Datadog Observability

Searches events like monitor alerts, deployment notifications, infrastructure changes, security findings, and service status changes.

Retrieves detailed information about an incident.

Queries and analyzes historical or real-time metric data, supporting custom queries and aggregations.

Retrieves detailed information about a metric including metadata, available tags, and tag values for filtering and grouping.

Retrieves information about Datadog monitors, including their statuses, thresholds, and alert conditions.

Fetches a complete trace from Datadog APM using a trace ID.

Lists available Datadog dashboards and key details.

Retrieves detailed information about a specific notebook by ID, including name, status, and author.

Lists and searches Datadog notebooks with filtering by author, tags, and content.

Lists and provides information about monitored hosts, supporting filtering and searching.

Retrieves a list of Datadog incidents, including their state, severity, and metadata.

Lists available metrics, with options for filtering and metadata.

Searches Datadog's Catalog for service identity, ownership and upstream and downstream dependencies.

Retrieves spans from APM traces with filters such as service, time, resource, and so on.

Aggregates APM spans to compute counts, sums, averages, minimums, maximums, cardinality, and percentiles (p50 to p99). Group results by fields such as service or resource, or set group_by.interval in milliseconds to return a timeseries.

Analyze Datadog logs using SQL queries for counting, aggregations, and numerical analysis. Use this for statistical analysis.

Searches logs with filters (time, query, service, host, storage tier, and so on) and returns log details. Renamed from get_logs.

Search Datadog RUM events using advanced query syntax.

Aggregates RUM events to compute counts, sums, averages, min, max, cardinality, and percentiles, with grouping support. Use this for statistical analysis and trend data, not for inspecting individual events.

Creates a new Datadog notebook.

Edits an existing Datadog notebook.

Validates a monitor definition for correctness before creating or updating it.

Retrieves available monitor templates to help you create monitors.

Searches monitor groups by name or criteria.

Searches Datadog SLOs by name, tags, or type. Supports query syntax for filtering by service, team, or other attributes.

Creates a Datadog monitor in draft mode. Monitors created with this tool do not send notifications and are set to priority 5 (low). Use validate_datadog_monitor to check the definition before creating and get_datadog_monitor_templates for query syntax examples. After creation, publish the monitor in the Datadog UI.

Finds monitoring gaps and coverage for services or hosts. Returns which signals (such as error rate, latency, and request rate) are covered by existing monitors and which are missing. Use with create_datadog_monitor to fill gaps.

Runs a read-only SQL query against a trace's spans to answer a specific question, such as ranking spans by self-time or isolating one span's attributes. Complements get_datadog_trace, which shows a trace's overall shape.

Discovers available tag keys on spans within a time range.

Retrieves the primary tag keys configured for the organization.

Retrieves the current health status (ok/warning/critical) for one or more APM services plus the signals driving it (paging monitors, incidents, Watchdog anomalies, DBM regressions). Returns present state only; no historical trends.

Analyzes latency bottlenecks across traces in an anomaly period using self-time calculations. Identifies which service and resource combinations consume the most self-time, detects cascading call patterns, and surfaces root causes of latency spikes.

Searches for APM recommendations from Datadog.

Retrieves full details of a specific APM recommendation by ID.

Lists remote sampling rules that set a fixed sample rate for spans matching a service, environment, and resource. Filter by service, environment, or both.

Creates a remote sampling rule that sets a sample rate for a service, environment, and resource, with no redeploy needed. A low rate can drop most of a service's traces. If a rule already exists for that target, use update_apm_sampling_rule instead. The tool requires explicit confirmation before it creates the rule.

Changes the sample rate of an existing remote sampling rule, identified by its service, environment, and resource. To change the rule's target, delete the rule and create a new one. The tool requires explicit confirmation before it applies changes.

Permanently deletes a remote sampling rule, identified by its service, environment, and resource. Matching spans fall back to the next applicable sampling mechanism. The tool requires explicit confirmation before it deletes the rule. This operation is idempotent.

Lists the organization's service remapping rules in evaluation order, or retrieves one rule by ID. Each result includes the rule's filter, new name, and current version.

Creates a service remapping rule that renames services or inferred entities on matching spans, which changes how they appear across APM, monitors, and dashboards. New rules are evaluated after existing rules. You can also specify a different tag for the rule to rewrite. The tool requires explicit confirmation before it creates the rule.

Updates an existing service remapping rule's name, filter, the name it assigns to matching services or inferred entities, or the tag it rewrites (service or peer.service by default). The rule type cannot be changed, and rules with multiple rewrite mappings must be edited in Datadog instead. The tool requires explicit confirmation before it applies changes.

Sets the evaluation order of all service remapping rules. The first matching rule applies, so order determines which rule wins when a span matches more than one. The tool requires explicit confirmation before it applies changes.

Permanently deletes a service remapping rule by ID. New spans that matched the rule keep their original service name. Data that's already indexed doesn't change. The tool requires explicit confirmation before it deletes the rule. This operation is idempotent.

Sends a message to the Datadog Assistant and returns its response. Optionally continues an existing conversation by providing a conversation_id.

Retrieves the full conversation history for a specific assistant conversation by its ID.

Lists all Datadog Assistant conversations for the current user.

Searches for Audit Trail events using Datadog query syntax with support for pagination. Use when you need to find and filter events by specific attributes. Returns Audit Trail events without metadata and previous or new asset values unless requested.

Lists Audit Trail events over a time window with support for pagination and an optional query. Use to scan recent Audit Trail events. Returns Audit Trail events without metadata and previous or new asset values unless requested.

Translates a natural-language description into an Audit Trail query string. If you are uncertain of query syntax when searching Audit Trail events, use this tool first with a description of the events you would like to retrieve, then pass the returned query and timestamps directly into search_audit_events.

Searches Work Management work items (cases) with filters including status, priority, project, and assignee. Supports time range filtering and pagination.

Retrieves detailed information about a specific work item (case) by ID or key, including title, status, priority, assignee, and timestamps. Optionally includes timeline activity (comments and status changes) and custom attributes.

