--- title: Incident AI description: >- Learn how to use Incident AI to investigate active incidents, receive proactive summaries, detect related issues, and trigger AI-powered root cause analysis. breadcrumbs: >- Docs > Incident Response > Incident Management > Incident Investigation > Incident AI --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Incident AI {% callout %} # Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com {% alert level="danger" %} This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}). {% /alert %} {% /callout %} ## Overview{% #overview %} Incident AI helps responders investigate active incidents faster by automating information gathering and surfacing relevant context. Working in Slack and the Datadog platform, it provides proactive summaries, detects related incidents, and enables conversational queries against incident history so your team can focus on resolution. To enable Incident AI, connect Datadog to Slack and activate Bits AI in your incident Slack channels. For setup instructions, see the [Slack integration for Incident Management](https://docs.datadoghq.com/incident_response/incident_management/setup_and_configuration/integrations/slack.md). For AI features that apply outside the investigation phase, see: - [Templates](https://docs.datadoghq.com/incident_response/incident_management/setup_and_configuration/templates.md): Add AI variables to notification and postmortem templates - [Postmortems](https://docs.datadoghq.com/incident_response/incident_management/post_incident/postmortems.md): Generate AI-assisted postmortem drafts ## Proactive incident summaries{% #proactive-incident-summaries %} When you join an incident channel in Slack (connected to Datadog Incident Management), Incident AI automatically posts a summary containing key information about the incident such as the contributing factors, impact, issue, and remediation. This can also be requested ad-hoc using `/dd incident summary`. This summary is only visible to you. When an incident is changed to resolved, Incident AI posts a final summary. This is visible to everyone in the channel. {% image source="https://docs.dd-static.net/images/incident_response/incident_management/investigate/incident_ai/incident_summary.5dd068e40ea5ec29f6743e809015fb0b.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/incident_response/incident_management/investigate/incident_ai/incident_summary.5dd068e40ea5ec29f6743e809015fb0b.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Example incident summary in Slack" /%} ## Meeting summaries{% #meeting-summaries %} {% callout %} # Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com {% alert level="danger" %} Meeting summaries are not available for your selected Datadog site ({% placeholder "user-datadog-site-name" /%}). {% /alert %} {% /callout %} Incident AI can automatically summarize incident meetings in Zoom, Google Meet, and Microsoft Teams. During a meeting, it periodically posts live summaries to the incident timeline and the incident chat channel. When the meeting ends, it posts a final post-meeting summary. {% alert level="info" %} When meeting summaries are enabled, a Datadog [subprocessor](https://www.datadoghq.com/legal/subprocessors/) records and transcribes meeting audio. After a seven-day retention period, the subprocessor automatically deletes all data. {% /alert %} Your organization must have AI features enabled before the Datadog Transcriber can join meetings. To turn on meeting summaries, enable **Generate AI meeting summaries** in the integration settings for your meeting platform: - [Zoom](https://docs.datadoghq.com/incident_response/incident_management/setup_and_configuration/integrations/zoom_integration.md#meeting-summaries) - [Google Meet](https://docs.datadoghq.com/incident_response/incident_management/setup_and_configuration/integrations/google_meet.md#meeting-summaries) - [Microsoft Teams](https://docs.datadoghq.com/incident_response/incident_management/setup_and_configuration/integrations/microsoft_teams.md#meeting-summaries) By default, Incident AI does not summarize meetings for private incidents. You can add conditions in the integration settings to prevent summarization for other incidents as well. ### How meeting summaries work{% #how-meeting-summaries-work %} When a meeting attached to an incident starts, a Datadog Transcriber attempts to join the meeting. This may take 10 to 30 seconds. If the meeting has a lobby or waiting room, a participant must admit the Datadog Transcriber before transcription can begin. After the Datadog Transcriber joins, it periodically posts live summaries to the following locations during the meeting: - The **incident timeline**, under a **Meeting Summary** entry. - The **incident chat channel**, both in the meeting card thread and as a message to the channel. When the meeting ends, it posts a final post-meeting summary to the same locations. ### Reviewing a summary{% #reviewing-a-summary %} After a summary is posted, you can approve it, edit its text, or reject it. You can take these actions from the incident timeline in Datadog, or from the incident chat channel if the summary was broadcast there. To review a summary from the incident timeline: 1. Open the incident in Datadog and find the **Meeting Summary** entry on the timeline. 1. Click the checkmark icon to approve the summary, the pencil icon to edit its text, or the reject icon to remove it from the timeline. When a user approves or edits a summary, Datadog records who did so. After a summary is edited, it can't be approved; the edited version takes precedence. Rejecting a summary removes it from the incident timeline for everyone and hides its content in connected chat channels. Datadog asks for confirmation before rejecting, because that action can't be undone. If the summary was broadcast to the incident chat channel, use the **Approve**, **Edit**, or **Reject summary** buttons on the message. ### Re-inviting the transcriber{% #re-inviting-the-transcriber %} If the Datadog Transcriber leaves a meeting, re-invite it to the same linked meeting to resume summarization: 1. Open the incident in Datadog. 1. In the incident header, open the menu for the linked meeting. 1. Click **Add Transcriber** (the robot icon) beside the meeting. 