Switched from Panther to Datadog Cloud SIEM - which is better?

Hey everyone! 👋 I've been a Panther user for about 18 months, deeply embedded in their platform for monitoring our marketing tech stack's security posture (think PII data flows, access logs from our CDP, suspicious campaign deployment activity). Last quarter, we made a strategic shift to consolidate tools and moved to Datadog Cloud SIEM. I've now lived with both for a meaningful period, and I wanted to share my detailed, hands-on comparison for anyone else weighing these two options.

My core takeaway: **Panther feels like a powerful, dedicated security investigation lab, while Datadog is a seamless, real-time operational dashboard that happens to do great security.** The "better" tool depends entirely on whether security is a standalone function or integrated into your DevOps/marketing ops workflow.

Here’s my breakdown of key dimensions:

**Log Analysis & Schema Mapping**
* **Panther:** You embrace the power—and the work—of defining everything. Writing your own Python-based detection rules and data transforms is incredibly flexible. I had schemas meticulously mapped for our marketing attribution logs. Example of a simple custom detection I wrote:
```python
def rule(event):
# Alert on admin console login from non-corporate IP for our CMS
return (event.get('eventType') == 'console_login' and
event.get('app_name') == 'marketing_cms' and
event.get('ip_address') not in CORPORATE_NETWORKS)
```
This is fantastic for bespoke needs but requires ongoing maintenance.
* **Datadog:** It’s all about out-of-the-box normalization. You send logs, and Datadog automatically parses common fields (`user.email`, `client.ip`). The speed to value is insane, but sometimes you have to massage custom log formats (like our proprietary A/B testing tool logs) to get them perfectly understood.

**Detection & Alerting Workflow**
* **Panther:** The detection-as-code model is brilliant for version control, peer review, and integration into existing CI/CD pipelines. We had detections for anomalies in ad spend data drops. The downside is it's a more "deploy and wait" cycle.
* **Datadog:** Real-time alerting feels more fluid. Setting up a monitor for, say, "more than 5 failed login attempts to the analytics dashboard in 10 minutes" is a 5-minute UI task. The tight integration with their APM and infrastructure metrics lets you create super-contextful alerts (e.g., a security event *combined with* a spike in database CPU).

**Context & Investigation**
* **Panther:** Built for security analysts. The alert triage workflow, the ability to run bulk searches across all data with SQL/Panther Query Language, and the focus on resource-centric views (what happened with this user?) are top-tier.
* **Datadog:** Built for on-call engineers. The context is unparalleled because the security alert sits right next to the service latency graph, the deployment markers, and the related error logs. For investigating a potential breach in our data pipeline, seeing the exact code deployment that preceded it was a game-changer.

**Pricing & Value**
This was a major factor for us. Panther's pricing based on data analyzed per month is predictable and can be cost-effective if you're selective about what you ingest. Datadog's model (based on ingested GB per month + per-host fees for the infra monitoring side) can get complex, but the consolidation meant we decommissioned a separate infra tool, which offset the cost.

**So, which is better?**
If your primary need is a robust, security-focused SOC platform and your team loves code-first tooling, **Panther is a phenomenal choice.** It's deep and powerful.
If security is one piece of your operational puzzle and you value speed, unified visibility, and having security data sit alongside performance data, **Datadog Cloud SIEM is transformative.** The operational context it provides is something Panther simply can't match, as it's not built to see your entire stack's health.

For our use case—where the marketing engineering team owns both the security and reliability of our data pipelines—Datadog's integrated worldview won out. But I genuinely miss the granular control and dedicated security focus of Panther some days.

I'm happy to dive deeper into any specific area—like comparing detection rule syntax or log onboarding—if anyone has questions!