Datadog

From an investigation, Bits sends Slack and Microsoft Teams messages, opens PagerDuty or Datadog incidents, pages engineers through On Call, creates Work Management items and opens Jira tickets, with descriptions and ticket fields filled in from the findings, and Bits Code opens pull requests on GitHub. Investigations also read Grafana, Dynatrace, Splunk, Sentry and ServiceNow. Agents built in Bits Agent Builder call any action in the Action Catalog or any API through custom HTTP actions, with a tool's parameters locked when a team wants them fixed.

Sourcedocs.datadoghq.com/bits_ai/bits_remediationread 2026-11-09

An investigation runs as a loop of hypotheses, queries and revisions that branches into a tree until it settles on a cause, then passes a code related root cause to Bits Code, a second agent that writes and iterates on the fix. Agents built in Bits Agent Builder run inside Workflow Automation and App Builder through a Run Agent step, return output shaped by a JSON schema so later steps can branch on its fields, and keep context across runs when given a conversation ID. Work Management can assign custom agents to work items alongside people.

Sourcedocs.datadoghq.com/actions/agentsread 2026-11-09

Investigations follow runbooks written into monitor messages and the notebooks and Confluence pages those messages link, pulling out telemetry links and troubleshooting steps as they go, and a bits.md file holds tagging conventions, glossary terms, architecture notes and known noise for investigations and chat. With account crawling turned on, a connected Confluence Cloud account becomes a standing data source that Bits Chat searches, rather than a page read only when a monitor links it. Bits Security Analyst takes its own org wide context file for security investigations.

Sourcedocs.datadoghq.com/bits_ai/bits_investigation/knowledge_sourcesread 2026-11-09

Bits Guardrails let admins set remediation actions to wait for approval from named teams, roles or people, or to stay recommendations only, scoped by environment, service and resource tags, but Guardrails and one click infrastructure actions sit in a preview that customers join by request. Once open to every customer, that approval step would put a named person in front of each scoped action.

Generally available controls are separate permissions for each Bits product, agents limited to the tools added to them, rate limits on automatic investigations, an org wide AI switch and credit caps. Bits Testing, the browser exploration agent, has an Ask about every action review mode that pauses before any step that would change real data until someone clicks Approve or Deny, and an unanswered request counts as a denial. Code fixes arrive as pull requests for review.

Sourcedocs.datadoghq.com/bits_ai/bits_remediationread 2026-11-09

Access runs through managed and custom roles, with separate permissions to read or run Bits investigations, write with Bits Code, build or run Agent Builder agents, configure Bits Security Analyst and manage Guardrails, and only holders of User Access Manage can grant them. Audit Trail records manual investigations, their tool calls and changes to automatic investigation settings. The trust center lists SOC 2 Type 2 reports, ISO 27001, 27017, 27018, 27701 and 42001 certificates, FedRAMP High authorization, HIPAA and PCI DSS compliance, plus CSA STAR, TISAX and IRAP assessments.

Sourcetrust.datadoghq.comread 2026-11-09

While it works, each investigation records every step, including how it weighed evidence, in an Investigation Steps view, and a Hypothesis Tree lays out the path to the conclusion once it finishes; findings land on the monitor status page and in Slack, Teams, On Call or the linked work item. A Reports tab tracks investigations by monitor, user, service and team, with mean time to conclusion. Audit Trail logs manual investigations and each of their tool calls, and Agent Builder configuration changes can be traced by agent ID.

Sourcedocs.datadoghq.com/bits_ai/bits_investigation/investigate_issuesread 2026-11-09

Positive feedback on a conclusion, and any correction given in the chat, becomes a memory that Bits picks up in later investigations of similar alerts, reusing queries that worked and applying past corrections to how it orders its steps. Memories are kept per monitor, and admins view and delete them from the Memories column of the monitor management page. Agent Builder agents keep chat history across sessions and carry context between workflow runs through a conversation ID, and Bits Security Analyst holds situational context entries that stop applying on an expiry date the team sets.