Creates a new Work Management work item (case) with a title, project, and optional fields like description, priority, and assignee. The project can be given as a project key, a project name, or a project ID.

Updates an existing work item (case): status, priority, title, description, assignee, due date, and custom attributes. Only the fields you provide are updated.

Adds a comment to a work item (case) timeline. Comments support markdown formatting.

Lists available Work Management projects with optional filtering by name or key.

Retrieves details for a specific project by ID.

Searches for Datadog users by email, name, or handle. Useful for finding the right person to assign a work item to.

Lists an organization's Cloud Cost Management cost-saving recommendations, ranked by estimated potential daily savings (highest first). Supports faceted filtering by cloud provider, recommendation type, status, savings threshold, and resource tags, along with pagination and a summary of the total count and total potential daily savings.

Gets the configuration and metadata that Datadog records for a single cloud resource. Identify the resource by its cloud resource ID: an AWS ARN, an Azure resource ID, a Google Cloud resource name, or an OCID. Returns the resource's account, region, tags, and provider configuration. Use this tool when you have a cloud resource ID and need the details behind it. To find resources by attribute, use a search tool instead. If the resource is not in the Resource Catalog, the tool reports that it was not found. This can mean the resource was deleted, was never ingested, or is not a supported type.

Executes AI agent-authored JavaScript in a Datadog-managed sandbox. The code receives a dd.* namespace with helpers for querying logs, metrics, traces, services, change events, incidents, monitors, dashboards, and other Datadog APIs, and returns a structured value back to the agent. This can reduce the number of round-trips needed for multi-signal investigations and ad-hoc data exploration.

Looks up the SDK functions, types, and API methods available for writing execute_code scripts. Call this before writing a script to confirm which methods exist and their signatures.

Retrieves a Datadog dashboard by ID, returning its title, description, tags, and widgets. Use search_datadog_dashboards first to find dashboard IDs.

Creates or updates a Datadog dashboard. To update an existing dashboard, provide the dashboard ID; omit it to create a new one. Call get_widget_reference for widget schemas before building widgets.

Permanently deletes a Datadog dashboard by ID. This action cannot be undone. Use search_datadog_dashboards first to find dashboard IDs.

Returns schemas and building instructions for dashboard widget types. Widget definitions are JSON objects; this tool returns TypeScript type definitions representing their schemas along with building instructions covering query patterns, formula syntax, and common pitfalls. Call this before generating widgets with upsert_datadog_dashboard.

Validates a widget definition against the dashboard schema. Use this to check widget JSON before passing it to upsert_datadog_dashboard.

Ask a Datadog widget expert a question about widget configuration, schemas, query syntax, field usage, debugging, or pitfalls. Best for targeted questions: schema lookups, field clarifications, debugging an existing widget definition, or understanding how a specific widget type works.

Searches for data entities in the data catalog by name, full-text search, or filters (platform, schema, database, account).

Returns the entity type schema for every platform with data in the catalog: entity types, containment hierarchy, filterable attributes, and default metrics.

Fetches full details and attributes (owner, tags, custom attributes, platform, schema, database, account) for one or more data entities by ID.

Fetches the containment hierarchy (ancestors and descendants) for one or more entities — for example, which database or schema a table belongs to, or which tables are in a schema.

Fetches the live reachable lineage subgraph (nodes and edges) from one or more anchor entities, upstream, downstream, or both.

Returns aggregate lineage statistics (node/edge counts, type breakdowns, depth distribution) for a large or unknown lineage graph, without the full payload. Use before get_data_entity_lineage on graphs of unknown size.

Ranks entities by transitive lineage connectivity (upstream, downstream, or both), using a pre-built snapshot.

Fetches recent queries that touched specific entities, in reverse chronological order, including the SQL text, execution state, and query type.

Ranks tables by query activity, grouped by who's querying them: human users, BI tools, orchestrators, ETL tools, or internal service accounts.

Analyzes a set of entities to find common attributes and naming patterns, and suggests monitor filter expressions that group subsets of those entities.

Ranks tables by monitoring priority, combining lineage impact and query activity into a single composite score. This is the primary entry point for "what should I monitor?" questions.

Retrieves data quality metric timeseries for a given monitor ID, including anomaly-detection bounds when enabled.

Fetches all data quality monitors for the org and resolves each monitor's filter to the entities it covers. Use this to see which tables have no monitoring at all.

Queries the current alert and warn state of data quality monitor groups.

Gets or sets custom user-defined tags on data entities.

Gets or sets custom user-defined tags on data entities.

Gets or sets custom user-defined descriptions on data entities.

Gets or sets custom user-defined descriptions on data entities.

Retrieves detailed health metrics (duration, executor CPU time, shuffle, spill, worst stages) for a single Spark or Databricks job run.

Retrieves the Spark SQL physical execution plan for a stage, including join strategies, shuffle information, and per-node metrics.

Lists cost and performance optimization recommendations for data jobs and queries (Spark, Databricks, Snowflake, BigQuery), with estimated cost and duration savings. Returns lightweight summaries with cursor pagination.

Retrieves full details of a specific Data Observability recommendation by ID, including its structured body describing the problem, evidence, and proposed change.

Discovers and ranks database instances for DBM investigation. Call this before other DBM tools that require a database_instance parameter. Accepts an APM trace or span ID, tags, or both to find matching instances, then assesses and ranks their health.

Identifies upstream APM services and resources that call database queries. Correlates database activity with application traces for root cause analysis across the APM-database boundary.

Retrieves PostgreSQL explain plans for a query signature within a time frame. Returns simplified plan structures with operator trees, index usage, and estimated costs, sorted by cost.

Runs health checks to surface potential PostgreSQL issues such as CPU saturation, restarts, query latency, and blocking. Compares a regression time frame against a baseline period.

Retrieves collected PostgreSQL configuration settings for a Database Monitoring instance, the same values shown on the Configuration tab. Returns parameters that affect performance and behavior, including memory (shared_buffers, work_mem), connections (max_connections), autovacuum, logging, WAL, and query planner settings. Filter by setting name to narrow results.

Analyzes a specific PostgreSQL query's performance. Returns throughput, average latency, execution time, rows per execution, cache hit ratio, I/O stats, connection activity, wait events, and transaction duration, with both overall statistics and time-bucketed analysis.

Retrieves the SQL statement text for a given query signature. Use this to map signature hashes back to the concrete SQL for investigation and reporting.

Retrieves live database recommendations for a database, query, table, host, or index. Returns the matching recommendations with status, severity, and a normalized scope block highlighting affected instances, query signatures, tables, indexes, services, plans, and infrastructure identifiers.

Fetches schema definitions (columns, indexes, foreign keys, partitions) for one or more database objects. Accepts table names with optional schema, database, and instance qualifiers.

Analyzes a PostgreSQL query for optimization opportunities using deterministic rules. Returns query rewrites, anti-pattern detection (SELECT *, OFFSET without ORDER BY, ORDER BY without LIMIT), missing index suggestions, and idle-in-transaction impact analysis. Accepts either SQL text or a query signature.

Searches Database Monitoring query execution plans, which show how the database engine executes queries, including index usage, join strategies, and cost estimates. Use this to analyze query performance and identify optimization opportunities.

Searches Database Monitoring query samples, which represent individual query executions with performance metrics. Use this to analyze database activity patterns, identify slow queries, and investigate database performance issues.

Gets a compact DDSQL capability spec, including supported SQL functions, SQL keywords, and DDSQL-specific differences from standard PostgreSQL. Call this tool before composing queries to understand supported syntax.

Searches DDSQL datasets and returns tables (public data sources and reference tables) and available metrics.

Gets static SQL columns for a DDSQL table from schema metadata.

Searches and ranks fields for unstructured DDSQL sources, such as logs, RUM, and spans, sorted by frequency. Use this tool for schema discovery on searchable sources before falling back to ddsql_schema_get_table_columns.

Runs a DDSQL query and returns results. Supports using SQL syntax to query infrastructure resources, logs, metrics, RUM, spans, and other Datadog data sources. See the DDSQL Reference for syntax details.

Generates a Datadog UI link to the DDSQL Editor with a given query pre-populated.

Searches saved DDSQL queries by name or description and returns their SQL text and metadata, sorted by most recently modified. Supports optional text filtering and pagination. Multiple filter words are ANDed together.

Gets a saved DDSQL query by its query ID, including its name, SQL text, columns, description, and author metadata.

Creates or updates a saved DDSQL query. To create a query, provide a name and SQL text and omit the query ID. To update a query, provide its query ID and a new name, SQL text, or both. If the name or SQL text is omitted from an update, its existing value is preserved.

Searches Error Tracking Issues across data sources (RUM, Logs, Traces).

Retrieves detailed information about a specific Error Tracking Issue from Datadog.

Analyzes Datadog Error Tracking errors using SQL queries for counting, aggregations, and numerical analysis. Operates on individual error samples, not Issues (groups of errors).

Updates the state or assignee of an Error Tracking Issue in Datadog.

Adds, updates, or deletes a comment on a Datadog Error Tracking Issue.

Creates, links, or unlinks a Jira ticket, Linear ticket, or Datadog case for an Error Tracking Issue.

Retrieves daily Error Tracking Issue counts broken down by state and category, for a set of services or teams. Each day's count is a snapshot of issue states at end of day.

Lists experiments for the organization, with optional name search, limit, and offset for pagination.

Gets a single experiment by ID, including status, linked feature flag, subject type, primary metric, assignment dates, and decision.

Creates a new experiment with a name, hypothesis, subject type, and primary metric.

Links a feature flag to an experiment.

Starts a standard experiment from its saved configuration using Datadog feature flags or warehouse-native assignment. The tool checks readiness before starting. If setup is incomplete, it returns every detected blocker with an action to resolve it and does not change the experiment. For warehouse-native experiments, configure variants and run dates before using this tool because it accepts only the experiment ID.

Concludes a running experiment with a permanent winning variant decision.

Cancels a running experiment with a required reason.

Returns a health summary for an experiment before interpreting results: sample ratio mismatch (SRM) status, total subjects, per-variant exposure counts and fractions, and per-metric health including unreliable and zero-data metrics. Call this before get_experiment_results — if srm.has_warning is true, variant-level comparisons are not safe to interpret.

Returns computed per-variant, per-metric results. The verdict field (better, worse, inconclusive, or unreliable) is authoritative — do not recalculate significance from raw p-values or confidence intervals.

Segments results by an assignment property (device type, country, plan tier, and so on) or over time. Use after get_experiment_results for deeper analysis.

Lists the assignment properties an experiment can be split by. Call this before explore_experiment_results to get valid property IDs — do not guess them.

Returns the concrete values for a segmentation property (for example, ["mobile", "desktop", "tablet"] for device type). Use this before filtering in explore_experiment_results to avoid invalid filter strings.

Returns the definition of an experiment metric — the underlying event query, data source, and the recommended Datadog MCP tool for investigating why the metric moved. For datadog-sourced metrics, the response includes a recommended_tool_call field with the structured parameters needed to query the raw event data. Not for Datadog infrastructure or APM metrics; use get_datadog_metric for those.

Diagnoses why the latest (or a specific) analysis pipeline run for an experiment failed. Returns the root-cause task, a categorized failure explanation, and actionable next steps. Use get_experiment_diagnostics for result quality and SRM issues instead.

Lists feature flags with pagination support.

Retrieves details about a specific feature flag.

Creates a new feature flag.

Lists environments configured for feature flags.

Lists allocations for a feature flag in a specific environment.

Updates a feature flag configuration in a specific environment.

Checks if a feature flag is implemented in code.

Syncs feature flag allocations for a specific environment. This replaces all existing allocations for the flag in that environment. Confirm the change before applying.

Lists forms visible to your organization, with keyword filtering and pagination.

Retrieves a form's full metadata and definition by ID. Use the version parameter to select latest, published, or a specific version number.

Returns the JSON schema used to validate a form's field and layout definitions. Call this before creating or updating a form.

