Observability: metrics, logs and traces

Picture a company that sells scheduling and dispatch software to plumbing and electrical contractors. It runs about 500 hosts on one cloud and writes about 2 TB of logs a day. When a dispatcher drags a job onto a technician's calendar and nothing happens for eight seconds, somebody at the dispatch company needs to know within minutes, find out why and fix it. Observability is everything that makes that possible, and it's one of the larger software bills the company pays.

Your services emit telemetry: metrics (numbers over time, like error rate), logs (lines of text describing what happened), traces (the path of one request across services, made of one span per step) and, increasingly, profiles of which code burns CPU. Collectors pick it up: a vendor's agent on each host, or OpenTelemetry, the open standard for instrumenting code and moving telemetry. They send it to a pipeline that filters, samples (keeps a fraction on purpose) and routes it. The pipeline decides what's kept before the platform stores it, and it's where the bill is set, because everything after it is priced by volume. The platform stores, queries and alerts the on-call team, the engineers whose phones ring, who use dashboards and traces to fix the service. The same data now feeds security and AI products: a SIEM (the security team's log analysis and detection system), cloud security tools, and AI agents that investigate incidents. That reuse is pulling the observability, security and AI markets closer.

What I'd want a new PM in this space to take away:

1. The bill: what you index sets the bill. Vendors price on volume units (hosts, gigabytes, events, metric series), and the unit shapes what gets sampled, indexed and kept. A 10% rise in traffic can grow the bill by 40-50%, because cardinality (the number of unique label combinations on a metric), log verbosity, the share of logs indexed and overage rates multiply on top of traffic. Cost control is now a funded category, and security and observability companies are buying it up. More in How the money moves.
2. OpenTelemetry: it made collection portable. It graduated in the CNCF (the Linux Foundation's home for cloud software) on May 21, 2026, and every major vendor now accepts its data. Lock-in moved up the stack, to billing units, dashboards, alert rules, query languages and years of history, none of which port. See Interfaces & standards.
3. Signal: the hard work is deciding which data and which alerts matter. Alert fatigue tops the list of obstacles to faster incident response in Grafana Labs' practitioner survey, and in Splunk's 2025 survey 73% of respondents said they'd had outages caused by alerts that were ignored or suppressed. Google's own guidance aims for one alert per real incident; few teams get close.
4. Convergence: it's only partly real. Security vendors are buying pipelines and observability companies, and observability vendors sell security on the same meters. But Datadog's whole security business is about a seventh the size of the SIEM businesses at Palo Alto Networks or CrowdStrike, and the new AI layer is separating from the data store rather than locking customers into it. More in Observability, security and AI: what's real.
5. Rules: they're thinner than in payments or identity, and I'd say so plainly to anyone new. Nobody licenses observability. The rules bite on the data inside telemetry (personal, card and health data), on retention floors for some buyers, and through vendor SLAs that cap liability at service credits.

Monitoring in the compliance sense, watching transactions for money laundering, is a different job with the same word; it's in Identity and trust. Tracing and evaluating AI agents is in AI agents: orchestration platforms. Cloud security (CNAPP) gets its own guide later in this series; here I only cover where it meets observability.

The main players

These are the names behind the diagram's roles, layer by layer, in no particular order.

How they make money, and who's moving:

• Open source earns through the companies that sell managed versions or support. OpenTelemetry graduated with more than 12,000 contributors from more than 2,800 companies. Prometheus 3.0 (November 2024) accepts OpenTelemetry metrics natively, and Grafana donated its eBPF instrumentation to OpenTelemetry in May 2025. Fluent Bit claims more than 15 billion downloads (company figure).
• Pipelines charge per gigabyte processed or in credits, and pitch savings on the downstream bill. Cribl says it passed $300 million of annual recurring revenue (ARR) in 2025, up from $200 million (self-reported). Chronosphere had more than $160 million of ARR, growing triple digits, when Palo Alto agreed to buy it for $3.35 billion; the deal closed on January 29, 2026. Bindplane added $13 million of ARR to Dynatrace by June 2026. CrowdStrike bought Onum (about $290 million, reported) and SentinelOne bought Observo AI (about $225 million) in 2025.
• Incumbent platforms charge per host, gigabyte, million events and metric series, under annual commitments with overage on top, at gross margins of about 80%. Datadog's revenue grew 36% to $1.12 billion in the quarter to June 2026. Dynatrace's ARR grew 17% to $2.14 billion, with log consumption doubling. Elastic grew 15% to about $478 million a quarter and doesn't split observability out. Cisco's Observability line grew 4% to about $1.1 billion in fiscal 2026; most of Splunk's log business sits in its Security line. New Relic has been private since a take-private of about $6.5 billion in November 2023.
• Newer platforms often charge on a different unit to make a point. Grafana Labs says it passed $400 million of ARR and 7,000 customers in September 2025 (self-reported). Honeycomb prices per event, so adding detail costs nothing; its last disclosed round was in 2023. Coralogix raised at $1.6 billion in June 2026, Dash0 at $1 billion in March 2026 and groundcover $100 million in July 2026. ClickHouse raised at $15 billion in January 2026 and bought Langfuse, an LLM tracing tool, and Snowflake bought Observe in February 2026 for about $596 million, according to its filings.
• Cloud providers charge per gigabyte, metric and trace, and none discloses observability revenue. CloudWatch shows up on the AWS invoice and counts toward a customer's existing AWS commitment.
• Incident tools charge per user, usually $15-50 a month. PagerDuty's ARR was about $500 million in mid-2026, roughly flat. incident.io raised $62 million at about $400 million in April 2025, and Freshworks bought FireHydrant in December 2025. Atlassian ends support for Opsgenie on April 5, 2027, which puts its installed base up for grabs.
• Security vendors sell SIEM on volume and cloud security per host. Google closed its $32 billion purchase of Wiz on March 11, 2026. Palo Alto's XSIAM passed $700 million of ARR and CrowdStrike's Next-Gen SIEM $695 million (secondary coverage). Datadog's security products passed $100 million of ARR in 2025.
• AI SRE is priced as metered work: credits, agent-seconds or a monthly fee. Resolve AI raised $125 million at a $1 billion valuation on what TechCrunch's sources put at about $4 million of ARR, and Traversal raised $48 million in June 2025. AWS DevOps Agent became generally available on March 31, 2026, and Dynatrace opened Bluebox to early adopters in July 2026.

As of October 2026. This market moves through acquisitions every quarter, so treat the list as a map to check before relying on it.

Back to the dispatch company. A dispatcher assigns a job, and the request passes through the API gateway, the scheduling service, a Postgres database and a notification service that texts the technician. The OpenTelemetry SDK in each service creates a span and passes a trace ID along in a header, so the spans join into one trace. The Datadog Agent on each host collects spans, logs and metrics and sends them to a Cribl pipeline, which drops debug logs, keeps every trace with an error plus a sample of the rest, and copies the full log stream to an S3 bucket the company owns. Datadog indexes the errors and a fifth of the other logs. When the scheduling service burns through its error budget too fast, a Datadog monitor pages the on-call engineer through PagerDuty, Bits AI SRE drafts a guess at the cause, and the engineer opens the trace to find a slow query from that morning's deploy. The same logs reach Palo Alto's SIEM for the security team. Six or seven companies touch one slow drag-and-drop, and the dispatch company pays most of them by volume.

How telemetry becomes a fix, step by step

Here's the slow job assignment from the moment the code records it to the fix. Much of the data is sampled out or dropped before it's kept, usually to control cost. And an alert only helps if someone acts on it; noisy alerts get ignored, and that's where many incidents slip through.

