Dd Audit Compliance Report

datadog-labs/agent-skills/dd-audit/compliance-report

作者 datadog-labs5b40c73824ec无许可证177 个星标收录于 2026年10月8日更新于 2026年10月8日仓库今天更新

Generate auditor-ready compliance evidence from Datadog Audit Trail for SOC 2 and PCI DSS. Maps framework controls to specific query patterns and produces formatted output.

仅含说明Security Business & Finance

AI 生成的概览

根据 Datadog Audit Trail 日志生成可供审计使用的 SOC 2 与 PCI DSS 合规证据报告。

功能: 该技能引导智能体从 Datadog Audit Trail 生成合规证据报告。它把 SOC 2 与 PCI DSS 控制项映射到具体的 Datadog 审计日志查询模式，执行保留期检查，并将收集到的事件整理为结构化证据报告，包含按控制项分列的事件表格和缺口部分。它还说明范围边界，指出证据覆盖的是 Datadog 平台，而非持卡人数据环境。
适用场景: 适用于需要从 Datadog Audit Trail 准备 SOC 2 或 PCI DSS 审计证据的场景，例如按指定时间段收集用户开通与注销、角色变更、登录失败或特权操作记录。适合需要控制项与查询映射并输出格式化报告的合规与审计准备工作。
运行要求: 需要 Datadog pup 命令行工具并完成身份验证（推荐通过 pup auth login 使用 OAuth2，或设置具有 audit_logs_read 权限的 DD_API_KEY 与 DD_APP_KEY），需要 jq 处理 JSON，并需要访问 Datadog 的网络连接。该技能不附带脚本，仅为说明文档，另含一份控制项与查询映射及保留期要求的参考文件。

Audit Trail: Compliance Evidence Report

Generate auditor-ready evidence from Datadog Audit Trail for SOC 2 and PCI DSS control requirements.

Prerequisites

bash

pup auth login   # OAuth2 (recommended)# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

pup auth login   # OAuth2 (recommended)# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

Read First

See references/control-mapping.md for the full control → query mapping table and retention requirements by framework.

Retention Check (Run First)

PCI requires 12 months. Datadog default retention is 90 days. Check whether archive is configured:

bash

pup audit-logs search --query "@evt.name:\"Audit Trail\" @action:modified" --from 90d -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource: .attributes.attributes.asset.type    }]'

pup audit-logs search --query "@evt.name:\"Audit Trail\" @action:modified" --from 90d -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource: .attributes.attributes.asset.type    }]'

If the requested time window exceeds 90 days and no archive is confirmed, surface this gap in the report header.

Workflow

Confirm: framework (SOC 2 / PCI DSS), time window, org scope
Run retention check
Run each relevant control query
Format output using the Evidence Report template

SOC 2 Queries

CC6.2 — User Provisioning / Deprovisioning

bash

pup audit-logs search \  --query "@evt.name:\"Access Management\" @asset.type:user @action:(created OR deleted OR modified)" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      affected_user: .attributes.attributes.asset.id    }]'

pup audit-logs search \  --query "@evt.name:\"Access Management\" @asset.type:user @action:(created OR deleted OR modified)" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      affected_user: .attributes.attributes.asset.id    }]'

CC6.3 — Role and Permission Changes

bash

pup audit-logs search \  --query "@evt.name:\"Access Management\" @asset.type:role" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      role_id: .attributes.attributes.asset.id    }]'

pup audit-logs search \  --query "@evt.name:\"Access Management\" @asset.type:role" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      role_id: .attributes.attributes.asset.id    }]'

CC6.6 — Failed Logins and Suspicious Access

bash

pup audit-logs search \  --query "@evt.name:Authentication @action:login @status:error" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      ip: .attributes.attributes.network.client.ip,      country: .attributes.attributes.network.client.geoip.country.name    }]'

pup audit-logs search \  --query "@evt.name:Authentication @action:login @status:error" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      ip: .attributes.attributes.network.client.ip,      country: .attributes.attributes.network.client.geoip.country.name    }]'

CC7.2 — Privileged / Support User Actions

bash

pup audit-logs search \  --query "@evt.actor.type:SUPPORT_USER" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      support_actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id    }]'

pup audit-logs search \  --query "@evt.actor.type:SUPPORT_USER" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      support_actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id    }]'

PCI DSS Queries

PCI 10.2.2 — Actions by Privileged Users

Same as CC7.2 above. Also include org-level admin actions:

bash

pup audit-logs search \  --query "@evt.name:\"Organization Management\"" \  --from PERIOD_START --to PERIOD_END --limit 200 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type    }]'

pup audit-logs search \  --query "@evt.name:\"Organization Management\"" \  --from PERIOD_START --to PERIOD_END --limit 200 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type    }]'

PCI 10.2.3 — Access to Audit Trail Itself

bash

pup audit-logs search \  --query "@evt.name:\"Audit Trail\"" \  --from PERIOD_START --to PERIOD_END --limit 200 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type    }]'

pup audit-logs search \  --query "@evt.name:\"Audit Trail\"" \  --from PERIOD_START --to PERIOD_END --limit 200 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type    }]'

PCI 10.2.4 — Invalid Access Attempts

Same as CC6.6 failed logins above.

