List Datadog monitors with filtering. Use for questions like 'show alerting monitors', 'what monitors are in warning state', or 'monitors tagged with team:platform'. Filter by groupStates: 'alert', 'warn', 'no data', 'ok'. Use get-monitor for a single monitor's full details.

Get full details for a specific monitor by ID. Use after get-monitors to dive deeper into a specific monitor's configuration, thresholds, query, and current state. Returns complete monitor definition.

List all Datadog dashboards. Use to answer 'what dashboards exist', 'find dashboard for API metrics', or to get dashboard IDs for get-dashboard. Returns dashboard names, IDs, and URLs.

Get full dashboard definition by ID. Returns all widgets, queries, and layout. Use after get-dashboards to explore a specific dashboard's contents and understand what metrics/data it displays.

Search for available Datadog metrics by name pattern. Use to discover metrics like 'what CPU metrics exist' or 'find metrics for service X'. Parameter q searches metric names (e.g., q='aws.ec2' finds all EC2 metrics).

Get metadata for a specific metric name. Returns type (gauge/count/rate), unit, description, and integration. Use when you need to understand what a metric measures, e.g., 'what does system.cpu.user mean'.

Query Datadog events within a time range. Events include deployments, alerts, configuration changes, and comments. Use for 'what happened yesterday', 'show deployment events', or correlating incidents with changes. Requires start/end as Unix timestamps.

List Datadog incidents for incident management. Use for 'show active incidents', 'what incidents happened this week', or 'find incidents related to payments'. Includes severity, status, commander, and timeline.

Search and retrieve log entries from Datadog. Use for 'find errors in auth service', 'show logs from last hour', or investigating issues. Query syntax: 'service:web-app status:error', time range: 'now-15m' to 'now'. Returns actual log messages. Use aggregate-logs for counts/stats instead.

Compute statistics and aggregations on logs. Use for 'how many errors per service', 'count logs by status', or 'average response time from logs'. Supports count, avg, sum, min, max, percentiles. Use search-logs to see actual log content instead.

List infrastructure hosts reporting to Datadog. Use for 'show production hosts', 'which hosts are muted', 'hosts running agent version X'. Returns host names, IPs, apps, agent info, and mute status. Essential for infrastructure visibility during incidents.

List scheduled maintenance downtimes in Datadog. Use for 'are there any active downtimes', 'what's scheduled for maintenance', 'why is this monitor muted'. Shows scope, schedule, and duration. Critical for on-call to understand muted monitors.

List Service Level Objectives (SLOs). Use for 'show all SLOs', 'SLOs for team platform', 'which SLOs are at risk'. Returns SLO names, targets, and current status. Use get-slo for detailed error budget and history of a specific SLO.

Get detailed SLO information by ID. Returns error budget remaining, burn rate, target vs actual, thresholds, and configured alerts. Use after get-slos to understand a specific SLO's health and history.

Search APM spans/traces. Use for 'find slow requests', 'show errors in payment service', or investigating latency. Query syntax: 'service:web status:error @duration:>1s'. Returns individual spans with trace IDs. Use get-trace for full trace context.

Compute statistics on APM spans. Use for 'p99 latency by service', 'error rate per endpoint', 'request count over time'. Supports count, avg, sum, min, max, percentiles (pc75/90/95/99). Use search-spans to see actual span details.

List all APM-instrumented services. Use to discover traced services, find service names for span queries, or get an overview of your distributed system. Returns service names and their environments.

Get all spans for a specific trace ID. Use after search-spans to see the full request flow across services. Returns all spans in the trace with timing, service, resource, and error information.

List or search Datadog security findings (Cloud Security Management). Use to retrieve findings with a query and optional pagination cursor. Requires security_monitoring_findings_read or appsec_vm_read (OAuth apps still require security_monitoring_findings_read).

Get a legacy CSPM/CIEM finding by ID (posture_management). Note: this endpoint uses the legacy data model. Requires the security_monitoring_findings_read scope.

