Brief Customer Success on every customer-impacting Datadog incident

Build an agent workflow that briefs our Customer Success team every time Datadog declares a new customer-impacting incident, or upgrades an existing incident to customer-impacting.

Trigger: an incoming webhook from Datadog Incident Workflows / the Datadog Webhooks integration. The webhook payload contains the incident UUID, severity, customer impact status, and the impacted services. Fire on incident creation and on any update where customer impact changes to true.

When the webhook fires, the agent should do the following:

1) Call the Datadog Get an Incident operation using the incident UUID from the webhook payload. Capture severity, customer impact status, impacted services, the incident detected/created timestamp, and the public incident link.

2) Call the Datadog Search Logs (POST) operation, scoped to the impacted services and to the incident time window (incident start through now, or through resolution if resolved). Look for error and warn level log entries that carry a customer identifier field. Common field names: tenant_id, account_id, workspace_id, customer_id, org_id. Collect the distinct identifiers and a rough count of how many error events each one had.

3) If zero customer identifiers are extracted, stop and post nothing. This is the silent-skip path for internal-only incidents (background workers, infra-only services). Do not post a "no customers affected" message. Just exit.

4) For each distinct customer identifier, call HubSpot Search Companies. Try to match the identifier against the company's domain, name, or a custom property your team uses to store tenant ids. Pull back the company name, the account owner's name and email, and the annual revenue / ARR property. If a match is not found, keep the raw identifier in the output marked as unresolved.

5) Rank the affected customers by ARR descending (resolved customers first, then any unresolved identifiers at the bottom).

6) Call the Slack Bot Send a Message operation to post a single message to the CS war-room channel. The user should be able to set this channel during setup. The message should contain: the incident title, severity, current status, and a link back to the Datadog incident; a ranked table or bullet list of affected customers (company name, ARR, error event count, account owner @-mentioned by Slack handle when known); and a short 2 to 3 sentence drafted customer comms blurb that account owners can copy, personalize, and send. The blurb should acknowledge the issue plainly, set rough expectations, and not promise a specific ETA unless the incident has one.

Make all three connections (Datadog, HubSpot, Slack Bot) configurable, and let the user pick the Slack channel and the HubSpot company property that holds their tenant identifier during setup. Use Slack Bot, not the user-token Slack integration, since this is workspace automation that should be authored by a bot.

This is distinct from our existing Datadog prompts. The morning Linear triage runs on a cron and is aimed at engineering. The Zendesk enrichment is ticket-triggered and is aimed at support. The weekly Notion retro is a weekly engineering write-up. This one is per-incident, fires the moment Datadog flips an incident to customer-impacting, and is aimed at the GTM side of the house so account owners can get out ahead of customers before customers come to them.