Reads submitted responses from the data store linked to a form. Requires the datastore_id from get_datadog_form.

Creates a new form in draft state, with a linked data store automatically provisioned. Call get_form_definition_schema first to build a valid definition.

Creates a new draft version of an existing form with an updated definition. Does not publish the form; use publish_datadog_form afterward.

Publishes a specific draft version of a form, making it the live version respondents see.

Copies an existing form, including its latest definition, into a new form with a new data store.

Retrieves governance health insights for your organization, such as the number of unused API keys or the percentage of monitors with team tags. Supports filtering by product and includes computed values and trends by default.

Lists the governance controls for your organization, including each control's detection type, severity, category, detection counts, and mitigation options.

Retrieves details for a governance control by detection type, including its configuration, detection parameters, available mitigations, notification settings, and detection counts.

Lists the detections for a governance control. A detection is a resource that violates the control, such as an unused API key. Supports filtering by state (active, exception, or mitigated) and searching by resource ID or name.

Retrieves details for a governance detection, including its state, resource details, assignment, mitigation deadline, and notification history.

Lists your organization's rate limits and resource limits, with current usage compared to each limit. Use this tool to find resources that are close to or over their limits.

Lists recommended governance best practices, each with a description, expected impact, priority, and a link to the relevant page in Datadog. Supports filtering by category (access_governance, security, compliance, or operational_hygiene) and keyword search.

Lists your organization's tag rules. A tag rule flags telemetry that is missing a required tag or has a tag value that does not match an allowed pattern. Rules apply to logs, spans, metrics, RUM events, or feed events. Supports filtering by source and including disabled or deleted rules.

Retrieves a tag rule by ID, including the tag key it governs, its allowed value patterns, its scope, and whether it is enabled.

Runs a mitigation on up to 25 detections for a control, such as revoking unused API keys. You must specify the mitigation type. Use get_governance_control to see the mitigations available for a control. Each mitigation also requires the permissions to change the affected resources. Some mitigations cannot be undone. The tool requires explicit confirmation before it runs the mitigation.

Updates a governance detection. Use this tool to mark a detection as an exception, reactivate it, assign it to a user or team, or change its automatic mitigation deadline. The tool requires explicit confirmation before it applies changes.

Creates a tag rule. Rules created with this tool only flag non-compliant telemetry; they do not block it. New rules are disabled unless you ask for the rule to be enabled. The tool requires explicit confirmation before it creates the rule.

Updates the fields you specify on a tag rule and leaves other fields unchanged. To change the source of a rule, delete the rule and create another one. You cannot update rules that block telemetry with this tool; use Governance Console instead. The tool requires explicit confirmation before it applies changes.

Deletes a tag rule. By default, the rule is soft-deleted and can be recovered. To delete the rule permanently, ask for a hard delete. The tool requires explicit confirmation before it deletes the rule.

Triggers a Bits Investigation for a monitor alert. This starts an automated investigation that analyzes the alert context and provides findings and conclusions. Use get_bits_ai_investigation to retrieve results.

Triggers a Bits Investigation from a text description. For best results, scope the investigation with a service:<name> or host:<name> tag. Use get_bits_ai_investigation to poll for results after triggering.

Triggers a Bits Investigation scoped to a Datadog incident. The investigation analyzes the incident timeline and context to provide findings and conclusions. Use get_investigations_from_incident_id to check for existing investigations first.

Searches Bits AI investigations by keyword or query. Returns matching investigations with their IDs, status, and summaries.

Retrieves Bits AI investigations linked to a specific Datadog incident.

Retrieves the status, findings, and conclusions of a Bits AI investigation.

Sends a steering message to a running Bits AI investigation to correct, redirect, or add context. Use get_bits_ai_investigation first to confirm the investigation is still active.

Searches for Kubernetes resources across all clusters. Use this tool instead of kubectl to determine the state of Kubernetes resources such as deployments, pods, nodes, etc. This tool does not require local cluster access, works across all clusters, and returns enriched data with tags. You can include specific tag keys on each result, and include parent resource names to investigate relationships between resources (for example, the deployment a pod belongs to).

Assembles a Kubernetes Deployment rollout in one call: rollout status and progress, timing (ETA while the rollout is in progress, duration after it finishes), the new, previous, and old ReplicaSet split by revision, and before/after impact series (RED, resource utilization, and log counts). Identify the Deployment by its UID from a previous search or by providing resource identifiers (cluster, namespace, and resource name). Use this tool for rollout questions instead of combining search_datadog_k8s_resources and describe_datadog_k8s_resource.

Gets detailed information about a specific Kubernetes resource, including resource-specific details such as CPU and memory requests and limits, and optionally tags, labels, annotations, manifest history, parent resources, and a deep link to the Kubernetes Explorer. Use this tool instead of kubectl describe. Identify a resource by its UID from a previous search or by providing resource identifiers (cluster, namespace, and resource name). For the full raw manifest, use get_datadog_k8s_manifest.

Retrieves the YAML manifest for a specific Kubernetes resource. Use this tool instead of kubectl get -o yaml. Supports extracting specific subtrees with a kubectl JSONPath expression and a concise mode that omits status and managedFields to reduce response size.

Estimates a metric's timeseries cardinality for a proposed allowlist of tag keys. Use this tool to evaluate how keeping or removing tags could affect indexed volume.

Identifies the tag-level drivers of a metric's indexed timeseries volume, including tag cardinality, query activity from the past 30 days, active aggregations, and the direct tag configuration. The profile describes observed data and does not estimate the combined effect of changing multiple tags.

Retrieves the Metrics without Limits™ governance status for up to 20 metrics, including direct tag configurations, exemptions, and optionally the first matching tag indexing rule.

Retrieves the direct Metrics without Limits™ tag configuration for up to 20 metrics. The result identifies whether each configuration is an allowlist or denylist; a metric without a configuration might still be governed by a tag indexing rule.

Retrieves indexed and ingested tag keys for a metric over the last four hours, with one observed sample value for each key.

Retrieves series volume for up to 20 metrics. Custom metrics return indexed and ingested volume, while standard metrics return distinct volume. Supports windows from four hours to two weeks.

Lists Metrics without Limits™ tag indexing rules in priority order. The first rule that matches a metric determines its tag configuration.

Creates, updates, or deletes a direct Metrics without Limits™ tag configuration for a metric. The tool provides a preview and requires explicit confirmation before applying changes.

Creates, updates, deletes, or reorders Metrics without Limits™ tag indexing rules and manages metric exemptions. The tool provides a preview and requires explicit confirmation before applying changes.

Discovers the deployment environments where a service runs Live Debugger and the features it supports, such as message_templates, conditions, and capture_expressions. Call this tool before create_datadog_logpoint.

Enables Live Debugger for a service in an environment where it is supported but not yet enabled. This tool may block for a few minutes to confirm enablement. Run discover_datadog_logpoint again to confirm logpoint readiness.

Creates a Live Debugger session. Use the returned session_id to create, list, and disable logpoints.

Creates a logpoint to capture runtime data unavailable in existing logs, metrics, or traces. Call discover_datadog_logpoint first to confirm the environment supports logpoints. Logpoints take up to a minute to propagate before they begin capturing data.

Lists the logpoints in a Live Debugger session, with the service, source location, message template, and enabled state for each.

Retrieves captured variables from a Live Debugger snapshot. Use variable_path to select a nested value and depth to control how many levels it expands. To aggregate the same captured value across multiple snapshots, pass the node's extra_columns block, when present, to analyze_datadog_logs.

Disables all logpoints in a Live Debugger session. The session stays active so new logpoints can be added.

Investigates network-level issues using Cloud Network Monitoring data, analyzing network flow data to detect anomalies like elevated retransmission rates.

Searches network devices (routers, switches, firewalls) monitored by Datadog Network Device Monitoring.

Retrieves detailed information about a specific network device by its device ID.

Retrieves all network interfaces for a specific device.

Searches and retrieves Network Path test runs with hop-by-hop traceroute data, including a link to the path in the Network Path view.

Checks the health of an Autonomous System (AS) using Network Path data, comparing latency, packet loss, and visibility against a 7-day baseline.

Lists degraded Autonomous Systems (ASes) using Network Path data, without requiring a specific AS number. An AS is degraded when its latency, packet loss, or visibility is worse than its own 7-day baseline. Results cover the highest-traffic ASes for the selected time frame, not every AS in your organization. To check one specific AS, use get_autonomous_system_status.

Runs a live Network Path traceroute test from a Datadog Agent host to a destination, through the Private Action Runner (PAR). Supports UDP (default), TCP, and ICMP. For TCP, specify the destination port. To retrieve historical results without running a new test, use get_network_path_test_runs.

Guides you through onboarding Browser RUM to Datadog.

Guides you through onboarding devices to Datadog monitoring.

Guides you through onboarding Kubernetes clusters to Datadog.

Guides you through onboarding Agent Observability in Datadog.

Guides you through onboarding Test Optimization in Datadog.

Guides you through onboarding serverless applications to Datadog, including AWS Lambda functions and GCP Cloud Run and Cloud Run functions (Gen 2).

Guides you through uploading source maps for RUM error mapping.

Finds Product Analytics views and actions matching a natural-language description using semantic search, including org-curated labeled actions.

Looks up org-specific Product Analytics entities by name or keyword (feature flags, context attribute keys, saved charts, and segments).

Retrieves the full definition of a saved Product Analytics chart by ID, including its query parameters, filters, and time interval. Use search_product_analytics_org_entities first to find the chart ID.

Aggregates Product Analytics event data as a scalar or timeseries, supporting count, cardinality, average, sum, min, max, and percentile calculations with optional grouping.

Runs funnel, timeseries, scalar, list, and drop-off queries across a multi-step user journey, tracked at the user, session, or account level.

Runs a Sankey (pathway) analysis showing how users navigate between views, starting from a source view or leading to a target view.

Runs retention queries on Product Analytics data as a cohort grid, retention curve, timeseries, or scalar value, tracked at the user or account level.

Returns available profile types and families for a given query context (query string and time range) or a trace/span context. Use this first to discover what is queryable.

Lists profiled services and their profiling families in scope. Results are unordered and do not imply importance or activity level.

Returns individual profiled runtime IDs (processes or containers) in scope. Defaults to the top-1 by CPU; the limit parameter controls how many.

Returns pre-computed service insights, including a high-level summary, contextual signals (affected methods, packages, processes), and recommended next steps.

Returns top-N stack traces by value contribution for a given profile type. Supports filtering by frame, endpoint, or attribute regex. Single-service. Accepts either service:family or a traceContext.

Returns a call-graph view (caller-to-callee edges) of hot functions for a given profile type. Defaults to the top 20 nodes, a 5% cutoff, and 5 edges per node. Single-service.

Returns a timeline of lane groups (threads, garbage collection, and so on) with CPU and I/O activity. Supports a critical-path mode (Go-only; requires traceContext) to identify latency bottlenecks within a span.

Returns profiling data aggregated as timeseries (rate metrics). Best for trends, cross-service comparison, and regression detection. Supports groupBy on frame fields, contexts, and tags.

Discovers available tag names (such as service, host, env, version, family, runtime-id, kube_*) for filtering profiling data. Returns up to 50 results, sorted by relevance.

Returns values for a specific profiling tag (for example, all values of the service tag). Returns up to 50 results, sorted by frequency.

Discovers frame and context facet fields (such as @stack.function and @labels.trace_endpoint) usable in get_profiling_timeseries groupBy and filter parameters. Scoped by sampleType.

Returns values for a specific frame or context field discovered with get_profiling_fields. Sorted by frequency.

Lists and searches Reference Tables in the organization, with optional filtering by name and sorting.

Lists all rows in a reference table with optional filtering and pagination. Use list_reference_tables first to find the table ID and schema.

Retrieves specific rows from a reference table by their primary key values. Use list_reference_tables first to find the table ID and schema.

Appends new rows to an existing reference table. This operation only adds rows and does not modify or delete existing data. Each row must include all required fields from the table's schema, including the primary key field. If rows may already exist, use upsert_reference_table_rows instead.

