Overview
Work items can be created manually, automatically from across Datadog, or programmatically with the API. There are two types of work items: standard and security. Work items created from security signals and Sensitive Data Scanner are automatically made security cases. The security work type has all the features of the standard work type, along with a mandatory field for specifying the reason for closing a work item (testing, false positive, or one time exception).
Manual work item creation
- Navigate to the Work Management page.
- Select a project to create the work item in. Note: A work item can only belong to a single project.
- Click New Work Item.
- Fill in a title for the work item.
- Select a work type.
- (Optional) Add a description.
- Click Create Work Item to complete.
You can also create work items manually from the following products:
| Product | Instructions |
|---|
| Monitors | - On a monitor status page, optionally scope the monitor to a time frame and specific monitor group(s). Then, under More Actions, click Create a work item.
- In Slack, click Create work item under a monitor notification. |
| Security signals | Beside a signal, in the Cases column, click the Create Case icon. Then, enter the work item details in the Create Case window that opens. |
| Error Tracking | Click into an Error Tracking issue to open the side panel. Then, click Actions and select Add a work item. |
| Watchdog | Click into an alert to open its side panel. Click the Actions dropdown menu and select Create a work item. |
| Event Management (raw events) | Click into an event to open its side panel. Click the Actions dropdown menu and select Create a work item. |
| Cloud Cost Management | Click into a cost recommendation to open its side panel. Then, click Create a work item. |
| Sensitive Data Scanner | Click Create case next to a Sensitive Data Scanner issue. |
| Slack | Click the Create Work Item button under a monitor notification in Slack. |
Automatic work item creation
Configure the following products to automatically create work items:
| Product | Instructions |
|---|
| Monitors | Navigate to the Project Settings page, click Integrations > Datadog Monitors, and click on the toggle to get your @case-<project_handle>.
When creating a monitor, include @case-{project_handle} in the Configure notifications and automations section. Work items are automatically created when the monitor transitions to a different status. To only create work items for certain monitor transitions, use conditional variables. As an example, to create work items only when a monitor triggers, wrap the @case mention with {{#is_alert}} and {{/is_alert}}.
Toggle on Auto-close work items when the monitor group resolves to reduce manual cleanup. |
| Event Management (Correlations) | In Event Management, correlations configured to aggregate events from Datadog and third-party sources automatically create work items. |
| Workflow Automation | 1. In a new or existing workflow, add a step in the Workflow builder and search for “Case Management."
2. Select the Create Case action.
3. If the workflow is configured to run based on a monitor or security signal trigger, add the relevant workflow triggers and ensure that you’ve added the workflow handle to the desired resources. For more information, see Trigger a workflow. |
| Error Tracking | In Error Tracking, work items are automatically created when an issue is commented on or assigned. |
Work types
Add work types when you are creating a work item. Not all work types are available for configuration between manual and automatic creation. For example, only Standard, Security and Change Request, Event Management types are available when creating work items manually.
To add and enable custom work types, see Work Management Customization.
| Work Type | Description |
|---|
| Standard | A general-purpose work item for operational tasks, investigations, and more. |
| Change Request | Used in change management workflows to track planned or approved changes. |
| Event Management | Integrated with the Event Management product to house correlated events. |
| Security | Used by security teams and products to manage investigations or alerts. |
| Error Tracking | Linked to the Error Tracking product to track and remediate application issues. |
| Custom Type | Add a custom work type. For more information, see Work Management Customization. |
API
Create a work item through the API endpoint.
Note: This endpoint requires the cases_write authorization scope.
The Work Management API endpoints use case-management terminology, which reflects the product's previous name.
Further Reading
Additional helpful documentation, links, and articles:
