Looking for Datadog SIEM and how to stream audit logs? Please look at our audit log help article here.
What does the integration do?
When you automatically trigger incidents using PagerDuty or OpsGenie, incident.io automatically pulls through information about any Datadog monitors that triggered the alert.
This means that when you join an incident channel, everything you need is right there:
The name of the triggering monitor, with a link to see more
Up to 500 characters of the body of the trigger monitor. This means if you can link things like runbooks in your monitors and have access to them in your incident channel.
The Alert Priority and Priority of your Datadog monitor
Any tags on your Datadog monitor
Additionally, we'll record the monitor as an incident.io attachment, so you if you go to the incident homepage on the web, you'll have a link to the monitor there under both the Attachments tab, and listed in your Timeline.
How do I set it up?
To get started, you need to first be sending your Datadog monitors to either PagerDuty or OpsGenie - if you've not done that, you can find instructions on Datadog's site (PagerDuty, OpsGenie).
Once you've installed those integrations, you can tag whichever service you want inside a Datadog monitor using something like
@pagerduty-growth-team. This will mean that when your monitor triggers, you'll page the service you've tagged.
The final piece to set up, is to configure incident.io to trigger incidents when a PagerDuty/OpsGenie alert occurs - details on how to do this can be found here.
Once you've completed the above steps, that's you! incident.io will now automatically pull through the originating Datadog monitor when an incident is created.
In addition to incident.io automatically pulling through Datadog Monitors, you can also pin Slack messages and incident.io will put them on your incident timeline in the dashboard and in post-mortems.
This is really useful for links to Datadog logs, traces and dashboards that might have helped you track down the cause of an incident.
Additionally, if you paste in the link to any Datadog snapshots, Slack will unfurl the image, and if you pin that message, incident.io will add the linked image to your timeline.
For more info on pinning items, check out our article on incident timelines.
Finally, incident.io automatically tracks any images that are shared in incident channels. So, if you screenshot a useful graph or trace, then paste it into your incident channel, that image will automatically be tracked on the incident timeline, and will be included in generated post-mortems.