Skip to main content
Deploy this agent when your telemetry is in Datadog and you want an incident traced without someone pivoting through dashboards by hand. It works the way an experienced responder does — aggregate first, pivot to the bad slice, then read one trace in detail. This page covers what it reaches, what to connect first, and where it stops.

​
What it does

You give it an incident description and the questions you want answered. It runs the aggregate → pivot → trace flow to localise a regression: narrowing on the failing slice, reading the flame graph of one bad trace within it, correlating against deploys and downstream services, and returning structured findings. Every finding carries a Datadog permalink, so the claim and the evidence stay together when the report is read by someone who was not on the run.

​
What it reads

All of it read-only.

​
Before you deploy

An account can hold several Datadog connections. Provider presence alone does not identify the organization or environment you meant, so select the specific connection this agent should use rather than assuming the only active one is the right one.

​
Ask it for

In chat, or as a run’s prompt:
When a workflow drives it instead of a person, it takes a structured envelope:

​
Defaults and limits

The time budget degrades rather than fails. At 70% the agent is nudged to converge; at 100% further tool calls are refused and it reports what it has, so a long investigation returns a partial report rather than nothing.

​
In a workflow

This is a specialist, not a lead. In an incident workflow it takes a scoped sub-task from an orchestrator, investigates the Datadog slice, and hands findings back to be synthesized with other specialists’ work. It is also a natural verification step: the same agent that localised a regression can be asked afterwards whether the signal recovered. See Orchestration for how a step delivers work to it, and Incidents for the module that drives it.

​
What it will not do

It never writes to Datadog. It cannot mute a monitor, close an incident, edit a dashboard or acknowledge an alert — it reads telemetry and reports what it found. It is also bounded by what Datadog holds. If the relevant span was sampled away or the log retention window has passed, the agent reports that it could not verify the step rather than filling the gap by inference.

​
Next steps

Use specialized agents

Browse the catalog and walk the deploy wizard.

Integration groups

Scope the gateway tools this agent is given.

Grafana Investigator

The same investigation shape, over Grafana telemetry.

Agent catalog

Every catalog agent, side by side.