You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/en/service_management/incident_management/declare.md
+13Lines changed: 13 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,6 +11,19 @@ In the Datadog paradigm, any of the following are appropriate situations for dec
11
11
12
12
You can declare an incident from multiple places within the Datadog platform, such as a graph widget on a dashboard, the Incidents UI, or any alert reporting into Datadog.
13
13
14
+
## Declaration modal
15
+
16
+
When you declare an incident, a declaration modal appears. This modal has several core elements:
17
+
18
+
| Incident elements | Description |
19
+
| ------------------ | ----------- |
20
+
| Title | (Required) A descriptive title for the incident. |
21
+
| Severity Level | (Required) By default, severity ranges from SEV-1 (most severe) to SEV-5 (least severe). You can customize the number of severities and their descriptions in Incident Management settings.
22
+
| Incident Commander | The person assigned to lead the incident response. |
23
+
24
+
You can configure [Incident Management Settings][2] to include more fields in the incident declaration modal or require certain fields.
25
+
26
+
14
27
## From the Incident page
15
28
16
29
In the [Datadog UI][1], click **Declare Incident** to create an incident.
Copy file name to clipboardExpand all lines: content/en/service_management/incident_management/describe.md
+5-66Lines changed: 5 additions & 66 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,22 +16,13 @@ No matter where you [declare an incident][1], it’s important to describe it as
16
16
- Why it happened
17
17
- Attributes associated with the incident
18
18
19
-
## Incident elements
20
-
21
-
When you declare an incident, an incident modal comes up. This modal has several core elements:
22
-
23
-
| Incident elements | Description |
24
-
| ------------------ | ----------- |
25
-
| Title | (Required) Give your incident a descriptive title. |
26
-
| Severity Level | (Required) Denotes the severity of your incident, from SEV-1 (most severe) to SEV-5 (least severe). If your incident is under initial investigation, and you do not know the severity yet, select UNKNOWN. <br> **Note**: You can customize the description of each severity level to fit the requirements of your organization.|
27
-
| Incident Commander | (Required) This person is assigned as the leader of the incident investigation. |
28
-
| Attributes (Teams) | Assign the appropriate group of users to an incident using [Datadog Teams][2]. Members of the assigned team are automatically invited to the Slack channels. |
29
-
30
19
## Incident details
31
20
32
-
An incident's status and details can be updated on the incident's Overview tab. Within an incident, fill out the Overview tab with relevant details—including incident description, customer impact, affected services, incident responders, root cause, detection method, and severity—to give your teams all the information they need to investigate and resolve an incident.
21
+
An incident's status and details can be updated on the incident's Overview tab. Within an incident, fill out the Overview tab with relevant details—including incident summary, customer impact, affected services, incident responders, root cause, detection method, and severity—to give your teams all the information they need to investigate and resolve an incident.
33
22
34
-
Update the impact section to specify customer impact, the start and end times of the impact, and whether the incident is still active. This section also requires a description of the scope of impact to be completed.
23
+
Update the impact section to record customer impacts, including their start and end times. These impacts influence incident analytics to help your organization analyze the impact of incidents on your business.
24
+
25
+
You can define your own custom incident fields on the [Incident Settings Property Fields][2] page.
35
26
36
27
### Status levels
37
28
@@ -42,61 +33,9 @@ The default statuses are **Active**, **Stable**, and **Resolved**. You can add t
42
33
* Resolved: Incident no longer affecting others and investigations complete.
43
34
* Completed: All remediation complete.
44
35
45
-
As the status of an incident changes, Datadog tracks time-to-resolution as follows:
46
-
47
-
| Status Transition | Resolved Timestamp |
48
-
| ------------------ | -----------|
49
-
|`Active` to `Resolved`, `Active` to `Completed`| Current time |
50
-
|`Active` to `Resolved` to `Completed`, `Active` to `Completed` to `Resolved`| Unchanged |
51
-
|`Active` to `Completed` to `Active` to `Resolved`| Overridden on last transition |
52
-
53
-
### Response team
54
-
55
-
Form your response team by adding other users and assigning them roles to carry out in the process of resolving an incident. There are two default responder types provided by Datadog.
