Datadog · AIOps
AIOps in Saudi Arabia: anomaly detection, correlation and root cause analysis with Datadog
AIOps means using machine learning on monitoring data so that the operations team sees fewer, better alerts and reaches the cause of an incident sooner. In Datadog, Watchdog learns a baseline and flags what departs from it, Intelligent Correlation groups related alerts into one case, and Bits AI investigates an alert and proposes a conclusion. None of it replaces the engineer who decides what to change. Interkey is an official Datadog partner in Saudi Arabia: we sell the licences, prepare the data these features depend on, tune them and support the platform after go-live.
Orientation
At a glance
The page in one table, for the reader who has five minutes.
- What AIOps covers here
- Anomaly detection, alert correlation and root-cause suggestions inside Datadog
- The Datadog features
- Watchdog, anomaly and outlier monitors, Intelligent Correlation, Bits AI investigations
- What it depends on
- Good telemetry: APM, logs and infrastructure metrics with consistent service tags
- What it does not do
- Decide what to change in production; that stays with your engineers and your change process
- How it is billed
- Watchdog is built in; APM, logs and hosts are billed as usual; Bits AI uses Datadog AI Credits
- Where the data goes
- To your Datadog site; as of November 2026 Datadog lists no site in the Middle East
- What Interkey does
- Licences, telemetry and tagging, monitor tuning, correlation set-up and technical support from Riyadh
What an AIOps platform does, and what it needs from you
Most operations teams have too many alerts, many about the same incident, and fixed thresholds that fire when traffic is normal and stay quiet while a slow leak builds. AIOps tools try to notice unusual behaviour without a hand-written threshold, group alerts that belong to one problem, and point at a likely cause.
These features are only as good as the data under them. Watchdog's root cause analysis needs APM, and Datadog recommends unified service tagging so that metrics, traces and logs for one service are read together. That is why most of our Datadog projects start with the telemetry, not with the AI features.
Datadog AIOps features: what each one does
Summarised from Datadog's own documentation. The last column is the part a person still owns.
| Feature | What it does, per Datadog | What it needs | Where people decide |
|---|---|---|---|
| Watchdog alerts | Flags anomalies in service errors, latency and requests, in error logs and in host memory | Built in; two weeks of history for metrics, 24 hours for logs | Whether the anomaly matters and who is paged for it |
| Watchdog root cause analysis | Links an APM anomaly to one of four kinds of cause | APM, with unified service tagging | Whether the suggested cause is the real one |
| Faulty deployment detection | Compares a new version with earlier ones for new or higher errors | APM and enough earlier deployments | Whether to roll back |
| Anomaly monitors | Alert when a metric departs from its own daily or weekly pattern | A metric you choose; three cycles of history | Which metrics, which algorithm, how sensitive |
| Intelligent Correlation | Groups related monitor alerts into one case | Monitors that page someone or are tagged high priority | How the case is triaged and closed |
| Bits AI investigations | Tests hypotheses against telemetry; ends with a conclusion or marks it inconclusive | Auto-investigate on a monitor, or a person who starts one | Whether to accept the conclusion and act on it |
Datadog states that Watchdog features are built in and need no setup. The set-up is everything around them: tags, services in APM and who receives each alert.
Anomaly detection monitoring: Watchdog and anomaly monitors
Watchdog computes a baseline of expected behaviour for your systems, applications and deployments, and alerts when something departs from it: error rate, latency and request rate in APM, a new or sudden rise in error logs, and host memory, TCP retransmits and metrics from common databases, Kubernetes and AWS services. Metric anomalies need two weeks of history and work best with six, so a new service is quiet at first.
Read more
To choose the metric and sensitivity yourself, anomaly monitors offer three algorithms: basic for metrics with no repeating pattern, agile for seasonal metrics expected to shift, and robust for stable seasonal metrics where a slow shift counts as an anomaly. A seasonal algorithm needs three periods of data, so three weeks for a weekly pattern, such as a Saudi working week with its quieter Friday and Saturday.
Root cause analysis: what Watchdog and Bits AI suggest
When Watchdog detects an APM anomaly, its root cause analysis reports three things: the root cause, a state change behind the problem; the critical failure, where latency or errors first rise; and the impact, the services affected downstream and, with Real User Monitoring, the affected users. It recognises four kinds of root cause: a version change, a traffic increase, an AWS instance failure and running out of disk space. A slow query or a wrong firewall rule is outside that list. Datadog says this kind of analysis helps reduce mean time to recovery; our MTTR glossary entry explains the measure.
Read more
Bits AI goes further. Its investigation agent starts when a monitor set to auto-investigate goes into alert, or when an engineer asks. It forms hypotheses, tests them against metrics, traces, logs and change tracking, and ends with an evidence-backed conclusion or marks the investigation inconclusive, with suggested next steps. Its steps and hypothesis tree stay visible, so an engineer can check its reasoning. Traces let both tools follow a request across services; our Datadog APM page covers how they are collected.
Alert correlation: one case instead of twenty pages
One fault can fire many monitors: the database, the services that call it, the web front end and the synthetic test in front of them. Intelligent Correlation in Datadog Event Management groups related monitor alerts into one case, using infrastructure dependencies and telemetry. It considers only monitors that page someone or are tagged high priority, and without enough telemetry it may build no cases at all.
