Skip to content

[DOCS-10343] Event Management Inbox #30836

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 33 additions & 28 deletions config/_default/menus/main.en.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -100,146 +100,151 @@ menu:
url: getting_started/devsecops
parent: getting_started
weight: 10
- name: Event Management
identifier: getting_started_event_mgmt
url: getting_started/event_management
parent: getting_started
weight: 11
- name: Incident Management
identifier: getting_started_incident_management
url: getting_started/incident_management/
parent: getting_started
weight: 11
weight: 12
- name: Integrations
identifier: getting_started_integrations
url: getting_started/integrations/
parent: getting_started
weight: 12
weight: 13
- name: AWS
identifier: getting_started_with_aws
url: getting_started/integrations/aws/
weight: 1201
weight: 1301
parent: getting_started_integrations
- name: Azure
identifier: getting_started_with_azure
url: getting_started/integrations/azure/
weight: 1202
weight: 1302
parent: getting_started_integrations
- name: Google Cloud
identifier: getting_started_with_google_cloud
url: getting_started/integrations/google_cloud/
weight: 1203
weight: 1303
parent: getting_started_integrations
- name: Terraform
identifier: getting_started_with_terraform
url: getting_started/integrations/terraform/
weight: 1204
weight: 1304
parent: getting_started_integrations
- name: Internal Developer Portal
identifier: getting_started_internal_developer_portal
url: getting_started/internal_developer_portal/
parent: getting_started
weight: 13
weight: 14
- name: Logs
identifier: getting_started_logs
url: getting_started/logs/
parent: getting_started
weight: 14
weight: 15
- name: Monitors
identifier: getting_started_monitors
url: getting_started/monitors/
parent: getting_started
weight: 15
weight: 16
- name: OpenTelemetry
identifier: getting_started_opentelemetry
url: getting_started/opentelemetry/
parent: getting_started
weight: 16
weight: 17
- name: Profiler
identifier: getting_started_profiler
url: getting_started/profiler/
parent: getting_started
weight: 17
weight: 18
- name: Session Replay
identifier: getting_started_session_replay
url: getting_started/session_replay/
parent: getting_started
weight: 18
weight: 19
- name: Security
identifier: getting_started_security
url: getting_started/security/
parent: getting_started
weight: 19
weight: 20
- name: App and API Protection
identifier: getting_started_application_security
url: getting_started/security/application_security
parent: getting_started_security
weight: 1901
weight: 2001
- name: Cloud Security
identifier: getting_started_cloud_security_management
url: getting_started/security/cloud_security_management/
parent: getting_started_security
weight: 1902
weight: 2002
- name: Cloud SIEM
identifier: getting_started_cloud_siem
url: getting_started/security/cloud_siem/
parent: getting_started_security
weight: 1903
weight: 2003
- name: Code Security
identifier: getting_started_code_security
url: getting_started/code_security/
parent: getting_started_security
weight: 1904
weight: 2004
- name: Serverless for AWS Lambda
identifier: getting_started_serverless
url: getting_started/serverless/
parent: getting_started
weight: 20
weight: 21
- name: Software Delivery
identifier: getting_started_software_delivery
url: getting_started/software_delivery/
parent: getting_started
weight: 21
weight: 22
- name: CI Visibility
identifier: getting_started_ci_visibility
url: getting_started/ci_visibility/
parent: getting_started_software_delivery
weight: 2101
weight: 2201
- name: Test Optimization
identifier: getting_started_test_optimization
url: getting_started/test_optimization/
parent: getting_started_software_delivery
weight: 2102
weight: 2202
- name: Test Impact Analysis
identifier: getting_started_test_impact_analysis
url: getting_started/test_impact_analysis/
parent: getting_started_software_delivery
weight: 2103
weight: 2203
- name: Synthetic Monitoring and Testing
identifier: getting_started_synthetics
url: getting_started/synthetics/
parent: getting_started
weight: 22
weight: 23
- name: API Tests
identifier: getting_started_api_test
url: getting_started/synthetics/api_test
parent: getting_started_synthetics
weight: 2201
weight: 2301
- name: Browser Tests
identifier: getting_started_browser_test
url: getting_started/synthetics/browser_test
parent: getting_started_synthetics
weight: 2202
weight: 2302
- name: Mobile App Tests
identifier: getting_started_mobile_app
url: getting_started/synthetics/mobile_app_testing
parent: getting_started_synthetics
weight: 2203
weight: 2303
- name: Continuous Testing
identifier: getting_started_continuous_testing
url: getting_started/continuous_testing/
parent: getting_started_synthetics
weight: 2204
weight: 2304
- name: Private Locations
identifier: getting_started_private_location
url: getting_started/synthetics/private_location
parent: getting_started_synthetics
weight: 2205
weight: 2305
- name: Tags
identifier: tagging_
url: getting_started/tagging/
Expand Down
66 changes: 66 additions & 0 deletions content/en/getting_started/event_management/_index.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
---
title: Getting Started with Event Management Inbox
further_reading:
- link: "/service_management/events/ingest//"
tag: "doc"
text: "Send events to Datadog"
- link: "/service_management/events/correlation/"
tag: "doc"
text: "Learn more about event correlation"
- link: "https://www.datadoghq.com/blog/datadog-event-management/"
tag: "Blog"
text: "Aggregate, correlate, and act on alerts faster with AIOps-powered Event Management"
---

## Overview

Datadog Event Management [Triage Inbox][4] simplifies incident response by consolidating related events from any source into actionable cases. This centralized view reduces noise and helps teams triage, investigate, and collaborate more effectively. With customizable saved views, you can stay focused on high-priority cases and review correlated alerts, related changes, and telemetry, all in one place.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it Event Management Inbox or Triage inbox?