56
-
57
-
<divclass="alert alert-info">Responder roles are unrelated to the <ahref="/account_management/rbac/?tab=datadogapplication">Role Based Access Control (RBAC)</a> system. The Responder Type in Incident Management does not change a user's permissions in any capacity. </a></div>
58
-
59
-
Incident Commander
60
-
: The individual responsible for leading the response team
61
-
62
-
Responder
63
-
: An individual that actively contributes to investigating an incident and resolving its underlying issue
64
-
65
-
*Responders* are notified through the email associated with their Datadog account. Anyone is able to change the role of a responder, but to remove an individual from an incident's Response Team you must have the general `Responder` role assigned and have no activity in the incident. If there is already an `Incident Commander` assigned to an incident, assigning another individual as the `Incident Commander` transfers that role over to them. The previous `Incident Commander` is reassigned the general `Responder` role. A similar reassignment happens whenever you reassign one of your custom one person roles.
66
-
67
-
The **Response Team** tab saves the date and time when an individual was originally added to the response team of an incident, as well as the date and time when they last contributed something to the Incident Timeline.
68
-
69
-
#### Custom responder role
70
-
71
-
You can create custom responder roles in the [Incident Settings for Responder Types][3]. This allows you to create new responder types with custom names and descriptions. It also allows you to choose if a responder type should be a one person role or a multi person role.
72
-
73
-
## Attributes
74
-
75
-
Attributes are the metadata and context that you can define for each incident. These fields are [key:value metric tags][4]. Add these field keys on the [Incident Settings Property Fields][5] page. The values you add are then available when you are assessing the impact of an incident on the Overview tab. The following fields are available for assessment in all incidents:
76
-
77
-
Root Cause
78
-
: This text field allows you to enter the description of the root cause, triggers, and contributing factors of the incident.
79
-
80
-
Detection Method
81
-
: Specify how the incident was detected with these default options: customer, employee, monitor, other, or unknown.
82
-
83
-
Services
84
-
: If you have APM configured, your APM services are available for incident assessment. To learn more about configuring your services in APM, see [the docs][5].<br><ul><li>If you are not using Datadog APM, you can upload service names as a CSV. Any values uploaded through CSV are only available within Incident Management for incident assessment purposes.</li><li>Datadog deduplicates service names case-insensitively, so if you use "My Service" or "my service", only the manually added one is shown.</li><li>Datadog overrides APM service names in favor of the manually uploaded list.</li><li>If the service is an APM service and no metrics are posted in the past seven days, it does not appear in the search results.</li><li>Further integrate with Datadog products and accurately assess service impact. The Services property field is automatically populated with APM services for customers using Datadog APM.</li></ul>
85
-
86
-
Teams
87
-
: Choose from the [teams][2] defined in your organization. It is not necessary to upload a list of teams from a CSV file.
88
-
89
-
## Notifications
90
-
91
-
Configure incident notifications to share incident updates with all stakeholders and keep all involved members aware of the current investigation. For more information, see the [Notification][6] page.
text: "Customize responder types in Incident Settings"
7
+
---
8
+
9
+
## Overview
10
+
11
+
Form your response team by adding other users and assigning them responder types (responder roles) so they know what they should focus on during the incident response.
12
+
13
+
## Adding responders
14
+
15
+
A responder is any Datadog user who participates in the response process for a particular incident.
16
+
17
+
When you add a responder to an incident:
18
+
* Datadog notifies the responder about the by email.
19
+
* If the incident is private, the responder can view it in Datadog.
20
+
* If the incident has a Slack channel attached, the responders is automatically added to that channel.
21
+
22
+
Datadog also automatically adds users as responders when:
23
+
* They perform any action that updates the incident, including writing to the timeline.
24
+
* They are notified about the incident through a notification rule or a manual incident notification.
25
+
26
+
The **Response Team** tab of the Incident Details page records the time an individual was added to the incident’s response team. It also records the time the responder last took an action affecting the incident in Datadog, such as updating its attributes or writing to its timeline.
27
+
28
+
You can remove responders if they are not assigned to any responder types and if they have not yet performed any actions updating the incident.
29
+
30
+
## Assigning responder types
31
+
32
+
<divclass="alert alert-info">Responder types are unrelated to the <ahref="/account_management/rbac/?tab=datadogapplication">Role Based Access Control (RBAC)</a> system. The Responder Type in Incident Management does not affect a user’s permissions.</a></div>
33
+
34
+
From the **Response Team** tab of the Incident Details page, you can modify the responder types for any responder.
35
+
36
+
You can define additional single-person or multi-person responder types with custom names and descriptions in [Incident Settings][1].
37
+
38
+
## Managing responders in Slack
39
+
40
+
In Slack, you can manage responders and their responder types by entering the command `/dd incident responders` inside an incident channel. You can also click the "Manage Responders" button on the incident action tray.
41
+
42
+
When you assign a responder type, the assignee is notified about it in Slack.
0 commit comments