AI AGENTS
Cost-Anomaly PagerDuty Trigger with Suspect Deploy
Reacts to a Datadog cost-anomaly alert, identifies the single most likely deploy that caused it.
How it runs
The automated pipeline, trigger to output.
- TriggerDatadog cost-anomaly webhookDatadog
- ActionExtract affected service and anomaly window
- ActionQuery GitLab deploys and MRs in windowGitLab
- LogicScore and select most likely suspect deploy
- OutputOpen PagerDuty incident with suspect and rollbackPagerDuty
What it does
Turns a noisy cost-anomaly alert into an actionable incident. When Datadog flags abnormal spend on a service, the agent immediately looks at what shipped to that service, picks the single most suspicious deploy, and opens a PagerDuty incident that already names the suspect change and links the rollback path — so the on-call engineer starts with a hypothesis, not a blank page.
When to use it
Use this when cost anomalies need an owner fast and you don't want them buried in a Slack channel overnight. Best for teams that already route reliability incidents through PagerDuty and want runaway spend treated with the same urgency.
How it works
- 1A Datadog cost-anomaly monitor fires a webhook into the workflow.
- 2The agent reads the alert to extract the affected service and the anomaly window.
- 3It queries GitLab for deploys and MRs touching that service inside the window.
- 4It scores each candidate and selects the single most likely trigger.
- 5It opens a PagerDuty incident titled with the suspect deploy, attaches the diff and rollback link, and sets urgency from the spike size.
Set it up
What you configure once, before turning it on.
- 1Connect DatadogMetrics, traces, log search.
- 2Connect GitLabRepos, MRs, pipelines, registry.
- 3Connect PagerDutyIncidents, on-call, escalations.
- 4Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 5Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 6Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More AI Agents workflows
Custom Metrics Cardinality Spike Pager
A webhook from a Datadog monitor fires when custom-metric cardinality jumps; an agent pinpoints the offending metric and tag, estimates the added cost.
Sentry-to-Confluence Runbook Updater
When a Sentry issue is resolved, the agent finds the matching Confluence runbook page and proposes an inline update with the verified fix.
Stale Doc-PR Chaser for Runbook Gaps
On a daily schedule the agent finds runbook doc PRs that were opened from resolved incidents but never reviewed, summarizes what each one fixes.
Resolved Incident to Public Troubleshooting Doc
For customer-facing errors resolved in Sentry, the agent drafts a sanitized troubleshooting entry and opens a PR to your ReadMe documentation.
On-Call Runbook Gap Closer: Resolved Sentry Issues to Doc PRs
An agent reads each newly resolved Sentry issue, compares the actual fix against your existing runbook, and opens a GitHub PR adding the missing remediation steps.
Weekly On-Call Doc-Gap Digest
Each week the agent reviews every Sentry issue resolved in the last 7 days, ranks the ones whose runbook coverage is missing or thin.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.