Introducing Datadog Agent Builder: Build agentic workflows for alert response and remediation

Building automated workflows that adapt to real-world complexity can be a challenge. As systems scale and scenarios multiply, teams often end up hardcoding endless logic branches just to handle every potential outcome.

That’s why we’re introducing Datadog Agent Builder, a powerful new tool that lets you create custom AI agents that are fully hosted by Datadog. These agents can analyze data, reason through complex decisions, and adapt to changing inputs in real time, all without requiring you to hardcode every possible path. With AI-driven orchestration, Datadog Workflow Automation can now power automations that think, react, and scale as intelligently as your systems do.

In this blog post, we will cover the following topics:

• What is Agent Builder?
• What types of workflows can you automate with Agent Builder?

What is Agent Builder?

Datadog Agent Builder lets you define AI agents that can interpret Datadog observability data and third-party signals—such as which service is affected, what metrics are spiking, or whether similar incidents have occurred—and then take action either automatically through a workflow or on demand through chat. You can describe an agent’s goals in natural language, include relevant prompts, and control which data sources and tools it can access. This makes it possible to design agents that reflect the specific architecture, technology stack, and operational patterns of your environment.

Workflows can also chain multiple agents together or trigger agents conditionally based on the situation. For example, an investigation agent might analyze logs and traces to identify a likely root cause, then trigger a remediation agent if the suggested fix matches a known pattern—such as restarting a service, rolling back a deployment, or scaling a resource. These chains allow different agents to specialize in distinct steps of an operational process while maintaining end-to-end automation and control. By orchestrating agents this way, teams can build workflows that reason, act, and adapt in real time, without sacrificing the structure and safety of traditional automation.

What types of workflows can be automated with Agent Builder?

Teams can use Agent Builder to make smarter, faster decisions that draw upon the full range of Datadog’s observability data. A key feature of custom agents built with Agent Builder is that they have access to the 2,000+ prebuilt, production-ready actions from Datadog’s Action Catalog. As shown in the image below, these actions connect to external services such as Kubernetes, cloud services, CI/CD platforms, security tools, and more.

Thanks to these built-in integrations with third-party services, you can automate virtually any task without requiring custom code or external integrations. And since your agents run natively in Datadog, your data, logic, and actions all live in one place with no context lost.

To see what this looks like in practice, let’s explore some ways you can use Agent Builder to automate complex workflows.

Automate application error investigations

Consider an agent created with Agent Builder to automate the investigation of application errors. This investigator agent runs automatically when a Customer Success Manager or Support Engineer posts a Slack message such as “User reports the app crashed” about a bug. Once triggered, the agent runs a predefined playbook that pulls evidence only from trusted Datadog sources—such as logs, APM, and RUM—to ensure consistent, high-quality investigations. Following the playbook, the agent first searches recent application logs for related errors or warnings, and then checks RUM data to see if any users have experienced similar frontend issues or performance slowdowns. As it collects data, it follows strict standards: Every log or trace is hyperlinked, assumptions are clearly marked, and if nothing is found, it states that clearly.

Finally, the agent compiles a structured report—summarizing findings, linking to evidence, and suggesting possible root causes—and posts it back into Slack. By the time engineers pick up the issue, they already have a data-backed investigation that meets company best practices, powered entirely by Datadog’s observability data and AI-driven automation.

Detect and respond to a critical vulnerability

In a second example, imagine how a custom agent could be used to automate a response when critical vulnerabilities are detected. Let’s say that Datadog Cloud Security detects several EC2 instances running a vulnerable version of OpenSSL that is affected by a newly disclosed critical CVE, such as CVE-2023-0464. The agent starts by creating a Datadog case, consolidating all relevant details (such as instance IDs, AWS account information, and whether the hosts are internet-facing) to give the security team immediate visibility into the blast radius.

Once the vulnerability is confirmed as high-risk, the agent steps in to contain the threat. It can generate a Github PR to update the OpenSSL version or quarantine the affected EC2 instances by using AWS Systems Manager. It can then notify the responsible engineering team through Slack, Datadog On-Call, or PagerDuty. Every remediation action is logged back into the Datadog case, creating a complete audit trail. This automated, end-to-end response pipeline helps teams move from detection to remediation in minutes, significantly reducing exposure time and strengthening their overall cloud security posture.

Automate service documentation with IDP Scorecards

Scorecards in Datadog’s Internal Developer Portal (IDP) help teams measure and enforce operational and engineering standards across their services in areas like deployment readiness, observability coverage, or documentation completeness.

In this use case, a scorecard is configured to assess whether each service repository includes a README.md file. During the scorecard evaluation, if the check detects that a service is missing a README, it triggers a custom Datadog agent. This agent uses metadata from the Service Catalog (like team name, dependencies, and runtime environment) and pulls key context from telemetry data and existing dashboards to auto-generate an initial README draft. It can include sections like “Service Overview,” “Dependencies,” and “Runbook Links,” and then open a pull request in GitHub for the owning team to review and finalize.

By combining Scorecards with automation, teams can close documentation gaps automatically—evaluating, creating, and updating service standards with minimal manual work.

Try Agent Builder in Preview

With Agent Builder, engineers can create and manage purpose-built agents in minutes, accelerating how teams investigate issues and trigger actions across their environments.

Agent Builder is available now in Preview. You can sign up for early access by navigating to Actions -> Agents in your Datadog account.

If you don’t already have a Datadog account, get started with a 14-day free trial today.