Create a Case


Cases can be created manually, automatically from across Datadog, or programmatically with the API. There are two types of cases: standard and security. Cases created from security signals and Sensitive Data Scanner are automatically made security cases. The security case type has all the features of the standard case type, along with a mandatory field for specifying the reason for closing a case (testing, false positive, or one time exception).

Manual case creation

Case Management page with the New Case modal opened to create a case manually

On the Case Management page, click New Case.

  1. Select a project to create the case in. A case can only belong to a single project.
  2. Fill in a title for the case.
  3. Optionally, add a description.
  4. Click Create Case to complete.

You can also create cases manually from the following products:

Monitors- On a monitor status page, optionally scope the monitor to a time frame and specific monitor group(s). Then, click the Escalate dropdown menu and select Create a case.
- In Slack, click Create case under a monitor notification.
Security signalsClick into a Security Signal to open up the side panel. Click the Escalate Investigation dropdown menu and select Create a case.
Error TrackingClick into an Error Tracking issue to open the side panel. Then, click Create a case.
WatchdogClick into an alert to open its side panel. Click the Escalate dropdown menu and select Create a case.
Event Management (raw events)Click into an event to open its side panel. Click the Escalate dropdown menu and select Create a case.
Cloud Cost ManagementClick into a cost recommendation to open its side panel. Then, click Create case.
Sensitive Data ScannerClick Create case next to a Sensitive Data Scanner issue.
SlackClick the Create Case button under a monitor notification in Slack.

Automatic case creation

Configure the following products to automatically create cases:

MonitorsNavigate to the Project Settings page, click Integrations > Datadog Monitors, and click on the toggle to get your @case-<project_handle>.

When creating a monitor, include @case-{project_handle} in the Configure notifications and automations section. Cases are automatically created when the monitor transitions to a different status. To only create cases for certain monitor transitions, use conditional variables. As an example, to create cases only when a monitor triggers, wrap the @case mention with {{#is_alert}} and {{/is_alert}}.
Event Management (Correlations)In Event Management, correlations configured to aggregate events from Datadog and third-party sources automatically create cases.
Workflow Automation1. In a new or existing workflow, add a step in the Workflow builder and search for “Case Management."
2. Select the Create Case action.
3. If the workflow is configured to run based on a monitor or security signal trigger, add the workflow handle to the desired resources.


Create a case through the API endpoint.

Note: This endpoint requires the cases_write authorization scope.

Further Reading

Additional helpful documentation, links, and articles: