# Automate Datadog Monitoring Operations

Manual Datadog investigations and configuration changes consume operational time. This skill guides metrics, logs, monitors, dashboards, events, downtimes, hosts, and traces through Rube MCP.

## Install

```bash
npx skillstore add sickn33/datadog-automation
```

## Metadata

- Status: approved
- Slug: sickn33-datadog-automation
- Skillstore revision: r2
- Version status: missing
- Tree hash: 98d02e04e576a6454dbec806cc2bac6df1fda26fb685947e966c837b39c9681b
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/datadog-automation
- Ref: f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network
- Quality score: 50
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/sickn33-datadog-automation
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-datadog-automation/manifest

## Capabilities

- Query metrics and list metric names with tool-specific parameter guidance.
- Search retained Datadog logs and list log indexes with time, sort, and pagination guidance.
- List, inspect, create, update, mute, and unmute monitors.
- List, inspect, update, and delete dashboards using current MCP tool schemas.
- Create Datadog events and maintenance downtimes with scoped tags and timestamps.
- List reporting hosts and retrieve distributed traces by identifier.

## Use Cases

- Investigate Production Incidents: Correlate service metrics, error logs, hosts, and traces within a defined incident window.
- Maintain Alerting: Inspect monitor settings, prepare threshold changes, and schedule bounded maintenance downtimes.
- Administer Observability Assets: Review dashboards, publish deployment events, and inventory reporting hosts across environments.

## Prompt Templates

### Query Host CPU

```
Search current Datadog tools, then query average CPU usage for {host} from {start_time} to {end_time}. Summarize peaks, averages, and data gaps.
```

### Investigate Service Errors

```
Investigate {service} errors between {start_time} and {end_time}. Search current tools, query relevant metrics and logs, then summarize likely causes with evidence.
```

### Prepare Maintenance Downtime

```
Draft a Datadog downtime for {scope} from {start_time} to {end_time}. Show affected monitors and request explicit confirmation before creating it.
```

### Correlate an Incident

```
Analyze incident {incident_id} across {services}. Correlate metrics, logs, monitor states, hosts, and trace {trace_id}; rank hypotheses and identify missing evidence.
```

## Limitations

- Requires Rube MCP and an active, authenticated Datadog connection.
- Tool schemas and available operations can change, so each workflow must search current tools first.
- Results depend on Datadog permissions, retention windows, data availability, and rate limits.
- The source workflow lacks mandatory approval and rollback controls for state-changing operations.

## Best Practices

- Search current Rube tool schemas before selecting tools or parameters.
- Use narrow time windows, explicit tag scopes, bounded result limits, and pagination.
- Require explicit confirmation before mutations, especially monitor muting, downtimes, dashboard changes, and deletions.

## Anti Patterns

- Do not assume documented tool names or parameter schemas remain current.
- Do not create broad or indefinite downtimes, mute monitors, or delete dashboards without approval.
- Do not expose sensitive log, trace, host, or monitor data beyond the requested scope.

## Security Audit

- Audited at: 2026-07-23T22:48:47.914\+00:00
- Summary: All 80 shell-backtick findings and eight reconnaissance findings are false positives caused by Markdown formatting, Datadog identifiers, and query examples. The Rube MCP URL is a confirmed low-severity external dependency. Semantic review found missing confirmation controls for alert suppression and irreversible dashboard deletion.

## Stats

- Views: 97
- Downloads: 10
- Favorites: 0
- Popularity score: 0