---
title: Incident AI
description: >-
  Learn how to use Incident AI to investigate active incidents, receive
  proactive summaries, detect related issues, and trigger AI-powered root cause
  analysis.
breadcrumbs: >-
  Docs > Incident Response > Incident Management > Incident Investigation >
  Incident AI
---

# Incident AI

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ().
{% /alert %}

{% /callout %}

## Overview{% #overview %}

Incident AI helps responders investigate active incidents faster by automating information gathering and surfacing relevant context. Working in Slack and the Datadog platform, it provides proactive summaries, detects related incidents, and enables conversational queries against incident history so your team can focus on resolution.

To enable Incident AI, connect Datadog to Slack and activate Bits AI in your incident Slack channels. For setup instructions, see the [Slack integration for Incident Management](https://docs.datadoghq.com/incident_response/incident_management/setup_and_configuration/integrations/slack.md).

For AI features that apply outside the investigation phase, see:

- [Templates](https://docs.datadoghq.com/incident_response/incident_management/setup_and_configuration/templates.md): Add AI variables to notification and postmortem templates
- [Postmortems](https://docs.datadoghq.com/incident_response/incident_management/post_incident/postmortems.md): Generate AI-assisted postmortem drafts

## Proactive incident summaries{% #proactive-incident-summaries %}

When you join an incident channel in Slack (connected to Datadog Incident Management), Incident AI automatically posts a summary containing key information about the incident such as the contributing factors, impact, issue, and remediation. This can also be requested ad-hoc using `/dd incident summary`. This summary is only visible to you.

When an incident is changed to resolved, Incident AI posts a final summary. This is visible to everyone in the channel.

{% image
   source="https://docs.dd-static.net/images/service_management/incidents/incident_ai/incident_summary.5dd068e40ea5ec29f6743e809015fb0b.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/service_management/incidents/incident_ai/incident_summary.5dd068e40ea5ec29f6743e809015fb0b.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Example incident summary in Slack" /%}

## Related incident detection{% #related-incident-detection %}

Incident AI automatically flags related incidents if they are declared within 20 minutes of each other, helping you identify broader systemic issues.

## Chat with Incident AI{% #chat-with-incident-ai %}

Use natural language prompts to request information or take action from Slack:

| Functionality                | Example prompt                                                                                                                            |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| Declare an incident          | `@Datadog Declare an incident`                                                                                                            |
| Change severity              | `@Datadog Update this incident to SEV-3`                                                                                                  |
| Change status                | `@Datadog Mark this incident as stable``@Datadog Resolve this incident`                                                                   |
| Request new summary          | `@Datadog Give me a summary of this incident``@Datadog Summarize incident-262`**Note**: Private incidents are not summarized.             |
| Search incident history      | `@Datadog How many incidents are currently ongoing?``@Datadog Show me all Sev-1 incidents that occurred in the past week.`                |
| Dive into specific incidents | `@Datadog What was the root cause of incident-123?``@Datadog What remediation actions did the responders take in incident-123?`           |
| Find related incidents       | `@Datadog Are there any related incidents?``@Datadog Find me incidents related to DDoS attacks from the past month`                       |
| Early detection inquiry      | `@Datadog A customer is unable to check out. Is there an incident?``@Datadog Are there any incidents now impacting the payments service?` |

## Trigger a Bits AI SRE investigation{% #bits-ai-investigation %}

Start a Bits AI SRE investigation directly from your incident Slack channel or the Datadog Incident Management web UI, without leaving your incident response workflow. This reduces context switching during active incidents and allows the AI agent to investigate alongside your team using the same shared context.

Bits AI SRE must be enabled for your organization and you can only trigger an investigation from a **properly configured Datadog Incident Management Slack channel**. The Incident Investigation flow only activates when the system detects a valid incident channel.

**From Slack,** type `@Datadog investigate` in the incident channel to kick off an investigation during an active incident. You can include additional context inline to help the agent narrow its scope from the start:

| Prompt                                                                                               | Behavior                                                  |
| ---------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
| `@Datadog investigate we're seeing high error rates in the payments service since the deploy at 2pm` | Triggers investigation with responder-provided focus area |
| `@Datadog investigate, I think this is related to the redis cache`                                   | Triggers investigation with a hypothesis seed             |

When triggered, the agent automatically pulls in the incident's timeline, linked telemetry signals (traces, metrics, and logs), and any context you provide in the prompt. It then posts updates back to the channel as a thread reply, with a final root cause summary and recommended next steps surfaced to the broader channel when the investigation completes.

**From the web UI**, you can trigger an investigation directly from the "Investigation" section on the incident overview page.

When triggered, the investigation is embedded in the incident web UI, and Bits AI SRE appears as a responder in the Responder Roles section of the page.

For a full walkthrough of the investigation workflow, see [Bits AI SRE](https://docs.datadoghq.com/bits_ai/bits_ai_sre.md).

## Further reading{% #further-reading %}

- [Learn about Bits AI SRE](https://docs.datadoghq.com/bits_ai/bits_ai_sre.md)
- [Generate AI-assisted postmortems](https://docs.datadoghq.com/incident_response/incident_management/post_incident/postmortems.md)
- [Configure AI variables in notification and postmortem templates](https://docs.datadoghq.com/incident_response/incident_management/setup_and_configuration/templates.md)