1. Emitted: the scheduling service records a latency metric, a log line and a span. Spans come from an SDK the team calls in code, from auto-instrumentation that hooks into common frameworks, or from eBPF, which watches network calls from the Linux kernel without code changes. Real-user monitoring (RUM) is emitted from users' browsers and phones. Breaks: a proxy or message queue drops the trace header and the trace splits in two; a host with a bad clock produces negative durations.
2. Kept: a collector on each host batches the data and adds host and Kubernetes details, then a pipeline filters, samples, redacts and routes it. Head sampling decides cheaply at the start of a trace. Tail sampling waits until the trace is complete and keeps the errors and slow ones, but it holds whole traces in memory, and OpenTelemetry's docs say it can take "dozens or even hundreds" of servers at scale. The platform indexes some data (fast to search, expensive) and stores the rest cheaply. Breaks: head sampling at 1% also drops 99% of error traces; scaling a tail-sampling tier can split traces silently; a collector buffer fills while the backend is slow, and data is lost during the very incident you need it for.
3. Alerted: a rule fires on a threshold, an anomaly or an SLO (service level objective, an internal target such as 99.9% of requests succeeding over 30 days). SLO alerts fire on burn rate, how fast the error budget (the 0.1% you're allowed to fail) is being spent. Breaks: Google's SRE Workbook shows that a plain alert on a 0.1% error rate over ten minutes could fire up to 144 times a day while the service still meets its SLO, which trains people to ignore the pager.
4. Investigated: someone looks, usually going from a dashboard to a trace to the logs, then to recent deploys and feature-flag changes. Google budgets about six hours of engineering per incident, postmortem included. This is the step AI SRE products target. Breaks: the trace that would show the cause was sampled out; the logs must be pulled back from the archive; the observability vendor itself is down.
5. Resolved: the team mitigates (roll back, fail over, turn off a flag), fixes properly later and writes a blameless postmortem with action items. Breaks: the action items never close, and the incident comes back a quarter later.

Two exits sit off that path. Dropped is data sampled out or filtered because keeping it was too costly; it can't be recovered. Ignored is an alert nobody acted on, usually because the same rule had fired falsely many times. In Splunk's 2025 survey, 52% of respondents said they struggle with high volumes of false alerts.

The cardinality column is worth remembering. A customer ID on a metric multiplies the series by the number of customers, while on a span it adds almost nothing, so per-customer questions belong in traces.

Collecting the data

Most large companies end up with a mix: in Grafana's 2026 survey, 65% of respondents were investing in both Prometheus and OpenTelemetry.

Which observability setup? Five questions

1. How much will you send? Estimate hosts, gigabytes of logs a day, metric series and spans, then price each against the vendor's units. The same telemetry on the same vendor can cost three times more depending on how much you index, so model the indexing share before the contract.
2. Who will run it? Self-hosted open source has no licence fee, but at 500 hosts it usually takes two to five platform engineers, who cost more than the software saves until you're very large.
3. How portable must you be? If you might switch vendors or run two, instrument with OpenTelemetry and keep a full copy of logs in storage you own. Dashboards, alert rules and query history won't move either way, so keep them as code.
4. Who else wants the data? If the security team needs the same logs for its SIEM, a pipeline that routes one stream to both is cheaper than two collectors.
5. Which rules apply? Card data, health data, US federal customers and EU residents each change retention, region and certification needs. Region is usually fixed when the account is created, so decide it first.

My defaults: for a B2B software company of a few hundred hosts, instrument new code with OpenTelemetry, use one commercial platform for breadth, and put a pipeline in front of it once logs pass about a terabyte a day. Index errors and the logs you search weekly; send the rest to cheap storage you own. Alert on SLO burn rates for user-facing services and review every page that wasn't actionable. And read the overage rates and the custom-metric definition before the headline price.

What's different here

How the money moves

The customer pays almost everyone, mostly by volume. The app teams who decide what to log rarely see the bill; the platform team owns it.

Enterprise contracts are discounted from list, often a lot, and nobody publishes by how much. Overage is the opposite: above the commitment, Datadog's on-demand rates run 20-50% higher than its annual rates.

Gartner's research, as summarized by others, puts its median client's spend with a single observability vendor above $800,000 a year. At the top end, OpenAI was reported in 2025 to spend about $170 million a year on Datadog.

The vendors' growth model is the customer's bill seen from the other side. Datadog, Dynatrace and Elastic report net retention between about 110% and the low 120s, meaning existing customers spend that much more each year, and in Grafana's 2026 survey most respondents expecting higher spend blamed broader adoption more than price rises.

A year of observability for 500 hosts and 2 TB of logs a day

Back to the dispatch company: 500 hosts with APM on all of them, about 2 TB of logs a day (roughly 60 billion log events a month at an average of 1 KB each), half a million to 1.5 million metric series, and 10-20 TB of sampled traces a month. Searchable logs are kept 30 days, metrics 13 months, and a log archive for a year. Every figure is a list-price range for a year, before discounts.

The striking gap is between the two Datadog rows: same telemetry, same vendor, about three times the bill, and the only difference is how much gets indexed. Under ingest-only pricing (New Relic, Grafana) savings from dropping data scale with bytes, so a pipeline matters less there.

As I read the numbers, self-hosting doesn't save money at this size once people are counted. It wins at Airbnb's scale, where moving metrics to OpenTelemetry and open-source storage at more than 100 million samples a second reportedly cut cost by about an order of magnitude. CloudWatch looks expensive on paper, and Gartner's clients complain about its cost, but teams pick it anyway because it draws down a commitment they've already signed.

Why the bill grew 47% when traffic grew 10%

Now the next quarter. Traffic grows 10%, and the disciplined Datadog setup starts at about $66,000 a month.

None of those drivers shows up on a traffic dashboard. A smaller example in the research, 200 hosts and 1.5 TB of logs a day, comes out at +39% on the same mechanics, so I'd tell a CFO "40-50%" and explain the four causes.

The fix is mostly in the pipeline and the tag allow-list: drop debug logs before ingest, index less, keep the customer tag ingested but unindexed, or move per-customer detail into traces. In the smaller example those moves bring the bill back to about 6% above baseline. The pipeline itself cost about 15% of the bill there. At index-heavy prices it pays for itself many times over if it cuts what gets indexed; cutting ingest alone barely covers its cost.

What the pipelines are worth

Cost control is a funded category, and it's being bought: Palo Alto, Dynatrace, CrowdStrike and SentinelOne all bought pipelines in 2025-2026 (see The main players). The platforms ship their own cost tools too, such as Grafana's Adaptive Metrics and Adaptive Logs, which Grafana says cut series by up to 80% and logs by up to 50%. Cribl's secondary-market value of about $3 billion in September 2026 sits below its 2024 round. The buyers seem to treat pipelines as a feature of a SIEM or a platform, and I'm not sure cost control survives as a standalone category.

Who holds the power

Power in observability follows whoever controls the meter, the history and the pipeline.

• Platform vendors hold the meter and the unit definitions, years of history, dashboards and alert rules written in their query languages, multi-product bundles (58% of Datadog's customers used four or more products by mid-2026) and an agent on every host. Each makes a partial exit harder.
• Customers gain power through OpenTelemetry, a pipeline they control, an archive in their own bucket, PromQL-compatible backends and the renewal date. In Grafana's survey, 37% of OpenTelemetry adopters cite freedom to switch vendors. The power shows up mostly at renewal and mostly for large buyers who can afford to run two stacks.
• Cloud providers hold the default, the invoice and the commitment. Their tools are one click away, their charges count toward commitments customers already signed, and AWS gives DevOps Agent credits worth 30-100% of a customer's support spend, which specialists can't match.
• Security vendors hold the CISO's budget and the detection content, and they're buying pipelines to control what reaches any SIEM.
• OpenTelemetry's maintainers, many of them vendor employees, decide what attributes are called. A rename costs everyone downstream.
• Coding-agent vendors are a new channel. Whoever feeds production context into Claude, Copilot, Cursor or AWS's Kiro gets embedded in how code is written.
• Regulators hold little direct power. They set retention floors for some buyers and data rules for what's inside the logs.

