Datadog Observability for Enterprise Engineering Teams

Prometheus and Grafana are open-source, self-hosted and highly customisable but require your team to operate the storage, alertmanager and dashboarding stack. Datadog is a managed SaaS platform that unifies metrics, traces, logs, RUM and SIEM with zero operational overhead and built-in ML anomaly detection. For teams without a dedicated platform-engineering function, or for organisations with strict SLA requirements on the observability layer itself, Datadog's managed reliability and integrated correlation across signals typically justify the cost premium over a self-managed Prometheus stack.

Custom-metric cost is driven by cardinality — the number of unique tag-value combinations per metric name. We audit your instrumentation for high-cardinality tags (user IDs, request IDs, UUIDs), replace them with lower-cardinality aggregations, set per-service metric budgets using Datadog's usage attribution, configure log exclusion filters and indexing tiers to reduce indexed log volume, and use metrics-from-logs to generate metrics from high-volume log streams without indexing the full payload.

Datadog's sensitive-data scanner applies regex and pattern-matching rules to log events and APM payloads before they are indexed. We configure rule sets covering GDPR-relevant identifiers (email, national ID, IP address), healthcare fields (diagnosis codes, medication names) and payment data (PANs, CVVs). APM obfuscation rules scrub SQL query values and HTTP body parameters from traces. The result is that PII never appears in the Datadog index, satisfying GDPR data-minimisation requirements and reducing HIPAA exposure.

Yes. Datadog operates a dedicated EU site (datadoghq.eu) hosted in AWS Frankfurt. We migrate all Datadog agents to the EU-site intake endpoints, update DNS and firewall egress rules, verify via network capture that no telemetry reaches US intake endpoints, and document the data-flow for GDPR Article 30 records of processing activities. The EU site supports all Datadog products including APM, logs, RUM, synthetics and Cloud SIEM.

Both are valid, and the choice depends on your vendor-portability requirements. The Datadog agent's auto-instrumentation is lower-effort and unlocks Datadog-specific features such as Watchdog anomaly detection, deployment tracking and dynamic instrumentation. OpenTelemetry SDK instrumentation is vendor-neutral — traces can be routed to Datadog today and to another backend tomorrow via a collector swap. We recommend an OTel-first strategy for new services using Datadog's native OTel ingest, which preserves portability without sacrificing APM feature coverage.

Cloud SIEM ingests log data from cloud provider audit logs (AWS CloudTrail, GCP Audit Logs, Azure Activity Logs), identity providers and network flows, and applies threat-detection rules to surface security signals in real time. We configure log pipelines to route security-relevant sources into SIEM, tune out-of-the-box detection rules to reduce false positives, define custom detection rules for your threat model, and wire signals to on-call workflows via PagerDuty or Opsgenie. For NIS2-scoped organisations, CSPM posture findings are also integrated into the SIEM signal stream.

Datadog signs a Business Associate Agreement (BAA) for accounts on eligible plans, making it a HIPAA-eligible vendor. The BAA covers the Datadog SaaS infrastructure; the configuration responsibility remains with the customer. We configure PII scrubbing in log pipelines and APM obfuscation to prevent PHI from being indexed, restrict access to dashboards and log indexes containing health data via RBAC, enforce MFA on the Datadog organisation, enable the audit trail, and document the full configuration in a HIPAA compliance matrix suitable for your compliance programme.