1. If required, admit the Datadog Transcriber from the meeting lobby or waiting room so transcription can begin. The robot icon shows whether the transcriber is joining or already in the meeting. If you cannot add the transcriber, hover over the icon to see the reason. A re-invite prompt can also appear in the incident's Slack or Microsoft Teams meeting-card thread after the transcriber leaves. This can happen after a timeout while waiting for admission or participants, after everyone leaves the meeting, or when someone removes the transcriber. Select **Yes** to re-invite the transcriber or **No** to dismiss the prompt. Re-inviting requires permission to edit the incident and, for organizations with seat-based billing, an [Incident Management or Incident Response seat](https://docs.datadoghq.com/account_management/billing/incident_response.md#allocate-seats). Re-inviting does not override conditions that prevent summarization, including the default exclusion for private incidents. ## Related incident detection{% #related-incident-detection %} Incident AI automatically flags related incidents if they are declared within 20 minutes of each other, helping you identify broader systemic issues. ## Chat with Incident AI{% #chat-with-incident-ai %} Use natural language prompts to request information or take action from Slack: | Functionality | Example prompt | | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | Declare an incident | `@Datadog Declare an incident` | | Change severity | `@Datadog Update this incident to SEV-3` | | Change status | `@Datadog Mark this incident as stable``@Datadog Resolve this incident` | | Request new summary | `@Datadog Give me a summary of this incident``@Datadog Summarize incident-262`**Note**: Private incidents are not summarized. | | Search incident history | `@Datadog How many incidents are currently ongoing?``@Datadog Show me all Sev-1 incidents that occurred in the past week.` | | Dive into specific incidents | `@Datadog What was the root cause of incident-123?``@Datadog What remediation actions did the responders take in incident-123?` | | Find related incidents | `@Datadog Are there any related incidents?``@Datadog Find me incidents related to DDoS attacks from the past month` | | Early detection inquiry | `@Datadog A customer is unable to check out. Is there an incident?``@Datadog Are there any incidents now impacting the payments service?` | ## Trigger a Bits Investigation{% #bits-ai-investigation %} Start a Bits Investigation directly from your incident Slack channel or the Datadog Incident Management web UI, without leaving your incident response workflow. This reduces context switching during active incidents and allows the AI agent to investigate alongside your team using the same shared context. Bits Investigation must be enabled for your organization and you can only trigger an investigation from a **properly configured Datadog Incident Management Slack channel**. The Incident Investigation flow only activates when the system detects a valid incident channel. From Slack, start an investigation during an active incident in any of these ways: - Click **Investigate with Bits AI** in the incident actions. - Run the `/dd incident investigate` slash command. - Type `@Datadog investigate` in the incident channel. When you use `@Datadog investigate`, you can include additional context inline to help the agent narrow its scope from the start: | Prompt | Behavior | | ---------------------------------------------------------------------------------------------------- | --------------------------------------------------------- | | `@Datadog investigate we're seeing high error rates in the payments service since the deploy at 2pm` | Triggers investigation with responder-provided focus area | | `@Datadog investigate, I think this is related to the redis cache` | Triggers investigation with a hypothesis seed | When triggered, the agent automatically pulls in the incident's timeline, linked telemetry signals (traces, metrics, and logs), and any context you provide in the prompt. It then posts updates back to the channel as a thread reply, with a final root cause summary and recommended next steps surfaced to the broader channel when the investigation completes. {% image source="https://docs.dd-static.net/images/incident_response/incident_management/investigate/incident_ai/Triggering_investigations_slack.1af163e1857d58d20b7610dcab13ce34.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/incident_response/incident_management/investigate/incident_ai/Triggering_investigations_slack.1af163e1857d58d20b7610dcab13ce34.png?auto=format&fit=max&w=850&dpr=2 2x" alt="A Datadog incident Slack channel showing a completed Bits Investigation with root cause findings and a View Full Investigation button." /%} **From the web UI**, you can trigger an investigation directly from the "Investigation" section on the incident overview page. {% image source="https://docs.dd-static.net/images/incident_response/incident_management/investigate/incident_ai/Triggering_investigations_web.f8efad47358e1c0bac9f03890fe4a23b.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/incident_response/incident_management/investigate/incident_ai/Triggering_investigations_web.f8efad47358e1c0bac9f03890fe4a23b.png?auto=format&fit=max&w=850&dpr=2 2x" alt="The Incident Management overview page showing a completed Bits Investigation in the Investigation section with a View Investigation button." /%} When triggered, the investigation is embedded in the incident web UI, and Bits Investigation appears as a responder in the Responder Roles section of the page. For a full walkthrough of the investigation workflow, see [Bits Investigation](https://docs.datadoghq.com/bits_ai/bits_investigation.md). ## Further reading{% #further-reading %} Additional helpful documentation, links, and articles: - [Learn about Bits Investigation](https://docs.datadoghq.com/bits_ai/bits_investigation.md) - [Generate AI-assisted postmortems](https://docs.datadoghq.com/incident_response/incident_management/post_incident/postmortems.md) - [Configure AI variables in notification and postmortem templates](https://docs.datadoghq.com/incident_response/incident_management/setup_and_configuration/templates.md) - [Accelerate investigations with AI in Datadog Incident Response](https://www.datadoghq.com/blog/datadog-incident-response-ai-features/)