--- title: Determine the Cloud SIEM product your organization is using description: >- Cloud SIEM is available in Standalone, Add-on with Flex Logs, and Legacy products. Follow this guide to determine which product your organization is using and compare the features available in each. breadcrumbs: >- Docs > Datadog Security > Cloud SIEM > Cloud SIEM Guides > Determine the Cloud SIEM product your organization is using --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Determine the Cloud SIEM product your organization is using ## Overview{% #overview %} Cloud SIEM is available as the following products: - Standalone - 12 months (365 days, usage measured in GB) - 15 months (450 days, usage measured in millions of events) Important alert (level: info): Organizations that adopted Standalone before 12-month retention was introduced have a 15-month retention period. The documentation refers to both as Standalone, because they provide the same features. - Add-on with Flex Logs - Legacy Standalone 12 months is the default product for new Cloud SIEM organizations. In Standalone: - Usage is measured in gigabytes of analyzed logs, rather than in millions of analyzed events. - Ingestion of logs indexed in the Cloud SIEM index is included in the analyzed log cost, rather than billed separately. - Data is retained for 365 days (12 months), rather than for 15 months. There are two ways to see which Cloud SIEM product your organization is using: - Check the Plan & Usage page - Check the Cloud SIEM settings page To compare what each product includes, see Features by Cloud SIEM product. ## Check the Plan & Usage page{% #plan-usage %} {% alert level="info" %} You may not be able to use this option if: - You don't have access to this page - Your organization has multi-org configured; the Plan & Usage page is a roll-up of all sub-orgs, so you might see multiple Cloud SIEM product tiles In either case, follow the instructions in the Check the Cloud SIEM settings page section to determine which product your organization is using. {% /alert %} 1. In Datadog, go to Plan & Usage > [**Usage & Cost**](https://app.datadoghq.com/billing/usage) page. 1. Scroll to the **Usage Summary** section and click the Security tab. 1. Find the tile that indicates which Cloud SIEM product your organization is using: | Tile | Product | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- | | **Security Analyzed and Indexed Logs** {% image source="https://docs.dd-static.net/images/security/cloud_siem/guide/tile_security_analyzed_indexed_logs.9e29494a6316a8feaefbd571cd9bb6c5.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/cloud_siem/guide/tile_security_analyzed_indexed_logs.9e29494a6316a8feaefbd571cd9bb6c5.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Tile labelled with 'Security Analyzed and Indexed Logs,' in addition to a usage amount, and indication of whether that usage was on-demand" /%} | Standalone | | **Cloud SIEM - Analyzed Logs (Add-On)** {% image source="https://docs.dd-static.net/images/security/cloud_siem/guide/tile_analyzed_logs_add_on.cb23a1b3e33a6ddc72d081d80eb6502e.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/cloud_siem/guide/tile_analyzed_logs_add_on.cb23a1b3e33a6ddc72d081d80eb6502e.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Tile labelled with 'Cloud SIEM - Analyzed Logs (Add-On),' in addition to a usage amount, and indication of whether that usage was on-demand" /%} | Add-on with Flex Logs | | **SIEM - Analyzed Logs** {% image source="https://docs.dd-static.net/images/security/cloud_siem/guide/tile_analyzed_logs.659f85a70d11f49fb9623d0a49b2cadc.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/cloud_siem/guide/tile_analyzed_logs.659f85a70d11f49fb9623d0a49b2cadc.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Tile labelled with 'SIEM - Analyzed Logs,' in addition to a usage amount, and indication of whether that usage was on-demand" /%} | Legacy | ## Check the Cloud SIEM settings page{% #settings %} In Datadog, go to the [Cloud SIEM settings](https://app.datadoghq.com/security/configuration/siem/setup) page. The page shows either a Core Configuration or Settings section, which indicates the Cloud SIEM product your organization is using. | Settings section | Product | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- | | **Core Configuration** section with **Index Configuration** {% image source="https://docs.dd-static.net/images/security/cloud_siem/guide/config_core_index.84258a2e675999fa7a5f21f08245fad1.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/cloud_siem/guide/config_core_index.84258a2e675999fa7a5f21f08245fad1.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Configuration settings including a Core Configuration heading, which contains an Index Configuration section" /%} | Standalone | | **Core Configuration** section with **Security Filters Configuration** {% image source="https://docs.dd-static.net/images/security/cloud_siem/guide/config_core_security_filters.9333dd436a4d2cb4f7e669d38b574883.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/cloud_siem/guide/config_core_security_filters.9333dd436a4d2cb4f7e669d38b574883.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Configuration settings including a Core Configuration heading, which contains an Security Filters Configuration section." /%} | Add-on with Flex Logs | | **Sources** table {% image source="https://docs.dd-static.net/images/security/cloud_siem/guide/config_sources.f5e920af953f0eb3034b436897819e29.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/cloud_siem/guide/config_sources.f5e920af953f0eb3034b436897819e29.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Configuration settings including a Sources table" /%} | Legacy | ## Features by Cloud SIEM product{% #features %} The following table lists the Cloud SIEM features available in each product. | Feature | Standalone | Add-on with Flex Logs | Legacy | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | --------------------- | ------ | | [Content Packs](https://docs.datadoghq.com/security/cloud_siem/ingest_and_enrich/content_packs.md) | yes | yes | yes | | [Editing default detection rules](https://docs.datadoghq.com/security/detection_rules.md) | yes | yes | yes | | [MITRE ATT&CK Map](https://docs.datadoghq.com/security/cloud_siem/detect_and_monitor/mitre_attack_map.md) | yes | yes | yes | | [Security Filters](https://docs.datadoghq.com/security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes.md#how-security-filters-work) | yes | yes | | [Log index filters](https://docs.datadoghq.com/security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes.md#cloud-siem-standalone-filter-the-cloud-siem-index) | yes | | [MITRE ATT&CK Map compact view](https://docs.datadoghq.com/security/cloud_siem/detect_and_monitor/mitre_attack_map.md) | yes | yes | | [Scheduled rules](https://docs.datadoghq.com/security/cloud_siem/detect_and_monitor/custom_detection_rules.md) | yes | yes | | [Sequence detections](https://docs.datadoghq.com/security/cloud_siem/detect_and_monitor/custom_detection_rules/sequence.md) | yes | yes | | [Historical jobs](https://docs.datadoghq.com/security/cloud_siem/detect_and_monitor/historical_jobs.md) | yes | yes | | [Risk Insights](https://docs.datadoghq.com/security/cloud_siem/triage_and_investigate/entities_and_risk_scoring.md) | yes | yes | | [Dynamic Severity](https://docs.datadoghq.com/security/cloud_siem/detect_and_monitor/dynamic_severity.md) | yes | yes | | [Open Cybersecurity Schema Framework (OCSF)](https://docs.datadoghq.com/security/cloud_siem/ingest_and_enrich/open_cybersecurity_schema_framework.md) | yes | yes | | [Threat intelligence](https://docs.datadoghq.com/security/cloud_siem/ingest_and_enrich/threat_intelligence.md) | yes | yes | For help identifying your product, or to use a feature your product does not include, contact your Datadog account team or [Datadog support](https://docs.datadoghq.com/help/).