Your new workforce won't be all human. Join the
conference to learn the new workforce OS.
request invite
TL;DR: An AI SRE wired from Datadog to Atomicwork to Slack does the first ten minutes of an incident, correlation, war room, routing, before a human joins. In this ANZ e-commerce customer story, that cut incident MTTR by 8x. Read-only analysis and coordination; humans remediate.
Related reading: Your on-call now has an AI buddy.
An ANZ e-commerce platform reduced average incident MTTR from 3 hours to 22 minutes by closing the loop between Datadog, their ITSM, Slack, and an AI RCA engine. That is an 8x reduction, not from better engineers, but from eliminating the manual handoffs between monitoring, ticketing, and postmortem that every team does by hand today.
If your team uses Datadog for monitoring, Slack for collaboration, and a ticketing tool for governance, you already know the failure mode: context lives in three places and nobody bridges them. Datadog shows the metrics, the logs, the spike, but it doesn't know your service owner, your change history, or your approval chain. Slack is where the war room happens, decisions get made, mitigations land, but the moment the channel is archived, the institutional memory is gone. The ticket is supposed to be the system of record, but in practice it gets a single line written twelve hours after the fact by someone who has already forgotten half of what happened.
The result: every incident is fixed from scratch. Patterns aren't seen. The postmortem is a "will write tomorrow" message that never comes.
One of our customers is an ANZ e-commerce retailer running on GCP with Datadog as their monitoring layer. Their engineering team was good. Their incident tooling was fragmented. Datadog fired alerts into Slack. Engineers diagnosed in Slack. Tickets got created manually, sometimes hours later, with whatever context someone remembered to paste in.
The postmortem problem was worst. After every major incident, the question from IT leadership was the same: where's the RCA document? The answer was usually: we'll write it up by end of week. It almost never happened.
We built them a closed-loop incident agent sitting between Datadog, Atomicwork, Slack, and Claude.
When a Datadog monitor fires, its webhook hits the agent. The payload includes the alert title, query, scope, a log sample, correlated alerts, and tags. The agent passes all of this to Claude with one job: produce structured triage. What comes back: priority (P1/P2/P3 based on customer-flow impact, not just severity), a hypothesis with confidence level and counterfactual, a runbook with copy-pasteable commands using actual values from the alert, an investigation plan with numbered steps and if/then branches, similar past incidents searched live from the ITSM knowledge base, dashboard URLs constructed from alert tags, and ownership and escalation routing.
The whole thing lands as the ticket description. Atomicwork also picks the right category, subcategory, and routing group, no human hand-off required. In the demo, the alert was a Route 53 / synthetic DNS issue, and the incident hit the IT Ops queue within seconds of the Datadog monitor firing.
Atomicwork's native Slack integration creates a war-room channel automatically. A workflow rule fires a webhook to the agent, which looks up the channel ID, joins it, and posts the full AI triage as a pinned Slack message, visible to everyone the moment they're added. Anyone joining the war room sees the full triage at the top. No one has to ask "what's happening?" They already know.
This is the part most incident tooling gets wrong, or skips entirely. Slack Events API delivers every channel message to the agent in real time. The agent filters out its own bot posts, resolves Slack user IDs to real names, and posts each human message as an activity note on the ticket, timestamped, attributed, permanent. Without it, the ticket has a creation timestamp and a resolution timestamp, with nothing in between. With bidirectional sync, the ticket becomes a durable, searchable transcript of every decision made during the incident.
When the engineer marks the ticket Resolved, a workflow fires another webhook. The agent pulls all activity notes from the ticket and the full Slack channel history with sender names resolved, and hands the combined transcript to Claude with a strict postmortem structure: a summary in plain English, a timeline with real names and timestamps, root cause and contributing factors (separated), customer impact in business terms, mitigation actions, preventive actions, detection improvements, and lessons learned.
The output gets rendered as a Word document attached to the ticket, posted as a searchable HTML activity note, posted in the Slack war room, and pinned in the channel. From "Resolved" click to "RCA available" is under 60 seconds.
Datadog launched Bits AI SRE in late 2025, an autonomous investigator that runs inside Datadog when an alert fires and posts a hypothesis to Slack before the on-call engineer logs in. It's genuinely good. Use it. But investigation alone isn't operational. Bits AI SRE does not create an ITSM incident record, generate a change record, cluster cross-incident patterns into a problem record, produce executive reporting, handle the L1/L2 service portal, or enforce ITIL governance and audit trail. The two are complementary. Datadog investigates inside Datadog. Atomicwork routes that finding into governance, accountability, and institutional memory.
MTTR drops. In early data, average MTTR went from about 3 hours to about 22 minutes, not because alerts fire faster, but because triage, war-room context-setting, and the postmortem are no longer human bottlenecks. The postmortem actually gets written, every time, in real time, with the real conversation captured, so patterns become visible because every RCA is queryable and indexed. Junior engineers operate at senior level, because the AI surfaces commands, similar past incidents, and the hypothesis with confidence, turning institutional knowledge into a real-time co-pilot.
How does an AI SRE reduce incident MTTR? It removes the manual handoffs between monitoring, chat, and ticketing. Triage, war-room context, and the postmortem are generated automatically, so engineers spend their time resolving the incident rather than coordinating it.
What does the AI SRE integration connect? It wires together your monitoring tool (Datadog), your ITSM platform, your chat tool (Slack or Teams), and an AI engine, so an alert flows end to end into a structured incident, a war room, and a written RCA.
How is this different from Datadog Bits AI SRE? Bits AI SRE investigates inside Datadog and posts a hypothesis. It does not create an ITSM incident, enforce governance, or produce the postmortem record. The two are complementary: Datadog investigates, the ITSM layer routes that into accountability and institutional memory.
How long does it take to set up? Typical build time is about two weeks, including ITSM workflow setup and chat app permissions.
If your team is still copy-pasting between Datadog, Slack, and your ticketing tool during incidents, the loop can close. Wire them once, webhooks on alert and resolution, Slack Events API, an AI model for synthesis, document generation, ITSM custom fields, and the coordination work that eats the first hour of every incident happens before a human even opens the alert.
