Skip to content

INA-7891: Extract off-topic sections from "Describe incident" documentation #30917

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 11 commits into from
Aug 12, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 11 additions & 6 deletions config/_default/menus/main.en.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2397,16 +2397,21 @@ menu:
parent: incidents
identifier: incident_describe
weight: 2
- name: Response Team
url: service_management/incident_management/response_team
parent: incidents
identifier: response_team
weight: 3
- name: Notification
url: service_management/incident_management/notification
parent: incidents
identifier: incident_notification
weight: 3
weight: 4
- name: Investigate an Incident
url: service_management/incident_management/investigate
parent: incidents
identifier: incident_investigate
weight: 4
weight: 5
- name: Timeline
url: service_management/incident_management/investigate/timeline
parent: incident_investigate
Expand All @@ -2416,7 +2421,7 @@ menu:
url: service_management/incident_management/incident_settings
parent: incidents
identifier: incidents_settings
weight: 5
weight: 6
- name: Information
url: service_management/incident_management/incident_settings/information
parent: incidents_settings
Expand Down Expand Up @@ -2451,17 +2456,17 @@ menu:
url: service_management/incident_management/analytics
parent: incidents
identifier: analytics
weight: 6
weight: 7
- name: Datadog Clipboard
url: service_management/incident_management/datadog_clipboard
parent: incidents
identifier: incidents_clipboard
weight: 7
weight: 8
- name: Guides
url: service_management/incident_management/guides
parent: incidents
identifier: incidents_guide
weight: 10
weight: 9
- name: On-Call
url: service_management/on-call/
pre: on-call
Expand Down
13 changes: 13 additions & 0 deletions content/en/service_management/incident_management/declare.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,19 @@ In the Datadog paradigm, any of the following are appropriate situations for dec

You can declare an incident from multiple places within the Datadog platform, such as a graph widget on a dashboard, the Incidents UI, or any alert reporting into Datadog.

## Declaration modal

When you declare an incident, a declaration modal appears. This modal has several core elements:

| Incident elements | Description |
| ------------------ | ----------- |
| Title | (Required) A descriptive title for the incident. |
| Severity Level | (Required) By default, severity ranges from SEV-1 (most severe) to SEV-5 (least severe). You can customize the number of severities and their descriptions in Incident Management settings.
| Incident Commander | The person assigned to lead the incident response. |

You can configure [Incident Management Settings][2] to include more fields in the incident declaration modal or require certain fields.


## From the Incident page

In the [Datadog UI][1], click **Declare Incident** to create an incident.
Expand Down
71 changes: 5 additions & 66 deletions content/en/service_management/incident_management/describe.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,22 +16,13 @@ No matter where you [declare an incident][1], it’s important to describe it as
- Why it happened
- Attributes associated with the incident

## Incident elements

When you declare an incident, an incident modal comes up. This modal has several core elements:

| Incident elements | Description |
| ------------------ | ----------- |
| Title | (Required) Give your incident a descriptive title. |
| Severity Level | (Required) Denotes the severity of your incident, from SEV-1 (most severe) to SEV-5 (least severe). If your incident is under initial investigation, and you do not know the severity yet, select UNKNOWN. <br> **Note**: You can customize the description of each severity level to fit the requirements of your organization.|
| Incident Commander | (Required) This person is assigned as the leader of the incident investigation. |
| Attributes (Teams) | Assign the appropriate group of users to an incident using [Datadog Teams][2]. Members of the assigned team are automatically invited to the Slack channels. |

## Incident details

An incident's status and details can be updated on the incident's Overview tab. Within an incident, fill out the Overview tab with relevant details—including incident description, customer impact, affected services, incident responders, root cause, detection method, and severity—to give your teams all the information they need to investigate and resolve an incident.
An incident's status and details can be updated on the incident's Overview tab. Within an incident, fill out the Overview tab with relevant details—including incident summary, customer impact, affected services, incident responders, root cause, detection method, and severity—to give your teams all the information they need to investigate and resolve an incident.

Update the impact section to specify customer impact, the start and end times of the impact, and whether the incident is still active. This section also requires a description of the scope of impact to be completed.
Update the impact section to record customer impacts, including their start and end times. These impacts influence incident analytics to help your organization analyze the impact of incidents on your business.

You can define your own custom incident fields on the [Incident Settings Property Fields][2] page.

### Status levels

Expand All @@ -42,61 +33,9 @@ The default statuses are **Active**, **Stable**, and **Resolved**. You can add t
* Resolved: Incident no longer affecting others and investigations complete.
* Completed: All remediation complete.

As the status of an incident changes, Datadog tracks time-to-resolution as follows:

| Status Transition | Resolved Timestamp |
| ------------------ | -----------|
| `Active` to `Resolved`, `Active` to `Completed` | Current time |
| `Active` to `Resolved` to `Completed`, `Active` to `Completed` to `Resolved` | Unchanged |
| `Active` to `Completed` to `Active` to `Resolved` | Overridden on last transition |

### Response team

Form your response team by adding other users and assigning them roles to carry out in the process of resolving an incident. There are two default responder types provided by Datadog.

