Dd Audit

by datadog-labs5b40c73824ecNo license177 starsListed Oct 8, 2026Updated Oct 8, 2026Repository updated today

Audit Trail investigations - who changed what, key compromise, cost spike root cause, compliance evidence (SOC 2/PCI), and AI activity auditing.

Instructions onlySecurity Business & Finance

AI-generated overview

Investigates Datadog Audit Trail logs for user activity, key compromise, cost spikes, compliance evidence, and AI activity.

What it does: This skill guides an agent through investigating Datadog Audit Trail events using the pup audit-logs command-line tool. It covers five sub-skills: security investigation of who changed what, API key compromise checks, cost spike root cause analysis, compliance evidence reports such as SOC 2 and PCI, and AI activity auditing. It supplies the event schema, Lucene-style search syntax, retention limits, and troubleshooting guidance needed to run and interpret queries.
When to use it: Use it when you need to answer questions about who changed a Datadog resource, whether an API key was compromised, why usage or LLM costs spiked, or what an AI assistant or MCP tool calls did. It also fits producing audit evidence for compliance auditors.
Requirements: Requires the pup CLI with Datadog authentication, either via pup auth login (OAuth2) or DD_API_KEY and DD_APP_KEY with the audit_logs_read scope, plus network access to Datadog. Queries beyond the default 90-day retention need archive configuration. Ships no scripts; instructions only.

Datadog Audit Trail

Investigate user activity, configuration changes, access patterns, and compliance evidence using pup audit-logs.

Sub-Skills

Sub-skill	Use when
security-investigation	"Who changed X?", "What did this user do?", "Show me deletions in the last 24h"
key-compromise	"Was this API key compromised?", "What did key XYZ do?", "Investigate suspicious key activity"
cost-spike-investigation	"Why did my bill go up?", "What caused this usage spike?", "Investigate LLM cost increase"
compliance-report	"Generate SOC 2 evidence", "PCI audit log", "User provisioning report for auditor"
ai-activity-audit	"What did the AI assistant do?", "Audit MCP tool calls", "AI governance report"

Prerequisites

bash

pup auth login   # OAuth2 (recommended)# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

pup auth login   # OAuth2 (recommended)# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

Commands

bash

# List recent eventspup audit-logs list --from 1h --limit 100
# Search with a querypup audit-logs search --query "@action:deleted" --from 24h
# JSON output for piping to jqpup audit-logs search --query "@usr.email:[email protected]" --from 7d -o json | jq '.data[].attributes'

# List recent eventspup audit-logs list --from 1h --limit 100
# Search with a querypup audit-logs search --query "@action:deleted" --from 24h
# JSON output for piping to jqpup audit-logs search --query "@usr.email:[email protected]" --from 7d -o json | jq '.data[].attributes'

Event Schema Quick Reference

Field	Description	Example values
`@usr.email`	Actor email	`[email protected]`
`@evt.actor.type`	How action was taken	`USER`, `API_KEY`, `SUPPORT_USER`
`@action`	Verb	`created`, `modified`, `deleted`, `accessed`, `login`
`@evt.name`	Event category	`Dashboard`, `Monitor`, `Authentication`, `Access Management`
`@asset.type`	Resource type	`dashboard`, `monitor`, `api_key`, `role`, `user`
`@asset.id`	Resource identifier	`abc-123`
`@metadata.api_key.id`	API key used (if applicable)	`key_abc123`
`@metadata.app_key.id`	App key used (if applicable)	`app_abc123`
`@network.client.ip`	Client IP address	`1.2.3.4`
`@network.client.geoip.country.name`	Country	`United States`
`@network.client.geoip.as.name`	ASN name	`Amazon.com`
`@http.url_details.path`	API endpoint path	`/api/v1/dashboard/xyz`

Search Syntax

Same Lucene-style syntax as Log Explorer:

Query	Meaning
`@evt.name:Dashboard`	Exact field match
`@action:deleted`	Action filter
`@usr.email:[email protected]`	Specific user
`@evt.name:Monitor AND @action:modified`	Compound
`-@action:deleted`	Negation
`@usr.email:*`	Field exists
`@network.client.ip:1.2.3.4`	IP filter

Retention

Default retention is 90 days. If querying beyond 90 days, archive to S3/GCS/Azure Blob must be configured. Always check whether the requested time window falls within retention before running a query.

Troubleshooting

Problem	Cause	Fix
403 Forbidden	Missing `audit_logs_read` scope	Add scope to app key in Datadog UI
Empty results	Time window outside retention	Check archive config; default max is 90 days
Timeout	Query too broad	Narrow time window or add more filters
No IP data	Internal action or pre-enrichment event	Not all events have geo data

References

Source and attribution

Source:datadog-labs/agent-skillsindd-auditat commit5b40c73

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

Dd Audit

Datadog Audit Trail

Sub-Skills

Prerequisites

Commands

Event Schema Quick Reference

Search Syntax

Retention

Troubleshooting

References

Source and attribution

More from datadog-labs/agent-skills

Upgrade Browser Sdk V7

Upgrade Browser Sdk V6

Dd Audit Security Investigation

Upgrade Browser Sdk V5

Dd Audit Key Compromise

Dd Audit Cost Spike Investigation

More in Security

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt

Secops Cases