diff --git a/config/_default/menus/main.en.yaml b/config/_default/menus/main.en.yaml index b69163e197f3e..4979abb948626 100644 --- a/config/_default/menus/main.en.yaml +++ b/config/_default/menus/main.en.yaml @@ -2651,26 +2651,31 @@ menu: identifier: event_explorer_saved_views parent: events_explorer weight: 308 + - name: Triage Inbox + identifier: event_triage_inbox + url: service_management/events/triage_inbox + parent: events + weight: 4 - name: Correlation url: service_management/events/correlation/ identifier: event_correlation parent: events - weight: 4 + weight: 5 - name: Configuration url: service_management/events/correlation/configuration identifier: event_correlation_configure parent: event_correlation - weight: 401 + weight: 501 - name: Triaging & Notifying url: service_management/events/correlation/triage_and_notify identifier: event_correlation_triage_and_notify parent: event_correlation - weight: 402 + weight: 502 - name: Analytics url: service_management/events/correlation/analytics identifier: event_correlation_analytics parent: event_correlation - weight: 403 + weight: 503 - name: Guides url: service_management/events/guides/ identifier: events_guides diff --git a/content/en/service_management/events/_index.md b/content/en/service_management/events/_index.md index 1ca4aa795f921..610380608cf41 100644 --- a/content/en/service_management/events/_index.md +++ b/content/en/service_management/events/_index.md @@ -31,7 +31,7 @@ further_reading: Ingest, enrich and normalize, and correlate your events from any source into actionable insights. Datadog automatically creates events from various products including monitors, Watchdog, and Error Tracking. You can also track events generated from the Agent and installed integrations. Event Management can also ingest events from any source, including alert events from third parties, change requests, deployments, configuration changes. -More than 100 Datadog integrations support events collection, including [Kubernetes][1], [Docker][2], [Jenkins][3], [Chef][4], [Puppet][5], [Amazon ECS][6] or [Autoscaling][7], [Sentry][8], and [Nagios][9]. +More than 100 Datadog integrations support events collection, including [Kubernetes][1], [Docker][2], [Jenkins][3], [Chef][4], [Puppet][5], [Amazon ECS][6] or [Autoscaling][7], [Sentry][8], and [Nagios][9]. **Tip**: To open the Event Management page from Datadog's global search, press Cmd/Ctrl + K and search for `event explorer`. @@ -41,6 +41,7 @@ More than 100 Datadog integrations support events collection, including [Kuberne {{< whatsnext desc="Event Management features:">}} {{< nextlink href="/service_management/events/ingest/" >}}Ingest events - Learn how to send events to Datadog{{< /nextlink >}} + {{< nextlink href="/service_management/events/triage_inbox" >}}Triage Inbox - Triage, investigate, collaborate, and resolve incidents{{< /nextlink >}} {{< nextlink href="/service_management/events/pipelines_and_processors/">}}Pipelines and Processors - Enrich and Normalize your events{{< /nextlink >}} {{< nextlink href="/service_management/events/explorer/" >}}Events Explorer - View, search and send notifications from events coming into Datadog{{< /nextlink >}} {{< nextlink href="/service_management/events/guides/usage/" >}}Using events - Analyze, investigate, and monitor events {{< /nextlink >}} diff --git a/content/en/service_management/events/triage_inbox.md b/content/en/service_management/events/triage_inbox.md new file mode 100644 index 0000000000000..062d53f147df8 --- /dev/null +++ b/content/en/service_management/events/triage_inbox.md @@ -0,0 +1,66 @@ +--- +title: Event Management Triage Inbox +further_reading: +- link: "/service_management/events/ingest//" + tag: "doc" + text: "Send events to Datadog" +- link: "/service_management/events/correlation/" + tag: "doc" + text: "Learn more about event correlation" +- link: "https://www.datadoghq.com/blog/datadog-event-management/" + tag: "Blog" + text: "Aggregate, correlate, and act on alerts faster with AIOps-powered Event Management" +--- + +## Overview + +Datadog Event Management [Triage Inbox][4] simplifies incident response by consolidating related events from any source into actionable cases. This centralized view reduces noise and