> ## Documentation Index
> Fetch the complete documentation index at: https://docs.komodor.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Datadog Investigator
> Localises a regression through Datadog traces, logs, metrics and monitors, and returns findings that link back to the permalink behind each one.
Deploy this agent when your telemetry is in Datadog and you want an incident traced without someone
pivoting through dashboards by hand. It works the way an experienced responder does — aggregate
first, pivot to the bad slice, then read one trace in detail. This page covers what it reaches,
what to connect first, and where it stops.
## What it does
You give it an incident description and the questions you want answered. It runs the aggregate →
pivot → trace flow to localise a regression: narrowing on the failing slice, reading the flame graph
of one bad trace within it, correlating against deploys and downstream services, and returning
structured findings.
Every finding carries a Datadog permalink, so the claim and the evidence stay together when the
report is read by someone who was not on the run.
## What it reads
All of it read-only.
| Source | What it uses it for |
| ---------------- | ------------------------------------------------------------------- |
| Traces and spans | Localising the failing slice, then the flame graph of one bad trace |
| Logs | The error text behind a failure, scoped to the slice |
| Metrics | Rates, latencies and saturation across the incident window |
| Monitors | What alerted, when it transitioned, and what it was watching |
| Events | Deploys and changes to correlate the regression against |
## Before you deploy
| Requirement | Detail | Where to set it up |
| ------------------ | ----------------------------------------------------------------- | ------------------------------------------------------------------------ |
| Model access | The managed model gateway, or your own Claude API key | [Credentials & secrets](/manage-your-agents/build/credentials-secrets) |
| Datadog connection | Read-only access to traces, logs, metrics, monitors and events | [Built-in integrations](/manage-your-agents/build/built-in-integrations) |
| MCP group | The agent reaches Datadog through a group-scoped gateway endpoint | [Integration groups](/manage-your-agents/build/integration-groups) |
An account can hold several Datadog connections. Provider presence alone does not identify the
organization or environment you meant, so select the specific connection this agent should use
rather than assuming the only active one is the right one.
## Ask it for
In chat, or as a run's prompt:
```text theme={null}
Checkout-api p99 latency tripled between 09:00 and 09:40 UTC. Find where the time is
going, whether it is us or a downstream dependency, and whether anything deployed in
that window. Link the traces you used.
```
When a workflow drives it instead of a person, it takes a structured envelope:
| Field | What it is |
| ---------------------- | --------------------------------------------------------------------- |
| `incident_description` | What is happening, in a sentence or two |
| `questions` | The specific questions to answer — the agent scopes its work to these |
| `affected_services` | Service names, to narrow the search |
| `investigation_start` | An ISO-8601 timestamp; it looks no further back |
| `context` | Enrichment already gathered — alerts, errors, deploys |
| `budget_seconds` | A shorter or longer wall-clock budget for this run |
## Defaults and limits
| | |
| ----------- | ---------------------------------------- |
| Catalog ID | `datadog-investigator` |
| Model | `claude-sonnet-4-6` |
| Time budget | 600 seconds, adjustable 120–1800 per run |
| Deployment | Komodor cloud or self-hosted |
| Chat | Yes |
The time budget degrades rather than fails. At 70% the agent is nudged to converge; at 100% further
tool calls are refused and it reports what it has, so a long investigation returns a partial report
rather than nothing.
## In a workflow
This is a specialist, not a lead. In an incident workflow it takes a scoped sub-task from an
orchestrator, investigates the Datadog slice, and hands findings back to be synthesized with other
specialists' work. It is also a natural verification step: the same agent that localised a
regression can be asked afterwards whether the signal recovered.
See [Orchestration](/manage-your-agents/run/orchestration) for how a step delivers work to it, and
[Incidents](/modules-and-workflows/sre/incidents) for the module that drives it.
## What it will not do
It never writes to Datadog. It cannot mute a monitor, close an incident, edit a dashboard or
acknowledge an alert — it reads telemetry and reports what it found.
It is also bounded by what Datadog holds. If the relevant span was sampled away or the log retention
window has passed, the agent reports that it could not verify the step rather than filling the gap
by inference.
## Next steps
Browse the catalog and walk the deploy wizard.
Scope the gateway tools this agent is given.
The same investigation shape, over Grafana telemetry.
Every catalog agent, side by side.
## Related topics
- [Grafana Investigator](/manage-your-agents/build/catalog/grafana-investigator.md)
- [Agent catalog](/manage-your-agents/build/catalog/overview.md)
- [Orchestration](/manage-your-agents/run/orchestration.md)
- [Azure Investigator](/manage-your-agents/build/catalog/azure-investigator.md)
- [Use specialized agents](/manage-your-agents/build/use-specialized-agents.md)