How the rules work

There's no observability regulator and no licence, so most of this section is about data rules and buyer rules that happen to land on telemetry. I'd still take them seriously, because the fines come from what's in the logs.

Personal data in logs. Telemetry carries IP addresses, user IDs, emails in URLs, auth tokens in headers and now LLM prompts. The largest GDPR fine I found about data sitting in internal systems is Meta's €91 million from Ireland's regulator in September 2024, for passwords stored in plaintext, partly for failing to notify and document the breach. France's CNIL recommends keeping access logs six months to a year, minimizing personal data in them, and storing them separately and append-only. Deleting one person's data from append-only stores is hard, so the common practice is to redact in the pipeline and keep retention short. The customer is the controller and carries the liability; the vendor is a processor.

Diagnostic files are the leak people forget. In 2023 an attacker reached support files for 134 Okta customers; some were browser recordings (HAR files) holding session tokens, and five customers' sessions were hijacked. Those files never went through a pipeline. Session replay in RUM tools has its own exposure: since a court struck down part of HHS's tracking guidance in 2024, claims over replay and tracking pixels have moved to state wiretap lawsuits against website operators.

Retention floors.

The federal change is the clearest example of rules following the bill. M-26-14 cut the floor from 30 months to 12, and the memo itself says keeping "vast quantities of logging data without clear utility" was neither operationally feasible nor cost-effective. Its top maturity level grades signal: logs should generate actionable alerts covering at least 95% of baseline requirements. PCI's 12-and-3 maps neatly onto vendors' hot and archive tiers.

Buyer rules. FedRAMP decides who can sell to US federal agencies. Datadog for Government and Grafana's federal cloud say they're authorized at High, Dynatrace holds Moderate and said in July 2026 it would pursue High, and FedRAMP's new 20x process becomes mandatory on January 1, 2027. Listed US companies must file an 8-K within four business days of deciding a cyber incident is material, under SEC Item 1.05; trade groups want it rescinded, but I found no proposal as of October 2026. Telemetry is the evidence for scoping, and "we can't determine the scope" is an answer regulators read badly.

Residency and switching. Regions are fixed at setup. Datadog's sites are separate ("you cannot share data across sites"), and New Relic says the customer is "solely responsible" for choosing its region. Moving is a re-implementation. From January 12, 2027, the EU Data Act bars cloud and SaaS providers, observability vendors included, from charging EU customers switching or data-egress fees when they move.

SLAs and contracts. Most of the customer's protection sits here, and it's thin; see Liability allocation. EU financial firms have their own operational resilience rules (DORA), which I haven't covered.

What mistakes cost

• Bill shock: a tag or a debug flag can add tens of thousands of dollars a month within days, and overage history raises the next commitment.
• Ignored alerts: users find the outage first. In Splunk's UK cut of its 2025 survey, 54% said false alerts hurt morale.
• Cost-cutting blind spots: dropped logs and sampled traces lengthen the next investigation, and rehydrating the archive mid-incident costs time you don't have.
• Secrets in logs: Meta's €91 million fine was about passwords in internal systems, and Okta's 2023 breach ran through troubleshooting files.
• Logs you didn't keep: after Storm-0558, the US Cyber Safety Review Board found Microsoft had "no evidence or logs" for parts of its explanation.
• Vendor and agent failures: Datadog's 2023 outage and CrowdStrike's 2024 update, both in Liability allocation, left customers carrying most of the cost.
• The wrong region: moving an account to another region is a rebuild, with dashboards and alerts recreated by hand.

Observability, security and AI: what's real

My view as of October 2026: the convergence is real at two layers, the pipeline and the agent on the host, and weak at the revenue line, where security buyers still mostly buy from security vendors. AI investigation is improving but solves a minority of incidents on public benchmarks, and the AI layer is separating from the data store. If I were at an observability vendor, I'd treat the pipeline and the context (who owns what, what changed, how services connect) as what's worth defending, more than the raw data.

