skilld
All skills
datadog-labs avatar

/dd-audit

@0d12930 official
by Datadog Labsdatadog-labs/agent-skills176 stars
29

Audit Trail investigations - who changed what, key compromise, cost spike root cause, compliance evidence (SOC 2/PCI), and AI activity auditing.

Ask your Agent

Use this Skill: https://skilld.dev/gh/datadog-labs/agent-skills/dd-audit

This session only. Nothing lands on disk.

SKILL.md

≈39 tokens always: the name and description. ≈870 when used: this file. ≈8.1k more on demand in 6 files.

Datadog Audit Trail

Investigate user activity, configuration changes, access patterns, and compliance evidence using pup audit-logs.

Sub-Skills

Sub-skill Use when
security-investigation "Who changed X?", "What did this user do?", "Show me deletions in the last 24h"
key-compromise "Was this API key compromised?", "What did key XYZ do?", "Investigate suspicious key activity"
cost-spike-investigation "Why did my bill go up?", "What caused this usage spike?", "Investigate LLM cost increase"
compliance-report "Generate SOC 2 evidence", "PCI audit log", "User provisioning report for auditor"
ai-activity-audit "What did the AI assistant do?", "Audit MCP tool calls", "AI governance report"

Prerequisites

pup auth login   # OAuth2 (recommended)
# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

Commands

# List recent events
pup audit-logs list --from 1h --limit 100

# Search with a query
pup audit-logs search --query "@action:deleted" --from 24h

# JSON output for piping to jq
pup audit-logs search --query "@usr.email:alice@example.com" --from 7d -o json | jq '.data[].attributes'

Event Schema Quick Reference

Field Description Example values
@usr.email Actor email alice@example.com
@evt.actor.type How action was taken USER, API_KEY, SUPPORT_USER
@action Verb created, modified, deleted, accessed, login
@evt.name Event category Dashboard, Monitor, Authentication, Access Management
@asset.type Resource type dashboard, monitor, api_key, role, user
@asset.id Resource identifier abc-123
@metadata.api_key.id API key used (if applicable) key_abc123
@metadata.app_key.id App key used (if applicable) app_abc123
@network.client.ip Client IP address 1.2.3.4
@network.client.geoip.country.name Country United States
@network.client.geoip.as.name ASN name Amazon.com
@http.url_details.path API endpoint path /api/v1/dashboard/xyz

Search Syntax

Same Lucene-style syntax as Log Explorer:

Query Meaning
@evt.name:Dashboard Exact field match
@action:deleted Action filter
@usr.email:alice@example.com Specific user
@evt.name:Monitor AND @action:modified Compound
-@action:deleted Negation
@usr.email:* Field exists
@network.client.ip:1.2.3.4 IP filter

Retention

Default retention is 90 days. If querying beyond 90 days, archive to S3/GCS/Azure Blob must be configured. Always check whether the requested time window falls within retention before running a query.

Troubleshooting

Problem Cause Fix
403 Forbidden Missing audit_logs_read scope Add scope to app key in Datadog UI
Empty results Time window outside retention Check archive config; default max is 90 days
Timeout Query too broad Narrow time window or add more filters
No IP data Internal action or pre-enrichment event Not all events have geo data

References

Source: SKILL.md on GitHub

Third-party checks

No alerts14d3 checks · Risk SAFE
  • Gen Agent Trust Hub14d

    The skill provides a set of tools and templates for auditing Datadog environments, including compliance reporting, security investigations, and API key compromise analysis. It utilizes the official Datadog CLI tool ('pup') and APIs for data retrieval and processing. No malicious patterns or security vulnerabilities were identified.

  • Socket14d

    No alerts

  • Snyk14d

    Risk: LOW · No issues

Provenance

Signed by skilld at 0d12930. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 20 hours ago.

Activeupdated 5 months ago

Capability

Other metadata
metadata
{
  "version": "0.1.0",
  "author": "datadog-labs",
  "repository": "https://github.com/datadog-labs/agent-skills",
  "tags": "datadog,audit,audit-trail,security,compliance,dd-audit",
  "alwaysApply": "false"
}

Topics

  • Security
  • API
  • datadog
  • audit
  • audit-trail
  • compliance
  • investigation
  • logging

README badge

README badge for datadog-labs/agent-skills/dd-audit

What it does

Queries Datadog Audit Trail to investigate user activity, configuration changes, and compliance events using the pup audit-logs command. Covers security investigations (who changed what), key compromise auditing, cost spike root cause analysis, SOC 2/PCI compliance reporting, and AI assistant activity tracking.

Generated from the current SKILL.md.

Frequently asked

What time window can I query?
Default retention is 90 days. Queries beyond 90 days require archive configuration to S3/GCS/Azure Blob. Always verify the requested time window falls within retention before running a query.
What permissions do I need?
The API key or app key must have the `audit_logs_read` scope. Use OAuth2 login with `pup auth login` or set DD_API_KEY and DD_APP_KEY with the appropriate scope.
Can I audit AI assistant activity?
Yes. The skill includes an ai-activity-audit sub-skill for auditing MCP tool calls and generating AI governance reports.
What fields can I search on?
You can filter by user email, actor type, action verb, event category, resource type, API/app key ID, client IP, geolocation, and HTTP path using Lucene-style syntax matching the Log Explorer syntax.
What should I do if a query times out?
Narrow the time window or add more filters to reduce the result set scope.

Generated from the current SKILL.md. These answers refresh after source changes.