Inserts new rows or updates existing rows in a reference table. If a row with the same primary key already exists, its values are overwritten. Use this instead of append_reference_table_rows when rows may already exist.

Creates a new reference table. Supports two modes: LOCAL_FILE creates an empty table you can populate with append_reference_table_rows or upsert_reference_table_rows. Cloud-backed modes (S3, GCS, AZURE) sync from a CSV file in Amazon S3, Google Cloud Storage, or Azure Blob Storage. Only INT32 and STRING field types are supported.

Runs a read-only shell command on a specified host. Supported commands include: cat, ls, head, tail, find, grep, sed, cut, sort, uniq, wc, ping, ss, and ip. Supports pipes, loops, conditionals, variable assignment, and globbing.

Lists your RUM applications and resolves the application_id to use for subsequent RUM tool calls.

Returns a summary of vital metrics for a RUM application, with period-over-period diffs.

Returns aggregated insights for RUM Views: waterfall, long tasks, vital distributions, and tag analysis.

Reconstructs the chronological load timeline for a single RUM view occurrence on web or mobile. Returns every resource, long task, error, and user interaction during that view, ordered by start time. Use this to investigate one concrete page load or screen. For the aggregated, cross-session view, use get_rum_insight.

Lists the operations in your organization, including both SDK-instrumented and UI-configured operations, and resolves an operation name to its operation_id and application_id. Operations observed only through the SDK have no ID.

Returns a health summary for a single operation: volume, success rate, failure breakdown by reason, latency percentiles, a per-bucket success and failure trend, and related SLOs and monitors.

Investigates why an operation is failing, slow, or abandoned. The failures mode returns top failing endpoints, custom context attributes on failed runs, and correlated crash errors. The latency mode compares slow and fast cohorts and returns top slow resources. The abandonment mode shows how often users give up instead of completing, which views and in-flight resources are involved, and where users navigate next.

Creates a UI-configured operation that tracks a user journey between a start event and a success, failure, or abandonment event, matched by search queries against RUM events. This tool does not create SDK-instrumented operations, which are defined in application code. Confirm the operation name, queries, and event types before applying.

Updates a UI-configured operation in place. Only the fields you pass are changed, and the rest keep their current values. This tool cannot rename an operation, and does not affect SDK-instrumented operations. Confirm the change before applying.

Permanently deletes a UI-configured operation by ID or name. The response lists any SLOs and monitors still tagged for the operation, which are not deleted with it. Confirm the deletion before applying. This tool does not affect SDK-instrumented operations.

Explores RUM metrics for an application, including out-of-the-box metrics and custom metrics.

Creates or updates a custom RUM metric. Checks immutable fields before updating an existing metric. This operation is idempotent.

Permanently deletes a custom RUM metric by ID. This operation is idempotent.

Lists retention filters configured on a RUM application. Read-only; available for RUM without Limits customers.

Creates a RUM retention filter, appended to the end of the evaluation order. Retention filters control which RUM events are indexed and retained, which affects billing. Confirm the change before applying.

Updates an existing RUM retention filter's attributes in place, such as its name, event type, query, sample rate, or enabled state. Confirm the change before applying.

Sets the full evaluation order of a RUM application's retention filters. Filters are evaluated top-down and each event stops at the first match, so order determines which sample rate applies. Confirm the new order before applying.

Permanently deletes a RUM retention filter by ID. Confirm the deletion before applying. This operation is idempotent.

Scans code for hardcoded secrets and credentials, detecting AWS keys, API keys, passwords, tokens, private keys, and database credentials.

Returns the available fields and their types for security signals. Signal types map to @workflow.rule.type values such as Log Detection, Application Security, and Workload Security.

Searches and retrieves security signals from Datadog Security Monitoring, including Cloud SIEM signals, App & API Protection signals, and Workload Protection signals.

Analyzes security signals using SQL queries for aggregations, grouping, and trend analysis. Use this for counts, top-N, and breakdowns over time. To list or retrieve specific signals, use search_datadog_security_signals or get_datadog_security_signal.

Retrieves the full details of a single security signal by ID, including attributes, rule information, triage state, tags, and case correlations.

Updates the triage state or assignee of one or more security signals in bulk (up to 500 signals). Accepts either a list of signal IDs or a filter query matching all signals to update.

List IoC Explorer indicators (IPs, domains, URLs, file hashes) matched against threat intel feeds. Pair with get_datadog_security_ioc_indicator for full detail and update_datadog_security_ioc_indicator_triage to mark reviewed.

Retrieve full detail for one IoC Explorer indicator by value (score, category, AS info, GeoIP, log sources, signal counts).

Set the triage state of an IoC Explorer indicator.

Discover filterable fields and their values for IoC Explorer. Omit filter to list available fields; supply filter to get [{value, count}] for that field. Use query to scope counts to a subset of indicators.

Returns the authoring reference and schema for detection rules. Covers supported rule types, detection methods, query syntax, tag conventions, and valid search facets. Use this before authoring or querying detection rules. Currently supported rule types: log detection, API security, and AppSec.

Retrieves security detection rules. Supports two modes: provide rule_id to get the full definition of a single rule by ID, or omit rule_id to list rules (optionally filtered with query and token-limited with max_tokens). The two modes are mutually exclusive.

Creates a new detection rule. Call get_datadog_security_detection_rules_schema first to fetch the payload grammar, then supply a complete rule payload. On success, returns the full rule including its server-assigned ID.

Updates an existing custom detection rule by replacing it entirely. Call get_datadog_security_detection_rules first to fetch the current rule body, modify the fields you need, and submit the full updated object. Cannot update Datadog-shipped default rules.

Deletes one or more custom detection rules by ID. Only custom (non-default) rules can be deleted. Default rules return 403. Each rule is authorized individually; failures appear in failed_rules without aborting the batch.

Retrieves security monitoring suppressions. Supports three modes: list all suppressions, get a single suppression by ID, or get suppressions affecting a specific detection rule. Suppressions prevent detection rules from generating signals for matching conditions.

