skilld
All skills
datadog-labs avatar

/dd-audit

@0d12930 official
by Datadog Labsdatadog-labs/agent-skills176 stars
29

Audit Trail investigations - who changed what, key compromise, cost spike root cause, compliance evidence (SOC 2/PCI), and AI activity auditing.

Ask your Agent

Use this Skill: https://skilld.dev/gh/datadog-labs/agent-skills/dd-audit

This session only. Nothing lands on disk.

compliance-reportreferencescontrol-mapping.md

≈944 tokens on demand. Your agent reads this file only when SKILL.md points to it.

Compliance Control → Audit Trail Query Mapping

Scope Boundary

Datadog Audit Trail documents actions within the Datadog platform:

  • Who logged in, from where
  • Who changed monitors, dashboards, log pipelines, integrations, roles, API keys
  • What the Bits AI assistant did on behalf of users

It does not document:

  • Actions within systems that Datadog monitors (AWS, GCP, application servers)
  • Content of data ingested by Datadog (logs, traces, metrics values)
  • Network activity between user systems and Datadog

SOC 2 Trust Services Criteria

Control Description Audit Trail Query Fields Used
CC6.1 Logical access controls implemented Review role assignments @evt.name:"Access Management" @asset.type:role
CC6.2 User registration and deprovisioning User lifecycle events @evt.name:"Access Management" @asset.type:user @action:(created OR deleted)
CC6.3 Role-based access Permission change log @evt.name:"Access Management" @asset.type:role
CC6.6 Logical access boundaries Failed logins, geo anomalies @evt.name:Authentication @action:login @status:error
CC6.8 Prevent unauthorized access API key management @evt.name:Authentication @asset.type:api_key
CC7.2 System monitoring — anomaly detection Privileged/support access @evt.actor.type:SUPPORT_USER
CC7.3 Event response Changes during incident window Time-scoped @action:modified + @evt.name filter
A1.1 Availability monitoring Monitor create/delete events @evt.name:Monitor

PCI DSS Requirement 10 — Audit Logging

Req Description Audit Trail Query PCI Field Mapping
10.2.1 Access to cardholder data Dashboard/resource access events @http.method:GET @asset.type:dashboard
10.2.2 Actions by root/privileged users Support user and org admin events @evt.actor.type:SUPPORT_USER
10.2.3 Access to audit trail Audit Trail config events @evt.name:"Audit Trail"
10.2.4 Invalid access attempts Failed authentication events @evt.name:Authentication @status:error
10.2.5 Use of identification/auth mechanisms All login events @evt.name:Authentication @action:login
10.2.6 Initialization/stopping of audit logs Audit retention setting changes @evt.name:"Audit Trail" @action:modified
10.2.7 Creation/deletion of system objects All create/delete events @action:(created OR deleted)
10.3.1 User identification @usr.email field Present on all user-initiated events
10.3.2 Event type @action, @evt.name fields Present on all events
10.3.3 Date and time timestamp field ISO 8601 UTC on all events
10.3.4 Success/failure indication @status field info/error/warn
10.3.5 Origination of event @network.client.ip field Present on most events
10.3.6 Identity of affected data/component @asset.type, @asset.id fields Present on resource events
10.7 Retain audit logs ≥12 months Check archive config Default 90 days — must configure archive

Retention Requirements by Framework

Framework Required retention Datadog default Gap?
SOC 2 Auditor discretion (typically 12 months) 90 days Yes — configure archive
PCI DSS 12 months minimum 90 days Yes — configure archive
ISO 27001 3 years typical 90 days Yes — configure archive
HIPAA 6 years 90 days Yes — configure archive

To configure archive: Datadog UI > Security > Audit Trail > Configure > Archive to S3/GCS/Azure Blob.

Source: SKILL.md on GitHub

Third-party checks

No alerts14d3 checks · Risk SAFE
  • Gen Agent Trust Hub14d

    The skill provides a set of tools and templates for auditing Datadog environments, including compliance reporting, security investigations, and API key compromise analysis. It utilizes the official Datadog CLI tool ('pup') and APIs for data retrieval and processing. No malicious patterns or security vulnerabilities were identified.

  • Socket14d

    No alerts

  • Snyk14d

    Risk: LOW · No issues

Provenance

Signed by skilld at 0d12930. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated 5 months ago

Capability

Other metadata
metadata
{
  "version": "0.1.0",
  "author": "datadog-labs",
  "repository": "https://github.com/datadog-labs/agent-skills",
  "tags": "datadog,audit,audit-trail,security,compliance,dd-audit",
  "alwaysApply": "false"
}

Topics

  • Security
  • API
  • datadog
  • audit
  • audit-trail
  • compliance
  • investigation
  • logging

README badge

README badge for datadog-labs/agent-skills/dd-audit

What it does

Queries Datadog Audit Trail to investigate user activity, configuration changes, and compliance events using the pup audit-logs command. Covers security investigations (who changed what), key compromise auditing, cost spike root cause analysis, SOC 2/PCI compliance reporting, and AI assistant activity tracking.

Generated from the current SKILL.md.

Frequently asked

What time window can I query?
Default retention is 90 days. Queries beyond 90 days require archive configuration to S3/GCS/Azure Blob. Always verify the requested time window falls within retention before running a query.
What permissions do I need?
The API key or app key must have the `audit_logs_read` scope. Use OAuth2 login with `pup auth login` or set DD_API_KEY and DD_APP_KEY with the appropriate scope.
Can I audit AI assistant activity?
Yes. The skill includes an ai-activity-audit sub-skill for auditing MCP tool calls and generating AI governance reports.
What fields can I search on?
You can filter by user email, actor type, action verb, event category, resource type, API/app key ID, client IP, geolocation, and HTTP path using Lucene-style syntax matching the Log Explorer syntax.
What should I do if a query times out?
Narrow the time window or add more filters to reduce the result set scope.

Generated from the current SKILL.md. These answers refresh after source changes.