Datadog Observability Pipelines Now Routes Security Logs to Exabeam — Without Blinding Your SIEM

SIEM ingest costs are the infrastructure bill that security teams dread opening. Datadog’s new Exabeam Packs give platform teams a surgical tool for reducing that bill without creating the blind spots that cheaper approaches introduce.

What Happened

Datadog Observability Pipelines already lets teams process and route telemetry within their own infrastructure before data egresses to external systems. The new Exabeam Packs extend that capability with seven preconfigured filtering templates built specifically for Exabeam’s SIEM and UEBA platform.

The Packs cover high-volume security sources: Cisco ASA, Fortinet FortiGate, and Palo Alto for network traffic; CrowdStrike Falcon, SentinelOne, and Windows Event Logs for endpoints; and Zscaler for web traffic. For each source, the Pack automatically drops low-value noise — routine accepts, health checks, repetitive keepalives — while preserving the signals that matter for threat detection: denied connections, anomalous activity, and CrowdStrike threat detections.

The filtered data routes to Exabeam. Raw log payloads route simultaneously to object storage (Amazon S3, Azure Blob, or Google Cloud Storage) for compliance retention. A Replay feature allows investigators to retrieve archived logs for forensic analysis without re-ingesting the full historical volume into the SIEM.

Why It Matters

The SIEM cost problem has a specific shape: high-volume sources like Windows Event Logs and firewall traffic generate orders of magnitude more data than threat detection actually requires. Most of that data is noise — routine activity that would never appear in an investigation but gets priced at the same SIEM ingest rate as the alerts that do.

The standard approaches to this problem both have failure modes. Aggressive filtering reduces costs but introduces blind spots — if the filtering logic drops an event category that turns out to be relevant to an investigation, that data is gone. Routing everything to object storage for cheap retention solves the cost problem but requires retrospective query infrastructure to make the logs useful, and most security teams don’t build that until after they need it.

Datadog’s Exabeam Packs address both failure modes: the source-specific filtering logic is maintained by Datadog rather than ad-hoc by an internal team, and the Replay feature provides the retrospective query capability without requiring a separate data lake build. Raw payloads are preserved untouched so existing Exabeam parsers continue to function correctly.

Source: Datadog

Content created with AI assistance and reviewed for accuracy.