Dd Audit Compliance Report

by datadog-labs5b40c73824ecNo license177 starsListed Oct 8, 2026Updated Oct 8, 2026Repository updated today

Generate auditor-ready compliance evidence from Datadog Audit Trail for SOC 2 and PCI DSS. Maps framework controls to specific query patterns and produces formatted output.

Instructions onlySecurity Business & Finance

AI-generated overview

Generates auditor-ready SOC 2 and PCI DSS compliance evidence reports from Datadog Audit Trail logs.

What it does: This skill guides an agent through producing compliance evidence reports from Datadog Audit Trail. It maps SOC 2 and PCI DSS controls to specific Datadog audit-log query patterns, runs a retention check, and formats the collected events into a structured evidence report with per-control tables and a gaps section. It also documents scope boundaries, noting that the evidence covers the Datadog platform rather than the cardholder data environment.
When to use it: Use it when preparing audit evidence for SOC 2 or PCI DSS from Datadog Audit Trail, such as gathering user provisioning, role change, failed login, or privileged action records for a defined period. It suits compliance and audit preparation work where control-to-query mapping and a formatted report are needed.
Requirements: Requires the Datadog pup CLI with authentication (OAuth2 via pup auth login, or DD_API_KEY and DD_APP_KEY with audit_logs_read scope), jq for JSON processing, and network access to Datadog. It ships no scripts; it is instructions only, plus a reference file with the control-to-query mapping and retention requirements.

Audit Trail: Compliance Evidence Report

Generate auditor-ready evidence from Datadog Audit Trail for SOC 2 and PCI DSS control requirements.

Prerequisites

bash

pup auth login   # OAuth2 (recommended)# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

pup auth login   # OAuth2 (recommended)# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

Read First

See references/control-mapping.md for the full control → query mapping table and retention requirements by framework.

Retention Check (Run First)

PCI requires 12 months. Datadog default retention is 90 days. Check whether archive is configured:

bash

pup audit-logs search --query "@evt.name:\"Audit Trail\" @action:modified" --from 90d -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource: .attributes.attributes.asset.type    }]'

pup audit-logs search --query "@evt.name:\"Audit Trail\" @action:modified" --from 90d -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource: .attributes.attributes.asset.type    }]'

If the requested time window exceeds 90 days and no archive is confirmed, surface this gap in the report header.

Workflow

Confirm: framework (SOC 2 / PCI DSS), time window, org scope
Run retention check
Run each relevant control query
Format output using the Evidence Report template

SOC 2 Queries

CC6.2 — User Provisioning / Deprovisioning

bash

pup audit-logs search \  --query "@evt.name:\"Access Management\" @asset.type:user @action:(created OR deleted OR modified)" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      affected_user: .attributes.attributes.asset.id    }]'

pup audit-logs search \  --query "@evt.name:\"Access Management\" @asset.type:user @action:(created OR deleted OR modified)" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      affected_user: .attributes.attributes.asset.id    }]'

CC6.3 — Role and Permission Changes

bash

pup audit-logs search \  --query "@evt.name:\"Access Management\" @asset.type:role" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      role_id: .attributes.attributes.asset.id    }]'

pup audit-logs search \  --query "@evt.name:\"Access Management\" @asset.type:role" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      role_id: .attributes.attributes.asset.id    }]'

CC6.6 — Failed Logins and Suspicious Access

bash

pup audit-logs search \  --query "@evt.name:Authentication @action:login @status:error" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      ip: .attributes.attributes.network.client.ip,      country: .attributes.attributes.network.client.geoip.country.name    }]'

pup audit-logs search \  --query "@evt.name:Authentication @action:login @status:error" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      ip: .attributes.attributes.network.client.ip,      country: .attributes.attributes.network.client.geoip.country.name    }]'

CC7.2 — Privileged / Support User Actions

bash

pup audit-logs search \  --query "@evt.actor.type:SUPPORT_USER" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      support_actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id    }]'

pup audit-logs search \  --query "@evt.actor.type:SUPPORT_USER" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      support_actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id    }]'

PCI DSS Queries

PCI 10.2.2 — Actions by Privileged Users

Same as CC7.2 above. Also include org-level admin actions:

bash

pup audit-logs search \  --query "@evt.name:\"Organization Management\"" \  --from PERIOD_START --to PERIOD_END --limit 200 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type    }]'

pup audit-logs search \  --query "@evt.name:\"Organization Management\"" \  --from PERIOD_START --to PERIOD_END --limit 200 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type    }]'

PCI 10.2.3 — Access to Audit Trail Itself

bash

pup audit-logs search \  --query "@evt.name:\"Audit Trail\"" \  --from PERIOD_START --to PERIOD_END --limit 200 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type    }]'

pup audit-logs search \  --query "@evt.name:\"Audit Trail\"" \  --from PERIOD_START --to PERIOD_END --limit 200 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type    }]'

PCI 10.2.4 — Invalid Access Attempts

Same as CC6.6 failed logins above.

PCI 10.2.5 — All Authentication Events

bash

pup audit-logs search \  --query "@evt.name:Authentication @action:login" \  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      auth_method: .attributes.attributes.auth_method,      result: .attributes.attributes.status,      ip: .attributes.attributes.network.client.ip,      country: .attributes.attributes.network.client.geoip.country.name    }]'

pup audit-logs search \  --query "@evt.name:Authentication @action:login" \  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      auth_method: .attributes.attributes.auth_method,      result: .attributes.attributes.status,      ip: .attributes.attributes.network.client.ip,      country: .attributes.attributes.network.client.geoip.country.name    }]'

PCI 10.2.7 — Object Creation and Deletion

bash

pup audit-logs search \  --query "@action:(created OR deleted)" \  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id,      ip: .attributes.attributes.network.client.ip    }]'

pup audit-logs search \  --query "@action:(created OR deleted)" \  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id,      ip: .attributes.attributes.network.client.ip    }]'

Evidence Report Template

# Datadog Audit Trail — Compliance Evidence ReportFramework: [SOC 2 / PCI DSS]Organization: [org name]Period: [start] to [end]Generated: [date]
## Scope BoundaryThis report covers administrative actions within the Datadog platform.It does not cover actions taken within systems that Datadog monitors.
## Retention Status[✓ Full period covered by Audit Trail retention][⚠ Requested period exceeds 90-day default. Archive config required for complete coverage.]
---
## [Control ID] — [Control Name]Events found: [N]
| Timestamp | Actor | Action | Resource Type | Resource ID | IP | Country ||-----------|-------|--------|---------------|-------------|-----|---------|| ...       | ...   | ...    | ...           | ...         | ... | ...     |
[Repeat per control]
---
## Gaps[List any controls where data was unavailable or incomplete, and why]

# Datadog Audit Trail — Compliance Evidence ReportFramework: [SOC 2 / PCI DSS]Organization: [org name]Period: [start] to [end]Generated: [date]
## Scope BoundaryThis report covers administrative actions within the Datadog platform.It does not cover actions taken within systems that Datadog monitors.
## Retention Status[✓ Full period covered by Audit Trail retention][⚠ Requested period exceeds 90-day default. Archive config required for complete coverage.]
---
## [Control ID] — [Control Name]Events found: [N]
| Timestamp | Actor | Action | Resource Type | Resource ID | IP | Country ||-----------|-------|--------|---------------|-------------|-----|---------|| ...       | ...   | ...    | ...           | ...         | ... | ...     |
[Repeat per control]
---
## Gaps[List any controls where data was unavailable or incomplete, and why]

Scope Caveat

Datadog Audit Trail covers the Datadog platform as the system being audited. For PCI purposes, this is evidence that the monitoring platform's access controls are functioning — not direct evidence about the cardholder data environment (CDE) itself. Auditors should understand this scope boundary.

References

Source and attribution

Source:datadog-labs/agent-skillsindd-audit/compliance-reportat commit5b40c73

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

Dd Audit Compliance Report

Audit Trail: Compliance Evidence Report

Prerequisites

Read First

Retention Check (Run First)

Workflow

SOC 2 Queries

CC6.2 — User Provisioning / Deprovisioning

CC6.3 — Role and Permission Changes

CC6.6 — Failed Logins and Suspicious Access

CC7.2 — Privileged / Support User Actions

PCI DSS Queries

PCI 10.2.2 — Actions by Privileged Users

PCI 10.2.3 — Access to Audit Trail Itself

PCI 10.2.4 — Invalid Access Attempts

PCI 10.2.5 — All Authentication Events

PCI 10.2.7 — Object Creation and Deletion

Evidence Report Template

Scope Caveat

References

Source and attribution

More from datadog-labs/agent-skills

Upgrade Browser Sdk V7

Upgrade Browser Sdk V6

Dd Audit Security Investigation

Upgrade Browser Sdk V5

Dd Audit Key Compromise

Dd Audit Cost Spike Investigation

More in Security

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt

Secops Cases