List legacy CSPM/CIEM posture management findings (misconfigurations and identity risks). Useful for compliance use-cases. Requires the security_monitoring_findings_read scope.

Query time-series metric data from Datadog. The backbone of observability — use for 'CPU usage over last hour', 'request rate for web service', or any metric query. Query syntax: 'avg:system.cpu.user{host:web-1}'. Returns data points with timestamps.

List Datadog Synthetic tests (API and browser). Use for 'show all synthetic tests', 'what API tests exist', or 'which tests are failing'. Returns test names, types, status, locations, and tags.

Get execution results for a specific Synthetic test. Use after get-synthetic-tests to see pass/fail history, response times, and probe locations. Returns individual check results with timing data.

Search Real User Monitoring (RUM) events. Use for 'frontend errors in production', 'slow page loads', 'user session analysis'. Query syntax similar to logs: '@type:error @application.id:abc'. Returns user sessions, views, actions, and errors.

List all RUM applications configured in Datadog. Use to discover which frontend apps are monitored, get application IDs for RUM queries, or see who created them. Companion to search-rum-events.

Search Error Tracking events across services. Use for 'what errors are happening in production', 'error groups for payment service', 'new errors this week'. Returns error groups with counts, first/last seen, and affected services.

List containers monitored by Datadog. Use for 'show running containers', 'containers for web service', 'container status by image'. Returns container names, images, tags, state, and start time.

Get all tags associated with hosts. Use for 'what tags are on my hosts', 'which hosts have team:platform tag', or to understand host groupings. Returns a map of tag names to host lists.

Search Datadog organization audit events. Use for 'who changed this monitor', 'what config changes happened today', 'audit trail for user X'. Returns timestamped events with actor, action, and affected resource.

Get historical SLO data over a time range. Use after get-slo to see 'SLO performance last 30 days', 'error budget consumption over time', or 'SLI trend for checkout service'. Returns SLI values, thresholds, and time range data.

List Datadog notebooks. Use for 'show investigation notebooks', 'find notebooks by team', or 'recent notebooks about outage'. Notebooks are collaborative documents used during incidents and investigations.

Get hourly usage data by product family. Use for 'how many infra hosts this month', 'log ingestion volume', 'APM usage trends'. Returns usage records with timestamps for billing and capacity planning.

List all log processing pipelines. Use for 'how are logs being processed', 'which pipelines are active', 'what parsing rules exist'. Returns pipeline names, filters, processors, and enabled status. Essential for understanding log processing configuration.

List all log indexes and their configuration. Use for 'where are logs being stored', 'what retention is configured', 'which logs are being excluded'. Returns index names, filters, retention days, daily limits, and exclusion filters.

Get Database Monitoring query samples. Use for 'slow database queries', 'what queries are running on postgres', 'DB performance issues'. Returns query samples with execution time, affected rows, and database context.

Aggregate RUM events with compute operations (count, avg, sum, min, max, percentile) and group-by facets. Use for 'RUM page load times by country', 'error count by browser', 'average session duration by app version'.

Get total number of active and up hosts. Use for 'how many hosts are running', 'infrastructure host count', 'active host summary'.

List running processes with optional filtering by search term or tags. Use for 'what processes are running', 'find java processes', 'process list for host'.

List service definitions from the Datadog Service Catalog. Use for 'what services exist', 'service catalog', 'list all registered services'.

Get a single service definition by name from the Service Catalog. Use for 'show service X details', 'what team owns service Y', 'service definition for Z'.

List CI pipeline events (pipeline runs/executions). Use for 'recent CI builds', 'failed pipelines', 'CI pipeline status', 'deployment history'.

Aggregate CI pipeline analytics with compute operations. Use for 'average pipeline duration', 'failure rate by pipeline', 'CI performance trends'.

