Dd Audit Ai Activity

by datadog-labs5b40c73824ecNo license177 starsListed Oct 8, 2026Updated Oct 8, 2026Repository updated today

Audit what the Bits AI assistant (MCP server) has done in your Datadog org — tool calls by user, resources accessed, and anomaly flags for AI governance.

Instructions onlySecurity Business & Finance

AI-generated overview

Audits Datadog Bits AI MCP tool activity via Audit Trail, showing users, actions, resources and anomaly flags.

What it does: This skill provides a set of Datadog Audit Trail queries that surface what the Bits AI assistant (MCP server) has done in an organization. It reports tool calls by user, actions taken, affected resource types and IDs, client IP and country, and produces a weekly summary with totals, top users, action breakdowns and resource types. It also lists anomaly signals such as destructive AI actions, support-user activity, first-time users, high call volume and out-of-scope resource access, and defines a text output format for the audit report.
When to use it: Use it for security reviews of AI actions, compliance audits that need AI activity to be logged and attributable, and governance reporting on AI assistant adoption and risk. It fits when you need to know which users invoked the Datadog AI assistant and what it changed.
Requirements: Requires the pup CLI with Datadog access, authenticated via pup auth login (OAuth2) or DD_API_KEY and DD_APP_KEY with the audit_logs_read scope, plus jq for the JSON pipelines. Network access to Datadog Audit Trail is needed. It ships no scripts; it is instructions and shell queries only.

Audit Trail: AI Activity Audit

Every Datadog MCP tool call is recorded in Audit Trail under the Bits AI SRE category. This skill surfaces what the AI assistant has done in your org — which users invoked it, which tools were called, and which resources were affected.

Prerequisites

bash

pup auth login   # OAuth2 (recommended)# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

pup auth login   # OAuth2 (recommended)# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

Queries

All MCP tool activity in a time window

bash

pup audit-logs search --query "@evt.name:\"MCP Server\"" --from 7d --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      actor_type: .attributes.attributes.evt.actor.type,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id,      ip: .attributes.attributes.network.client.ip,      country: .attributes.attributes.network.client.geoip.country.name    }]'

pup audit-logs search --query "@evt.name:\"MCP Server\"" --from 7d --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      actor_type: .attributes.attributes.evt.actor.type,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id,      ip: .attributes.attributes.network.client.ip,      country: .attributes.attributes.network.client.geoip.country.name    }]'

Activity by user (who is using the AI assistant most?)

bash

pup audit-logs search --query "@evt.name:\"MCP Server\"" --from 30d --limit 1000 -o json \  | jq '[.data[] | .attributes.attributes.usr.email]    | group_by(.)    | map({user: .[0], tool_calls: length})    | sort_by(-.tool_calls)'

pup audit-logs search --query "@evt.name:\"MCP Server\"" --from 30d --limit 1000 -o json \  | jq '[.data[] | .attributes.attributes.usr.email]    | group_by(.)    | map({user: .[0], tool_calls: length})    | sort_by(-.tool_calls)'

Resources modified by AI tool calls

bash

pup audit-logs search \  --query "@evt.name:\"MCP Server\" @action:(created OR modified OR deleted)" \  --from 7d --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id    }]'

pup audit-logs search \  --query "@evt.name:\"MCP Server\" @action:(created OR modified OR deleted)" \  --from 7d --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id    }]'

AI activity for a specific user

bash

pup audit-logs search \  --query "@evt.name:\"MCP Server\" @usr.email:[email protected]" \  --from 30d --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id    }]'

pup audit-logs search \  --query "@evt.name:\"MCP Server\" @usr.email:[email protected]" \  --from 30d --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id    }]'

Weekly summary report

bash

pup audit-logs search --query "@evt.name:\"MCP Server\"" --from 7d --limit 1000 -o json \  | jq '{      total_tool_calls: (.data | length),      unique_users: ([.data[] | .attributes.attributes.usr.email] | unique | length),      top_users: (        [.data[] | .attributes.attributes.usr.email]        | group_by(.)        | map({user: .[0], calls: length})        | sort_by(-.calls)        | .[:5]      ),      actions_breakdown: (        [.data[] | .attributes.attributes.action]        | group_by(.)        | map({action: .[0], count: length})        | sort_by(-.count)      ),      resource_types: (        [.data[] | .attributes.attributes.asset.type]        | group_by(.)        | map({type: .[0], count: length})        | sort_by(-.count)      )    }'

pup audit-logs search --query "@evt.name:\"MCP Server\"" --from 7d --limit 1000 -o json \  | jq '{      total_tool_calls: (.data | length),      unique_users: ([.data[] | .attributes.attributes.usr.email] | unique | length),      top_users: (        [.data[] | .attributes.attributes.usr.email]        | group_by(.)        | map({user: .[0], calls: length})        | sort_by(-.calls)        | .[:5]      ),      actions_breakdown: (        [.data[] | .attributes.attributes.action]        | group_by(.)        | map({action: .[0], count: length})        | sort_by(-.count)      ),      resource_types: (        [.data[] | .attributes.attributes.asset.type]        | group_by(.)        | map({type: .[0], count: length})        | sort_by(-.count)      )    }'

Anomaly Flags

Signal	Governance concern
AI performing `deleted` actions on monitors or dashboards	Review whether destructive AI operations are expected
AI acting as `SUPPORT_USER`	Datadog support using AI on behalf of org
First-time user invoking AI tools	New user accessing AI assistant
High volume of tool calls in short window	Automated/batch AI usage
AI accessing resources outside user's normal scope	Potential over-permissioned AI session

Output Format

AI Activity Audit — [Org] — [Date Range]
Total MCP tool calls: [N]Unique users: [N]
Top users:  [[email protected]]: [N] calls
Actions breakdown:  accessed: [N]  modified: [N]  created: [N]  deleted: [N]
Resource types affected:  dashboard: [N]  monitor: [N]
Anomalies:  [List any flagged events with timestamp, user, action, resource]

AI Activity Audit — [Org] — [Date Range]
Total MCP tool calls: [N]Unique users: [N]
Top users:  [[email protected]]: [N] calls
Actions breakdown:  accessed: [N]  modified: [N]  created: [N]  deleted: [N]
Resource types affected:  dashboard: [N]  monitor: [N]
Anomalies:  [List any flagged events with timestamp, user, action, resource]

Context

This skill is most useful for:

Security reviews: Verifying AI actions were authorized and within expected scope
Compliance audits: Demonstrating AI activity is logged and attributable to specific users
Governance reports: Understanding adoption and risk surface of the AI assistant across the org

No other observability vendor audits their AI assistant's actions at this level of detail.

References

Source and attribution

Source:datadog-labs/agent-skillsindd-audit/ai-activity-auditat commit5b40c73

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

Dd Audit Ai Activity

Audit Trail: AI Activity Audit

Prerequisites

Queries

All MCP tool activity in a time window

Activity by user (who is using the AI assistant most?)

Resources modified by AI tool calls

AI activity for a specific user

Weekly summary report

Anomaly Flags

Output Format

Context

References

Source and attribution

More from datadog-labs/agent-skills

Upgrade Browser Sdk V7

Upgrade Browser Sdk V6

Dd Audit Security Investigation

Upgrade Browser Sdk V5

Dd Audit Key Compromise

Dd Audit Cost Spike Investigation

More in Security

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt

Secops Cases