It is switched on for the whole Datadog organisation, with tag filters. Its cases are where the on-call engineer starts; how they are assigned, escalated and closed belongs to your incident management process.
Relatedincident management
Where people still decide
AIOps changes what an engineer looks at first, not who decides. In our projects four decisions stay with your team:
- What deserves a page. An anomaly is a change, not necessarily a problem. Someone decides which ones wake a person at night.
- Whether the cause is right. Watchdog and Bits AI propose a cause with evidence; an engineer confirms it before acting.
- What changes in production. Datadog lists remediation among Bits AI's capabilities; whether any automated action runs in production is for your change process to decide.
- What the system should learn from. Tags, ownership and monitors are written by people. When they are wrong, the AI groups and blames the wrong things.
Where AIOps helps in practice
- Releases. Faulty deployment detection flags a bad release on a busy banking or e-commerce service while the release team is still watching.
- Slow leaks. A memory leak or a disk filling over days crosses a fixed threshold late; memory anomalies and forecast monitors catch the trend earlier.
- Busy periods. Ramadan evenings and salary days change traffic in ways a seasonal monitor can learn, so a normal peak pages nobody.
- Night-time on-call. A correlated case with a Bits AI investigation attached gives the on-call engineer a starting point, not a list of red monitors.
AIOps in the Kingdom: data, regulation and support
- Where the data goes. As of November 2026 Datadog's documented sites are in the US, Germany, Japan, Australia and the UK, none in the Middle East. The AI features work on telemetry already in your Datadog site, so filter personal data out of logs and traces first; our Datadog data residency guide sets out the options. Bits AI is not offered on Datadog's US government sites.
- Regulation. The National Cybersecurity Authority (NCA) Essential Cybersecurity Controls include logging and monitoring of systems. AI-assisted triage sits on top of that monitoring and does not replace the records auditors expect.
- Support. Interkey's engineers work from Riyadh, in Arabic and English, and tune monitors and correlation with your operations team.
RelatedDatadog data residency guide
What drives the cost of AIOps in Datadog
Watchdog has no separate licence. The cost comes from the data it reads and from Bits AI:
- APM hosts. Root cause analysis and faulty deployment detection need APM on each service analysed.
- Log volume. Watchdog reads ingested logs; volume ingested and indexed sets the log bill.
- Infrastructure hosts. Host and integration metrics come from the Agent, billed per host.
- Bits AI. Priced through Datadog AI Credits; the number of auto-investigated monitors drives usage.
List prices are on our Datadog pricing guide; Interkey quotes licences, set-up and support together.
How Interkey sets up AIOps in Datadog
-
Review today's alerts.
Which monitors fire most, which nobody acts on, which incidents users found first.
-
Fill the telemetry gaps.
APM on key services, filtered logs, and unified service tags.
-
Quote the licences.
Datadog products and AI Credits sized to the services in scope.
-
Replace noisy thresholds.
Anomaly and forecast monitors where fixed thresholds do not fit the traffic pattern.
-
Turn on correlation and investigations.
Intelligent Correlation with tag filters, and auto-investigate where it helps most.
-
Agree who decides.
Paging rules, review of AI conclusions and change approval, in your runbooks.
-
Operate or hand over.
Interkey operates the platform from Riyadh, or hands it over with documentation and stays on as technical support.
Questions buyers ask
Does Datadog Watchdog need to be configured before it finds anomalies?
Datadog states that Watchdog features are built in and need no setup. It does need history: two weeks for metric anomalies and 24 hours for log anomalies. Root cause analysis also needs APM.
Can Bits AI fix a production incident on its own?
Bits AI investigates an alert, reaches a conclusion or marks it inconclusive, and suggests next steps. Datadog also lists remediation among its capabilities, but whether any action runs in production is your decision; we set it up so an engineer approves changes.
What kinds of root cause can Watchdog identify?
Per Datadog's documentation, four: a version change, a traffic increase, an AWS instance failure and running out of disk space. Higher latency on its own is never treated as a root cause.
How is AIOps in Datadog licensed for a company in Saudi Arabia?
Watchdog has no separate licence; you pay for the APM, log and infrastructure products it reads. Bits AI uses Datadog AI Credits. Interkey sells the licences in Saudi Arabia, quoted with set-up and support.
Does AIOps send our monitoring data outside the Kingdom?
The AI features work on what is already in your Datadog site, and as of November 2026 none of Datadog's sites is in the Middle East. Filter personal data out of logs and traces before they are sent.
How long before AIOps starts giving useful alerts?
It depends on how complete your telemetry is and how much history Datadog holds: about two weeks for metric anomalies, three cycles for seasonal monitors. We estimate after reviewing your alerts.
Next
Read next
Next step
Review your alerts for AIOps
Tell us what you monitor today, roughly how many alerts your team receives a week and which incidents users found first. We can show where Watchdog, correlation and Bits AI would help, and quote licences, set-up and support together.
Or directly
+966-11-2180999 [email protected]Tawuniya Towers, North Tower, 7th Floor, King Fahad Highway, Olaya, P.O. Box 56835, Riyadh 11564, Saudi Arabia