> ## Documentation Index
> Fetch the complete documentation index at: https://docs.devin.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Auto-Investigate Datadog Alerts

export const UseCaseHero = ({title, description, prompt, category, features, devinUrl, agent, intent, playbookId, type}) => {
  const encodedPrompt = encodeURIComponent(prompt || '');
  const tag = 'docs-use-case-gallery';
  const utm = 'utm_source=docs&utm_medium=use-case-gallery&utm_campaign=hero-cta';
  const agentParams = (agent ? '&agent=' + agent : '') + (intent ? '&intent=' + intent : '') + (playbookId ? '&playbookId=' + playbookId : '');
  const devinHref = type === 'schedule' ? 'https://app.devin.ai/settings/schedules/create?' + utm + agentParams + (prompt ? '&prompt=' + encodedPrompt : '') : type === 'review' ? 'https://app.devin.ai/review?' + utm : agent === 'ada' ? 'https://app.devin.ai/search?' + utm + '&noSubmit=true' + (prompt ? '&prompt=' + encodedPrompt : '') : devinUrl ? devinUrl.includes('?') ? devinUrl + '&' + utm + agentParams : devinUrl + '?' + utm + agentParams : prompt ? 'https://app.devin.ai/?tags=' + tag + '&' + utm + agentParams + '&prompt=' + encodedPrompt : 'https://app.devin.ai/?' + utm + agentParams;
  const buttonLabel = type === 'schedule' ? 'Schedule in Devin ↗' : type === 'review' ? 'Set Up Devin Review ↗' : agent === 'advanced' ? 'Try in Devin ↗' : agent === 'dana' ? 'Try in Dana ↗' : agent === 'ada' ? 'Try in Ask Devin ↗' : 'Try in Devin ↗';
  const featureList = features ? features.split(',').map(f => f.trim()) : [];
  return <div className="uc-hero">
      <div className="uc-hero-inner">
        <div className="uc-hero-left">
          <h1 className="uc-hero-title">{title}</h1>
          <p className="uc-hero-desc">{description}</p>
          <div>
            <a href={devinHref} target="_blank" rel="noopener noreferrer" className="try-in-devin-btn">
              {buttonLabel}
            </a>
          </div>
        </div>
        <div className="uc-hero-meta">
          <div className="uc-meta-item">
            <span className="uc-meta-label">Author</span>
            <span className="uc-meta-value">Cognition</span>
          </div>
          <div className="uc-meta-item">
            <span className="uc-meta-label">Category</span>
            <span className="uc-meta-value">{category}</span>
          </div>
          {featureList.length > 0 && <div className="uc-meta-item">
              <span className="uc-meta-label">Features</span>
              <span className="uc-meta-value">{featureList.join(', ')}</span>
            </div>}
        </div>
      </div>
    </div>;
};