<div class="alert alert-info">Responder roles are unrelated to the <a href="/account_management/rbac/?tab=datadogapplication">Role Based Access Control (RBAC)</a> system. The Responder Type in Incident Management does not change a user's permissions in any capacity. </a></div>

Incident Commander
: The individual responsible for leading the response team

Responder
: An individual that actively contributes to investigating an incident and resolving its underlying issue

*Responders* are notified through the email associated with their Datadog account. Anyone is able to change the role of a responder, but to remove an individual from an incident's Response Team you must have the general `Responder` role assigned and have no activity in the incident. If there is already an `Incident Commander` assigned to an incident, assigning another individual as the `Incident Commander` transfers that role over to them. The previous `Incident Commander` is reassigned the general `Responder` role. A similar reassignment happens whenever you reassign one of your custom one person roles.

The **Response Team** tab saves the date and time when an individual was originally added to the response team of an incident, as well as the date and time when they last contributed something to the Incident Timeline.

#### Custom responder role

You can create custom responder roles in the [Incident Settings for Responder Types][3]. This allows you to create new responder types with custom names and descriptions. It also allows you to choose if a responder type should be a one person role or a multi person role.

## Attributes

Attributes are the metadata and context that you can define for each incident. These fields are [key:value metric tags][4]. Add these field keys on the [Incident Settings Property Fields][5] page. The values you add are then available when you are assessing the impact of an incident on the Overview tab. The following fields are available for assessment in all incidents:

Root Cause
: This text field allows you to enter the description of the root cause, triggers, and contributing factors of the incident.

Detection Method
: Specify how the incident was detected with these default options: customer, employee, monitor, other, or unknown.

Services
: If you have APM configured, your APM services are available for incident assessment. To learn more about configuring your services in APM, see [the docs][5].<br><ul><li>If you are not using Datadog APM, you can upload service names as a CSV. Any values uploaded through CSV are only available within Incident Management for incident assessment purposes.</li><li>Datadog deduplicates service names case-insensitively, so if you use "My Service" or "my service", only the manually added one is shown.</li><li>Datadog overrides APM service names in favor of the manually uploaded list.</li><li>If the service is an APM service and no metrics are posted in the past seven days, it does not appear in the search results.</li><li>Further integrate with Datadog products and accurately assess service impact. The Services property field is automatically populated with APM services for customers using Datadog APM.</li></ul>

Teams
: Choose from the [teams][2] defined in your organization. It is not necessary to upload a list of teams from a CSV file.

## Notifications

Configure incident notifications to share incident updates with all stakeholders and keep all involved members aware of the current investigation. For more information, see the [Notification][6] page.

## Further reading

{{< partial name="whats-next/whats-next.html" >}}

[1]: /service_management/incident_management/declare
[2]: /account_management/teams/
[3]: /service_management/incident_management/incident_settings/responder-types
[4]: /getting_started/tagging/assigning_tags?tab=noncontainerizedenvironments#overview
[5]: https://app.datadoghq.com/incidents/settings#Property-Fields
[6]: /service_management/incident_management/notification
[2]: https://app.datadoghq.com/incidents/settings#Property-Fields
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
---
title: Incident Response Team
further_reading:
- link: "/service_management/incident_management/incident_settings/responder_types"
tag: "Documentation"
text: "Customize responder types in Incident Settings"
---

## Overview

Form your response team by adding other users and assigning them responder types (responder roles) so they know what they should focus on during the incident response.

## Adding responders

A responder is any Datadog user who participates in the response process for a particular incident.

When you add a responder to an incident:
* Datadog notifies the responder about the by email.
* If the incident is private, the responder can view it in Datadog.
* If the incident has a Slack channel attached, the responders is automatically added to that channel.

Datadog also automatically adds users as responders when:
* They perform any action that updates the incident, including writing to the timeline.
* They are notified about the incident through a notification rule or a manual incident notification.

The **Response Team** tab of the Incident Details page records the time an individual was added to the incident’s response team. It also records the time the responder last took an action affecting the incident in Datadog, such as updating its attributes or writing to its timeline.

You can remove responders if they are not assigned to any responder types and if they have not yet performed any actions updating the incident.

## Assigning responder types

<div class="alert alert-info">Responder types are unrelated to the <a href="/account_management/rbac/?tab=datadogapplication">Role Based Access Control (RBAC)</a> system. The Responder Type in Incident Management does not affect a user’s permissions.</a></div>

From the **Response Team** tab of the Incident Details page, you can modify the responder types for any responder.

You can define additional single-person or multi-person responder types with custom names and descriptions in [Incident Settings][1].

## Managing responders in Slack

In Slack, you can manage responders and their responder types by entering the command `/dd incident responders` inside an incident channel. You can also click the "Manage Responders" button on the incident action tray.

When you assign a responder type, the assignee is notified about it in Slack.

## Further reading

{{< partial name="whats-next/whats-next.html" >}}

[1]: /service_management/incident_management/incident_settings/responder-types
Loading