ryanmaclean/dd-skill-test

Overview

This skill provides comprehensive Datadog operations for investigation, automation, incident response, and cost optimization. It covers queries across APM, logs, metrics, RUM, and databases, plus creation and management of monitors, dashboards, synthetics, incidents, and workflows. Use it to speed up debugging, automate repetitive tasks, and reduce Datadog spend.

How this skill works

The skill runs scripts that call Datadog APIs to fetch traces, logs, metrics, SLOs, Watchdog anomalies, RUM data, and service catalog metadata. It can create and update monitors, dashboards, synthetic tests, incidents, and trigger workflows. Built-in workflows guide incident investigation, security analysis, cost optimization, and LLM observability for GenAI apps.

When to use it

• Investigating production incidents and tracing slow endpoints
• Automating monitor and dashboard creation for new services
• Detecting security signals and analyzing attack patterns
• Running FinOps analyses to identify high-cost products and recommendations
• Monitoring frontend performance and user experience with RUM
• Observing LLM token usage, latency and cost for GenAI services

Best practices

• Set and export DD_API_KEY, DD_APP_KEY and DD_SITE before running scripts
• Start with targeted time windows and services to reduce noise and API load
• Mute non-critical monitors during maintenance or incident noise to avoid alert storms
• Use dashboards and SLO checks to validate changes after deployments
• Regularly run cost analysis and apply high-priority recommendations to control spend
• Integrate workflow triggers into automated remediation for fast incident containment

Example use cases

• Find top slow endpoints with P95 latency and generate an APM dashboard for the service
• Search logs for recent error patterns and retrieve related trace IDs for root-cause analysis
• Create a latency monitor and a synthetic uptime check when onboarding a new API
• Run a 30-day FinOps report to see APM, logs, and custom metric costs with optimization suggestions
• Trigger an incident and remediation workflow after an SLO breach, then mute noisy monitors
• Analyze LLM token usage and model latency to attribute costs and identify expensive operations