Incident management in Saudi Arabia: from alert to resolved incident with Datadog

In many Saudi IT departments the monitoring sits in one tool, the on-call rota in a spreadsheet, the discussion in a chat group and the record in a ticket written after the event. When a service fails at night, the first minutes go into finding who is on duty.

Datadog puts these steps beside the data that raised the alarm. The paged engineer opens the dashboards, traces and logs the alert came from, and every change is written to the incident's timeline. If you already run Datadog, as described on our Datadog implementation page, incident management extends the same platform.

Good incidents start with good alerts: see our Datadog alerting page for monitors whose Pages mean something, and the SLO monitoring page for deciding which failures deserve an incident.

On-call with Datadog On-Call

Datadog On-Call is organised around teams. Each team has schedules that say who responds at which times, escalation policies that say who is paged next if nobody acknowledges, and routing rules that let a team treat different kinds of events differently, for example holding low-priority Pages until support hours begin.

A monitor, an incident or a security signal creates a Page for the team. It moves from Triggered to Acknowledged to Resolved, and can be reassigned or promoted to an incident. Each person sets their own contact methods: push notifications through the Datadog mobile app, email, SMS and phone calls. Datadog notes that phone number support varies by country, so check that the numbers your engineers use are covered before the first night on call.

The same features serve different situations. These are typical patterns, not projects:

• A customer-facing service fails out of hours. The monitor pages the primary on-call engineer, escalates to the secondary after the agreed delay, and the engineer declares a SEV-2 with a channel opened in Microsoft Teams or Slack.
• A failure crosses teams. Application, database and network teams join one incident and work from the same traces and logs.
• The business needs updates. A communications lead sends notifications and updates an internal or public status page, while engineers keep working.
• Management asks what changed. Incident Analytics shows whether incidents are fewer and shorter each quarter.

Datadog bills On-Call and Incident Management per seat, per month. They are separate products, or one Incident Response bundle that covers both; the bundle cannot be combined with the separate products. Each month is billed on the highest number of seats assigned at the same time, and use above your commitment is billed at the on-demand rate.

• On-Call seat: needed by people on a schedule, in an escalation policy, or set up to receive Pages. Viewing schedules and Pages is free.
• Incident Management seat: needed to change or delete an incident, add to its timeline, or hold a user-defined role. Creating, viewing or joining an incident, and posting in its connected channel, need no seat.

So the cost follows the number of active responders, not the size of the organisation. Our Datadog pricing guide explains the wider bill; Interkey quotes seats with set-up and support.

Three points come up in most Saudi projects:

• Where the data goes. Datadog is SaaS, and as of November 2026 its documented sites are in the US, Germany, Japan, Australia and the UK, none in the Middle East. Incident records hold names, phone numbers and what responders write, so agree what belongs in them. Our Datadog data residency guide sets out the options.
• Phone paging. SMS and voice depend on Datadog's list of supported countries; push notifications and email do not.
• Regulation. The National Cybersecurity Authority (NCA) Essential Cybersecurity Controls include managing cybersecurity incidents. If security signals feed the same process, involve your security team in the severity definitions. The authority's own text is the reference.

Interkey's engineers work from Riyadh, in Arabic and English, and can write runbooks and postmortem templates in both languages.

RelatedDatadog data residency guide