DEVOPS
Turn a Datadog cost-anomaly monitor into a routed Slack triage thread
When a Datadog cloud-cost anomaly monitor fires, it pulls the spiking service's tags to identify the owning team, posts an alert to that team's Slack channel.
How it runs
The automated pipeline, trigger to output.
- TriggerDatadog cost-anomaly monitor firesDatadog
- ActionFetch resource tags and spend timeseriesDatadog
- LogicResolve owning team to Slack channel
- OutputPost routed triage thread to SlackSlack
What it does
Listens for Datadog cloud-cost anomaly monitor alerts, reads the service and team tags on the offending resource, and routes a triage message to the right team's Slack channel instead of a generic firehose. The Slack post opens a thread so the owning team can investigate in place.
When to use it
Use it when you already track cloud spend metrics in Datadog and want anomaly alerts delivered to the team that actually owns the resource, with enough context to act immediately rather than a bare "cost is high" ping.
How it works
- 1A Datadog cost-anomaly monitor fires and posts to the workflow webhook.
- 2An action enriches the alert by querying Datadog for the resource's `team` and `service` tags and the spend timeseries.
- 3A logic step maps the `team` tag to its Slack channel; unmapped or untagged resources fall through to a default FinOps channel.
- 4An output step posts a Slack message to the resolved channel with the spend graph link, the anomaly window, and the top cost-driving dimensions.
- 5The message starts a thread the team can reply in to claim and resolve the spike.
Set it up
What you configure once, before turning it on.
- 1Connect DatadogMetrics, traces, log search.
- 2Connect SlackChannels, DMs, threads, mentions.
- 3Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 4Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 5Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More DevOps workflows
Slack-approved pause for idle Hugging Face Spaces
On a daily scan it finds idle paid Spaces and posts an interactive Slack approval; on approve it pauses the Space and logs the decision to a GitHub issue audit trail.
Block costly Hugging Face Space hardware upgrades in PR review
When a pull request changes a Space's hardware config, it estimates the new monthly cost and posts a GitHub PR comment that flags upgrades crossing a budget ceiling.
Hugging Face Spaces idle-runtime sweep with auto-pause
On a schedule, scans all Hugging Face Spaces for ones running idle past a threshold, pauses them to stop billing, and posts a Slack summary with the estimated monthly savings.
Open a Zoom war-room from a Datadog multi-alert storm
When a Datadog monitor crosses a critical threshold, this workflow dedupes against active incidents, and only for a genuinely new outage it creates a Zoom bridge.
Auto-spin a Zoom war-room when PagerDuty hits SEV-1
When a PagerDuty incident escalates to a critical severity, this workflow creates a dedicated Zoom meeting and posts the bridge link to the incident's Slack channel so responders…
Spin up a war-room on demand from a Slack slash command
When an engineer runs a Slack command, this workflow creates a Zoom bridge, opens a tracking Sentry-linked incident, files a Linear issue for follow-up.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.