Rootly Datadog Integration: Alerts, Paging and Incidents

Rootly integrates with Datadog in both directions. Datadog monitor alerts reach Rootly through a webhook, where they can page the on-call engineer, open an incident or post to a Slack channel. During the incident, Rootly workflows pull Datadog graph snapshots and dashboards into the incident record and can create a Datadog notebook for the investigation. Setup takes a Datadog API key, an application key with dashboard read access, and one webhook. The integration is documented in full in the Rootly Datadog docs.

Setup docs: step-by-step installation, the full configuration reference and troubleshooting are in the Rootly Datadog integration docs.

Datadog tells you something is wrong. Rootly runs what happens next: who gets paged, which channel the team works in, what stakeholders hear, and which follow-up work gets tracked. If you are weighing Datadog’s own incident product against a dedicated platform, see Datadog vs PagerDuty vs Rootly.

What the Rootly Datadog integration does

Capability	What happens
Alert ingestion	Datadog monitors send alerts to Rootly through a webhook. Each alert appears on Rootly’s Alerts page with its Datadog fields.
On-call paging	An alert can page a user, a team, an escalation policy or a service directly, chosen in the webhook payload.
Alert workflows	Rules on alert fields such as alert_priority, alert_status or alert_title decide whether to create an incident, page on-call, send a Slack message, or send SMS or email.
Graph snapshots	A workflow action captures a point-in-time Datadog graph for a metric query and attaches it to the incident.
Dashboards	A workflow action fetches a Datadog dashboard and puts its link on the incident timeline.
Notebooks	A workflow action creates a Datadog notebook named after the incident, for investigation notes in Datadog.

Connect Datadog to Rootly

1. In Rootly, open Settings → Integrations, search for Datadog and click Setup. Use a service account, so the integration keeps working if the person who installed it leaves.
2. In Datadog, create an API key under Organization Settings → API Keys. Copy the key value, which Datadog shows only once.
3. In Datadog, create an application key under Personal Settings → Security → Application Keys with Read permission for Dashboards. Rootly needs only the dashboard_read scope.
4. Back in Rootly, enter your Datadog API host (for example api.datadoghq.com for US1 or api.eu.datadoghq.com for EU), the API key and the application key, then click Connect.

Send Datadog alerts to Rootly

Alerts travel over Datadog’s Webhooks integration. Create a webhook in Datadog that points at Rootly, add Rootly’s webhook secret as a custom header, and reference the webhook from any monitor.

https://webhooks.rootly.com/webhooks/incoming/datadog_webhooks

To page someone straight from the alert, add a notification_target object to the webhook payload. The type is User, Group, EscalationPolicy or Service, and the id is the Rootly resource’s ID.

{
  "id": "$ID",
  "title": "$EVENT_TITLE",
  "body": "$EVENT_MSG",
  "alert_id": "$ALERT_ID",
  "alert_priority": "$ALERT_PRIORITY",
  "alert_status": "$ALERT_STATUS",
  "alert_transition": "$ALERT_TRANSITION",
  "date": "$DATE",
  "rootly": {
    "notification_target": {
      "type": "EscalationPolicy",
      "id": "<ESCALATION_POLICY_ID>"
    }
  }
}

Leave the rootly object out for alerts that should be recorded without paging anyone. The full payload, with every Datadog variable, is in the docs.

Then add the webhook to a monitor’s notification message as @webhook-<WEBHOOK_NAME>, click Test Notifications, and check that the alert appears in Rootly. One webhook can serve as many monitors as you like.

By default Rootly pages for Datadog alerts in the CRITICAL state, so warnings are recorded without waking anyone. Keep it that way unless a warning needs someone to act right now. To do something with warnings, add an alert workflow that matches alert_status for warnings and routes them quietly, for example to a low-urgency route or a Slack channel, rather than to a page.

Turn Datadog alerts into incidents automatically

Alert workflows react when an alert is created or when its status changes. Scope a workflow to Datadog with the condition Source is Datadog, then filter on payload fields. Common patterns:

• Create an incident when a monitor with alert_priority P1 fires.
• Page the owning team’s escalation policy for P1 and P2 alerts.
• Post to a Slack channel when a monitor transitions to ALERT.
• Resolve the Rootly alert when Datadog sends the RECOVERY transition.

Actions chain, so one workflow can create the incident, page the team and post the incident channel link in a single run. Workflow run logs under Workflows → History show what each run did.

Bring Datadog context into the incident

Responders should not have to paste screenshots into the channel. Three Datadog workflow actions run when an incident starts or changes status:

• Get Datadog Graph Snapshot takes a metric query, such as avg:system.cpu.user scoped to the affected service, and attaches the graph to the incident.
• Get Datadog Dashboard takes a dashboard ID and puts the dashboard link on the incident timeline.
• Create Datadog Notebook opens a notebook named after the incident, using any incident variable in the name.

These run alongside Rootly’s other actions, so the same workflow can open a Zoom bridge, create a Jira ticket and assign the incident commander.

How teams run Datadog with Rootly

Most teams keep Datadog for detection and use Rootly for everything after the alert. A typical setup sends every production monitor to one Datadog webhook, uses alert workflows to page by service and priority, and attaches the triggering graph to every SEV1 and SEV2. The result is one process for every alert source: alerts from Grafana, Sentry or CloudWatch follow the same routing, paging and incident flow as Datadog’s.

Rootly runs incidents natively in Slack, Microsoft Teams and Google Chat. The Datadog integration is included on every Rootly plan; see pricing. For the other integrations a team usually connects alongside it, see must-have integrations for incident management software.

Ready to connect it? Follow the Datadog setup guide on docs.rootly.com.