Datadog · Workflow automation
Workflow automation in Saudi Arabia: Datadog runbooks that start from an alert, with approvals
Workflow automation turns the steps an engineer repeats after an alert into a workflow that Datadog runs by itself: collect the facts, try the agreed fix, ask a person to approve anything risky, and record what happened. In Datadog Workflow Automation a monitor, a security signal, an incident, a schedule or a person can start a workflow, and each step calls an action in your cloud, your chat tool or your ticketing system. Interkey is an official Datadog partner in Saudi Arabia: it sells the licences, writes and tests the runbooks with your teams, and provides technical support from Riyadh.
In short
- What it does: runs a runbook as a workflow when an alert fires, a security signal appears or a person presses Run, and keeps a record of every run.
- Where people stay in charge: an approval step in Slack or Microsoft Teams stops the workflow until someone chooses Approve or Reject.
- How it is billed: Datadog lists Workflow Automation per 100 workflow executions per month. See our Datadog pricing guide.
- What Interkey does: licences, the runbooks themselves, connections and permissions, testing, and technical support.
At a glance: what can start a Datadog workflow
A workflow can have several triggers. Most of them run only once the workflow is published.
| Trigger | What starts the run | Typical use |
|---|---|---|
| Monitor | The monitor alerts and its notification message mentions the workflow as @workflow-name | Alert auto-remediation: collect diagnostics, restart a service, open a ticket |
| Security | A Security Notification Rule matches a signal or finding, or an analyst runs it from Cloud SIEM | Security response: enrich the signal, ask for approval, contain |
| Incident | An incident is declared or updated, on a schedule, or by hand from the incident | Open the chat channel, page the owner, post status updates |
| Scheduled | A set time and frequency, run as a service account | Routine checks, clean-up and reports |
| Manual, dashboard or Slack | A person presses Run, uses a dashboard widget or the /datadog workflow command | Runbooks an engineer starts on purpose |
| API or GitHub | A call to the workflows API, or a webhook from a repository | Start a workflow from a pipeline or another system |
Datadog workflows: what workflow automation does
A workflow is a sequence of steps drawn on a canvas. Each step is an action: restart a Kubernetes deployment, send a Slack message, create a Jira issue, call an internal API, or transform data in a short JavaScript step. Datadog states that its action catalogue holds over 2,000 actions. Flow-control steps add the logic a runbook needs: if conditions, switch statements, loops, and sleep.
Read more
Every run is recorded with its inputs and each step's result. A workflow runs as its owner, as the user who started it, or as a service account; runs that no person starts, such as schedules, need the owner or a service account. Datadog's blueprints, ready-made workflows for incidents, change management, security and remediation, are a starting point rather than a finished runbook.
Alert auto-remediation: runbooks triggered by monitors
Most alerts already have a known first response: a disk fills and someone clears old files, a pod stops answering and someone restarts it. Alert auto-remediation means the monitor starts that response as soon as it alerts. You add the workflow to the monitor by mentioning it in the notification message, and the monitor can pass values such as the host, service or tag into the workflow's inputs.
Read more
A good remediation workflow does three things in order. First it gathers evidence: recent logs, the last deployment, the state of the resource. Then it checks that the fix is safe, for example that the same fix has not already run in the last hour. Only then does it act, and it posts what it did to the on-call channel and the monitor's history. Each step can retry at a set interval and up to a set number of times, and an error path decides what happens when a step still fails, for example paging the engineer on call instead of trying again.
The monitors themselves come first. A workflow attached to a noisy monitor repeats the noise faster, so we review thresholds and grouping before automating anything; our AIOps page covers how Datadog reduces alert volume.
Runbook automation with approvals in Slack or Microsoft Teams
Rolling back a release or blocking a cloud resource can be correct and still need a person's decision. Datadog's "Make a decision" action, available for Slack and Microsoft Teams, posts a message with Approve and Reject buttons and stops the workflow until someone answers. Each answer leads to its own branch, and the workflow knows who responded, so a JavaScript step can check that person against the list of engineers allowed to approve.
Read more
This is how runbook automation usually grows in practice: a workflow that only collects facts and suggests a fix, then one that acts after approval, and only for the safest, best-understood cases one that acts alone. Steps can also wait for a condition, such as a service returning to healthy, up to a maximum wait.
Incidents connect here too. An incident trigger can open the channel, invite the service owner and post updates while the team works; our incident management page describes the rest of that process.