List teams in the Datadog organization. Use for 'what teams exist', 'team structure', 'find team by name'.

List users in the Datadog organization. Use for 'who has access', 'list all users', 'find user by email'.

Search security monitoring signals (threat detections, security alerts). Use for 'recent security alerts', 'threat detections', 'security signal search'.

List all custom dashboard lists. Use for 'what dashboard lists exist', 'organized dashboards', 'dashboard collections'.

Search metrics by name pattern with volume and ingestion data. Use for 'find metrics matching pattern', 'metric ingestion volume', 'what metrics are configured'.

List RBAC roles in your Datadog organization

List all available permissions in Datadog

Get all log-based metric configurations

Get all span-based metric configurations from APM

Get log archive configurations showing where logs are stored

Get service dependency graph for APM services in a given environment

List service scorecard rules for evaluating service quality

List scorecard rule evaluation outcomes for services

Search Datadog cases for incident investigation

Get reusable dashboard widget templates (Powerpacks)

Get log index configurations including retention and exclusion filters

Get log processing pipeline configurations

Search Datadog audit logs for configuration changes, user actions, and API calls

Get Datadog hourly usage by product family for cost analysis

List Datadog-monitored containers with their metadata and health status

Search Datadog error tracking issues for user-facing errors and exceptions

Get details of a Datadog error tracking issue (user-facing error/exception) by ID

List Datadog notebooks (investigation documents, runbooks, postmortems)

Get a specific Datadog notebook by ID with all cells and content

List Datadog security monitoring detection rules

List Datadog API keys for key management and security audit

Get action items/todos for a specific Datadog incident

List AWS accounts integrated with Datadog

List network devices monitored by Datadog NDM with filtering and pagination

Get Cloud Security Management coverage across cloud accounts

Search Datadog incidents with advanced filtering by severity, status, and time range

List cloud cost management budgets for tracking team spending

List security vulnerability findings with filtering by tool, type, severity, and status

Aggregate network connection analytics with grouping and filtering

List Datadog workflow automations for incident response and remediation

List monitor notification routing rules showing who gets alerted

Get top custom metrics by average hourly count for cost and cardinality analysis

List CSM Threats agent rules for workload security monitoring

List DORA metric deployments for tracking deployment frequency and lead time

List Datadog fleet agents with version, OS, and status information

List all SLO corrections (status adjustments) across your organization. Shows maintenance windows and planned downtime exclusions that affect SLO calculations.

Get Datadog IP ranges used by agents, APIs, APM, logs, process collection, synthetics, and webhooks. Useful for firewall/allowlist configuration.

Get the ordered list of log pipeline IDs, showing the processing order for log pipelines.

Get the ordered list of log archive IDs, showing the priority order for log archiving.

Search and filter SLOs by query string. Supports pagination and faceted search for finding specific SLOs by name, tags, or other attributes.

Get estimated cost data for your Datadog usage. Filter by date range and view type (sub_org, summary). Useful for cost monitoring and budget planning.

List all Synthetics global variables used across synthetic tests for shared configuration like URLs, credentials, and test data.

List scheduled downtimes (v2 API). Filter by current/upcoming schedules. Shows muted monitors, scopes, and schedule details.

List all span-based metrics (APM custom metrics) configured for generating metrics from APM spans.

Get monitor configuration policies that enforce tag and setting requirements on monitors across your organization.

List available Synthetics testing locations (both managed by Datadog and private). Useful for configuring where synthetic tests run.

List all log-based metrics configured for generating custom metrics from log data.

Get your Datadog organization info including name, plan, public ID, and settings. Essential for understanding account configuration.

Get the total number of active and up hosts in your Datadog account. Quick health check for infrastructure scale.

List all configured webhook integrations. Useful for auditing alert routing and notification channels.

List Synthetics private locations for internal testing. Shows private location IDs, names, and tags.

List security monitoring detection rules with pagination. Shows enabled/disabled rules, names, and types.