helps teams triage, investigate, and collaborate more effectively. With customizable saved views, you can stay focused on high-priority cases and review correlated alerts, related changes, and telemetry, all in one place. + +## Triaging and investigating cases + +Case triage and investigation begins in the Triage Inbox, where you can sort, filter, and manage incoming cases. Collaborate with teammates, both within and outside of Datadog, to coordinate responses. From there, you can prioritize, assign, investigate, and escalate cases as needed to drive faster resolution. + +{{< img src="/service_management/events/triage_inbox/event_mgmt_inbox.mp4" alt="Event Management Inbox, sorting by priority, highlighting changing status and priority capabilities" video=true >}} + +## Getting Started + +1. Navigate to [**Service Management** > **Event Management** > **Triage Inbox**][4]. +2. Select a project from the left-hand panel to display out-of-the-box status views such as **Open**, **In Progress**, **Closed**, and **Archived**. +3. Use the display settings icon to choose between **split view** (for detailed case investigation) or **table view** (for bulk case review and column configuration). Customize your inbox ranking with the **Sort By** dropdown-options include **Priority**, **Created at**, or **Last Updated**. Click **Save** to re-use your customized inbox for future use. +5. Update the status, priority, and assignment directly on case cards during triage. +6. Maximize screen space by collapsing the left-hand case project panel and the Datadog navigation bar. +7. Hover over the case card **alert** count to preview correlated alerts. + +## Next Steps + +Now that you've learned how to triage and investigate cases, use these tools to [collaborate](#collaborate-and-integrate) with your team, [take action](#take-action) on root causes, and streamline response efforts. + +## Collaborate and Integrate + +On the right hand split-view side panel, you can perform the following: + +- **Tag and comment**: Collaborate with teammates in the case timeline by tagging users and adding notes. +- **Send notifications**: Alert stakeholders with Slack, Microsoft Teams, email, or webhooks. +- **Escalate issues**: Trigger an incident or page an on-call responder using [Incident Management][1], [On-Call][2], [Workflow Automation][3], or third-party tools. +- **Sync with external tools**: Keep Jira and ServiceNow records in sync to ensure external stakeholders stay up to date. + + {{< img src="/service_management/events/triage_inbox/event_mgmt_inbox_right_hand_panel.png" alt="Event Management Inbox right hand panel, highlighting Escalate drop down" style="width:100%;" >}} + +## Take Action + +- **Mark root cause**: Identify and mark a related event, such as a faulty change, as the root cause. +- **Run workflows**: Execute remediation runbooks manually or trigger them conditionally with [Case Automation Rules][5]. +- **Merge cases**: Combine related cases to streamline investigations. +- **Split cases**: Separate alerts that require individual investigation. + +**Note**: When all alerts in a case are resolved, the system automatically closes the case. You can also manually mark a case as resolved. + +## Further Reading + +{{< partial name="whats-next/whats-next.html" >}} + +[1]: /service_management/incident_management/ +[2]: /service_management/on-call/ +[3]: /actions/workflows/ +[4]: https://app.datadoghq.com/event/correlation +[5]: /service_management/case_management/automation_rules/ \ No newline at end of file diff --git a/static/images/service_management/events/triage_inbox/event_mgmt_inbox.mp4 b/static/images/service_management/events/triage_inbox/event_mgmt_inbox.mp4 new file mode 100644 index 0000000000000..66ec093e65df2 Binary files /dev/null and b/static/images/service_management/events/triage_inbox/event_mgmt_inbox.mp4 differ diff --git a/static/images/service_management/events/triage_inbox/event_mgmt_inbox_right_hand_panel.png b/static/images/service_management/events/triage_inbox/event_mgmt_inbox_right_hand_panel.png new file mode 100644 index 0000000000000..b71658f81016d Binary files /dev/null and b/static/images/service_management/events/triage_inbox/event_mgmt_inbox_right_hand_panel.png differ