## Case triage and investigation
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
## Case triage and investigation
## Triaging and investigating cases


Case triage and investigation begins in the Triage Inbox, where you can sort, filter, and manage incoming cases. Collaborate seamlessly with teammates, both within and outside of Datadog, to coordinate responses. From there, you can prioritize, assign, investigate, and escalate cases as needed to drive faster resolution.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Case triage and investigation begins in the Triage Inbox, where you can sort, filter, and manage incoming cases. Collaborate seamlessly with teammates, both within and outside of Datadog, to coordinate responses. From there, you can prioritize, assign, investigate, and escalate cases as needed to drive faster resolution.
Case triage and investigation begins in the Triage Inbox, where you can sort, filter, and manage incoming cases. Collaborate with teammates, both within and outside of Datadog, to coordinate responses. From there, you can prioritize, assign, investigate, and escalate cases as needed to drive faster resolution.


{{< img src="getting_started/event_management/event_mgmt_inbox.mp4" alt="Event Management Inbox, sorting by priority, highlighting changing status and priority capabilities" video=true >}}

## Getting Started

1. Navigate to [**Service Management** > **Event Management** > **Triage Inbox**][4].
2. Select a project from the left-hand panel to display out-of-the-box status views such as **Open**, **In Progress**, **Closed**, and **Archived**.
3. Use the display settings icon to choose between **split view** (for detailed case investigation) or **table view** (for bulk case review and column configuration). Customize your inbox ranking with the **Sort By** dropdown-options include **Priority**, **Created at**, or **Last Updated**. Click **Save** to re-use your customized inbox for future use.
5. Update the status, priority, and assignment directly on case cards during triage.
6. Maximize screen space by collapsing the left-hand case project panel and the Datadog navigation bar.
7. Hover over the case card **alert** count to preview correlated alerts.

## Next Steps

Now that you've learned how to triage and investigate cases, use these tools to [collaborate](#collaborate-and-integrate) with your team, [take action](#take-action) on root causes, and streamline response efforts.

## Collaborate and Integrate

On the right hand split-view side panel, you can perform the following:

- **Tag and comment**: Collaborate with teammates in the case timeline by tagging users and adding notes.
- **Send notifications**: Alert stakeholders with Slack, Microsoft Teams, email, or webhooks.
- **Escalate issues**: Trigger an incident or page an on-call responder using [Incident Management][1], [On-Call][2], [Workflow Automation][3], or third-party tools.
- **Sync with external tools**: Keep Jira and ServiceNow records in-sync to ensure external stakeholders stay up to date.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- **Sync with external tools**: Keep Jira and ServiceNow records in-sync to ensure external stakeholders stay up to date.
- **Sync with external tools**: Keep Jira and ServiceNow records in sync to ensure external stakeholders stay up to date.


{{< img src="getting_started/event_management/event_mgmt_inbox_right_hand_panel.png" alt="Event Management Inbox right hand panel, highlighting Escalate drop down" style="width:100%;" >}}

## Take Action

- **Mark root cause**: Identify and mark a related event, such as a faulty change, as the root cause.
- **Run workflows**: Execute remediation runbooks manually or trigger them conditionally with [Case Automation Workflows][5].
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be Case Automation Rules?

- **Merge cases**: Combine related cases to streamline investigations.
- **Split cases**: Separate alerts that require individual investigation.

**Note**: When all alerts in the case are resolved, the system automatically closes the case, or you can manually mark it as resolved.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
**Note**: When all alerts in the case are resolved, the system automatically closes the case, or you can manually mark it as resolved.
**Note**: When all alerts in a case are resolved, the system automatically closes the case. You can also manually mark a case as resolved.


## Further Reading

{{< partial name="whats-next/whats-next.html" >}}

[1]: https://docs.datadoghq.com/service_management/incident_management/
[2]: https://docs.datadoghq.com/service_management/on-call/
[3]: https://docs.datadoghq.com/actions/workflows/
[4]: https://app.datadoghq.com/event/correlation
[5]: /service_management/case_management/automation_rules/
1 change: 1 addition & 0 deletions content/en/service_management/events/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ More than 100 Datadog integrations support events collection, including [Kuberne

{{< whatsnext desc="Event Management features:">}}
{{< nextlink href="/service_management/events/ingest/" >}}<u>Ingest events</u> - Learn how to send events to Datadog{{< /nextlink >}}
{{< nextlink href="/getting_started/event_management" >}}<u>Event Management Inbox</u> - Getting Started with Event Management Inbox{{< /nextlink >}}
{{< nextlink href="/service_management/events/pipelines_and_processors/">}}<u>Pipelines and Processors</u> - Enrich and Normalize your events{{< /nextlink >}}
{{< nextlink href="/service_management/events/explorer/" >}}<u>Events Explorer</u> - View, search and send notifications from events coming into Datadog{{< /nextlink >}}
{{< nextlink href="/service_management/events/guides/usage/" >}}<u>Using events</u> - Analyze, investigate, and monitor events {{< /nextlink >}}
Expand Down
Binary file not shown.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading