> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Datadog

> Connect Datadog to CloudThinker for log search, metric queries, infrastructure monitoring, and incident investigation

Connect your Datadog account to enable CloudThinker agents to search logs, query metrics, monitor infrastructure, and investigate incidents across your entire stack.

***

## Supported Platforms

| Platform        | Support                           |
| --------------- | --------------------------------- |
| **Datadog**     | All plans (Free, Pro, Enterprise) |
| **Datadog US1** | `app.datadoghq.com`               |
| **Datadog US3** | `us3.datadoghq.com`               |
| **Datadog US5** | `us5.datadoghq.com`               |
| **Datadog EU1** | `app.datadoghq.eu`                |
| **Datadog AP1** | `ap1.datadoghq.com`               |
| **Datadog AP2** | `ap2.datadoghq.com`               |

<Warning>
  GovCloud (US1-FED) is **not supported** by the Datadog MCP Server.
</Warning>

***

## Prerequisites

You need a **Datadog API Key** and an **Application Key** with appropriate scopes.

### Create an API Key

1. Go to **Organization Settings → API Keys** in your Datadog account
2. Click **+ New Key**
3. Name it (e.g., `CloudThinker`) and save
4. Copy the key value

### Create a Scoped Application Key

1. Go to **Organization Settings → Application Keys**
2. Click **+ New Key**
3. Name it (e.g., `CloudThinker`)
4. Under **Scopes**, select the permissions listed in [Required Permissions](#required-permissions) below
5. Save and copy the key value

<Tip>
  Always use scoped Application Keys instead of unscoped ones. This follows the principle of least privilege — the key can only access what CloudThinker needs.
</Tip>

***

## Setup

<Steps>
  <Step title="Open CloudThinker">
    Navigate to **Connections → Datadog** in your CloudThinker workspace.
  </Step>

  <Step title="Select your Datadog Site">
    Choose the Datadog site that matches your account (e.g., US1 for `datadoghq.com`, EU1 for `datadoghq.eu`).
  </Step>

  <Step title="Enter API Key">
    Paste your Datadog **API Key**.
  </Step>

  <Step title="Enter Application Key">
    Paste your Datadog **Application Key**.
  </Step>

  <Step title="Connect">
    Click **Connect**. CloudThinker will verify the credentials and show a **Connected** status.
  </Step>
</Steps>

***

## Required Permissions

When creating your Application Key, select these scopes to enable all CloudThinker tools:

### MCP

| Tool        | What it does                   | Requires                          |
| ----------- | ------------------------------ | --------------------------------- |
| `mcp_read`  | Read data via the MCP server.  | Read scopes (see below)           |
| `mcp_write` | Write data via the MCP server. | `notebooks_write` + user approval |

### Read Scopes (all read tools)

| Scope                                    | Enables                                                          |
| ---------------------------------------- | ---------------------------------------------------------------- |
| `logs_read_data`, `logs_read_index_data` | Search logs, analyze log patterns and trends                     |
| `metrics_read`                           | Search metrics, query time-series data, retrieve metric metadata |
| `timeseries_query`                       | Query metric time-series data                                    |
| `monitors_read`                          | Search monitors by status, name, or tag                          |
| `incidents_read`                         | Search incidents, get full incident details                      |
| `dashboards_read`                        | Search dashboard configurations                                  |
| `hosts_read`                             | List and inspect infrastructure hosts                            |
| `apm_read`                               | Retrieve distributed traces, search APM spans                    |
| `apm_service_catalog_read`               | List services, map service dependencies                          |
| `events_read`                            | Search platform and custom events                                |
| `notebooks_read`                         | Search and retrieve investigation notebooks                      |
| `rum_apps_read`                          | Search Real User Monitoring data                                 |

### Write Scopes (notebook creation and editing)

| Scope             | Enables                                 |
| ----------------- | --------------------------------------- |
| `notebooks_write` | Create and edit investigation notebooks |

<Info>
  The connection health check requires no additional scopes — it validates the connection itself.
</Info>

<Tip>
  If your Application Key is **unscoped** (no scopes selected), it inherits all permissions from the user who created it. For production use, we recommend always specifying explicit scopes.
</Tip>

***

## Agent Capabilities

Once connected, agents can perform **19 read operations** and **2 write operations** across your Datadog environment:

### Read Capabilities

| Category              | What the agent can do                                                                  |
| --------------------- | -------------------------------------------------------------------------------------- |
| **Logs**              | Search logs across services and environments, analyze log patterns and trends          |
| **Metrics**           | Search available metrics, query time-series data, retrieve metric metadata and context |
| **Monitors**          | Find monitors by status, name, or tag                                                  |
| **Incidents**         | Search active and resolved incidents, get full incident details                        |
| **Dashboards**        | Search and inspect dashboard configurations                                            |
| **Infrastructure**    | List and inspect hosts across your infrastructure                                      |
| **APM**               | Retrieve distributed traces, search spans for latency analysis                         |
| **Service Catalog**   | List services and map service dependency relationships                                 |
| **Events**            | Search platform and custom events                                                      |
| **Notebooks**         | Search and retrieve investigation notebooks                                            |
| **RUM**               | Search Real User Monitoring data                                                       |
| **Connection Health** | Validate that the Datadog MCP connection is working                                    |

### Write Capabilities

| Category      | What the agent can do                                       |
| ------------- | ----------------------------------------------------------- |
| **Notebooks** | Create new investigation notebooks, edit existing notebooks |

<Warning>
  Write operations (creating and editing notebooks) require user approval before execution.
</Warning>

### Example Prompts

```bash theme={null}
@alex search for error logs in the production environment from the last 15 minutes
@alex check for active incidents and investigate root causes
@alex analyze APM traces for the checkout service and identify latency bottlenecks
@alex list all hosts and check for any monitors in alert state
@alex search for RUM events with errors on the checkout page
@alex create a notebook documenting the investigation for incident INC-1234
```

***

## Troubleshooting

<Accordion title="Connection test fails with 403">
  * Verify your **API Key** is valid and not revoked
  * Verify your **Application Key** has the required scopes
  * Ensure the keys belong to the same Datadog organization
</Accordion>

<Accordion title="Missing data after connecting">
  * Check that your Application Key scopes include the data type you are querying (e.g., `logs_read_data` for logs)
  * Verify your Datadog retention settings — data may have been aged out
  * Ensure the service or host is actively sending data to Datadog
</Accordion>

<Accordion title="Wrong Datadog site selected">
  * If queries return empty results, you may have selected the wrong site
  * Check your Datadog URL: `app.datadoghq.com` → US1, `us3.datadoghq.com` → US3, `datadoghq.eu` → EU1, etc.
  * Disconnect and reconnect with the correct site
</Accordion>

<Accordion title="API Key vs Application Key">
  * **API Key**: Authenticates API requests to Datadog. Required for all connections.
  * **Application Key**: Grants access to specific Datadog features and data. Must be scoped for least-privilege access.
  * Both are required — one alone is not sufficient.
</Accordion>

***

## Security Best Practices

* **Use scoped Application Keys** — only grant the permissions CloudThinker needs
* **Separate keys per integration** — create dedicated API and Application Keys for CloudThinker
* **Rotate regularly** — periodically rotate both keys and update them in CloudThinker
* **Revoke when unused** — delete the keys in Datadog if you disconnect the integration

***

## Related

<CardGroup cols={2}>
  <Card title="Grafana Connection" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/grafana.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=c1329049025cd3c3a0909b400baef7be" href="/guide/connections/grafana" width="24" height="24" data-path="images/icons/grafana.svg">
    Alternative metrics and dashboards
  </Card>

  <Card title="PagerDuty Connection" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/pagerduty.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=cdc34a966d5d46da70c3bc509a2a7492" href="/guide/connections/pagerduty" width="24" height="24" data-path="images/icons/pagerduty.svg">
    Incident alerting and on-call
  </Card>
</CardGroup>