Incident Management

The Bottom Line - Keep Everything from Declaration to Retrospective on One Screen, and Pay per Person

Events and alerts are records of what happened to the system; an incident is a record of how people responded. Datadog Incident Management takes on the latter, keeping on a single screen everything from the time the outage was declared through who commanded, what was decided, when it settled, and what was learned. No installation is required to adopt it; it is usable from the moment you declare an incident (as of September 2026; source: Incident Management). Because it lives in the same place as monitors and dashboards, you can paste the graph you were looking at during the response straight into the record, and later reconstruct which graph you looked at when you made a decision. Pricing is determined not by the number of monitored hosts but by the number of people who edit the record, in other words the number of seats. Below we walk through, in order, how states progress, the fields filled in at declaration, the entry points for declaring, how the record accumulates, the division of labor with On-Call, how seats are counted, and how to run retrospectives.

States Progress in Three Stages: Active / Stable / Resolved

An incident has three states by default, and their meanings are defined in the official documentation. Active is the state in which others are being affected, Stable is the state in which the impact has stopped but the investigation is not finished, and Resolved is the state in which the impact has stopped and the investigation is also complete. You can add a state called Completed in the settings, and the description text for each state can be customized (as of September 2026; source: Describe an Incident). The key point is the separation of Active and Stable. Because you can name the intermediate state of no longer causing impact but the cause is not yet known, the split in which reporting to executives settles down once at Stable while the technical side continues investigating toward Resolved holds up in the record.

What You Fill In at Declaration Is Title, Severity, and Commander

The declaration modal has three central fields: the title (required), the severity (required), and the Incident Commander who leads the response. Severity has five levels by default, from SEV-1 (most severe) to SEV-5 (least severe), and the number of levels and their descriptions can be changed in the settings. The declaration fields can be extended in the settings, and items such as state, impact, root cause, detection method, and affected services can be updated later. You can define and use your own responder roles to organize the response team (as of September 2026; source: Declare an Incident and Incident Management). Since the severity description text is something the organization decides, here we show only the skeleton for deciding it.

Deciding just one rule for when you are unsure about severity makes declaration faster. A rule that assumes you can lower it later, such as when in doubt, declare one level higher and lower it at the point you move to Stable.

Where Can You Declare From?

There is more than one entry point for declaring. The official documentation lists declaration from the incident list screen, monitors, security signals, leaked secrets, cases, graphs, Synthetic tests, the Datadog clipboard, On-Call pages, Slack, Google Chat, and handoff notifications (as of September 2026; source: Declare an Incident). The two used most often in practice are monitors and Slack.

The reason there are so many entry points is that a delay in declaring translates directly into a gap in the record. With a we will register it formally later approach, the decisions of the first 30 minutes are not preserved. Automatic declaration from monitors is a means of having the machine fill in those 30 minutes. However, attaching automatic declaration to every monitor buries the record in noise, so limiting it to monitors that merit high severity is the sensible course.

The Timeline and Slack Gather the Record in One Place

The body of the record is the timeline. Comments, graphs, and links are stacked with timestamps, and changes to state and severity are also preserved here. When you declare from Slack, a dedicated incident channel is created, and messages in that channel are synchronized to the timeline. Notifications to stakeholders can be configured, so you can keep interested parties informed of the progress of the response (as of September 2026; source: Incident Management and Declare an Incident).

What matters here is that you do not have to give up Slack. The conversation of the response stays in Slack, and the authoritative record lives on the incident timeline. With these two layers, the work of scrolling up and down Slack the next day to trace who decided what disappears.

On-Call Pages, Incident Management Records and Closes

On-Call and Incident Management sit on the same Incident Response branch and are divided by role. On-Call is the feature that decides which on-duty person to page right now and delivers the page; Incident Management is the feature that preserves what happened after the page and how it was closed. The touchpoints run in both directions: you can escalate an On-Call page to an incident, and you can page a team manually or automatically from within an incident (as of September 2026; source: Incident Management).

Either one works on its own. An organization whose paging already runs on existing tools and is missing only the record can start with Incident Management; conversely, an organization whose record is adequately kept in Slack and spreadsheets but whose night-time paging is manual will naturally start with On-Call. If you use both, the bundled SKU in the next section comes into play.

Pricing Is per Seat - Count Only the People Who Edit the Record

The official documentation enumerates which operations require a seat and which do not. This distinction is the same whether in the Datadog UI or through the Slack or Microsoft Teams integration (as of September 2026; source: Incident Response Billing).

Reading it takes one line. If the same person both receives pages and edits the record, the bundle that includes both comes in lower than adding the two standalone SKUs, and people who do only one of the two get the corresponding standalone SKU. For where this sits within the overall pricing, see how to read the pricing structure. This article explains how billing works. For current unit prices and plans, refer to Datadog's official pricing page.

The Minimum Rules for Running Retrospectives

A postmortem is a structured document of what happened, why it happened, and what will be done to prevent recurrence. After Resolved, when you select a template on the Post-Incident tab and generate one, the incident data is poured in and a document is created in the configured destination such as Notebooks or Confluence and linked to the incident (as of September 2026; source: Postmortems). Generation is a single operation, but whether retrospectives actually run is determined by the rules before and after it.

The second one is the most effective. The quality of a postmortem is determined not by writing skill but by the number of decision lines left during the response. If your organization operates SLOs, you can also prioritize retrospectives starting from the outages that consumed the most error budget. Whereas Error Tracking tracks bundles of the same error, what Incident Management tracks is the human response to a single outage. Read them apart: the cause side is Error Tracking, and the decision side is the incident timeline.