export const PromptBlock = ({children, type, agent, intent, playbookId}) => {
  var utm = 'utm_source=docs&utm_medium=use-case-gallery&utm_campaign=prompt-block';
  var tag = 'docs-use-case-gallery';
  var agentParams = (agent ? '&agent=' + agent : '') + (intent ? '&intent=' + intent : '') + (playbookId ? '&playbookId=' + playbookId : '');
  var label = type === 'schedule' ? 'Schedule in Devin' : type === 'playbook' ? 'Create Playbook' : type === 'knowledge' ? 'Add to Knowledge' : agent === 'advanced' ? 'Try in Devin' : agent === 'dana' ? 'Try in Dana' : agent === 'ada' ? 'Try in Ask Devin' : 'Try in Devin';
  var buildUrl = function (text) {
    var encoded = encodeURIComponent(text);
    if (type === 'schedule') return 'https://app.devin.ai/settings/schedules/create?' + utm + agentParams + '&prompt=' + encoded;
    if (type === 'playbook') return 'https://app.devin.ai/settings/playbooks/create?' + utm + '&body=' + encoded;
    if (type === 'knowledge') return 'https://app.devin.ai/knowledge?' + utm + '&body=' + encoded;
    if (agent === 'ada') return 'https://app.devin.ai/search?' + utm + '&noSubmit=true&prompt=' + encoded;
    return 'https://app.devin.ai/?tags=' + tag + '&' + utm + agentParams + '&prompt=' + encoded;
  };
  const ref = React.useRef(null);
  const [href, setHref] = React.useState('#');
  React.useEffect(() => {
    if (!ref.current) return;
    var codeEl = ref.current.querySelector('pre code');
    if (codeEl) {
      var text = codeEl.textContent.trim();
      if (text) setHref(buildUrl(text));
    }
    var header = ref.current.querySelector('[data-component-part="code-block-header"]');
    if (header && !header.querySelector('.prompt-block-devin-link')) {
      var link = document.createElement('a');
      link.href = href;
      link.target = '_blank';
      link.rel = 'noopener noreferrer';
      link.className = 'prompt-block-devin-link';
      link.style.cssText = 'display:inline-flex;align-items:center;gap:6px;text-decoration:none;color:#fff;font-size:11px;font-weight:500;padding:4px 10px;border-radius:6px;white-space:nowrap;background:#317CFF;transition:background 0.2s;margin-left:8px;';
      link.innerHTML = '<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg> ' + label;
      link.onmouseenter = function () {
        link.style.background = '#2968D9';
      };
      link.onmouseleave = function () {
        link.style.background = '#317CFF';
      };
      header.appendChild(link);
    }
    var existingLink = ref.current.querySelector('.prompt-block-devin-link');
    if (existingLink && href !== '#') existingLink.href = href;
  });
  return <div className="prompt-block" ref={ref}>{children}</div>;
};

<UseCaseHero title="Auto-Investigate Datadog Alerts" description="Wire PagerDuty or Datadog alerts to Devin for automatic incident investigation." prompt="Help me set up a Datadog-to-Devin alert investigation pipeline. Follow the guide at https://docs.devin.ai/use-cases/gallery/api-datadog-alert-investigation and walk me through each step: enabling the Datadog MCP, creating the webhook handler, and wiring it to my Datadog monitors." category="Incident Response" features="API, MCP" />

<div className="uc-detail-wrapper">
  <Tip>For a more detailed Datadog integration guide, [click here](/enterprise/integrations/datadog).</Tip>

  <Steps>
    <Step title="Enable the Datadog MCP">
      Devin needs access to your Datadog account to query logs, metrics, and monitors during an investigation.

      1. Go to **Settings > Connections > MCP servers** and find **Datadog**
      2. Click **Enable**, select your Datadog site/region, and enter your `DD-API-KEY` and `DD-APPLICATION-KEY` — generate these in [Datadog > Organization Settings > API Keys](https://app.datadoghq.com/organization-settings/api-keys)
      3. Click **Test listing tools** to verify Devin can connect

      Once enabled, Devin can query error logs, pull metric timeseries, list active monitors, and search traces — all within a session. Learn more about [connecting MCP servers](/work-with-devin/mcp).
    </Step>

    <Step title="Build the alert-to-Devin bridge">
      You need a small service that receives alert webhooks and starts a Devin session via the [Devin API](/api-reference/overview). Deploy this as a serverless function (AWS Lambda, Cloudflare Worker) or a lightweight container:

      ```python theme={null}
      from flask import Flask, request, jsonify
      import requests, os

      app = Flask(__name__)

      @app.route("/alert", methods=["POST"])
      def handle_alert():
          payload = request.json

          # Datadog webhook payload fields
          alert_title = payload.get("title", "Unknown alert")
          tags_str = payload.get("tags", "")
          service = next(
              (t.split(":", 1)[1] for t in tags_str.split(",") if t.strip().startswith("service:")),
              "unknown-service"
          )
          alert_url = payload.get("link", "")

          org_id = os.environ["DEVIN_ORG_ID"]
          response = requests.post(
              f"https://api.devin.ai/v3/organizations/{org_id}/sessions",
              headers={"Authorization": f"Bearer {os.environ['DEVIN_API_KEY']}"},
              json={
                  "prompt": (
                      f"Datadog alert fired: '{alert_title}'\n"
                      f"Service: {service}\n"
                      f"Alert link: {alert_url}\n\n"
                      "Using the Datadog MCP:\n"
                      "1. Pull error logs for this service from the past 30 min\n"
                      "2. Identify the top error messages and stack traces\n"
                      "3. Check if this correlates with a recent deploy\n"
                      "4. If the root cause is clear, open a hotfix PR\n"
                      "5. Post your findings to #incidents on Slack"
                  ),
                  "playbook_id": "14fed18b89d44713a26e673cf258f548",
              }
          )
          return jsonify(response.json()), 200
      ```

      Create a [service user](/api-reference/v3/overview) in **Settings > Service Users** at [app.devin.ai](https://app.devin.ai/?utm_source=docs\&utm_medium=use-case-gallery) with `ManageOrgSessions` permission. Copy the API token shown after creation and store it as `DEVIN_API_KEY` on your bridge service. Set `DEVIN_ORG_ID` to your organization ID — get it by calling `GET https://api.devin.ai/v3/enterprise/organizations` with your token.

      The code above uses the [`!triage` template playbook](https://app.devin.ai/settings/playbooks/14fed18b89d44713a26e673cf258f548?utm_source=docs\&utm_medium=use-case-gallery) — duplicate it and customize the investigation steps for your stack, then update the `playbook_id` in your bridge service.
    </Step>

    <Step title="Route alerts to the webhook">
      **From Datadog directly:**

      1. In your Datadog dashboard, go to **Integrations > Webhooks**
      2. Click **New Webhook** and set the URL to your bridge endpoint (e.g., `https://your-bridge.example.com/alert`)
      3. In any monitor's notification message, add `@webhook-devin-bridge` — Devin investigates whenever that monitor fires

      **From PagerDuty:**

      1. In PagerDuty, go to **Services > \[your service] > Integrations**
      2. Add a **Generic Webhooks (v3)** integration
      3. Set the webhook URL to your bridge endpoint and filter by event type `incident.triggered`

      Start with warning-level monitors to test the pipeline before routing critical alerts.
    </Step>

    <Step title="What Devin investigates">
      When an alert triggers a session, Devin uses the Datadog MCP to run a structured investigation — querying logs, correlating with deploys, and tracing the error to source code.

      <PromptBlock>
        ```txt Investigate Datadog alert theme={null}
        Datadog alert: "High error rate on payments-service (5.2%, threshold 1%)"
        fired at 2026-02-10 14:32 UTC.

        Using the Datadog MCP:
        1. Pull error logs for payments-service from the past 30 minutes
        2. Group by error message — what's the dominant failure?
        3. Check Datadog events for recent deploys to payments-service
        4. Read the relevant source code and recent commits for the failing path
        5. If fixable, open a PR with a hotfix. Otherwise, post findings to #incidents.
        ```
      </PromptBlock>

      Example investigation Devin posts to Slack:

      ```
      Alert Investigation: payments-service error rate spike

      Timeline:
      - 14:28 UTC — Deploy #492 released (commit abc123f)
      - 14:31 UTC — Error rate jumped from 0.3% to 5.2%
      - 14:32 UTC — Alert triggered

      Root cause: Deploy #492 refactored the Stripe webhook handler
      (src/webhooks/stripe.ts) to async/await but removed the try/catch
      around handlePaymentIntent(). Unhandled rejections are returning
      500s on ~4% of checkout requests.

      Fix: Added error boundary with structured logging and proper 4xx
      responses for client errors.

      PR #493 opened → https://github.com/acme/payments/pull/493
      ```
    </Step>

    <Step title="Extend the pipeline">
      Once basic investigation works, layer on more automation:

      **Customize the triage playbook.** The bridge code already uses the [`!triage` template playbook](https://app.devin.ai/settings/playbooks/14fed18b89d44713a26e673cf258f548?utm_source=docs\&utm_medium=use-case-gallery). Duplicate it and tailor the investigation checklist to your team's stack — add service-specific runbooks, escalation paths, and conventions for hotfix PRs.

      **Scope by severity.** Route P1 alerts for immediate investigation and hotfix. Route P3 alerts for root-cause analysis only. Use different prompts or playbooks per severity level.

      **Add [Knowledge](/product-guides/knowledge)** about your services — normal thresholds, architecture, on-call runbooks — so Devin's investigation starts from your team's context instead of from scratch.
    </Step>
  </Steps>
</div>