Creates a new suppression rule that prevents a detection rule from generating signals for specific conditions. At least one of suppression_query or data_exclusion_query must be provided.

Updates an existing suppression rule. Only changes provided fields. Providing version enables optimistic concurrency control to prevent overwriting concurrent edits.

Deletes a suppression rule.

Returns the schema (available fields and their types) for security findings. Call this first before using analyze_datadog_security_findings to discover queryable fields. Supports filtering by finding type and controlling response size.

Primary tool for analyzing security findings using SQL queries. Queries live data from the last 24 hours with flexible SQL aggregations, filtering, and grouping. Call get_datadog_security_findings_schema first to discover available fields, then use this tool to query.

Fallback tool for retrieving full security finding details. Prefer analyze_datadog_security_findings for most analysis tasks. Use this tool only when you need complete finding objects or when SQL queries are insufficient.

Returns ranked project suggestions for ticketing security findings. Shows available Case Management, Jira, Linear, and ServiceNow projects with 30-day usage data. Call this before create_datadog_security_findings_ticket to discover which project to use.

Creates a Case Management case, Jira issue, Linear issue, or ServiceNow ticket for security findings. Requires specific finding IDs and a project ID. Use get_datadog_security_findings_ticket_suggestions first to discover available projects.

Detaches security findings from their linked case or ticket. Since Jira and ServiceNow tickets are linked through Case Management, detaching the case also detaches any downstream ticket.

Mutes or unmutes security findings to suppress them from alerts and dashboards. Requires a mute reason (PENDING_FIX, FALSE_POSITIVE, ACCEPTED_RISK, or OTHER) and supports an optional description and expiration date.

Assigns or unassigns security findings to a user. Assignment cascades to any linked cases. Omit the assignee ID to unassign.

Lists security findings automation rules of a given type (mute, due_date, ticket_creation, or severity_modifier).

Creates a security findings automation rule. Choose a rule_type: mute (suppress findings), due_date (set remediation deadlines), severity_modifier (adjust finding severity), or ticket_creation (auto-create Jira or Case Management tickets).

Updates an existing automation rule. Supports partial updates, so only the provided fields are changed. Use it to enable or disable rules, rename them, adjust filters, or change action parameters.

Permanently deletes a security findings automation rule by ID.

Moves an automation rule up or down in the list. Rules are applied in order, so a rule's position sets its priority.

Returns all WAF exclusion filter (passlist) entries for the organization to review existing suppressions.

Creates or updates a WAF exclusion filter (passlist) entry to suppress noisy rules on a specific service or endpoint.

Deletes an existing WAF exclusion filter (passlist) entry.

Lists blocked IPs, users, and user agents (denylist entries), with optional filtering.

Adds or updates a denylist block for an IP, user, or user agent with an expiration.

Unblocks a previously denylisted entity by setting its expiration in the past.

Retrieves one App & API Protection (AAP) custom WAF rule by ID or lists custom rules. Supports filtering by category, status, service, and environment.

Creates or updates an AAP custom WAF rule in the attack attempt or business logic category. New rules cannot block traffic: create the rule in monitoring mode, then update it to blocking mode after confirming its matches.

Permanently deletes an AAP custom WAF rule by ID.

Retrieves the organization-wide AAP blocking and denylist enforcement settings.

Retrieves one Infrastructure as Code (IaC) custom rule by ID or lists the custom rules in your organization. Supports filtering by platform, provider, published state, or a text query. Listing returns the full custom ruleset without pagination.

Returns the schema for IaC custom rules: allowed platforms, categories, severities, the rule ID format, and the fields each write tool accepts. Call this tool before generating, validating, or creating a rule.

Generates a Rego IaC custom rule from a natural-language description and validates it with the scanner. Does not save the rule.

Checks that the Rego for an IaC custom rule compiles. When a sample file is provided, also evaluates the rule against it and requires at least one finding. Does not save the rule.

Creates a draft IaC custom rule. Rules are always created unpublished. To activate a rule for scans, publish it with publish_datadog_security_iac_custom_rule.

Creates a new revision of a draft or published IaC custom rule. Omitted fields keep their current values, including the published state. Can also publish or unpublish the rule.

Publishes a draft IaC custom rule so it becomes active for scans. To unpublish it later, use update_datadog_security_iac_custom_rule.

Permanently deletes an IaC custom rule by ID. This action cannot be undone.

Searches Session Replay recordings and returns matching sessions. Supports filtering by user identity, device, error count, or any RUM facet, and journey search for sessions that followed a specific sequence of views or actions.

Generates an AI-powered, time-based play-by-play of what a user did during a specific session replay—pages visited, actions taken, and key moments—organized into chapters. Typically called after search_replays to dive into a session of interest.

Creates or updates a Datadog spreadsheet's tables, sheets, and pivots in a single call.

Returns reference documentation for building inputs to upsert_datadog_spreadsheet. Call this before creating or updating a spreadsheet.

Searches Datadog spreadsheets by name or owner. Returns a paginated list of spreadsheets with their IDs and names.

Retrieves a Datadog spreadsheet by ID. Returns tables (tables[].id), pivots (pivots[].id), and sheets (sheets[].id) with their configurations. Use search_datadog_spreadsheets first to find spreadsheet IDs.

Retrieves paginated data from a table, sheet, or legacy pivot tab in a Datadog spreadsheet. Use search_datadog_spreadsheets first to find spreadsheet IDs.

Permanently deletes a Datadog spreadsheet by ID. This action cannot be undone. Use search_datadog_spreadsheets first to find spreadsheet IDs.

Searches CI events with filters and returns details on them.

Aggregates CI pipeline events to produce statistics, metrics, and grouped analytics.

Searches Datadog Test Optimization for flaky tests and returns triage details (failure rate, category, owners, history, CI impact), with pagination and sorting.

Sets the state of one or more flaky tests to quarantined (suppress failures), disabled (skip test), fixed (mark resolved), or active (restore). This is a write operation that requires explicit user approval. All state changes are reversible.

