Brief Customer Success on every customer-impacting Datadog incident

Build an agent workflow that briefs our Customer Success team every time Datadog declares a new customer-impacting incident, or upgrades an existing incident to customer-impacting.

Trigger: an incoming webhook from Datadog Incident Workflows / the Datadog Webhooks integration. The webhook payload contains the incident UUID, severity, customer impact status, and the impacted services. Fire on incident creation and on any update where customer impact changes to true.

When the webhook fires, the agent should do the following:

1) Call the Datadog Get an Incident operation using the incident UUID from the webhook payload. Capture severity, customer impact status, impacted services, the incident detected/created timestamp, and the public incident link.

2) Call the Datadog Search Logs (POST) operation, scoped to the impacted services and to the incident time window (incident start through now, or through resolution if resolved). Look for error and warn level log entries that carry a customer identifier field. Common field names: tenant_id, account_id, workspace_id, customer_id, org_id. Collect the distinct identifiers and a rough count of how many error events each one had.

3) If zero customer identifiers are extracted, stop and post nothing. This is the silent-skip path for internal-only incidents (background workers, infra-only services). Do not post a "no customers affected" message. Just exit.

4) For each distinct customer identifier, call HubSpot Search Companies. Try to match the identifier against the company's domain, name, or a custom property your team uses to store tenant ids. Pull back the company name, the account owner's name and email, and the annual revenue / ARR property. If a match is not found, keep the raw identifier in the output marked as unresolved.

5) Rank the affected customers by ARR descending (resolved customers first, then any unresolved identifiers at the bottom).

6) Call the Slack Bot Send a Message operation to post a single message to the CS war-room channel. The user should be able to set this channel during setup. The message should contain: the incident title, severity, current status, and a link back to the Datadog incident; a ranked table or bullet list of affected customers (company name, ARR, error event count, account owner @-mentioned by Slack handle when known); and a short 2 to 3 sentence drafted customer comms blurb that account owners can copy, personalize, and send. The blurb should acknowledge the issue plainly, set rough expectations, and not promise a specific ETA unless the incident has one.

Make all three connections (Datadog, HubSpot, Slack Bot) configurable, and let the user pick the Slack channel and the HubSpot company property that holds their tenant identifier during setup. Use Slack Bot, not the user-token Slack integration, since this is workspace automation that should be authored by a bot.

This is distinct from our existing Datadog prompts. The morning Linear triage runs on a cron and is aimed at engineering. The Zendesk enrichment is ticket-triggered and is aimed at support. The weekly Notion retro is a weekly engineering write-up. This one is per-incident, fires the moment Datadog flips an incident to customer-impacting, and is aimed at the GTM side of the house so account owners can get out ahead of customers before customers come to them.

Additional information

What does this prompt do?

Listens for new or upgraded customer-impacting incidents in Datadog and reacts the moment one is declared.
Pulls the incident's severity, impacted services, and timeline, then scans the logs from those services for the customer identifiers caught in the blast radius.
Resolves those identifiers into real account names, owners, and annual revenue from your HubSpot CRM.
Posts a single ranked briefing to your CS war room in Slack, account owners tagged, with a short drafted customer message they can copy into outreach.

What do I need to use this?

A Datadog account with Incident Management turned on, and permission to set up an outgoing webhook on incident updates.
A HubSpot account where your customer companies have account owner and revenue fields populated.
A Slack workspace with a channel set aside for your CS war room.

How can I customize it?

Change which Slack channel the briefing posts to, or split into separate channels by severity.
Tweak the ranking, default is highest revenue first, but you can sort by user count, strategic tier, or contract renewal date.
Adjust which log field the agent uses to identify customers, for example tenant id, account id, or workspace slug.

Frequently asked questions

Will this spam our CS channel every time Datadog twitches?

No. It only fires when Datadog opens or escalates an incident flagged customer-impacting, and it skips silently when no customer identifiers turn up in the logs. Internal-only incidents stay out of your CS channel.

How does the agent figure out which customers are affected?

It reads the Datadog incident details, narrows the log search to the impacted services and the incident time window, and extracts customer or tenant identifiers from error logs. Those identifiers are then looked up in HubSpot.

Does the agent message customers directly?

No. It drafts a 2 to 3 sentence customer message your account owner can copy, personalize, and send themselves. The decision to reach out stays with your team.

What if an affected customer is not in HubSpot yet?

Unresolved identifiers still show up in the briefing so you do not lose visibility on accounts that have not been added to the CRM. Your team can decide whether to dig in or ignore.

Does this replace our engineering incident response process?

No. This is the GTM-facing companion to your engineering paging, focused on which paying customers to talk to and what to say. Your engineers stay on their existing on-call workflow.