SIEM and APM
Supahound vs Datadog: a general SIEM vs detectors built for Supabase
Datadog is an observability platform; this page compares its Cloud SIEM and App and API Protection products. Supahound reads Supabase edge logs and flags abnormal traffic per user. Datadog gives a security team a general detection engine across many systems; Supahound gives a Supabase team detectors that already know Supabase.
Last updated
How do Supahound and Datadog compare?
| Question | Supahound | Datadog |
|---|---|---|
| Supabase-specific detectors? | Yes. Cross-tenant reads, service-key misuse and more. | Not described. You build those rules yourself. |
| How it gets Supabase data | Read-only OAuth; reads edge logs. | Metrics integration, plus a log drain for edge logs (Supabase Pro, Team or Enterprise). |
| Needs a service-role key? | No. | The metrics integration uses the service_role JWT. The log-drain route does not. |
| Detection rules | Per-actor Supabase detectors. | 800+ out-of-the-box rules and threat intelligence. |
| History | 30-day incident history. | 12 months of analysis and retention. |
| Pricing model | Per project per month. | Per GB analyzed and per event indexed. |
What does Datadog do well?
- A real-time detection engine with 800+ out-of-the-box detection rules and threat intelligence.
- Bits Security Analyst investigates alerts, and you get 12 months of searchable security data.
- The Supabase integration collects Postgres, PgBouncer, Supavisor, PostgREST and runtime metrics.
- Supabase log drains can send logs to Datadog.
What does Datadog not cover?
- The Supabase integration collects metrics only and includes no events. Edge logs need a Supabase log drain, which needs a Pro, Team or Enterprise plan.
- The integration's metrics endpoint uses the service_role JWT as its password.
- No Supabase-specific detection for cross-tenant reads or service-role key misuse is described. You build those rules yourself.
- Usage-based pricing per GB and per event is designed for larger teams.
How much does Datadog cost?
Cloud SIEM starts at $5 per GB analyzed per month billed annually, or $7.50 on demand, with 12 months of analysis and retention. Log Management costs $0.10 per GB ingested, and standard indexing costs $1.70 per million events (annual) or $2.55 (on demand). See Datadog's pricing page for the App and API Protection price. Supahound's posture scan is free; runtime detection is $29 per project per month (pricing).
Which one should I choose?
Choose Datadog if you already run Datadog and have a security team to write and tune detection rules across many systems.
Choose Supahound if you want Supabase detectors that work without writing rules, without a service-role key and without per-GB billing.
Frequently asked questions
- Does Datadog's Supabase integration need my service-role key?
- Yes, for metrics: its metrics endpoint uses the service_role JWT as its password. The log-drain route does not. Supahound never asks for a service-role key; it uses read-only OAuth.
- Does Datadog detect cross-tenant reads on Supabase out of the box?
- Datadog's docs do not describe a Supabase-specific rule for it. Its SIEM ships 800+ general rules, and you would write a cross-tenant rule yourself on drained edge logs.
- We already pay for Datadog. Is Supahound still worth it?
- If your security team has time to build and tune Supabase rules in Datadog, you may not need it. If not, Supahound adds per-actor Supabase detectors for a fixed price per project.
Find out if someone is abusing your app
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.
Sources
Checked on . Products change; check each source for current details.