PCI 10.2.5 — All Authentication Events

bash

pup audit-logs search \  --query "@evt.name:Authentication @action:login" \  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      auth_method: .attributes.attributes.auth_method,      result: .attributes.attributes.status,      ip: .attributes.attributes.network.client.ip,      country: .attributes.attributes.network.client.geoip.country.name    }]'

pup audit-logs search \  --query "@evt.name:Authentication @action:login" \  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      auth_method: .attributes.attributes.auth_method,      result: .attributes.attributes.status,      ip: .attributes.attributes.network.client.ip,      country: .attributes.attributes.network.client.geoip.country.name    }]'

PCI 10.2.7 — Object Creation and Deletion

bash

pup audit-logs search \  --query "@action:(created OR deleted)" \  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id,      ip: .attributes.attributes.network.client.ip    }]'

pup audit-logs search \  --query "@action:(created OR deleted)" \  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id,      ip: .attributes.attributes.network.client.ip    }]'

Evidence Report Template

# Datadog Audit Trail — Compliance Evidence ReportFramework: [SOC 2 / PCI DSS]Organization: [org name]Period: [start] to [end]Generated: [date]
## Scope BoundaryThis report covers administrative actions within the Datadog platform.It does not cover actions taken within systems that Datadog monitors.
## Retention Status[✓ Full period covered by Audit Trail retention][⚠ Requested period exceeds 90-day default. Archive config required for complete coverage.]
---
## [Control ID] — [Control Name]Events found: [N]
| Timestamp | Actor | Action | Resource Type | Resource ID | IP | Country ||-----------|-------|--------|---------------|-------------|-----|---------|| ...       | ...   | ...    | ...           | ...         | ... | ...     |
[Repeat per control]
---
## Gaps[List any controls where data was unavailable or incomplete, and why]

# Datadog Audit Trail — Compliance Evidence ReportFramework: [SOC 2 / PCI DSS]Organization: [org name]Period: [start] to [end]Generated: [date]
## Scope BoundaryThis report covers administrative actions within the Datadog platform.It does not cover actions taken within systems that Datadog monitors.
## Retention Status[✓ Full period covered by Audit Trail retention][⚠ Requested period exceeds 90-day default. Archive config required for complete coverage.]
---
## [Control ID] — [Control Name]Events found: [N]
| Timestamp | Actor | Action | Resource Type | Resource ID | IP | Country ||-----------|-------|--------|---------------|-------------|-----|---------|| ...       | ...   | ...    | ...           | ...         | ... | ...     |
[Repeat per control]
---
## Gaps[List any controls where data was unavailable or incomplete, and why]

Scope Caveat

Datadog Audit Trail covers the Datadog platform as the system being audited. For PCI purposes, this is evidence that the monitoring platform's access controls are functioning — not direct evidence about the cardholder data environment (CDE) itself. Auditors should understand this scope boundary.

References

来源与署名

来源：datadog-labs/agent-skills位于dd-audit/compliance-report提交5b40c73

许可证：无许可证

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

Dd Audit Compliance Report

Audit Trail: Compliance Evidence Report

Prerequisites

Read First

Retention Check (Run First)

Workflow

SOC 2 Queries

CC6.2 — User Provisioning / Deprovisioning

CC6.3 — Role and Permission Changes

CC6.6 — Failed Logins and Suspicious Access

CC7.2 — Privileged / Support User Actions

PCI DSS Queries

PCI 10.2.2 — Actions by Privileged Users

PCI 10.2.3 — Access to Audit Trail Itself

PCI 10.2.4 — Invalid Access Attempts

PCI 10.2.5 — All Authentication Events

PCI 10.2.7 — Object Creation and Deletion

Evidence Report Template

Scope Caveat

References

来源与署名

更多来自 datadog-labs/agent-skills 的技能

Upgrade Browser Sdk V7

Upgrade Browser Sdk V6

Dd Audit Security Investigation

Upgrade Browser Sdk V5

Dd Audit Key Compromise

Dd Audit Cost Spike Investigation

更多Security技能

Kyc Rules

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt