# Datadog Integration

Connecting Datadog to itoc360 means every monitor alert automatically opens an incident — and when the monitor recovers, the incident closes on its own. Setup takes about five minutes and requires no additional agent installation. You only need to point a Datadog webhook at your itoc360 source URL and drop in a token.

### Prerequisites

* Admin or Standard role in your Datadog account
* A Datadog source created in itoc360 (the token is generated at this step)

### Setup

#### Step 1 — Create a Source in itoc360

1. In itoc360, go to **Sources → New Source**.
2. Select **Datadog** as the provider.
3. Once the source is saved, a token is generated. Copy it — you'll need it in the next step.

#### Step 2 — Add the Webhook in Datadog

1. In Datadog, go to **Integrations → Integrations** and search for **Webhooks**.
2. Open the Webhooks tile and click **+ New**.
3. Fill in the following fields:

**Name:** `itoc360` (this name is used when mentioning the webhook in monitors, e.g. `@webhook-itoc360`)

**URL:**

```
https://<your-project>.supabase.co/functions/v1/events
```

**Payload:** Clear the default content and paste the following:

```json
{
  "alert_id": "$ALERT_ID",
  "alert_title": "$ALERT_TITLE",
  "alert_type": "$ALERT_TYPE",
  "alert_transition": "$ALERT_TRANSITION",
  "alert_metric": "$ALERT_METRIC",
  "alert_query": "$ALERT_QUERY",
  "alert_scope": "$ALERT_SCOPE",
  "alert_status": "$ALERT_STATUS",
  "hostname": "$HOSTNAME",
  "body": "$EVENT_MSG",
  "link": "$LINK",
  "tags": "$TAGS",
  "priority": "$PRIORITY",
  "date": "$DATE",
  "id": "$ID",
  "org": {
    "id": "$ORG_ID",
    "name": "$ORG_NAME"
  }
}
```

4. Check the **Custom Headers** box and enter:

```json
{"x-itoc360-token": "<your-source-token>"}
```

5. Click **Save**.

<figure><img src="https://4108595529-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FimJRSa33y5Ej6rwXrBeA%2Fuploads%2FEDEzZqFB7jH75HZQvTwH%2FEkran%20Resmi%202026-03-13%2000.02.25.png?alt=media&#x26;token=457bd80d-cedc-4896-aff1-8dc018739cda" alt=""><figcaption></figcaption></figure>

#### Step 3 — Attach the Webhook to a Monitor

With the webhook in place, you decide which monitors send notifications to itoc360.

1. Open any monitor and click **Edit**.
2. Scroll to the **Configure notifications & automations** section.
3. In the message box, type `@webhook-itoc360` — Datadog will suggest it via autocomplete.
4. Save the monitor.

<figure><img src="https://4108595529-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FimJRSa33y5Ej6rwXrBeA%2Fuploads%2FwZa53J96UJzb8BdCDIEI%2FEkran%20Resmi%202026-03-13%2000.03.32.png?alt=media&#x26;token=cfea0476-0ac8-485c-b230-120f81e3deaf" alt=""><figcaption></figcaption></figure>

From this point, every state change on that monitor will be forwarded to itoc360.

### How Alerts Map to Incidents

itoc360 reads the `alert_transition` field from the Datadog payload to decide whether to open or close an incident:

| Datadog `alert_transition` | itoc360 Action  |
| -------------------------- | --------------- |
| Triggered                  | Opens incident  |
| Re-Triggered               | Opens incident  |
| Warn                       | Opens incident  |
| No Data                    | Opens incident  |
| Renotify                   | Opens incident  |
| Recovered                  | Closes incident |

If the same monitor fires again after recovering, a new incident is opened since the previous one is already closed.

### Priority Mapping

itoc360 uses the `alert_type` field to determine incident priority:

| Datadog `alert_type` | itoc360 Priority |
| -------------------- | ---------------- |
| error                | High             |
| warning              | Medium           |
| info                 | Low              |
| success              | Low              |

To customize this mapping per source, go to **Sources → Edit → Priority Mapping**.

### Troubleshooting

**Webhook fires but no incident appears in itoc360** Check the Supabase Edge Function logs. The most common cause is a missing required field — make sure the payload template was pasted correctly and includes `alert_id`, `alert_title`, and `alert_transition`.

**Monitor triggers but webhook never fires** Verify that `@webhook-itoc360` is present in the monitor's notification message. Without the mention, Datadog won't call the webhook.

**401 Unauthorized** The token in Datadog's Custom Headers must exactly match the token shown on the itoc360 source page. If you regenerate the token in itoc360, update the Datadog webhook header as well.