| name | datadog-incidents |
| description | Manage incidents in Datadog Incident Management. |
| version | 1.0.0 |
| license | Apache-2.0 |
| author | netclaw |
| tags | [] |
Datadog Incidents Skill
Manage incidents in Datadog Incident Management.
Tools
| Tool | Description |
|---|
list_incidents | List incidents with optional filters |
get_incident | Get detailed incident information |
create_incident | Create a new incident (read-only by default) |
update_incident | Update incident status or fields (read-only by default) |
Example Queries
List all active incidents
→ list_incidents(status="active")
Get details of a specific incident
→ get_incident(incident_id="INC-12345")
List recent network-related incidents
→ list_incidents(tags=["service:network"], time_range="7d")
List SEV1 incidents from the past month
→ list_incidents(severity="SEV-1", time_range="30d")
Workflows
Incident Investigation
- List active incidents:
list_incidents(status="active")
- Get incident details:
get_incident(incident_id="INC-12345")
- Review timeline and related monitors
- Check correlated metrics and logs
- Document findings in incident
Network Outage Tracking
- Search network incidents:
list_incidents(tags=["service:network"])
- Filter by impact:
list_incidents(severity="SEV-1,SEV-2")
- Review affected services and dependencies
- Track MTTR and resolution patterns
Post-Incident Review
- Get incident timeline:
get_incident(incident_id="INC-12345")
- Extract key events and decisions
- Identify detection and response gaps
- Document lessons learned
Prerequisites
DD_API_KEY Datadog API key
DD_APP_KEY Datadog application key
DD_SITE Datadog site (optional, defaults to datadoghq.com)
Server
This skill uses the datadog-mcp server via remote MCP transport.
Notes
- Create and update operations may require additional permissions
- NetClaw operates in read-only mode by default for safety
- Incident creation should follow your organization's incident process