Sourcedocs.datadoghq.com/bits_ai/bits_investigation/knowledge_sourcesread 2026-11-09

Each organization lives on one Datadog site, chosen for where its data should be stored, and Bits runs on the seven commercial sites: US1, US3 and US5 in the United States, EU1 in Germany, AP1 in Japan, AP2 in Australia and UK1 in the United Kingdom. Sites are fully independent and data is not shared between them. The Datadog for Government sites carry no Bits products, and every option runs in Datadog's own cloud, with no self hosted or customer tenant deployment for the agents.

Sourcedocs.datadoghq.com/getting_started/siteread 2026-11-09

Bits ships as a set of agents that each do their own job: Bits Investigation for alerts, Bits Code for fixes and code review, Bits Security Analyst for Cloud SIEM signals, Bits Chat for questions about telemetry, Bits Data Analysis for business data in plain language, Bits Detection for spotting service degradations and Bits Remediation for acting on a root cause. Bits Agent Builder adds blueprints for error triage, incident response, security analysis and DevOps assistance that arrive with instructions, tools and automations already set and stay editable.

Sourcedocs.datadoghq.com/bits_airead 2026-11-09

Investigations start on their own when a supported monitor moves into the alert state, across metric, anomaly, forecast, integration, outlier, log, APM metric, composite, SLO, Synthetic and RUM monitors, within per monitor and organization rate limits. People can also start one from a monitor page, a Slack or Teams thread, a Synthetic test, a RUM chart, an Error Tracking issue in preview, or a plain language prompt. Bits Security Analyst takes every eligible Cloud SIEM signal above medium severity, and Agent Builder agents run on schedules or on monitor, incident and security signal triggers.

Sourcedocs.datadoghq.com/bits_ai/bits_investigation/investigate_issuesread 2026-11-09

Bits Investigation, the lead agent, runs on models Datadog selects, and so do Bits Chat and the other built in agents, with no model picker in their settings. The choice reaches only Bits Agent Builder, which sits beside them for teams assembling their own operations agents: there the team picks the model behind each agent's reasoning, weighing capability, speed and cost, with the OpenAI and Anthropic model lineups named as the reference, and can change it as the workload shifts. Outside assistants that reach Bits through the Datadog MCP Server run on their own models.

Sourcedocs.datadoghq.com/actions/agentsread 2026-11-09

The Bits AI API triggers, lists and retrieves investigations from scripts and applications, and the Datadog MCP Server's investigator toolset lets AI assistants search past investigations, start one for an alert, an incident or a written description, and steer a running one with more context. The pup command line tool lists, gets and triggers investigations from a JSON file, Bits Investigation adds Trigger, Get and List actions for Workflow Automation, and the Datadog REST API covers the rest of the platform.

Sourcedocs.datadoghq.com/bits_ai/bits_investigation/mcp_api_cliread 2026-11-09

Agent Observability evaluates the customer's own LLM applications and agents for quality, privacy and safety, flags prompt injection attempts and sensitive data, clusters production traffic into Patterns that show coverage gaps and response quality over time, and raises Insights that name the root cause, impact and recommended fix for recurring cost or reliability problems. Evaluations are unlimited on every plan, including the free one, because billing follows LLM spans alone.

Sourcedocs.datadoghq.com/llm_observabilityread 2026-11-09

Bits Testing drives a hosted browser through the customer's own web application from a starting URL, choosing a set of actions at each new page, clicking and typing with saved login profiles, and keeping a screenshot and its reasoning for every step on an exploration map.

Jobs run from managed locations in Frankfurt, N. Virginia, Ohio and Virginia, or reach internal apps through a private location tunnel. The journeys it finds become Synthetic browser tests that replay in Chrome, Firefox and Edge on laptop, tablet and mobile screen sizes, every five minutes by default. Goal Based tests, where an agent explores toward a plain language goal on every run, sit in a waitlist preview.

Sourcedocs.datadoghq.com/synthetics/bits_testingread 2026-11-09