Connect Datadog to PagerDuty

Detect the Datadog region for the connected account. Call this FIRST before any other Datadog tool if you do not already know the region. Returns the region domain (e.g. datadoghq.com) which must be passed as the region parameter to **Search Logs**, **Search Monitors**, **Get Metric Data**, and all other Datadog tools. See the docs

Detect the Datadog region for the connected account by validating the API key against each regional endpoint. Use this to discover the correct region before calling other Datadog actions. See the docs

Query time-series metric data for analyzing trends and system performance. Query syntax: avg:system.cpu.user{*}, sum:requests.count{env:prod} by {host}, max:system.mem.used{service:web}. Both from and to are POSIX timestamps in seconds. Use **Search Metrics** first to discover available metric names. Use **Search Hosts** to find valid host tags for scoping. After finding anomalies, use **Search Logs** to investigate related entries. See the docs

Get a list of logs matching a filter query. Uses the GET endpoint with a higher rate limit (3600/hr vs 300/hr). See the docs

Post custom time-series metric data points to Datadog. Data appears in dashboards, monitors, and can be queried via **Get Metric Data**. Points: JSON object where keys are Unix timestamps (seconds) and values are numeric, e.g. {"1640995200": 1.0}. Use **Search Metrics** to verify a metric name exists, or post to a new name to create it. This is a WRITE operation that creates or appends data to a metric time series. See the docs

List and search Datadog dashboards. Returns dashboard IDs, titles, URLs, and metadata. Dashboard URL: https://app.{region}/dashboard/{id} where region comes from **Get Account Info**. Use alongside **Search Services** to find dashboards related to a specific service. See the docs

Search Datadog events: monitor state changes, deployment markers, error spikes, and infrastructure events. Filter by sources (e.g. nagios,docker), tags (e.g. env:prod,service:web), and priority (normal or low). Time range defaults to last 24h (POSIX timestamps in seconds). To investigate a monitor alert, use **Search Monitors** first, then search events for the relevant time range. Follow up with **Search Logs** for deeper investigation. See the docs

Search monitored infrastructure hosts. Filter by tag (env:production), name (host:web-01), or partial match. Sort by cpu, iowait, load, status, or apps. Host names from results can scope queries in **Get Metric Data** (e.g. avg:system.cpu.user{host:web-01}), filter logs in **Search Logs** (host:web-01), or filter metrics in **Search Metrics**. Max 1000 results. See the docs

Search Datadog incidents by state, severity, and metadata. Query syntax: state:active, state:resolved, severity:SEV-1. After finding an incident, investigate with: **Search Logs** for the incident time window, **Get Metric Data** for relevant metrics, **Search Events** for related monitor alerts, and **Search Services** for ownership info. See the docs

Search Datadog logs matching a query with support for facets and time ranges. Uses log search syntax: service:web-app status:error, @http.status_code:>=400, boolean operators (AND, OR, NOT), and wildcards. Set from to now-1h for recent logs. Use **Search Metrics** to discover metric names or **Search Hosts** to find host names for filtering. To investigate an incident, use **Search Incidents** first, then search logs for that time window and service. See the docs

Discovery tool: list available Datadog metric names, optionally filtered by host. Returns metric name strings (e.g. system.cpu.user, aws.ec2.cpuutilization) for use in **Get Metric Data** queries with the syntax aggregation:metric.name{tags}. Use **Search Hosts** to find valid host names for the host filter. See the docs

Search Datadog monitors (alerting rules) including status, thresholds, and conditions. Query syntax: tag:env:production, type:metric, status:Alert. Tags filter: comma-separated (e.g. env:prod,team:backend). After finding a monitor, use **Search Events** to see recent state changes, or **Get Metric Data** to query the underlying metric it tracks. Returns monitor ID, name, type, query, status, and tags. See the docs

List services from Datadog's Service Catalog with ownership, metadata, and team info. Use to discover service names for filtering in **Search Logs** (service:my-app) or finding monitors via **Search Monitors** (tag:service:my-app). Returns service definitions including links, docs, and on-call. See the docs

**Deprecated** — use **Update Incident** instead. Acknowledge an incident. See the documentation

Add a text note to an incident. Notes are visible in the incident timeline and useful for documenting investigation steps, resolution details, or handoff notes. Use **List Incidents** or **Get Incident** to find the incident ID. See the documentation