Relatedincident management page
Security response: SOAR-style workflows for Cloud SIEM
Security teams use the same engine for response. A workflow with a Security trigger runs when a Security Notification Rule matches a signal or finding, or an analyst runs it by hand from a Cloud SIEM signal. Datadog's own documented examples include a workflow that finds a public Amazon S3 bucket, asks for approval in Slack and then turns on Block Public Access, and one that creates a Jira issue for each finding and assigns it by the team tag.
Read more
For a security operations team this covers much of what is usually bought as SOAR: enrichment, ticketing, an approval and a containment step, in the platform where the signals already are. It does not replace your response plan, your case management or the analyst who decides whether an account is really compromised. Our Datadog Cloud SIEM page covers detection and the Content Packs that ship with response workflows.
RelatedDatadog Cloud SIEM page
Reaching systems inside your network
Many runbooks need to act on systems that are not on the internet: an internal API, a database, a cluster in your data centre. Datadog's private action runner runs inside the Datadog Agent or as a standalone container in your network, opens an outbound connection to Datadog and needs no inbound access. An allowlist in the Agent's configuration limits which actions it may run. We agree with your security team which actions each workflow may use.
Data residency and local support in Saudi Arabia
Datadog is SaaS, and as of November 2026 its documented sites are in the US, Germany, Japan, Australia and the UK, none in the Middle East. Workflow inputs and step results can carry hostnames, user names and log lines, so Interkey designs each workflow to pass only what a step needs and keeps personal data out of messages and tickets. For regulated workloads we follow the guidance of the National Cybersecurity Authority that applies to you. Support comes from Interkey's engineers in Riyadh, in Arabic and English.
How a workflow automation project runs with Interkey
-
List the repeated responses.
The alerts and signals your team answers the same way each time, and how long each takes.
-
Quote the licences.
Workflow Automation and the Datadog products it builds on, quoted with set-up and support.
-
Set connections and permissions.
Service accounts, connections and the private action runner, reviewed by your security team.
-
Build in stages.
Collect facts first, then act after approval, then act alone only where everyone agrees it is safe.
-
Test on non-production.
Each workflow runs against a test environment and a forced failure before it touches production.
-
Review the runs.
After the first weeks: what ran, what was rejected, what failed and why.
-
Operate or hand over.
Interkey maintains the workflows from Riyadh, or hands them over and stays on as technical support.
What drives the cost and the timeline
Datadog bills Workflow Automation by executions, listed per 100 workflow executions per month, and a workflow that calls another as a step counts as a new run. A noisy monitor therefore costs more to automate, one more reason to tune monitors first. Our Datadog pricing guide covers the other Datadog products.
The timeline is an estimate, not a promise. A first workflow that collects diagnostics can run within days; a set of tested runbooks with approvals usually takes a few weeks. The drivers are how many runbooks are already written down, how many systems the workflows must reach, and how quickly your change and security reviews approve new permissions.
Questions buyers ask
Can a Datadog monitor fix the problem it alerts on without waking anyone?
Yes, if the fix is known and safe. The monitor starts a workflow that gathers evidence, applies the agreed fix and posts what it did. Where the fix carries risk, the workflow asks for approval first.
How do approvals work in Datadog Workflow Automation?
A "Make a decision" step posts Approve and Reject buttons in Slack or Microsoft Teams and waits. Each answer follows its own branch, and the workflow can check that the person who answered is allowed to approve.
Can Datadog workflows replace a separate SOAR tool for our SOC?
For many teams it covers enrichment, ticketing, approval and containment on Cloud SIEM signals. Whether it is enough depends on your case management and response plan, which we review with you first.
Can workflows act on servers inside our data centre in Saudi Arabia?
Yes, through Datadog's private action runner, which runs in your network and connects outward to Datadog, so no inbound access is opened. An allowlist limits which actions it may run.
How is Datadog Workflow Automation licensed in KSA?
Datadog lists it per 100 workflow executions per month. Interkey sells the licences in Saudi Arabia and quotes them with set-up and technical support from Riyadh in one offer.
How long does it take to automate our first incident runbooks?
As an estimate, a first diagnostic workflow can run within days and a tested set with approvals takes a few weeks. It depends on how many runbooks are written down and on your change reviews.
Next
Read next
Next step
Automate your alert runbooks with Datadog
Tell us which alerts or signals your team answers the same way every time, which systems the fix touches, and whether you use Datadog today. We can quote the licences, the runbooks and technical support together.
Or directly
+966-11-2180999 [email protected]Tawuniya Towers, North Tower, 7th Floor, King Fahad Highway, Olaya, P.O. Box 56835, Riyadh 11564, Saudi Arabia