Workflow Automation is not supported for your selected Datadog site ().
You can trigger a workflow manually or automatically.
A workflow can either run with the identity of the user who owns it, or with the identity of a service account associated with the workflow. For more information on service accounts, see Service accounts for Workflow Automation.
Manually trigger a workflow
To trigger a workflow manually:
From the workflow page, click Run.
Enter the values for existing trigger variables.
When you’re ready to run the workflow, click Save & Run.
Trigger a workflow from a Dashboard
To trigger a workflow from a Dashboard, add the Run Workflow widget:
From your Dashboard, click Add Widget.
Search for workflows and add the Run Workflow widget.
Under Select the workflow, find your workflow in the dropdown menu.
Map dashboard template variables to workflow input parameters. This allows the values of your dashboard template variables to be mapped directly to the input parameters when you run the workflow.
Enter a title for the widget and click Save.
To run the workflow:
Click Run Workflow on your dashboard widget.
Under Execution parameters, any template variables you mapped to workflow inputs are automatically populated. Enter the values for any unmapped execution parameters, or edit the existing values if needed.
Click Run to run the workflow.
Trigger a workflow from a workflow
You can trigger a child workflow from another workflow using the Trigger Workflow action. For example, if you have a complex series of steps that you need to reuse in several workflows, there’s no need to recreate those steps for all of your workflows. Instead, add the steps to a new workflow and trigger it in your other workflows using the Trigger Workflow action.
For billing purposes, triggering a child workflow registers as a new workflow execution.
If the child workflow has input parameters, these parameters appear as required fields in the Trigger Workflow action. In the example below, the service_name input parameter is required because service_name is set as an input parameter in the child workflow.
Trigger a workflow from a Monitor
To trigger a workflow from a Monitor:
On the workflow canvas, click Add an Automated Trigger and select @mention.
Find the monitor you’d like to use to trigger the workflow and edit it, or create a new monitor.
In the message section, add the full workflow mention name:
The mention name should start with @workflow-. For example, @workflow-my-workflow
To pass trigger variables into the workflow, use a comma-separated list with the syntax @workflow-name(key=value, key=value). For example, @workflow-my-workflow(name="Bits", alert_threshold=threshold)
Save the monitor.
Each time the monitor threshold is hit, the monitor triggers a workflow run.
Scheduled and triggered workflows don’t run automatically until you’ve published them. To publish the workflow, click Publish from the workflow’s page. Published workflows accrue costs based on workflow executions. For more information, see the Datadog Pricing page.
Test a monitor trigger
You can test a monitor trigger during workflow creation. Testing a monitor generates a snippet that you can paste into your monitor notification window to trigger the workflow.
To test a monitor trigger:
Select the monitor trigger action in your workflow.
Click Test from Monitor.
If your monitor passes inputs to the workflow, enter a test value under Workflow Inputs.
Select a monitor to test.
Select a monitor state.
Click Run From Monitor.
Trigger a workflow from a Security Signal
You can trigger a Workflow automatically for any Security Signal, or manually trigger a Workflow from a Cloud SIEM Security Signal panel.
Trigger a workflow automatically from Security Signal Notification Rules
You can set up a workflow to trigger every time a Security Signal Notification Rule fires.
To trigger a workflow from a Notification Rule:
On the workflow canvas, click Add an Automated Trigger and select @mention.
Next to @workflow-, enter a mention name for the trigger. Your mention name must be unique.
Save your Workflow.
From the Configuration page, find the notification rule you’d like to use to trigger your workflow, or create a new rule.
In the Recipient section, add the full workflow mention name. For example, @workflow-my-workflow.
Add a unique notification name.
Click Save and Activate.
Each time the Notification Rule fires, it triggers a workflow run.
Scheduled and triggered workflows don’t run automatically until you’ve published them. To publish the workflow, click Publish from the workflow’s page. Published workflows accrue costs based on workflow executions. For more information, see the Datadog Pricing page.
Trigger a workflow manually from Cloud SIEM Security Signals
You can manually start a workflow from a Cloud SIEM Security Signal panel.
Click Run Workflow at the top of the Security Signal panel.
In the search modal, enter the name of the workflow you want to run. Select the workflow.
If your workflow requires input parameters, enter the values as required. You can copy the values from the Signal object JSON displayed next to the input parameters, and paste them into the parameter fields.
Click Run.
You can see the workflow run status in the Workflow section of the Security Signal.
To trigger a workflow from incidents, create an incident notification rule:
Create a workflow with a Monitor, Incident, or Security signal trigger, or add a Monitor, Incident, or Security signal trigger to an existing workflow.
Click on the trigger in the workflow canvas and copy the Mention handle.
Configure a Severity, Service, and Other attributes for your notification rule.
Under Notify, paste the workflow handle that you copied earlier.
Enter a Template and configure the Renotify settings for the notification rule.
Click Save.
Scheduled and triggered workflows don’t run automatically until you’ve published them. To publish the workflow, click Publish from the workflow’s page. Published workflows accrue costs based on workflow executions. For more information, see the Datadog Pricing page.
Trigger a workflow with an API call
Triggering a workflow using an API call requires an API key and an application key with the workflows_run scope. For information on adding a scope to an application key, see Scopes.
Unscoped keys do not include the workflows_run scope by default. Ensure that you're following security best practice and use an application key with the minimum scopes needed to perform the desired task.
You can trigger a workflow by sending a POST request with the workflow ID to the endpoint https://api.datadoghq.com/api/v2/workflows/WORKFLOW-ID/instances. When you add an API trigger to a workflow, the trigger interface gives you an example cURL request that you can use to trigger the workflow.
To add an API trigger to a workflow:
Click Add Trigger > API.
On the workflow canvas, click API and note the example workflow cURL request, which includes the required headers and data to trigger your workflow.
A cURL request to trigger a workflow looks something like this:
If the workflow includes input parameters, include them in the request payload. The following example uses two input parameters, example_input1 and example_input2:
Click Publish to publish the workflow. A workflow must be published before you can trigger it with a POST request. Published workflows accrue costs based on workflow executions. For more information, see the Datadog Pricing page.
Trigger a workflow on a schedule
To schedule a workflow run:
On the workflow canvas, click Add an Automated Trigger and select Schedule.
Click Create to create a service account. For more information, see Use a service account.
Enter a time and frequency for the run.
(Optional) Enter a description for the workflow in the Memo field.
Click Save.
Scheduled and triggered workflows don’t run automatically until you’ve published them. To publish the workflow, click Publish from the workflow’s page. Published workflows accrue costs based on workflow executions. For more information, see the Datadog Pricing page.
Run history
After you trigger a workflow, the workflow page switches to the workflow’s Run History. Click Configuration or Run History in the top-left to switch between the configuration and run history views.
Use run history to watch the progress of a triggered workflow, or debug a failed step. Clicking on a failed step gives you the inputs, outputs, and execution context for the step, as well as the associated error message. The example below shows a failed GitHub pull request status step. The error message shows that the step failed due to missing permissions:
The initial run history for a workflow provides a panel with the list of previous workflow executions and whether each execution succeeded or failed. Failures include a link to the failed workflow step. Click on a workflow execution in the list to inspect it. You can return to the initial execution history at any time by clicking anywhere on the workflow canvas.
Further reading
Additional helpful documentation, links, and articles: