datadog-incidents

$npx mdskill add automateyournetwork/netclaw/datadog-incidents

Manage Datadog incidents with search, retrieval, and status updates

  • List, retrieve, and update Datadog incidents based on filters like status, severity, and tags
  • Uses Datadog Incident Management API for data access and modifications
  • Applies user-specified filters and parameters to fetch or modify relevant incidents
  • Returns structured incident data or confirmation of updates to the user

SKILL.md

.github/skills/datadog-incidentsView on GitHub ↗
---
name: datadog-incidents
description: "Manage incidents in Datadog Incident Management."
version: 1.0.0
license: Apache-2.0
author: netclaw
tags: []
---

# Datadog Incidents Skill

Manage incidents in Datadog Incident Management.

## Tools

| Tool | Description |
|------|-------------|
| `list_incidents` | List incidents with optional filters |
| `get_incident` | Get detailed incident information |
| `create_incident` | Create a new incident (read-only by default) |
| `update_incident` | Update incident status or fields (read-only by default) |

## Example Queries

```
List all active incidents
→ list_incidents(status="active")

Get details of a specific incident
→ get_incident(incident_id="INC-12345")

List recent network-related incidents
→ list_incidents(tags=["service:network"], time_range="7d")

List SEV1 incidents from the past month
→ list_incidents(severity="SEV-1", time_range="30d")
```

## Workflows

### Incident Investigation
1. List active incidents: `list_incidents(status="active")`
2. Get incident details: `get_incident(incident_id="INC-12345")`
3. Review timeline and related monitors
4. Check correlated metrics and logs
5. Document findings in incident

### Network Outage Tracking
1. Search network incidents: `list_incidents(tags=["service:network"])`
2. Filter by impact: `list_incidents(severity="SEV-1,SEV-2")`
3. Review affected services and dependencies
4. Track MTTR and resolution patterns

### Post-Incident Review
1. Get incident timeline: `get_incident(incident_id="INC-12345")`
2. Extract key events and decisions
3. Identify detection and response gaps
4. Document lessons learned

## Prerequisites

- `DD_API_KEY` Datadog API key
- `DD_APP_KEY` Datadog application key
- `DD_SITE` Datadog site (optional, defaults to datadoghq.com)

## Server

This skill uses the `datadog-mcp` server via remote MCP transport.

## Notes

- Create and update operations may require additional permissions
- NetClaw operates in read-only mode by default for safety
- Incident creation should follow your organization's incident process

More from automateyournetwork/netclaw

SkillDescription
aap-automationRed Hat Ansible Automation Platform — inventory management, job template execution, project SCM sync, ad-hoc commands, host management, Galaxy content discovery. Use when automating infrastructure with Ansible, running playbooks, managing inventories, or searching for Ansible collections and roles.
aap-edaEvent-Driven Ansible (EDA) — activation lifecycle, rulebook management, decision environments, event stream monitoring. Use when managing event-driven automation triggers, enabling/disabling activations, or reviewing EDA rulebooks.
aap-lintansible-lint playbook and role validation — syntax checking, best practice enforcement, project-wide analysis, rule filtering. Use when validating Ansible playbooks, checking code quality, or enforcing automation best practices before deployment.
aci-change-deploySafe ACI policy change deployment - ServiceNow CR lifecycle, pre/post-change fault baselines, APIC policy application, automatic rollback on fault delta, and GAIT audit trail. Use when deploying ACI policy changes, creating tenants or EPGs, pushing config to APIC, or running a change window with rollback protection.
aci-fabric-auditComprehensive Cisco ACI fabric health audit - node status, tenant/VRF/BD/EPG policy review, contract analysis, fault triage, and endpoint learning verification. Use when auditing ACI fabric health, checking for faults, reviewing tenant policies, or running pre/post-change baselines on APIC.
arista-cvpArista CloudVision Portal (CVP) automation via REST API — device inventory, events, connectivity monitoring, tag management (4 tools). Use when managing Arista devices, checking CloudVision events, monitoring network connectivity probes, or tagging devices in CVP.
aruba-cx-configView and manage Aruba CX switch configurations, perform ISSU upgrades, and firmware operations
aruba-cx-interfacesMonitor Aruba CX switch interface status, LLDP neighbors, and optical transceiver health
aruba-cx-switchingView and manage Aruba CX switch VLANs and MAC address tables for Layer 2 operations
aruba-cx-systemDiscover Aruba CX switch system information, firmware versions, and VSF topology