to seamlessly pivot from a potential threat to associated monitoring data to quickly triage security alerts. Datadog’s 500+ integrations let you collect metrics, logs, and traces from your entire stack as well as from your security tools, giving you end-to-end visibility into your environment. Datadog integration with Slack and PagerDuty allows you to automatically loop in relevant teams when a high-severity rule detects a threat. You can also export security signals to collaboration tools like JIRA or ServiceNow.
Trellix SIEM comes with an in-built compliance framework that simplifies audits and governance. The Trellix Advanced Correlation Engine produces audit trails that support investigations and compliance reporting efforts. Trellix ESM offers integration with dozens of complementary incident management and analytics solutions, including Trellix Threat Intelligence Exchange based on endpoint monitoring and Trellix GTI which brings in data from more than 100 million Trellix Labs global sensors.
Licensing and Price Plans
Datadog Cloud SIEM pricing model is per GB of analyzed logs, per month billed annually or on-demand. An analyzed log is a text-based record of activity generated by an operating system, an application, or other sources analyzed to detect potential security threats. Datadog charges for analyzed logs based on the total number of gigabytes ingested and analyzed by the Datadog Cloud SIEM service.
TrelIix subscription licensing, which is ideal for customers who prefer renewable annual contracts
Choosing Between Datadog Cloud SIEM and McAfee SIEM
Although Datadog is a newcomer in the SIEM market, it has no doubt distinguished itself over the years in the observability space. It is therefore well positioned to meet the security needs of its existing customers and organizations that don’t have dedicated IT personnel to keep tabs on the infrastructure at a granular level. Datadog customers can leverage Datadog Cloud SIEM to aggregate and better analyze events inside their cloud-native applications without looking to third-party SIEM tools. This provides an advantage in terms of cost, implementation, and integration.
Datadog’s ability to support and integrate with more than 500 technologies makes it more versatile and adapted to many different functions, provides deeper context during investigations, and lets you cast a wider net to catch possible security issues. However, the lack of SOAR and UEBA capabilities makes it less effective in responding to modern security challenges.
Trellix is not a well-known brand in the IT security space. However, its products were inherited from McAfee. The Trellix system’s ability to leverage companion UEBA solution as well as SOAR capabilities from independent providers puts it in a better position to defend against modern security challenges. However, contrary to popular practice, the UEBA and SOAR capabilities are not an in-built feature in the SIEM package, but a separate module in the Trellix security portfolio or a third-party solution. Customers that want to use these powerful features will have to pay more, thereby increasing the total cost of ownership.
Notwithstanding, choosing between Datadog and McAfee shouldn’t be just about which is better. The focus should be on which SIEM solution best meets your business and security needs. Key factors to consider should include:
- Is the SIEM solution capable of meeting your organization’s security and compliance requirements?
- How much native support does the SIEM tool provide for relevant log sources?
- Does the SIEM solution possess the capabilities of next-generation SIEM functionalities such as SOAR and UEBA?
- What is the total cost of ownership, is vendor support available in your region, and to what extent?
