Explain the lifecycle of an incident in Datadog Incident Management?

An incident is declared - either manually by a responder or automatically triggered from a monitor - creating a structured record with an initial severity, a designated commander, and an auto-provisioned communication channel (commonly a dedicated Slack channel) to centralize discussion.

As the incident progresses, the timeline auto-populates with relevant context: monitor state changes, graphs pulled in by responders, and manually added comments, building a chronological record of what was observed and done without requiring anyone to separately write it all down after the fact.

The incident moves through defined states - typically something like Active, then Stable once impact is contained but not fully resolved, then Resolved once the underlying issue is actually fixed - and severity can be adjusted as understanding of impact evolves during the response.

Throughout, responders can attach related resources - the triggering monitor, relevant dashboards, or a notebook - directly to the incident record, so the full investigative context stays linked rather than scattered across separate tools.

Once resolved, the accumulated timeline feeds into a postmortem template, pre-populated with the incident's actual chronology, which teams then annotate with root cause analysis and follow-up action items - turning documentation that would otherwise be reconstructed from memory into something largely already captured in real time.

flowchart LR
  A[Incident declared: manual or monitor-triggered] --> B[Commander assigned, channel provisioned]
  B --> C[Timeline auto-populates: monitors, graphs, comments]
  C --> D{State}
  D -- Active --> C
  D -- Stable --> C
  D -- Resolved --> E[Postmortem generated from timeline]