What's real in the security convergence

• Buying the data path: Palo Alto closed Chronosphere on January 29, 2026 and calls it "our next-generation observability platform"; its annual report now names Datadog, Dynatrace and Elastic as competitors. CrowdStrike and SentinelOne bought telemetry pipelines in 2025. Going the other way, Cribl bought detection-engineering and AI security-operations assets in mid-2026.
• Same meters: Datadog prices its SIEM at $5 per million events analyzed and cloud security at $10-25 per host, on the same agent and bill. On a company with the dispatch company's host count and about half its log volume, adding SIEM, cloud security and a sensitive-data scanner would run roughly 20-35% on top of the log bill. One of Datadog's mid-2026 wins was a bank adopting its SIEM for how it handles personal data.
• The host agent: Wiz, built agentless, now ships a runtime sensor on the workload, while Datadog sells workload security from its observability agent. Google closed Wiz for $32 billion on March 11, 2026, so a cloud provider now owns a cloud-security leader.

What's not there yet

• Scale: Datadog's security products passed $100 million of ARR in 2025. By their 2026 figures, Palo Alto's XSIAM and CrowdStrike's Next-Gen SIEM are each around $700 million, roughly seven times larger even allowing for the year's gap, and Datadog's security business is a few percent of its revenue by my estimate.
• Growth from owning both: Cisco owns Splunk on both sides, and in its fiscal 2026 Security grew 2% and Observability 4%.
• Different buyers: reliability teams measure time to recover, SLOs and cost per gigabyte; security teams measure detection coverage, how long an attacker goes unnoticed, and audit evidence. Security vendors stay ahead on detection rules and threat intelligence, and observability vendors win on consolidation and data handling.

What's real in AI SRE

AI SRE (site reliability engineering) products promise to turn an alert into a diagnosis, and sometimes a fix.

The benchmarks are sobering. On OpenRCA, a public root-cause benchmark presented in 2025, the best model solved about 11% of 335 failure cases, and ITBench put AI agents at 11-14% of its SRE scenarios. A 2026 follow-up, OpenRCA 2.0, found about 21% exact root causes across 11 frontier models. Scores are rising from one paper to the next, but I'd treat any claim of autonomous root-cause analysis as running ahead of the evidence.

Dynatrace shows the gap in its own messaging. Its CTO has talked about taking humans out of the loop while also saying nobody has moved from AI-assisted to autonomous operations yet, and Bluebox's documentation says it "never pushes a fix on its own": it opens an issue, a coding agent proposes the change, and a person merges it. That's a policy statement more than a technical guarantee, and the liability sits with whoever approved the change.

Practitioners want to see the reasoning: in Grafana's 2026 survey, 95% said AI must show how it reached its answer, and the top barrier was having to feed it context by hand.

Where the AI layer is heading

• Away from the store: Datadog separated its AI security analyst from its SIEM "so customers can use it with other SIEMs", AWS DevOps Agent investigates apps outside AWS, and the startups store little telemetry. If the AI works on anyone's data, the store is less of a lock.
• Into coding agents: Bluebox, Datadog's Bits Code and AWS's Kiro feed production data into the tools that write code. The bottleneck moves to reviewing changes before production, the theme of Becoming AI native.
• AI workloads as telemetry: Dynatrace says more than 1,000 customers monitor AI workloads with it, and LLM prompts make traces bigger. OpenTelemetry's AI conventions are still in development, so vendors fill the gap with their own SDKs; agent tracing and evaluation are in AI agents: orchestration platforms.
• Metered pricing: credits, agent-seconds and tokens are priced like telemetry, and Datadog's move from per-investigation bundles to credits in mid-2026 cut the list price per investigation by about three-quarters by my arithmetic.

Questions to ask about an AI investigation agent

1. On your last hundred real incidents, how often was the agent's initial answer the root cause, and who checked?
2. What data does it read, through which interface, and does it copy telemetry into tickets or chat outside our retention policy?
3. Can it change anything in production, and what's the approval step and the audit trail when it does?
4. Does it work on data stored with another vendor, or only yours?
5. How is it priced per investigation at our volume, including the query charges it triggers?

What usually goes wrong

Words that mean something else here

What surprised me

Placeholders in your voice, drafted from the research and the earlier guides. Rewrite each with your own moment.

"Observability is a tool you buy." Coming from payments, I pictured a product with a price. It turned out to be a set of choices about what to keep, and the same telemetry on the same vendor could cost three times as much depending on how much we indexed.

"Open standards end lock-in." OpenTelemetry made the collection portable. The dashboards, alert rules, query language and two years of history stayed exactly where they were.

"More data, fewer outages." The incidents that hurt were the ones where an alert fired and nobody looked, because it had fired falsely all month.

"Security and observability are merging." The deals say so. The revenue says the security vendors' SIEMs are still several times bigger than the observability vendors' security lines.

"This is a regulated industry like the others." There's no licence and no supervisor. The rules that bit were about what we'd written into the logs.

Sources

Undated entries were read on October 8, 2026; "search result" means seen only as a search snippet or summary. Company figures are self-reported unless they come from a filing or a regulator.

Standards, open source and research

• CNCF, OpenTelemetry's graduation (May 2026)
• OpenTelemetry: specification status; sampling; collector follow-up survey (2026); eBPF instrumentation goals for 2026; Governance Committee elections (2026, search result)
• ClickHouse, OpenTelemetry semantic conventions; Greptime, GenAI semantic conventions (May 2026, search result)
• Prometheus, Prometheus 3.0 (Nov 2024)
• Grafana Labs, Beyla donated to OpenTelemetry (May 2025); Elastic, profiling agent accepted by OpenTelemetry
• Chronosphere, Fluent Bit v4 (Apr 2025)
• Google SRE: Alerting on SLOs; Monitoring Distributed Systems; Being On-Call; Postmortem Culture
• AI root-cause benchmarks: OpenRCA (ICLR 2025, search result); OpenRCA 2.0 (2026, search result); ITBench (2025, search result); ITBench leaderboard (search result)

Rules and regulators

• OMB, M-26-14 on agency logging (May 2026); cloud.gov, M-21-31 compliance (search result)
• Data Protection Commission, €91 million fine on Meta (Sep 2024, search result)
• CNIL, logging recommendation (Oct 2021, search result)
• PCI DSS v4 requirement 10.5.1, control summary (search result)
• Hunton: California's cybersecurity audit regulations (2025, search result); HHS tracking guidance ruling (Jun 2024, search result)
• Baird Holm, HHS withdraws its appeal (2024, search result)
• Fierce Healthcare, HIPAA Security Rule pushed to July 2027 (search result)
• Latham & Watkins, EU Data Act switching requirements (Aug 2025, search result)
• SEC, petition comments on cyber disclosure, File 4-856 (2026, search result); Rane, the future of the SEC's cybersecurity rules (search result)
• FedRAMP: A-LIGN, FedRAMP 20x (2026, search result); Datadog, FedRAMP High (search result); Grafana Labs, FedRAMP High (Apr 2025, search result); Dynatrace, intent to pursue FedRAMP High (Jul 2026, search result)

Company filings and results

• Datadog: FY2025 10-K (Feb 2026); Q2 2026 results (Aug 2026); Q2 2026 earnings call transcript (Aug 2026); Q3 2025 call transcript (search result)
• Dynatrace, Q1 FY27 results (Aug 2026); MarketBeat, Dynatrace Q1 call highlights (Aug 2026, search result)
• Elastic, Q1 FY27 results (Aug 2026, search result)
• Cisco: FY2026 results (Aug 2026); 10-Q for the quarter to April 2026
• PagerDuty, Q2 FY27 results (2026, search result)
• Palo Alto Networks: FY2026 10-K (Sep 2026); Chronosphere acquisition completed (Jan 2026); Chronosphere deal announcement (Nov 2025, search result); Zacks, XSIAM ARR (search result)
• CrowdStrike: Q2 FY27 results (Aug 2026, search result); Eastern Progress, Next-Gen SIEM momentum (search result); GovInfoSecurity, CrowdStrike buys Onum (Aug 2025, search result)
• SecurityWeek, SentinelOne to acquire Observo AI (Sep 2025, search result)
• Google, completes acquisition of Wiz (Mar 2026, search result); Wiz, runtime sensor (search result)
• Snowflake: Observe acquisition closed (2026); FY2026 10-K (search result)