Trigger a new incident on a PagerDuty service. Use **List Services** to find a service ID and **List Escalation Policies** to find a policy ID. Use **List Priorities** to find priority IDs. Set incidentKey to a stable value derived from the alert source (e.g. a hash of title + service ID) to prevent duplicate incidents on retry — PagerDuty deduplicates open incidents with the same key on the same service. See the documentation

Override a schedule layer to assign a specific user for a time window. Use **List Schedules** to find a schedule ID and **List Users** to find the user ID. Time params use ISO 8601 with explicit UTC offset, e.g. 2026-06-02T15:00:00-07:00. Always include the UTC offset — do not assume UTC; using the wrong offset will place the override in the wrong time slot. See the documentation

Create a new PagerDuty service. A service represents a system or application that generates incidents. Use **List Escalation Policies** to find a valid escalation policy ID (required). Set autoResolveTimeout to 0 to disable auto-resolve. Set acknowledgementTimeout to 0 to disable re-triggering after acknowledgment. See the documentation

Find the user on call for a specific schedule. See the documentation

Get the active event orchestration routing rules configured for a service. Event orchestration routes incoming events to the right responders based on conditions. Use **List Services** to discover service IDs. See the documentation

Get full details for a single incident by ID, including its current status, urgency, assignments, and html_url. Use **List Incidents** to find the incident ID. See the documentation

Get incident volume and MTTR (mean time to resolve) metrics for one or more services over a time range. Use **List Services** to discover service IDs. Time params use ISO 8601 with explicit UTC offset, e.g. 2026-06-02T15:00:00-07:00. See the documentation

List escalation policies in the PagerDuty account. Supports both exact name match (name) and substring search (query), plus team filtering. Use policy IDs with **Create Incident**, **Create Service**, and **Update Escalation Policy**. See the documentation

Retrieves available options for the Escalation Policy ID field.

List change events (deployments, config changes) correlated to an incident. Change events show what changed in your systems around the time the incident was triggered. Use **List Incidents** or **Get Incident** to find the incident ID. See the documentation

List available incident automation workflows. Use workflow IDs with **Start Incident Workflow** to run automation on an active incident. Requires Business+ plan — accounts without this plan will receive empty results or a 402 error. See the documentation

List and filter incidents by status, urgency, service, or team. Default statuses are triggered and acknowledged (open incidents). Use **List Services** to discover service IDs and **List Teams** for team IDs. Time params use ISO 8601 with explicit UTC offset, e.g. 2026-06-02T15:00:00-07:00. See the documentation

List log entries (the audit trail of actions taken on an incident or across the account). When incidentId is provided, scopes results to that incident's log entries. Otherwise returns account-wide log entries. Use **List Incidents** or **Get Incident** to find incident IDs. Time params use ISO 8601 with explicit UTC offset, e.g. 2026-06-02T15:00:00-07:00. Set isOverview: true to get only the most recent action per incident. See the documentation

Retrieves available options for the On-Call Schedule ID field.

List on-call entries — who is on call right now or during a given time window. Filterable by schedule IDs or escalation policy IDs. Use **List Schedules** to discover schedule IDs and **List Escalation Policies** to discover policy IDs. Time params use ISO 8601 with explicit UTC offset, e.g. 2026-06-02T15:00:00-07:00. Set earliest: true to get one on-call entry per unique (schedule, escalation policy, escalation level) combination. See the documentation

List the priority levels configured for this PagerDuty account. Returns priority IDs and names (e.g. P1, P2, critical) useful for **Create Incident** and **Update Incident**. See the documentation

List on-call schedules in the PagerDuty account, optionally filtered by name. Returns schedule IDs and names useful for **List On-Calls** and **Create Schedule Override**. See the documentation

Retrieves available options for the Service ID field.

List services, optionally filtered by team or searched by name. Returns service IDs, names, status, and html_url. Use **List Teams** to discover team IDs for filtering. See the documentation

List posts on a PagerDuty status page. Use **List Status Pages** to discover status page IDs. Set activeOnly: true to filter to currently active posts (client-side filter). Requires Business+ plan — accounts without this plan will receive empty results or a 402 error. See the documentation

List configured PagerDuty status pages. Use status page IDs with **List Status Page Posts** to retrieve posts on a specific page. Requires Business+ plan — accounts without this plan will receive empty results or a 402 error. See the documentation

List teams in the PagerDuty account, optionally filtered by name. Returns team IDs and names useful for filtering incidents, users, and services. See the documentation