> ## Documentation Index
> Fetch the complete documentation index at: https://docs.squasher.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Datadog monitor alerts

> Send Datadog monitor lifecycle transitions to Squasher incidents.

The Datadog monitor connector uses a managed webhook payload so firing, renotify,
and recovery notifications keep one stable Squasher incident.

## Connect Datadog

<Steps>
  <Step title="Create the Squasher source">
    Create a **Datadog monitors** source under **Settings → Integrations**. Copy its
    endpoint and generated secret.
  </Step>

  <Step title="Add a Datadog webhook">
    In Datadog, open **Integrations → Webhooks**, create a webhook, and set its URL
    to the Squasher endpoint.
  </Step>

  <Step title="Add the authentication header">
    Set **Custom Headers** to the JSON below.

    ```json theme={null}
    { "Authorization": "Bearer <setup.secret>" }
    ```
  </Step>

  <Step title="Use the Squasher payload template">
    Paste this JSON into **Payload**.

    ```json theme={null}
    {
      "alert_cycle_key": "$ALERT_CYCLE_KEY",
      "alert_id": "$ALERT_ID",
      "event_id": "$ID",
      "alert_transition": "$ALERT_TRANSITION",
      "title": "$ALERT_TITLE",
      "message": "$ALERT_STATUS",
      "date": "$DATE",
      "priority": "$ALERT_PRIORITY",
      "tags": "$TAGS",
      "link": "$LINK"
    }
    ```
  </Step>

  <Step title="Notify the webhook">
    Add `@webhook-<WEBHOOK_NAME>` to each Datadog monitor that should create a
    Squasher incident. Trigger and recover a test alert.
  </Step>
</Steps>

## Incident behavior

* `$ALERT_CYCLE_KEY` is the preferred stable key across trigger and recovery. The
  monitor alert ID is used only when a cycle key is unavailable.
* `Triggered`, `Re-Triggered`, `Warn`, `Re-Warn`, `No Data`, `Re-No Data`, and
  `Renotify` are firing updates. `Recovered` or `Resolved` resolves the incident.
* Monitor priority maps deterministically: `P1`/`P2` → `sev-1`, `P3` → `sev-2`,
  and `P4`/`P5` → `sev-3`. An absent or unrecognized priority uses the connector's
  configured default severity.
* Tags, status message, and the Datadog link remain available for triage.
* Retries of the same `$ID` are idempotent.

The adapter requires `title`, a transition (`alert_transition` or `transition`), and
one stable identity (`alert_cycle_key` or `alert_id`). It also accepts `event_id`,
`date`, `message`, `link`, `tags`, `priority`, and an optional explicit `severity`.
If you customize the managed template with `severity`, project-defined severity keys
or common severity names take precedence over `priority`. Unknown fields are ignored.

<Note>
  Datadog retries webhook delivery for internal errors and `5xx` responses. It does not retry a
  request rejected for an invalid credential or payload.
</Note>

If recovery creates a separate incident, confirm that `$ALERT_CYCLE_KEY` appears in
the exact payload template. If a logs monitor omits status text, add
`$ALERT_STATUS` to its webhook configuration.

Related: [Inbound alert connectors](/integrations/alert-connectors),
[Alert Connectors API](/api-reference/alert-connectors).