菜单
Work with Datadog Incidents API - fetch incidents with enrichment, update incident fields, understand incident data structures. Use when working with incidents or the dd-cli get-incident/update-incident commands.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Create, inspect, and update Datadog monitors via API - get monitor details by ID or URL, create or update metric/query alerts with thresholds and Slack notifications. Use when setting up alerting, tuning monitors, investigating monitor triggers, or checking monitor group states.
Troubleshoot Datadog API authentication issues (401/403 errors), understand API keys vs app keys, and configure correct regions. Use when hitting auth errors or setting up Datadog API access.
Search and manage Datadog Error Tracking issues via API - find grouped errors by service, resolve/ignore issues. Use when investigating production errors or managing error tracking issue states.
Create log-based count metrics via API - works with all storage tiers including flex. Use when you need to monitor log patterns but logs are in flex tier (where log monitors don't work).
Search Datadog logs via API - query syntax, storage tiers (indexes, flex, online-archives), pagination. Use when searching logs or using the dd-cli search-logs command.
List and inspect Datadog SLOs via API - view SLI values, error budgets, thresholds, and history. Use when checking SLO compliance, reviewing error budgets, or finding SLOs by tag.
基于 SOC 职业分类
| name | datadog-incidents |
| description | Work with Datadog Incidents API - fetch incidents with enrichment, update incident fields, understand incident data structures. Use when working with incidents or the dd-cli get-incident/update-incident commands. |
# Get incident by ID (public ID like 152, or UUID)
dd-cli get-incident 152
# Get enriched incident with user details
dd-cli get-incident 152 --include users
# Get fully enriched with incident type and integrations
dd-cli get-incident 152 --include users --enrich
# Update incident
dd-cli update-incident 152 --title "New Title" --severity SEV-2 --state resolved
Returns incident data with UUIDs for users - less useful for human analysis.
--include usersTransforms user references:
"created_by": {
"data": {
"type": "users",
"id": "0082a465-...",
"attributes": {
"name": "Jane Doe",
"email": "jdoe@example.com"
}
}
}
--enrichAdds enrichment section with:
--title - Incident title--severity - SEV-1, SEV-2, etc.--state - active, stable, resolved--customer-impacted - true/false--customer-impact-scope - Description of impactdd-cli update-incident 152 --field "root_cause=Database timeout" --field "teams=backend"
152 instead of full UUIDinclude parameter only works for users and attachments# Get with user enrichment
curl -X GET "https://api.$DD_SITE/api/v2/incidents/$INCIDENT_UUID?include=users" \
-H "DD-API-KEY: $DD_API_KEY" \
-H "DD-APPLICATION-KEY: $DD_APP_KEY"
# Get integrations (Slack/Jira)
curl -X GET "https://api.$DD_SITE/api/v2/incidents/$INCIDENT_UUID/relationships/integrations" \
-H "DD-API-KEY: $DD_API_KEY" \
-H "DD-APPLICATION-KEY: $DD_APP_KEY"
# Get incident type config
curl -X GET "https://api.$DD_SITE/api/v2/incidents/config/types/$TYPE_UUID" \
-H "DD-API-KEY: $DD_API_KEY" \
-H "DD-APPLICATION-KEY: $DD_APP_KEY"