Private companies and deals

• Cribl: $200 million ARR (Jan 2025); Axios Pro, $300 million ARR and secondary offering (Feb 2026); StockAnalysis profile (Sep 2026, search result); SaaSRise, Cribl buys Radiant Security's AI SOC technology (Aug 2026, search result)
• Grafana Labs, $400 million ARR and 7,000 customers (Sep 2025, search result)
• Bloomberg Government, ClickHouse at $15 billion (Jan 2026, search result); ClickHouse, ClickStack in ClickHouse Cloud
• SecurityWeek, Coralogix raises $200 million at $1.6 billion (Jun 2026)
• The Next Web, Dash0's $110 million Series B (Mar 2026)
• SiliconANGLE, groundcover raises $100 million (Jul 2026)
• BigDATAwire, New Relic to be acquired by Francisco Partners and TPG (2023, search result)
• TechCrunch, incident.io raises $62 million (Apr 2025, search result)
• Freshworks, acquisition of FireHydrant (Dec 2025, search result)
• Atlassian, Opsgenie licensing; Grafana Labs, OnCall open source in maintenance mode (Mar 2025) and OnCall OSS docs
• TechCrunch, Resolve AI confirms $125 million raise (Feb 2026); BuiltIn NYC, Traversal raises $48 million (Jun 2025); Business Wire, Traversal strategic investment (Mar 2026, search result); Business Wire, Cleric launch (Dec 2025)

Pricing, product and legal pages

• Datadog: price list; custom metrics billing; billing; DDOT collector; Flex Frozen, Archive Search and CloudPrem (Jun 2025); sites (search result); March 2023 incident
• Dynatrace: pricing; Bluebox on Dynatrace Hub
• Bluebox: product and pricing
• Grafana Labs: pricing; Grafana Cloud SLA
• New Relic: pricing; EU region (search result); service level commitment (search result)
• Splunk: Observability pricing; OpenTelemetry Collector distribution
• Honeycomb, pricing; incident.io, pricing; PagerDuty, incident management pricing (search result)
• AWS: CloudWatch pricing; DevOps Agent pricing; DevOps Agent generally available (Mar 2026, search result); Kiro, DevOps Agent and Bluebox (search result)
• Microsoft, Azure SRE Agent pricing

Surveys, press and analysis

• Grafana Labs: Observability Survey 2025; 2026 survey release (Mar 2026); open standards in the 2026 survey
• Splunk, State of Observability 2025 (Oct 2025); IT Brief UK, Splunk's UK findings
• Catchpoint, summary of Gartner's observability spend research; AWSInsider, Gartner on CloudWatch costs (Jul 2025)
• The Pragmatic Engineer: inside the Datadog outage (2023); Datadog's $65 million customer (May 2023, search result); The Pulse #148, OpenAI's Datadog spend (Oct 2025, search result)
• SaaSRise, Datadog's biggest AI client cuts usage (2026, search result)
• InfoQ, Airbnb's OpenTelemetry metrics pipeline (Apr 2026, search result)
• Okta, support system breach root cause (Nov 2023, search result)
• Dark Reading, Microsoft offers free logging (2023, search result); TechTarget, Cyber Safety Review Board on Microsoft (Mar 2024, search result)
• CrowdStrike outage: Axios, Fortune 500 impact (Jul 2024, search result); The Register, Delta's lawsuit allowed to proceed (May 2025, search result)
• TechTarget, Dynatrace executives on Bluebox (2026)
• Datadog AI credits change, pricing tracker (Jun 2026, search result)