Amanda Quach
Product Manager
Vera Chan
Senior Product Marketing Manager
Jenny Park
Product Manager
Jason Hunsberger
Senior Product Manager
Managing dynamic cloud environments is an ongoing challenge for organizations as they scale and innovate. Protecting assets, data, and reputations is more important than ever, yet detecting insider threats, compromised accounts, and unusual behavior throughout an environment remains complex.
Datadog Cloud SIEM now integrates user and entity behavior analytics (UEBA) to identify emerging threats earlier and enrich security signals with detailed context. By correlating alerts with key identity attributes and applying risk scores, Datadog Cloud SIEM helps reduce alert fatigue, simplify investigations, and prioritize threats. This integrated approach not only minimizes false positives but also enables security teams to allocate resources where they matter most, leading to stronger, more efficient security practices.
Building on these capabilities, Datadog Cloud SIEM Entity Risks is available for entities across a wide range of supported log sources, offering security teams deeper behavioral and environmental context for their investigations. Entity Risks enhances Cloud SIEM signals by integrating data from Datadog Cloud Security—including misconfigurations, identity risks, and configuration attributes—to assess the risk level of entities effectively.
In this post, we’ll walk through how Datadog Cloud SIEM helps teams:
Start investigations with Entity Risks
Security teams need to understand which users and accounts pose the greatest risk to their environment. Suspicious activity can span multiple identities, cloud resources, and services, making it difficult to connect related findings and assess their combined significance. Without a consolidated view of risk across these entities, analysts may struggle to identify which users warrant investigation and where to focus their efforts.
Entity Risks helps security teams tackle this challenge by enabling them to consolidate correlated signals. Powered by an opinionated risk model, Entity Risks offers an intuitive breakdown of an entity’s risk so teams can streamline their workflows and improve the speed and precision of their investigations.
Let’s say you’re a security analyst starting your daily review of new activity. You can begin with the Entity Risks Explorer, which provides a prioritized list of risky entities and their corresponding risk score. Datadog Cloud SIEM’s risk score incorporates multiple variables, emphasizing the most relevant signals and the duration of their threat. To help analysts quickly assess their environment, risk scores are grouped into severity thresholds, offering a clear, actionable view of potential risks.
To refine your focus, you can apply filters or use the search bar to dive into specific entity attributes.
This targeted approach helps security teams focus on high-risk insights, improving their ability to respond promptly and effectively to real threats.
Correlate security signals with misconfigurations and entity risks
In today’s monitoring landscape, many SIEMs are often isolated from other observability and security platforms. In order to conduct efficient investigations, teams need rich context and the ability to correlate data across user attributes and their entity models. Let’s take a closer look at how Datadog Cloud SIEM achieves this by exploring a specific entity in detail.
After navigating to the Entity Risks Explorer, you can use filters or the search bar to explore specific entity attributes in depth. Datadog Cloud SIEM supports a broad range of human and non-human entities, including:
Users and service identities, including identity and access management (IAM) users, users identified by email address or username, directory users, and web identity users
Sessions and credentials, including assumed role sessions and session credentials
Cloud accounts and resources, including storage containers, compute instances, and code repositories
This expanded coverage ensures that security teams have the context they need to investigate efficiently across complex environments.
Once you’ve identified the entity to investigate, select it to open the Entity Side Panel, which provides detailed metadata, such as the entity’s risk score, recent risk changes, and entity type. Additionally, you can examine existing correlated signals to gain deeper insights into related misconfigurations and identity risks.
To understand how specific events have impacted the entity, the side panel also allows you to search relevant logs, visualize the entity’s activity via Cloud SIEM Investigator, and review a timeline of associated events. The risk score timeline, for example, provides insights into which signals—like one for downgrading multi-factor authentication (MFA) in an Okta policy rule—affected an entity’s risk score over time, helping teams conduct more in-depth investigations. It also displays the status of each signal so teams can avoid duplicating work.
With this information, you can quickly take action by creating a case to collaborate with cross-functional teams and continue the investigation. You have the flexibility to assign the selected signals to yourself or escalate and reassign them to teammates as needed. Additionally, you can address misconfigurations and identity risk signals directly—by adding them to a new case, for example—to close the loop between investigation and response efficiently.
Alternatively, if you determine that the entity does not pose a risk, you can close the signals and review the updated risk score, which will be automatically adjusted.
Get started with Entity Risks
Efficient threat detection and response relies on identity and activity context. With Entity Risks, Datadog Cloud SIEM prioritizes the most severe threats by correlating signals with misconfiguration and identity risk data from AWS, GCP, Azure, GitHub, and Okta entities. This integrated approach provides a clearer understanding of potential threats, reducing alert noise and signal volume to help security teams investigate effectively.
To learn more, check out the Entity Risks documentation. If you don’t already have a Datadog account, you can sign up for a 14-day free trial to start identifying high-risk users and entities and prioritizing threats with Cloud SIEM.