Aggregates Datadog Test Optimization events to quantify reliability and performance trends with aggregation functions, optional metrics, group-by facets, and configurable test levels.

Searches Test Optimization test events with filters and returns details on them.

Fetches aggregated code coverage summary metrics for a repository branch, including total coverage, patch coverage, and service/codeowner breakdowns.

Fetches aggregated code coverage summary metrics for a repository commit, including total coverage, patch coverage, and service/codeowner breakdowns.

Fetches aggregated code coverage summary metrics for a pull request, including total coverage, patch coverage, and service or codeowner breakdowns.

Fetches per-file code coverage line data for a repository commit, branch, or pull request. Returns executable lines, covered lines, and added lines for each file. Exactly one of commit_sha, branch, or pr_number must be provided. At most one of service, codeowner, or flag may be provided to filter results.

Retrieves the Test Optimization features that are enabled for a service, including Test Impact Analysis (ITR), Early Flake Detection (EFD), Auto Test Retries (ATR), Failed Test Replay, Code Coverage collection, and PR Comments.

Retrieves the Flaky Tests Management policies configured for a repository, including auto-quarantine windows, branch rules, failure rate thresholds, disable policies, and retry settings.

Searches DORA deployment events with filters, or fetches full details for a single deployment by ID.

Returns DORA metrics (deployment frequency, change lead time, change failure rate, recovery time) for a service, team, or repo, as scalar values or timeseries. Use for questions about software delivery performance over a time window.

Searches Datadog Synthetic HTTP API tests.

Edits Datadog Synthetic HTTP API tests.

Preview and create Datadog Synthetics HTTP API Tests.

Searches Watchdog stories for anomalies and root cause analyses across APM, infrastructure, and logs. Returns story summaries and keys to use with get_watchdog_story.

Retrieves a Watchdog story by its key, including insight details, the timeline, and available root cause analysis. Use a story key returned by search_watchdog_stories.

Searches Watchdog insights for a product context and time range, including anomalies, outliers, recommendations, and correlations. Supports contexts such as APM, logs, RUM, Kubernetes, and Database Monitoring.

Identifies tag dimensions associated with a spike, drop, or other change in a metric. Provide a metric query and a time range. Include the anomaly start time when known, to compare behavior before and after the change.

Retrieves external provider outages, including their status and impacted regions. Filter by provider, affected service, or time range, and optionally include resolved outages and impacted services.

Detects sudden changes in an APM timeseries for latency, error rate, or throughput. Provide a signal query and analysis window. Latency and error-rate analysis also require a request-count query.

Reanalyzes an ongoing jump returned by find_new_jumps over a new time window to determine whether it is ongoing, resolved, expired, or invalidated. Reuse the returned jump state and original signal queries. This tool computes an updated result without modifying stored data.

Forecasts future values from supplied historical timestamps and values, with optional confidence bounds. Provide at least 64 historical points per series. To forecast a Datadog metric, retrieve its history with a metrics query tool first.

Retrieves and visualizes Datadog metrics, traces, logs, and other data as interactive charts. Supports three modes: dashboard lookup, direct definition, or URL resolution.

Searches and retrieves information about widgets across Datadog dashboards, including their IDs, titles, and underlying queries.

Converts a widget definition from one visualization type to another while preserving queries. Supports formula-request-based widget types: timeseries, query_value, top list, query_table, treemap, sunburst, distribution, heatmap, geomap, and list_stream.

Validates notebook cell widget definitions, including SQL correctness for analysis_sql cells. When validating an analysis_sql cell, include its upstream data source widgets so the endpoint can check SQL expressions against their schemas.

Validates multiple notebook cell widget definitions in a single call, including SQL correctness for analysis_sql cells.

Verifies whether widget definitions return data for the last hour. Call after adding widgets to a dashboard to confirm queries return real data. Returns one result per widget indicating whether data was found, with a reason if not.

Renders tabular data as an interactive visualization (sunburst, treemap, or top list). Use after aggregating data from queries to visualize hierarchical relationships or rankings.

Lists and searches Workflow Automation workflows by name, creator, handle, tag, or trigger type. Results include metadata by default and can optionally include complete workflow specifications.

Retrieves a workflow by ID, including its metadata and complete specification. Returns a saved draft when one exists, otherwise the base specification.

Searches the Workflow Automation action catalog with a free-text query and ranks matching actions by relevance. Each result includes an action ID; use get_datadog_workflow_action to retrieve its contract before adding it to a workflow specification.

Retrieves the definition of a Workflow Automation action by action ID. The definition includes resolved input and output schemas and action-specific instructions for building a workflow step.

Retrieves the JSON schema for a complete Workflow Automation specification, including the structure required for triggers, steps, and connections. Use this tool before constructing a specification to create, validate, or update a workflow.

Checks a complete workflow specification without creating or modifying a workflow. Returns an isValid result and any validation errors. Validation does not verify external credentials, permissions, or third-party runtime behavior.

Creates an unpublished Workflow Automation workflow from a complete specification.

Updates a Workflow Automation workflow by ID. Provided specifications and tag lists replace the existing values, while omitted fields remain unchanged. Specification updates are saved as drafts.

Publishes a workflow by ID. If a saved draft exists, it replaces the base specification and is removed. Otherwise, the existing unpublished base specification is published.

Unpublishes a workflow by ID to stop new automatic executions while preserving its base specification and any saved draft. This does not cancel executions already in progress; use cancel_datadog_workflow_instance for those.

Permanently deletes a workflow by ID. This tool requires explicit user confirmation and confirm: true before deleting the workflow.

Starts a new execution of a workflow that has an agent trigger. Runs the saved draft when one exists, otherwise the base specification.

Lists a workflow's execution history, with filters for execution status. Use get_datadog_workflow_instance for details.

Retrieves a lightweight summary of a workflow execution instance, with an option to include the detailed execution record. Use get_datadog_workflow_step_data to inspect one step.

Retrieves execution data for one workflow step, with optional execution context.

Cancels a running workflow execution instance. Invoke this tool only when the user intends to stop the run. A canceled execution cannot be resumed, but execute_datadog_workflow can start a new run.