GuidesIntegrations
Datadog
Create Runframe incidents automatically from Datadog monitors and alerts via webhooks.
Datadog
Create incidents automatically from Datadog monitors and alerts.
How it works
Datadog Monitor Alert → Webhook POST → Runframe → Incident CreatedDatadog fires a webhook when a monitor triggers. Runframe parses the payload, maps fields, and creates an incident routed to the correct service and team.
Setup from Runframe
- Navigate to Integrations Hub
- Click Set up webhook next to Datadog
- Copy the unique webhook URL (format:
https://api.runframe.io/webhooks/{routingKey}) - Link services to route Datadog alerts to specific Runframe services
Setup from Datadog
- In Datadog, navigate to Integrations > Webhooks
- Create a new webhook with your Runframe webhook URL
- Add the
service_idtag to your monitors (e.g.,service_id:SER-00001) - Customize the payload to include incident details
- Associate the webhook with your monitors
Field mapping
| Datadog field | Runframe field |
|---|---|
| Monitor name | Incident title |
| Monitor query | Description |
| Alert priority (P1-P5) | Severity (mapped to SEV0-SEV4) |
service_id tag | Routes to specific service |
| Alert snapshot | Link to Datadog dashboard |
Severity mapping
Configure how Datadog alert priorities map to Runframe severities:
| Datadog priority | Default Runframe severity |
|---|---|
| P1 | Critical (SEV0) |
| P2 | High (SEV1) |
| P3 | Medium (SEV2) |
| P4 | Low (SEV3) |
| P5 | Minimal (SEV4) |
Customize severity mapping
Adjust severity mapping per monitor based on your service's priorities. A "low" priority database alert might be P1 if the database is business-critical.
Deduplication
Datadog webhooks include a unique event ID. Runframe uses this to deduplicate — the same monitor alert won't create duplicate incidents.
Testing
Trigger a test alert from a Datadog monitor and verify:
- Runframe creates the incident
- Title, severity, and service routing are correct
- The right team is notified